@sigrun/oauth 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-10-24
+### Added
+- OIDC login providers with discovery, authorization code, PKCE S256, nonce, and issuer/audience/expiry/JWKS-signature validation.
+- OAuth 2 explicit endpoints and field-path mapping, plus GitHub and Discord presets.
+- Per-provider settings validation, scoped client-secret reads, and provisioning-policy contributions.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michael MacLeod
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,55 @@
-# Temporary Holding Version
+Sign in to sigrun with an OIDC or OAuth 2 provider. This is for logging in; MCP account connections live in the MCP extension.
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @sigrun/oauth
+
+The `oauth` extension contributes `loginProviders` to sigrun's login seam. Core qualifies them as `login:oauth:<id>`. It supports OIDC discovery with authorization code, PKCE S256, nonce, and full ID-token validation; GitHub and Discord presets; and explicit OAuth 2 endpoints with configurable userinfo field paths.
+
+## Settings
+
+Configure `settings/oauth.json` through sigrun's extension settings surface:
+
+```json
+{
+  "providers": [
+    {
+      "id": "company",
+      "label": "Company SSO",
+      "kind": "oidc",
+      "issuer": "https://id.example.com",
+      "clientId": "sigrun",
+      "scopes": "openid profile email",
+      "usernameClaim": "preferred_username",
+      "groupsClaim": "groups",
+      "autoProvision": false,
+      "allowedGroups": ["staff"],
+      "allowedDomains": ["example.com"]
+    },
+    {
+      "id": "github",
+      "label": "GitHub",
+      "kind": "oauth2",
+      "preset": "github",
+      "clientId": "your-client-id"
+    }
+  ]
+}
+```
+
+Set each client secret in the extension secret store under `<id>.clientSecret` (for example, `github.clientSecret`). Never put a client secret in settings. A client ID is public configuration and is required in settings on every provider form, including both OAuth 2 forms.
+
+An OAuth 2 provider may instead declare `authorizeUrl`, `tokenUrl`, and `userinfoUrl`, plus `fields` with a required `subject` and optional `username`, `name`, `email`, `emailVerified`, and `groups` dot-separated field paths. Optional `scopes` default to `openid profile email`. The `policy` fields (`autoProvision`, `allowedGroups`, `allowedDomains`) are reported to core, which enforces them. GitHub email is selected only from the primary, verified entry in `/user/emails`; Discord uses its user `verified` field. Neither preset supplies groups.
+
+Malformed entries are skipped individually with a warning naming the provider. With no valid providers, the extension returns `loginProviders: []`. Production provider endpoints require HTTPS; plain HTTP is limited to loopback URLs for local development and tests.
+
+## Development
+
+```sh
+npm install --legacy-peer-deps --ignore-scripts
+npm test
+npm run typecheck
+npm run build
+```
+
+`dist/` is committed because git-source extension installs load it directly. Rebuild and commit it with source changes.
+
+Core's types-only contract is currently mapped in `tsconfig.json` to the M3b core worktree's built declaration. This is a development-only coupling; use a registry development dependency after the matching core contract is published. Do not publish this package from that worktree-specific state.

