@stacksjs/socials 0.70.44 → 0.70.53

package/LICENSE.md

@@ -0,0 +1,21 @@
+# MIT License
+
+Copyright (c) 2023 Open Web Foundation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/abstract.d.ts

@@ -14,6 +14,7 @@ export declare abstract class AbstractProvider implements ProviderInterface {
   protected scopeSeparator: string;
   protected _stateless: boolean;
   protected _usesPKCE: boolean;
+  protected _state: string | null;
   protected user: SocialUser | null;
   constructor(config: ProviderConfig);
   abstract getAuthUrl(): Promise<string>;
@@ -27,6 +28,8 @@ export declare abstract class AbstractProvider implements ProviderInterface {
   setScopes(scopes: string | string[]): this;
   getScopes(): string[];
   setRedirectUrl(url: string): this;
+  withState(state: string): this;
+  protected resolveState(): string;
   protected usesState(): boolean;
   validateState(expected: string | null | undefined, actual: string | null | undefined): boolean;
   protected isStateless(): boolean;

package/dist/drivers/apple.d.ts

@@ -0,0 +1,56 @@
+import { AbstractProvider } from '../abstract';
+import type { AppleIdTokenClaims, ProviderInterface, SocialUser } from '../types';
+import type { ProviderConfig } from '../abstract';
+/**
+ * Apple replaces the static client secret with a signed JWT, so its
+ * provider config carries the signing inputs instead of clientSecret
+ * (which may be left '').
+ */
+export declare interface AppleProviderConfig extends ProviderConfig {
+  teamId?: string
+  keyId?: string
+  privateKey?: string
+}
+/**
+ * Sign in with Apple (OAuth2 / OIDC).
+ *
+ * Apple deviates from the other providers in three ways, all handled
+ * here so callers keep the same getAuthUrl/getAccessToken/getUserByToken
+ * contract:
+ *
+ * 1. There is no static client secret. Apple requires a short-lived JWT
+ *    signed with an ES256 private key (.p8) issued in the developer
+ *    portal, scoped by team ID and key ID. `generateClientSecret()`
+ *    builds one per token exchange.
+ * 2. There is no userinfo endpoint. Identity comes from the `id_token`
+ *    returned by the token endpoint, so `getAccessToken()` returns the
+ *    id_token (not the access token — there is nothing to spend it on),
+ *    and `getUserByToken()` decodes its claims. The id_token arrives
+ *    straight from Apple's token endpoint over TLS, which OIDC Core
+ *    3.1.3.7 accepts in place of local signature verification; iss, aud
+ *    and exp are still validated.
+ * 3. When scopes are requested (they are by default: name + email),
+ *    Apple mandates `response_mode=form_post` — the callback arrives as
+ *    a cross-site POST, not a GET. Applications must register a POST
+ *    callback route and use a cookie jar that survives cross-site POSTs
+ *    (SameSite=None) if they carry state in cookies.
+ *
+ * Note that Apple only transmits the user's name (and only on the very
+ * first authorization) as a `user` JSON field in the form_post body —
+ * it is never part of the id_token. Reading it is the application's
+ * job; `SocialUser.name` from this driver is therefore always ''.
+ */
+export declare class AppleProvider extends AbstractProvider implements ProviderInterface {
+  protected baseUrl: string;
+  protected teamId: string;
+  protected keyId: string;
+  protected privateKey: string;
+  constructor(providerConfig: AppleProviderConfig);
+  getAuthUrl(): Promise<string>;
+  getAccessToken(code: string): Promise<string>;
+  getUserByToken(token: string): Promise<SocialUser>;
+  protected generateClientSecret(): string;
+  protected decodeIdToken(idToken: string): AppleIdTokenClaims;
+  protected validateConfig(): void;
+  protected getTokenUrl(): string;
+}

package/dist/drivers/github.d.ts

@@ -6,6 +6,7 @@ export declare class GitHubProvider extends AbstractProvider implements Provider
   getAuthUrl(): Promise<string>;
   getAccessToken(code: string): Promise<string>;
   getUserByToken(token: string): Promise<SocialUser>;
+  protected pickEmail(emails: GitHubEmail[]): GitHubEmail | null;
   protected getEmail(emails: GitHubEmail[]): string | null;
   protected validateConfig(): void;
   protected getTokenUrl(): string;

package/dist/drivers/index.d.ts

@@ -1,5 +1,9 @@
+export * from './apple';
 export * from './bluesky';
 export * from './facebook';
 export * from './github';
 export * from './google';
+export * from './instagram';
+export * from './linkedin';
+export * from './threads';
 export * from './twitter';

package/dist/drivers/instagram.d.ts

@@ -0,0 +1,51 @@
+import type { PublishedPost, PublishPostInput, SocialIdentityCredentials, SocialPublishingDriver, TimelineQuery, TimelineResult } from '../types';
+export declare interface InstagramDriverOptions {
+  graphVersion?: string
+  authBase?: string
+  graphBase?: string
+}
+export declare interface InstagramAuthUrlInput {
+  clientId: string
+  redirectUrl: string
+  scopes: string[]
+  state: string
+}
+export declare interface InstagramTokenExchangeInput {
+  clientId: string
+  clientSecret: string
+  redirectUrl: string
+  code: string
+}
+export declare interface InstagramAccount {
+  igUserId: string
+  username?: string
+  pageAccessToken: string
+}
+export declare class InstagramApiError extends Error {
+  public status: number;
+  public body: string;
+  constructor(message: string, status: number, body: string);
+  get isAuthError(): boolean;
+}
+/**
+ * Publishing driver for Instagram Business/Creator accounts via the Facebook
+ * Graph API. Auth is Facebook Login (OAuth 2.0). Publishing is the documented
+ * two-step flow: create a media container, then publish it.
+ *
+ * Instagram does not allow text-only posts — every post requires an image (or
+ * video) reachable at a public URL, supplied via `post.media`.
+ */
+export declare class InstagramPublishingDriver implements SocialPublishingDriver {
+  readonly provider: 'instagram';
+  characterLimit: number;
+  protected graphVersion: string;
+  protected authBase: string;
+  protected graphBase: string;
+  constructor(options?: InstagramDriverOptions);
+  getAuthUrl(input: InstagramAuthUrlInput): string;
+  exchangeCode(input: InstagramTokenExchangeInput): Promise<{ accessToken: string, expiresIn?: number }>;
+  resolveAccount(accessToken: string): Promise<InstagramAccount>;
+  publish(identity: SocialIdentityCredentials, post: PublishPostInput): Promise<PublishedPost>;
+  timeline(_identity: SocialIdentityCredentials, _query?: TimelineQuery): Promise<TimelineResult>;
+  protected graph<T>(path: string, init: RequestInit): Promise<T>;
+}

