@stacksjs/socials 0.70.86 → 0.70.88

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/socials",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.86",
+  "version": "0.70.88",
   "description": "A simple and elegant social authentication package for Stacks.",
   "author": "Chris Breuer",
   "contributors": [
@@ -53,7 +53,7 @@
   },
   "devDependencies": {
     "better-dx": "^0.2.16",
-    "@stacksjs/error-handling": "0.70.86",
-    "@stacksjs/router": "0.70.86"
+    "@stacksjs/error-handling": "0.70.88",
+    "@stacksjs/router": "0.70.88"
   }
 }

package/dist/abstract.d.ts

@@ -1,45 +0,0 @@
-import type { ProviderInterface, SocialUser } from './types';
-export declare interface ProviderConfig {
-  clientId: string
-  clientSecret: string
-  redirectUrl: string
-  guzzle?: Record<string, any>
-}
-export declare abstract class AbstractProvider implements ProviderInterface {
-  protected clientId: string;
-  protected clientSecret: string;
-  protected redirectUrl: string;
-  protected parameters: Record<string, any>;
-  protected _scopes: string[];
-  protected scopeSeparator: string;
-  protected _stateless: boolean;
-  protected _usesPKCE: boolean;
-  protected _state: string | null;
-  protected user: SocialUser | null;
-  constructor(config: ProviderConfig);
-  abstract getAuthUrl(): Promise<string>;
-  protected abstract getTokenUrl(): string;
-  abstract getAccessToken(code: string): Promise<string>;
-  abstract getUserByToken(token: string): Promise<SocialUser>;
-  protected getCodeFields(state?: string | null): Record<string, any>;
-  protected formatScopes(scopes: string[], scopeSeparator: string): string;
-  userFromToken(token: string): Promise<SocialUser>;
-  scopes(scopes: string | string[]): this;
-  setScopes(scopes: string | string[]): this;
-  getScopes(): string[];
-  setRedirectUrl(url: string): this;
-  withState(state: string): this;
-  protected resolveState(): string;
-  protected usesState(): boolean;
-  validateState(expected: string | null | undefined, actual: string | null | undefined): boolean;
-  protected isStateless(): boolean;
-  stateless(): this;
-  protected getState(): string;
-  protected usesPKCE(): boolean;
-  enablePKCE(): this;
-  protected getCodeVerifier(): string;
-  protected getCodeChallenge(): Promise<string>;
-  protected getCodeChallengeMethod(): string;
-  with(parameters: Record<string, any>): this;
-  protected buildAuthUrlFromBase(url: string, state: string | null): string;
-}

package/dist/drivers/apple.d.ts

@@ -1,56 +0,0 @@
-import { AbstractProvider } from '../abstract';
-import type { AppleIdTokenClaims, ProviderInterface, SocialUser } from '../types';
-import type { ProviderConfig } from '../abstract';
-/**
- * Apple replaces the static client secret with a signed JWT, so its
- * provider config carries the signing inputs instead of clientSecret
- * (which may be left '').
- */
-export declare interface AppleProviderConfig extends ProviderConfig {
-  teamId?: string
-  keyId?: string
-  privateKey?: string
-}
-/**
- * Sign in with Apple (OAuth2 / OIDC).
- *
- * Apple deviates from the other providers in three ways, all handled
- * here so callers keep the same getAuthUrl/getAccessToken/getUserByToken
- * contract:
- *
- * 1. There is no static client secret. Apple requires a short-lived JWT
- *    signed with an ES256 private key (.p8) issued in the developer
- *    portal, scoped by team ID and key ID. `generateClientSecret()`
- *    builds one per token exchange.
- * 2. There is no userinfo endpoint. Identity comes from the `id_token`
- *    returned by the token endpoint, so `getAccessToken()` returns the
- *    id_token (not the access token — there is nothing to spend it on),
- *    and `getUserByToken()` decodes its claims. The id_token arrives
- *    straight from Apple's token endpoint over TLS, which OIDC Core
- *    3.1.3.7 accepts in place of local signature verification; iss, aud
- *    and exp are still validated.
- * 3. When scopes are requested (they are by default: name + email),
- *    Apple mandates `response_mode=form_post` — the callback arrives as
- *    a cross-site POST, not a GET. Applications must register a POST
- *    callback route and use a cookie jar that survives cross-site POSTs
- *    (SameSite=None) if they carry state in cookies.
- *
- * Note that Apple only transmits the user's name (and only on the very
- * first authorization) as a `user` JSON field in the form_post body —
- * it is never part of the id_token. Reading it is the application's
- * job; `SocialUser.name` from this driver is therefore always ''.
- */
-export declare class AppleProvider extends AbstractProvider implements ProviderInterface {
-  protected baseUrl: string;
-  protected teamId: string;
-  protected keyId: string;
-  protected privateKey: string;
-  constructor(providerConfig: AppleProviderConfig);
-  getAuthUrl(): Promise<string>;
-  getAccessToken(code: string): Promise<string>;
-  getUserByToken(token: string): Promise<SocialUser>;
-  protected generateClientSecret(): string;
-  protected decodeIdToken(idToken: string): AppleIdTokenClaims;
-  protected validateConfig(): void;
-  protected getTokenUrl(): string;
-}

package/dist/drivers/bluesky.d.ts

@@ -1,24 +0,0 @@
-import type { BlueskySession, BlueskySessionCredentials, PublishedPost, PublishPostInput, SocialIdentityCredentials, SocialPublishingDriver, TimelineQuery, TimelineResult } from '../types';
-export declare interface BlueskyDriverOptions {
-  service?: string
-}
-export declare class BlueskyApiError extends Error {
-  public status: number;
-  public body: string;
-  constructor(message: string, status: number, body: string);
-  get isAuthError(): boolean;
-}
-export declare class BlueskyPublishingDriver implements SocialPublishingDriver {
-  readonly provider: 'bluesky';
-  characterLimit: number;
-  protected service: string;
-  constructor(options?: BlueskyDriverOptions);
-  createSession(credentials: BlueskySessionCredentials): Promise<BlueskySession>;
-  refreshSession(refreshToken: string): Promise<BlueskySession>;
-  publish(identity: SocialIdentityCredentials, post: PublishPostInput): Promise<PublishedPost>;
-  timeline(identity: SocialIdentityCredentials, query?: TimelineQuery): Promise<TimelineResult>;
-  getProfile(identity: SocialIdentityCredentials): Promise<{ did: string, handle: string, displayName?: string }>;
-  protected post<T>(path: string, body?: unknown, headers?: Record<string, string>): Promise<T>;
-  protected request<T>(url: URL, init: RequestInit): Promise<T>;
-  protected toPostUrl(handle: string, uri: string): string;
-}