package/dist/config.d.ts

@@ -0,0 +1,49 @@
+import type { LoginProviderContribution } from "@sigrun/sigrun/extension";
+export declare const DEFAULT_SCOPES = "openid profile email";
+export declare const DEFAULT_USERNAME_CLAIM = "preferred_username";
+export declare const DEFAULT_GROUPS_CLAIM = "groups";
+export interface ProvisioningPolicy {
+    autoProvision?: boolean;
+    allowedGroups?: string[];
+    allowedDomains?: string[];
+}
+interface Common {
+    id: string;
+    label: string;
+    icon?: string;
+    policy?: ProvisioningPolicy;
+}
+export interface OidcConfig extends Common {
+    kind: "oidc";
+    issuer: string;
+    clientId: string;
+    scopes: string;
+    usernameClaim: string;
+    groupsClaim: string;
+}
+export interface FieldMap {
+    subject: string;
+    username?: string;
+    name?: string;
+    email?: string;
+    emailVerified?: string;
+    groups?: string;
+}
+export interface Oauth2Config extends Common {
+    kind: "oauth2";
+    clientId: string;
+    authorizeUrl: string;
+    tokenUrl: string;
+    userinfoUrl: string;
+    scopes: string;
+    fields: FieldMap;
+    preset?: "github" | "discord";
+}
+export type ProviderConfig = (OidcConfig | Oauth2Config) & {
+    policy?: ProvisioningPolicy;
+};
+export type Warning = (message: string) => void;
+export declare function parseProvider(value: unknown): ProviderConfig;
+export declare function parseProviders(settings: Record<string, unknown>, warn?: Warning): ProviderConfig[];
+export declare function contributionPolicy(config: ProviderConfig): LoginProviderContribution["policy"];
+export {};

package/dist/config.js

@@ -0,0 +1,141 @@
+import { githubPreset, discordPreset } from "./presets.js";
+export const DEFAULT_SCOPES = "openid profile email";
+export const DEFAULT_USERNAME_CLAIM = "preferred_username";
+export const DEFAULT_GROUPS_CLAIM = "groups";
+function object(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function string(entry, key, required = true) {
+    const value = entry[key];
+    if (value === undefined && !required)
+        return undefined;
+    if (typeof value !== "string" || value.length === 0)
+        throw new Error(`${key} must be a non-empty string`);
+    return value;
+}
+function url(entry, key) {
+    const value = string(entry, key);
+    try {
+        const parsed = new URL(value);
+        const loopback = ["127.0.0.1", "localhost", "::1"].includes(parsed.hostname);
+        if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopback))
+            throw new Error();
+        return value;
+    }
+    catch {
+        throw new Error(`${key} must be an HTTP(S) URL`);
+    }
+}
+function strings(value, key) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || item.length === 0))
+        throw new Error(`${key} must be an array of non-empty strings`);
+    return value;
+}
+function policy(entry) {
+    const result = {};
+    if (entry.autoProvision !== undefined) {
+        if (typeof entry.autoProvision !== "boolean")
+            throw new Error("autoProvision must be boolean");
+        result.autoProvision = entry.autoProvision;
+    }
+    result.allowedGroups = strings(entry.allowedGroups, "allowedGroups");
+    result.allowedDomains = strings(entry.allowedDomains, "allowedDomains");
+    return Object.keys(result).length === 0 ? undefined : result;
+}
+function common(entry) {
+    const id = string(entry, "id");
+    if (!/^[a-z0-9][a-z0-9._-]*$/.test(id))
+        throw new Error("id is invalid");
+    return {
+        id,
+        label: string(entry, "label"),
+        ...(entry.icon === undefined ? {} : { icon: string(entry, "icon") }),
+        ...(policy(entry) === undefined ? {} : { policy: policy(entry) }),
+    };
