@shware/security 4.0.0 → 5.0.0

package/dist/oauth2/client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.cjs","names":["object","optional","string"],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport type {\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  private async getClientConfig(registrationId: string) {\n    const registrations =\n      typeof this.config.registration === 'function'\n        ? await this.config.registration()\n        : this.config.registration;\n\n    const registration = registrations[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  async createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = await this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;;AAUA,MAAa,6BAAA,GAA4BA,YAAAA,OAAAA,CAAO;CAC9C,OAAA,GAAMC,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACvB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,oBAAA,GAAmBD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACpC,YAAA,GAAWD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;AAC9B,CAAC;AAED,MAAa,sBAAA,GAAqBF,YAAAA,OAAAA,CAAO;CAEvC,OAAA,GAAMC,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACvB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,oBAAA,GAAmBD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACpC,YAAA,GAAWD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAC5B,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,eAAA,GAAcD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAC/B,KAAA,GAAID,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAErB,aAAA,GAAYD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;CAEA,MAAc,gBAAgB,gBAAwB;EAMpD,MAAM,gBAJJ,OAAO,KAAK,OAAO,iBAAiB,aAChC,MAAM,KAAK,OAAO,aAAa,IAC/B,KAAK,OAAO,aAAA,CAEiB;EACnC,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,gBAAgB,eAAe,WAAW;EAElE,MAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY;EAC/D,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,YAAY,aAAa,YAAY,eAAe,WAAW;EACnF,OAAO;GAAE;GAAc;EAAS;CAClC;CAEA,MAAM,uBAAuB,EAC3B,gBACA,OACA,QAKe;EACf,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,OAAO,UAAU,gBAAgB;EACzC,OAAO,SAAS,uBAAuB;GACrC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,0BAA0B,EAC9B,gBACA,MACA,QAKuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAChD,OAAO,SAAS,0BAA0B;GACxC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,YAAY,EAChB,gBACA,SAIC;EACD,MAAM,EAAE,aAAa,MAAM,KAAK,gBAAgB,cAAc;EAC9D,OAAO,SAAS,YAAY,KAAK;CACnC;CAEA,MAAM,mBAAmB,EACvB,gBACA,gBAIuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,oBAAoB,8CAA8C;EACrF,OAAO,SAAS,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CAC7E;CAEA,MAAM,YAAY,gBAAwB,OAAe;EACvD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,aAAa,uCAAuC;EACvE,MAAM,SAAS,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CAC9D;CAEA,MAAM,kBAAkB,EACtB,gBACA,aACA,QAKC;EACD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,mBAAmB,6CAA6C;EACnF,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAEhD,OAAO,SAAS,kBAAkB;GAChC;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;GAC5D;GACA;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"client.cjs","names":["object","optional","string","OAuth2Error"],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport { OAuth2Error } from './error';\nimport type {\n  AuthorizationResponse,\n  ClientSecret,\n  NativeClient,\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  OneTapProvider,\n  PkceParameters,\n  Provider,\n  ProviderConfig,\n  WebClient,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  // Apple's form_post: the user's name as JSON, first authorization only.\n  user: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  /** The provider key comes from the request path, so an unknown one is the caller's error. */\n  private async getProviderConfig(provider: string): Promise<ProviderConfig> {\n    const providers =\n      typeof this.config.providers === 'function'\n        ? await this.config.providers()\n        : this.config.providers;\n    const config = Object.hasOwn(providers, provider) ? providers[provider] : undefined;\n    if (!config) throw new OAuth2Error(400, 'invalid_request', `Unknown provider: ${provider}`);\n    return config;\n  }\n\n  private defaultRedirectUri(provider: string) {\n    return `${this.config.baseUri}/login/oauth2/code/${provider}`;\n  }\n\n  /** The redirect flow and One Tap sign in as the provider's web client. */\n  private async getWebClient(provider: string) {\n    const config = await this.getProviderConfig(provider);\n    if (!config.web) {\n      throw new OAuth2Error(400, 'invalid_request', `Provider ${provider} has no web client`);\n    }\n    return { implementation: config.provider, client: config.web };\n  }\n\n  /**\n   * Any configured client of the provider, looked up by id: refresh and revoke use the client a\n   * token was issued to, and the native login the one the app names. The web client counts too:\n   * an Android app's server auth code and a Facebook app's tokens are issued to it.\n   */\n  private async getClient(provider: string, clientId: string) {\n    const config = await this.getProviderConfig(provider);\n    const client = [config.web, ...(config.native ?? [])].find((c) => c?.clientId === clientId);\n    if (!client) {\n      throw new OAuth2Error(400, 'invalid_client', `${clientId} is not a client of ${provider}`);\n    }\n    return { implementation: config.provider, client };\n  }\n\n  /**\n   * The client a native login signs in as: the one the app names with `client_id`, which must be\n   * configured; without one, the only native client, or the web client when there is no native\n   * one. Several native clients and no `client_id` is ambiguous and refused rather than guessed.\n   */\n  private async getNativeClient(provider: string, clientId: string | undefined) {\n    if (clientId !== undefined) return this.getClient(provider, clientId);\n    const config = await this.getProviderConfig(provider);\n    const native = config.native ?? [];\n    const client: WebClient | NativeClient | undefined =\n      native.length === 0 ? config.web : native.length === 1 ? native[0] : undefined;\n    if (!client) {\n      throw new OAuth2Error(400, 'invalid_request', `client_id is required for ${provider}`);\n    }\n    return { implementation: config.provider, client };\n  }\n\n  private async resolveSecret(secret: ClientSecret | undefined, clientId: string) {\n    return typeof secret === 'function' ? secret(clientId) : secret;\n  }\n\n  async createAuthorizationUri({\n    provider,\n    state,\n    pkce,\n  }: {\n    provider: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { implementation, client } = await this.getWebClient(provider);\n    return implementation.createAuthorizationUri({\n      pkce,\n      state,\n      scope: client.scope,\n      clientId: client.clientId,\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n    });\n  }\n\n  /** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */\n  async exchangeAuthorizationCode({\n    provider,\n    code,\n    pkce,\n  }: {\n    provider: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<{ clientId: string; token: OAuth2Token }> {\n    const { implementation, client } = await this.getWebClient(provider);\n    const { clientId } = client;\n    const token = await implementation.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret: await this.resolveSecret(client.clientSecret, clientId),\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n    });\n    return { clientId, token };\n  }\n\n  /** `clientId` is the client the token was issued to, as `exchangeAuthorizationCode` returns it. */\n  async getUserInfo({\n    provider,\n    clientId,\n    token,\n    response,\n  }: {\n    provider: string;\n    clientId: string;\n    token: OAuth2Token | OidcToken;\n    response?: AuthorizationResponse;\n  }) {\n    const { implementation } = await this.getClient(provider, clientId);\n    return implementation.getUserInfo(token, { clientId, response });\n  }\n\n  /** Verifies a Google One Tap / FedCM credential, which is issued to the web client. */\n  async getTokenInfo({ provider, credential }: { provider: string; credential: string }) {\n    const { implementation, client } = await this.getWebClient(provider);\n    if (!isOneTapProvider(implementation)) {\n      throw new OAuth2Error(400, 'invalid_request', `Provider ${provider} has no One Tap`);\n    }\n    const { clientId } = client;\n    return { clientId, ...