@vunexa/lixa 0.0.1-alpha.27 → 0.0.1-alpha.28

package/dist/export-types/index.d.ts

@@ -40,9 +40,10 @@ export declare class DefaultSessionStrategy implements SessionStrategy {
      * Handles common OAuth token formats and extracts the access token.
      *
      * @param tokenData - The token data received from the OAuth provider
+     * @param providerMetadata - Provider metadata (not used in default implementation)
      * @returns A Promise that resolves to a Session object
      */
-    createSession(tokenData: OAuthTokenResponse): Promise<Session>;
+    createSession(tokenData: OAuthTokenResponse, providerMetadata: ProviderMetadata): Promise<Session>;
 }
 
 /**
@@ -769,6 +770,26 @@ export declare type ProviderConfig = {
     provider: IProvider;
 });
 
+/**
+ * Provider metadata passed to session strategy.
+ * Contains provider name and endpoints for user info extraction.
+ *
+ * @public
+ */
+export declare interface ProviderMetadata {
+    /** The provider name (e.g., 'google', 'github') */
+    name: string;
+    /** Provider endpoints */
+    endpoints: {
+        /** Authorization endpoint URL */
+        authorization: string;
+        /** Token endpoint URL */
+        token: string;
+        /** UserInfo endpoint URL */
+        userInfo: string;
+    };
+}
+
 /**
  * Helper type to create a configuration with only registered providers.
  * Use this with Lixa.createConfig() for type safety.
@@ -942,24 +963,27 @@ export declare interface SessionDao {
  * @example
  * Custom session strategy with database integration:
  * ```typescript
- * interface CustomSessionData extends OAuthTokenResponse {
+ * interface CustomSessionData {
  *   userId: string;
  *   email: string;
+ *   provider: string;
+ *   accessToken: string;
+ *   refreshToken?: string;
+ *   expiresAt: number;
  * }
  *
  * class DatabaseSessionStrategy implements SessionStrategy {
  *   constructor(private db: Database) {}
  *
- *   async createSession(tokenData: OAuthTokenResponse): Promise<Session<CustomSessionData>> {
- *     // Decode ID token for OIDC providers
- *     const idToken = tokenData.id_token;
- *     const payload = decodeJwt(idToken);
+ *   async createSession(oauthContext: OAuthContext): Promise<Session<CustomSessionData>> {
+ *     // User info is already extracted by Lixa!
+ *     const { userInfo, provider, tokenData } = oauthContext;
  *
  *     // Create or update user in database
  *     const user = await this.db.users.upsert({
- *       email: payload.email,
- *       name: payload.name,
- *       picture: payload.picture
+ *       email: userInfo.email,
+ *       name: userInfo.name,
+ *       picture: userInfo.picture
  *     });
  *
  *     // Generate session ID
@@ -979,7 +1003,10 @@ export declare interface SessionDao {
  *       raw: {
  *         userId: user.id,
  *         email: user.email,
- *         ...tokenData
+ *         provider,
+ *         accessToken: tokenData.access_token,
+ *         refreshToken: tokenData.refresh_token,
+ *         expiresAt: Date.now() + (tokenData.expires_in || 3600) * 1000
  *       }
  *     };
  *   }
@@ -993,14 +1020,14 @@ export declare interface SessionStrategy {
      * Creates a session from OAuth token data.
      *
      * @param tokenData - The token data received from the OAuth provider's token endpoint
+     * @param providerMetadata - Provider metadata including name and endpoints
      * @returns A Promise that resolves to a Session object
      *
      * @remarks
      * This method is called after successfully exchanging the authorization code
-     * for tokens. The tokenData parameter contains the raw response from the
-     * provider's token endpoint.
+     * for tokens. You receive:
      *
-     * Common token data fields:
+     * Token Data:
      * - access_token: OAuth access token
      * - refresh_token: OAuth refresh token (optional)
      * - expires_in: Token expiration time in seconds
@@ -1008,6 +1035,28 @@ export declare interface SessionStrategy {
      * - id_token: OpenID Connect ID token (for OIDC providers)
      * - scope: Granted scopes
      *
+     * Provider Metadata:
+     * - name: The provider name (e.g., 'google', 'github')
+     * - endpoints: Provider endpoints (authorization, token, userInfo)
+     *
+     * The providerMetadata.endpoints.userInfo can be used with extractUserInfo():
+     * ```typescript
+     * import { extractUserInfo } from '@vunexa/lixa';
+     *
+     * const { userInfo } = await extractUserInfo(
+     *   tokenData,
+     *   providerMetadata.endpoints.userInfo,
+     *   providerMetadata.name
+     * );
+     * ```
+     *
+     * Your session strategy should:
+     * 1. Extract user info (using extractUserInfo or decode ID token)
+     * 2. Create or lookup users in your database
+     * 3. Generate session identifiers
+     * 4. Store session data as needed
+     * 5. Return a Session object with token and raw data
+     *
      * @throws \{Error\} If session creation fails (e.g., database error, invalid token)
      *
      * @example
@@ -1020,8 +1069,35 @@ export declare interface SessionStrategy {
      *   };
      * }
      * ```
+     *
+     * @example
+     * Database integration with user info extraction:
+     * ```typescript
+     * async createSession(
+     *   tokenData: OAuthTokenResponse,
+     *   providerMetadata: ProviderMetadata
+     * ): Promise<Session> {
+     *   // Extract user info from token or userinfo endpoint
+     *   const { userInfo } = await extractUserInfo(
+     *     tokenData,
+     *     providerMetadata.endpoints.userInfo,
+     *     providerMetadata.name
+     *   );
+     *
+     *   // Create or update user in database
+     *   const user = await db.users.upsert({
+     *     email: userInfo.email,
+     *     name: userInfo.name
+     *   });
+     *
+     *   return {
+     *     token: generateSessionId(),
+     *     raw: { userId: user.id, provider: providerMetadata.name, ...tokenData }
+     *   };
+     * }
+     * ```
      */
-    createSession(tokenData: OAuthTokenResponse): Promise<Session>;
+    createSession(tokenData: OAuthTokenResponse, providerMetadata: ProviderMetadata): Promise<Session>;
 }
 
 /**

package/dist/index.cjs

@@ -88,9 +88,10 @@ var DefaultSessionStrategy = class {
    * Handles common OAuth token formats and extracts the access token.
    *
    * @param tokenData - The token data received from the OAuth provider
+   * @param providerMetadata - Provider metadata (not used in default implementation)
    * @returns A Promise that resolves to a Session object
    */
-  async createSession(tokenData) {
+  async createSession(tokenData, providerMetadata) {
     if (!tokenData.access_token || typeof tokenData.access_token !== "string") {
       throw new Error("No valid access token found in OAuth response");
     }
@@ -549,7 +550,15 @@ var Lixa = class _Lixa {
     );
     this.log("INFO", "Token", "Token exchange successful");
     this.log("INFO", "Session", "Creating user session");
-    const session = await this.sessionStrategy.createSession(tokens);
+    const providerMetadata = {
+      name: providerType,
+      endpoints: {
+        authorization: providerImpl.authorizationEndpoint,
+        token: providerImpl.tokenEndpoint,
+        userInfo: providerImpl.userInfoEndpoint
+      }
+    };
+    const session = await this.sessionStrategy.createSession(tokens, providerMetadata);
     const sessionId = (0, import_crypto.randomBytes)(32).toString("hex");
     this.log("INFO", "Session", "Storing session", { sessionId });
     await this.sesionDao.saveSession(sessionId, session, 86400);

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/lixa.ts","../src/dao/state-cache.ts","../src/dao/session-cache.ts","../src/models/session.ts","../src/utils/user-info.ts"],"sourcesContent":["/**\n * A flexible, provider-agnostic OAuth 2.0 and OpenID Connect (OIDC) client library for backend applications.\n * \n * @remarks\n * This package simplifies multi-provider authentication flows (e.g., Google, GitHub), supports extensible session management, and enables custom provider registration.\n * \n * Key features:\n * - OAuth 2.0 authorization code flow with PKCE (RFC 6749, RFC 7636)\n * - OpenID Connect support\n * - Built-in providers available in \\@vunexa/lixa-providers\n * - Custom provider support via IProvider interface\n * - Extensible session management via SessionStrategy\n * - Pluggable state and session storage via StateDao and SessionDao\n * - TypeScript-first with comprehensive type safety\n * \n * @packageDocumentation\n */\n\nexport { Lixa } from \"./lixa\";\nexport {\n  type ProviderConfig,\n  type LixaConfig,\n  type SafeLixaConfig,\n  type IProvider,\n  type SessionStrategy,\n  type Session,\n  type OAuthTokenResponse,\n  type StateDao,\n  type SessionDao,\n  type StateData,\n} from \"./types\";\nexport { DefaultSessionStrategy } from \"./models/session\";\nexport {\n  type UserInfo,\n  extractUserInfo,\n  decodeIdToken,\n  fetchUserInfo,\n  determineProviderFromIssuer,\n} from \"./utils/user-info\";\n","import { randomBytes } from \"crypto\";\nimport { type LixaConfig, type ProviderConfig } from \"./types\";\nimport { IProvider } from \"./providers\";\nimport { LocalStateCache } from \"./dao/state-cache\";\nimport { SessionDao, StateDao } from \"./dao/types\";\nimport crypto from \"crypto\";\nimport { LocalSessionCache } from \"./dao/session-cache\";\nimport { type Session, type SessionStrategy, DefaultSessionStrategy, type OAuthTokenResponse } from \"./models/session\";\n\n/**\n * Type representing the keys of configured providers\n */\ntype ConfiguredProviderKey<T extends LixaConfig<Record<string, ProviderConfig>>> = keyof T['providers'];\n\n/**\n * A flexible, provider-agnostic OAuth 2.0 and OpenID Connect (OIDC) client library.\n *\n * @remarks\n * Lixa simplifies multi-provider authentication flows and supports extensible session management.\n * Providers can be passed inline in the configuration, eliminating the need for pre-registration.\n *\n * @example\n * Using built-in providers from \\@vunexa/lixa-providers:\n * ```typescript\n * import { Lixa } from '@vunexa/lixa';\n * import { GoogleProvider } from '@vunexa/lixa-providers';\n * \n * const lixa = new Lixa({\n *   providers: {\n *     google: {\n *       provider: new GoogleProvider(),\n *       clientId: 'your-client-id',\n *       clientSecret: 'your-client-secret',\n *       redirectUri: 'https://yourapp.com/auth/google/callback',\n *       scopes: ['openid', 'email', 'profile']\n *     }\n *   }\n * });\n * ```\n * \n * @example\n * Using custom inline providers:\n * ```typescript\n * import { Lixa, IProvider } from '@vunexa/lixa';\n * \n * const customProvider: IProvider = {\n *   authorizationEndpoint: 'https://custom.com/oauth/authorize',\n *   tokenEndpoint: 'https://custom.com/oauth/token',\n *   userInfoEndpoint: 'https://custom.com/api/user'\n * };\n * \n * const lixa = new Lixa({\n *   providers: {\n *     custom: {\n *       provider: customProvider,\n *       clientId: 'your-client-id',\n *       clientSecret: 'your-client-secret',\n *       redirectUri: 'https://yourapp.com/auth/custom/callback',\n *       scopes: ['read:user']\n *     }\n *   }\n * });\n * ```\n *\n * @public\n */\nclass Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> = LixaConfig> {\n  private static DEFAULT_PROVIDERS: Map<string, IProvider> = new Map();\n  private static CONFIGURED_PROVIDERS: Map<string, IProvider> = new Map(); // Legacy registry for backward compatibility\n  private static LOCAL_STATE_CACHE = new LocalStateCache();\n  private static LOCAL_SESSION_CACHE = new LocalSessionCache();\n  private static DEFAULT_SESSION_STRATEGY = new DefaultSessionStrategy();\n  private config: TConfig;\n  private stateDao: StateDao;\n  private sesionDao: SessionDao;\n  private sessionStrategy: SessionStrategy;\n  private debug: boolean;\n\n  /**\n   * Creates a new Lixa instance with the provided configuration.\n   * \n   * @remarks\n   * Providers can be passed inline in the configuration using the `provider` field.\n   * Provider resolution priority: inline custom provider \\> default providers \\> legacy registry.\n   * \n   * @param config - The configuration object containing provider settings and optional session strategy\n   * \n   * @throws Error when provider configuration is missing required fields\n   * @throws Error when provider implementation is missing required properties\n   * @throws Error when provider is not available and no inline implementation is provided\n   */\n  constructor(config: TConfig) {\n    this.config = config;\n    this.stateDao = config.stateDao || Lixa.LOCAL_STATE_CACHE;\n    this.sesionDao = config.sessionDao || Lixa.LOCAL_SESSION_CACHE;\n    this.sessionStrategy = config.sessionStrategy || Lixa.DEFAULT_SESSION_STRATEGY;\n    this.debug = config.debug || false;\n    \n    this.log('INFO', 'Init', 'Initializing Lixa instance', { \n      providers: Object.keys(config.providers),\n      debug: this.debug \n    });\n    \n    // Validate and extract providers from configuration\n    for (const [providerName, providerConfig] of Object.entries(config.providers)) {\n      const name = providerName.toLowerCase();\n      const typedConfig: ProviderConfig = providerConfig;\n      \n      // Validate provider configuration has required credentials\n      this.validateProviderConfig(providerName, typedConfig);\n      \n      // If provider config includes a custom provider implementation, validate it\n      if (typedConfig.provider) {\n        this.validateProviderImplementation(providerName, typedConfig.provider);\n        this.log('INFO', 'Init', `Registered inline provider: ${providerName}`);\n      } else {\n        // Check if it's available in default providers or legacy registry\n        if (!Lixa.DEFAULT_PROVIDERS.has(name) && !Lixa.CONFIGURED_PROVIDERS.has(name)) {\n          this.log('ERROR', 'Init', `Provider '${providerName}' not available`);\n          throw new Error(\n            `Provider '${providerName}' is not available. ` +\n            `Either import it from '@vunexa/lixa-providers' and include it in the configuration, ` +\n            `or provide a custom implementation using the 'provider' field: ` +\n            `{ provider: new CustomProvider(), clientId: '...', ... }`\n          );\n        }\n        this.log('INFO', 'Init', `Using registered provider: ${providerName}`);\n      }\n    }\n    \n    this.log('INFO', 'Init', 'Lixa instance initialized successfully');\n  }\n  \n  /**\n   * Validates that a provider configuration has all required credentials.\n   * \n   * @param name - The provider name\n   * @param config - The provider configuration\n   * @throws Error when required fields are missing or invalid\n   */\n  private validateProviderConfig(name: string, config: ProviderConfig): void {\n    const requiredFields: (keyof ProviderConfig)[] = ['clientId', 'clientSecret', 'redirectUri', 'scopes'];\n    const missingFields = requiredFields.filter(field => {\n      const value = config[field];\n      return value === undefined || value === null || (typeof value === 'string' && value.trim() === '');\n    });\n    \n    if (missingFields.length > 0) {\n      throw new Error(\n        `Provider '${name}' configuration is missing required fields: ${missingFields.join(', ')}`\n      );\n    }\n    \n    // Validate scopes is an array\n    if (!Array.isArray(config.scopes)) {\n      throw new Error(\n        `Provider '${name}' configuration error: 'scopes' must be an array of strings`\n      );\n    }\n    \n    if (config.scopes.length === 0) {\n      throw new Error(\n        `Provider '${name}' configuration error: 'scopes' array cannot be empty`\n      );\n    }\n  }\n  \n  /**\n   * Validates that a provider implementation has all required properties.\n   * \n   * @param name - The provider name\n   * @param provider - The provider implementation\n   * @throws Error when required properties are missing\n   */\n  private validateProviderImplementation(name: string, provider: IProvider): void {\n    const requiredProps: (keyof IProvider)[] = ['authorizationEndpoint', 'tokenEndpoint', 'userInfoEndpoint'];\n    const missingProps = requiredProps.filter(prop => {\n      const value = provider[prop];\n      return !value || typeof value !== 'string' || value.trim() === '';\n    });\n    \n    if (missingProps.length > 0) {\n      throw new Error(\n        `Provider '${name}' implementation is missing required properties: ${missingProps.join(', ')}. ` +\n        `All IProvider implementations must define: authorizationEndpoint, tokenEndpoint, and userInfoEndpoint.`\n      );\n    }\n  }\n\n  /**\n   * Structured debug logging with standardized format.\n   * \n   * @param level - Log level (INFO, WARN, ERROR)\n   * @param context - Context of the log (Init, Auth, Token, Session, State)\n   * @param message - Log message\n   * @param data - Optional data to log\n   * \n   * @remarks\n   * Format: [Lixa] [timestamp] [level] [context] message\n   * Only logs when debug mode is enabled.\n   */\n  private log(level: 'INFO' | 'WARN' | 'ERROR', context: 'Init' | 'Auth' | 'Token' | 'Session' | 'State', message: string, data?: Record<string, string | number | boolean | string[]>): void {\n    if (!this.debug) return;\n    \n    const timestamp = new Date().toISOString();\n    const prefix = `[Lixa] [${timestamp}] [${level}] [${context}]`;\n    \n    if (data !== undefined) {\n      console.log(`${prefix} ${message}`, data);\n    } else {\n      console.log(`${prefix} ${message}`);\n    }\n  }\n\n  /**\n   * Checks if a provider is configured for this instance.\n   * This is a type guard that narrows the provider type for use with getAuthUrl.\n   *\n   * @param provider - The provider name to check (case-insensitive)\n   * @returns True if the provider is configured, false otherwise\n   *\n   * @example\n   * ```typescript\n   * if (lixa.isProviderConfigured(provider)) {\n   *   // TypeScript now knows provider is a valid ConfiguredProviderKey\n   *   const authUrl = lixa.getAuthUrl(provider, state);\n   * }\n   * ```\n   */\n  public isProviderConfigured<T extends string>(provider: T): provider is T & ConfiguredProviderKey<TConfig> {\n    const providerType = provider.toLowerCase();\n    return this.config.providers.hasOwnProperty(providerType);\n  }\n  \n  /**\n   * Gets a provider implementation by name.\n   * Resolution priority: inline custom provider \\> default providers \\> legacy registry\n   * \n   * @param name - The provider name (case-insensitive)\n   * @param config - The provider configuration\n   * @returns The provider implementation\n   * @throws Error when provider is not found\n   */\n  private getProvider(name: string, config: ProviderConfig): IProvider {\n    // First check if provider is inline in config\n    if (config.provider) {\n      return config.provider;\n    }\n    \n    // Then check default providers\n    const lowerName = name.toLowerCase();\n    const defaultProvider = Lixa.DEFAULT_PROVIDERS.get(lowerName);\n    if (defaultProvider) {\n      return defaultProvider;\n    }\n    \n    // Finally check legacy registry for backward compatibility\n    const legacyProvider = Lixa.CONFIGURED_PROVIDERS.get(lowerName);\n    if (legacyProvider) {\n      return legacyProvider;\n    }\n    \n    throw new Error(\n      `Provider '${name}' not found. ` +\n      `Ensure the provider is included in the configuration with a 'provider' field, ` +\n      `or registered using Lixa.registerProvider().`\n    );\n  }\n\n  /**\n   * Registers custom OAuth providers for use with Lixa.\n   * \n   * @deprecated This method is maintained for backward compatibility.\n   * The recommended approach is to pass providers inline in the configuration:\n   * ```typescript\n   * const lixa = new Lixa({\n   *   providers: {\n   *     custom: {\n   *       provider: new CustomProvider(),\n   *       clientId: '...',\n   *       // ...\n   *     }\n   *   }\n   * });\n   * ```\n   *\n   * @param providerMap - A map of provider names to IProvider implementations\n   *\n   * @example\n   * Legacy usage (still supported):\n   * ```typescript\n   * class CustomProvider implements IProvider {\n   *   authorizationEndpoint = 'https://custom.com/oauth/authorize';\n   *   tokenEndpoint = 'https://custom.com/oauth/token';\n   *   userInfoEndpoint = 'https://custom.com/api/user';\n   * }\n   *\n   * Lixa.registerProvider({ custom: new CustomProvider() });\n   * ```\n   */\n  public static registerProvider<T extends Record<string, IProvider>>(providerMap: T): void {\n    Object.entries(providerMap).forEach(([key, providerImpl]) => {\n      Lixa.CONFIGURED_PROVIDERS.set(key.toLowerCase(), providerImpl);\n    });\n  }\n\n  /**\n   * Gets the list of registered provider names.\n   * \n   * @returns Array of registered provider names\n   */\n  public static getRegisteredProviders(): string[] {\n    return Array.from(Lixa.CONFIGURED_PROVIDERS.keys());\n  }\n\n  /**\n   * Creates a type-safe configuration.\n   * \n   * @deprecated This method is maintained for backward compatibility.\n   * You can now pass configuration directly to the Lixa constructor without this helper.\n   * \n   * @param config - Configuration object with provider settings\n   * @returns The same configuration object with type safety\n   * \n   * @example\n   * New approach (recommended):\n   * ```typescript\n   * const lixa = new Lixa({\n   *   providers: {\n   *     google: {\n   *       provider: new GoogleProvider(),\n   *       clientId: '...',\n   *       // ...