+}
+function scopes(entry) {
+    return string(entry, "scopes", false) ?? DEFAULT_SCOPES;
+}
+function fields(value) {
+    if (!object(value))
+        throw new Error("fields must be an object");
+    const result = { subject: string(value, "subject") };
+    for (const key of ["username", "name", "email", "emailVerified", "groups"]) {
+        const field = string(value, key, false);
+        if (field !== undefined)
+            result[key] = field;
+    }
+    return result;
+}
+export function parseProvider(value) {
+    if (!object(value))
+        throw new Error("provider must be an object");
+    const base = common(value);
+    const clientId = string(value, "clientId");
+    if (value.kind === "oidc") {
+        return {
+            ...base,
+            kind: "oidc",
+            clientId,
+            issuer: url(value, "issuer").replace(/\/$/, ""),
+            scopes: scopes(value),
+            usernameClaim: string(value, "usernameClaim", false) ?? DEFAULT_USERNAME_CLAIM,
+            groupsClaim: string(value, "groupsClaim", false) ?? DEFAULT_GROUPS_CLAIM,
+        };
+    }
+    if (value.kind !== "oauth2")
+        throw new Error("kind must be oidc or oauth2");
+    let endpoints;
+    let preset;
+    if (value.preset !== undefined) {
+        if (value.preset !== "github" && value.preset !== "discord")
+            throw new Error("unknown oauth2 preset");
+        preset = value.preset;
+        endpoints = { ...(preset === "github" ? githubPreset() : discordPreset()) };
+    }
+    else {
+        endpoints = value;
+    }
+    return {
+        ...base,
+        kind: "oauth2",
+        clientId,
+        authorizeUrl: url(endpoints, "authorizeUrl"),
+        tokenUrl: url(endpoints, "tokenUrl"),
+        userinfoUrl: url(endpoints, "userinfoUrl"),
+        scopes: scopes({ scopes: value.scopes ?? endpoints.scopes }),
+        fields: fields(value.fields ?? endpoints.fields),
+        ...(preset === undefined ? {} : { preset }),
+    };
+}
+export function parseProviders(settings, warn = console.warn) {
+    if (settings.providers === undefined)
+        return [];
+    if (!Array.isArray(settings.providers)) {
+        warn("oauth: settings providers is not an array; no login providers loaded");
+        return [];
+    }
+    const providers = [];
+    const ids = new Set();
+    for (const value of settings.providers) {
+        const name = object(value) && typeof value.id === "string" ? value.id : "unnamed";
+        try {
+            const provider = parseProvider(value);
+            if (ids.has(provider.id)) {
+                warn(`oauth: skipping duplicate provider "${provider.id}"`);
+                continue;
+            }
+            ids.add(provider.id);
+            providers.push(provider);
+        }
+        catch (error) {
+            warn(`oauth: skipping malformed provider "${name}": ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return providers;
+}
+export function contributionPolicy(config) {
+    return config.policy;
+}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+import type { SigrunExtensionResult, SigrunHost } from "@sigrun/sigrun/extension";
+export declare const EXTENSION_NAME = "oauth";
+/** Build login providers from this extension's scoped settings and secrets. */
+export declare function createOAuth(host: SigrunHost): Promise<SigrunExtensionResult>;
+export default createOAuth;
+export { parseProviders, parseProvider } from "./config.js";
+export type { ProviderConfig, OidcConfig, Oauth2Config, FieldMap } from "./config.js";
+export { createOidcProvider } from "./oidc.js";
+export { createOauth2Provider } from "./oauth2.js";
+export { githubPreset, discordPreset } from "./presets.js";