(await implementation.getTokenInfo(credential, clientId)) };\n  }\n\n  async refreshAccessToken({\n    provider,\n    clientId,\n    refreshToken,\n  }: {\n    provider: string;\n    clientId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { implementation, client } = await this.getClient(provider, clientId);\n    invariant(implementation.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    const clientSecret = await this.resolveSecret(client.clientSecret, clientId);\n    return implementation.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken({\n    provider,\n    clientId,\n    token,\n  }: {\n    provider: string;\n    clientId: string;\n    token: string;\n  }) {\n    const { implementation, client } = await this.getClient(provider, clientId);\n    invariant(implementation.revokeToken, 'Provider does not support revokeToken');\n    const clientSecret = await this.resolveSecret(client.clientSecret, clientId);\n    await implementation.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    provider,\n    credentials,\n    pkce,\n  }: {\n    provider: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { implementation, client } = await this.getNativeClient(provider, credentials.client_id);\n    invariant(implementation.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { clientId } = client;\n\n    const result = await implementation.loginOAuth2Native({\n      clientId,\n      clientSecret: await this.resolveSecret(client.clientSecret, clientId),\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n      credentials,\n      pkce,\n    });\n    return { clientId, ...result };\n  }\n}\n\nfunction isOneTapProvider(provider: Provider): provider is OneTapProvider {\n  return typeof (provider as Partial<OneTapProvider>).getTokenInfo === 'function';\n}\n"],"mappings":";;;;;AAkBA,MAAa,6BAAA,GAA4BA,YAAAA,OAAAA,CAAO;CAC9C,OAAA,GAAMC,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACvB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,oBAAA,GAAmBD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACpC,YAAA,GAAWD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAE5B,OAAA,GAAMD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;AACzB,CAAC;AAED,MAAa,sBAAA,GAAqBF,YAAAA,OAAAA,CAAO;CAEvC,OAAA,GAAMC,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACvB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,oBAAA,GAAmBD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACpC,YAAA,GAAWD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAC5B,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,eAAA,GAAcD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAC/B,KAAA,GAAID,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAErB,aAAA,GAAYD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;;CAGA,MAAc,kBAAkB,UAA2C;EACzE,MAAM,YACJ,OAAO,KAAK,OAAO,cAAc,aAC7B,MAAM,KAAK,OAAO,UAAU,IAC5B,KAAK,OAAO;EAClB,MAAM,SAAS,OAAO,OAAO,WAAW,QAAQ,IAAI,UAAU,YAAY,KAAA;EAC1E,IAAI,CAAC,QAAQ,MAAM,IAAIC,qBAAAA,YAAY,KAAK,mBAAmB,qBAAqB,UAAU;EAC1F,OAAO;CACT;CAEA,mBAA2B,UAAkB;EAC3C,OAAO,GAAG,KAAK,OAAO,QAAQ,qBAAqB;CACrD;;CAGA,MAAc,aAAa,UAAkB;EAC3C,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,IAAI,CAAC,OAAO,KACV,MAAM,IAAIA,qBAAAA,YAAY,KAAK,mBAAmB,YAAY,SAAS,mBAAmB;EAExF,OAAO;GAAE,gBAAgB,OAAO;GAAU,QAAQ,OAAO;EAAI;CAC/D;;;;;;CAOA,MAAc,UAAU,UAAkB,UAAkB;EAC1D,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,MAAM,SAAS,CAAC,OAAO,KAAK,GAAI,OAAO,UAAU,CAAC,CAAE,CAAC,CAAC,MAAM,MAAM,GAAG,aAAa,QAAQ;EAC1F,IAAI,CAAC,QACH,MAAM,IAAIA,qBAAAA,YAAY,KAAK,kBAAkB,GAAG,SAAS,sBAAsB,UAAU;EAE3F,OAAO;GAAE,gBAAgB,OAAO;GAAU;EAAO;CACnD;;;;;;CAOA,MAAc,gBAAgB,UAAkB,UAA8B;EAC5E,IAAI,aAAa,KAAA,GAAW,OAAO,KAAK,UAAU,UAAU,QAAQ;EACpE,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,MAAM,SAAS,OAAO,UAAU,CAAC;EACjC,MAAM,SACJ,OAAO,WAAW,IAAI,OAAO,MAAM,OAAO,WAAW,IAAI,OAAO,KAAK,KAAA;EACvE,IAAI,CAAC,QACH,MAAM,IAAIA,qBAAAA,YAAY,KAAK,mBAAmB,6BAA6B,UAAU;EAEvF,OAAO;GAAE,gBAAgB,OAAO;GAAU;EAAO;CACnD;CAEA,MAAc,cAAc,QAAkC,UAAkB;EAC9E,OAAO,OAAO,WAAW,aAAa,OAAO,QAAQ,IAAI;CAC3D;CAEA,MAAM,uBAAuB,EAC3B,UACA,OACA,QAKe;EACf,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,OAAO,eAAe,uBAAuB;GAC3C;GACA;GACA,OAAO,OAAO;GACd,UAAU,OAAO;GACjB,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;EACrE,CAAC;CACH;;CAGA,MAAM,0BAA0B,EAC9B,UACA,MACA,QAKoD;EACpD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,MAAM,EAAE,aAAa;EAQrB,OAAO;GAAE;GAAU,OAAA,MAPC,eAAe,0BAA0B;IAC3D;IACA;IACA;IACA,cAAc,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;IACpE,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;GACrE,CAAC;EACwB;CAC3B;;CAGA,MAAM,YAAY,EAChB,UACA,UACA,OACA,YAMC;EACD,MAAM,EAAE,mBAAmB,MAAM,KAAK,UAAU,UAAU,QAAQ;EAClE,OAAO,eAAe,YAAY,OAAO;GAAE;GAAU;EAAS,CAAC;CACjE;;CAGA,MAAM,aAAa,EAAE,UAAU,cAAwD;EACrF,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,IAAI,CAAC,iBAAiB,cAAc,GAClC,MAAM,IAAIA,qBAAAA,YAAY,KAAK,mBAAmB,YAAY,SAAS,gBAAgB;EAErF,MAAM,EAAE,aAAa;EACrB,OAAO;GAAE;GAAU,GAAI,MAAM,eAAe,aAAa,YAAY,QAAQ;EAAG;CAClF;CAEA,MAAM,mBAAmB,EACvB,UACA,UACA,gBAKuB;EACvB,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,UAAU,UAAU,QAAQ;EAC1E,CAAA,GAAA,cAAA,UAAA,CAAU,eAAe,oBAAoB,8CAA8C;EAC3F,MAAM,eAAe,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;EAC3E,OAAO,eAAe,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CACnF;CAEA,MAAM,YAAY,EAChB,UACA,UACA,SAKC;EACD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,UAAU,UAAU,QAAQ;EAC1E,CAAA,GAAA,cAAA,UAAA,CAAU,eAAe,aAAa,uCAAuC;EAC7E,MAAM,eAAe,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;EAC3E,MAAM,eAAe,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CACpE;CAEA,MAAM,kBAAkB,EACtB,UACA,aACA,QAKC;EACD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,gBAAgB,UAAU,YAAY,SAAS;EAC7F,CAAA,GAAA,cAAA,UAAA,CAAU,eAAe,mBAAmB,6CAA6C;EACzF,MAAM,EAAE,aAAa;EASrB,OAAO;GAAE;GAAU,GAAG,MAPD,eAAe,kBAAkB;IACpD;IACA,cAAc,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;IACpE,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;IACnE;IACA;GACF,CAAC;EAC4B;CAC/B;AACF;AAEA,SAAS,iBAAiB,UAAgD;CACxE,OAAO,OAAQ,SAAqC,iBAAiB;AACvE"}

package/dist/oauth2/client.d.cts

@@ -1,4 +1,4 @@
-import { NativeCredential, OAuth2ClientConfig, OAuth2Token, OidcToken, PkceParameters, UserInfo } from "./types.cjs";
+import { AuthorizationResponse, NativeCredential, OAuth2ClientConfig, OAuth2Token, OidcToken, PkceParameters, UserInfo } from "./types.cjs";
 //#region src/oauth2/client.d.ts
 export declare const oauth2RedirectQuerySchema: import("zod/mini").ZodMiniObject<{
   code: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
@@ -6,6 +6,7 @@ export declare const oauth2RedirectQuerySchema: import("zod/mini").ZodMiniObject
   error: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
   error_description: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
   error_uri: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  user: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
 }, import("zod/v4/core").$strip>;
 export declare const googleOneTapSchema: import("zod/mini").ZodMiniObject<{
   code: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
@@ -24,33 +25,72 @@ export declare class OAuth2Client {
   get baseUri(): string;
   get successUri(): string;
   get errorUri(): string;
-  private getClientConfig;
-  createAuthorizationUri({ registrationId, state, pkce }: {
-    registrationId: string;
+  /** The provider key comes from the request path, so an unknown one is the caller's error. */
+  private getProviderConfig;
+  private defaultRedirectUri;
+  /** The redirect flow and One Tap sign in as the provider's web client. */
+  private getWebClient;
+  /**
+   * Any configured client of the provider, looked up by id: refresh and revoke use the client a
+   * token was issued to, and the native login the one the app names. The web client counts too:
+   * an Android app's server auth code and a Facebook app's tokens are issued to it.