package/dist/drivers/facebook.d.ts

@@ -1,11 +0,0 @@
-import { AbstractProvider } from '../abstract';
-import type { ProviderInterface, SocialUser } from '../types';
-export declare class FacebookProvider extends AbstractProvider implements ProviderInterface {
-  protected baseUrl: string;
-  protected apiUrl: string;
-  getAuthUrl(): Promise<string>;
-  getAccessToken(code: string): Promise<string>;
-  getUserByToken(token: string): Promise<SocialUser>;
-  protected validateConfig(): void;
-  protected getTokenUrl(): string;
-}

package/dist/drivers/github.d.ts

@@ -1,13 +0,0 @@
-import { AbstractProvider } from '../abstract';
-import type { GitHubEmail, ProviderInterface, SocialUser } from '../types';
-export declare class GitHubProvider extends AbstractProvider implements ProviderInterface {
-  protected baseUrl: string;
-  protected apiUrl: string;
-  getAuthUrl(): Promise<string>;
-  getAccessToken(code: string): Promise<string>;
-  getUserByToken(token: string): Promise<SocialUser>;
-  protected pickEmail(emails: GitHubEmail[]): GitHubEmail | null;
-  protected getEmail(emails: GitHubEmail[]): string | null;
-  protected validateConfig(): void;
-  protected getTokenUrl(): string;
-}

package/dist/drivers/google.d.ts

@@ -1,11 +0,0 @@
-import { AbstractProvider } from '../abstract';
-import type { ProviderInterface, SocialUser } from '../types';
-export declare class GoogleProvider extends AbstractProvider implements ProviderInterface {
-  protected baseUrl: string;
-  protected apiUrl: string;
-  getAuthUrl(): Promise<string>;
-  getAccessToken(code: string): Promise<string>;
-  getUserByToken(token: string): Promise<SocialUser>;
-  protected validateConfig(): void;
-  protected getTokenUrl(): string;
-}

package/dist/drivers/index.d.ts

@@ -1,9 +0,0 @@
-export * from './apple';
-export * from './bluesky';
-export * from './facebook';
-export * from './github';
-export * from './google';
-export * from './instagram';
-export * from './linkedin';
-export * from './threads';
-export * from './twitter';

package/dist/drivers/instagram.d.ts

@@ -1,51 +0,0 @@
-import type { PublishedPost, PublishPostInput, SocialIdentityCredentials, SocialPublishingDriver, TimelineQuery, TimelineResult } from '../types';
-export declare interface InstagramDriverOptions {
-  graphVersion?: string
-  authBase?: string
-  graphBase?: string
-}
-export declare interface InstagramAuthUrlInput {
-  clientId: string
-  redirectUrl: string
-  scopes: string[]
-  state: string
-}
-export declare interface InstagramTokenExchangeInput {
-  clientId: string
-  clientSecret: string
-  redirectUrl: string
-  code: string
-}
-export declare interface InstagramAccount {
-  igUserId: string
-  username?: string
-  pageAccessToken: string
-}
-export declare class InstagramApiError extends Error {
-  public status: number;
-  public body: string;
-  constructor(message: string, status: number, body: string);
-  get isAuthError(): boolean;
-}
-/**
- * Publishing driver for Instagram Business/Creator accounts via the Facebook
- * Graph API. Auth is Facebook Login (OAuth 2.0). Publishing is the documented
- * two-step flow: create a media container, then publish it.
- *
- * Instagram does not allow text-only posts — every post requires an image (or
- * video) reachable at a public URL, supplied via `post.media`.
- */
-export declare class InstagramPublishingDriver implements SocialPublishingDriver {
-  readonly provider: 'instagram';
-  characterLimit: number;
-  protected graphVersion: string;
-  protected authBase: string;
-  protected graphBase: string;
-  constructor(options?: InstagramDriverOptions);
-  getAuthUrl(input: InstagramAuthUrlInput): string;
-  exchangeCode(input: InstagramTokenExchangeInput): Promise<{ accessToken: string, expiresIn?: number }>;
-  resolveAccount(accessToken: string): Promise<InstagramAccount>;
-  publish(identity: SocialIdentityCredentials, post: PublishPostInput): Promise<PublishedPost>;
-  timeline(_identity: SocialIdentityCredentials, _query?: TimelineQuery): Promise<TimelineResult>;
-  protected graph<T>(path: string, init: RequestInit): Promise<T>;
-}

package/dist/drivers/linkedin.d.ts

@@ -1,62 +0,0 @@
-import type { PublishedPost, PublishPostInput, SocialIdentityCredentials, SocialPublishingDriver, TimelineQuery, TimelineResult } from '../types';
-/**
- * Escape the reserved characters of LinkedIn's "little text" commentary format
- * so the literal text renders as typed. Without this, characters like `(` `)`
- * `@` `#` cause the share to be rejected with a 400.
- */
-export declare function escapeLinkedInText(text: string): string;
-export declare interface LinkedInDriverOptions {
-  apiVersion?: string
-  authBase?: string
-  apiBase?: string
-}
-export declare interface LinkedInAuthUrlInput {
-  clientId: string
-  redirectUrl: string
-  scopes: string[]
-  state: string
-}
-export declare interface LinkedInTokenExchangeInput {
-  clientId: string
-  clientSecret: string
-  redirectUrl: string
-  code: string
-}
-export declare interface LinkedInTokenResponse {
-  accessToken: string
-  expiresIn?: number
-  scope?: string
-}
-export declare interface LinkedInProfile {
-  sub: string
-  name?: string
-  picture?: string
-}
-export declare class LinkedInApiError extends Error {
-  public status: number;
-  public body: string;
-  constructor(message: string, status: number, body: string);
-  get isAuthError(): boolean;
-}
-/**
- * Publishing driver for LinkedIn member shares.
- *
- * Auth is OAuth 2.0 (authorization code). Posting uses the versioned REST
- * `/rest/posts` endpoint with the `w_member_social` scope. Unlike Bluesky,
- * LinkedIn has no app-password, so a token is always obtained via OAuth (or
- * pasted in from a prior OAuth grant).
- */
-export declare class LinkedInPublishingDriver implements SocialPublishingDriver {
-  readonly provider: 'linkedin';
-  characterLimit: number;
-  protected apiVersion: string;
-  protected authBase: string;
-  protected apiBase: string;
-  constructor(options?: LinkedInDriverOptions);
-  getAuthUrl(input: LinkedInAuthUrlInput): string;
-  exchangeCode(input: LinkedInTokenExchangeInput): Promise<LinkedInTokenResponse>;
-  getProfile(accessToken: string): Promise<LinkedInProfile>;
-  publish(identity: SocialIdentityCredentials, post: PublishPostInput): Promise<PublishedPost>;
-  timeline(_identity: SocialIdentityCredentials, _query?: TimelineQuery): Promise<TimelineResult>;
-  protected request<T>(url: string, init: RequestInit): Promise<T>;
-}