package/dist/drivers/linkedin.d.ts

@@ -0,0 +1,62 @@
+import type { PublishedPost, PublishPostInput, SocialIdentityCredentials, SocialPublishingDriver, TimelineQuery, TimelineResult } from '../types';
+/**
+ * Escape the reserved characters of LinkedIn's "little text" commentary format
+ * so the literal text renders as typed. Without this, characters like `(` `)`
+ * `@` `#` cause the share to be rejected with a 400.
+ */
+export declare function escapeLinkedInText(text: string): string;
+export declare interface LinkedInDriverOptions {
+  apiVersion?: string
+  authBase?: string
+  apiBase?: string
+}
+export declare interface LinkedInAuthUrlInput {
+  clientId: string
+  redirectUrl: string
+  scopes: string[]
+  state: string
+}
+export declare interface LinkedInTokenExchangeInput {
+  clientId: string
+  clientSecret: string
+  redirectUrl: string
+  code: string
+}
+export declare interface LinkedInTokenResponse {
+  accessToken: string
+  expiresIn?: number
+  scope?: string
+}
+export declare interface LinkedInProfile {
+  sub: string
+  name?: string
+  picture?: string
+}
+export declare class LinkedInApiError extends Error {
+  public status: number;
+  public body: string;
+  constructor(message: string, status: number, body: string);
+  get isAuthError(): boolean;
+}
+/**
+ * Publishing driver for LinkedIn member shares.
+ *
+ * Auth is OAuth 2.0 (authorization code). Posting uses the versioned REST
+ * `/rest/posts` endpoint with the `w_member_social` scope. Unlike Bluesky,
+ * LinkedIn has no app-password, so a token is always obtained via OAuth (or
+ * pasted in from a prior OAuth grant).
+ */
+export declare class LinkedInPublishingDriver implements SocialPublishingDriver {
+  readonly provider: 'linkedin';
+  characterLimit: number;
+  protected apiVersion: string;
+  protected authBase: string;
+  protected apiBase: string;
+  constructor(options?: LinkedInDriverOptions);
+  getAuthUrl(input: LinkedInAuthUrlInput): string;
+  exchangeCode(input: LinkedInTokenExchangeInput): Promise<LinkedInTokenResponse>;
+  getProfile(accessToken: string): Promise<LinkedInProfile>;
+  publish(identity: SocialIdentityCredentials, post: PublishPostInput): Promise<PublishedPost>;
+  timeline(_identity: SocialIdentityCredentials, _query?: TimelineQuery): Promise<TimelineResult>;
+  protected request<T>(url: string, init: RequestInit): Promise<T>;
+}

package/dist/drivers/threads.d.ts

@@ -0,0 +1,52 @@
+import type { PublishedPost, PublishPostInput, SocialIdentityCredentials, SocialPublishingDriver, TimelineQuery, TimelineResult } from '../types';
+export declare interface ThreadsDriverOptions {
+  graphVersion?: string
+  authBase?: string
+  graphBase?: string
+}
+export declare interface ThreadsAuthUrlInput {
+  clientId: string
+  redirectUrl: string
+  scopes: string[]
+  state: string
+}
+export declare interface ThreadsTokenExchangeInput {
+  clientId: string
+  clientSecret: string
+  redirectUrl: string
+  code: string
+}
+export declare interface ThreadsAccount {
+  threadsUserId: string
+  username?: string
+  accessToken: string
+}
+export declare class ThreadsApiError extends Error {
+  public status: number;
+  public body: string;
+  constructor(message: string, status: number, body: string);
+  get isAuthError(): boolean;
+}
+/**
+ * Publishing driver for Threads (Meta) via the Threads Graph API. Auth is the
+ * Threads OAuth flow (`threads.net/oauth/authorize`, scopes `threads_basic` +
+ * `threads_content_publish`). Publishing is the documented two-step flow:
+ * create a media container, then publish it.
+ *
+ * Unlike Instagram, Threads allows text-only posts — `post.media` is optional
+ * and, when present, the container is created as an `IMAGE` instead of `TEXT`.
+ */
+export declare class ThreadsPublishingDriver implements SocialPublishingDriver {
+  readonly provider: 'threads';
+  characterLimit: number;
+  protected graphVersion: string;
+  protected authBase: string;
+  protected graphBase: string;
+  constructor(options?: ThreadsDriverOptions);
+  getAuthUrl(input: ThreadsAuthUrlInput): string;
+  exchangeCode(input: ThreadsTokenExchangeInput): Promise<{ accessToken: string, userId?: string, expiresIn?: number }>;
+  resolveAccount(accessToken: string): Promise<ThreadsAccount>;
+  publish(identity: SocialIdentityCredentials, post: PublishPostInput): Promise<PublishedPost>;
+  timeline(_identity: SocialIdentityCredentials, _query?: TimelineQuery): Promise<TimelineResult>;
+  protected graph<T>(path: string, init: RequestInit): Promise<T>;
+}

package/dist/index.d.ts

@@ -1 +1,5 @@
+export * from './abstract';
 export * from './drivers/index';
+export * from './exceptions';
+export * from './token';
+export * from './types';