package/dist/index.js

@@ -0,0 +1,20 @@
+import { parseProviders } from "./config.js";
+import { createOidcProvider } from "./oidc.js";
+import { createOauth2Provider } from "./oauth2.js";
+export const EXTENSION_NAME = "oauth";
+/** Build login providers from this extension's scoped settings and secrets. */
+export async function createOAuth(host) {
+    const settings = await host.stores.settings.get();
+    const loginProviders = parseProviders(settings).map((config) => {
+        const readSecret = () => host.stores.secrets.get(`${config.id}.clientSecret`);
+        return config.kind === "oidc"
+            ? createOidcProvider(config, readSecret)
+            : createOauth2Provider(config, readSecret);
+    });
+    return { name: EXTENSION_NAME, loginProviders };
+}
+export default createOAuth;
+export { parseProviders, parseProvider } from "./config.js";
+export { createOidcProvider } from "./oidc.js";
+export { createOauth2Provider } from "./oauth2.js";
+export { githubPreset, discordPreset } from "./presets.js";

package/dist/oauth2.d.ts

@@ -0,0 +1,11 @@
+import type { HandlerContext, LoginFlow, LoginProviderContribution, LoginResult } from "@sigrun/sigrun/extension";
+import type { Oauth2Config } from "./config.js";
+import type { Fetch, SecretReader } from "./oidc.js";
+export declare function mapUserinfo(config: Oauth2Config, userinfo: unknown): LoginResult;
+export declare function beginOauth2(config: Oauth2Config, flow: LoginFlow): Promise<{
+    redirectUrl: string;
+}>;
+export declare function completeOauth2(config: Oauth2Config, flow: LoginFlow, callback: {
+    query: Record<string, string>;
+}, ctx: HandlerContext, secret: string | undefined, fetchImpl: Fetch): Promise<LoginResult>;
+export declare function createOauth2Provider(config: Oauth2Config, readSecret: SecretReader, fetchImpl?: Fetch): LoginProviderContribution;

package/dist/oauth2.js

@@ -0,0 +1,113 @@
+import * as oauth from "oauth4webapi";
+function field(value, path) {
+    let current = value;
+    for (const part of path.split(".")) {
+        if (typeof current !== "object" || current === null || Array.isArray(current))
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+function stringField(value, path) {
+    if (path === undefined)
+        return undefined;
+    const result = field(value, path);
+    if (result === undefined || result === null)
+        return undefined;
+    if (typeof result === "string")
+        return result;
+    if (typeof result === "number" && Number.isFinite(result))
+        return String(result);
+    throw new Error(`OAuth 2 userinfo field ${path} is not a string or number`);
+}
+function booleanField(value, path) {
+    if (path === undefined)
+        return undefined;
+    const result = field(value, path);
+    if (result === undefined)
+        return undefined;
+    if (typeof result !== "boolean")
+        throw new Error(`OAuth 2 userinfo field ${path} is not boolean`);
+    return result;
+}
+export function mapUserinfo(config, userinfo) {
+    const subject = stringField(userinfo, config.fields.subject);
+    if (subject === undefined || subject === "")
+        throw new Error("OAuth 2 userinfo subject is missing");
+    const groups = config.fields.groups === undefined ? undefined : field(userinfo, config.fields.groups);
+    if (groups !== undefined && (!Array.isArray(groups) || groups.some((group) => typeof group !== "string")))
+        throw new Error("OAuth 2 groups field is not a string array");
+    return {
+        subject,
+        profile: {
+            ...(stringField(userinfo, config.fields.username) === undefined ? {} : { username: stringField(userinfo, config.fields.username) }),
+            ...(stringField(userinfo, config.fields.name) === undefined ? {} : { name: stringField(userinfo, config.fields.name) }),
+            ...(stringField(userinfo, config.fields.email) === undefined ? {} : { email: stringField(userinfo, config.fields.email) }),