package/dist/drivers/threads.d.ts

@@ -1,52 +0,0 @@
-import type { PublishedPost, PublishPostInput, SocialIdentityCredentials, SocialPublishingDriver, TimelineQuery, TimelineResult } from '../types';
-export declare interface ThreadsDriverOptions {
-  graphVersion?: string
-  authBase?: string
-  graphBase?: string
-}
-export declare interface ThreadsAuthUrlInput {
-  clientId: string
-  redirectUrl: string
-  scopes: string[]
-  state: string
-}
-export declare interface ThreadsTokenExchangeInput {
-  clientId: string
-  clientSecret: string
-  redirectUrl: string
-  code: string
-}
-export declare interface ThreadsAccount {
-  threadsUserId: string
-  username?: string
-  accessToken: string
-}
-export declare class ThreadsApiError extends Error {
-  public status: number;
-  public body: string;
-  constructor(message: string, status: number, body: string);
-  get isAuthError(): boolean;
-}
-/**
- * Publishing driver for Threads (Meta) via the Threads Graph API. Auth is the
- * Threads OAuth flow (`threads.net/oauth/authorize`, scopes `threads_basic` +
- * `threads_content_publish`). Publishing is the documented two-step flow:
- * create a media container, then publish it.
- *
- * Unlike Instagram, Threads allows text-only posts — `post.media` is optional
- * and, when present, the container is created as an `IMAGE` instead of `TEXT`.
- */
-export declare class ThreadsPublishingDriver implements SocialPublishingDriver {
-  readonly provider: 'threads';
-  characterLimit: number;
-  protected graphVersion: string;
-  protected authBase: string;
-  protected graphBase: string;
-  constructor(options?: ThreadsDriverOptions);
-  getAuthUrl(input: ThreadsAuthUrlInput): string;
-  exchangeCode(input: ThreadsTokenExchangeInput): Promise<{ accessToken: string, userId?: string, expiresIn?: number }>;
-  resolveAccount(accessToken: string): Promise<ThreadsAccount>;
-  publish(identity: SocialIdentityCredentials, post: PublishPostInput): Promise<PublishedPost>;
-  timeline(_identity: SocialIdentityCredentials, _query?: TimelineQuery): Promise<TimelineResult>;
-  protected graph<T>(path: string, init: RequestInit): Promise<T>;
-}

package/dist/drivers/twitter.d.ts

@@ -1,11 +0,0 @@
-import { AbstractProvider } from '../abstract';
-import type { ProviderInterface, SocialUser } from '../types';
-export declare class TwitterProvider extends AbstractProvider implements ProviderInterface {
-  protected baseUrl: string;
-  protected apiUrl: string;
-  getAuthUrl(): Promise<string>;
-  getAccessToken(code: string): Promise<string>;
-  getUserByToken(token: string): Promise<SocialUser>;
-  protected validateConfig(): void;
-  protected getTokenUrl(): string;
-}

package/dist/exceptions.d.ts

@@ -1,6 +0,0 @@
-export declare class InvalidStateException extends Error {
-  constructor(message?: string);
-}
-export declare class ConfigException extends Error {
-  constructor(message: string);
-}

package/dist/index.d.ts

@@ -1,5 +0,0 @@
-export * from './abstract';
-export * from './drivers/index';
-export * from './exceptions';
-export * from './token';
-export * from './types';