package/dist/index.js

@@ -1,2 +1,3 @@
 // @bun
-var o=import.meta.require;class d extends Error{status;body;constructor(r,t,s){super(r);this.status=t;this.body=s;this.name="BlueskyApiError"}get isAuthError(){return this.status===400||this.status===401||this.status===403}}class S{provider="bluesky";characterLimit=300;service;constructor(r={}){this.service=r.service||"https://bsky.social"}async createSession(r){let t=r.identifier.trim(),s=r.password.trim();if(!t)throw Error("Bluesky identifier is required.");if(!s)throw Error("Bluesky app password is required.");let i=await this.post("/xrpc/com.atproto.server.createSession",{identifier:t,password:s}),a=await this.getProfile({did:i.did,handle:i.handle,accessToken:i.accessJwt,refreshToken:i.refreshJwt}).catch(()=>{return});return{did:i.did,handle:i.handle,displayName:a?.displayName,accessJwt:i.accessJwt,refreshJwt:i.refreshJwt}}async refreshSession(r){if(!r)throw Error("Bluesky refresh token is required.");let t=await this.post("/xrpc/com.atproto.server.refreshSession",void 0,{authorization:`Bearer ${r}`});return{did:t.did,handle:t.handle,accessJwt:t.accessJwt,refreshJwt:t.refreshJwt}}async publish(r,t){let s=r.did||r.handle;if(!r.accessToken)throw Error("Bluesky access token is missing for this identity.");if(!s)throw Error("Bluesky identity DID or handle is required.");if(t.text.length>this.characterLimit)throw Error(`Bluesky posts must be ${this.characterLimit} characters or fewer.`);let i={$type:"app.bsky.feed.post",text:t.text,createdAt:t.scheduledAt||new Date().toISOString()};if(t.langs?.length)i.langs=t.langs;if(t.external)i.embed={$type:"app.bsky.embed.external",external:{uri:t.external.uri,title:t.external.title,description:t.external.description||""}};let a=await this.post("/xrpc/com.atproto.repo.createRecord",{repo:s,collection:"app.bsky.feed.post",record:i},{authorization:`Bearer ${r.accessToken}`});return{provider:this.provider,uri:a.uri,cid:a.cid,url:this.toPostUrl(r.handle,a.uri)}}async timeline(r,t={}){if(!r.accessToken)throw Error("Bluesky access token is missing for this identity.");let s=new URL(`${this.service}/xrpc/app.bsky.feed.getTimeline`);if(s.searchParams.set("limit",String(Math.min(Math.max(t.limit||30,1),100))),t.cursor)s.searchParams.set("cursor",t.cursor);let i=await this.request(s,{headers:{authorization:`Bearer ${r.accessToken}`}});return{cursor:i.cursor,items:(i.feed||[]).flatMap((a)=>{let h=a.post;if(!h?.uri||!h.author?.handle)return[];return[{uri:h.uri,authorHandle:h.author.handle,authorName:h.author.displayName,body:h.record?.text||"",postedAt:h.record?.createdAt||new Date().toISOString(),likeCount:h.likeCount||0,repostCount:h.repostCount||0,replyCount:h.replyCount||0}]})}}async getProfile(r){if(!r.accessToken)throw Error("Bluesky access token is missing for this identity.");let t=r.did||r.handle;if(!t)throw Error("Bluesky identity DID or handle is required.");let s=new URL(`${this.service}/xrpc/app.bsky.actor.getProfile`);return s.searchParams.set("actor",t),await this.request(s,{headers:{authorization:`Bearer ${r.accessToken}`}})}async post(r,t,s={}){return await this.request(new URL(`${this.service}${r}`),{method:"POST",headers:{...t===void 0?{}:{"content-type":"application/json"},...s},...t===void 0?{}:{body:JSON.stringify(t)}})}async request(r,t){let s=await fetch(r,t),i=await s.text();if(!s.ok)throw new d(`Bluesky API failed (${s.status}): ${i||s.statusText}`,s.status,i);return i?JSON.parse(i):{}}toPostUrl(r,t){let s=t.split("/").pop();return`https://bsky.app/profile/${r}/post/${s}`}}import{fetcher as P}from"@stacksjs/api";import{config as w}from"@stacksjs/config";class n{clientId;clientSecret;redirectUrl;parameters={};_scopes=[];scopeSeparator=",";_stateless=!1;_usesPKCE=!1;user=null;constructor(r){this.clientId=r.clientId,this.clientSecret=r.clientSecret,this.redirectUrl=r.redirectUrl}getCodeFields(r=null){let t={client_id:this.clientId,redirect_uri:this.redirectUrl,scope:this.formatScopes(this.getScopes(),this.scopeSeparator),response_type:"code"};if(this.usesState())t.state=r;if(this.usesPKCE())t.code_challenge=this.getCodeChallenge(),t.code_challenge_method=this.getCodeChallengeMethod();return{...t,...this.parameters}}formatScopes(r,t){return r.join(t)}async userFromToken(r){return{...await this.getUserByToken(r),token:r}}scopes(r){let t=Array.isArray(r)?r:[r];return this._scopes=[...new Set([...this._scopes,...t])],this}setScopes(r){let t=Array.isArray(r)?r:[r];return this._scopes=[...new Set(t)],this}getScopes(){return this._scopes}setRedirectUrl(r){if(typeof r!=="string"||r.length===0)throw Error("[socials] setRedirectUrl requires a non-empty string");let t;try{t=new URL(r)}catch{throw Error(`[socials] setRedirectUrl: invalid URL: ${r}`)}if(t.protocol!=="https:"&&t.protocol!=="http:")throw Error(`[socials] setRedirectUrl protocol must be http(s)://, got ${t.protocol}`);return this.redirectUrl=r,this}usesState(){return!this._stateless}validateState(r,t){if(typeof r!=="string"||typeof t!=="string")return!1;if(r.length===0||t.length===0)return!1;if(r.length!==t.length)return!1;try{let{timingSafeEqual:s}=o("crypto");return s(Buffer.from(r,"utf8"),Buffer.from(t,"utf8"))}catch{let s=0;for(let i=0;i<r.length;i++)s|=r.charCodeAt(i)^t.charCodeAt(i);return s===0}}isStateless(){return this._stateless}stateless(){return this._stateless=!0,this}getState(){let r=new Uint8Array(32);return crypto.getRandomValues(r),Array.from(r).map((t)=>t.toString(16).padStart(2,"0")).join("")}usesPKCE(){return this._usesPKCE}enablePKCE(){return this._usesPKCE=!0,this}getCodeVerifier(){let r=new Uint8Array(48);return crypto.getRandomValues(r),Array.from(r).map((t)=>t.toString(16).padStart(2,"0")).join("")}async getCodeChallenge(){let t=new TextEncoder().encode(this.getCodeVerifier()),s=await crypto.subtle.digest("SHA-256",t),{Buffer:i}=await import("buffer");return i.from(new Uint8Array(s)).toString("base64url")}getCodeChallengeMethod(){return"S256"}with(r){return this.parameters=r,this}buildAuthUrlFromBase(r,t){let s=new URLSearchParams(this.getCodeFields(t));return`${r}?${s.toString()}`}}class u extends Error{constructor(r){super(r);this.name="ConfigException"}}class k extends n{baseUrl="https://www.facebook.com";apiUrl="https://graph.facebook.com";getConfig(){let r={clientId:w.services.facebook?.clientId??"",clientSecret:w.services.facebook?.clientSecret??"",redirectUrl:w.services.facebook?.redirectUrl??"",scopes:w.services.facebook?.scopes??["email","public_profile"]};return this.setScopes(r.scopes),r}async getAuthUrl(){let r=this.getState(),{clientId:t,redirectUrl:s,scopes:i}=this.getConfig();return this.validateConfig(),`${this.baseUrl}/v18.0/dialog/oauth?${new URLSearchParams({client_id:t,redirect_uri:s,scope:i.join(","),state:r,response_type:"code"}).toString()}`}async getAccessToken(r){let{clientId:t,clientSecret:s,redirectUrl:i}=this.getConfig();this.validateConfig();let a=await P.get(`${this.apiUrl}/v18.0/oauth/access_token?${new URLSearchParams({client_id:t,client_secret:s,redirect_uri:i,code:r}).toString()}`);if(a.data.error)throw Error(`Facebook OAuth error: ${a.data.error.message}`);return a.data.access_token}async getUserByToken(r){let t=await P.get(`${this.apiUrl}/v18.0/me?${new URLSearchParams({access_token:r,fields:"id,name,email,picture"}).toString()}`);return{id:t.data.id,nickname:null,name:t.data.name,email:t.data.email??null,avatar:t.data.picture?.data.url??null,token:r,raw:t.data}}validateConfig(){let{clientId:r,clientSecret:t,redirectUrl:s}=this.getConfig();if(!r)throw new u("Facebook client ID not provided");if(!t)throw new u("Facebook client secret not provided");if(!s)throw new u("Facebook redirect URL not provided")}getTokenUrl(){return`${this.apiUrl}/v18.0/oauth/access_token`}}import{fetcher as y}from"@stacksjs/api";import{config as e}from"@stacksjs/config";class $ extends n{baseUrl="https://github.com";apiUrl="https://api.github.com";getConfig(){let r={clientId:e.services.github?.clientId??"",clientSecret:e.services.github?.clientSecret??"",redirectUrl:e.services.github?.redirectUrl??"",scopes:e.services.github?.scopes??