+   */
+  private getClient;
+  /**
+   * The client a native login signs in as: the one the app names with `client_id`, which must be
+   * configured; without one, the only native client, or the web client when there is no native
+   * one. Several native clients and no `client_id` is ambiguous and refused rather than guessed.
+   */
+  private getNativeClient;
+  private resolveSecret;
+  createAuthorizationUri({ provider, state, pkce }: {
+    provider: string;
     state: string;
     pkce?: PkceParameters;
   }): Promise<URL>;
-  exchangeAuthorizationCode({ registrationId, code, pkce }: {
-    registrationId: string;
+  /** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */
+  exchangeAuthorizationCode({ provider, code, pkce }: {
+    provider: string;
     code: string;
     pkce?: PkceParameters;
-  }): Promise<OAuth2Token>;
-  getUserInfo({ registrationId, token }: {
-    registrationId: string;
+  }): Promise<{
+    clientId: string;
+    token: OAuth2Token;
+  }>;
+  /** `clientId` is the client the token was issued to, as `exchangeAuthorizationCode` returns it. */
+  getUserInfo({ provider, clientId, token, response }: {
+    provider: string;
+    clientId: string;
     token: OAuth2Token | OidcToken;
+    response?: AuthorizationResponse;
   }): Promise<UserInfo<unknown>>;
-  refreshAccessToken({ registrationId, refreshToken }: {
-    registrationId: string;
+  /** Verifies a Google One Tap / FedCM credential, which is issued to the web client. */
+  getTokenInfo({ provider, credential }: {
+    provider: string;
+    credential: string;
+  }): Promise<{
+    token: OAuth2Token;
+    userInfo: UserInfo;
+    clientId: string;
+  }>;
+  refreshAccessToken({ provider, clientId, refreshToken }: {
+    provider: string;
+    clientId: string;
     refreshToken: string;
   }): Promise<OAuth2Token>;
-  revokeToken(registrationId: string, token: string): Promise<void>;
-  loginOAuth2Native({ registrationId, credentials, pkce }: {
-    registrationId: string;
+  revokeToken({ provider, clientId, token }: {
+    provider: string;
+    clientId: string;
+    token: string;
+  }): Promise<void>;
+  loginOAuth2Native({ provider, credentials, pkce }: {
+    provider: string;
     credentials: NativeCredential;
     pkce?: PkceParameters;
   }): Promise<{
     token: OAuth2Token;
     userInfo: UserInfo;
+    clientId: string;
   }>;
 }
 //#endregion

package/dist/oauth2/client.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.cts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAUa,8CAAyB;;;;;;yBAMpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;UAIU;EAcR,yBACJ,gBACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,4BACJ,gBACA,MACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,cACJ,gBACA;IAEA;IACA,OAAO,cAAc;MACtB,QADsBA;EAMjB,qBACJ,gBACA;IAEA;IACA;MACE,QAAQ;EAQN,YAAY,wBAAwB,gBAAa;EAQjD,oBACJ,gBACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}
+{"version":3,"file":"client.d.cts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAkBa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;;UAKU;UAUN;;UAKM;;;;;;UAaA;;;;;;UAcA;UAYA;EAIR,yBACJ,UACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;;EAYN,4BACJ,UACA,MACA;IAEA;IACA;IACA,OAAO;MACL;IAAU;IAAkB,OAAO;;;EAcjC,cACJ,UACA,UACA,OACA;IAEA;IACA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;;EAOP,eAAe,UAAU;IAAgB;IAAkB;MAAoB;;;;;EAS/E,qBACJ,UACA,UACA;IAEA;IACA;IACA;MACE,QAAQ;EAON,cACJ,UACA,UACA;IAEA;IACA;IACA;MACD;EAOK,oBACJ,UACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}

package/dist/oauth2/client.d.mts

@@ -1,4 +1,4 @@
-import { NativeCredential, OAuth2ClientConfig, OAuth2Token, OidcToken, PkceParameters, UserInfo } from "./types.mjs";
+import { AuthorizationResponse, NativeCredential, OAuth2ClientConfig, OAuth2Token, OidcToken, PkceParameters, UserInfo } from "./types.mjs";
 //#region src/oauth2/client.d.ts
 export declare const oauth2RedirectQuerySchema: import("zod/mini").ZodMiniObject<{
   code: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
@@ -6,6 +6,7 @@ export declare const oauth2RedirectQuerySchema: import("zod/mini").ZodMiniObject
   error: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
   error_description: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
   error_uri: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  user: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
 }, import("zod/v4/core").$strip>;
 export declare const googleOneTapSchema: import("zod/mini").ZodMiniObject<{
   code: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
@@ -24,33 +25,72 @@ export declare class OAuth2Client {
   get baseUri(): string;
   get successUri(): string;
   get errorUri(): string;
-  private getClientConfig;
-  createAuthorizationUri({ registrationId, state, pkce }: {
-    registrationId: string;
+  /** The provider key comes from the request path, so an unknown one is the caller's error. */
+  private getProviderConfig;
+  private defaultRedirectUri;
+  /** The redirect flow and One Tap sign in as the provider's web client. */
+  private getWebClient;
+  /**
+   * Any configured client of the provider, looked up by id: refresh and revoke use the client a
+   * token was issued to, and the native login the one the app names. The web client counts too:
+   * an Android app's server auth code and a Facebook app's tokens are issued to it.
+   */
+  private getClient;
+  /**
+   * The client a native login signs in as: the one the app names with `client_id`, which must be
+   * configured; without one, the only native client, or the web client when there is no native
+   * one. Several native clients and no `client_id` is ambiguous and refused rather than guessed.