+            ...(booleanField(userinfo, config.fields.emailVerified) === undefined ? {} : { emailVerified: booleanField(userinfo, config.fields.emailVerified) }),
+        },
+        ...(groups === undefined ? {} : { groups: groups }),
+    };
+}
+async function githubEmail(accessToken, fetchImpl, signal) {
+    const response = await fetchImpl("https://api.github.com/user/emails", {
+        headers: { authorization: `Bearer ${accessToken}`, accept: "application/vnd.github+json" },
+        signal,
+    });
+    if (!response.ok)
+        throw new Error(`GitHub email lookup failed (${response.status})`);
+    const entries = await response.json();
+    if (!Array.isArray(entries))
+        throw new Error("GitHub email response is not an array");
+    const primary = entries.find((entry) => typeof entry === "object" && entry !== null && entry.primary === true && entry.verified === true);
+    if (primary === undefined)
+        return { emailVerified: false };
+    const email = primary.email;
+    if (typeof email !== "string")
+        throw new Error("GitHub primary verified email is not a string");
+    return { email, emailVerified: true };
+}
+export async function beginOauth2(config, flow) {
+    const verifier = oauth.generateRandomCodeVerifier();
+    flow.data.codeVerifier = verifier;
+    const url = new URL(config.authorizeUrl);
+    url.searchParams.set("client_id", config.clientId);
+    url.searchParams.set("redirect_uri", flow.callbackUrl);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("scope", config.scopes);
+    url.searchParams.set("state", flow.state);
+    url.searchParams.set("code_challenge", await oauth.calculatePKCECodeChallenge(verifier));
+    url.searchParams.set("code_challenge_method", "S256");
+    return { redirectUrl: url.toString() };
+}
+export async function completeOauth2(config, flow, callback, ctx, secret, fetchImpl) {
+    if (secret === undefined || secret === "")
+        throw new Error(`OAuth 2 provider "${config.id}" is missing its client secret`);
+    if (flow.data.codeVerifier === undefined)
+        throw new Error("OAuth 2 login flow is missing PKCE state");
+    const as = { issuer: config.authorizeUrl, token_endpoint: config.tokenUrl };
+    const client = { client_id: config.clientId };
+    const parameters = oauth.validateAuthResponse(as, client, new URLSearchParams(callback.query), flow.state);
+    const response = await oauth.authorizationCodeGrantRequest(as, client, oauth.ClientSecretPost(secret), parameters, flow.callbackUrl, flow.data.codeVerifier, { [oauth.customFetch]: fetchImpl, signal: ctx.abortSignal });
+    const token = await oauth.processAuthorizationCodeResponse(as, client, response);
+    const accessToken = token.access_token;
+    if (typeof accessToken !== "string")
+        throw new Error("OAuth 2 token response has no access token");
+    const userinfoResponse = await fetchImpl(config.userinfoUrl, { headers: { authorization: `Bearer ${accessToken}`, accept: "application/json" }, signal: ctx.abortSignal });
+    if (!userinfoResponse.ok)
+        throw new Error(`OAuth 2 userinfo request failed (${userinfoResponse.status})`);
+    const result = mapUserinfo(config, await userinfoResponse.json());
+    if (config.preset === "github" || config.userinfoUrl === "https://api.github.com/user") {
+        return { ...result, profile: { ...result.profile, ...(await githubEmail(accessToken, fetchImpl, ctx.abortSignal)) } };
+    }
+    return result;
+}
+export function createOauth2Provider(config, readSecret, fetchImpl = fetch) {
+    return {
+        id: config.id,
+        label: config.label,
+        ...(config.icon === undefined ? {} : { icon: config.icon }),
+        ...(config.policy === undefined ? {} : { policy: config.policy }),
+        begin: (flow) => beginOauth2(config, flow),
+        complete: async (flow, callback, ctx) => completeOauth2(config, flow, callback, ctx, await readSecret(), fetchImpl),
+    };
+}