["read:user","user:email"]};return this.setScopes(r.scopes),r}async getAuthUrl(){let r=this.getState(),{clientId:t,redirectUrl:s,scopes:i}=this.getConfig();return this.validateConfig(),`${this.baseUrl}/login/oauth/authorize?${new URLSearchParams({client_id:t,redirect_uri:s,scope:i.join(" "),state:r,response_type:"code"}).toString()}`}async getAccessToken(r){let{clientId:t,clientSecret:s,redirectUrl:i}=this.getConfig();this.validateConfig();let a=await y.post(`${this.baseUrl}/login/oauth/access_token`,{client_id:t,client_secret:s,code:r,redirect_uri:i});if(a.data.error)throw Error(`GitHub OAuth error: ${a.data.error_description}`);return a.data.access_token}async getUserByToken(r){let[t,s]=await Promise.all([y.withHeaders({Accept:"application/vnd.github.v3+json",Authorization:`token ${r}`}).get(`${this.apiUrl}/user`),y.withHeaders({Accept:"application/vnd.github.v3+json",Authorization:`token ${r}`}).get(`${this.apiUrl}/user/emails`)]);return{id:t.data.id.toString(),nickname:t.data.login,name:t.data.name??t.data.login,email:this.getEmail(s.data)??t.data.email??null,avatar:t.data.avatar_url,token:r,raw:t.data}}getEmail(r){if(!Array.isArray(r)||r.length===0)return null;let t=r.find((i)=>i.primary&&i.verified),s=r.find((i)=>i.verified);return(t||s||r.find((i)=>i.primary)||r[0])?.email??null}validateConfig(){let{clientId:r,clientSecret:t,redirectUrl:s}=this.getConfig();if(!r)throw new u("GitHub client ID not provided");if(!t)throw new u("GitHub client secret not provided");if(!s)throw new u("GitHub redirect URL not provided")}getTokenUrl(){return`${this.baseUrl}/login/oauth/access_token`}}import{fetcher as T}from"@stacksjs/api";import{config as l}from"@stacksjs/config";class J extends n{baseUrl="https://accounts.google.com";apiUrl="https://www.googleapis.com";getConfig(){let r={clientId:l.services.google?.clientId??"",clientSecret:l.services.google?.clientSecret??"",redirectUrl:l.services.google?.redirectUrl??"",scopes:l.services.google?.scopes??["openid","email"]};return this.setScopes(r.scopes),r}async getAuthUrl(){let r=this.getState(),{clientId:t,redirectUrl:s,scopes:i}=this.getConfig();return this.validateConfig(),`${this.baseUrl}/o/oauth2/v2/auth?${new URLSearchParams({client_id:t,redirect_uri:s,scope:i.join(" "),state:r,response_type:"code",access_type:"offline",prompt:"consent"}).toString()}`}async getAccessToken(r){let{clientId:t,clientSecret:s,redirectUrl:i}=this.getConfig();this.validateConfig();let a=await T.post(`${this.baseUrl}/oauth2/v4/token`,{client_id:t,client_secret:s,code:r,redirect_uri:i,grant_type:"authorization_code"});if(a.data.error)throw Error(`Google OAuth error: ${a.data.error_description}`);return a.data.access_token}async getUserByToken(r){let t=await T.withHeaders({Authorization:`Bearer ${r}`}).get(`${this.apiUrl}/oauth2/v2/userinfo`);return{id:t.data.id,nickname:t.data.given_name,name:t.data.name,email:t.data.email,avatar:t.data.picture,token:r,raw:t.data}}validateConfig(){let{clientId:r,clientSecret:t,redirectUrl:s}=this.getConfig();if(!r)throw new u("Google client ID not provided");if(!t)throw new u("Google client secret not provided");if(!s)throw new u("Google redirect URL not provided")}getTokenUrl(){return`${this.baseUrl}/oauth2/v4/token`}}import{Buffer as D}from"buffer";import{createHash as x,randomBytes as N}from"crypto";import{fetcher as B}from"@stacksjs/api";import{config as m}from"@stacksjs/config";class b extends n{baseUrl="https://twitter.com";apiUrl="https://api.twitter.com";codeVerifier=null;getConfig(){let r={clientId:m.services.twitter?.clientId??"",clientSecret:m.services.twitter?.clientSecret??"",redirectUrl:m.services.twitter?.redirectUrl??"",scopes:m.services.twitter?.scopes??["users.read","tweet.read"]};return this.setScopes(r.scopes),r}generateCodeVerifier(){return N(32).toString("base64").replace(/[^a-z0-9]/gi,"").substring(0,128)}generateCodeChallenge(r){return x("sha256").update(r).digest("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async getAuthUrl(){let r=this.getState(),{clientId:t,redirectUrl:s,scopes:i}=this.getConfig();this.validateConfig(),this.codeVerifier=this.generateCodeVerifier();let a=this.generateCodeChallenge(this.codeVerifier);return`${this.baseUrl}/i/oauth2/authorize?${new URLSearchParams({client_id:t,redirect_uri:s,scope:i.join(" "),state:r,response_type:"code",code_challenge:a,code_challenge_method:"S256"}).toString()}`}async getAccessToken(r){let{clientId:t,clientSecret:s,redirectUrl:i}=this.getConfig();if(this.validateConfig(),!this.codeVerifier)throw Error("Code verifier not found. Please ensure getAuthUrl() is called first.");let a=D.from(`${t}:${s}`).toString("base64"),h=await B.withHeaders({Authorization:`Basic ${a}`,"Content-Type":"application/x-www-form-urlencoded"}).post(`${this.apiUrl}/2/oauth2/token`,{code:r,grant_type:"authorization_code",redirect_uri:i,code_verifier:this.codeVerifier});if(h.data.error)throw Error(`Twitter OAuth error: ${h.data.error_description}`);return h.data.access_token}async getUserByToken(r){let t=await B.withHeaders({Authorization:`Bearer ${r}`}).get(`${this.apiUrl}/2/users/me?user.fields=profile_image_url`);return{id:t.data.id,nickname:t.data.username,name:t.data.name,email:t.data.email??null,avatar:t.data.profile_image_url??null,token:r,raw:t.data}}validateConfig(){let{clientId:r,clientSecret:t,redirectUrl:s}=this.getConfig();if(!r)throw new u("Twitter client ID not provided");if(!t)throw new u("Twitter client secret not provided");if(!s)throw new u("Twitter redirect URL not provided")}getTokenUrl(){return`${this.apiUrl}/2/oauth2/token`}}export{b as TwitterProvider,J as GoogleProvider,$ as GitHubProvider,k as FacebookProvider,S as BlueskyPublishingDriver,d as BlueskyApiError};
+var q=import.meta.require;class N{clientId;clientSecret;redirectUrl;parameters={};_scopes=[];scopeSeparator=",";_stateless=!1;_usesPKCE=!1;_state=null;user=null;constructor(w){this.clientId=w.clientId,this.clientSecret=w.clientSecret,this.redirectUrl=w.redirectUrl}getCodeFields(w=null){let h={client_id:this.clientId,redirect_uri:this.redirectUrl,scope:this.formatScopes(this.getScopes(),this.scopeSeparator),response_type:"code"};if(this.usesState())h.state=w;if(this.usesPKCE())h.code_challenge=this.getCodeChallenge(),h.code_challenge_method=this.getCodeChallengeMethod();return{...h,...this.parameters}}formatScopes(w,h){return w.join(h)}async userFromToken(w){return{...await this.getUserByToken(w),token:w}}scopes(w){let h=Array.isArray(w)?w:[w];return this._scopes=[...new Set([...this._scopes,...h])],this}setScopes(w){let h=Array.isArray(w)?w:[w];return this._scopes=[...new Set(h)],this}getScopes(){return this._scopes}setRedirectUrl(w){if(typeof w!=="string"||w.length===0)throw Error("[socials] setRedirectUrl requires a non-empty string");let h;try{h=new URL(w)}catch{throw Error(`[socials] setRedirectUrl: invalid URL: ${w}`)}if(h.protocol!=="https:"&&h.protocol!=="http:")throw Error(`[socials] setRedirectUrl protocol must be http(s)://, got ${h.protocol}`);return this.redirectUrl=w,this}withState(w){if(typeof w!=="string"||w.length===0)throw Error("[socials] withState requires a non-empty string");return this._state=w,this}resolveState(){return this._state??this.getState()}usesState(){return!this._stateless}validateState(w,h){if(typeof w!=="string"||typeof h!=="string")return!1;if(w.length===0||h.length===0)return!1;if(w.length!==h.length)return!1;try{let{timingSafeEqual:P}=q("crypto");return P(Buffer.from(w,"utf8"),Buffer.from(h,"utf8"))}catch{let P=0;for(let S=0;S<w.length;S++)P|=w.charCodeAt(S)^h.charCodeAt(S);return P===0}}isStateless(){return this._stateless}stateless(){return this._stateless=!0,this}getState(){let w=new Uint8Array(32);return crypto.getRandomValues(w),Array.from(w).map((h)=>h.toString(16).padStart(2,"0")).join("")}usesPKCE(){return this._usesPKCE}enablePKCE(){return this._usesPKCE=!0,this}getCodeVerifier(){let w=new Uint8Array(48);return crypto.getRandomValues(w),Array.from(w).map((h)=>h.toString(16).padStart(2,"0")).join("")}async getCodeChallenge(){let h=new TextEncoder().encode(this.getCodeVerifier()),P=await crypto.subtle.digest("SHA-256",h),{Buffer:S}=await import("buffer");return S.from(new Uint8Array(P)).toString("base64url")}getCodeChallengeMethod(){return"S256"}with(w){return this.parameters=w,this}buildAuthUrlFromBase(w,h){let P=new URLSearchParams(this.getCodeFields(h));return`${w}?${P.toString()}`}}import{Buffer as Y}from"buffer";import{createPrivateKey as V,sign as x}from"crypto";import{config as u}from"@stacksjs/config";class L extends Error{constructor(w="Invalid state"){super(w);this.name="InvalidStateException"}}class B extends Error{constructor(w){super(w);this.name="ConfigException"}}class v extends N{baseUrl="https://appleid.apple.com";teamId="";keyId="";privateKey="";constructor(w){super(w);this.teamId=w.teamId??"",this.keyId=w.keyId??"",this.privateKey=w.privateKey??""}getConfig(){let w={clientId:this.clientId||(u.services.apple?.clientId??""),teamId:this.teamId||(u.services.apple?.teamId??""),keyId:this.keyId||(u.services.apple?.keyId??""),privateKey:(this.privateKey||(u.services.apple?.privateKey??"")).replace(/\\n/g,`