package/dist/index.js

@@ -1,3 +0,0 @@
-// @bun
-var _=import.meta.require;class N{clientId;clientSecret;redirectUrl;parameters={};_scopes=[];scopeSeparator=",";_stateless=!1;_usesPKCE=!1;_state=null;user=null;constructor(w){this.clientId=w.clientId,this.clientSecret=w.clientSecret,this.redirectUrl=w.redirectUrl}getCodeFields(w=null){let h={client_id:this.clientId,redirect_uri:this.redirectUrl,scope:this.formatScopes(this.getScopes(),this.scopeSeparator),response_type:"code"};if(this.usesState())h.state=w;if(this.usesPKCE())h.code_challenge=this.getCodeChallenge(),h.code_challenge_method=this.getCodeChallengeMethod();return{...h,...this.parameters}}formatScopes(w,h){return w.join(h)}async userFromToken(w){return{...await this.getUserByToken(w),token:w}}scopes(w){let h=Array.isArray(w)?w:[w];return this._scopes=[...new Set([...this._scopes,...h])],this}setScopes(w){let h=Array.isArray(w)?w:[w];return this._scopes=[...new Set(h)],this}getScopes(){return this._scopes}setRedirectUrl(w){if(typeof w!=="string"||w.length===0)throw Error("[socials] setRedirectUrl requires a non-empty string");let h;try{h=new URL(w)}catch{throw Error(`[socials] setRedirectUrl: invalid URL: ${w}`)}if(h.protocol!=="https:"&&h.protocol!=="http:")throw Error(`[socials] setRedirectUrl protocol must be http(s)://, got ${h.protocol}`);return this.redirectUrl=w,this}withState(w){if(typeof w!=="string"||w.length===0)throw Error("[socials] withState requires a non-empty string");return this._state=w,this}resolveState(){return this._state??this.getState()}usesState(){return!this._stateless}validateState(w,h){if(typeof w!=="string"||typeof h!=="string")return!1;if(w.length===0||h.length===0)return!1;if(w.length!==h.length)return!1;try{let{timingSafeEqual:P}=_("crypto");return P(Buffer.from(w,"utf8"),Buffer.from(h,"utf8"))}catch{let P=0;for(let S=0;S<w.length;S++)P|=w.charCodeAt(S)^h.charCodeAt(S);return P===0}}isStateless(){return this._stateless}stateless(){return this._stateless=!0,this}getState(){let w=new Uint8Array(32);return crypto.getRandomValues(w),Array.from(w).map((h)=>h.toString(16).padStart(2,"0")).join("")}usesPKCE(){return this._usesPKCE}enablePKCE(){return this._usesPKCE=!0,this}getCodeVerifier(){let w=new Uint8Array(48);return crypto.getRandomValues(w),Array.from(w).map((h)=>h.toString(16).padStart(2,"0")).join("")}async getCodeChallenge(){let h=new TextEncoder().encode(this.getCodeVerifier()),P=await crypto.subtle.digest("SHA-256",h),{Buffer:S}=await import("buffer");return S.from(new Uint8Array(P)).toString("base64url")}getCodeChallengeMethod(){return"S256"}with(w){return this.parameters=w,this}buildAuthUrlFromBase(w,h){let P=new URLSearchParams(this.getCodeFields(h));return`${w}?${P.toString()}`}}import{Buffer as X}from"buffer";import{createPrivateKey as V,sign as v}from"crypto";import{config as R}from"@stacksjs/config";class m extends Error{constructor(w="Invalid state"){super(w);this.name="InvalidStateException"}}class B extends Error{constructor(w){super(w);this.name="ConfigException"}}class l extends N{baseUrl="https://appleid.apple.com";teamId="";keyId="";privateKey="";constructor(w){super(w);this.teamId=w.teamId??"",this.keyId=w.keyId??"",this.privateKey=w.privateKey??""}getConfig(){let w={clientId:this.clientId||(R.services.apple?.clientId??""),teamId:this.teamId||(R.services.apple?.teamId??""),keyId:this.keyId||(R.services.apple?.keyId??""),privateKey:(this.privateKey||(R.services.apple?.privateKey??"")).replace(/\\n/g,`
-`),redirectUrl:this.redirectUrl||(R.services.apple?.redirectUrl??""),scopes:this._scopes.length>0?this._scopes:R.services.apple?.scopes??["name","email"]};return this.setScopes(w.scopes),w}async getAuthUrl(){let w=this.resolveState(),{clientId:h,redirectUrl:P,scopes:S}=this.getConfig();this.validateConfig();let $={client_id:h,redirect_uri:P,scope:S.join(" "),state:w,response_type:"code",...this.parameters};if(S.length>0)$.response_mode="form_post";return`${this.baseUrl}/auth/authorize?${new URLSearchParams($).toString()}`}async getAccessToken(w){let{clientId:h,redirectUrl:P}=this.getConfig();this.validateConfig();let S=await fetch(`${this.baseUrl}/auth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:w,redirect_uri:P,client_id:h,client_secret:this.generateClientSecret()})}),$=await S.json();if(!S.ok||$.error)throw Error(`Apple OAuth error: ${$.error_description??$.error??`HTTP ${S.status}`}`);if(!$.id_token)throw Error("Apple OAuth error: token response contained no id_token");return $.id_token}async getUserByToken(w){let{clientId:h}=this.getConfig(),P=this.decodeIdToken(w),S=P.iss===this.baseUrl,$=Array.isArray(P.aud)?P.aud.includes(h):P.aud===h,J=typeof P.exp==="number"&&P.exp*1000>Date.now();if(!S||!$||!J)throw Error("Apple OAuth error: id_token claims failed validation (iss/aud/exp)");if(!P.sub)throw Error("Apple OAuth error: id_token has no subject");let D=typeof P.email==="string"?P.email:null,u=null;if(P.email_verified===!0||P.email_verified==="true")u=!0;else if(P.email_verified===!1||P.email_verified==="false")u=!1;return{id:String(P.sub),nickname:null,name:"",email:D,emailVerified:u,avatar:null,token:w,raw:P}}generateClientSecret(){let{clientId:w,teamId:h,keyId:P,privateKey:S}=this.getConfig(),$=Math.floor(Date.now()/1000),J={alg:"ES256",kid:P,typ:"JWT"},D={iss:h,iat:$,exp:$+3600,aud:this.baseUrl,sub:w},u=`${this.base64urlJson(J)}.${this.base64urlJson(D)}`,Z;try{Z=V(S)}catch(H){throw new B(`Apple private key could not be parsed: ${H instanceof Error?H.message:String(H)}`)}let L=v("sha256",X.from(u),{key:Z,dsaEncoding:"ieee-p1363"});return`${u}.${L.toString("base64url")}`}decodeIdToken(w){let h=w.split(".");if(h.length!==3)throw Error("Apple OAuth error: malformed id_token");return JSON.parse(X.from(h[1],"base64url").toString("utf8"))}base64urlJson(w){return X.from(JSON.stringify(w)).toString("base64url")}validateConfig(){let{clientId:w,teamId:h,keyId:P,privateKey:S,redirectUrl:$}=this.getConfig();if(!w)throw new B("Apple client ID (Service ID) not provided");if(!h)throw new B("Apple team ID not provided");if(!P)throw new B("Apple key ID not provided");if(!S)throw new B("Apple private key not provided");if(!