+   */
+  private getNativeClient;
+  private resolveSecret;
+  createAuthorizationUri({ provider, state, pkce }: {
+    provider: string;
     state: string;
     pkce?: PkceParameters;
   }): Promise<URL>;
-  exchangeAuthorizationCode({ registrationId, code, pkce }: {
-    registrationId: string;
+  /** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */
+  exchangeAuthorizationCode({ provider, code, pkce }: {
+    provider: string;
     code: string;
     pkce?: PkceParameters;
-  }): Promise<OAuth2Token>;
-  getUserInfo({ registrationId, token }: {
-    registrationId: string;
+  }): Promise<{
+    clientId: string;
+    token: OAuth2Token;
+  }>;
+  /** `clientId` is the client the token was issued to, as `exchangeAuthorizationCode` returns it. */
+  getUserInfo({ provider, clientId, token, response }: {
+    provider: string;
+    clientId: string;
     token: OAuth2Token | OidcToken;
+    response?: AuthorizationResponse;
   }): Promise<UserInfo<unknown>>;
-  refreshAccessToken({ registrationId, refreshToken }: {
-    registrationId: string;
+  /** Verifies a Google One Tap / FedCM credential, which is issued to the web client. */
+  getTokenInfo({ provider, credential }: {
+    provider: string;
+    credential: string;
+  }): Promise<{
+    token: OAuth2Token;
+    userInfo: UserInfo;
+    clientId: string;
+  }>;
+  refreshAccessToken({ provider, clientId, refreshToken }: {
+    provider: string;
+    clientId: string;
     refreshToken: string;
   }): Promise<OAuth2Token>;
-  revokeToken(registrationId: string, token: string): Promise<void>;
-  loginOAuth2Native({ registrationId, credentials, pkce }: {
-    registrationId: string;
+  revokeToken({ provider, clientId, token }: {
+    provider: string;
+    clientId: string;
+    token: string;
+  }): Promise<void>;
+  loginOAuth2Native({ provider, credentials, pkce }: {
+    provider: string;
     credentials: NativeCredential;
     pkce?: PkceParameters;
   }): Promise<{
     token: OAuth2Token;
     userInfo: UserInfo;
+    clientId: string;
   }>;
 }
 //#endregion

package/dist/oauth2/client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.mts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAUa,8CAAyB;;;;;;yBAMpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;UAIU;EAcR,yBACJ,gBACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,4BACJ,gBACA,MACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,cACJ,gBACA;IAEA;IACA,OAAO,cAAc;MACtB,QADsBA;EAMjB,qBACJ,gBACA;IAEA;IACA;MACE,QAAQ;EAQN,YAAY,wBAAwB,gBAAa;EAQjD,oBACJ,gBACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}
+{"version":3,"file":"client.d.mts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAkBa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;;UAKU;UAUN;;UAKM;;;;;;UAaA;;;;;;UAcA;UAYA;EAIR,yBACJ,UACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;;EAYN,4BACJ,UACA,MACA;IAEA;IACA;IACA,OAAO;MACL;IAAU;IAAkB,OAAO;;;EAcjC,cACJ,UACA,UACA,OACA;IAEA;IACA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;;EAOP,eAAe,UAAU;IAAgB;IAAkB;MAAoB;;;;;EAS/E,qBACJ,UACA,UACA;IAEA;IACA;IACA;MACE,QAAQ;EAON,cACJ,UACA,UACA;IAEA;IACA;IACA;MACD;EAOK,oBACJ,UACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}

package/dist/oauth2/client.mjs

@@ -1,3 +1,4 @@
+import { OAuth2Error } from "./error.mjs";
 import { invariant } from "@shware/utils";
 import { object, optional, string } from "zod/v4-mini";
 //#region src/oauth2/client.ts
@@ -6,7 +7,8 @@ const oauth2RedirectQuerySchema = object({
 	state: optional(string()),
 	error: optional(string()),
 	error_description: optional(string()),
-	error_uri: optional(string())
+	error_uri: optional(string()),
+	user: optional(string())
 });
 const googleOneTapSchema = object({
 	code: optional(string()),
@@ -33,78 +35,140 @@ var OAuth2Client = class {
 	get errorUri() {
 		return this.config.errorUri;
 	}
-	async getClientConfig(registrationId) {
-		const registration = (typeof this.config.registration === "function" ? await this.config.registration() : this.config.registration)[registrationId];
-		invariant(registration, `Registration ${registrationId} not found`);
-		const provider = this.config.provider[registration.provider ?? registrationId];
-		invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);
+	/** The provider key comes from the request path, so an unknown one is the caller's error. */
+	async getProviderConfig(provider) {
+		const providers = typeof this.config.providers === "function" ? await this.config.providers() : this.config.providers;
+		const config = Object.hasOwn(providers, provider) ? providers[provider] : void 0;
+		if (!config) throw new OAuth2Error(400, "invalid_request", `Unknown provider: ${provider}`);
+		return config;
+	}
+	defaultRedirectUri(provider) {
+		return `${this.config.baseUri}/login/oauth2/code/${provider}`;
+	}
+	/** The redirect flow and One Tap sign in as the provider's web client. */
+	async getWebClient(provider) {
+		const config = await this.getProviderConfig(provider);
+		if (!config.web) throw new OAuth2Error(400, "invalid_request", `Provider ${provider} has no web client`);
+		return {
+			implementation: config.provider,
+			client: config.web
+		};
+	}
+	/**
+	* Any configured client of the provider, looked up by id: refresh and revoke use the client a
+	* token was issued to, and the native login the one the app names. The web client counts too:
+	* an Android app's server auth code and a Facebook app's tokens are issued to it.
+	*/
+	async getClient(provider, clientId) {
+		const config = await this.getProviderConfig(provider);
+		const client = [config.web, ...config.native ?? []].find((c) => c?.clientId === clientId);
+		if (!client) throw new OAuth2Error(400, "invalid_client", `${clientId} is not a client of ${provider}`);
 		return {
-			registration,
-			provider
+			implementation: config.provider,
+			client
 		};
 	}
-	async createAuthorizationUri({ registrationId, state, pkce }) {
-		const { provider, registration } = await this.getClientConfig(registrationId);
-		const { baseUri } = this.config;
-		const { scope, clientId, redirectUri } = registration;
-		return provider.createAuthorizationUri({
+	/**
+	* The client a native login signs in as: the one the app names with `client_id`, which must be
+	* configured; without one, the only native client, or the web client when there is no native
+	* one. Several native clients and no `client_id` is ambiguous and refused rather than guessed.