+`),redirectUrl:this.redirectUrl||(u.services.apple?.redirectUrl??""),scopes:this._scopes.length>0?this._scopes:u.services.apple?.scopes??["name","email"]};return this.setScopes(w.scopes),w}async getAuthUrl(){let w=this.resolveState(),{clientId:h,redirectUrl:P,scopes:S}=this.getConfig();this.validateConfig();let $={client_id:h,redirect_uri:P,scope:S.join(" "),state:w,response_type:"code",...this.parameters};if(S.length>0)$.response_mode="form_post";return`${this.baseUrl}/auth/authorize?${new URLSearchParams($).toString()}`}async getAccessToken(w){let{clientId:h,redirectUrl:P}=this.getConfig();this.validateConfig();let S=await fetch(`${this.baseUrl}/auth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:w,redirect_uri:P,client_id:h,client_secret:this.generateClientSecret()})}),$=await S.json();if(!S.ok||$.error)throw Error(`Apple OAuth error: ${$.error_description??$.error??`HTTP ${S.status}`}`);if(!$.id_token)throw Error("Apple OAuth error: token response contained no id_token");return $.id_token}async getUserByToken(w){let{clientId:h}=this.getConfig(),P=this.decodeIdToken(w),S=P.iss===this.baseUrl,$=Array.isArray(P.aud)?P.aud.includes(h):P.aud===h,J=typeof P.exp==="number"&&P.exp*1000>Date.now();if(!S||!$||!J)throw Error("Apple OAuth error: id_token claims failed validation (iss/aud/exp)");if(!P.sub)throw Error("Apple OAuth error: id_token has no subject");let D=typeof P.email==="string"?P.email:null,R=null;if(P.email_verified===!0||P.email_verified==="true")R=!0;else if(P.email_verified===!1||P.email_verified==="false")R=!1;return{id:String(P.sub),nickname:null,name:"",email:D,emailVerified:R,avatar:null,token:w,raw:P}}generateClientSecret(){let{clientId:w,teamId:h,keyId:P,privateKey:S}=this.getConfig(),$=Math.floor(Date.now()/1000),J={alg:"ES256",kid:P,typ:"JWT"},D={iss:h,iat:$,exp:$+3600,aud:this.baseUrl,sub:w},R=`${this.base64urlJson(J)}.${this.base64urlJson(D)}`,_;try{_=V(S)}catch(X){throw new B(`Apple private key could not be parsed: ${X instanceof Error?X.message:String(X)}`)}let m=x("sha256",Y.from(R),{key:_,dsaEncoding:"ieee-p1363"});return`${R}.${m.toString("base64url")}`}decodeIdToken(w){let h=w.split(".");if(h.length!==3)throw Error("Apple OAuth error: malformed id_token");return JSON.parse(Y.from(h[1],"base64url").toString("utf8"))}base64urlJson(w){return Y.from(JSON.stringify(w)).toString("base64url")}validateConfig(){let{clientId:w,teamId:h,keyId:P,privateKey:S,redirectUrl:$}=this.getConfig();if(!w)throw new B("Apple client ID (Service ID) not provided");if(!h)throw new B("Apple team ID not provided");if(!P)throw new B("Apple key ID not provided");if(!S)throw new B("Apple private key not provided");if(!$)throw new B("Apple redirect URL not provided")}getTokenUrl(){return`${this.baseUrl}/auth/token`}}class T extends Error{status;body;constructor(w,h,P){super(w);this.status=h;this.body=P;this.name="BlueskyApiError"}get isAuthError(){return this.status===400||this.status===401||this.status===403}}class U{provider="bluesky";characterLimit=300;service;constructor(w={}){this.service=w.service||"https://bsky.social"}async createSession(w){let h=w.identifier.trim(),P=w.password.trim();if(!h)throw Error("Bluesky identifier is required.");if(!P)throw Error("Bluesky app password is required.");let S=await this.post("/xrpc/com.atproto.server.createSession",{identifier:h,password:P}),$=await this.getProfile({did:S.did,handle:S.handle,accessToken:S.accessJwt,refreshToken:S.refreshJwt}).catch(()=>{return});return{did:S.did,handle:S.handle,displayName:$?.displayName,accessJwt:S.accessJwt,refreshJwt:S.refreshJwt}}async refreshSession(w){if(!w)throw Error("Bluesky refresh token is required.");let h=await this.post("/xrpc/com.atproto.server.refreshSession",void 0,{authorization:`Bearer ${w}`});return{did:h.did,handle:h.handle,accessJwt:h.accessJwt,refreshJwt:h.refreshJwt}}async publish(w,h){let P=w.did||w.handle;if(!w.accessToken)throw Error("Bluesky access token is missing for this identity.");if(!P)throw Error("Bluesky identity DID or handle is required.");if(h.text.length>this.characterLimit)throw Error(`Bluesky posts must be ${this.characterLimit} characters or fewer.`);let S={$type:"app.bsky.feed.post",text:h.text,createdAt:h.scheduledAt||new Date().toISOString()};if(h.langs?.length)S.langs=h.langs;if(h.external)S.embed={$type:"app.bsky.embed.external",external:{uri:h.external.uri,title:h.external.title,description:h.external.description||""}};let $=await this.post("/xrpc/com.atproto.repo.createRecord",{repo:P,collection:"app.bsky.feed.post",record:S},{authorization:`Bearer ${w.accessToken}`});return{provider:this.provider,uri:$.uri,cid:$.cid,url:this.toPostUrl(w.handle,$.uri)}}async timeline(w,h={}){if(!w.accessToken)throw Error("Bluesky access token is missing for this identity.");let P=new URL(`${this.service}/xrpc/app.bsky.feed.getTimeline`);if(P.searchParams.set("limit",String(Math.min(Math.max(h.limit||30,1),100))),h.cursor)P.searchParams.set("cursor",h.cursor);let S=await this.request(P,{headers:{authorization:`Bearer ${w.accessToken}`}});return{cursor:S.cursor,items:(S.feed||[]).flatMap(($)=>{let J=$.post;if(!J?.uri||!J.author?.handle)return[];return[{uri:J.uri,authorHandle:J.author.handle,authorName:J.author.displayName,authorAvatar:J.author.avatar,postUrl:this.toPostUrl(J.author.handle,J.uri),body:J.record?.text||"",postedAt:J.record?.createdAt||new Date().toISOString(),likeCount:J.likeCount||0,repostCount:J.repostCount||0,replyCount:J.replyCount||0}]})}}async getProfile(w){if(!w.accessToken)throw Error("Bluesky access token is missing for this identity.");let h=w.did||w.handle;if(!h)throw Error("Bluesky identity DID or handle is required.");let P=new URL(`${this.service}/xrpc/app.bsky.actor.getProfile`);return P.searchParams.set("actor",h),await this.request(P,{headers:{authorization:`Bearer ${w.accessToken}`}})}async post(w,h,P={}){return await this.request(new URL(`${this.service}${w}`),{method:"POST",headers:{...h===void 0?{}:{"content-type":"application/json"},...P},...h===void 0?{}:{body:JSON.stringify(h)}})}async request(w,h){let P=await fetch(w,h),S=await P.text();if(!P.ok)throw new T(`Bluesky API failed (${P.status}): ${S||P.statusText}`,P.status,S);return S?JSON.parse(S):{}}toPostUrl(w,h){let P=h.split("/").pop();return`https://bsky.app/profile/${w}/post/${P}`}}import{fetcher as W}from"@stacksjs/api";import{config as Q}from"@stacksjs/config";class l extends N{baseUrl="https://www.facebook.com";apiUrl="https://graph.facebook.com";getConfig(){let w={clientId:Q.services.facebook?.clientId??"",clientSecret:Q.services.facebook?.clientSecret??"",redirectUrl:Q.services.facebook?.redirectUrl??"",scopes:Q.services.facebook?.scopes??["email","public_profile"]};return this.setScopes(w.scopes),w}async getAuthUrl(){let w=this.getState(),{clientId:h,redirectUrl:P,scopes:S}=this.getConfig();return this.validateConfig(),`${this.baseUrl}/v18.0/dialog/oauth?${new URLSearchParams({client_id:h,redirect_uri:P,scope:S.join(","),state:w,response_type:"code"}).toString()}`}async getAccessToken(w){let{clientId:h,clientSecret:P,redirectUrl:S}=this.getConfig();this.validateConfig();let $=await W.get(`${this.apiUrl}/v18.0/oauth/access_token?