$)throw new B("Apple redirect URL not provided")}getTokenUrl(){return`${this.baseUrl}/auth/token`}}class T extends Error{status;body;constructor(w,h,P){super(w);this.status=h;this.body=P;this.name="BlueskyApiError"}get isAuthError(){return this.status===400||this.status===401||this.status===403}}class U{provider="bluesky";characterLimit=300;service;constructor(w={}){this.service=w.service||"https://bsky.social"}async createSession(w){let h=w.identifier.trim(),P=w.password.trim();if(!h)throw Error("Bluesky identifier is required.");if(!P)throw Error("Bluesky app password is required.");let S=await this.post("/xrpc/com.atproto.server.createSession",{identifier:h,password:P}),$=await this.getProfile({did:S.did,handle:S.handle,accessToken:S.accessJwt,refreshToken:S.refreshJwt}).catch(()=>{return});return{did:S.did,handle:S.handle,displayName:$?.displayName,accessJwt:S.accessJwt,refreshJwt:S.refreshJwt}}async refreshSession(w){if(!w)throw Error("Bluesky refresh token is required.");let h=await this.post("/xrpc/com.atproto.server.refreshSession",void 0,{authorization:`Bearer ${w}`});return{did:h.did,handle:h.handle,accessJwt:h.accessJwt,refreshJwt:h.refreshJwt}}async publish(w,h){let P=w.did||w.handle;if(!w.accessToken)throw Error("Bluesky access token is missing for this identity.");if(!P)throw Error("Bluesky identity DID or handle is required.");if(h.text.length>this.characterLimit)throw Error(`Bluesky posts must be ${this.characterLimit} characters or fewer.`);let S={$type:"app.bsky.feed.post",text:h.text,createdAt:h.scheduledAt||new Date().toISOString()};if(h.langs?.length)S.langs=h.langs;if(h.external)S.embed={$type:"app.bsky.embed.external",external:{uri:h.external.uri,title:h.external.title,description:h.external.description||""}};let $=await this.post("/xrpc/com.atproto.repo.createRecord",{repo:P,collection:"app.bsky.feed.post",record:S},{authorization:`Bearer ${w.accessToken}`});return{provider:this.provider,uri:$.uri,cid:$.cid,url:this.toPostUrl(w.handle,$.uri)}}async timeline(w,h={}){if(!w.accessToken)throw Error("Bluesky access token is missing for this identity.");let P=new URL(`${this.service}/xrpc/app.bsky.feed.getTimeline`);if(P.searchParams.set("limit",String(Math.min(Math.max(h.limit||30,1),100))),h.cursor)P.searchParams.set("cursor",h.cursor);let S=await this.request(P,{headers:{authorization:`Bearer ${w.accessToken}`}});return{cursor:S.cursor,items:(S.feed||[]).flatMap(($)=>{let J=$.post;if(!J?.uri||!J.author?.handle)return[];return[{uri:J.uri,authorHandle:J.author.handle,authorName:J.author.displayName,authorAvatar:J.author.avatar,postUrl:this.toPostUrl(J.author.handle,J.uri),body:J.record?.text||"",postedAt:J.record?.createdAt||new Date().toISOString(),likeCount:J.likeCount||0,repostCount:J.repostCount||0,replyCount:J.replyCount||0}]})}}async getProfile(w){if(!w.accessToken)throw Error("Bluesky access token is missing for this identity.");let h=w.did||w.handle;if(!h)throw Error("Bluesky identity DID or handle is required.");let P=new URL(`${this.service}/xrpc/app.bsky.actor.getProfile`);return P.searchParams.set("actor",h),await this.request(P,{headers:{authorization:`Bearer ${w.accessToken}`}})}async post(w,h,P={}){return await this.request(new URL(`${this.service}${w}`),{method:"POST",headers:{...h===void 0?{}:{"content-type":"application/json"},...P},...h===void 0?{}:{body:JSON.stringify(h)}})}async request(w,h){let P=await fetch(w,h),S=await P.text();if(!P.ok)throw new T(`Bluesky API failed (${P.status}): ${S||P.statusText}`,P.status,S);return S?JSON.parse(S):{}}toPostUrl(w,h){let P=h.split("/").pop();return`https://bsky.app/profile/${w}/post/${P}`}}import{fetcher as W}from"@stacksjs/api";import{config as Q}from"@stacksjs/config";class C extends N{baseUrl="https://www.facebook.com";apiUrl="https://graph.facebook.com";getConfig(){let w={clientId:Q.services.facebook?.clientId??"",clientSecret:Q.services.facebook?.clientSecret??"",redirectUrl:Q.services.facebook?.redirectUrl??"",scopes:Q.services.facebook?.scopes??["email","public_profile"]};return this.setScopes(w.scopes),w}async getAuthUrl(){let w=this.getState(),{clientId:h,redirectUrl:P,scopes:S}=this.getConfig();return this.validateConfig(),`${this.baseUrl}/v18.0/dialog/oauth?${new URLSearchParams({client_id:h,redirect_uri:P,scope:S.join(","),state:w,response_type:"code"}).toString()}`}async getAccessToken(w){let{clientId:h,clientSecret:P,redirectUrl:S}=this.getConfig();this.validateConfig();let $=await W.get(`${this.apiUrl}/v18.0/oauth/access_token?${new URLSearchParams({client_id:h,client_secret:P,redirect_uri:S,code:w}).toString()}`);if($.data.error)throw Error(`Facebook OAuth error: ${$.data.error.message}`);return $.data.access_token}async getUserByToken(w){let h=await W.get(`${this.apiUrl}/v18.0/me?${new URLSearchParams({access_token:w,fields:"id,name,email,picture"}).toString()}`);return{id:h.data.id,nickname:null,name:h.data.name,email:h.data.email??null,avatar:h.data.picture?.data.url??null,token:w,raw:h.data}}validateConfig(){let{clientId:w,clientSecret:h,redirectUrl:P}=this.getConfig();if(!w)throw new B("Facebook client ID not provided");if(!h)throw new B("Facebook client secret not provided");if(!P)throw new B("Facebook redirect URL not provided")}getTokenUrl(){return`${this.apiUrl}/v18.0/oauth/access_token`}}import{fetcher as Y}from"@stacksjs/api";import{config as q}from"@stacksjs/config";class x extends N{baseUrl="https://github.com";apiUrl="https://api.github.com";getConfig(){let w={clientId:this.clientId||(q.services.github?.clientId??""),clientSecret:this.clientSecret||(q.services.github?.clientSecret??""),redirectUrl:this.redirectUrl||(q.services.github?.redirectUrl??""),scopes:this._scopes.length>0?this._scopes:q.services.github?.scopes??["read:user","user:email"]};return this.setScopes(w.scopes),w}async getAuthUrl(){let w=this.resolveState(),{clientId:h,redirectUrl:P,scopes:S}=this.getConfig();return this.validateConfig(),`${this.baseUrl}/login/oauth/authorize?${new URLSearchParams({client_id:h,redirect_uri:P,scope:S.join(" "),state:w,response_type:"code",...this.parameters}).toString()}`}async getAccessToken(w){let{clientId:h,clientSecret:P,redirectUrl:S}=this.getConfig();this.validateConfig();let $=await Y.post(`${this.baseUrl}/login/oauth/access_token`,{client_id:h,client_secret:P,code:w,redirect_uri:S});if($.data.error)throw Error(`GitHub OAuth error: ${$.data.error_description}`);return $.data.access_token}async getUserByToken(w){let[h,P]=await Promise.all([Y.withHeaders({Accept:"application/vnd.github.v3+json",Authorization:`token ${w}`}).get(`${this.apiUrl}/user`),Y.withHeaders({Accept:"application/vnd.github.v3+json",Authorization:`token ${w}`}).get(`${this.apiUrl}/user/emails`)]),S=this.pickEmail(P.data);return{id:h.data.id.toString(),nickname:h.data.login,name:h.data.name??h.data.login,email:S?.email??h.data.email??null,emailVerified:S?S.verified:null,avatar:h.data.avatar_url,token:w,raw:h.data}}pickEmail(w){if(!Array.isArray(w)||w.length===0)return null;let h=w.find((S)=>S.primary&&S.verified),P=w.find((S)=>S.verified);return h??P??w.find((S)=>S.primary)??w[0]??null}getEmail(w){return this.pickEmail(w)?.email??null}validateConfig(){let{clientId:w,clientSecret:h,redirectUrl:P}=this.getConfig();if(!w)throw new B("GitHub client ID not provided");if(!h)throw new B("GitHub client secret not provided");if(!P)throw new B("GitHub redirect URL not provided")}getTokenUrl(){return`${this.baseUrl}/login/oauth/access_token`}}import{fetcher as b}from"@stacksjs/api";import{config as F}from"@stacksjs/config";class k extends N{baseUrl="https://accounts.google.com";apiUrl="https://www.googleapis.com";getConfig(){let w={clientId:this.clientId||(F.services.google?.clientId??""),clientSecret:this.clientSecret||(F.services.google?.clientSecret??""),redirectUrl:this.redirectUrl||(F.services.google?.redirectUrl??""),scopes:this._scopes.length>0?this._scopes:F.services.google?.scopes??