+	*/
+	async getNativeClient(provider, clientId) {
+		if (clientId !== void 0) return this.getClient(provider, clientId);
+		const config = await this.getProviderConfig(provider);
+		const native = config.native ?? [];
+		const client = native.length === 0 ? config.web : native.length === 1 ? native[0] : void 0;
+		if (!client) throw new OAuth2Error(400, "invalid_request", `client_id is required for ${provider}`);
+		return {
+			implementation: config.provider,
+			client
+		};
+	}
+	async resolveSecret(secret, clientId) {
+		return typeof secret === "function" ? secret(clientId) : secret;
+	}
+	async createAuthorizationUri({ provider, state, pkce }) {
+		const { implementation, client } = await this.getWebClient(provider);
+		return implementation.createAuthorizationUri({
 			pkce,
 			state,
-			scope,
-			clientId,
-			redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
+			scope: client.scope,
+			clientId: client.clientId,
+			redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider)
 		});
 	}
-	async exchangeAuthorizationCode({ registrationId, code, pkce }) {
-		const { provider, registration } = await this.getClientConfig(registrationId);
-		const { baseUri } = this.config;
-		const { clientId, clientSecret, redirectUri } = registration;
-		return provider.exchangeAuthorizationCode({
-			code,
-			pkce,
+	/** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */
+	async exchangeAuthorizationCode({ provider, code, pkce }) {
+		const { implementation, client } = await this.getWebClient(provider);
+		const { clientId } = client;
+		return {
+			clientId,
+			token: await implementation.exchangeAuthorizationCode({
+				code,
+				pkce,
+				clientId,
+				clientSecret: await this.resolveSecret(client.clientSecret, clientId),
+				redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider)
+			})
+		};
+	}
+	/** `clientId` is the client the token was issued to, as `exchangeAuthorizationCode` returns it. */
+	async getUserInfo({ provider, clientId, token, response }) {
+		const { implementation } = await this.getClient(provider, clientId);
+		return implementation.getUserInfo(token, {
 			clientId,
-			clientSecret,
-			redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
+			response
 		});
 	}
-	async getUserInfo({ registrationId, token }) {
-		const { provider } = await this.getClientConfig(registrationId);
-		return provider.getUserInfo(token);
+	/** Verifies a Google One Tap / FedCM credential, which is issued to the web client. */
+	async getTokenInfo({ provider, credential }) {
+		const { implementation, client } = await this.getWebClient(provider);
+		if (!isOneTapProvider(implementation)) throw new OAuth2Error(400, "invalid_request", `Provider ${provider} has no One Tap`);
+		const { clientId } = client;
+		return {
+			clientId,
+			...await implementation.getTokenInfo(credential, clientId)
+		};
 	}
-	async refreshAccessToken({ registrationId, refreshToken }) {
-		const { provider, registration } = await this.getClientConfig(registrationId);
-		const { clientId, clientSecret } = registration;
-		invariant(provider.refreshAccessToken, "Provider does not support refreshAccessToken");
-		return provider.refreshAccessToken({
+	async refreshAccessToken({ provider, clientId, refreshToken }) {
+		const { implementation, client } = await this.getClient(provider, clientId);
+		invariant(implementation.refreshAccessToken, "Provider does not support refreshAccessToken");
+		const clientSecret = await this.resolveSecret(client.clientSecret, clientId);
+		return implementation.refreshAccessToken({
 			refreshToken,
 			clientId,
 			clientSecret
 		});
 	}
-	async revokeToken(registrationId, token) {
-		const { provider, registration } = await this.getClientConfig(registrationId);
-		const { clientId, clientSecret } = registration;
-		invariant(provider.revokeToken, "Provider does not support revokeToken");
-		await provider.revokeToken({
+	async revokeToken({ provider, clientId, token }) {
+		const { implementation, client } = await this.getClient(provider, clientId);
+		invariant(implementation.revokeToken, "Provider does not support revokeToken");
+		const clientSecret = await this.resolveSecret(client.clientSecret, clientId);
+		await implementation.revokeToken({
 			token,
 			clientId,
 			clientSecret
 		});
 	}
-	async loginOAuth2Native({ registrationId, credentials, pkce }) {
-		const { provider, registration } = await this.getClientConfig(registrationId);
-		invariant(provider.loginOAuth2Native, "Provider does not support loginOAuth2Native");
-		const { baseUri } = this.config;
-		const { clientId, clientSecret, redirectUri } = registration;
-		return provider.loginOAuth2Native({
+	async loginOAuth2Native({ provider, credentials, pkce }) {
+		const { implementation, client } = await this.getNativeClient(provider, credentials.client_id);
+		invariant(implementation.loginOAuth2Native, "Provider does not support loginOAuth2Native");
+		const { clientId } = client;
+		return {
 			clientId,
-			clientSecret,
-			redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,
-			credentials,
-			pkce
-		});
+			...await implementation.loginOAuth2Native({
+				clientId,
+				clientSecret: await this.resolveSecret(client.clientSecret, clientId),
+				redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),
+				credentials,
+				pkce
+			})
+		};
 	}
 };
+function isOneTapProvider(provider) {
+	return typeof provider.getTokenInfo === "function";
+}
 //#endregion
 export { OAuth2Client, googleOneTapSchema, oauth2RedirectQuerySchema };
 

package/dist/oauth2/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport type {\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  private async getClientConfig(registrationId: string) {\n    const registrations =\n      typeof this.config.registration === 'function'\n        ? await this.config.registration()\n        : this.config.registration;\n\n    const registration = registrations[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  async createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = await this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;AAUA,MAAa,4BAA4B,OAAO;CAC9C,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;AAC9B,CAAC;AAED,MAAa,qBAAqB,OAAO;CAEvC,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAC5B,OAAO,SAAS,OAAO,CAAC;CACxB,cAAc,SAAS,OAAO,CAAC;CAC/B,IAAI,SAAS,OAAO,CAAC;CAErB,YAAY,SAAS,OAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;CAEA,MAAc,gBAAgB,gBAAwB;EAMpD,MAAM,gBAJJ,OAAO,KAAK,OAAO,iBAAiB,aAChC,MAAM,KAAK,OAAO,aAAa,IAC/B,KAAK,OAAO,aAAA,CAEiB;EACnC,UAAU,cAAc,gBAAgB,eAAe,WAAW;EAElE,MAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY;EAC/D,UAAU,UAAU,YAAY,aAAa,YAAY,eAAe,WAAW;EACnF,OAAO;GAAE;GAAc;EAAS;CAClC;CAEA,MAAM,uBAAuB,EAC3B,gBACA,OACA,QAKe;EACf,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,OAAO,UAAU,gBAAgB;EACzC,OAAO,SAAS,uBAAuB;GACrC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,0BAA0B,EAC9B,gBACA,MACA,QAKuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAChD,OAAO,SAAS,0BAA0B;GACxC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,YAAY,EAChB,gBACA,SAIC;EACD,MAAM,EAAE,aAAa,MAAM,KAAK,gBAAgB,cAAc;EAC9D,OAAO,SAAS,YAAY,KAAK;CACnC;CAEA,MAAM,mBAAmB,EACvB,gBACA,gBAIuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,UAAU,SAAS,oBAAoB,8CAA8C;EACrF,OAAO,SAAS,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CAC7E;CAEA,MAAM,YAAY,gBAAwB,OAAe;EACvD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,UAAU,SAAS,aAAa,uCAAuC;EACvE,MAAM,SAAS,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CAC9D;CAEA,MAAM,kBAAkB,EACtB,gBACA,aACA,QAKC;EACD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,UAAU,SAAS,mBAAmB,6CAA6C;EACnF,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAEhD,OAAO,SAAS,kBAAkB;GAChC;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;GAC5D;GACA;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport { OAuth2Error } from './error';\nimport type {\n  AuthorizationResponse,\n  ClientSecret,\n  NativeClient,\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  OneTapProvider,\n  PkceParameters,\n  Provider,\n  ProviderConfig,\n  WebClient,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  // Apple's form_post: the user's name as JSON, first authorization only.