\n   *     }\n   *   }\n   * });\n   * ```\n   */\n  public static createConfig<T extends Record<string, ProviderConfig>>(\n    config: LixaConfig<T> & { providers: T }\n  ): LixaConfig<T> {\n    return config;\n  }\n\n  /**\n   * Generates a cryptographically secure random state parameter for OAuth flows.\n   *\n   * @returns A 32-character hexadecimal string\n   *\n   * @remarks\n   * The state parameter is used to prevent CSRF attacks in OAuth flows.\n   */\n  public static generateRandomState(): string {\n    return randomBytes(16).toString(\"hex\");\n  }\n\n  /**\n   * Generates a cryptographically secure code verifier for PKCE flows.\n   *\n   * @returns A 64-character hexadecimal string (32 random bytes encoded as hex)\n   *\n   * @remarks\n   * This method implements the code verifier generation as specified in RFC 7636 (PKCE).\n   * \n   * **PKCE (Proof Key for Code Exchange)** is a security extension to OAuth 2.0 that\n   * prevents authorization code interception attacks. It's especially important for\n   * public clients (mobile apps, SPAs) but is recommended for all OAuth flows.\n   * \n   * **Generation methodology:**\n   * 1. Generate 32 cryptographically random bytes using Node.js crypto.randomBytes()\n   * 2. Encode the bytes as a hexadecimal string (64 characters)\n   * 3. The verifier is stored securely and used later in the token exchange\n   * \n   * **RFC 7636 Requirements:**\n   * - Minimum length: 43 characters\n   * - Maximum length: 128 characters\n   * - Character set: [A-Z] / [a-z] / [0-9] / \"-\" / \".\" / \"_\" / \"~\"\n   * - This implementation produces 64 hex characters, meeting the requirements\n   * \n   * The code verifier is:\n   * - Generated when creating the authorization URL\n   * - Stored in state cache with the state parameter\n   * - Retrieved during callback handling\n   * - Sent to the token endpoint to prove the client's identity\n   * \n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7636 | RFC 7636 - PKCE}\n   * @see buildCodeChallenge for the corresponding challenge generation\n   * \n   * @internal\n   */\n  private static generateCodeVerifier(): string {\n    return randomBytes(32).toString(\"hex\");\n  }\n\n  /**\n   * Generates a code challenge from a code verifier for PKCE flows.\n   *\n   * @param codeVerifier - The code verifier string (64 hex characters)\n   * @returns A base64url-encoded SHA-256 hash of the code verifier\n   *\n   * @remarks\n   * This method implements the code challenge generation as specified in RFC 7636 (PKCE)\n   * using the S256 (SHA-256) transformation method.\n   * \n   * **Challenge generation methodology:**\n   * 1. Hash the code verifier using SHA-256\n   * 2. Encode the hash as base64\n   * 3. Convert to base64url format (RFC 4648):\n   *    - Replace '+' with '-'\n   *    - Replace '/' with '_'\n   *    - Remove trailing '=' padding\n   * \n   * **PKCE Flow:**\n   * 1. Client generates code_verifier (random string)\n   * 2. Client creates code_challenge = BASE64URL(SHA256(code_verifier))\n   * 3. Client sends code_challenge to authorization endpoint\n   * 4. Authorization server stores the code_challenge\n   * 5. Client sends code_verifier to token endpoint\n   * 6. Authorization server verifies: SHA256(code_verifier) == code_challenge\n   * \n   * **Security Benefits:**\n   * - Prevents authorization code interception attacks\n   * - Even if an attacker intercepts the authorization code, they cannot\n   *   exchange it for tokens without the original code_verifier\n   * - The challenge is sent in the authorization request (public)\n   * - The verifier is sent in the token request (should be kept secret)\n   * \n   * **RFC 7636 Transformation Methods:**\n   * - plain: code_challenge = code_verifier (not recommended)\n   * - S256: code_challenge = BASE64URL(SHA256(code_verifier)) (recommended, used here)\n   * \n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7636 | RFC 7636 - PKCE}\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc4648#section-5 | RFC 4648 - Base64url Encoding}\n   * @see generateCodeVerifier for the verifier generation\n   * \n   * @internal\n   */\n  private static buildCodeChallenge(codeVerifier: string): string {\n    const hash = crypto\n      .createHash(\"sha256\")\n      .update(codeVerifier)\n      .digest(\"base64\");\n\n    // Convert to base64url (RFC 4648 Section 5)\n    return hash.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n  }\n\n  /**\n   * Generates the authorization URL for the specified provider.\n   *\n   * @param provider - The provider name (must be a configured provider key)\n   * @param state - The state parameter for CSRF protection\n   * @returns The complete authorization URL to redirect users to\n   *\n   * @throws Error when the provider is not configured\n   *\n   * @example\n   * ```typescript\n   * const state = Lixa.generateRandomState();\n   * const authUrl = lixa.getAuthUrl('google', state);\n   * res.redirect(authUrl);\n   * ```\n   */\n  public getAuthUrl(provider: ConfiguredProviderKey<TConfig> | string, state: string): string {\n    const providerType = String(provider).toLowerCase();\n    \n    this.log('INFO', 'Auth', `Generating authorization URL for provider: ${providerType}`);\n    \n    const providerConfig = this.findProviderByType(providerType);\n\n    if (!providerConfig) {\n      this.log('ERROR', 'Auth', `Provider '${String(provider)}' is not configured`);\n      throw new Error(`Provider '${String(provider)}' is not configured in this Lixa instance`);\n    }\n\n    const providerImpl = this.getProvider(providerType, providerConfig);\n\n    const codeVerifier = Lixa.generateCodeVerifier();\n    const codeChallenge = Lixa.buildCodeChallenge(codeVerifier);\n\n    this.log('INFO', 'State', `Saving state for provider: ${providerType}`, { state });\n\n    // Cache the state paramaeter with TTL of 5 minutes (300 seconds)\n    // We dont care about value. we are onl interested in key existence\n    this.stateDao.saveState(\n      state,\n      {\n        createdAt: Date.now(),\n        provider: providerType,\n        codeVerifier,\n      },\n      300 // 5 minutes in seconds\n    );\n\n    const params = new URLSearchParams({\n      client_id: providerConfig.clientId,\n      redirect_uri: providerConfig.redirectUri,\n      scope: providerConfig.scopes.join(\" \"),\n      state,\n      response_type: \"code\",\n      code_challenge: codeChallenge,\n      code_challenge_method: \"S256\",\n      ...providerConfig.extraConfig,\n    });\n\n    const authUrl = `${providerImpl.authorizationEndpoint}?${params.toString()}`;\n    this.log('INFO', 'Auth', `Authorization URL generated successfully`, { \n      provider: providerType,\n      endpoint: providerImpl.authorizationEndpoint \n    });\n\n    return authUrl;\n  }\n\n  /**\n   * Handles the OAuth callback and creates a user session.\n   *\n   * @param provider - The provider name (must be a configured provider key)\n   * @param code - The authorization code from the provider\n   * @param state - The state parameter for validation\n   * @returns A Promise that resolves to the session ID\n   *\n   * @throws Error when code or state is missing/invalid, or provider is not configured\n   *\n   * @example\n   * ```typescript\n   * const sessionId = await lixa.handleCallback({\n   *   provider: 'google',\n   *   code: req.query.code,\n   *   state: req.query.state\n   * });\n   * ```\n   */\n  public async handleCallback({\n    provider,\n    code,\n    state,\n  }: {\n    provider: ConfiguredProviderKey<TConfig> | string;\n    code: string;\n    state?: string;\n  }): Promise<string> {\n    const providerType = String(provider).toLowerCase();\n    this.log('INFO', 'Auth', `Handling OAuth callback for provider: ${providerType}`);\n\n    if (!code || code.trim() === \"\") {\n      this.log('ERROR', 'Auth', 'Invalid or missing authorization code in callback');\n      throw new Error(\"Invalid or missing code in callback\");\n    }\n\n    if (!state || state.trim() === \"\") {\n      this.log('ERROR', 'Auth', 'Invalid or missing state in callback');\n      throw new Error(\"Invalid or missing state in callback\");\n    }\n\n    this.log('INFO', 'State', 'Validating state parameter', { state });\n\n    //Validate state here\n    const cachedState = await this.stateDao.getState(state);\n    if (!cachedState) {\n      this.log('ERROR', 'State', 'State validation failed: state not found or expired', { state });\n      throw new Error(\"Invalid or expired state\");\n    }\n    \n    this.log('INFO', 'State', 'State validated successfully, removing from cache');\n    // State is valid, remove it from cache to prevent reuse\n    await this.stateDao.deleteState(state);\n\n    //Get code verifier from cached state\n    const codeVerifier = cachedState.codeVerifier;\n\n    const providerConfig = this.findProviderByType(providerType);\n\n    if (!providerConfig) {\n      this.log('ERROR', 'Auth', `Provider '${String(provider)}' is not configured`);\n      throw new Error(`Provider '${String(provider)}' is not configured in this Lixa instance`);\n    }\n\n    const providerImpl = this.getProvider(providerType, providerConfig);\n\n    this.log('INFO', 'Token', `Exchanging authorization code for tokens`, { provider: providerType });\n\n    // Exchange code for tokens and fetch user info here.\n    const tokens = await this.exchangeCodeForToken(\n      code,\n      providerConfig,\n      providerImpl,\n      codeVerifier\n    );\n\n    this.log('INFO', 'Token', 'Token exchange successful');\n\n    this.log('INFO', 'Session', 'Creating user session');\n    const session = await this.sessionStrategy.createSession(tokens);\n\n    // Generate unique session ID\n    const sessionId = randomBytes(32).toString(\"hex\");\n\n    this.log('INFO', 'Session', 'Storing session', { sessionId });\n    // Store session with 24 hour TTL (86400 seconds)\n    await this.sesionDao.saveSession(sessionId, session, 86400);\n\n    this.log('INFO', 'Session', 'Session created successfully', { sessionId });\n\n    return sessionId;\n  }\n\n  public async fetchSessionInfo(sessionId: string): Promise<Session | null> {\n    return await this.sesionDao.getSession<Session>(sessionId);\n  }\n\n  private async exchangeCodeForToken(\n    code: string,\n    providerConfig: ProviderConfig,\n    providerImpl: IProvider,\n    codeVerifier: string\n  ): Promise<OAuthTokenResponse> {\n    // Build the request body\n    const body: Record<string, string> = {\n      client_id: providerConfig.clientId,\n      client_secret: providerConfig.clientSecret,\n      code,\n      redirect_uri: providerConfig.redirectUri,\n      grant_type: \"authorization_code\",\n    };\n\n    if (codeVerifier) {\n      body.code_verifier = codeVerifier;\n    }\n    const params = new URLSearchParams(body);\n\n    this.log('INFO', 'Token', 'Sending token exchange request', { \n      endpoint: providerImpl.tokenEndpoint \n    });\n    \n    const response = await fetch(providerImpl.tokenEndpoint, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/x-www-form-urlencoded\",\n        Accept: \"application/json\",\n      },\n      body: params.toString(),\n    });\n\n    if (!response.ok) {\n      const errorBody = await response.text();\n      this.log('ERROR', 'Token', 'Token exchange failed', { \n        status: response.status, \n        statusText: response.statusText,\n        error: errorBody \n      });\n      throw new Error(\n        `Token exchange failed: ${response.status} ${response.statusText} - ${errorBody}`\n      );\n    }\n\n    this.log('INFO', 'Token', 'Token exchange response received successfully');\n    return response.json();\n  }\n\n  private findProviderByType(providerType: string): ProviderConfig | undefined {\n    // Use Object.entries to safely iterate and find the provider\n    for (const [key, value] of Object.entries(this.config.providers)) {\n      if (key.toLowerCase() === providerType.toLowerCase()) {\n        return value;\n      }\n    }\n    return undefined;\n  }\n}\n\nexport { Lixa };\n","import NodeCache from 'node-cache';\nimport { StateDao, StateData } from \"./types\";\n\nclass LocalStateCache implements StateDao {\n  private cache: NodeCache;\n\n  constructor(defaultTtlSeconds: number = 600) {\n    this.cache = new NodeCache({ stdTTL: defaultTtlSeconds });\n  }\n\n  async saveState(state: string, data: StateData, expiresInSeconds: number): Promise<void> {\n    this.cache.set(state, data, expiresInSeconds);\n  }\n\n  async getState(state: string): Promise<StateData | null> {\n    return this.cache.get<StateData>(state) || null;\n  }\n\n  async deleteState(state: string): Promise<void> {\n    this.cache.del(state);\n  }\n}\n\nexport { LocalStateCache };\n","import NodeCache from 'node-cache';\nimport { SessionDao } from \"./types\";\nimport type { Session } from \"../models/session\";\n\nclass LocalSessionCache implements SessionDao {\n  private cache: NodeCache;\n\n  constructor(defaultTtlSeconds: number = 600) {\n    this.cache = new NodeCache({ stdTTL: defaultTtlSeconds });\n  }\n\n  async saveSession<T extends Session>(state: string, data: T, expiresInSeconds: number): Promise<void> {\n    this.cache.set(state, data, expiresInSeconds);\n  }\n\n  async getSession<T extends Session>(state: string): Promise<T | null> {\n    return this.cache.get<T>(state) || null;\n  }\n\n  async deleteSession(state: string): Promise<void> {\n    this.cache.del(state);\n  }\n}\n\nexport { LocalSessionCache };\n","/**\n * OAuth 2.0 token response structure.\n * Based on RFC 6749 Section 5.1 and OpenID Connect Core 1.0 Section 3.1.3.3\n * \n * @remarks\n * This interface represents the standard OAuth 2.0 token response with\n * optional OpenID Connect extensions. All OAuth providers should return\n * at minimum the required fields (access_token, token_type).\n * \n * @public\n */\nexport interface OAuthTokenResponse {\n  /** \n   * OAuth 2.0 access token (required).\n   * Used to access protected resources on behalf of the user.\n   */\n  access_token: string;\n  \n  /** \n   * Token type (required).\n   * Typically \"Bearer\" for OAuth 2.0.\n   */\n  token_type: string;\n  \n  /** \n   * Token expiration time in seconds (optional).\n   * Time until the access token expires.\n   */\n  expires_in?: number;\n  \n  /** \n   * OAuth 2.0 refresh token (optional).\n   * Used to obtain new access tokens without re-authentication.\n   */\n  refresh_token?: string;\n  \n  /** \n   * Granted OAuth scopes (optional).\n   * Space-separated list of scopes that were granted.\n   */\n  scope?: string;\n  \n  /** \n   * OpenID Connect ID token (optional).\n   * JWT containing user identity claims (only present for OIDC providers).\n   */\n  id_token?: string;\n  \n  /**\n   * Additional provider-specific fields.\n   * Some providers may include extra fields like user_id, account_id, etc.\n   */\n  [key: string]: string | number | boolean | undefined;\n}\n\n/**\n * Represents a user session after successful OAuth authentication.\n * \n * @remarks\n * The Session object is returned by SessionStrategy.createSession() and contains\n * the session identifier and any additional data needed for your application.\n * \n * The structure is intentionally flexible to support various session management\n * approaches (JWT tokens, session IDs, etc.).\n *\n * @public\n */\nexport interface Session<TRaw = OAuthTokenResponse> {\n  /** \n   * The session token or identifier.\n   * This could be an access token, a session ID, a JWT, or any other identifier\n   * that your application uses to track authenticated users.\n   */\n  token: string;\n  \n  /** \n   * Raw session data.\n   * Contains the complete OAuth token response and any additional data\n   * your SessionStrategy adds (user info, database IDs, etc.).\n   * \n   * Typical OAuth token data includes:\n   * - access_token: OAuth access token\n   * - refresh_token: OAuth refresh token (if requested)\n   * - expires_in: Token expiration time in seconds\n   * - token_type: Token type (usually \"Bearer\")\n   * - id_token: OpenID Connect ID token (if using OIDC)\n   * - scope: Granted scopes\n   */\n  raw: TRaw;\n}\n\n/**\n * Strategy interface for custom session creation.\n * \n * @remarks\n * Implement this interface to customize how OAuth tokens are converted into\n * application sessions. This is where you typically:\n * - Decode ID tokens (for OpenID Connect)\n * - Look up or create users in your database\n * - Generate session identifiers\n * - Store session data\n * - Add custom claims or metadata\n * \n * The default implementation (DefaultSessionStrategy) simply extracts the\n * access token and returns it as the session token.\n * \n * @example\n * Custom session strategy with database integration:\n * ```typescript\n * interface CustomSessionData extends OAuthTokenResponse {\n *   userId: string;\n *   email: string;\n * }\n * \n * class DatabaseSessionStrategy implements SessionStrategy {\n *   constructor(private db: Database) {}\n *   \n *   async createSession(tokenData: OAuthTokenResponse): Promise<Session<CustomSessionData>> {\n *     // Decode ID token for OIDC providers\n *     const idToken = tokenData.id_token;\n *     const payload = decodeJwt(idToken);\n *     \n *     // Create or update user in database\n *     const user = await this.db.users.upsert({\n *       email: payload.email,\n *       name: payload.name,\n *       picture: payload.picture\n *     });\n *     \n *     // Generate session ID\n *     const sessionId = generateSecureId();\n *     \n *     // Store session with tokens\n *     await this.db.sessions.create({\n *       id: sessionId,\n *       userId: user.id,\n *       accessToken: tokenData.access_token,\n *       refreshToken: tokenData.refresh_token,\n *       expiresAt: new Date(Date.now() + (tokenData.expires_in || 3600) * 1000)\n *     });\n *     \n *     return {\n *       token: sessionId,\n *       raw: {\n *         userId: user.id,\n *         email: user.email,\n *         ...tokenData\n *       }\n *     };\n *   }\n * }\n * ```\n *\n * @public\n */\nexport interface SessionStrategy {\n  /**\n   * Creates a session from OAuth token data.\n   * \n   * @param tokenData - The token data received from the OAuth provider's token endpoint\n   * @returns A Promise that resolves to a Session object\n   * \n   * @remarks\n   * This method is called after successfully exchanging the authorization code\n   * for tokens. The tokenData parameter contains the raw response from the\n   * provider's token endpoint.\n   * \n   * Common token data fields:\n   * - access_token: OAuth access token\n   * - refresh_token: OAuth refresh token (optional)\n   * - expires_in: Token expiration time in seconds\n   * - token_type: Token type (usually \"Bearer\")\n   * - id_token: OpenID Connect ID token (for OIDC providers)\n   * - scope: Granted scopes\n   * \n   * @throws \\{Error\\} If session creation fails (e.g., database error, invalid token)\n   * \n   * @example\n   * Simple implementation:\n   * ```typescript\n   * async createSession(tokenData: OAuthTokenResponse): Promise<Session> {\n   *   return {\n   *     token: tokenData.access_token,\n   *     raw: tokenData\n   *   };\n   * }\n   * ```\n   */\n  createSession(tokenData: OAuthTokenResponse): Promise<Session>;\n}\n\n/**\n * Default session strategy that works with any OAuth provider.\n * Extracts common token information and creates a standardized session.\n *\n * @public\n */\nexport class DefaultSessionStrategy implements SessionStrategy {\n  /**\n   * Creates a session from OAuth token data.\n   * Handles common OAuth token formats and extracts the access token.\n   *\n   * @param tokenData - The token data received from the OAuth provider\n   * @returns A Promise that resolves to a Session object\n   */\n  async createSession(tokenData: OAuthTokenResponse): Promise<Session> {\n    if (!tokenData.access_token || typeof tokenData.access_token !== 'string') {\n      throw new Error('No valid access token found in OAuth response');\n    }\n\n    return {\n      token: tokenData.access_token,\n      raw: tokenData,\n    };\n  }\n}","import type { OAuthTokenResponse } from \"../models/session\";\n\n/**\n * User information extracted from OAuth provider\n * \n * @public\n */\nexport interface UserInfo {\n  email: string;\n  id?: string | undefined;\n  sub?: string | undefined;\n  given_name?: string | undefined;\n  family_name?: string | undefined;\n  name?: string | undefined;\n  picture?: string | undefined;\n  email_verified?: boolean | undefined;\n  iss?: string | undefined;\n}\n\n/**\n * Decode JWT ID token to extract user information\n * \n * @public\n */\nexport function decodeIdToken(idToken: string): UserInfo {\n  const parts = idToken.split('.');\n  if (parts.length !