["openid","email"]};return this.setScopes(w.scopes),w}async getAuthUrl(){let w=this.resolveState(),{clientId:h,redirectUrl:P,scopes:S}=this.getConfig();return this.validateConfig(),`${this.baseUrl}/o/oauth2/v2/auth?${new URLSearchParams({client_id:h,redirect_uri:P,scope:S.join(" "),state:w,response_type:"code",access_type:"offline",prompt:"consent",...this.parameters}).toString()}`}async getAccessToken(w){let{clientId:h,clientSecret:P,redirectUrl:S}=this.getConfig();this.validateConfig();let $=await b.post(`${this.baseUrl}/oauth2/v4/token`,{client_id:h,client_secret:P,code:w,redirect_uri:S,grant_type:"authorization_code"});if($.data.error)throw Error(`Google OAuth error: ${$.data.error_description}`);return $.data.access_token}async getUserByToken(w){let h=await b.withHeaders({Authorization:`Bearer ${w}`}).get(`${this.apiUrl}/oauth2/v2/userinfo`);return{id:h.data.id,nickname:h.data.given_name,name:h.data.name,email:h.data.email,emailVerified:typeof h.data.verified_email==="boolean"?h.data.verified_email:null,avatar:h.data.picture,token:w,raw:h.data}}validateConfig(){let{clientId:w,clientSecret:h,redirectUrl:P}=this.getConfig();if(!w)throw new B("Google client ID not provided");if(!h)throw new B("Google client secret not provided");if(!P)throw new B("Google redirect URL not provided")}getTokenUrl(){return`${this.baseUrl}/oauth2/v4/token`}}class O extends Error{status;body;constructor(w,h,P){super(w);this.status=h;this.body=P;this.name="InstagramApiError"}get isAuthError(){return this.status===401||this.status===403||this.status===190}}class A{provider="instagram";characterLimit=2200;graphVersion;authBase;graphBase;constructor(w={}){this.graphVersion=w.graphVersion||"v21.0",this.authBase=w.authBase||"https://www.facebook.com",this.graphBase=w.graphBase||"https://graph.facebook.com"}getAuthUrl(w){let h=new URLSearchParams({client_id:w.clientId,redirect_uri:w.redirectUrl,scope:w.scopes.join(","),state:w.state,response_type:"code"});return`${this.authBase}/${this.graphVersion}/dialog/oauth?${h.toString()}`}async exchangeCode(w){let h=new URLSearchParams({client_id:w.clientId,client_secret:w.clientSecret,redirect_uri:w.redirectUrl,code:w.code}),P=await this.graph(`/oauth/access_token?${h.toString()}`,{method:"GET"});if(!P.access_token)throw new O("Facebook did not return an access token.",400,JSON.stringify(P));return{accessToken:P.access_token,expiresIn:P.expires_in}}async resolveAccount(w){let h=new URLSearchParams({fields:"name,access_token,instagram_business_account{id,username}",access_token:w}),P=await this.graph(`/me/accounts?${h.toString()}`,{method:"GET"}),S=(P.data||[]).find((J)=>J.instagram_business_account?.id),$=S?.instagram_business_account;if(!$?.id||!S?.access_token)throw new O("No Instagram Business account is linked to your Facebook Pages.",400,JSON.stringify(P));return{igUserId:$.id,username:$.username,pageAccessToken:S.access_token}}async publish(w,h){if(!w.accessToken)throw Error("Instagram access token is missing for this identity.");let P=w.did;if(!P)throw Error("Instagram account id is required to publish.");let S=h.media?.[0];if(!S?.url)throw Error("Instagram requires an image to post.");if(h.text.length>this.characterLimit)throw Error(`Instagram captions must be ${this.characterLimit} characters or fewer.`);let $=await this.graph(`/${P}/media`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({image_url:S.url,caption:h.text,access_token:w.accessToken}).toString()});if(!$.id)throw new O("Instagram did not return a media container id.",400,JSON.stringify($));let J=await this.graph(`/${P}/media_publish`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({creation_id:$.id,access_token:w.accessToken}).toString()}),D=await this.graph(`/${J.id}?fields=permalink&access_token=${encodeURIComponent(w.accessToken)}`,{method:"GET"}).catch(()=>{return});return{provider:this.provider,uri:J.id,url:D?.permalink}}async timeline(w,h={}){return{items:[]}}async graph(w,h){let P=await fetch(`${this.graphBase}/${this.graphVersion}${w}`,h),S=await P.text(),$={};try{$=S?JSON.parse(S):{}}catch{$={}}if(!P.ok||$?.error){let J=$?.error?.message||S||P.statusText;throw new O(`Instagram API failed (${P.status}): ${J}`,P.status,S)}return $}}class M extends Error{status;body;constructor(w,h,P){super(w);this.status=h;this.body=P;this.name="LinkedInApiError"}get isAuthError(){return this.status===401||this.status===403}}class E{provider="linkedin";characterLimit=3000;apiVersion;authBase;apiBase;constructor(w={}){this.apiVersion=w.apiVersion||"202405",this.authBase=w.authBase||"https://www.linkedin.com",this.apiBase=w.apiBase||"https://api.linkedin.com"}getAuthUrl(w){let h=new URLSearchParams({response_type:"code",client_id:w.clientId,redirect_uri:w.redirectUrl,scope:w.scopes.join(" "),state:w.state});return`${this.authBase}/oauth/v2/authorization?${h.toString()}`}async exchangeCode(w){let h=new URLSearchParams({grant_type:"authorization_code",code:w.code,redirect_uri:w.redirectUrl,client_id:w.clientId,client_secret:w.clientSecret}),P=await this.request(`${this.authBase}/oauth/v2/accessToken`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:h.toString()});if(!P.access_token)throw new M("LinkedIn did not return an access token.",400,JSON.stringify(P));return{accessToken:P.access_token,expiresIn:P.expires_in,scope:P.scope}}async getProfile(w){if(!w)throw Error("LinkedIn access token is required.");let h=await this.request(`${this.apiBase}/v2/userinfo`,{headers:{authorization:`Bearer ${w}`}});if(!h.sub)throw new M("LinkedIn profile is missing a subject id.",400,JSON.stringify(h));return{sub:h.sub,name:h.name,picture:h.picture}}async publish(w,h){if(!w.accessToken)throw Error("LinkedIn access token is missing for this identity.");let P=w.did;if(!P)throw Error("LinkedIn member URN is required to publish.");if(h.text.length>this.characterLimit)throw Error(`LinkedIn posts must be ${this.characterLimit} characters or fewer.