${new URLSearchParams({client_id:h,client_secret:P,redirect_uri:S,code:w}).toString()}`);if($.data.error)throw Error(`Facebook OAuth error: ${$.data.error.message}`);return $.data.access_token}async getUserByToken(w){let h=await W.get(`${this.apiUrl}/v18.0/me?${new URLSearchParams({access_token:w,fields:"id,name,email,picture"}).toString()}`);return{id:h.data.id,nickname:null,name:h.data.name,email:h.data.email??null,avatar:h.data.picture?.data.url??null,token:w,raw:h.data}}validateConfig(){let{clientId:w,clientSecret:h,redirectUrl:P}=this.getConfig();if(!w)throw new B("Facebook client ID not provided");if(!h)throw new B("Facebook client secret not provided");if(!P)throw new B("Facebook redirect URL not provided")}getTokenUrl(){return`${this.apiUrl}/v18.0/oauth/access_token`}}import{fetcher as Z}from"@stacksjs/api";import{config as F}from"@stacksjs/config";class C extends N{baseUrl="https://github.com";apiUrl="https://api.github.com";getConfig(){let w={clientId:this.clientId||(F.services.github?.clientId??""),clientSecret:this.clientSecret||(F.services.github?.clientSecret??""),redirectUrl:this.redirectUrl||(F.services.github?.redirectUrl??""),scopes:this._scopes.length>0?this._scopes:F.services.github?.scopes??["read:user","user:email"]};return this.setScopes(w.scopes),w}async getAuthUrl(){let w=this.resolveState(),{clientId:h,redirectUrl:P,scopes:S}=this.getConfig();return this.validateConfig(),`${this.baseUrl}/login/oauth/authorize?${new URLSearchParams({client_id:h,redirect_uri:P,scope:S.join(" "),state:w,response_type:"code",...this.parameters}).toString()}`}async getAccessToken(w){let{clientId:h,clientSecret:P,redirectUrl:S}=this.getConfig();this.validateConfig();let $=await Z.post(`${this.baseUrl}/login/oauth/access_token`,{client_id:h,client_secret:P,code:w,redirect_uri:S});if($.data.error)throw Error(`GitHub OAuth error: ${$.data.error_description}`);return $.data.access_token}async getUserByToken(w){let[h,P]=await Promise.all([Z.withHeaders({Accept:"application/vnd.github.v3+json",Authorization:`token ${w}`}).get(`${this.apiUrl}/user`),Z.withHeaders({Accept:"application/vnd.github.v3+json",Authorization:`token ${w}`}).get(`${this.apiUrl}/user/emails`)]),S=this.pickEmail(P.data);return{id:h.data.id.toString(),nickname:h.data.login,name:h.data.name??h.data.login,email:S?.email??h.data.email??null,emailVerified:S?S.verified:null,avatar:h.data.avatar_url,token:w,raw:h.data}}pickEmail(w){if(!Array.isArray(w)||w.length===0)return null;let h=w.find((S)=>S.primary&&S.verified),P=w.find((S)=>S.verified);return h??P??w.find((S)=>S.primary)??w[0]??null}getEmail(w){return this.pickEmail(w)?.email??null}validateConfig(){let{clientId:w,clientSecret:h,redirectUrl:P}=this.getConfig();if(!w)throw new B("GitHub client ID not provided");if(!h)throw new B("GitHub client secret not provided");if(!P)throw new B("GitHub redirect URL not provided")}getTokenUrl(){return`${this.baseUrl}/login/oauth/access_token`}}import{fetcher as K}from"@stacksjs/api";import{config as G}from"@stacksjs/config";class k extends N{baseUrl="https://accounts.google.com";apiUrl="https://www.googleapis.com";getConfig(){let w={clientId:this.clientId||(G.services.google?.clientId??""),clientSecret:this.clientSecret||(G.services.google?.clientSecret??""),redirectUrl:this.redirectUrl||(G.services.google?.redirectUrl??""),scopes:this._scopes.length>0?this._scopes:G.services.google?.scopes??["openid","email"]};return this.setScopes(w.scopes),w}async getAuthUrl(){let w=this.resolveState(),{clientId:h,redirectUrl:P,scopes:S}=this.getConfig();return this.validateConfig(),`${this.baseUrl}/o/oauth2/v2/auth?${new URLSearchParams({client_id:h,redirect_uri:P,scope:S.join(" "),state:w,response_type:"code",access_type:"offline",prompt:"consent",...this.parameters}).toString()}`}async getAccessToken(w){let{clientId:h,clientSecret:P,redirectUrl:S}=this.getConfig();this.validateConfig();let $=await K.post(`${this.baseUrl}/oauth2/v4/token`,{client_id:h,client_secret:P,code:w,redirect_uri:S,grant_type:"authorization_code"});if($.data.error)throw Error(`Google OAuth error: ${$.data.error_description}`);return $.data.access_token}async getUserByToken(w){let h=await K.withHeaders({Authorization:`Bearer ${w}`}).get(`${this.apiUrl}/oauth2/v2/userinfo`);return{id:h.data.id,nickname:h.data.given_name,name:h.data.name,email:h.data.email,emailVerified:typeof h.data.verified_email==="boolean"?h.data.verified_email:null,avatar:h.data.picture,token:w,raw:h.data}}validateConfig(){let{clientId:w,clientSecret:h,redirectUrl:P}=this.getConfig();if(!w)throw new B("Google client ID not provided");if(!h)throw new B("Google client secret not provided");if(!P)throw new B("Google redirect URL not provided")}getTokenUrl(){return`${this.baseUrl}/oauth2/v4/token`}}class O extends Error{status;body;constructor(w,h,P){super(w);this.status=h;this.body=P;this.name="InstagramApiError"}get isAuthError(){return this.status===401||this.status===403||this.status===190}}class A{provider="instagram";characterLimit=2200;graphVersion;authBase;graphBase;constructor(w={}){this.graphVersion=w.graphVersion||"v21.0",this.authBase=w.authBase||"https://www.facebook.com",this.graphBase=w.graphBase||"https://graph.facebook.com"}getAuthUrl(w){let h=new URLSearchParams({client_id:w.clientId,redirect_uri:w.redirectUrl,scope:w.scopes.join(","),state:w.state,response_type:"code"});return`${this.authBase}/${this.graphVersion}/dialog/oauth?${h.toString()}`}async exchangeCode(w){let h=new URLSearchParams({client_id:w.clientId,client_secret:w.clientSecret,redirect_uri:w.redirectUrl,code:w.code}),P=await this.graph(`/oauth/access_token?${h.toString()}`,{method:"GET"});if(!P.access_token)throw new O("Facebook did not return an access token.",400,JSON.stringify(P));return{accessToken:P.access_token,expiresIn:P.expires_in}}async resolveAccount(w){let h=new URLSearchParams({fields:"name,access_token,instagram_business_account{id,username}",access_token:w}),P=await this.graph(`/me/accounts?${h.toString()}`,{method:"GET"}),S=(P.data||[]).find((J)=>J.instagram_business_account?.id),$=S?.instagram_business_account;if(!$?.id||!S?.access_token)throw new O("No Instagram Business account is linked to your Facebook Pages.",400,JSON.stringify(P));return{igUserId:$.id,username:$.username,pageAccessToken:S.access_token}}async publish(w,h){if(!w.accessToken)throw Error("Instagram access token is missing for this identity.");let P=w.did;if(!P)throw Error("Instagram account id is required to publish.");let S=h.media?.[0];if(!S?.url)throw Error("Instagram requires an image to post.");if(h.text.length>this.characterLimit)throw Error(`Instagram captions must be ${this.characterLimit} characters or fewer.`);let $=await this.graph(`/${P}/media`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({image_url:S.url,caption:h.text,access_token:w.accessToken}).toString()});if(!$.id)throw new O("Instagram did not return a media container id.",400,JSON.stringify($));let J=await this.graph(`/${P}/media_publish`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({creation_id:$.id,access_token:w.accessToken}).toString()}),D=await this.graph(`/${J.id}?fields=permalink&access_token=${encodeURIComponent(w.accessToken)}`,{method:"GET"}).catch(()=>{return});return{provider:this.provider,uri:J.id,url:D?.permalink}}async timeline(w,h={}){return{items:[]}}async graph(w,h){let P=await fetch(`${this.graphBase}/${this.graphVersion}${w}`,h),S=await P.text(),$={};try{$=S?JSON.parse(S):{}}catch{$={}}if(!P.ok||$?.error){let J=$?.error?.message||S||P.statusText;throw new O(`Instagram API failed (${P.status}): ${J}`,P.status,S)}return $}}class M extends Error{status;body;constructor(w,h,P){super(w);this.status=h;this.body=P;this.name="LinkedInApiError"}get isAuthError(){return this.status===401||this.status===403}}class E{provider="linkedin";characterLimit=3000;apiVersion;authBase;apiBase;constructor(w={}){this.apiVersion=w.apiVersion||"202405",this.authBase=w.authBase||"https://www.linkedin.com",this.apiBase=w.apiBase||"https://api.linkedin.com"}getAuthUrl(w){let h=new URLSearchParams({response_type:"code",client_id:w.clientId,redirect_uri:w.redirectUrl,scope:w.scopes.join(" "),state:w.state});return`${this.authBase}/oauth/v2/authorization?