== 3) {\n    throw new Error('Invalid ID token format: expected 3 parts separated by dots');\n  }\n  \n  const base64Payload = parts[1];\n  if (!base64Payload) {\n    throw new Error('Invalid ID token: missing payload section');\n  }\n  const payload = Buffer.from(base64Payload, 'base64').toString();\n  \n  try {\n    return JSON.parse(payload);\n  } catch (error) {\n    throw new Error('Invalid ID token: failed to parse payload JSON');\n  }\n}\n\n/**\n * Determine OAuth provider from ID token issuer\n * \n * @public\n */\nexport function determineProviderFromIssuer(userInfo: UserInfo): string | null {\n  if (!userInfo.iss) {\n    return null;\n  }\n  \n  const issuer = userInfo.iss.toLowerCase();\n  \n  if (issuer.includes('accounts.google.com')) {\n    return 'google';\n  }\n  \n  if (issuer.includes('github')) {\n    return 'github';\n  }\n  \n  // Unknown issuer\n  return null;\n}\n\n/**\n * Fetch user info from OAuth provider's userinfo endpoint\n * \n * @param accessToken - OAuth access token\n * @param userInfoEndpoint - The provider's userinfo endpoint URL\n * @param providerName - Provider name for error messages (optional)\n * @returns User information from the provider\n * \n * @throws Error if the request fails or response is invalid\n * \n * @public\n */\nexport async function fetchUserInfo(\n  accessToken: string, \n  userInfoEndpoint: string,\n  providerName?: string\n): Promise<UserInfo> {\n  const response = await fetch(userInfoEndpoint, {\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      Accept: 'application/json',\n    },\n  });\n  \n  if (!response.ok) {\n    const providerLabel = providerName ? ` from ${providerName}` : '';\n    throw new Error(`Failed to fetch user info${providerLabel}: ${response.status} ${response.statusText}`);\n  }\n  \n  const data = await response.json();\n  if (!data || typeof data !== 'object' || !('email' in data) || typeof data.email !== 'string') {\n    const providerLabel = providerName ? ` from ${providerName}` : '';\n    throw new Error(`Invalid user info response${providerLabel}: missing or invalid email`);\n  }\n  \n  return {\n    email: data.email,\n    id: 'id' in data ? String(data.id) : undefined,\n    sub: 'sub' in data ? String(data.sub) : undefined,\n    given_name: 'given_name' in data ? String(data.given_name) : undefined,\n    family_name: 'family_name' in data ? String(data.family_name) : undefined,\n    name: 'name' in data ? String(data.name) : undefined,\n    picture: 'picture' in data ? String(data.picture) : undefined,\n    email_verified: 'email_verified' in data ? Boolean(data.email_verified) : undefined,\n    iss: 'iss' in data ? String(data.iss) : undefined,\n  };\n}\n\n/**\n * Extract user info from OAuth token data\n * \n * @param tokenData - OAuth token response from provider\n * @param userInfoEndpoint - Optional userinfo endpoint URL (required if no ID token)\n * @param providerName - Optional provider name for error messages\n * @returns User info and detected provider name\n * \n * @remarks\n * This function attempts to extract user information in the following order:\n * 1. Decode ID token if present (preferred method)\n * 2. Fetch from userinfo endpoint using access token (requires userInfoEndpoint parameter)\n * \n * Provider detection:\n * - Primary: Extract from ID token issuer field\n * - Fallback: Use provider field in token data (if present)\n * - Fallback: Use providerName parameter\n * - Throws error if provider cannot be determined\n * \n * @throws Error if no ID token or access token is available\n * @throws Error if provider cannot be determined\n * @throws Error if userInfoEndpoint is required but not provided\n * \n * @example\n * With ID token (provider auto-detected):\n * ```typescript\n * const { userInfo, provider } = await extractUserInfo(tokenData);\n * console.log(`User ${userInfo.email} authenticated via ${provider}`);\n * ```\n * \n * @example\n * Without ID token (requires userInfoEndpoint):\n * ```typescript\n * const { userInfo, provider } = await extractUserInfo(\n *   tokenData,\n *   'https://api.example.com/user',\n *   'custom'\n * );\n * ```\n * \n * @public\n */\nexport async function extractUserInfo(\n  tokenData: OAuthTokenResponse,\n  userInfoEndpoint?: string,\n  providerName?: string\n): Promise<{ userInfo: UserInfo; provider: string }> {\n  let userInfo: UserInfo;\n  let provider: string | null = null;\n  \n  if (tokenData.id_token) {\n    // Decode ID token to get user info\n    userInfo = decodeIdToken(tokenData.id_token);\n    \n    // Try to determine provider from issuer\n    provider = determineProviderFromIssuer(userInfo);\n    \n    // Fallback to provided provider name\n    if (!provider && providerName) {\n      provider = providerName;\n    }\n  } else if (tokenData.access_token) {\n    // Without ID token, we need to know which provider to fetch from\n    // Check if provider info is in the token data (custom field)\n    if ('provider' in tokenData && typeof tokenData.provider === 'string') {\n      provider = tokenData.provider;\n    } else if (providerName) {\n      provider = providerName;\n    }\n    \n    if (!provider) {\n      throw new Error(\n        'Cannot determine OAuth provider: No ID token with issuer information, ' +\n        'no provider field in token data, and no providerName provided. Unable to fetch user info.'\n      );\n    }\n    \n    if (!userInfoEndpoint) {\n      throw new Error(\n        `Cannot fetch user info for provider '${provider}': No ID token available and no userInfoEndpoint provided. ` +\n        'Either ensure the provider returns an ID token or provide the userInfoEndpoint parameter.'\n      );\n    }\n    \n    // Fetch user info from provider's API\n    userInfo = await fetchUserInfo(tokenData.access_token, userInfoEndpoint, provider);\n  } else {\n    throw new Error('No ID token or access token available to fetch user info');\n  }\n  \n  // Final provider validation\n  if (!provider) {\n    throw new Error(\n      'Cannot determine OAuth provider: ID token issuer not recognized and no provider name provided.'\n    );\n  }\n  \n  return { userInfo, provider };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAA4B;;;ACA5B,wBAAsB;AAGtB,IAAM,kBAAN,MAA0C;AAAA,EAChC;AAAA,EAER,YAAY,oBAA4B,KAAK;AAC3C,SAAK,QAAQ,IAAI,kBAAAA,QAAU,EAAE,QAAQ,kBAAkB,CAAC;AAAA,EAC1D;AAAA,EAEA,MAAM,UAAU,OAAe,MAAiB,kBAAyC;AACvF,SAAK,MAAM,IAAI,OAAO,MAAM,gBAAgB;AAAA,EAC9C;AAAA,EAEA,MAAM,SAAS,OAA0C;AACvD,WAAO,KAAK,MAAM,IAAe,KAAK,KAAK;AAAA,EAC7C;AAAA,EAEA,MAAM,YAAY,OAA8B;AAC9C,SAAK,MAAM,IAAI,KAAK;AAAA,EACtB;AACF;;;ADhBA,IAAAC,iBAAmB;;;AELnB,IAAAC,qBAAsB;AAItB,IAAM,oBAAN,MAA8C;AAAA,EACpC;AAAA,EAER,YAAY,oBAA4B,KAAK;AAC3C,SAAK,QAAQ,IAAI,mBAAAC,QAAU,EAAE,QAAQ,kBAAkB,CAAC;AAAA,EAC1D;AAAA,EAEA,MAAM,YAA+B,OAAe,MAAS,kBAAyC;AACpG,SAAK,MAAM,IAAI,OAAO,MAAM,gBAAgB;AAAA,EAC9C;AAAA,EAEA,MAAM,WAA8B,OAAkC;AACpE,WAAO,KAAK,MAAM,IAAO,KAAK,KAAK;AAAA,EACrC;AAAA,EAEA,MAAM,cAAc,OAA8B;AAChD,SAAK,MAAM,IAAI,KAAK;AAAA,EACtB;AACF;;;AC+KO,IAAM,yBAAN,MAAwD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ7D,MAAM,cAAc,WAAiD;AACnE,QAAI,CAAC,UAAU,gBAAgB,OAAO,UAAU,iBAAiB,UAAU;AACzE,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,WAAO;AAAA,MACL,OAAO,UAAU;AAAA,MACjB,KAAK;AAAA,IACP;AAAA,EACF;AACF;;;AHrJA,IAAM,OAAN,MAAM,MAA8E;AAAA,EAClF,OAAe,oBAA4C,oBAAI,IAAI;AAAA,EACnE,OAAe,uBAA+C,oBAAI,IAAI;AAAA;AAAA,EACtE,OAAe,oBAAoB,IAAI,gBAAgB;AAAA,EACvD,OAAe,sBAAsB,IAAI,kBAAkB;AAAA,EAC3D,OAAe,2BAA2B,IAAI,uBAAuB;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeR,YAAY,QAAiB;AAC3B,SAAK,SAAS;AACd,SAAK,WAAW,OAAO,YAAY,MAAK;AACxC,SAAK,YAAY,OAAO,cAAc,MAAK;AAC3C,SAAK,kBAAkB,OAAO,mBAAmB,MAAK;AACtD,SAAK,QAAQ,OAAO,SAAS;AAE7B,SAAK,IAAI,QAAQ,QAAQ,8BAA8B;AAAA,MACrD,WAAW,OAAO,KAAK,OAAO,SAAS;AAAA,MACvC,OAAO,KAAK;AAAA,IACd,CAAC;AAGD,eAAW,CAAC,cAAc,cAAc,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AAC7E,YAAM,OAAO,aAAa,YAAY;AACtC,YAAM,cAA8B;AAGpC,WAAK,uBAAuB,cAAc,WAAW;AAGrD,UAAI,YAAY,UAAU;AACxB,aAAK,+BAA+B,cAAc,YAAY,QAAQ;AACtE,aAAK,IAAI,QAAQ,QAAQ,+BAA+B,YAAY,EAAE;AAAA,MACxE,OAAO;AAEL,YAAI,CAAC,MAAK,kBAAkB,IAAI,IAAI,KAAK,CAAC,MAAK,qBAAqB,IAAI,IAAI,GAAG;AAC7E,eAAK,IAAI,SAAS,QAAQ,aAAa,YAAY,iBAAiB;AACpE,gBAAM,IAAI;AAAA,YACR,aAAa,YAAY;AAAA,UAI3B;AAAA,QACF;AACA,aAAK,IAAI,QAAQ,QAAQ,8BAA8B,YAAY,EAAE;AAAA,MACvE;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,QAAQ,wCAAwC;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,uBAAuB,MAAc,QAA8B;AACzE,UAAM,iBAA2C,CAAC,YAAY,gBAAgB,eAAe,QAAQ;AACrG,UAAM,gBAAgB,eAAe,OAAO,WAAS;AACnD,YAAM,QAAQ,OAAO,KAAK;AAC1B,aAAO,UAAU,UAAa,UAAU,QAAS,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,IACjG,CAAC;AAED,QAAI,cAAc,SAAS,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI,+CAA+C,cAAc,KAAK,IAAI,CAAC;AAAA,MAC1F;AAAA,IACF;AAGA,QAAI,CAAC,MAAM,QAAQ,OAAO,MAAM,GAAG;AACjC,YAAM,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAEA,QAAI,OAAO,OAAO,WAAW,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,+BAA+B,MAAc,UAA2B;AAC9E,UAAM,gBAAqC,CAAC,yBAAyB,iBAAiB,kBAAkB;AACxG,UAAM,eAAe,cAAc,OAAO,UAAQ;AAChD,YAAM,QAAQ,SAAS,IAAI;AAC3B,aAAO,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,IACjE,CAAC;AAED,QAAI,aAAa,SAAS,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI,oDAAoD,aAAa,KAAK,IAAI,CAAC;AAAA,MAE9F;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcQ,IAAI,OAAkC,SAA0D,SAAiB,MAAmE;AAC1L,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,UAAM,SAAS,WAAW,SAAS,MAAM,KAAK,MAAM,OAAO;AAE3D,QAAI,SAAS,QAAW;AACtB,cAAQ,IAAI,GAAG,MAAM,IAAI,OAAO,IAAI,IAAI;AAAA,IAC1C,OAAO;AACL,cAAQ,IAAI,GAAG,MAAM,IAAI,OAAO,EAAE;AAAA,IACpC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBO,qBAAuC,UAA6D;AACzG,UAAM,eAAe,SAAS,YAAY;AAC1C,WAAO,KAAK,OAAO,UAAU,eAAe,YAAY;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,YAAY,MAAc,QAAmC;AAEnE,QAAI,OAAO,UAAU;AACnB,aAAO,OAAO;AAAA,IAChB;AAGA,UAAM,YAAY,KAAK,YAAY;AACnC,UAAM,kBAAkB,MAAK,kBAAkB,IAAI,SAAS;AAC5D,QAAI,iBAAiB;AACnB,aAAO;AAAA,IACT;AAGA,UAAM,iBAAiB,MAAK,qBAAqB,IAAI,SAAS;AAC9D,QAAI,gBAAgB;AAClB,aAAO;AAAA,IACT;AAEA,UAAM,IAAI;AAAA,MACR,aAAa,IAAI;AAAA,IAGnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiCA,OAAc,iBAAsD,aAAsB;AACxF,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,YAAY,MAAM;AAC3D,YAAK,qBAAqB,IAAI,IAAI,YAAY,GAAG,YAAY;AAAA,IAC/D,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,yBAAmC;AAC/C,WAAO,MAAM,KAAK,MAAK,qBAAqB,KAAK,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,OAAc,aACZ,QACe;AACf,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,OAAc,sBAA8B;AAC1C,eAAO,2BAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoCA,OAAe,uBAA+B;AAC5C,eAAO,2BAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6CA,OAAe,mBAAmB,cAA8B;AAC9D,UAAM,OAAO,eAAAC,QACV,WAAW,QAAQ,EACnB,OAAO,YAAY,EACnB,OAAO,QAAQ;AAGlB,WAAO,KAAK,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBO,WAAW,UAAmD,OAAuB;AAC1F,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAElD,SAAK,IAAI,QAAQ,QAAQ,8CAA8C,YAAY,EAAE;AAErF,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAE3D,QAAI,CAAC,gBAAgB;AACnB,WAAK,IAAI,SAAS,QAAQ,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAC5E,YAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,CAAC,2CAA2C;AAAA,IAC1F;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAElE,UAAM,eAAe,MAAK,qBAAqB;AAC/C,UAAM,gBAAgB,MAAK,mBAAmB,YAAY;AAE1D,SAAK,IAAI,QAAQ,SAAS,8BAA8B,YAAY,IAAI,EAAE,MAAM,CAAC;AAIjF,SAAK,SAAS;AAAA,MACZ;AAAA,MACA;AAAA,QACE,WAAW,KAAK,IAAI;AAAA,QACpB,UAAU;AAAA,QACV;AAAA,MACF;AAAA,MACA;AAAA;AAAA,IACF;AAEA,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,eAAe;AAAA,MAC1B,cAAc,eAAe;AAAA,MAC7B,OAAO,eAAe,OAAO,KAAK,GAAG;AAAA,MACrC;AAAA,MACA,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,MACvB,GAAG,eAAe;AAAA,IACpB,CAAC;AAED,UAAM,UAAU,GAAG,aAAa,qBAAqB,IAAI,OAAO,SAAS,CAAC;AAC1E,SAAK,IAAI,QAAQ,QAAQ,4CAA4C;AAAA,MACnE,UAAU;AAAA,MACV,UAAU,aAAa;AAAA,IACzB,CAAC;AAED,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAa,eAAe;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIoB;AAClB,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAClD,SAAK,IAAI,QAAQ,QAAQ,yCAAyC,YAAY,EAAE;AAEhF,QAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,IAAI;AAC/B,WAAK,IAAI,SAAS,QAAQ,mDAAmD;AAC7E,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACvD;AAEA,QAAI,CAAC,SAAS,MAAM,KAAK,MAAM,IAAI;AACjC,WAAK,IAAI,SAAS,QAAQ,sCAAsC;AAChE,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,SAAK,IAAI,QAAQ,SAAS,8BAA8B,EAAE,MAAM,CAAC;AAGjE,UAAM,cAAc,MAAM,KAAK,SAAS,SAAS,KAAK;AACtD,QAAI,CAAC,aAAa;AAChB,WAAK,IAAI,SAAS,SAAS,uDAAuD,EAAE,MAAM,CAAC;AAC3F,YAAM,IAAI,MAAM,0BAA0B;AAAA,IAC5C;AAEA,SAAK,IAAI,QAAQ,SAAS,mDAAmD;AAE7E,UAAM,KAAK,SAAS,YAAY,KAAK;AAGrC,UAAM,eAAe,YAAY;AAEjC,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAE3D,QAAI,CAAC,gBAAgB;AACnB,WAAK,IAAI,SAAS,QAAQ,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAC5E,YAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,CAAC,2CAA2C;AAAA,IAC1F;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAElE,SAAK,IAAI,QAAQ,SAAS,4CAA4C,EAAE,UAAU,aAAa,CAAC;AAGhG,UAAM,SAAS,MAAM,KAAK;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,SAAS,2BAA2B;AAErD,SAAK,IAAI,QAAQ,WAAW,uBAAuB;AACnD,UAAM,UAAU,MAAM,KAAK,gBAAgB,cAAc,MAAM;AAG/D,UAAM,gBAAY,2BAAY,EAAE,EAAE,SAAS,KAAK;AAEhD,SAAK,IAAI,QAAQ,WAAW,mBAAmB,EAAE,UAAU,CAAC;AAE5D,UAAM,KAAK,UAAU,YAAY,WAAW,SAAS,KAAK;AAE1D,SAAK,IAAI,QAAQ,WAAW,gCAAgC,EAAE,UAAU,CAAC;AAEzE,WAAO;AAAA,EACT;AAAA,EAEA,MAAa,iBAAiB,WAA4C;AACxE,WAAO,MAAM,KAAK,UAAU,WAAoB,SAAS;AAAA,EAC3D;AAAA,EAEA,MAAc,qBACZ,MACA,gBACA,cACA,cAC6B;AAE7B,UAAM,OAA+B;AAAA,MACnC,WAAW,eAAe;AAAA,MAC1B,eAAe,eAAe;AAAA,MAC9B;AAAA,MACA,cAAc,eAAe;AAAA,MAC7B,YAAY;AAAA,IACd;AAEA,QAAI,cAAc;AAChB,WAAK,gBAAgB;AAAA,IACvB;AACA,UAAM,SAAS,IAAI,gBAAgB,IAAI;AAEvC,SAAK,IAAI,QAAQ,SAAS,kCAAkC;AAAA,MAC1D,UAAU,aAAa;AAAA,IACzB,CAAC;AAED,UAAM,WAAW,MAAM,MAAM,aAAa,eAAe;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,MACA,MAAM,OAAO,SAAS;AAAA,IACxB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,WAAK,IAAI,SAAS,SAAS,yBAAyB;AAAA,QAClD,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,OAAO;AAAA,MACT,CAAC;AACD,YAAM,IAAI;AAAA,QACR,0BAA0B,SAAS,MAAM,IAAI,SAAS,UAAU,MAAM,SAAS;AAAA,MACjF;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,SAAS,+CAA+C;AACzE,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEQ,mBAAmB,cAAkD;AAE3E,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,OAAO,SAAS,GAAG;AAChE,UAAI,IAAI,YAAY,MAAM,aAAa,YAAY,GAAG;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;AIroBO,SAAS,cAAc,SAA2B;AACvD,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AAEA,QAAM,gBAAgB,MAAM,CAAC;AAC7B,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACA,QAAM,UAAU,OAAO,KAAK,eAAe,QAAQ,EAAE,SAAS;AAE9D,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACF;AAOO,SAAS,4BAA4B,UAAmC;AAC7E,MAAI,CAAC,SAAS,KAAK;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,SAAS,IAAI,YAAY;AAExC,MAAI,OAAO,SAAS,qBAAqB,GAAG;AAC1C,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,SAAS,QAAQ,GAAG;AAC7B,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAcA,eAAsB,cACpB,aACA,kBACA,cACmB;AACnB,QAAM,WAAW,MAAM,MAAM,kBAAkB;AAAA,IAC7C,SAAS;AAAA,MACP,eAAe,UAAU,WAAW;AAAA,MACpC,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,gBAAgB,eAAe,SAAS,YAAY,KAAK;AAC/D,UAAM,IAAI,MAAM,4BAA4B,aAAa,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAAA,EACxG;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,SAAS,OAAO,KAAK,UAAU,UAAU;AAC7F,UAAM,gBAAgB,eAAe,SAAS,YAAY,KAAK;AAC/D,UAAM,IAAI,MAAM,6BAA6B,aAAa,4BAA4B;AAAA,EACxF;AAEA,SAAO;AAAA,IACL,OAAO,KAAK;AAAA,IACZ,IAAI,QAAQ,OAAO,OAAO,KAAK,EAAE,IAAI;AAAA,IACrC,KAAK,SAAS,OAAO,OAAO,KAAK,GAAG,IAAI;AAAA,IACxC,YAAY,gBAAgB,OAAO,OAAO,KAAK,UAAU,IAAI;AAAA,IAC7D,aAAa,iBAAiB,OAAO,OAAO,KAAK,WAAW,IAAI;AAAA,IAChE,MAAM,UAAU,OAAO,OAAO,KAAK,IAAI,IAAI;AAAA,IAC3C,SAAS,aAAa,OAAO,OAAO,KAAK,OAAO,IAAI;AAAA,IACpD,gBAAgB,oBAAoB,OAAO,QAAQ,KAAK,cAAc,IAAI;AAAA,IAC1E,KAAK,SAAS,OAAO,OAAO,KAAK,GAAG,IAAI;AAAA,EAC1C;AACF;AA4CA,eAAsB,gBACpB,WACA,kBACA,cACmD;AACnD,MAAI;AACJ,MAAI,WAA0B;AAE9B,MAAI,UAAU,UAAU;AAEtB,eAAW,cAAc,UAAU,QAAQ;AAG3C,eAAW,4BAA4B,QAAQ;AAG/C,QAAI,CAAC,YAAY,cAAc;AAC7B,iBAAW;AAAA,IACb;AAAA,EACF,WAAW,UAAU,cAAc;AAGjC,QAAI,cAAc,aAAa,OAAO,UAAU,aAAa,UAAU;AACrE,iBAAW,UAAU;AAAA,IACvB,WAAW,cAAc;AACvB,iBAAW;AAAA,IACb;AAEA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAEA,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI;AAAA,QACR,wCAAwC,QAAQ;AAAA,MAElD;AAAA,IACF;AAGA,eAAW,MAAM,cAAc,UAAU,cAAc,kBAAkB,QAAQ;AAAA,EACnF,OAAO;AACL,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAGA,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,SAAS;AAC9B;","names":["NodeCache","import_crypto","import_node_cache","NodeCache","crypto"]}
+{"version":3,"sources":["../src/index.ts","../src/lixa.ts","../src/dao/state-cache.ts","../src/dao/session-cache.ts","../src/models/session.ts","../src/utils/user-info.ts"],"sourcesContent":["/**\n * A flexible, provider-agnostic OAuth 2.0 and OpenID Connect (OIDC) client library for backend applications.\n * \n * @remarks\n * This package simplifies multi-provider authentication flows (e.g., Google, GitHub), supports extensible session management, and enables custom provider registration.\n * \n * Key features:\n * - OAuth 2.0 authorization code flow with PKCE (RFC 6749, RFC 7636)\n * - OpenID Connect support\n * - Built-in providers available in \\@vunexa/lixa-providers\n * - Custom provider support via IProvider interface\n * - Extensible session management via SessionStrategy\n * - Pluggable state and session storage via StateDao and SessionDao\n * - TypeScript-first with comprehensive type safety\n * \n * @packageDocumentation\n */\n\nexport { Lixa } from \"./lixa\";\nexport {\n  type ProviderConfig,\n  type LixaConfig,\n  type SafeLixaConfig,\n  type IProvider,\n  type SessionStrategy,\n  type Session,\n  type ProviderMetadata,\n  type OAuthTokenResponse,\n  type StateDao,\n  type SessionDao,\n  type StateData,\n} from \"./types\";\nexport { DefaultSessionStrategy } from \"./models/session\";\nexport {\n  type UserInfo,\n  extractUserInfo,\n  decodeIdToken,\n  fetchUserInfo,\n  determineProviderFromIssuer,\n} from \"./utils/user-info\";\n","import { randomBytes } from \"crypto\";\nimport { type LixaConfig, type ProviderConfig } from \"./types\";\nimport { IProvider } from \"./providers\";\nimport { LocalStateCache } from \"./dao/state-cache\";\nimport { SessionDao, StateDao } from \"./dao/types\";\nimport crypto from \"crypto\";\nimport { LocalSessionCache } from \"./dao/session-cache\";\nimport { type Session, type SessionStrategy, DefaultSessionStrategy, type OAuthTokenResponse, type ProviderMetadata } from \"./models/session\";\n\n/**\n * Type representing the keys of configured providers\n */\ntype ConfiguredProviderKey<T extends LixaConfig<Record<string, ProviderConfig>>> = keyof T['providers'];\n\n/**\n * A flexible, provider-agnostic OAuth 2.0 and OpenID Connect (OIDC) client library.\n *\n * @remarks\n * Lixa simplifies multi-provider authentication flows and supports extensible session management.\n * Providers can be passed inline in the configuration, eliminating the need for pre-registration.\n *\n * @example\n * Using built-in providers from \\@vunexa/lixa-providers:\n * ```typescript\n * import { Lixa } from '@vunexa/lixa';\n * import { GoogleProvider } from '@vunexa/lixa-providers';\n * \n * const lixa = new Lixa({\n *   providers: {\n *     google: {\n *       provider: new GoogleProvider(),\n *       clientId: 'your-client-id',\n *       clientSecret: 'your-client-secret',\n *       redirectUri: 'https://yourapp.com/auth/google/callback',\n *       scopes: ['openid', 'email', 'profile']\n *     }\n *   }\n * });\n * ```\n * \n * @example\n * Using custom inline providers:\n * ```typescript\n * import { Lixa, IProvider } from '@vunexa/lixa';\n * \n * const customProvider: IProvider = {\n *   authorizationEndpoint: 'https://custom.com/oauth/authorize',\n *   tokenEndpoint: 'https://custom.com/oauth/token',\n *   userInfoEndpoint: 'https://custom.com/api/user'\n * };\n * \n * const lixa = new Lixa({\n *   providers: {\n *     custom: {\n *       provider: customProvider,\n *       clientId: 'your-client-id',\n *       clientSecret: 'your-client-secret',\n *       redirectUri: 'https://yourapp.com/auth/custom/callback',\n *       scopes: ['read:user']\n *     }\n *   }\n * });\n * ```\n *\n * @public\n */\nclass Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> = LixaConfig> {\n  private static DEFAULT_PROVIDERS: Map<string, IProvider> = new Map();\n  private static CONFIGURED_PROVIDERS: Map<string, IProvider> = new Map(); // Legacy registry for backward compatibility\n  private static LOCAL_STATE_CACHE = new LocalStateCache();\n  private static LOCAL_SESSION_CACHE = new LocalSessionCache();\n  private static DEFAULT_SESSION_STRATEGY = new DefaultSessionStrategy();\n  private config: TConfig;\n  private stateDao: StateDao;\n  private sesionDao: SessionDao;\n  private sessionStrategy: SessionStrategy;\n  private debug: boolean;\n\n  /**\n   * Creates a new Lixa instance with the provided configuration.\n   * \n   * @remarks\n   * Providers can be passed inline in the configuration using the `provider` field.\n   * Provider resolution priority: inline custom provider \\> default providers \\> legacy registry.