`);let S={author:P,commentary:j(h.text),visibility:"PUBLIC",distribution:{feedDistribution:"MAIN_FEED",targetEntities:[],thirdPartyDistributionChannels:[]},lifecycleState:"PUBLISHED",isReshareDisabledByAuthor:!1};if(h.external)S.content={article:{source:h.external.uri,title:h.external.title,description:h.external.description||""}};let $=await fetch(`${this.apiBase}/rest/posts`,{method:"POST",headers:{authorization:`Bearer ${w.accessToken}`,"content-type":"application/json","linkedin-version":this.apiVersion,"x-restli-protocol-version":"2.0.0"},body:JSON.stringify(S)}),J=await $.text();if(!$.ok)throw new M(`LinkedIn API failed (${$.status}): ${J||$.statusText}`,$.status,J);let D=$.headers.get("x-restli-id")||$.headers.get("x-linkedin-id")||"";return{provider:this.provider,uri:D,url:D?`https://www.linkedin.com/feed/update/${D}`:void 0}}async timeline(w,h={}){return{items:[]}}async request(w,h){let P=await fetch(w,h),S=await P.text();if(!P.ok)throw new M(`LinkedIn API failed (${P.status}): ${S||P.statusText}`,P.status,S);return S?JSON.parse(S):{}}}function j(w){return w.replace(/[\\|{}@[\]()<>#*_~]/g,"\\$&")}class z extends Error{status;body;constructor(w,h,P){super(w);this.status=h;this.body=P;this.name="ThreadsApiError"}get isAuthError(){return this.status===401||this.status===403||this.status===190}}class y{provider="threads";characterLimit=500;graphVersion;authBase;graphBase;constructor(w={}){this.graphVersion=w.graphVersion||"v1.0",this.authBase=w.authBase||"https://threads.net",this.graphBase=w.graphBase||"https://graph.threads.net"}getAuthUrl(w){let h=new URLSearchParams({client_id:w.clientId,redirect_uri:w.redirectUrl,scope:w.scopes.join(","),response_type:"code",state:w.state});return`${this.authBase}/oauth/authorize?${h.toString()}`}async exchangeCode(w){let h=await fetch(`${this.graphBase}/oauth/access_token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:w.clientId,client_secret:w.clientSecret,grant_type:"authorization_code",redirect_uri:w.redirectUrl,code:w.code}).toString()}),P=await h.text(),S={};try{S=P?JSON.parse(P):{}}catch{S={}}if(!h.ok||S?.error||!S?.access_token){let $=S?.error_message||S?.error?.message||P||h.statusText;throw new z(`Threads token exchange failed (${h.status}): ${$}`,h.status,P)}return{accessToken:S.access_token,userId:S.user_id!=null?String(S.user_id):void 0,expiresIn:S.expires_in}}async resolveAccount(w){let h=new URLSearchParams({fields:"id,username",access_token:w}),P=await this.graph(`/me?${h.toString()}`,{method:"GET"});if(!P.id)throw new z("Could not resolve the Threads account for this token.",400,JSON.stringify(P));return{threadsUserId:P.id,username:P.username,accessToken:w}}async publish(w,h){if(!w.accessToken)throw Error("Threads access token is missing for this identity.");let P=w.did;if(!P)throw Error("Threads account id is required to publish.");if(h.text.length>this.characterLimit)throw Error(`Threads posts must be ${this.characterLimit} characters or fewer.`);let S=h.media?.[0],$=new URLSearchParams({text:h.text,access_token:w.accessToken});if(S?.url)$.set("media_type","IMAGE"),$.set("image_url",S.url);else $.set("media_type","TEXT");let J=await this.graph(`/${P}/threads`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:$.toString()});if(!J.id)throw new z("Threads did not return a media container id.",400,JSON.stringify(J));let D=await this.graph(`/${P}/threads_publish`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({creation_id:J.id,access_token:w.accessToken}).toString()});if(!D.id)throw new z("Threads did not return a published post id.",400,JSON.stringify(D));let u=await this.graph(`/${D.id}?fields=permalink&access_token=${encodeURIComponent(w.accessToken)}`,{method:"GET"}).catch(()=>{return});return{provider:this.provider,uri:D.id,url:u?.permalink}}async timeline(w,h={}){return{items:[]}}async graph(w,h){let P=await fetch(`${this.graphBase}/${this.graphVersion}${w}`,h),S=await P.text(),$={};try{$=S?JSON.parse(S):{}}catch{$={}}if(!P.ok||$?.error){let J=$?.error?.message||S||P.statusText;throw new z(`Threads API failed (${P.status}): ${J}`,P.status,S)}return $}}import{Buffer as I}from"buffer";import{createHash as g,randomBytes as r}from"crypto";import{fetcher as K}from"@stacksjs/api";import{config as G}from"@stacksjs/config";class f extends N{baseUrl="https://twitter.com";apiUrl="https://api.twitter.com";codeVerifier=null;getConfig(){let w={clientId:G.services.twitter?.clientId??"",clientSecret:G.services.twitter?.clientSecret??"",redirectUrl:G.services.twitter?.redirectUrl??"",scopes:G.services.twitter?.scopes??["users.read","tweet.read"]};return this.setScopes(w.scopes),w}generateCodeVerifier(){return r(32).toString("base64").replace(/[^a-z0-9]/gi,"").substring(0,128)}generateCodeChallenge(w){return g("sha256").update(w).digest("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async getAuthUrl(){let w=this.getState(),{clientId:h,redirectUrl:P,scopes:S}=this.getConfig();this.validateConfig(),this.codeVerifier=this.generateCodeVerifier();let $=this.generateCodeChallenge(this.codeVerifier);return`${this.baseUrl}/i/oauth2/authorize?${new URLSearchParams({client_id:h,redirect_uri:P,scope:S.join(" "),state:w,response_type:"code",code_challenge:$,code_challenge_method:"S256"}).toString()}`}async getAccessToken(w){let{clientId:h,clientSecret:P,redirectUrl:S}=this.getConfig();if(this.validateConfig(),!this.codeVerifier)throw Error("Code verifier not found. Please ensure getAuthUrl() is called first.");let $=I.from(`${h}:${P}`).toString("base64"),J=await K.withHeaders({Authorization:`Basic ${$}`,"Content-Type":"application/x-www-form-urlencoded"}).post(`${this.apiUrl}/2/oauth2/token`,{code:w,grant_type:"authorization_code",redirect_uri:S,code_verifier:this.codeVerifier});if(J.data.error)throw Error(`Twitter OAuth error: ${J.data.error_description}`);return J.data.access_token}async getUserByToken(w){let h=await K.withHeaders({Authorization:`Bearer ${w}`}).get(`${this.apiUrl}/2/users/me?user.fields=profile_image_url`);return{id:h.data.id,nickname:h.data.username,name:h.data.name,email:h.data.email??null,avatar:h.data.profile_image_url??null,token:w,raw:h.data}}validateConfig(){let{clientId:w,clientSecret:h,redirectUrl:P}=this.getConfig();if(!w)throw new B("Twitter client ID not provided");if(!h)throw new B("Twitter client secret not provided");if(!P)throw new B("Twitter redirect URL not provided")}getTokenUrl(){return`${this.apiUrl}/2/oauth2/token`}}class a{accessToken;refreshToken;expiresIn;approvedScopes;constructor(w,h=null,P=null,S=[]){this.accessToken=w;this.refreshToken=h;this.expiresIn=P;this.approvedScopes=S}}export{j as escapeLinkedInText,f as TwitterProvider,a as Token,y as ThreadsPublishingDriver,z as ThreadsApiError,E as LinkedInPublishingDriver,M as LinkedInApiError,m as InvalidStateException,A as InstagramPublishingDriver,O as InstagramApiError,k as GoogleProvider,x as GitHubProvider,C as FacebookProvider,B as ConfigException,U as BlueskyPublishingDriver,T as BlueskyApiError,l as AppleProvider,N as AbstractProvider};