${h.toString()}`}async exchangeCode(w){let h=new URLSearchParams({grant_type:"authorization_code",code:w.code,redirect_uri:w.redirectUrl,client_id:w.clientId,client_secret:w.clientSecret}),P=await this.request(`${this.authBase}/oauth/v2/accessToken`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:h.toString()});if(!P.access_token)throw new M("LinkedIn did not return an access token.",400,JSON.stringify(P));return{accessToken:P.access_token,expiresIn:P.expires_in,scope:P.scope}}async getProfile(w){if(!w)throw Error("LinkedIn access token is required.");let h=await this.request(`${this.apiBase}/v2/userinfo`,{headers:{authorization:`Bearer ${w}`}});if(!h.sub)throw new M("LinkedIn profile is missing a subject id.",400,JSON.stringify(h));return{sub:h.sub,name:h.name,picture:h.picture}}async publish(w,h){if(!w.accessToken)throw Error("LinkedIn access token is missing for this identity.");let P=w.did;if(!P)throw Error("LinkedIn member URN is required to publish.");if(h.text.length>this.characterLimit)throw Error(`LinkedIn posts must be ${this.characterLimit} characters or fewer.`);let S={author:P,commentary:j(h.text),visibility:"PUBLIC",distribution:{feedDistribution:"MAIN_FEED",targetEntities:[],thirdPartyDistributionChannels:[]},lifecycleState:"PUBLISHED",isReshareDisabledByAuthor:!1};if(h.external)S.content={article:{source:h.external.uri,title:h.external.title,description:h.external.description||""}};let $=await fetch(`${this.apiBase}/rest/posts`,{method:"POST",headers:{authorization:`Bearer ${w.accessToken}`,"content-type":"application/json","linkedin-version":this.apiVersion,"x-restli-protocol-version":"2.0.0"},body:JSON.stringify(S)}),J=await $.text();if(!$.ok)throw new M(`LinkedIn API failed (${$.status}): ${J||$.statusText}`,$.status,J);let D=$.headers.get("x-restli-id")||$.headers.get("x-linkedin-id")||"";return{provider:this.provider,uri:D,url:D?`https://www.linkedin.com/feed/update/${D}`:void 0}}async timeline(w,h={}){return{items:[]}}async request(w,h){let P=await fetch(w,h),S=await P.text();if(!P.ok)throw new M(`LinkedIn API failed (${P.status}): ${S||P.statusText}`,P.status,S);return S?JSON.parse(S):{}}}function j(w){return w.replace(/[\\|{}@[\]()<>#*_~]/g,"\\$&")}class z extends Error{status;body;constructor(w,h,P){super(w);this.status=h;this.body=P;this.name="ThreadsApiError"}get isAuthError(){return this.status===401||this.status===403||this.status===190}}class I{provider="threads";characterLimit=500;graphVersion;authBase;graphBase;constructor(w={}){this.graphVersion=w.graphVersion||"v1.0",this.authBase=w.authBase||"https://threads.net",this.graphBase=w.graphBase||"https://graph.threads.net"}getAuthUrl(w){let h=new URLSearchParams({client_id:w.clientId,redirect_uri:w.redirectUrl,scope:w.scopes.join(","),response_type:"code",state:w.state});return`${this.authBase}/oauth/authorize?${h.toString()}`}async exchangeCode(w){let h=await fetch(`${this.graphBase}/oauth/access_token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:w.clientId,client_secret:w.clientSecret,grant_type:"authorization_code",redirect_uri:w.redirectUrl,code:w.code}).toString()}),P=await h.text(),S={};try{S=P?JSON.parse(P):{}}catch{S={}}if(!h.ok||S?.error||!S?.access_token){let $=S?.error_message||S?.error?.message||P||h.statusText;throw new z(`Threads token exchange failed (${h.status}): ${$}`,h.status,P)}return{accessToken:S.access_token,userId:S.user_id!=null?String(S.user_id):void 0,expiresIn:S.expires_in}}async resolveAccount(w){let h=new URLSearchParams({fields:"id,username",access_token:w}),P=await this.graph(`/me?${h.toString()}`,{method:"GET"});if(!P.id)throw new z("Could not resolve the Threads account for this token.",400,JSON.stringify(P));return{threadsUserId:P.id,username:P.username,accessToken:w}}async publish(w,h){if(!w.accessToken)throw Error("Threads access token is missing for this identity.");let P=w.did;if(!P)throw Error("Threads account id is required to publish.");if(h.text.length>this.characterLimit)throw Error(`Threads posts must be ${this.characterLimit} characters or fewer.`);let S=h.media?.[0],$=new URLSearchParams({text:h.text,access_token:w.accessToken});if(S?.url)$.set("media_type","IMAGE"),$.set("image_url",S.url);else $.set("media_type","TEXT");let J=await this.graph(`/${P}/threads`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:$.toString()});if(!J.id)throw new z("Threads did not return a media container id.",400,JSON.stringify(J));let D=await this.graph(`/${P}/threads_publish`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({creation_id:J.id,access_token:w.accessToken}).toString()});if(!D.id)throw new z("Threads did not return a published post id.",400,JSON.stringify(D));let R=await this.graph(`/${D.id}?fields=permalink&access_token=${encodeURIComponent(w.accessToken)}`,{method:"GET"}).catch(()=>{return});return{provider:this.provider,uri:D.id,url:R?.permalink}}async timeline(w,h={}){return{items:[]}}async graph(w,h){let P=await fetch(`${this.graphBase}/${this.graphVersion}${w}`,h),S=await P.text(),$={};try{$=S?JSON.parse(S):{}}catch{$={}}if(!P.ok||$?.error){let J=$?.error?.message||S||P.statusText;throw new z(`Threads API failed (${P.status}): ${J}`,P.status,S)}return $}}import{Buffer as y}from"buffer";import{createHash as r,randomBytes as g}from"crypto";import{fetcher as b}from"@stacksjs/api";import{config as H}from"@stacksjs/config";class f extends N{baseUrl="https://twitter.com";apiUrl="https://api.twitter.com";codeVerifier=null;getConfig(){let w={clientId:H.services.twitter?.clientId??"",clientSecret:H.services.twitter?.clientSecret??"",redirectUrl:H.services.twitter?.redirectUrl??"",scopes:H.services.twitter?.scopes??["users.read","tweet.read"]};return this.setScopes(w.scopes),w}generateCodeVerifier(){return g(32).toString("base64").replace(/[^a-z0-9]/gi,"").substring(0,128)}generateCodeChallenge(w){return r("sha256").update(w).digest("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async getAuthUrl(){let w=this.getState(),{clientId:h,redirectUrl:P,scopes:S}=this.getConfig();this.validateConfig(),this.codeVerifier=this.generateCodeVerifier();let $=this.generateCodeChallenge(this.codeVerifier);return`${this.baseUrl}/i/oauth2/authorize?${new URLSearchParams({client_id:h,redirect_uri:P,scope:S.join(" "),state:w,response_type:"code",code_challenge:$,code_challenge_method:"S256"}).toString()}`}async getAccessToken(w){let{clientId:h,clientSecret:P,redirectUrl:S}=this.getConfig();if(this.validateConfig(),!this.codeVerifier)throw Error("Code verifier not found. Please ensure getAuthUrl() is called first.");let $=y.from(`${h}:${P}`).toString("base64"),J=await b.withHeaders({Authorization:`Basic ${$}`,"Content-Type":"application/x-www-form-urlencoded"}).post(`${this.apiUrl}/2/oauth2/token`,{code:w,grant_type:"authorization_code",redirect_uri:S,code_verifier:this.codeVerifier});if(J.data.error)throw Error(`Twitter OAuth error: ${J.data.error_description}`);return J.data.access_token}async getUserByToken(w){let h=await b.withHeaders({Authorization:`Bearer ${w}`}).get(`${this.apiUrl}/2/users/me?user.fields=profile_image_url`);return{id:h.data.id,nickname:h.data.username,name:h.data.name,email:h.data.email??null,avatar:h.data.profile_image_url??null,token:w,raw:h.data}}validateConfig(){let{clientId:w,clientSecret:h,redirectUrl:P}=this.getConfig();if(!w)throw new B("Twitter client ID not provided");if(!h)throw new B("Twitter client secret not provided");if(!P)throw new B("Twitter redirect URL not provided")}getTokenUrl(){return`${this.apiUrl}/2/oauth2/token`}}class a{accessToken;refreshToken;expiresIn;approvedScopes;constructor(w,h=null,P=null,S=[]){this.accessToken=w;this.refreshToken=h;this.expiresIn=P;this.approvedScopes=S}}export{j as escapeLinkedInText,f as TwitterProvider,a as Token,I as ThreadsPublishingDriver,z as ThreadsApiError,E as LinkedInPublishingDriver,M as LinkedInApiError,L as InvalidStateException,A as InstagramPublishingDriver,O as InstagramApiError,k as GoogleProvider,C as GitHubProvider,l as FacebookProvider,B as ConfigException,U as BlueskyPublishingDriver,T as BlueskyApiError,v as AppleProvider,N as AbstractProvider};