\n   * \n   * @param config - The configuration object containing provider settings and optional session strategy\n   * \n   * @throws Error when provider configuration is missing required fields\n   * @throws Error when provider implementation is missing required properties\n   * @throws Error when provider is not available and no inline implementation is provided\n   */\n  constructor(config: TConfig) {\n    this.config = config;\n    this.stateDao = config.stateDao || Lixa.LOCAL_STATE_CACHE;\n    this.sesionDao = config.sessionDao || Lixa.LOCAL_SESSION_CACHE;\n    this.sessionStrategy = config.sessionStrategy || Lixa.DEFAULT_SESSION_STRATEGY;\n    this.debug = config.debug || false;\n    \n    this.log('INFO', 'Init', 'Initializing Lixa instance', { \n      providers: Object.keys(config.providers),\n      debug: this.debug \n    });\n    \n    // Validate and extract providers from configuration\n    for (const [providerName, providerConfig] of Object.entries(config.providers)) {\n      const name = providerName.toLowerCase();\n      const typedConfig: ProviderConfig = providerConfig;\n      \n      // Validate provider configuration has required credentials\n      this.validateProviderConfig(providerName, typedConfig);\n      \n      // If provider config includes a custom provider implementation, validate it\n      if (typedConfig.provider) {\n        this.validateProviderImplementation(providerName, typedConfig.provider);\n        this.log('INFO', 'Init', `Registered inline provider: ${providerName}`);\n      } else {\n        // Check if it's available in default providers or legacy registry\n        if (!Lixa.DEFAULT_PROVIDERS.has(name) && !Lixa.CONFIGURED_PROVIDERS.has(name)) {\n          this.log('ERROR', 'Init', `Provider '${providerName}' not available`);\n          throw new Error(\n            `Provider '${providerName}' is not available. ` +\n            `Either import it from '@vunexa/lixa-providers' and include it in the configuration, ` +\n            `or provide a custom implementation using the 'provider' field: ` +\n            `{ provider: new CustomProvider(), clientId: '...', ... }`\n          );\n        }\n        this.log('INFO', 'Init', `Using registered provider: ${providerName}`);\n      }\n    }\n    \n    this.log('INFO', 'Init', 'Lixa instance initialized successfully');\n  }\n  \n  /**\n   * Validates that a provider configuration has all required credentials.\n   * \n   * @param name - The provider name\n   * @param config - The provider configuration\n   * @throws Error when required fields are missing or invalid\n   */\n  private validateProviderConfig(name: string, config: ProviderConfig): void {\n    const requiredFields: (keyof ProviderConfig)[] = ['clientId', 'clientSecret', 'redirectUri', 'scopes'];\n    const missingFields = requiredFields.filter(field => {\n      const value = config[field];\n      return value === undefined || value === null || (typeof value === 'string' && value.trim() === '');\n    });\n    \n    if (missingFields.length > 0) {\n      throw new Error(\n        `Provider '${name}' configuration is missing required fields: ${missingFields.join(', ')}`\n      );\n    }\n    \n    // Validate scopes is an array\n    if (!Array.isArray(config.scopes)) {\n      throw new Error(\n        `Provider '${name}' configuration error: 'scopes' must be an array of strings`\n      );\n    }\n    \n    if (config.scopes.length === 0) {\n      throw new Error(\n        `Provider '${name}' configuration error: 'scopes' array cannot be empty`\n      );\n    }\n  }\n  \n  /**\n   * Validates that a provider implementation has all required properties.\n   * \n   * @param name - The provider name\n   * @param provider - The provider implementation\n   * @throws Error when required properties are missing\n   */\n  private validateProviderImplementation(name: string, provider: IProvider): void {\n    const requiredProps: (keyof IProvider)[] = ['authorizationEndpoint', 'tokenEndpoint', 'userInfoEndpoint'];\n    const missingProps = requiredProps.filter(prop => {\n      const value = provider[prop];\n      return !value || typeof value !== 'string' || value.trim() === '';\n    });\n    \n    if (missingProps.length > 0) {\n      throw new Error(\n        `Provider '${name}' implementation is missing required properties: ${missingProps.join(', ')}. ` +\n        `All IProvider implementations must define: authorizationEndpoint, tokenEndpoint, and userInfoEndpoint.`\n      );\n    }\n  }\n\n  /**\n   * Structured debug logging with standardized format.\n   * \n   * @param level - Log level (INFO, WARN, ERROR)\n   * @param context - Context of the log (Init, Auth, Token, Session, State)\n   * @param message - Log message\n   * @param data - Optional data to log\n   * \n   * @remarks\n   * Format: [Lixa] [timestamp] [level] [context] message\n   * Only logs when debug mode is enabled.\n   */\n  private log(level: 'INFO' | 'WARN' | 'ERROR', context: 'Init' | 'Auth' | 'Token' | 'Session' | 'State', message: string, data?: Record<string, string | number | boolean | string[]>): void {\n    if (!this.debug) return;\n    \n    const timestamp = new Date().toISOString();\n    const prefix = `[Lixa] [${timestamp}] [${level}] [${context}]`;\n    \n    if (data !== undefined) {\n      console.log(`${prefix} ${message}`, data);\n    } else {\n      console.log(`${prefix} ${message}`);\n    }\n  }\n\n  /**\n   * Checks if a provider is configured for this instance.\n   * This is a type guard that narrows the provider type for use with getAuthUrl.\n   *\n   * @param provider - The provider name to check (case-insensitive)\n   * @returns True if the provider is configured, false otherwise\n   *\n   * @example\n   * ```typescript\n   * if (lixa.isProviderConfigured(provider)) {\n   *   // TypeScript now knows provider is a valid ConfiguredProviderKey\n   *   const authUrl = lixa.getAuthUrl(provider, state);\n   * }\n   * ```\n   */\n  public isProviderConfigured<T extends string>(provider: T): provider is T & ConfiguredProviderKey<TConfig> {\n    const providerType = provider.toLowerCase();\n    return this.config.providers.hasOwnProperty(providerType);\n  }\n  \n  /**\n   * Gets a provider implementation by name.\n   * Resolution priority: inline custom provider \\> default providers \\> legacy registry\n   * \n   * @param name - The provider name (case-insensitive)\n   * @param config - The provider configuration\n   * @returns The provider implementation\n   * @throws Error when provider is not found\n   */\n  private getProvider(name: string, config: ProviderConfig): IProvider {\n    // First check if provider is inline in config\n    if (config.provider) {\n      return config.provider;\n    }\n    \n    // Then check default providers\n    const lowerName = name.toLowerCase();\n    const defaultProvider = Lixa.DEFAULT_PROVIDERS.get(lowerName);\n    if (defaultProvider) {\n      return defaultProvider;\n    }\n    \n    // Finally check legacy registry for backward compatibility\n    const legacyProvider = Lixa.CONFIGURED_PROVIDERS.get(lowerName);\n    if (legacyProvider) {\n      return legacyProvider;\n    }\n    \n    throw new Error(\n      `Provider '${name}' not found. ` +\n      `Ensure the provider is included in the configuration with a 'provider' field, ` +\n      `or registered using Lixa.registerProvider().`\n    );\n  }\n\n  /**\n   * Registers custom OAuth providers for use with Lixa.\n   * \n   * @deprecated This method is maintained for backward compatibility.\n   * The recommended approach is to pass providers inline in the configuration:\n   * ```typescript\n   * const lixa = new Lixa({\n   *   providers: {\n   *     custom: {\n   *       provider: new CustomProvider(),\n   *       clientId: '...',\n   *       // ...\n   *     }\n   *   }\n   * });\n   * ```\n   *\n   * @param providerMap - A map of provider names to IProvider implementations\n   *\n   * @example\n   * Legacy usage (still supported):\n   * ```typescript\n   * class CustomProvider implements IProvider {\n   *   authorizationEndpoint = 'https://custom.com/oauth/authorize';\n   *   tokenEndpoint = 'https://custom.com/oauth/token';\n   *   userInfoEndpoint = 'https://custom.com/api/user';\n   * }\n   *\n   * Lixa.registerProvider({ custom: new CustomProvider() });\n   * ```\n   */\n  public static registerProvider<T extends Record<string, IProvider>>(providerMap: T): void {\n    Object.entries(providerMap).forEach(([key, providerImpl]) => {\n      Lixa.CONFIGURED_PROVIDERS.set(key.toLowerCase(), providerImpl);\n    });\n  }\n\n  /**\n   * Gets the list of registered provider names.\n   * \n   * @returns Array of registered provider names\n   */\n  public static getRegisteredProviders(): string[] {\n    return Array.from(Lixa.CONFIGURED_PROVIDERS.keys());\n  }\n\n  /**\n   * Creates a type-safe configuration.\n   * \n   * @deprecated This method is maintained for backward compatibility.\n   * You can now pass configuration directly to the Lixa constructor without this helper.\n   * \n   * @param config - Configuration object with provider settings\n   * @returns The same configuration object with type safety\n   * \n   * @example\n   * New approach (recommended):\n   * ```typescript\n   * const lixa = new Lixa({\n   *   providers: {\n   *     google: {\n   *       provider: new GoogleProvider(),\n   *       clientId: '...',\n   *       // ...\n   *     }\n   *   }\n   * });\n   * ```\n   */\n  public static createConfig<T extends Record<string, ProviderConfig>>(\n    config: LixaConfig<T> & { providers: T }\n  ): LixaConfig<T> {\n    return config;\n  }\n\n  /**\n   * Generates a cryptographically secure random state parameter for OAuth flows.\n   *\n   * @returns A 32-character hexadecimal string\n   *\n   * @remarks\n   * The state parameter is used to prevent CSRF attacks in OAuth flows.\n   */\n  public static generateRandomState(): string {\n    return randomBytes(16).toString(\"hex\");\n  }\n\n  /**\n   * Generates a cryptographically secure code verifier for PKCE flows.\n   *\n   * @returns A 64-character hexadecimal string (32 random bytes encoded as hex)\n   *\n   * @remarks\n   * This method implements the code verifier generation as specified in RFC 7636 (PKCE).\n   * \n   * **PKCE (Proof Key for Code Exchange)** is a security extension to OAuth 2.0 that\n   * prevents authorization code interception attacks. It's especially important for\n   * public clients (mobile apps, SPAs) but is recommended for all OAuth flows.\n   * \n   * **Generation methodology:**\n   * 1. Generate 32 cryptographically random bytes using Node.js crypto.randomBytes()\n   * 2. Encode the bytes as a hexadecimal string (64 characters)\n   * 3. The verifier is stored securely and used later in the token exchange\n   * \n   * **RFC 7636 Requirements:**\n   * - Minimum length: 43 characters\n   * - Maximum length: 128 characters\n   * - Character set: [A-Z] / [a-z] / [0-9] / \"-\" / \".\" / \"_\" / \"~\"\n   * - This implementation produces 64 hex characters, meeting the requirements\n   * \n   * The code verifier is:\n   * - Generated when creating the authorization URL\n   * - Stored in state cache with the state parameter\n   * - Retrieved during callback handling\n   * - Sent to the token endpoint to prove the client's identity\n   * \n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7636 | RFC 7636 - PKCE}\n   * @see buildCodeChallenge for the corresponding challenge generation\n   * \n   * @internal\n   */\n  private static generateCodeVerifier(): string {\n    return randomBytes(32).toString(\"hex\");\n  }\n\n  /**\n   * Generates a code challenge from a code verifier for PKCE flows.\n   *\n   * @param codeVerifier - The code verifier string (64 hex characters)\n   * @returns A base64url-encoded SHA-256 hash of the code verifier\n   *\n   * @remarks\n   * This method implements the code challenge generation as specified in RFC 7636 (PKCE)\n   * using the S256 (SHA-256) transformation method.\n   * \n   * **Challenge generation methodology:**\n   * 1. Hash the code verifier using SHA-256\n   * 2. Encode the hash as base64\n   * 3. Convert to base64url format (RFC 4648):\n   *    - Replace '+' with '-'\n   *    - Replace '/' with '_'\n   *    - Remove trailing '=' padding\n   * \n   * **PKCE Flow:**\n   * 1. Client generates code_verifier (random string)\n   * 2. Client creates code_challenge = BASE64URL(SHA256(code_verifier))\n   * 3. Client sends code_challenge to authorization endpoint\n   * 4. Authorization server stores the code_challenge\n   * 5. Client sends code_verifier to token endpoint\n   * 6. Authorization server verifies: SHA256(code_verifier) == code_challenge\n   * \n   * **Security Benefits:**\n   * - Prevents authorization code interception attacks\n   * - Even if an attacker intercepts the authorization code, they cannot\n   *   exchange it for tokens without the original code_verifier\n   * - The challenge is sent in the authorization request (public)\n   * - The verifier is sent in the token request (should be kept secret)\n   * \n   * **RFC 7636 Transformation Methods:**\n   * - plain: code_challenge = code_verifier (not recommended)\n   * - S256: code_challenge = BASE64URL(SHA256(code_verifier)) (recommended, used here)\n   * \n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7636 | RFC 7636 - PKCE}\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc4648#section-5 | RFC 4648 - Base64url Encoding}\n   * @see generateCodeVerifier for the verifier generation\n   * \n   * @internal\n   */\n  private static buildCodeChallenge(codeVerifier: string): string {\n    const hash = crypto\n      .createHash(\"sha256\")\n      .update(codeVerifier)\n      .digest(\"base64\");\n\n    // Convert to base64url (RFC 4648 Section 5)\n    return hash.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n  }\n\n  /**\n   * Generates the authorization URL for the specified provider.\n   *\n   * @param provider - The provider name (must be a configured provider key)\n   * @param state - The state parameter for CSRF protection\n   * @returns The complete authorization URL to redirect users to\n   *\n   * @throws Error when the provider is not configured\n   *\n   * @example\n   * ```typescript\n   * const state = Lixa.generateRandomState();\n   * const authUrl = lixa.getAuthUrl('google', state);\n   * res.redirect(authUrl);\n   * ```\n   */\n  public getAuthUrl(provider: ConfiguredProviderKey<TConfig> | string, state: string): string {\n    const providerType = String(provider).toLowerCase();\n    \n    this.log('INFO', 'Auth', `Generating authorization URL for provider: ${providerType}`);\n    \n    const providerConfig = this.findProviderByType(providerType);\n\n    if (!providerConfig) {\n      this.log('ERROR', 'Auth', `Provider '${String(provider)}' is not configured`);\n      throw new Error(`Provider '${String(provider)}' is not configured in this Lixa instance`);\n    }\n\n    const providerImpl = this.getProvider(providerType, providerConfig);\n\n    const codeVerifier = Lixa.generateCodeVerifier();\n    const codeChallenge = Lixa.buildCodeChallenge(codeVerifier);\n\n    this.log('INFO', 'State', `Saving state for provider: ${providerType}`, { state });\n\n    // Cache the state paramaeter with TTL of 5 minutes (300 seconds)\n    // We dont care about value. we are onl interested in key existence\n    this.stateDao.saveState(\n      state,\n      {\n        createdAt: Date.now(),\n        provider: providerType,\n        codeVerifier,\n      },\n      300 // 5 minutes in seconds\n    );\n\n    const params = new URLSearchParams({\n      client_id: providerConfig.clientId,\n      redirect_uri: providerConfig.redirectUri,\n      scope: providerConfig.scopes.join(\" \"),\n      state,\n      response_type: \"code\",\n      code_challenge: codeChallenge,\n      code_challenge_method: \"S256\",\n      ...providerConfig.extraConfig,\n    });\n\n    const authUrl = `${providerImpl.authorizationEndpoint}?${params.toString()}`;\n    this.log('INFO', 'Auth', `Authorization URL generated successfully`, { \n      provider: providerType,\n      endpoint: providerImpl.authorizationEndpoint \n    });\n\n    return authUrl;\n  }\n\n  /**\n   * Handles the OAuth callback and creates a user session.\n   *\n   * @param provider - The provider name (must be a configured provider key)\n   * @param code - The authorization code from the provider\n   * @param state - The state parameter for validation\n   * @returns A Promise that resolves to the session ID\n   *\n   * @throws Error when code or state is missing/invalid, or provider is not configured\n   *\n   * @example\n   * ```typescript\n   * const sessionId = await lixa.handleCallback({\n   *   provider: 'google',\n   *   code: req.query.code,\n   *   state: req.query.state\n   * });\n   * ```\n   */\n  public async handleCallback({\n    provider,\n    code,\n    state,\n  }: {\n    provider: ConfiguredProviderKey<TConfig> | string;\n    code: string;\n    state?: string;\n  }): Promise<string> {\n    const providerType = String(provider).toLowerCase();\n    this.log('INFO', 'Auth', `Handling OAuth callback for provider: ${providerType}`);\n\n    if (!code || code.trim() === \"\") {\n      this.log('ERROR', 'Auth', 'Invalid or missing authorization code in callback');\n      throw new Error(\"Invalid or missing code in callback\");\n    }\n\n    if (!state || state.trim() === \"\") {\n      this.log('ERROR', 'Auth', 'Invalid or missing state in callback');\n      throw new Error(\"Invalid or missing state in callback\");\n    }\n\n    this.log('INFO', 'State', 'Validating state parameter', { state });\n\n    //Validate state here\n    const cachedState = await this.stateDao.getState(state);\n    if (!cachedState) {\n      this.log('ERROR', 'State', 'State validation failed: state not found or expired', { state });\n      throw new Error(\"Invalid or expired state\");\n    }\n    \n    this.log('INFO', 'State', 'State validated successfully, removing from cache');\n    // State is valid, remove it from cache to prevent reuse\n    await this.stateDao.deleteState(state);\n\n    //Get code verifier from cached state\n    const codeVerifier = cachedState.codeVerifier;\n\n    const providerConfig = this.findProviderByType(providerType);\n\n    if (!providerConfig) {\n      this.log('ERROR', 'Auth', `Provider '${String(provider)}' is not configured`);\n      throw new Error(`Provider '${String(provider)}' is not configured in this Lixa instance`);\n    }\n\n    const providerImpl = this.getProvider(providerType, providerConfig);\n\n    this.log('INFO', 'Token', `Exchanging authorization code for tokens`, { provider: providerType });\n\n    // Exchange code for tokens and fetch user info here.\n    const tokens = await this.exchangeCodeForToken(\n      code,\n      providerConfig,\n      providerImpl,\n      codeVerifier\n    );\n\n    this.log('INFO', 'Token', 'Token exchange successful');\n    this.log('INFO', 'Session', 'Creating user session');\n    \n    // Create provider metadata for session strategy\n    const providerMetadata: ProviderMetadata = {\n      name: providerType,\n      endpoints: {\n        authorization: providerImpl.authorizationEndpoint,\n        token: providerImpl.tokenEndpoint,\n        userInfo: providerImpl.userInfoEndpoint\n      }\n    };\n    \n    const session = await this.sessionStrategy.createSession(tokens, providerMetadata);\n\n    // Generate unique session ID\n    const sessionId = randomBytes(32).toString(\"hex\");\n\n    this.log('INFO', 'Session', 'Storing session', { sessionId });\n    // Store session with 24 hour TTL (86400 seconds)\n    await this.sesionDao.saveSession(sessionId, session, 86400);\n\n    this.log('INFO', 'Session', 'Session created successfully', { sessionId });\n\n    return sessionId;\n  }\n\n  public async fetchSessionInfo(sessionId: string): Promise<Session | null> {\n    return await this.sesionDao.getSession<Session>(sessionId);\n  }\n\n  private async exchangeCodeForToken(\n    code: string,\n    providerConfig: ProviderConfig,\n    providerImpl: IProvider,\n    codeVerifier: string\n  ): Promise<OAuthTokenResponse> {\n    // Build the request body\n    const body: Record<string, string> = {\n      client_id: providerConfig.clientId,\n      client_secret: providerConfig.clientSecret,\n      code,\n      redirect_uri: providerConfig.redirectUri,\n      grant_type: \"authorization_code\",\n    };\n\n    if (codeVerifier) {\n      body.code_verifier = codeVerifier;\n    }\n    const params = new URLSearchParams(body);\n\n    this.log('INFO', 'Token', 'Sending token exchange request', { \n      endpoint: providerImpl.tokenEndpoint \n    });\n    \n    const response = await fetch(providerImpl.tokenEndpoint, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/x-www-form-urlencoded\",\n        Accept: \"application/json\",\n      },\n      body: params.toString(),\n    });\n\n    if (!response.ok) {\n      const errorBody = await response.text();\n      this.log('ERROR', 'Token', 'Token exchange failed', { \n        status: response.status, \n        statusText: response.statusText,\n        error: errorBody \n      });\n      throw new Error(\n        `Token exchange failed: ${response.status} ${response.statusText} - ${errorBody}`\n      );\n    }\n\n    this.log('INFO', 'Token', 'Token exchange response received successfully');\n    return response.json();\n  }\n\n  private findProviderByType(providerType: string): ProviderConfig | undefined {\n    // Use Object.entries to safely iterate and find the provider\n    for (const [key, value] of Object.entries(this.config.providers)) {\n      if (key.toLowerCase() === providerType.toLowerCase()) {\n        return value;\n      }\n    }\n    return undefined;\n  }\n}\n\nexport { Lixa };\n","import NodeCache from 'node-cache';\nimport { StateDao, StateData } from \"./types\";\n\nclass LocalStateCache implements StateDao {\n  private cache: NodeCache;\n\n  constructor(defaultTtlSeconds: number = 600) {\n    this.cache = new NodeCache({ stdTTL: defaultTtlSeconds });\n  }\n\n  async saveState(state: string, data: StateData, expiresInSeconds: number): Promise<void> {\n    this.cache.set(state, data, expiresInSeconds);\n  }\n\n  async getState(state: string): Promise<StateData | null> {\n    return this.cache.get<StateData>(state) || null;\n  }\n\n  async deleteState(state: string): Promise<void> {\n    this.cache.del(state);\n  }\n}\n\nexport { LocalStateCache };\n","import NodeCache from 'node-cache';\nimport { SessionDao } from \"./types\";\nimport type { Session } from \"../models/session\";\n\nclass LocalSessionCache implements SessionDao {\n  private cache: NodeCache;\n\n  constructor(defaultTtlSeconds: number = 600) {\n    this.cache = new NodeCache({ stdTTL: defaultTtlSeconds });\n  }\n\n  async saveSession<T extends Session>(state: string, data: T, expiresInSeconds: number): Promise<void> {\n    this.cache.set(state, data, expiresInSeconds);\n  }\n\n  async getSession<T extends Session>(state: string): Promise<T | null> {\n    return this.cache.get<T>(state) || null;\n  }\n\n  async deleteSession(state: string): Promise<void> {\n    this.cache.del(state);\n  }\n}\n\nexport { LocalSessionCache };\n","/**\n * OAuth 2.0 token response structure.