package/dist/oidc.d.ts

@@ -0,0 +1,15 @@
+import * as oauth from "oauth4webapi";
+import type { HandlerContext, LoginFlow, LoginProviderContribution, LoginResult } from "@sigrun/sigrun/extension";
+import type { OidcConfig } from "./config.js";
+export type Fetch = typeof fetch;
+export type SecretReader = () => Promise<string | undefined>;
+export declare function discover(issuer: string, fetchImpl: Fetch, ctx: HandlerContext): Promise<oauth.AuthorizationServer>;
+export declare function beginOidc(config: OidcConfig, flow: LoginFlow, ctx: HandlerContext, fetchImpl: Fetch): Promise<{
+    redirectUrl: string;
+}>;
+export declare function oidcResult(config: OidcConfig, claims: oauth.IDToken): LoginResult;
+export declare function completeOidc(config: OidcConfig, flow: LoginFlow, callback: {
+    query: Record<string, string>;
+    body?: unknown;
+}, ctx: HandlerContext, secret: string | undefined, fetchImpl: Fetch): Promise<LoginResult>;
+export declare function createOidcProvider(config: OidcConfig, readSecret: SecretReader, fetchImpl?: Fetch): LoginProviderContribution;

package/dist/oidc.js

@@ -0,0 +1,103 @@
+import * as oauth from "oauth4webapi";
+function requestOptions(fetchImpl, ctx) {
+    return { [oauth.customFetch]: fetchImpl, signal: ctx.abortSignal };
+}
+export async function discover(issuer, fetchImpl, ctx) {
+    const identifier = new URL(issuer);
+    return oauth.processDiscoveryResponse(identifier, await oauth.discoveryRequest(identifier, requestOptions(fetchImpl, ctx)));
+}
+export async function beginOidc(config, flow, ctx, fetchImpl) {
+    const as = await discover(config.issuer, fetchImpl, ctx);
+    if (as.authorization_endpoint === undefined) {
+        throw new Error(`OIDC provider "${config.id}" has no authorization endpoint`);
+    }
+    const verifier = oauth.generateRandomCodeVerifier();
+    const nonce = oauth.generateRandomNonce();
+    flow.data.codeVerifier = verifier;
+    flow.data.nonce = nonce;
+    const url = new URL(as.authorization_endpoint);
+    url.searchParams.set("client_id", config.clientId);
+    url.searchParams.set("redirect_uri", flow.callbackUrl);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("scope", config.scopes);
+    url.searchParams.set("state", flow.state);
+    url.searchParams.set("code_challenge", await oauth.calculatePKCECodeChallenge(verifier));
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("nonce", nonce);
+    return { redirectUrl: url.toString() };
+}
+function stringClaim(claims, name) {
+    const value = claims[name];
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string")
+        throw new Error(`ID token claim ${name} is not a string`);
+    return value;
+}
+function groupsClaim(claims, name) {
+    const value = claims[name];
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.some((group) => typeof group !== "string")) {
+        throw new Error(`ID token claim ${name} is not a string array`);
+    }
+    return value;
+}
+export function oidcResult(config, claims) {
+    const username = stringClaim(claims, config.usernameClaim);
+    const name = stringClaim(claims, "name");
+    const email = stringClaim(claims, "email");
+    const emailVerified = claims.email_verified;
+    const groups = groupsClaim(claims, config.groupsClaim);
+    if (emailVerified !== undefined && typeof emailVerified !== "boolean") {
+        throw new Error("ID token claim email_verified is not boolean");
+    }
+    return {
+        subject: stringClaim(claims, "sub"),
+        profile: {
+            ...(username === undefined ? {} : { username }),
+            ...(name === undefined ? {} : { name }),
+            ...(email === undefined ? {} : { email }),
+            ...(emailVerified === undefined ? {} : { emailVerified }),
+        },
+        ...(groups === undefined ? {} : { groups }),
+    };
+}
+export async function completeOidc(config, flow, callback, ctx, secret, fetchImpl) {
+    if (secret === undefined || secret === "") {
+        throw new Error(`OIDC provider "${config.id}" is missing its client secret`);
+    }
+    if (flow.data.codeVerifier === undefined || flow.data.nonce === undefined) {
+        throw new Error("OIDC login flow is missing PKCE or nonce state");
+    }
+    const as = await discover(config.issuer, fetchImpl, ctx);
+    if (as.jwks_uri === undefined) {
+        throw new Error(`OIDC provider "${config.id}" has no JWKS endpoint`);
+    }
+    const client = { client_id: config.clientId };
+    const parameters = oauth.validateAuthResponse(as, client, new URLSearchParams(callback.query), flow.state);
+    const response = await oauth.authorizationCodeGrantRequest(as, client, oauth.ClientSecretPost(secret), parameters, flow.callbackUrl, flow.data.codeVerifier, requestOptions(fetchImpl, ctx));
+    // oauth4webapi validates issuer, audience, expiry and the expected nonce.
+    // Explicit JWKS validation below also requires a valid ID-token signature.
+    const result = await oauth.processAuthorizationCodeResponse(as, client, response, {
+        expectedNonce: flow.data.nonce,
+        requireIdToken: true,
+        ...requestOptions(fetchImpl, ctx),
+    });
+    const claims = oauth.getValidatedIdTokenClaims(result);
+    if (claims === undefined || result.id_token === undefined) {
+        throw new Error("OIDC token response has no ID token");
+    }
+    await oauth.validateApplicationLevelSignature(as, response, requestOptions(fetchImpl, ctx));
+    return oidcResult(config, claims);
+}
+export function createOidcProvider(config, readSecret, fetchImpl = fetch) {
+    return {
+        id: config.id,
+        label: config.label,
+        ...(config.icon === undefined ? {} : { icon: config.icon }),
+        ...(config.policy === undefined ? {} : { policy: config.policy }),
+        begin: (flow, ctx) => beginOidc(config, flow, ctx, fetchImpl),
+        complete: async (flow, callback, ctx) => completeOidc(config, flow, callback, ctx, await readSecret(), fetchImpl),
+    };
+}