\n  user: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  /** The provider key comes from the request path, so an unknown one is the caller's error. */\n  private async getProviderConfig(provider: string): Promise<ProviderConfig> {\n    const providers =\n      typeof this.config.providers === 'function'\n        ? await this.config.providers()\n        : this.config.providers;\n    const config = Object.hasOwn(providers, provider) ? providers[provider] : undefined;\n    if (!config) throw new OAuth2Error(400, 'invalid_request', `Unknown provider: ${provider}`);\n    return config;\n  }\n\n  private defaultRedirectUri(provider: string) {\n    return `${this.config.baseUri}/login/oauth2/code/${provider}`;\n  }\n\n  /** The redirect flow and One Tap sign in as the provider's web client. */\n  private async getWebClient(provider: string) {\n    const config = await this.getProviderConfig(provider);\n    if (!config.web) {\n      throw new OAuth2Error(400, 'invalid_request', `Provider ${provider} has no web client`);\n    }\n    return { implementation: config.provider, client: config.web };\n  }\n\n  /**\n   * Any configured client of the provider, looked up by id: refresh and revoke use the client a\n   * token was issued to, and the native login the one the app names. The web client counts too:\n   * an Android app's server auth code and a Facebook app's tokens are issued to it.\n   */\n  private async getClient(provider: string, clientId: string) {\n    const config = await this.getProviderConfig(provider);\n    const client = [config.web, ...(config.native ?? [])].find((c) => c?.clientId === clientId);\n    if (!client) {\n      throw new OAuth2Error(400, 'invalid_client', `${clientId} is not a client of ${provider}`);\n    }\n    return { implementation: config.provider, client };\n  }\n\n  /**\n   * The client a native login signs in as: the one the app names with `client_id`, which must be\n   * configured; without one, the only native client, or the web client when there is no native\n   * one. Several native clients and no `client_id` is ambiguous and refused rather than guessed.\n   */\n  private async getNativeClient(provider: string, clientId: string | undefined) {\n    if (clientId !== undefined) return this.getClient(provider, clientId);\n    const config = await this.getProviderConfig(provider);\n    const native = config.native ?? [];\n    const client: WebClient | NativeClient | undefined =\n      native.length === 0 ? config.web : native.length === 1 ? native[0] : undefined;\n    if (!client) {\n      throw new OAuth2Error(400, 'invalid_request', `client_id is required for ${provider}`);\n    }\n    return { implementation: config.provider, client };\n  }\n\n  private async resolveSecret(secret: ClientSecret | undefined, clientId: string) {\n    return typeof secret === 'function' ? secret(clientId) : secret;\n  }\n\n  async createAuthorizationUri({\n    provider,\n    state,\n    pkce,\n  }: {\n    provider: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { implementation, client } = await this.getWebClient(provider);\n    return implementation.createAuthorizationUri({\n      pkce,\n      state,\n      scope: client.scope,\n      clientId: client.clientId,\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n    });\n  }\n\n  /** Exchanges a code issued to the provider's web client: the redirect flow and One Tap. */\n  async exchangeAuthorizationCode({\n    provider,\n    code,\n    pkce,\n  }: {\n    provider: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<{ clientId: string; token: OAuth2Token }> {\n    const { implementation, client } = await this.getWebClient(provider);\n    const { clientId } = client;\n    const token = await implementation.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret: await this.resolveSecret(client.clientSecret, clientId),\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n    });\n    return { clientId, token };\n  }\n\n  /** `clientId` is the client the token was issued to, as `exchangeAuthorizationCode` returns it. */\n  async getUserInfo({\n    provider,\n    clientId,\n    token,\n    response,\n  }: {\n    provider: string;\n    clientId: string;\n    token: OAuth2Token | OidcToken;\n    response?: AuthorizationResponse;\n  }) {\n    const { implementation } = await this.getClient(provider, clientId);\n    return implementation.getUserInfo(token, { clientId, response });\n  }\n\n  /** Verifies a Google One Tap / FedCM credential, which is issued to the web client. */\n  async getTokenInfo({ provider, credential }: { provider: string; credential: string }) {\n    const { implementation, client } = await this.getWebClient(provider);\n    if (!isOneTapProvider(implementation)) {\n      throw new OAuth2Error(400, 'invalid_request', `Provider ${provider} has no One Tap`);\n    }\n    const { clientId } = client;\n    return { clientId, ...(await implementation.getTokenInfo(credential, clientId)) };\n  }\n\n  async refreshAccessToken({\n    provider,\n    clientId,\n    refreshToken,\n  }: {\n    provider: string;\n    clientId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { implementation, client } = await this.getClient(provider, clientId);\n    invariant(implementation.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    const clientSecret = await this.resolveSecret(client.clientSecret, clientId);\n    return implementation.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken({\n    provider,\n    clientId,\n    token,\n  }: {\n    provider: string;\n    clientId: string;\n    token: string;\n  }) {\n    const { implementation, client } = await this.getClient(provider, clientId);\n    invariant(implementation.revokeToken, 'Provider does not support revokeToken');\n    const clientSecret = await this.resolveSecret(client.clientSecret, clientId);\n    await implementation.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    provider,\n    credentials,\n    pkce,\n  }: {\n    provider: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { implementation, client } = await this.getNativeClient(provider, credentials.client_id);\n    invariant(implementation.