\n * Based on RFC 6749 Section 5.1 and OpenID Connect Core 1.0 Section 3.1.3.3\n * \n * @remarks\n * This interface represents the standard OAuth 2.0 token response with\n * optional OpenID Connect extensions. All OAuth providers should return\n * at minimum the required fields (access_token, token_type).\n * \n * @public\n */\nexport interface OAuthTokenResponse {\n  /** \n   * OAuth 2.0 access token (required).\n   * Used to access protected resources on behalf of the user.\n   */\n  access_token: string;\n  \n  /** \n   * Token type (required).\n   * Typically \"Bearer\" for OAuth 2.0.\n   */\n  token_type: string;\n  \n  /** \n   * Token expiration time in seconds (optional).\n   * Time until the access token expires.\n   */\n  expires_in?: number;\n  \n  /** \n   * OAuth 2.0 refresh token (optional).\n   * Used to obtain new access tokens without re-authentication.\n   */\n  refresh_token?: string;\n  \n  /** \n   * Granted OAuth scopes (optional).\n   * Space-separated list of scopes that were granted.\n   */\n  scope?: string;\n  \n  /** \n   * OpenID Connect ID token (optional).\n   * JWT containing user identity claims (only present for OIDC providers).\n   */\n  id_token?: string;\n  \n  /**\n   * Additional provider-specific fields.\n   * Some providers may include extra fields like user_id, account_id, etc.\n   */\n  [key: string]: string | number | boolean | undefined;\n}\n\n/**\n * Represents a user session after successful OAuth authentication.\n * \n * @remarks\n * The Session object is returned by SessionStrategy.createSession() and contains\n * the session identifier and any additional data needed for your application.\n * \n * The structure is intentionally flexible to support various session management\n * approaches (JWT tokens, session IDs, etc.).\n *\n * @public\n */\nexport interface Session<TRaw = OAuthTokenResponse> {\n  /** \n   * The session token or identifier.\n   * This could be an access token, a session ID, a JWT, or any other identifier\n   * that your application uses to track authenticated users.\n   */\n  token: string;\n  \n  /** \n   * Raw session data.\n   * Contains the complete OAuth token response and any additional data\n   * your SessionStrategy adds (user info, database IDs, etc.).\n   * \n   * Typical OAuth token data includes:\n   * - access_token: OAuth access token\n   * - refresh_token: OAuth refresh token (if requested)\n   * - expires_in: Token expiration time in seconds\n   * - token_type: Token type (usually \"Bearer\")\n   * - id_token: OpenID Connect ID token (if using OIDC)\n   * - scope: Granted scopes\n   */\n  raw: TRaw;\n}\n\n/**\n * Provider metadata passed to session strategy.\n * Contains provider name and endpoints for user info extraction.\n * \n * @public\n */\nexport interface ProviderMetadata {\n  /** The provider name (e.g., 'google', 'github') */\n  name: string;\n  \n  /** Provider endpoints */\n  endpoints: {\n    /** Authorization endpoint URL */\n    authorization: string;\n    /** Token endpoint URL */\n    token: string;\n    /** UserInfo endpoint URL */\n    userInfo: string;\n  };\n}\n\n/**\n * Strategy interface for custom session creation.\n * \n * @remarks\n * Implement this interface to customize how OAuth tokens are converted into\n * application sessions. This is where you typically:\n * - Decode ID tokens (for OpenID Connect)\n * - Look up or create users in your database\n * - Generate session identifiers\n * - Store session data\n * - Add custom claims or metadata\n * \n * The default implementation (DefaultSessionStrategy) simply extracts the\n * access token and returns it as the session token.\n * \n * @example\n * Custom session strategy with database integration:\n * ```typescript\n * interface CustomSessionData {\n *   userId: string;\n *   email: string;\n *   provider: string;\n *   accessToken: string;\n *   refreshToken?: string;\n *   expiresAt: number;\n * }\n * \n * class DatabaseSessionStrategy implements SessionStrategy {\n *   constructor(private db: Database) {}\n *   \n *   async createSession(oauthContext: OAuthContext): Promise<Session<CustomSessionData>> {\n *     // User info is already extracted by Lixa!\n *     const { userInfo, provider, tokenData } = oauthContext;\n *     \n *     // Create or update user in database\n *     const user = await this.db.users.upsert({\n *       email: userInfo.email,\n *       name: userInfo.name,\n *       picture: userInfo.picture\n *     });\n *     \n *     // Generate session ID\n *     const sessionId = generateSecureId();\n *     \n *     // Store session with tokens\n *     await this.db.sessions.create({\n *       id: sessionId,\n *       userId: user.id,\n *       accessToken: tokenData.access_token,\n *       refreshToken: tokenData.refresh_token,\n *       expiresAt: new Date(Date.now() + (tokenData.expires_in || 3600) * 1000)\n *     });\n *     \n *     return {\n *       token: sessionId,\n *       raw: {\n *         userId: user.id,\n *         email: user.email,\n *         provider,\n *         accessToken: tokenData.access_token,\n *         refreshToken: tokenData.refresh_token,\n *         expiresAt: Date.now() + (tokenData.expires_in || 3600) * 1000\n *       }\n *     };\n *   }\n * }\n * ```\n *\n * @public\n */\nexport interface SessionStrategy {\n  /**\n   * Creates a session from OAuth token data.\n   * \n   * @param tokenData - The token data received from the OAuth provider's token endpoint\n   * @param providerMetadata - Provider metadata including name and endpoints\n   * @returns A Promise that resolves to a Session object\n   * \n   * @remarks\n   * This method is called after successfully exchanging the authorization code\n   * for tokens. You receive:\n   * \n   * Token Data:\n   * - access_token: OAuth access token\n   * - refresh_token: OAuth refresh token (optional)\n   * - expires_in: Token expiration time in seconds\n   * - token_type: Token type (usually \"Bearer\")\n   * - id_token: OpenID Connect ID token (for OIDC providers)\n   * - scope: Granted scopes\n   * \n   * Provider Metadata:\n   * - name: The provider name (e.g., 'google', 'github')\n   * - endpoints: Provider endpoints (authorization, token, userInfo)\n   * \n   * The providerMetadata.endpoints.userInfo can be used with extractUserInfo():\n   * ```typescript\n   * import { extractUserInfo } from '@vunexa/lixa';\n   * \n   * const { userInfo } = await extractUserInfo(\n   *   tokenData,\n   *   providerMetadata.endpoints.userInfo,\n   *   providerMetadata.name\n   * );\n   * ```\n   * \n   * Your session strategy should:\n   * 1. Extract user info (using extractUserInfo or decode ID token)\n   * 2. Create or lookup users in your database\n   * 3. Generate session identifiers\n   * 4. Store session data as needed\n   * 5. Return a Session object with token and raw data\n   * \n   * @throws \\{Error\\} If session creation fails (e.g., database error, invalid token)\n   * \n   * @example\n   * Simple implementation:\n   * ```typescript\n   * async createSession(tokenData: OAuthTokenResponse): Promise<Session> {\n   *   return {\n   *     token: tokenData.access_token,\n   *     raw: tokenData\n   *   };\n   * }\n   * ```\n   * \n   * @example\n   * Database integration with user info extraction:\n   * ```typescript\n   * async createSession(\n   *   tokenData: OAuthTokenResponse,\n   *   providerMetadata: ProviderMetadata\n   * ): Promise<Session> {\n   *   // Extract user info from token or userinfo endpoint\n   *   const { userInfo } = await extractUserInfo(\n   *     tokenData,\n   *     providerMetadata.endpoints.userInfo,\n   *     providerMetadata.name\n   *   );\n   *   \n   *   // Create or update user in database\n   *   const user = await db.users.upsert({\n   *     email: userInfo.email,\n   *     name: userInfo.name\n   *   });\n   *   \n   *   return {\n   *     token: generateSessionId(),\n   *     raw: { userId: user.id, provider: providerMetadata.name, ...tokenData }\n   *   };\n   * }\n   * ```\n   */\n  createSession(tokenData: OAuthTokenResponse, providerMetadata: ProviderMetadata): Promise<Session>;\n}\n\n/**\n * Default session strategy that works with any OAuth provider.\n * Extracts common token information and creates a standardized session.\n *\n * @public\n */\nexport class DefaultSessionStrategy implements SessionStrategy {\n  /**\n   * Creates a session from OAuth token data.\n   * Handles common OAuth token formats and extracts the access token.\n   *\n   * @param tokenData - The token data received from the OAuth provider\n   * @param providerMetadata - Provider metadata (not used in default implementation)\n   * @returns A Promise that resolves to a Session object\n   */\n  async createSession(tokenData: OAuthTokenResponse, providerMetadata: ProviderMetadata): Promise<Session> {\n    if (!tokenData.access_token || typeof tokenData.access_token !== 'string') {\n      throw new Error('No valid access token found in OAuth response');\n    }\n\n    return {\n      token: tokenData.access_token,\n      raw: tokenData,\n    };\n  }\n}","import type { OAuthTokenResponse } from \"../models/session\";\n\n/**\n * User information extracted from OAuth provider\n * \n * @public\n */\nexport interface UserInfo {\n  email: string;\n  id?: string | undefined;\n  sub?: string | undefined;\n  given_name?: string | undefined;\n  family_name?: string | undefined;\n  name?: string | undefined;\n  picture?: string | undefined;\n  email_verified?: boolean | undefined;\n  iss?: string | undefined;\n}\n\n/**\n * Decode JWT ID token to extract user information\n * \n * @public\n */\nexport function decodeIdToken(idToken: string): UserInfo {\n  const parts = idToken.split('.');\n  if (parts.length !== 3) {\n    throw new Error('Invalid ID token format: expected 3 parts separated by dots');\n  }\n  \n  const base64Payload = parts[1];\n  if (!base64Payload) {\n    throw new Error('Invalid ID token: missing payload section');\n  }\n  const payload = Buffer.from(base64Payload, 'base64').toString();\n  \n  try {\n    return JSON.parse(payload);\n  } catch (error) {\n    throw new Error('Invalid ID token: failed to parse payload JSON');\n  }\n}\n\n/**\n * Determine OAuth provider from ID token issuer\n * \n * @public\n */\nexport function determineProviderFromIssuer(userInfo: UserInfo): string | null {\n  if (!userInfo.iss) {\n    return null;\n  }\n  \n  const issuer = userInfo.iss.toLowerCase();\n  \n  if (issuer.includes('accounts.google.com')) {\n    return 'google';\n  }\n  \n  if (issuer.includes('github')) {\n    return 'github';\n  }\n  \n  // Unknown issuer\n  return null;\n}\n\n/**\n * Fetch user info from OAuth provider's userinfo endpoint\n * \n * @param accessToken - OAuth access token\n * @param userInfoEndpoint - The provider's userinfo endpoint URL\n * @param providerName - Provider name for error messages (optional)\n * @returns User information from the provider\n * \n * @throws Error if the request fails or response is invalid\n * \n * @public\n */\nexport async function fetchUserInfo(\n  accessToken: string, \n  userInfoEndpoint: string,\n  providerName?: string\n): Promise<UserInfo> {\n  const response = await fetch(userInfoEndpoint, {\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      Accept: 'application/json',\n    },\n  });\n  \n  if (!response.ok) {\n    const providerLabel = providerName ? ` from ${providerName}` : '';\n    throw new Error(`Failed to fetch user info${providerLabel}: ${response.status} ${response.statusText}`);\n  }\n  \n  const data = await response.json();\n  if (!data || typeof data !== 'object' || !('email' in data) || typeof data.email !== 'string') {\n    const providerLabel = providerName ? ` from ${providerName}` : '';\n    throw new Error(`Invalid user info response${providerLabel}: missing or invalid email`);\n  }\n  \n  return {\n    email: data.email,\n    id: 'id' in data ? String(data.id) : undefined,\n    sub: 'sub' in data ? String(data.sub) : undefined,\n    given_name: 'given_name' in data ? String(data.given_name) : undefined,\n    family_name: 'family_name' in data ? String(data.family_name) : undefined,\n    name: 'name' in data ? String(data.name) : undefined,\n    picture: 'picture' in data ? String(data.picture) : undefined,\n    email_verified: 'email_verified' in data ? Boolean(data.email_verified) : undefined,\n    iss: 'iss' in data ? String(data.iss) : undefined,\n  };\n}\n\n/**\n * Extract user info from OAuth token data\n * \n * @param tokenData - OAuth token response from provider\n * @param userInfoEndpoint - Optional userinfo endpoint URL (required if no ID token)\n * @param providerName - Optional provider name for error messages\n * @returns User info and detected provider name\n * \n * @remarks\n * This function attempts to extract user information in the following order:\n * 1. Decode ID token if present (preferred method)\n * 2. Fetch from userinfo endpoint using access token (requires userInfoEndpoint parameter)\n * \n * Provider detection:\n * - Primary: Extract from ID token issuer field\n * - Fallback: Use provider field in token data (if present)\n * - Fallback: Use providerName parameter\n * - Throws error if provider cannot be determined\n * \n * @throws Error if no ID token or access token is available\n * @throws Error if provider cannot be determined\n * @throws Error if userInfoEndpoint is required but not provided\n * \n * @example\n * With ID token (provider auto-detected):\n * ```typescript\n * const { userInfo, provider } = await extractUserInfo(tokenData);\n * console.log(`User ${userInfo.email} authenticated via ${provider}`);\n * ```\n * \n * @example\n * Without ID token (requires userInfoEndpoint):\n * ```typescript\n * const { userInfo, provider } = await extractUserInfo(\n *   tokenData,\n *   'https://api.example.com/user',\n *   'custom'\n * );\n * ```\n * \n * @public\n */\nexport async function extractUserInfo(\n  tokenData: OAuthTokenResponse,\n  userInfoEndpoint?: string,\n  providerName?: string\n): Promise<{ userInfo: UserInfo; provider: string }> {\n  let userInfo: UserInfo;\n  let provider: string | null = null;\n  \n  if (tokenData.id_token) {\n    // Decode ID token to get user info\n    userInfo = decodeIdToken(tokenData.id_token);\n    \n    // Try to determine provider from issuer\n    provider = determineProviderFromIssuer(userInfo);\n    \n    // Fallback to provided provider name\n    if (!provider && providerName) {\n      provider = providerName;\n    }\n  } else if (tokenData.access_token) {\n    // Without ID token, we need to know which provider to fetch from\n    // Check if provider info is in the token data (custom field)\n    if ('provider' in tokenData && typeof tokenData.provider === 'string') {\n      provider = tokenData.provider;\n    } else if (providerName) {\n      provider = providerName;\n    }\n    \n    if (!provider) {\n      throw new Error(\n        'Cannot determine OAuth provider: No ID token with issuer information, ' +\n        'no provider field in token data, and no providerName provided. Unable to fetch user info.'\n      );\n    }\n    \n    if (!userInfoEndpoint) {\n      throw new Error(\n        `Cannot fetch user info for provider '${provider}': No ID token available and no userInfoEndpoint provided. ` +\n        'Either ensure the provider returns an ID token or provide the userInfoEndpoint parameter.'\n      );\n    }\n    \n    // Fetch user info from provider's API\n    userInfo = await fetchUserInfo(tokenData.access_token, userInfoEndpoint, provider);\n  } else {\n    throw new Error('No ID token or access token available to fetch user info');\n  }\n  \n  // Final provider validation\n  if (!provider) {\n    throw new Error(\n      'Cannot determine OAuth provider: ID token issuer not recognized and no provider name provided.'\n    );\n  }\n  \n  return { userInfo, provider };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAA4B;;;ACA5B,wBAAsB;AAGtB,IAAM,kBAAN,MAA0C;AAAA,EAChC;AAAA,EAER,YAAY,oBAA4B,KAAK;AAC3C,SAAK,QAAQ,IAAI,kBAAAA,QAAU,EAAE,QAAQ,kBAAkB,CAAC;AAAA,EAC1D;AAAA,EAEA,MAAM,UAAU,OAAe,MAAiB,kBAAyC;AACvF,SAAK,MAAM,IAAI,OAAO,MAAM,gBAAgB;AAAA,EAC9C;AAAA,EAEA,MAAM,SAAS,OAA0C;AACvD,WAAO,KAAK,MAAM,IAAe,KAAK,KAAK;AAAA,EAC7C;AAAA,EAEA,MAAM,YAAY,OAA8B;AAC9C,SAAK,MAAM,IAAI,KAAK;AAAA,EACtB;AACF;;;ADhBA,IAAAC,iBAAmB;;;AELnB,IAAAC,qBAAsB;AAItB,IAAM,oBAAN,MAA8C;AAAA,EACpC;AAAA,EAER,YAAY,oBAA4B,KAAK;AAC3C,SAAK,QAAQ,IAAI,mBAAAC,QAAU,EAAE,QAAQ,kBAAkB,CAAC;AAAA,EAC1D;AAAA,EAEA,MAAM,YAA+B,OAAe,MAAS,kBAAyC;AACpG,SAAK,MAAM,IAAI,OAAO,MAAM,gBAAgB;AAAA,EAC9C;AAAA,EAEA,MAAM,WAA8B,OAAkC;AACpE,WAAO,KAAK,MAAM,IAAO,KAAK,KAAK;AAAA,EACrC;AAAA,EAEA,MAAM,cAAc,OAA8B;AAChD,SAAK,MAAM,IAAI,KAAK;AAAA,EACtB;AACF;;;AC2PO,IAAM,yBAAN,MAAwD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS7D,MAAM,cAAc,WAA+B,kBAAsD;AACvG,QAAI,CAAC,UAAU,gBAAgB,OAAO,UAAU,iBAAiB,UAAU;AACzE,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,WAAO;AAAA,MACL,OAAO,UAAU;AAAA,MACjB,KAAK;AAAA,IACP;AAAA,EACF;AACF;;;AHlOA,IAAM,OAAN,MAAM,MAA8E;AAAA,EAClF,OAAe,oBAA4C,oBAAI,IAAI;AAAA,EACnE,OAAe,uBAA+C,oBAAI,IAAI;AAAA;AAAA,EACtE,OAAe,oBAAoB,IAAI,gBAAgB;AAAA,EACvD,OAAe,sBAAsB,IAAI,kBAAkB;AAAA,EAC3D,OAAe,2BAA2B,IAAI,uBAAuB;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeR,YAAY,QAAiB;AAC3B,SAAK,SAAS;AACd,SAAK,WAAW,OAAO,YAAY,MAAK;AACxC,SAAK,YAAY,OAAO,cAAc,MAAK;AAC3C,SAAK,kBAAkB,OAAO,mBAAmB,MAAK;AACtD,SAAK,QAAQ,OAAO,SAAS;AAE7B,SAAK,IAAI,QAAQ,QAAQ,8BAA8B;AAAA,MACrD,WAAW,OAAO,KAAK,OAAO,SAAS;AAAA,MACvC,OAAO,KAAK;AAAA,IACd,CAAC;AAGD,eAAW,CAAC,cAAc,cAAc,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AAC7E,YAAM,OAAO,aAAa,YAAY;AACtC,YAAM,cAA8B;AAGpC,WAAK,uBAAuB,cAAc,WAAW;AAGrD,UAAI,YAAY,UAAU;AACxB,aAAK,+BAA+B,cAAc,YAAY,QAAQ;AACtE,aAAK,IAAI,QAAQ,QAAQ,+BAA+B,YAAY,EAAE;AAAA,MACxE,OAAO;AAEL,YAAI,CAAC,MAAK,kBAAkB,IAAI,IAAI,KAAK,CAAC,MAAK,qBAAqB,IAAI,IAAI,GAAG;AAC7E,eAAK,IAAI,SAAS,QAAQ,aAAa,YAAY,iBAAiB;AACpE,gBAAM,IAAI;AAAA,YACR,aAAa,YAAY;AAAA,UAI3B;AAAA,QACF;AACA,aAAK,IAAI,QAAQ,QAAQ,8BAA8B,YAAY,EAAE;AAAA,MACvE;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,QAAQ,wCAAwC;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,uBAAuB,MAAc,QAA8B;AACzE,UAAM,iBAA2C,CAAC,YAAY,gBAAgB,eAAe,QAAQ;AACrG,UAAM,gBAAgB,eAAe,OAAO,WAAS;AACnD,YAAM,QAAQ,OAAO,KAAK;AAC1B,aAAO,UAAU,UAAa,UAAU,QAAS,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,IACjG,CAAC;AAED,QAAI,cAAc,SAAS,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI,+CAA+C,cAAc,KAAK,IAAI,CAAC;AAAA,MAC1F;AAAA,IACF;AAGA,QAAI,CAAC,MAAM,QAAQ,OAAO,MAAM,GAAG;AACjC,YAAM,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAEA,QAAI,OAAO,OAAO,WAAW,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,+BAA+B,MAAc,UAA2B;AAC9E,UAAM,gBAAqC,CAAC,yBAAyB,iBAAiB,kBAAkB;AACxG,UAAM,eAAe,cAAc,OAAO,UAAQ;AAChD,YAAM,QAAQ,SAAS,IAAI;AAC3B,aAAO,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,IACjE,CAAC;AAED,QAAI,aAAa,SAAS,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI,oDAAoD,aAAa,KAAK,IAAI,CAAC;AAAA,MAE9F;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcQ,IAAI,OAAkC,SAA0D,SAAiB,MAAmE;AAC1L,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,UAAM,SAAS,WAAW,SAAS,MAAM,KAAK,MAAM,OAAO;AAE3D,QAAI,SAAS,QAAW;AACtB,cAAQ,IAAI,GAAG,MAAM,IAAI,OAAO,IAAI,IAAI;AAAA,IAC1C,OAAO;AACL,cAAQ,IAAI,GAAG,MAAM,IAAI,OAAO,EAAE;AAAA,IACpC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBO,qBAAuC,UAA6D;AACzG,UAAM,eAAe,SAAS,YAAY;AAC1C,WAAO,KAAK,OAAO,UAAU,eAAe,YAAY;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,YAAY,MAAc,QAAmC;AAEnE,QAAI,OAAO,UAAU;AACnB,aAAO,OAAO;AAAA,IAChB;AAGA,UAAM,YAAY,KAAK,YAAY;AACnC,UAAM,kBAAkB,MAAK,kBAAkB,IAAI,SAAS;AAC5D,QAAI,iBAAiB;AACnB,aAAO;AAAA,IACT;AAGA,UAAM,iBAAiB,MAAK,qBAAqB,IAAI,SAAS;AAC9D,QAAI,gBAAgB;AAClB,aAAO;AAAA,IACT;AAEA,UAAM,IAAI;AAAA,MACR,aAAa,IAAI;AAAA,IAGnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiCA,OAAc,iBAAsD,aAAsB;AACxF,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,YAAY,MAAM;AAC3D,YAAK,qBAAqB,IAAI,IAAI,YAAY,GAAG,YAAY;AAAA,IAC/D,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,yBAAmC;AAC/C,WAAO,MAAM,KAAK,MAAK,qBAAqB,KAAK,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,OAAc,aACZ,QACe;AACf,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,OAAc,sBAA8B;AAC1C,eAAO,2BAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoCA,OAAe,uBAA+B;AAC5C,eAAO,2BAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6CA,OAAe,mBAAmB,cAA8B;AAC9D,UAAM,OAAO,eAAAC,QACV,WAAW,QAAQ,EACnB,OAAO,YAAY,EACnB,OAAO,QAAQ;AAGlB,WAAO,KAAK,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBO,WAAW,UAAmD,OAAuB;AAC1F,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAElD,SAAK,IAAI,QAAQ,QAAQ,8CAA8C,YAAY,EAAE;AAErF,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAE3D,QAAI,CAAC,gBAAgB;AACnB,WAAK,IAAI,SAAS,QAAQ,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAC5E,YAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,CAAC,2CAA2C;AAAA,IAC1F;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAElE,UAAM,eAAe,MAAK,qBAAqB;AAC/C,UAAM,gBAAgB,MAAK,mBAAmB,YAAY;AAE1D,SAAK,IAAI,QAAQ,SAAS,8BAA8B,YAAY,IAAI,EAAE,MAAM,CAAC;AAIjF,SAAK,SAAS;AAAA,MACZ;AAAA,MACA;AAAA,QACE,WAAW,KAAK,IAAI;AAAA,QACpB,UAAU;AAAA,QACV;AAAA,MACF;AAAA,MACA;AAAA;AAAA,IACF;AAEA,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,eAAe;AAAA,MAC1B,cAAc,eAAe;AAAA,MAC7B,OAAO,eAAe,OAAO,KAAK,GAAG;AAAA,MACrC;AAAA,MACA,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,MACvB,GAAG,eAAe;AAAA,IACpB,CAAC;AAED,UAAM,UAAU,GAAG,aAAa,qBAAqB,IAAI,OAAO,SAAS,CAAC;AAC1E,SAAK,IAAI,QAAQ,QAAQ,4CAA4C;AAAA,MACnE,UAAU;AAAA,MACV,UAAU,aAAa;AAAA,IACzB,CAAC;AAED,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAa,eAAe;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIoB;AAClB,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAClD,SAAK,IAAI,QAAQ,QAAQ,yCAAyC,YAAY,EAAE;AAEhF,QAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,IAAI;AAC/B,WAAK,IAAI,SAAS,QAAQ,mDAAmD;AAC7E,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACvD;AAEA,QAAI,CAAC,SAAS,MAAM,KAAK,MAAM,IAAI;AACjC,WAAK,IAAI,SAAS,QAAQ,sCAAsC;AAChE,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,SAAK,IAAI,QAAQ,SAAS,8BAA8B,EAAE,MAAM,CAAC;AAGjE,UAAM,cAAc,MAAM,KAAK,SAAS,SAAS,KAAK;AACtD,QAAI,CAAC,aAAa;AAChB,WAAK,IAAI,SAAS,SAAS,uDAAuD,EAAE,MAAM,CAAC;AAC3F,YAAM,IAAI,MAAM,0BAA0B;AAAA,IAC5C;AAEA,SAAK,IAAI,QAAQ,SAAS,mDAAmD;AAE7E,UAAM,KAAK,SAAS,YAAY,KAAK;AAGrC,UAAM,eAAe,YAAY;AAEjC,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAE3D,QAAI,CAAC,gBAAgB;AACnB,WAAK,IAAI,SAAS,QAAQ,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAC5E,YAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,CAAC,2CAA2C;AAAA,IAC1F;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAElE,SAAK,IAAI,QAAQ,SAAS,4CAA4C,EAAE,UAAU,aAAa,CAAC;AAGhG,UAAM,SAAS,MAAM,KAAK;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,SAAS,2BAA2B;AACrD,SAAK,IAAI,QAAQ,WAAW,uBAAuB;AAGnD,UAAM,mBAAqC;AAAA,MACzC,MAAM;AAAA,MACN,WAAW;AAAA,QACT,eAAe,aAAa;AAAA,QAC5B,OAAO,aAAa;AAAA,QACpB,UAAU,aAAa;AAAA,MACzB;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,KAAK,gBAAgB,cAAc,QAAQ,gBAAgB;AAGjF,UAAM,gBAAY,2BAAY,EAAE,EAAE,SAAS,KAAK;AAEhD,SAAK,IAAI,QAAQ,WAAW,mBAAmB,EAAE,UAAU,CAAC;AAE5D,UAAM,KAAK,UAAU,YAAY,WAAW,SAAS,KAAK;AAE1D,SAAK,IAAI,QAAQ,WAAW,gCAAgC,EAAE,UAAU,CAAC;AAEzE,WAAO;AAAA,EACT;AAAA,EAEA,MAAa,iBAAiB,WAA4C;AACxE,WAAO,MAAM,KAAK,UAAU,WAAoB,SAAS;AAAA,EAC3D;AAAA,EAEA,MAAc,qBACZ,MACA,gBACA,cACA,cAC6B;AAE7B,UAAM,OAA+B;AAAA,MACnC,WAAW,eAAe;AAAA,MAC1B,eAAe,eAAe;AAAA,MAC9B;AAAA,MACA,cAAc,eAAe;AAAA,MAC7B,YAAY;AAAA,IACd;AAEA,QAAI,cAAc;AAChB,WAAK,gBAAgB;AAAA,IACvB;AACA,UAAM,SAAS,IAAI,gBAAgB,IAAI;AAEvC,SAAK,IAAI,QAAQ,SAAS,kCAAkC;AAAA,MAC1D,UAAU,aAAa;AAAA,IACzB,CAAC;AAED,UAAM,WAAW,MAAM,MAAM,aAAa,eAAe;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,MACA,MAAM,OAAO,SAAS;AAAA,IACxB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,WAAK,IAAI,SAAS,SAAS,yBAAyB;AAAA,QAClD,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,OAAO;AAAA,MACT,CAAC;AACD,YAAM,IAAI;AAAA,QACR,0BAA0B,SAAS,MAAM,IAAI,SAAS,UAAU,MAAM,SAAS;AAAA,MACjF;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,SAAS,+CAA+C;AACzE,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEQ,mBAAmB,cAAkD;AAE3E,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,OAAO,SAAS,GAAG;AAChE,UAAI,IAAI,YAAY,MAAM,aAAa,YAAY,GAAG;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;AI/oBO,SAAS,cAAc,SAA2B;AACvD,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AAEA,QAAM,gBAAgB,MAAM,CAAC;AAC7B,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACA,QAAM,UAAU,OAAO,KAAK,eAAe,QAAQ,EAAE,SAAS;AAE9D,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACF;AAOO,SAAS,4BAA4B,UAAmC;AAC7E,MAAI,CAAC,SAAS,KAAK;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,SAAS,IAAI,YAAY;AAExC,MAAI,OAAO,SAAS,qBAAqB,GAAG;AAC1C,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,SAAS,QAAQ,GAAG;AAC7B,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAcA,eAAsB,cACpB,aACA,kBACA,cACmB;AACnB,QAAM,WAAW,MAAM,MAAM,kBAAkB;AAAA,IAC7C,SAAS;AAAA,MACP,eAAe,UAAU,WAAW;AAAA,MACpC,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,gBAAgB,eAAe,SAAS,YAAY,KAAK;AAC/D,UAAM,IAAI,MAAM,4BAA4B,aAAa,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAAA,EACxG;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,SAAS,OAAO,KAAK,UAAU,UAAU;AAC7F,UAAM,gBAAgB,eAAe,SAAS,YAAY,KAAK;AAC/D,UAAM,IAAI,MAAM,6BAA6B,aAAa,4BAA4B;AAAA,EACxF;AAEA,SAAO;AAAA,IACL,OAAO,KAAK;AAAA,IACZ,IAAI,QAAQ,OAAO,OAAO,KAAK,EAAE,IAAI;AAAA,IACrC,KAAK,SAAS,OAAO,OAAO,KAAK,GAAG,IAAI;AAAA,IACxC,YAAY,gBAAgB,OAAO,OAAO,KAAK,UAAU,IAAI;AAAA,IAC7D,aAAa,iBAAiB,OAAO,OAAO,KAAK,WAAW,IAAI;AAAA,IAChE,MAAM,UAAU,OAAO,OAAO,KAAK,IAAI,IAAI;AAAA,IAC3C,SAAS,aAAa,OAAO,OAAO,KAAK,OAAO,IAAI;AAAA,IACpD,gBAAgB,oBAAoB,OAAO,QAAQ,KAAK,cAAc,IAAI;AAAA,IAC1E,KAAK,SAAS,OAAO,OAAO,KAAK,GAAG,IAAI;AAAA,EAC1C;AACF;AA4CA,eAAsB,gBACpB,WACA,kBACA,cACmD;AACnD,MAAI;AACJ,MAAI,WAA0B;AAE9B,MAAI,UAAU,UAAU;AAEtB,eAAW,cAAc,UAAU,QAAQ;AAG3C,eAAW,4BAA4B,QAAQ;AAG/C,QAAI,CAAC,YAAY,cAAc;AAC7B,iBAAW;AAAA,IACb;AAAA,EACF,WAAW,UAAU,cAAc;AAGjC,QAAI,cAAc,aAAa,OAAO,UAAU,aAAa,UAAU;AACrE,iBAAW,UAAU;AAAA,IACvB,WAAW,cAAc;AACvB,iBAAW;AAAA,IACb;AAEA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAEA,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI;AAAA,QACR,wCAAwC,QAAQ;AAAA,MAElD;AAAA,IACF;AAGA,eAAW,MAAM,cAAc,UAAU,cAAc,kBAAkB,QAAQ;AAAA,EACnF,OAAO;AACL,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAGA,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,SAAS;AAC9B;","names":["NodeCache","import_crypto","import_node_cache","NodeCache","crypto"]}

package/dist/index.d.cts

@@ -80,6 +80,25 @@ interface Session<TRaw = OAuthTokenResponse> {
      */
     raw: TRaw;
 }
+/**
+ * Provider metadata passed to session strategy.
+ * Contains provider name and endpoints for user info extraction.
+ *
+ * @public
+ */
+interface ProviderMetadata {
+    /** The provider name (e.g., 'google', 'github') */
+    name: string;
+    /** Provider endpoints */
+    endpoints: {
+        /** Authorization endpoint URL */
+        authorization: string;
+        /** Token endpoint URL */
+        token: string;
+        /** UserInfo endpoint URL */
+        userInfo: string;
+    };
+}
 /**
  * Strategy interface for custom session creation.
  *
@@ -98,24 +117,27 @@ interface Session<TRaw = OAuthTokenResponse> {
  * @example
  * Custom session strategy with database integration:
  * ```typescript
- * interface CustomSessionData extends OAuthTokenResponse {
+ * interface CustomSessionData {
  *   userId: string;
  *   email: string;
+ *   provider: string;
+ *   accessToken: string;
+ *   refreshToken?: string;
+ *   expiresAt: number;
  * }
  *
  * class DatabaseSessionStrategy implements SessionStrategy {
  *   constructor(private db: Database) {}
  *
- *   async createSession(tokenData: OAuthTokenResponse): Promise<Session<CustomSessionData>> {
- *     // Decode ID token for OIDC providers
- *     const idToken = tokenData.id_token;
- *     const payload = decodeJwt(idToken);
+ *   async createSession(oauthContext: OAuthContext): Promise<Session<CustomSessionData>> {
+ *     // User info is already extracted by Lixa!
+ *     const { userInfo, provider, tokenData } = oauthContext;
  *
  *     // Create or update user in database
  *     const user = await this.db.users.upsert({
- *       email: payload.email,
- *       name: payload.name,
- *       picture: payload.picture
+ *       email: userInfo.email,
+ *       name: userInfo.name,
+ *       picture: userInfo.picture
  *     });
  *
  *     // Generate session ID
@@ -135,7 +157,10 @@ interface Session<TRaw = OAuthTokenResponse> {
  *       raw: {
  *         userId: user.id,
  *         email: user.email,
- *         ...tokenData
+ *         provider,
+ *         accessToken: tokenData.access_token,
+ *         refreshToken: tokenData.refresh_token,
+ *         expiresAt: Date.now() + (tokenData.expires_in || 3600) * 1000
  *       }
  *     };
  *   }
@@ -149,14 +174,14 @@ interface SessionStrategy {
      * Creates a session from OAuth token data.
      *
      * @param tokenData - The token data received from the OAuth provider's token endpoint
+     * @param providerMetadata - Provider metadata including name and endpoints
      * @returns A Promise that resolves to a Session object
      *
      * @remarks
      * This method is called after successfully exchanging the authorization code
-     * for tokens. The tokenData parameter contains the raw response from the
-     * provider's token endpoint.
+     * for tokens. You receive:
      *
-     * Common token data fields:
+     * Token Data:
      * - access_token: OAuth access token
      * - refresh_token: OAuth refresh token (optional)
      * - expires_in: Token expiration time in seconds
@@ -164,6 +189,28 @@ interface SessionStrategy {
      * - id_token: OpenID Connect ID token (for OIDC providers)
      * - scope: Granted scopes
      *
+     * Provider Metadata:
+     * - name: The provider name (e.g., 'google', 'github')
+     * - endpoints: Provider endpoints (authorization, token, userInfo)
+     *
+     * The providerMetadata.endpoints.userInfo can be used with extractUserInfo():
+     * ```typescript
+     * import { extractUserInfo } from '@vunexa/lixa';
+     *
+     * const { userInfo } = await extractUserInfo(
+     *   tokenData,
+     *   providerMetadata.endpoints.userInfo,
+     *   providerMetadata.name
+     * );
+     * ```
+     *
+     * Your session strategy should:
+     * 1. Extract user info (using extractUserInfo or decode ID token)
+     * 2. Create or lookup users in your database
+     * 3. Generate session identifiers
+     * 4. Store session data as needed
+     * 5. Return a Session object with token and raw data
+     *
      * @throws \{Error\} If session creation fails (e.g., database error, invalid token)
      *
      * @example
@@ -176,8 +223,35 @@ interface SessionStrategy {
      *   };
      * }
      * ```
+     *
+     * @example
+     * Database integration with user info extraction:
+     * ```typescript
+     * async createSession(
+     *   tokenData: OAuthTokenResponse,
+     *   providerMetadata: ProviderMetadata
+     * ): Promise<Session> {
+     *   // Extract user info from token or userinfo endpoint
+     *   const { userInfo } = await extractUserInfo(
+     *     tokenData,
+     *     providerMetadata.endpoints.userInfo,
+     *     providerMetadata.name
+     *   );
+     *
+     *   // Create or update user in database
+     *   const user = await db.users.upsert({
+     *     email: userInfo.email,
+     *     name: userInfo.name
+     *   });
+     *
+     *   return {
+     *     token: generateSessionId(),
+     *     raw: { userId: user.id, provider: providerMetadata.name, ...tokenData }
+     *   };
+     * }
+     * ```
      */
-    createSession(tokenData: OAuthTokenResponse): Promise<Session>;
+    createSession(tokenData: OAuthTokenResponse, providerMetadata: ProviderMetadata): Promise<Session>;
 }
 /**
  * Default session strategy that works with any OAuth provider.
@@ -191,9 +265,10 @@ declare class DefaultSessionStrategy implements SessionStrategy {
      * Handles common OAuth token formats and extracts the access token.
      *
      * @param tokenData - The token data received from the OAuth provider
+     * @param providerMetadata - Provider metadata (not used in default implementation)
      * @returns A Promise that resolves to a Session object
      */
-    createSession(tokenData: OAuthTokenResponse): Promise<Session>;
+    createSession(tokenData: OAuthTokenResponse, providerMetadata: ProviderMetadata): Promise<Session>;
 }
 
 /**
@@ -1158,4 +1233,4 @@ declare function extractUserInfo(tokenData: OAuthTokenResponse, userInfoEndpoint
     provider: string;
 }>;
 
-export { DefaultSessionStrategy, type IProvider, Lixa, type LixaConfig, type OAuthTokenResponse, type ProviderConfig, type SafeLixaConfig, type Session, type SessionDao, type SessionStrategy, type StateDao, type StateData, type UserInfo, decodeIdToken, determineProviderFromIssuer, extractUserInfo, fetchUserInfo };
+export { DefaultSessionStrategy, type IProvider, Lixa, type LixaConfig, type OAuthTokenResponse, type ProviderConfig, type ProviderMetadata, type SafeLixaConfig, type Session, type SessionDao, type SessionStrategy, type StateDao, type StateData, type UserInfo, decodeIdToken, determineProviderFromIssuer, extractUserInfo, fetchUserInfo };

package/dist/index.d.ts

@@ -16,7 +16,7 @@
  * @packageDocumentation
  */
 export { Lixa } from "./lixa";
-export { type ProviderConfig, type LixaConfig, type SafeLixaConfig, type IProvider, type SessionStrategy, type Session, type OAuthTokenResponse, type StateDao, type SessionDao, type StateData, } from "./types";
+export { type ProviderConfig, type LixaConfig, type SafeLixaConfig, type IProvider, type SessionStrategy, type Session, type ProviderMetadata, type OAuthTokenResponse, type StateDao, type SessionDao, type StateData, } from "./types";
 export { DefaultSessionStrategy } from "./models/session";
 export { type UserInfo, extractUserInfo, decodeIdToken, fetchUserInfo, determineProviderFromIssuer, } from "./utils/user-info";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,kBAAkB,EACvB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,SAAS,GACf,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EACL,KAAK,QAAQ,EACb,eAAe,EACf,aAAa,EACb,aAAa,EACb,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,SAAS,GACf,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EACL,KAAK,QAAQ,EACb,eAAe,EACf,aAAa,EACb,aAAa,EACb,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -47,9 +47,10 @@ var DefaultSessionStrategy = class {
    * Handles common OAuth token formats and extracts the access token.
    *
    * @param tokenData - The token data received from the OAuth provider
+   * @param providerMetadata - Provider metadata (not used in default implementation)
    * @returns A Promise that resolves to a Session object
    */
-  async createSession(tokenData) {
+  async createSession(tokenData, providerMetadata) {
     if (!tokenData.access_token || typeof tokenData.access_token !== "string") {
       throw new Error("No valid access token found in OAuth response");
     }
@@ -508,7 +509,15 @@ var Lixa = class _Lixa {
     );
     this.log("INFO", "Token", "Token exchange successful");
     this.log("INFO", "Session", "Creating user session");
-    const session = await this.sessionStrategy.createSession(tokens);
+    const providerMetadata = {
+      name: providerType,
+      endpoints: {
+        authorization: providerImpl.authorizationEndpoint,
+        token: providerImpl.tokenEndpoint,
+        userInfo: providerImpl.userInfoEndpoint
+      }
+    };
+    const session = await this.sessionStrategy.createSession(tokens, providerMetadata);
     const sessionId = randomBytes(32).toString("hex");
     this.log("INFO", "Session", "Storing session", { sessionId });
     await this.sesionDao.saveSession(sessionId, session, 86400);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/lixa.ts","../src/dao/state-cache.ts","../src/dao/session-cache.ts","../src/models/session.ts","../src/utils/user-info.ts"],"sourcesContent":["import { randomBytes } from \"crypto\";\nimport { type LixaConfig, type ProviderConfig } from \"./types\";\nimport { IProvider } from \"./providers\";\nimport { LocalStateCache } from \"./dao/state-cache\";\nimport { SessionDao, StateDao } from \"./dao/types\";\nimport crypto from \"crypto\";\nimport { LocalSessionCache } from \"./dao/session-cache\";\nimport { type Session, type SessionStrategy, DefaultSessionStrategy, type OAuthTokenResponse } from \"./models/session\";\n\n/**\n * Type representing the keys of configured providers\n */\ntype ConfiguredProviderKey<T extends LixaConfig<Record<string, ProviderConfig>>> = keyof T['providers'];\n\n/**\n * A flexible, provider-agnostic OAuth 2.0 and OpenID Connect (OIDC) client library.\n *\n * @remarks\n * Lixa simplifies multi-provider authentication flows and supports extensible session management.\n * Providers can be passed inline in the configuration, eliminating the need for pre-registration.\n *\n * @example\n * Using built-in providers from \\@vunexa/lixa-providers:\n * ```typescript\n * import { Lixa } from '@vunexa/lixa';\n * import { GoogleProvider } from '@vunexa/lixa-providers';\n * \n * const lixa = new Lixa({\n *   providers: {\n *     google: {\n *       provider: new GoogleProvider(),\n *       clientId: 'your-client-id',\n *       clientSecret: 'your-client-secret',\n *       redirectUri: 'https://yourapp.com/auth/google/callback',\n *       scopes: ['openid', 'email', 'profile']\n *     }\n *   }\n * });\n * ```\n * \n * @example\n * Using custom inline providers:\n * ```typescript\n * import { Lixa, IProvider } from '@vunexa/lixa';\n * \n * const customProvider: IProvider = {\n *   authorizationEndpoint: 'https://custom.com/oauth/authorize',\n *   tokenEndpoint: 'https://custom.com/oauth/token',\n *   userInfoEndpoint: 'https://custom.com/api/user'\n * };\n * \n * const lixa = new Lixa({\n *   providers: {\n *     custom: {\n *       provider: customProvider,\n *       clientId: 'your-client-id',\n *       clientSecret: 'your-client-secret',\n *       redirectUri: 'https://yourapp.com/auth/custom/callback',\n *       scopes: ['read:user']\n *     }\n *   }\n * });\n * ```\n *\n * @public\n */\nclass Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> = LixaConfig> {\n  private static DEFAULT_PROVIDERS: Map<string, IProvider> = new Map();\n  private static CONFIGURED_PROVIDERS: Map<string, IProvider> = new Map(); // Legacy registry for backward compatibility\n  private static LOCAL_STATE_CACHE = new LocalStateCache();\n  private static LOCAL_SESSION_CACHE = new LocalSessionCache();\n  private static DEFAULT_SESSION_STRATEGY = new DefaultSessionStrategy();\n  private config: TConfig;\n  private stateDao: StateDao;\n  private sesionDao: SessionDao;\n  private sessionStrategy: SessionStrategy;\n  private debug: boolean;\n\n  /**\n   * Creates a new Lixa instance with the provided configuration.\n   * \n   * @remarks\n   * Providers can be passed inline in the configuration using the `provider` field.\n   * Provider resolution priority: inline custom provider \\> default providers \\> legacy registry.\n   * \n   * @param config - The configuration object containing provider settings and optional session strategy\n   * \n   * @throws Error when provider configuration is missing required fields\n   * @throws Error when provider implementation is missing required properties\n   * @throws Error when provider is not available and no inline implementation is provided\n   */\n  constructor(config: TConfig) {\n    this.config = config;\n    this.stateDao = config.stateDao || Lixa.LOCAL_STATE_CACHE;\n    this.sesionDao = config.sessionDao || Lixa.LOCAL_SESSION_CACHE;\n    this.sessionStrategy = config.sessionStrategy || Lixa.DEFAULT_SESSION_STRATEGY;\n    this.debug = config.debug || false;\n    \n    this.log('INFO', 'Init', 'Initializing Lixa instance', { \n      providers: Object.keys(config.providers),\n      debug: this.debug \n    });\n    \n    // Validate and extract providers from configuration\n    for (const [providerName, providerConfig] of Object.entries(config.providers)) {\n      const name = providerName.toLowerCase();\n      const typedConfig: ProviderConfig = providerConfig;\n      \n      // Validate provider configuration has required credentials\n      this.validateProviderConfig(providerName, typedConfig);\n      \n      // If provider config includes a custom provider implementation, validate it\n      if (typedConfig.provider) {\n        this.validateProviderImplementation(providerName, typedConfig.provider);\n        this.log('INFO', 'Init', `Registered inline provider: ${providerName}`);\n      } else {\n        // Check if it's available in default providers or legacy registry\n        if (!Lixa.DEFAULT_PROVIDERS.has(name) && !Lixa.CONFIGURED_PROVIDERS.has(name)) {\n          this.log('ERROR', 'Init', `Provider '${providerName}' not available`);\n          throw new Error(\n            `Provider '${providerName}' is not available. ` +\n            `Either import it from '@vunexa/lixa-providers' and include it in the configuration, ` +\n            `or provide a custom implementation using the 'provider' field: ` +\n            `{ provider: new CustomProvider(), clientId: '...', ... }`\n          );\n        }\n        this.log('INFO', 'Init', `Using registered provider: ${providerName}`);\n      }\n    }\n    \n    this.log('INFO', 'Init', 'Lixa instance initialized successfully');\n  }\n  \n  /**\n   * Validates that a provider configuration has all required credentials.