package/dist/presets.d.ts

@@ -0,0 +1,10 @@
+import type { FieldMap } from "./config.js";
+export interface Preset {
+    authorizeUrl: string;
+    tokenUrl: string;
+    userinfoUrl: string;
+    scopes: string;
+    fields: FieldMap;
+}
+export declare function githubPreset(): Preset;
+export declare function discordPreset(): Preset;

package/dist/presets.js

@@ -0,0 +1,18 @@
+export function githubPreset() {
+    return {
+        authorizeUrl: "https://github.com/login/oauth/authorize",
+        tokenUrl: "https://github.com/login/oauth/access_token",
+        userinfoUrl: "https://api.github.com/user",
+        scopes: "read:user user:email",
+        fields: { subject: "id", username: "login", name: "name" },
+    };
+}
+export function discordPreset() {
+    return {
+        authorizeUrl: "https://discord.com/oauth2/authorize",
+        tokenUrl: "https://discord.com/api/oauth2/token",
+        userinfoUrl: "https://discord.com/api/users/@me",
+        scopes: "identify email",
+        fields: { subject: "id", username: "username", email: "email", emailVerified: "verified" },
+    };
+}

package/package.json

@@ -1,6 +1,54 @@
 {
-  "name": "@sigrun/oauth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+	"name": "@sigrun/oauth",
+	"version": "0.1.0",
+	"description": "OIDC and OAuth 2 login providers for sigrun",
+	"type": "module",
+	"engines": {
+		"node": ">=22.19.0"
+	},
+	"main": "dist/index.js",
+	"types": "dist/index.d.ts",
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"default": "./dist/index.js"
+		}
+	},
+	"files": [
+		"dist",
+		"CHANGELOG.md"
+	],
+	"scripts": {
+		"test": "node scripts/check-manifest.mjs --expect-name @sigrun/oauth && vitest run",
+		"typecheck": "tsc --noEmit",
+		"build": "tsc -p tsconfig.build.json",
+		"prepublishOnly": "npm run build"
+	},
+	"dependencies": {
+		"oauth4webapi": "3.8.8"
+	},
+	"peerDependencies": {
+		"@sigrun/sigrun": "*"
+	},
+	"devDependencies": {
+		"@types/node": "^26.6.4",
+		"jose": "^6.2.13",
+		"tsx": "^4.23.15",
+		"typescript": "^7.0.2",
+		"vite": "^8.3.5",
+		"vitest": "^5.0.3"
+	},
+	"license": "MIT",
+	"repository": {
+		"type": "github",
+		"url": "git+https://github.com/sigrun-ai/sigrun-ext-oauth.git"
+	},
+	"bugs": {
+		"url": "https://github.com/sigrun-ai/sigrun-ext-oauth/issues"
+	},
+	"homepage": "https://github.com/sigrun-ai/sigrun-ext-oauth#readme",
+	"publishConfig": {
+		"access": "public",
+		"provenance": true
+	}
+}