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { clientId } = client;\n\n    const result = await implementation.loginOAuth2Native({\n      clientId,\n      clientSecret: await this.resolveSecret(client.clientSecret, clientId),\n      redirectUri: client.redirectUri ?? this.defaultRedirectUri(provider),\n      credentials,\n      pkce,\n    });\n    return { clientId, ...result };\n  }\n}\n\nfunction isOneTapProvider(provider: Provider): provider is OneTapProvider {\n  return typeof (provider as Partial<OneTapProvider>).getTokenInfo === 'function';\n}\n"],"mappings":";;;;AAkBA,MAAa,4BAA4B,OAAO;CAC9C,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAE5B,MAAM,SAAS,OAAO,CAAC;AACzB,CAAC;AAED,MAAa,qBAAqB,OAAO;CAEvC,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAC5B,OAAO,SAAS,OAAO,CAAC;CACxB,cAAc,SAAS,OAAO,CAAC;CAC/B,IAAI,SAAS,OAAO,CAAC;CAErB,YAAY,SAAS,OAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;;CAGA,MAAc,kBAAkB,UAA2C;EACzE,MAAM,YACJ,OAAO,KAAK,OAAO,cAAc,aAC7B,MAAM,KAAK,OAAO,UAAU,IAC5B,KAAK,OAAO;EAClB,MAAM,SAAS,OAAO,OAAO,WAAW,QAAQ,IAAI,UAAU,YAAY,KAAA;EAC1E,IAAI,CAAC,QAAQ,MAAM,IAAI,YAAY,KAAK,mBAAmB,qBAAqB,UAAU;EAC1F,OAAO;CACT;CAEA,mBAA2B,UAAkB;EAC3C,OAAO,GAAG,KAAK,OAAO,QAAQ,qBAAqB;CACrD;;CAGA,MAAc,aAAa,UAAkB;EAC3C,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,IAAI,CAAC,OAAO,KACV,MAAM,IAAI,YAAY,KAAK,mBAAmB,YAAY,SAAS,mBAAmB;EAExF,OAAO;GAAE,gBAAgB,OAAO;GAAU,QAAQ,OAAO;EAAI;CAC/D;;;;;;CAOA,MAAc,UAAU,UAAkB,UAAkB;EAC1D,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,MAAM,SAAS,CAAC,OAAO,KAAK,GAAI,OAAO,UAAU,CAAC,CAAE,CAAC,CAAC,MAAM,MAAM,GAAG,aAAa,QAAQ;EAC1F,IAAI,CAAC,QACH,MAAM,IAAI,YAAY,KAAK,kBAAkB,GAAG,SAAS,sBAAsB,UAAU;EAE3F,OAAO;GAAE,gBAAgB,OAAO;GAAU;EAAO;CACnD;;;;;;CAOA,MAAc,gBAAgB,UAAkB,UAA8B;EAC5E,IAAI,aAAa,KAAA,GAAW,OAAO,KAAK,UAAU,UAAU,QAAQ;EACpE,MAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ;EACpD,MAAM,SAAS,OAAO,UAAU,CAAC;EACjC,MAAM,SACJ,OAAO,WAAW,IAAI,OAAO,MAAM,OAAO,WAAW,IAAI,OAAO,KAAK,KAAA;EACvE,IAAI,CAAC,QACH,MAAM,IAAI,YAAY,KAAK,mBAAmB,6BAA6B,UAAU;EAEvF,OAAO;GAAE,gBAAgB,OAAO;GAAU;EAAO;CACnD;CAEA,MAAc,cAAc,QAAkC,UAAkB;EAC9E,OAAO,OAAO,WAAW,aAAa,OAAO,QAAQ,IAAI;CAC3D;CAEA,MAAM,uBAAuB,EAC3B,UACA,OACA,QAKe;EACf,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,OAAO,eAAe,uBAAuB;GAC3C;GACA;GACA,OAAO,OAAO;GACd,UAAU,OAAO;GACjB,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;EACrE,CAAC;CACH;;CAGA,MAAM,0BAA0B,EAC9B,UACA,MACA,QAKoD;EACpD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,MAAM,EAAE,aAAa;EAQrB,OAAO;GAAE;GAAU,OAAA,MAPC,eAAe,0BAA0B;IAC3D;IACA;IACA;IACA,cAAc,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;IACpE,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;GACrE,CAAC;EACwB;CAC3B;;CAGA,MAAM,YAAY,EAChB,UACA,UACA,OACA,YAMC;EACD,MAAM,EAAE,mBAAmB,MAAM,KAAK,UAAU,UAAU,QAAQ;EAClE,OAAO,eAAe,YAAY,OAAO;GAAE;GAAU;EAAS,CAAC;CACjE;;CAGA,MAAM,aAAa,EAAE,UAAU,cAAwD;EACrF,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,aAAa,QAAQ;EACnE,IAAI,CAAC,iBAAiB,cAAc,GAClC,MAAM,IAAI,YAAY,KAAK,mBAAmB,YAAY,SAAS,gBAAgB;EAErF,MAAM,EAAE,aAAa;EACrB,OAAO;GAAE;GAAU,GAAI,MAAM,eAAe,aAAa,YAAY,QAAQ;EAAG;CAClF;CAEA,MAAM,mBAAmB,EACvB,UACA,UACA,gBAKuB;EACvB,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,UAAU,UAAU,QAAQ;EAC1E,UAAU,eAAe,oBAAoB,8CAA8C;EAC3F,MAAM,eAAe,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;EAC3E,OAAO,eAAe,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CACnF;CAEA,MAAM,YAAY,EAChB,UACA,UACA,SAKC;EACD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,UAAU,UAAU,QAAQ;EAC1E,UAAU,eAAe,aAAa,uCAAuC;EAC7E,MAAM,eAAe,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;EAC3E,MAAM,eAAe,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CACpE;CAEA,MAAM,kBAAkB,EACtB,UACA,aACA,QAKC;EACD,MAAM,EAAE,gBAAgB,WAAW,MAAM,KAAK,gBAAgB,UAAU,YAAY,SAAS;EAC7F,UAAU,eAAe,mBAAmB,6CAA6C;EACzF,MAAM,EAAE,aAAa;EASrB,OAAO;GAAE;GAAU,GAAG,MAPD,eAAe,kBAAkB;IACpD;IACA,cAAc,MAAM,KAAK,cAAc,OAAO,cAAc,QAAQ;IACpE,aAAa,OAAO,eAAe,KAAK,mBAAmB,QAAQ;IACnE;IACA;GACF,CAAC;EAC4B;CAC/B;AACF;AAEA,SAAS,iBAAiB,UAAgD;CACxE,OAAO,OAAQ,SAAqC,iBAAiB;AACvE"}

package/dist/oauth2/name.cjs

@@ -0,0 +1,107 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/oauth2/name.ts
+/**
+* Upper bound, in characters, on each name part taken from the client. Names that reach us outside
+* a signed token (Apple's form_post `user`, a native login body) are plain client input, so they
+* are capped before a host stores them; 64 leaves room for any real given or family name.
+*/
+const MAX_NAME_PART_LENGTH = 64;
+/** Apple's form_post `user` is a few dozen bytes; anything far larger is not Apple's. */
+const MAX_APPLE_USER_LENGTH = 1024;
+const CJK = /^[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}]+$/u;
+/**
+* Composes a display `name` from its parts, for providers that hand out the parts only. Chinese,
+* Japanese and Korean names are written family name first without a space (`王小明`), every other
+* name given name first (`John Appleseed`), which is also the safe choice for mixed scripts. With
+* one part only, that part is the name.
+*/
+function composeName({ given_name, family_name }) {
+	const given = given_name?.trim();
+	const family = family_name?.trim();
+	if (given && family) return CJK.test(given) && CJK.test(family) ? `${family}${given}` : `${given} ${family}`;
+	return given || family || void 0;
+}
+/**
+* One untrusted name part: a non-blank string, trimmed and capped at `MAX_NAME_PART_LENGTH`
+* characters (code points, so a cut never splits one). Anything else is dropped rather than refused,
+* because the name is a nicety and must never cost the user their login.
+*/
+function cleanNamePart(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	if (!trimmed) return void 0;
+	return Array.from(trimmed).slice(0, 64).join("");
+}
+/**
+* Parses Apple's form_post `user` (JSON, first authorization only). Malformed JSON or a wrong shape
+* yields `undefined`, never an error. Only known fields are kept, each cleaned, so what a host
+* persists stays small.
+*/
+function parseAppleUser(raw) {
+	if (!raw || raw.length > MAX_APPLE_USER_LENGTH) return void 0;
+	let json;
+	try {
+		json = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (!isObject(json)) return void 0;
+	const user = {};
+	if (isObject(json.name)) {
+		const firstName = cleanNamePart(json.name.firstName);
+		const lastName = cleanNamePart(json.name.lastName);
+		if (firstName || lastName) user.name = withoutUndefined({
+			firstName,
+			lastName
+		});
+	}
+	const email = typeof json.email === "string" ? json.email.trim().slice(0, 320) : void 0;
+	if (email) user.email = email;
+	return user.name || user.email ? user : void 0;
+}
+const PERSON_NAME_KEYS = [
+	"givenName",
+	"familyName",
+	"middleName",
+	"namePrefix",
+	"nameSuffix",
+	"nickname"
+];
+/**
+* Cleans the `fullName` of a native login body (iOS `PersonNameComponents`): known keys only,
+* each a cleaned string; `undefined` when nothing usable is left.
+*/
+function cleanPersonName(value) {
+	if (!isObject(value)) return void 0;
+	const name = {};
+	for (const key of PERSON_NAME_KEYS) {
+		const part = cleanNamePart(value[key]);
+		if (part) name[key] = part;
+	}
+	return Object.keys(name).length > 0 ? name : void 0;
+}
+/**
+* The standard name claims from cleaned parts, with `name` composed from given and family name.
+* Undefined parts are left out, so spreading the result never overwrites a claim with `undefined`.