\n   * \n   * @param name - The provider name\n   * @param config - The provider configuration\n   * @throws Error when required fields are missing or invalid\n   */\n  private validateProviderConfig(name: string, config: ProviderConfig): void {\n    const requiredFields: (keyof ProviderConfig)[] = ['clientId', 'clientSecret', 'redirectUri', 'scopes'];\n    const missingFields = requiredFields.filter(field => {\n      const value = config[field];\n      return value === undefined || value === null || (typeof value === 'string' && value.trim() === '');\n    });\n    \n    if (missingFields.length > 0) {\n      throw new Error(\n        `Provider '${name}' configuration is missing required fields: ${missingFields.join(', ')}`\n      );\n    }\n    \n    // Validate scopes is an array\n    if (!Array.isArray(config.scopes)) {\n      throw new Error(\n        `Provider '${name}' configuration error: 'scopes' must be an array of strings`\n      );\n    }\n    \n    if (config.scopes.length === 0) {\n      throw new Error(\n        `Provider '${name}' configuration error: 'scopes' array cannot be empty`\n      );\n    }\n  }\n  \n  /**\n   * Validates that a provider implementation has all required properties.\n   * \n   * @param name - The provider name\n   * @param provider - The provider implementation\n   * @throws Error when required properties are missing\n   */\n  private validateProviderImplementation(name: string, provider: IProvider): void {\n    const requiredProps: (keyof IProvider)[] = ['authorizationEndpoint', 'tokenEndpoint', 'userInfoEndpoint'];\n    const missingProps = requiredProps.filter(prop => {\n      const value = provider[prop];\n      return !value || typeof value !== 'string' || value.trim() === '';\n    });\n    \n    if (missingProps.length > 0) {\n      throw new Error(\n        `Provider '${name}' implementation is missing required properties: ${missingProps.join(', ')}. ` +\n        `All IProvider implementations must define: authorizationEndpoint, tokenEndpoint, and userInfoEndpoint.`\n      );\n    }\n  }\n\n  /**\n   * Structured debug logging with standardized format.\n   * \n   * @param level - Log level (INFO, WARN, ERROR)\n   * @param context - Context of the log (Init, Auth, Token, Session, State)\n   * @param message - Log message\n   * @param data - Optional data to log\n   * \n   * @remarks\n   * Format: [Lixa] [timestamp] [level] [context] message\n   * Only logs when debug mode is enabled.\n   */\n  private log(level: 'INFO' | 'WARN' | 'ERROR', context: 'Init' | 'Auth' | 'Token' | 'Session' | 'State', message: string, data?: Record<string, string | number | boolean | string[]>): void {\n    if (!this.debug) return;\n    \n    const timestamp = new Date().toISOString();\n    const prefix = `[Lixa] [${timestamp}] [${level}] [${context}]`;\n    \n    if (data !== undefined) {\n      console.log(`${prefix} ${message}`, data);\n    } else {\n      console.log(`${prefix} ${message}`);\n    }\n  }\n\n  /**\n   * Checks if a provider is configured for this instance.\n   * This is a type guard that narrows the provider type for use with getAuthUrl.\n   *\n   * @param provider - The provider name to check (case-insensitive)\n   * @returns True if the provider is configured, false otherwise\n   *\n   * @example\n   * ```typescript\n   * if (lixa.isProviderConfigured(provider)) {\n   *   // TypeScript now knows provider is a valid ConfiguredProviderKey\n   *   const authUrl = lixa.getAuthUrl(provider, state);\n   * }\n   * ```\n   */\n  public isProviderConfigured<T extends string>(provider: T): provider is T & ConfiguredProviderKey<TConfig> {\n    const providerType = provider.toLowerCase();\n    return this.config.providers.hasOwnProperty(providerType);\n  }\n  \n  /**\n   * Gets a provider implementation by name.\n   * Resolution priority: inline custom provider \\> default providers \\> legacy registry\n   * \n   * @param name - The provider name (case-insensitive)\n   * @param config - The provider configuration\n   * @returns The provider implementation\n   * @throws Error when provider is not found\n   */\n  private getProvider(name: string, config: ProviderConfig): IProvider {\n    // First check if provider is inline in config\n    if (config.provider) {\n      return config.provider;\n    }\n    \n    // Then check default providers\n    const lowerName = name.toLowerCase();\n    const defaultProvider = Lixa.DEFAULT_PROVIDERS.get(lowerName);\n    if (defaultProvider) {\n      return defaultProvider;\n    }\n    \n    // Finally check legacy registry for backward compatibility\n    const legacyProvider = Lixa.CONFIGURED_PROVIDERS.get(lowerName);\n    if (legacyProvider) {\n      return legacyProvider;\n    }\n    \n    throw new Error(\n      `Provider '${name}' not found. ` +\n      `Ensure the provider is included in the configuration with a 'provider' field, ` +\n      `or registered using Lixa.registerProvider().`\n    );\n  }\n\n  /**\n   * Registers custom OAuth providers for use with Lixa.\n   * \n   * @deprecated This method is maintained for backward compatibility.\n   * The recommended approach is to pass providers inline in the configuration:\n   * ```typescript\n   * const lixa = new Lixa({\n   *   providers: {\n   *     custom: {\n   *       provider: new CustomProvider(),\n   *       clientId: '...',\n   *       // ...\n   *     }\n   *   }\n   * });\n   * ```\n   *\n   * @param providerMap - A map of provider names to IProvider implementations\n   *\n   * @example\n   * Legacy usage (still supported):\n   * ```typescript\n   * class CustomProvider implements IProvider {\n   *   authorizationEndpoint = 'https://custom.com/oauth/authorize';\n   *   tokenEndpoint = 'https://custom.com/oauth/token';\n   *   userInfoEndpoint = 'https://custom.com/api/user';\n   * }\n   *\n   * Lixa.registerProvider({ custom: new CustomProvider() });\n   * ```\n   */\n  public static registerProvider<T extends Record<string, IProvider>>(providerMap: T): void {\n    Object.entries(providerMap).forEach(([key, providerImpl]) => {\n      Lixa.CONFIGURED_PROVIDERS.set(key.toLowerCase(), providerImpl);\n    });\n  }\n\n  /**\n   * Gets the list of registered provider names.\n   * \n   * @returns Array of registered provider names\n   */\n  public static getRegisteredProviders(): string[] {\n    return Array.from(Lixa.CONFIGURED_PROVIDERS.keys());\n  }\n\n  /**\n   * Creates a type-safe configuration.\n   * \n   * @deprecated This method is maintained for backward compatibility.\n   * You can now pass configuration directly to the Lixa constructor without this helper.\n   * \n   * @param config - Configuration object with provider settings\n   * @returns The same configuration object with type safety\n   * \n   * @example\n   * New approach (recommended):\n   * ```typescript\n   * const lixa = new Lixa({\n   *   providers: {\n   *     google: {\n   *       provider: new GoogleProvider(),\n   *       clientId: '...',\n   *       // ...\n   *     }\n   *   }\n   * });\n   * ```\n   */\n  public static createConfig<T extends Record<string, ProviderConfig>>(\n    config: LixaConfig<T> & { providers: T }\n  ): LixaConfig<T> {\n    return config;\n  }\n\n  /**\n   * Generates a cryptographically secure random state parameter for OAuth flows.\n   *\n   * @returns A 32-character hexadecimal string\n   *\n   * @remarks\n   * The state parameter is used to prevent CSRF attacks in OAuth flows.\n   */\n  public static generateRandomState(): string {\n    return randomBytes(16).toString(\"hex\");\n  }\n\n  /**\n   * Generates a cryptographically secure code verifier for PKCE flows.\n   *\n   * @returns A 64-character hexadecimal string (32 random bytes encoded as hex)\n   *\n   * @remarks\n   * This method implements the code verifier generation as specified in RFC 7636 (PKCE).\n   * \n   * **PKCE (Proof Key for Code Exchange)** is a security extension to OAuth 2.0 that\n   * prevents authorization code interception attacks. It's especially important for\n   * public clients (mobile apps, SPAs) but is recommended for all OAuth flows.\n   * \n   * **Generation methodology:**\n   * 1. Generate 32 cryptographically random bytes using Node.js crypto.randomBytes()\n   * 2. Encode the bytes as a hexadecimal string (64 characters)\n   * 3. The verifier is stored securely and used later in the token exchange\n   * \n   * **RFC 7636 Requirements:**\n   * - Minimum length: 43 characters\n   * - Maximum length: 128 characters\n   * - Character set: [A-Z] / [a-z] / [0-9] / \"-\" / \".\" / \"_\" / \"~\"\n   * - This implementation produces 64 hex characters, meeting the requirements\n   * \n   * The code verifier is:\n   * - Generated when creating the authorization URL\n   * - Stored in state cache with the state parameter\n   * - Retrieved during callback handling\n   * - Sent to the token endpoint to prove the client's identity\n   * \n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7636 | RFC 7636 - PKCE}\n   * @see buildCodeChallenge for the corresponding challenge generation\n   * \n   * @internal\n   */\n  private static generateCodeVerifier(): string {\n    return randomBytes(32).toString(\"hex\");\n  }\n\n  /**\n   * Generates a code challenge from a code verifier for PKCE flows.\n   *\n   * @param codeVerifier - The code verifier string (64 hex characters)\n   * @returns A base64url-encoded SHA-256 hash of the code verifier\n   *\n   * @remarks\n   * This method implements the code challenge generation as specified in RFC 7636 (PKCE)\n   * using the S256 (SHA-256) transformation method.\n   * \n   * **Challenge generation methodology:**\n   * 1. Hash the code verifier using SHA-256\n   * 2. Encode the hash as base64\n   * 3. Convert to base64url format (RFC 4648):\n   *    - Replace '+' with '-'\n   *    - Replace '/' with '_'\n   *    - Remove trailing '=' padding\n   * \n   * **PKCE Flow:**\n   * 1. Client generates code_verifier (random string)\n   * 2. Client creates code_challenge = BASE64URL(SHA256(code_verifier))\n   * 3. Client sends code_challenge to authorization endpoint\n   * 4. Authorization server stores the code_challenge\n   * 5. Client sends code_verifier to token endpoint\n   * 6. Authorization server verifies: SHA256(code_verifier) == code_challenge\n   * \n   * **Security Benefits:**\n   * - Prevents authorization code interception attacks\n   * - Even if an attacker intercepts the authorization code, they cannot\n   *   exchange it for tokens without the original code_verifier\n   * - The challenge is sent in the authorization request (public)\n   * - The verifier is sent in the token request (should be kept secret)\n   * \n   * **RFC 7636 Transformation Methods:**\n   * - plain: code_challenge = code_verifier (not recommended)\n   * - S256: code_challenge = BASE64URL(SHA256(code_verifier)) (recommended, used here)\n   * \n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7636 | RFC 7636 - PKCE}\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc4648#section-5 | RFC 4648 - Base64url Encoding}\n   * @see generateCodeVerifier for the verifier generation\n   * \n   * @internal\n   */\n  private static buildCodeChallenge(codeVerifier: string): string {\n    const hash = crypto\n      .createHash(\"sha256\")\n      .update(codeVerifier)\n      .digest(\"base64\");\n\n    // Convert to base64url (RFC 4648 Section 5)\n    return hash.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n  }\n\n  /**\n   * Generates the authorization URL for the specified provider.\n   *\n   * @param provider - The provider name (must be a configured provider key)\n   * @param state - The state parameter for CSRF protection\n   * @returns The complete authorization URL to redirect users to\n   *\n   * @throws Error when the provider is not configured\n   *\n   * @example\n   * ```typescript\n   * const state = Lixa.generateRandomState();\n   * const authUrl = lixa.getAuthUrl('google', state);\n   * res.redirect(authUrl);\n   * ```\n   */\n  public getAuthUrl(provider: ConfiguredProviderKey<TConfig> | string, state: string): string {\n    const providerType = String(provider).toLowerCase();\n    \n    this.log('INFO', 'Auth', `Generating authorization URL for provider: ${providerType}`);\n    \n    const providerConfig = this.findProviderByType(providerType);\n\n    if (!providerConfig) {\n      this.log('ERROR', 'Auth', `Provider '${String(provider)}' is not configured`);\n      throw new Error(`Provider '${String(provider)}' is not configured in this Lixa instance`);\n    }\n\n    const providerImpl = this.getProvider(providerType, providerConfig);\n\n    const codeVerifier = Lixa.generateCodeVerifier();\n    const codeChallenge = Lixa.buildCodeChallenge(codeVerifier);\n\n    this.log('INFO', 'State', `Saving state for provider: ${providerType}`, { state });\n\n    // Cache the state paramaeter with TTL of 5 minutes (300 seconds)\n    // We dont care about value. we are onl interested in key existence\n    this.stateDao.saveState(\n      state,\n      {\n        createdAt: Date.now(),\n        provider: providerType,\n        codeVerifier,\n      },\n      300 // 5 minutes in seconds\n    );\n\n    const params = new URLSearchParams({\n      client_id: providerConfig.clientId,\n      redirect_uri: providerConfig.redirectUri,\n      scope: providerConfig.scopes.join(\" \"),\n      state,\n      response_type: \"code\",\n      code_challenge: codeChallenge,\n      code_challenge_method: \"S256\",\n      ...providerConfig.extraConfig,\n    });\n\n    const authUrl = `${providerImpl.authorizationEndpoint}?${params.toString()}`;\n    this.log('INFO', 'Auth', `Authorization URL generated successfully`, { \n      provider: providerType,\n      endpoint: providerImpl.authorizationEndpoint \n    });\n\n    return authUrl;\n  }\n\n  /**\n   * Handles the OAuth callback and creates a user session.\n   *\n   * @param provider - The provider name (must be a configured provider key)\n   * @param code - The authorization code from the provider\n   * @param state - The state parameter for validation\n   * @returns A Promise that resolves to the session ID\n   *\n   * @throws Error when code or state is missing/invalid, or provider is not configured\n   *\n   * @example\n   * ```typescript\n   * const sessionId = await lixa.handleCallback({\n   *   provider: 'google',\n   *   code: req.query.code,\n   *   state: req.query.state\n   * });\n   * ```\n   */\n  public async handleCallback({\n    provider,\n    code,\n    state,\n  }: {\n    provider: ConfiguredProviderKey<TConfig> | string;\n    code: string;\n    state?: string;\n  }): Promise<string> {\n    const providerType = String(provider).toLowerCase();\n    this.log('INFO', 'Auth', `Handling OAuth callback for provider: ${providerType}`);\n\n    if (!code || code.trim() === \"\") {\n      this.log('ERROR', 'Auth', 'Invalid or missing authorization code in callback');\n      throw new Error(\"Invalid or missing code in callback\");\n    }\n\n    if (!state || state.trim() === \"\") {\n      this.log('ERROR', 'Auth', 'Invalid or missing state in callback');\n      throw new Error(\"Invalid or missing state in callback\");\n    }\n\n    this.log('INFO', 'State', 'Validating state parameter', { state });\n\n    //Validate state here\n    const cachedState = await this.stateDao.getState(state);\n    if (!cachedState) {\n      this.log('ERROR', 'State', 'State validation failed: state not found or expired', { state });\n      throw new Error(\"Invalid or expired state\");\n    }\n    \n    this.log('INFO', 'State', 'State validated successfully, removing from cache');\n    // State is valid, remove it from cache to prevent reuse\n    await this.stateDao.deleteState(state);\n\n    //Get code verifier from cached state\n    const codeVerifier = cachedState.codeVerifier;\n\n    const providerConfig = this.findProviderByType(providerType);\n\n    if (!providerConfig) {\n      this.log('ERROR', 'Auth', `Provider '${String(provider)}' is not configured`);\n      throw new Error(`Provider '${String(provider)}' is not configured in this Lixa instance`);\n    }\n\n    const providerImpl = this.getProvider(providerType, providerConfig);\n\n    this.log('INFO', 'Token', `Exchanging authorization code for tokens`, { provider: providerType });\n\n    // Exchange code for tokens and fetch user info here.\n    const tokens = await this.exchangeCodeForToken(\n      code,\n      providerConfig,\n      providerImpl,\n      codeVerifier\n    );\n\n    this.log('INFO', 'Token', 'Token exchange successful');\n\n    this.log('INFO', 'Session', 'Creating user session');\n    const session = await this.sessionStrategy.createSession(tokens);\n\n    // Generate unique session ID\n    const sessionId = randomBytes(32).toString(\"hex\");\n\n    this.log('INFO', 'Session', 'Storing session', { sessionId });\n    // Store session with 24 hour TTL (86400 seconds)\n    await this.sesionDao.saveSession(sessionId, session, 86400);\n\n    this.log('INFO', 'Session', 'Session created successfully', { sessionId });\n\n    return sessionId;\n  }\n\n  public async fetchSessionInfo(sessionId: string): Promise<Session | null> {\n    return await this.sesionDao.getSession<Session>(sessionId);\n  }\n\n  private async exchangeCodeForToken(\n    code: string,\n    providerConfig: ProviderConfig,\n    providerImpl: IProvider,\n    codeVerifier: string\n  ): Promise<OAuthTokenResponse> {\n    // Build the request body\n    const body: Record<string, string> = {\n      client_id: providerConfig.clientId,\n      client_secret: providerConfig.clientSecret,\n      code,\n      redirect_uri: providerConfig.redirectUri,\n      grant_type: \"authorization_code\",\n    };\n\n    if (codeVerifier) {\n      body.code_verifier = codeVerifier;\n    }\n    const params = new URLSearchParams(body);\n\n    this.log('INFO', 'Token', 'Sending token exchange request', { \n      endpoint: providerImpl.tokenEndpoint \n    });\n    \n    const response = await fetch(providerImpl.tokenEndpoint, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/x-www-form-urlencoded\",\n        Accept: \"application/json\",\n      },\n      body: params.toString(),\n    });\n\n    if (!response.ok) {\n      const errorBody = await response.text();\n      this.log('ERROR', 'Token', 'Token exchange failed', { \n        status: response.status, \n        statusText: response.statusText,\n        error: errorBody \n      });\n      throw new Error(\n        `Token exchange failed: ${response.status} ${response.statusText} - ${errorBody}`\n      );\n    }\n\n    this.log('INFO', 'Token', 'Token exchange response received successfully');\n    return response.json();\n  }\n\n  private findProviderByType(providerType: string): ProviderConfig | undefined {\n    // Use Object.entries to safely iterate and find the provider\n    for (const [key, value] of Object.entries(this.config.providers)) {\n      if (key.toLowerCase() === providerType.toLowerCase()) {\n        return value;\n      }\n    }\n    return undefined;\n  }\n}\n\nexport { Lixa };\n","import NodeCache from 'node-cache';\nimport { StateDao, StateData } from \"./types\";\n\nclass LocalStateCache implements StateDao {\n  private cache: NodeCache;\n\n  constructor(defaultTtlSeconds: number = 600) {\n    this.cache = new NodeCache({ stdTTL: defaultTtlSeconds });\n  }\n\n  async saveState(state: string, data: StateData, expiresInSeconds: number): Promise<void> {\n    this.cache.set(state, data, expiresInSeconds);\n  }\n\n  async getState(state: string): Promise<StateData | null> {\n    return this.cache.get<StateData>(state) || null;\n  }\n\n  async deleteState(state: string): Promise<void> {\n    this.cache.del(state);\n  }\n}\n\nexport { LocalStateCache };\n","import NodeCache from 'node-cache';\nimport { SessionDao } from \"./types\";\nimport type { Session } from \"../models/session\";\n\nclass LocalSessionCache implements SessionDao {\n  private cache: NodeCache;\n\n  constructor(defaultTtlSeconds: number = 600) {\n    this.cache = new NodeCache({ stdTTL: defaultTtlSeconds });\n  }\n\n  async saveSession<T extends Session>(state: string, data: T, expiresInSeconds: number): Promise<void> {\n    this.cache.set(state, data, expiresInSeconds);\n  }\n\n  async getSession<T extends Session>(state: string): Promise<T | null> {\n    return this.cache.get<T>(state) || null;\n  }\n\n  async deleteSession(state: string): Promise<void> {\n    this.cache.del(state);\n  }\n}\n\nexport { LocalSessionCache };\n","/**\n * OAuth 2.0 token response structure.\n * Based on RFC 6749 Section 5.1 and OpenID Connect Core 1.0 Section 3.1.3.3\n * \n * @remarks\n * This interface represents the standard OAuth 2.0 token response with\n * optional OpenID Connect extensions. All OAuth providers should return\n * at minimum the required fields (access_token, token_type).\n * \n * @public\n */\nexport interface OAuthTokenResponse {\n  /** \n   * OAuth 2.0 access token (required).\n   * Used to access protected resources on behalf of the user.\n   */\n  access_token: string;\n  \n  /** \n   * Token type (required).\n   * Typically \"Bearer\" for OAuth 2.0.\n   */\n  token_type: string;\n  \n  /** \n   * Token expiration time in seconds (optional).\n   * Time until the access token expires.\n   */\n  expires_in?: number;\n  \n  /** \n   * OAuth 2.0 refresh token (optional).\n   * Used to obtain new access tokens without re-authentication.\n   */\n  refresh_token?: string;\n  \n  /** \n   * Granted OAuth scopes (optional).\n   * Space-separated list of scopes that were granted.\n   */\n  scope?: string;\n  \n  /** \n   * OpenID Connect ID token (optional).\n   * JWT containing user identity claims (only present for OIDC providers).\n   */\n  id_token?: string;\n  \n  /**\n   * Additional provider-specific fields.\n   * Some providers may include extra fields like user_id, account_id, etc.