package/dist/token.d.ts

@@ -1,7 +0,0 @@
-export declare class Token {
-  public accessToken: string;
-  public refreshToken?: string | null;
-  public expiresIn?: number | null;
-  public approvedScopes?: string[];
-  constructor(accessToken: string, refreshToken?: string | null, expiresIn?: number | null, approvedScopes?: string[]);
-}

package/dist/types.d.ts

@@ -1,159 +0,0 @@
-/**
- * Normalized user type that all providers will map their responses to.
- * This ensures a consistent user structure regardless of the provider used.
- */
-export declare interface SocialUser {
-  id: string
-  nickname: string | null
-  name: string
-  email: string | null
-  emailVerified?: boolean | null
-  avatar: string | null
-  token: string
-  raw?: any
-}
-/**
- * GitHub-specific user type from their API response
- */
-export declare interface GitHubUser {
-  id: number
-  login: string
-  name: string | null
-  avatar_url: string | null
-  [key: string]: any
-}
-/**
- * GitHub-specific email type from their API response
- */
-export declare interface GitHubEmail {
-  email: string
-  primary: boolean
-  verified: boolean
-}
-/**
- * GitHub-specific OAuth token response
- */
-export declare interface GitHubTokenResponse {
-  access_token: string
-  error?: string
-  error_description?: string
-}
-export declare interface ProviderInterface {
-  getAuthUrl: () => Promise<string>
-  getAccessToken: (code: string) => Promise<string>
-  getUserByToken: (token: string) => Promise<SocialUser>
-}
-export declare interface TwitterTokenResponse {
-  access_token: string
-  token_type: string
-  expires_in: number
-  scope: string
-  error?: string
-  error_description?: string
-}
-export declare interface TwitterUser {
-  id: string
-  username: string
-  name: string
-  email?: string
-  profile_image_url?: string
-}
-/**
- * Apple-specific token response from https://appleid.apple.com/auth/token
- */
-export declare interface AppleTokenResponse {
-  access_token: string
-  token_type: string
-  expires_in: number
-  refresh_token?: string
-  id_token: string
-  error?: string
-  error_description?: string
-}
-/**
- * Claims Apple places in the id_token. `email_verified` and
- * `is_private_email` arrive as booleans or the strings 'true'/'false'
- * depending on the API era.
- */
-export declare interface AppleIdTokenClaims {
-  iss: string
-  aud: string | string[]
-  exp: number
-  iat: number
-  sub: string
-  nonce?: string
-  email?: string
-  email_verified?: boolean | 'true' | 'false'
-  is_private_email?: boolean | 'true' | 'false'
-  [key: string]: any
-}
-export declare interface BlueskySessionCredentials {
-  identifier: string
-  password: string
-}
-export declare interface BlueskySession {
-  did: string
-  handle: string
-  displayName?: string
-  accessJwt: string
-  refreshJwt: string
-}
-export declare interface SocialIdentityCredentials {
-  handle: string
-  did?: string
-  accessToken?: string
-  refreshToken?: string
-}
-export declare interface PublishPostInput {
-  text: string
-  scheduledAt?: string
-  langs?: string[]
-  external?: {
-    uri: string
-    title: string
-    description?: string
-  }
-  media?: Array<{
-    url: string
-    altText?: string
-  }>
-}
-export declare interface PublishedPost {
-  provider: SocialPublishingProvider
-  uri: string
-  cid?: string
-  url?: string
-}
-export declare interface TimelineQuery {
-  cursor?: string
-  limit?: number
-}
-export declare interface TimelineResult {
-  cursor?: string
-  items: Array<{
-    uri: string
-    authorHandle: string
-    authorName?: string
-    authorAvatar?: string
-    postUrl?: string
-    body: string
-    postedAt: string
-    likeCount: number
-    repostCount: number
-    replyCount: number
-  }>
-}
-export declare interface SocialPublishingDriver {
-  provider: SocialPublishingProvider
-  characterLimit: number
-  publish: (identity: SocialIdentityCredentials, post: PublishPostInput) => Promise<PublishedPost>
-  timeline: (identity: SocialIdentityCredentials, query?: TimelineQuery) => Promise<TimelineResult>
-}
-export type SocialPublishingProvider = | 'bluesky'
-  | 'twitter'
-  | 'mastodon'
-  | 'facebook'
-  | 'instagram'
-  | 'tiktok'
-  | 'linkedin'
-  | 'threads';