+*/
+function nameClaims(parts) {
+	return withoutUndefined({
+		...parts,
+		name: composeName(parts)
+	});
+}
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function withoutUndefined(value) {
+	return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+}
+//#endregion
+exports.MAX_NAME_PART_LENGTH = MAX_NAME_PART_LENGTH;
+exports.cleanNamePart = cleanNamePart;
+exports.cleanPersonName = cleanPersonName;
+exports.composeName = composeName;
+exports.nameClaims = nameClaims;
+exports.parseAppleUser = parseAppleUser;
+
+//# sourceMappingURL=name.cjs.map

package/dist/oauth2/name.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"name.cjs","names":[],"sources":["../../src/oauth2/name.ts"],"sourcesContent":["import type { PersonNameComponents, StandardClaims } from './types';\n\n/**\n * Upper bound, in characters, on each name part taken from the client. Names that reach us outside\n * a signed token (Apple's form_post `user`, a native login body) are plain client input, so they\n * are capped before a host stores them; 64 leaves room for any real given or family name.\n */\nexport const MAX_NAME_PART_LENGTH = 64;\n\n/** Apple's form_post `user` is a few dozen bytes; anything far larger is not Apple's. */\nconst MAX_APPLE_USER_LENGTH = 1024;\n\nconst CJK = /^[\\p{Script=Han}\\p{Script=Hiragana}\\p{Script=Katakana}\\p{Script=Hangul}]+$/u;\n\n/**\n * Composes a display `name` from its parts, for providers that hand out the parts only. Chinese,\n * Japanese and Korean names are written family name first without a space (`王小明`), every other\n * name given name first (`John Appleseed`), which is also the safe choice for mixed scripts. With\n * one part only, that part is the name.\n */\nexport function composeName({\n  given_name,\n  family_name,\n}: Pick<StandardClaims, 'given_name' | 'family_name'>): string | undefined {\n  const given = given_name?.trim();\n  const family = family_name?.trim();\n  if (given && family) {\n    return CJK.test(given) && CJK.test(family) ? `${family}${given}` : `${given} ${family}`;\n  }\n  return given || family || undefined;\n}\n\n/**\n * One untrusted name part: a non-blank string, trimmed and capped at `MAX_NAME_PART_LENGTH`\n * characters (code points, so a cut never splits one). Anything else is dropped rather than refused,\n * because the name is a nicety and must never cost the user their login.\n */\nexport function cleanNamePart(value: unknown): string | undefined {\n  if (typeof value !== 'string') return undefined;\n  const trimmed = value.trim();\n  if (!trimmed) return undefined;\n  return Array.from(trimmed).slice(0, MAX_NAME_PART_LENGTH).join('');\n}\n\n/** Name parts as Apple's form_post `user` carries them, after cleaning. */\nexport interface AppleUser {\n  name?: { firstName?: string; lastName?: string };\n  email?: string;\n}\n\n/**\n * Parses Apple's form_post `user` (JSON, first authorization only). Malformed JSON or a wrong shape\n * yields `undefined`, never an error. Only known fields are kept, each cleaned, so what a host\n * persists stays small.\n */\nexport function parseAppleUser(raw: string | undefined): AppleUser | undefined {\n  if (!raw || raw.length > MAX_APPLE_USER_LENGTH) return undefined;\n  let json: unknown;\n  try {\n    json = JSON.parse(raw);\n  } catch {\n    return undefined;\n  }\n  if (!isObject(json)) return undefined;\n  const user: AppleUser = {};\n  if (isObject(json.name)) {\n    const firstName = cleanNamePart(json.name.firstName);\n    const lastName = cleanNamePart(json.name.lastName);\n    if (firstName || lastName) user.name = withoutUndefined({ firstName, lastName });\n  }\n  // Kept as Apple sent it for the record only: the id token's email is signed, this one is not.\n  const email = typeof json.email === 'string' ? json.email.trim().slice(0, 320) : undefined;\n  if (email) user.email = email;\n  return user.name || user.email ? user : undefined;\n}\n\nconst PERSON_NAME_KEYS = [\n  'givenName',\n  'familyName',\n  'middleName',\n  'namePrefix',\n  'nameSuffix',\n  'nickname',\n] as const satisfies (keyof PersonNameComponents)[];\n\n/**\n * Cleans the `fullName` of a native login body (iOS `PersonNameComponents`): known keys only,\n * each a cleaned string; `undefined` when nothing usable is left.\n */\nexport function cleanPersonName(value: unknown): PersonNameComponents | undefined {\n  if (!isObject(value)) return undefined;\n  const name: PersonNameComponents = {};\n  for (const key of PERSON_NAME_KEYS) {\n    const part = cleanNamePart(value[key]);\n    if (part) name[key] = part;\n  }\n  return Object.keys(name).length > 0 ? name : undefined;\n}\n\ntype NameClaims = Pick<\n  StandardClaims,\n  'name' | 'given_name' | 'family_name' | 'middle_name' | 'nickname'\n>;\n\n/**\n * The standard name claims from cleaned parts, with `name` composed from given and family name.\n * Undefined parts are left out, so spreading the result never overwrites a claim with `undefined`.\n */\nexport function nameClaims(parts: Omit<NameClaims, 'name'>): NameClaims {\n  return withoutUndefined({ ...parts, name: composeName(parts) });\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction withoutUndefined<T extends object>(value: T): T {\n  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined)) as T;\n}\n"],"mappings":";;;;;;;AAOA,MAAa,uBAAuB;;AAGpC,MAAM,wBAAwB;AAE9B,MAAM,MAAM;;;;;;;AAQZ,SAAgB,YAAY,EAC1B,YACA,eACyE;CACzE,MAAM,QAAQ,YAAY,KAAK;CAC/B,MAAM,SAAS,aAAa,KAAK;CACjC,IAAI,SAAS,QACX,OAAO,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,MAAM,IAAI,GAAG,SAAS,UAAU,GAAG,MAAM,GAAG;CAEjF,OAAO,SAAS,UAAU,KAAA;AAC5B;;;;;;AAOA,SAAgB,cAAc,OAAoC;CAChE,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;CACtC,MAAM,UAAU,MAAM,KAAK;CAC3B,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,GAAA,EAAuB,CAAC,CAAC,KAAK,EAAE;AACnE;;;;;;AAaA,SAAgB,eAAe,KAAgD;CAC7E,IAAI,CAAC,OAAO,IAAI,SAAS,uBAAuB,OAAO,KAAA;CACvD,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN;CACF;CACA,IAAI,CAAC,SAAS,IAAI,GAAG,OAAO,KAAA;CAC5B,MAAM,OAAkB,CAAC;CACzB,IAAI,SAAS,KAAK,IAAI,GAAG;EACvB,MAAM,YAAY,cAAc,KAAK,KAAK,SAAS;EACnD,MAAM,WAAW,cAAc,KAAK,KAAK,QAAQ;EACjD,IAAI,aAAa,UAAU,KAAK,OAAO,iBAAiB;GAAE;GAAW;EAAS,CAAC;CACjF;CAEA,MAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,KAAA;CACjF,IAAI,OAAO,KAAK,QAAQ;CACxB,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAA;AAC1C;AAEA,MAAM,mBAAmB;CACvB;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AAMA,SAAgB,gBAAgB,OAAkD;CAChF,IAAI,CAAC,SAAS,KAAK,GAAG,OAAO,KAAA;CAC7B,MAAM,OAA6B,CAAC;CACpC,KAAK,MAAM,OAAO,kBAAkB;EAClC,MAAM,OAAO,cAAc,MAAM,IAAI;EACrC,IAAI,MAAM,KAAK,OAAO;CACxB;CACA,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,KAAA;AAC/C;;;;;AAWA,SAAgB,WAAW,OAA6C;CACtE,OAAO,iBAAiB;EAAE,GAAG;EAAO,MAAM,YAAY,KAAK;CAAE,CAAC;AAChE;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAmC,OAAa;CACvD,OAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC,QAAQ,GAAG,OAAO,MAAM,KAAA,CAAS,CAAC;AACpF"}