package/dist/token.d.ts

@@ -0,0 +1,7 @@
+export declare class Token {
+  public accessToken: string;
+  public refreshToken?: string | null;
+  public expiresIn?: number | null;
+  public approvedScopes?: string[];
+  constructor(accessToken: string, refreshToken?: string | null, expiresIn?: number | null, approvedScopes?: string[]);
+}

package/dist/types.d.ts

@@ -7,6 +7,7 @@ export declare interface SocialUser {
   nickname: string | null
   name: string
   email: string | null
+  emailVerified?: boolean | null
   avatar: string | null
   token: string
   raw?: any
@@ -57,6 +58,35 @@ export declare interface TwitterUser {
   email?: string
   profile_image_url?: string
 }
+/**
+ * Apple-specific token response from https://appleid.apple.com/auth/token
+ */
+export declare interface AppleTokenResponse {
+  access_token: string
+  token_type: string
+  expires_in: number
+  refresh_token?: string
+  id_token: string
+  error?: string
+  error_description?: string
+}
+/**
+ * Claims Apple places in the id_token. `email_verified` and
+ * `is_private_email` arrive as booleans or the strings 'true'/'false'
+ * depending on the API era.
+ */
+export declare interface AppleIdTokenClaims {
+  iss: string
+  aud: string | string[]
+  exp: number
+  iat: number
+  sub: string
+  nonce?: string
+  email?: string
+  email_verified?: boolean | 'true' | 'false'
+  is_private_email?: boolean | 'true' | 'false'
+  [key: string]: any
+}
 export declare interface BlueskySessionCredentials {
   identifier: string
   password: string
@@ -83,6 +113,10 @@ export declare interface PublishPostInput {
     title: string
     description?: string
   }
+  media?: Array<{
+    url: string
+    altText?: string
+  }>
 }
 export declare interface PublishedPost {
   provider: SocialPublishingProvider
@@ -100,6 +134,8 @@ export declare interface TimelineResult {
     uri: string
     authorHandle: string
     authorName?: string
+    authorAvatar?: string
+    postUrl?: string
     body: string
     postedAt: string
     likeCount: number
@@ -119,4 +155,5 @@ export type SocialPublishingProvider = | 'bluesky'
   | 'facebook'
   | 'instagram'
   | 'tiktok'
-  | 'linkedin';
+  | 'linkedin'
+  | 'threads';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/socials",
   "type": "module",
-  "version": "0.70.44",
+  "version": "0.70.53",
   "description": "A simple and elegant social authentication package for Stacks.",
   "author": "Chris Breuer",
   "contributors": [
@@ -48,7 +48,7 @@
   },
   "devDependencies": {
     "better-dx": "^0.2.12",
-    "@stacksjs/error-handling": "^0.70.44",
-    "@stacksjs/router": "^0.70.44"
+    "@stacksjs/error-handling": "0.70.53",
+    "@stacksjs/router": "0.70.53"
   }
 }