\n   */\n  [key: string]: string | number | boolean | undefined;\n}\n\n/**\n * Represents a user session after successful OAuth authentication.\n * \n * @remarks\n * The Session object is returned by SessionStrategy.createSession() and contains\n * the session identifier and any additional data needed for your application.\n * \n * The structure is intentionally flexible to support various session management\n * approaches (JWT tokens, session IDs, etc.).\n *\n * @public\n */\nexport interface Session<TRaw = OAuthTokenResponse> {\n  /** \n   * The session token or identifier.\n   * This could be an access token, a session ID, a JWT, or any other identifier\n   * that your application uses to track authenticated users.\n   */\n  token: string;\n  \n  /** \n   * Raw session data.\n   * Contains the complete OAuth token response and any additional data\n   * your SessionStrategy adds (user info, database IDs, etc.).\n   * \n   * Typical OAuth token data includes:\n   * - access_token: OAuth access token\n   * - refresh_token: OAuth refresh token (if requested)\n   * - expires_in: Token expiration time in seconds\n   * - token_type: Token type (usually \"Bearer\")\n   * - id_token: OpenID Connect ID token (if using OIDC)\n   * - scope: Granted scopes\n   */\n  raw: TRaw;\n}\n\n/**\n * Strategy interface for custom session creation.\n * \n * @remarks\n * Implement this interface to customize how OAuth tokens are converted into\n * application sessions. This is where you typically:\n * - Decode ID tokens (for OpenID Connect)\n * - Look up or create users in your database\n * - Generate session identifiers\n * - Store session data\n * - Add custom claims or metadata\n * \n * The default implementation (DefaultSessionStrategy) simply extracts the\n * access token and returns it as the session token.\n * \n * @example\n * Custom session strategy with database integration:\n * ```typescript\n * interface CustomSessionData extends OAuthTokenResponse {\n *   userId: string;\n *   email: string;\n * }\n * \n * class DatabaseSessionStrategy implements SessionStrategy {\n *   constructor(private db: Database) {}\n *   \n *   async createSession(tokenData: OAuthTokenResponse): Promise<Session<CustomSessionData>> {\n *     // Decode ID token for OIDC providers\n *     const idToken = tokenData.id_token;\n *     const payload = decodeJwt(idToken);\n *     \n *     // Create or update user in database\n *     const user = await this.db.users.upsert({\n *       email: payload.email,\n *       name: payload.name,\n *       picture: payload.picture\n *     });\n *     \n *     // Generate session ID\n *     const sessionId = generateSecureId();\n *     \n *     // Store session with tokens\n *     await this.db.sessions.create({\n *       id: sessionId,\n *       userId: user.id,\n *       accessToken: tokenData.access_token,\n *       refreshToken: tokenData.refresh_token,\n *       expiresAt: new Date(Date.now() + (tokenData.expires_in || 3600) * 1000)\n *     });\n *     \n *     return {\n *       token: sessionId,\n *       raw: {\n *         userId: user.id,\n *         email: user.email,\n *         ...tokenData\n *       }\n *     };\n *   }\n * }\n * ```\n *\n * @public\n */\nexport interface SessionStrategy {\n  /**\n   * Creates a session from OAuth token data.\n   * \n   * @param tokenData - The token data received from the OAuth provider's token endpoint\n   * @returns A Promise that resolves to a Session object\n   * \n   * @remarks\n   * This method is called after successfully exchanging the authorization code\n   * for tokens. The tokenData parameter contains the raw response from the\n   * provider's token endpoint.\n   * \n   * Common token data fields:\n   * - access_token: OAuth access token\n   * - refresh_token: OAuth refresh token (optional)\n   * - expires_in: Token expiration time in seconds\n   * - token_type: Token type (usually \"Bearer\")\n   * - id_token: OpenID Connect ID token (for OIDC providers)\n   * - scope: Granted scopes\n   * \n   * @throws \\{Error\\} If session creation fails (e.g., database error, invalid token)\n   * \n   * @example\n   * Simple implementation:\n   * ```typescript\n   * async createSession(tokenData: OAuthTokenResponse): Promise<Session> {\n   *   return {\n   *     token: tokenData.access_token,\n   *     raw: tokenData\n   *   };\n   * }\n   * ```\n   */\n  createSession(tokenData: OAuthTokenResponse): Promise<Session>;\n}\n\n/**\n * Default session strategy that works with any OAuth provider.\n * Extracts common token information and creates a standardized session.\n *\n * @public\n */\nexport class DefaultSessionStrategy implements SessionStrategy {\n  /**\n   * Creates a session from OAuth token data.\n   * Handles common OAuth token formats and extracts the access token.\n   *\n   * @param tokenData - The token data received from the OAuth provider\n   * @returns A Promise that resolves to a Session object\n   */\n  async createSession(tokenData: OAuthTokenResponse): Promise<Session> {\n    if (!tokenData.access_token || typeof tokenData.access_token !== 'string') {\n      throw new Error('No valid access token found in OAuth response');\n    }\n\n    return {\n      token: tokenData.access_token,\n      raw: tokenData,\n    };\n  }\n}","import type { OAuthTokenResponse } from \"../models/session\";\n\n/**\n * User information extracted from OAuth provider\n * \n * @public\n */\nexport interface UserInfo {\n  email: string;\n  id?: string | undefined;\n  sub?: string | undefined;\n  given_name?: string | undefined;\n  family_name?: string | undefined;\n  name?: string | undefined;\n  picture?: string | undefined;\n  email_verified?: boolean | undefined;\n  iss?: string | undefined;\n}\n\n/**\n * Decode JWT ID token to extract user information\n * \n * @public\n */\nexport function decodeIdToken(idToken: string): UserInfo {\n  const parts = idToken.split('.');\n  if (parts.length !== 3) {\n    throw new Error('Invalid ID token format: expected 3 parts separated by dots');\n  }\n  \n  const base64Payload = parts[1];\n  if (!base64Payload) {\n    throw new Error('Invalid ID token: missing payload section');\n  }\n  const payload = Buffer.from(base64Payload, 'base64').toString();\n  \n  try {\n    return JSON.parse(payload);\n  } catch (error) {\n    throw new Error('Invalid ID token: failed to parse payload JSON');\n  }\n}\n\n/**\n * Determine OAuth provider from ID token issuer\n * \n * @public\n */\nexport function determineProviderFromIssuer(userInfo: UserInfo): string | null {\n  if (!userInfo.iss) {\n    return null;\n  }\n  \n  const issuer = userInfo.iss.toLowerCase();\n  \n  if (issuer.includes('accounts.google.com')) {\n    return 'google';\n  }\n  \n  if (issuer.includes('github')) {\n    return 'github';\n  }\n  \n  // Unknown issuer\n  return null;\n}\n\n/**\n * Fetch user info from OAuth provider's userinfo endpoint\n * \n * @param accessToken - OAuth access token\n * @param userInfoEndpoint - The provider's userinfo endpoint URL\n * @param providerName - Provider name for error messages (optional)\n * @returns User information from the provider\n * \n * @throws Error if the request fails or response is invalid\n * \n * @public\n */\nexport async function fetchUserInfo(\n  accessToken: string, \n  userInfoEndpoint: string,\n  providerName?: string\n): Promise<UserInfo> {\n  const response = await fetch(userInfoEndpoint, {\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      Accept: 'application/json',\n    },\n  });\n  \n  if (!response.ok) {\n    const providerLabel = providerName ? ` from ${providerName}` : '';\n    throw new Error(`Failed to fetch user info${providerLabel}: ${response.status} ${response.statusText}`);\n  }\n  \n  const data = await response.json();\n  if (!data || typeof data !== 'object' || !('email' in data) || typeof data.email !== 'string') {\n    const providerLabel = providerName ? ` from ${providerName}` : '';\n    throw new Error(`Invalid user info response${providerLabel}: missing or invalid email`);\n  }\n  \n  return {\n    email: data.email,\n    id: 'id' in data ? String(data.id) : undefined,\n    sub: 'sub' in data ? String(data.sub) : undefined,\n    given_name: 'given_name' in data ? String(data.given_name) : undefined,\n    family_name: 'family_name' in data ? String(data.family_name) : undefined,\n    name: 'name' in data ? String(data.name) : undefined,\n    picture: 'picture' in data ? String(data.picture) : undefined,\n    email_verified: 'email_verified' in data ? Boolean(data.email_verified) : undefined,\n    iss: 'iss' in data ? String(data.iss) : undefined,\n  };\n}\n\n/**\n * Extract user info from OAuth token data\n * \n * @param tokenData - OAuth token response from provider\n * @param userInfoEndpoint - Optional userinfo endpoint URL (required if no ID token)\n * @param providerName - Optional provider name for error messages\n * @returns User info and detected provider name\n * \n * @remarks\n * This function attempts to extract user information in the following order:\n * 1. Decode ID token if present (preferred method)\n * 2. Fetch from userinfo endpoint using access token (requires userInfoEndpoint parameter)\n * \n * Provider detection:\n * - Primary: Extract from ID token issuer field\n * - Fallback: Use provider field in token data (if present)\n * - Fallback: Use providerName parameter\n * - Throws error if provider cannot be determined\n * \n * @throws Error if no ID token or access token is available\n * @throws Error if provider cannot be determined\n * @throws Error if userInfoEndpoint is required but not provided\n * \n * @example\n * With ID token (provider auto-detected):\n * ```typescript\n * const { userInfo, provider } = await extractUserInfo(tokenData);\n * console.log(`User ${userInfo.email} authenticated via ${provider}`);\n * ```\n * \n * @example\n * Without ID token (requires userInfoEndpoint):\n * ```typescript\n * const { userInfo, provider } = await extractUserInfo(\n *   tokenData,\n *   'https://api.example.com/user',\n *   'custom'\n * );\n * ```\n * \n * @public\n */\nexport async function extractUserInfo(\n  tokenData: OAuthTokenResponse,\n  userInfoEndpoint?: string,\n  providerName?: string\n): Promise<{ userInfo: UserInfo; provider: string }> {\n  let userInfo: UserInfo;\n  let provider: string | null = null;\n  \n  if (tokenData.id_token) {\n    // Decode ID token to get user info\n    userInfo = decodeIdToken(tokenData.id_token);\n    \n    // Try to determine provider from issuer\n    provider = determineProviderFromIssuer(userInfo);\n    \n    // Fallback to provided provider name\n    if (!provider && providerName) {\n      provider = providerName;\n    }\n  } else if (tokenData.access_token) {\n    // Without ID token, we need to know which provider to fetch from\n    // Check if provider info is in the token data (custom field)\n    if ('provider' in tokenData && typeof tokenData.provider === 'string') {\n      provider = tokenData.provider;\n    } else if (providerName) {\n      provider = providerName;\n    }\n    \n    if (!provider) {\n      throw new Error(\n        'Cannot determine OAuth provider: No ID token with issuer information, ' +\n        'no provider field in token data, and no providerName provided. Unable to fetch user info.'\n      );\n    }\n    \n    if (!userInfoEndpoint) {\n      throw new Error(\n        `Cannot fetch user info for provider '${provider}': No ID token available and no userInfoEndpoint provided. ` +\n        'Either ensure the provider returns an ID token or provide the userInfoEndpoint parameter.'\n      );\n    }\n    \n    // Fetch user info from provider's API\n    userInfo = await fetchUserInfo(tokenData.access_token, userInfoEndpoint, provider);\n  } else {\n    throw new Error('No ID token or access token available to fetch user info');\n  }\n  \n  // Final provider validation\n  if (!provider) {\n    throw new Error(\n      'Cannot determine OAuth provider: ID token issuer not recognized and no provider name provided.'\n    );\n  }\n  \n  return { userInfo, provider };\n}\n"],"mappings":";AAAA,SAAS,mBAAmB;;;ACA5B,OAAO,eAAe;AAGtB,IAAM,kBAAN,MAA0C;AAAA,EAChC;AAAA,EAER,YAAY,oBAA4B,KAAK;AAC3C,SAAK,QAAQ,IAAI,UAAU,EAAE,QAAQ,kBAAkB,CAAC;AAAA,EAC1D;AAAA,EAEA,MAAM,UAAU,OAAe,MAAiB,kBAAyC;AACvF,SAAK,MAAM,IAAI,OAAO,MAAM,gBAAgB;AAAA,EAC9C;AAAA,EAEA,MAAM,SAAS,OAA0C;AACvD,WAAO,KAAK,MAAM,IAAe,KAAK,KAAK;AAAA,EAC7C;AAAA,EAEA,MAAM,YAAY,OAA8B;AAC9C,SAAK,MAAM,IAAI,KAAK;AAAA,EACtB;AACF;;;ADhBA,OAAO,YAAY;;;AELnB,OAAOA,gBAAe;AAItB,IAAM,oBAAN,MAA8C;AAAA,EACpC;AAAA,EAER,YAAY,oBAA4B,KAAK;AAC3C,SAAK,QAAQ,IAAIA,WAAU,EAAE,QAAQ,kBAAkB,CAAC;AAAA,EAC1D;AAAA,EAEA,MAAM,YAA+B,OAAe,MAAS,kBAAyC;AACpG,SAAK,MAAM,IAAI,OAAO,MAAM,gBAAgB;AAAA,EAC9C;AAAA,EAEA,MAAM,WAA8B,OAAkC;AACpE,WAAO,KAAK,MAAM,IAAO,KAAK,KAAK;AAAA,EACrC;AAAA,EAEA,MAAM,cAAc,OAA8B;AAChD,SAAK,MAAM,IAAI,KAAK;AAAA,EACtB;AACF;;;AC+KO,IAAM,yBAAN,MAAwD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ7D,MAAM,cAAc,WAAiD;AACnE,QAAI,CAAC,UAAU,gBAAgB,OAAO,UAAU,iBAAiB,UAAU;AACzE,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,WAAO;AAAA,MACL,OAAO,UAAU;AAAA,MACjB,KAAK;AAAA,IACP;AAAA,EACF;AACF;;;AHrJA,IAAM,OAAN,MAAM,MAA8E;AAAA,EAClF,OAAe,oBAA4C,oBAAI,IAAI;AAAA,EACnE,OAAe,uBAA+C,oBAAI,IAAI;AAAA;AAAA,EACtE,OAAe,oBAAoB,IAAI,gBAAgB;AAAA,EACvD,OAAe,sBAAsB,IAAI,kBAAkB;AAAA,EAC3D,OAAe,2BAA2B,IAAI,uBAAuB;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeR,YAAY,QAAiB;AAC3B,SAAK,SAAS;AACd,SAAK,WAAW,OAAO,YAAY,MAAK;AACxC,SAAK,YAAY,OAAO,cAAc,MAAK;AAC3C,SAAK,kBAAkB,OAAO,mBAAmB,MAAK;AACtD,SAAK,QAAQ,OAAO,SAAS;AAE7B,SAAK,IAAI,QAAQ,QAAQ,8BAA8B;AAAA,MACrD,WAAW,OAAO,KAAK,OAAO,SAAS;AAAA,MACvC,OAAO,KAAK;AAAA,IACd,CAAC;AAGD,eAAW,CAAC,cAAc,cAAc,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AAC7E,YAAM,OAAO,aAAa,YAAY;AACtC,YAAM,cAA8B;AAGpC,WAAK,uBAAuB,cAAc,WAAW;AAGrD,UAAI,YAAY,UAAU;AACxB,aAAK,+BAA+B,cAAc,YAAY,QAAQ;AACtE,aAAK,IAAI,QAAQ,QAAQ,+BAA+B,YAAY,EAAE;AAAA,MACxE,OAAO;AAEL,YAAI,CAAC,MAAK,kBAAkB,IAAI,IAAI,KAAK,CAAC,MAAK,qBAAqB,IAAI,IAAI,GAAG;AAC7E,eAAK,IAAI,SAAS,QAAQ,aAAa,YAAY,iBAAiB;AACpE,gBAAM,IAAI;AAAA,YACR,aAAa,YAAY;AAAA,UAI3B;AAAA,QACF;AACA,aAAK,IAAI,QAAQ,QAAQ,8BAA8B,YAAY,EAAE;AAAA,MACvE;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,QAAQ,wCAAwC;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,uBAAuB,MAAc,QAA8B;AACzE,UAAM,iBAA2C,CAAC,YAAY,gBAAgB,eAAe,QAAQ;AACrG,UAAM,gBAAgB,eAAe,OAAO,WAAS;AACnD,YAAM,QAAQ,OAAO,KAAK;AAC1B,aAAO,UAAU,UAAa,UAAU,QAAS,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,IACjG,CAAC;AAED,QAAI,cAAc,SAAS,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI,+CAA+C,cAAc,KAAK,IAAI,CAAC;AAAA,MAC1F;AAAA,IACF;AAGA,QAAI,CAAC,MAAM,QAAQ,OAAO,MAAM,GAAG;AACjC,YAAM,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAEA,QAAI,OAAO,OAAO,WAAW,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,+BAA+B,MAAc,UAA2B;AAC9E,UAAM,gBAAqC,CAAC,yBAAyB,iBAAiB,kBAAkB;AACxG,UAAM,eAAe,cAAc,OAAO,UAAQ;AAChD,YAAM,QAAQ,SAAS,IAAI;AAC3B,aAAO,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,IACjE,CAAC;AAED,QAAI,aAAa,SAAS,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI,oDAAoD,aAAa,KAAK,IAAI,CAAC;AAAA,MAE9F;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcQ,IAAI,OAAkC,SAA0D,SAAiB,MAAmE;AAC1L,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,UAAM,SAAS,WAAW,SAAS,MAAM,KAAK,MAAM,OAAO;AAE3D,QAAI,SAAS,QAAW;AACtB,cAAQ,IAAI,GAAG,MAAM,IAAI,OAAO,IAAI,IAAI;AAAA,IAC1C,OAAO;AACL,cAAQ,IAAI,GAAG,MAAM,IAAI,OAAO,EAAE;AAAA,IACpC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBO,qBAAuC,UAA6D;AACzG,UAAM,eAAe,SAAS,YAAY;AAC1C,WAAO,KAAK,OAAO,UAAU,eAAe,YAAY;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,YAAY,MAAc,QAAmC;AAEnE,QAAI,OAAO,UAAU;AACnB,aAAO,OAAO;AAAA,IAChB;AAGA,UAAM,YAAY,KAAK,YAAY;AACnC,UAAM,kBAAkB,MAAK,kBAAkB,IAAI,SAAS;AAC5D,QAAI,iBAAiB;AACnB,aAAO;AAAA,IACT;AAGA,UAAM,iBAAiB,MAAK,qBAAqB,IAAI,SAAS;AAC9D,QAAI,gBAAgB;AAClB,aAAO;AAAA,IACT;AAEA,UAAM,IAAI;AAAA,MACR,aAAa,IAAI;AAAA,IAGnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiCA,OAAc,iBAAsD,aAAsB;AACxF,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,YAAY,MAAM;AAC3D,YAAK,qBAAqB,IAAI,IAAI,YAAY,GAAG,YAAY;AAAA,IAC/D,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,yBAAmC;AAC/C,WAAO,MAAM,KAAK,MAAK,qBAAqB,KAAK,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,OAAc,aACZ,QACe;AACf,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,OAAc,sBAA8B;AAC1C,WAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoCA,OAAe,uBAA+B;AAC5C,WAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6CA,OAAe,mBAAmB,cAA8B;AAC9D,UAAM,OAAO,OACV,WAAW,QAAQ,EACnB,OAAO,YAAY,EACnB,OAAO,QAAQ;AAGlB,WAAO,KAAK,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBO,WAAW,UAAmD,OAAuB;AAC1F,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAElD,SAAK,IAAI,QAAQ,QAAQ,8CAA8C,YAAY,EAAE;AAErF,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAE3D,QAAI,CAAC,gBAAgB;AACnB,WAAK,IAAI,SAAS,QAAQ,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAC5E,YAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,CAAC,2CAA2C;AAAA,IAC1F;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAElE,UAAM,eAAe,MAAK,qBAAqB;AAC/C,UAAM,gBAAgB,MAAK,mBAAmB,YAAY;AAE1D,SAAK,IAAI,QAAQ,SAAS,8BAA8B,YAAY,IAAI,EAAE,MAAM,CAAC;AAIjF,SAAK,SAAS;AAAA,MACZ;AAAA,MACA;AAAA,QACE,WAAW,KAAK,IAAI;AAAA,QACpB,UAAU;AAAA,QACV;AAAA,MACF;AAAA,MACA;AAAA;AAAA,IACF;AAEA,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,eAAe;AAAA,MAC1B,cAAc,eAAe;AAAA,MAC7B,OAAO,eAAe,OAAO,KAAK,GAAG;AAAA,MACrC;AAAA,MACA,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,MACvB,GAAG,eAAe;AAAA,IACpB,CAAC;AAED,UAAM,UAAU,GAAG,aAAa,qBAAqB,IAAI,OAAO,SAAS,CAAC;AAC1E,SAAK,IAAI,QAAQ,QAAQ,4CAA4C;AAAA,MACnE,UAAU;AAAA,MACV,UAAU,aAAa;AAAA,IACzB,CAAC;AAED,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAa,eAAe;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIoB;AAClB,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAClD,SAAK,IAAI,QAAQ,QAAQ,yCAAyC,YAAY,EAAE;AAEhF,QAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,IAAI;AAC/B,WAAK,IAAI,SAAS,QAAQ,mDAAmD;AAC7E,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACvD;AAEA,QAAI,CAAC,SAAS,MAAM,KAAK,MAAM,IAAI;AACjC,WAAK,IAAI,SAAS,QAAQ,sCAAsC;AAChE,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,SAAK,IAAI,QAAQ,SAAS,8BAA8B,EAAE,MAAM,CAAC;AAGjE,UAAM,cAAc,MAAM,KAAK,SAAS,SAAS,KAAK;AACtD,QAAI,CAAC,aAAa;AAChB,WAAK,IAAI,SAAS,SAAS,uDAAuD,EAAE,MAAM,CAAC;AAC3F,YAAM,IAAI,MAAM,0BAA0B;AAAA,IAC5C;AAEA,SAAK,IAAI,QAAQ,SAAS,mDAAmD;AAE7E,UAAM,KAAK,SAAS,YAAY,KAAK;AAGrC,UAAM,eAAe,YAAY;AAEjC,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAE3D,QAAI,CAAC,gBAAgB;AACnB,WAAK,IAAI,SAAS,QAAQ,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAC5E,YAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,CAAC,2CAA2C;AAAA,IAC1F;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAElE,SAAK,IAAI,QAAQ,SAAS,4CAA4C,EAAE,UAAU,aAAa,CAAC;AAGhG,UAAM,SAAS,MAAM,KAAK;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,SAAS,2BAA2B;AAErD,SAAK,IAAI,QAAQ,WAAW,uBAAuB;AACnD,UAAM,UAAU,MAAM,KAAK,gBAAgB,cAAc,MAAM;AAG/D,UAAM,YAAY,YAAY,EAAE,EAAE,SAAS,KAAK;AAEhD,SAAK,IAAI,QAAQ,WAAW,mBAAmB,EAAE,UAAU,CAAC;AAE5D,UAAM,KAAK,UAAU,YAAY,WAAW,SAAS,KAAK;AAE1D,SAAK,IAAI,QAAQ,WAAW,gCAAgC,EAAE,UAAU,CAAC;AAEzE,WAAO;AAAA,EACT;AAAA,EAEA,MAAa,iBAAiB,WAA4C;AACxE,WAAO,MAAM,KAAK,UAAU,WAAoB,SAAS;AAAA,EAC3D;AAAA,EAEA,MAAc,qBACZ,MACA,gBACA,cACA,cAC6B;AAE7B,UAAM,OAA+B;AAAA,MACnC,WAAW,eAAe;AAAA,MAC1B,eAAe,eAAe;AAAA,MAC9B;AAAA,MACA,cAAc,eAAe;AAAA,MAC7B,YAAY;AAAA,IACd;AAEA,QAAI,cAAc;AAChB,WAAK,gBAAgB;AAAA,IACvB;AACA,UAAM,SAAS,IAAI,gBAAgB,IAAI;AAEvC,SAAK,IAAI,QAAQ,SAAS,kCAAkC;AAAA,MAC1D,UAAU,aAAa;AAAA,IACzB,CAAC;AAED,UAAM,WAAW,MAAM,MAAM,aAAa,eAAe;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,MACA,MAAM,OAAO,SAAS;AAAA,IACxB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,WAAK,IAAI,SAAS,SAAS,yBAAyB;AAAA,QAClD,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,OAAO;AAAA,MACT,CAAC;AACD,YAAM,IAAI;AAAA,QACR,0BAA0B,SAAS,MAAM,IAAI,SAAS,UAAU,MAAM,SAAS;AAAA,MACjF;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,SAAS,+CAA+C;AACzE,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEQ,mBAAmB,cAAkD;AAE3E,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,OAAO,SAAS,GAAG;AAChE,UAAI,IAAI,YAAY,MAAM,aAAa,YAAY,GAAG;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;AIroBO,SAAS,cAAc,SAA2B;AACvD,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AAEA,QAAM,gBAAgB,MAAM,CAAC;AAC7B,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACA,QAAM,UAAU,OAAO,KAAK,eAAe,QAAQ,EAAE,SAAS;AAE9D,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACF;AAOO,SAAS,4BAA4B,UAAmC;AAC7E,MAAI,CAAC,SAAS,KAAK;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,SAAS,IAAI,YAAY;AAExC,MAAI,OAAO,SAAS,qBAAqB,GAAG;AAC1C,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,SAAS,QAAQ,GAAG;AAC7B,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAcA,eAAsB,cACpB,aACA,kBACA,cACmB;AACnB,QAAM,WAAW,MAAM,MAAM,kBAAkB;AAAA,IAC7C,SAAS;AAAA,MACP,eAAe,UAAU,WAAW;AAAA,MACpC,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,gBAAgB,eAAe,SAAS,YAAY,KAAK;AAC/D,UAAM,IAAI,MAAM,4BAA4B,aAAa,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAAA,EACxG;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,SAAS,OAAO,KAAK,UAAU,UAAU;AAC7F,UAAM,gBAAgB,eAAe,SAAS,YAAY,KAAK;AAC/D,UAAM,IAAI,MAAM,6BAA6B,aAAa,4BAA4B;AAAA,EACxF;AAEA,SAAO;AAAA,IACL,OAAO,KAAK;AAAA,IACZ,IAAI,QAAQ,OAAO,OAAO,KAAK,EAAE,IAAI;AAAA,IACrC,KAAK,SAAS,OAAO,OAAO,KAAK,GAAG,IAAI;AAAA,IACxC,YAAY,gBAAgB,OAAO,OAAO,KAAK,UAAU,IAAI;AAAA,IAC7D,aAAa,iBAAiB,OAAO,OAAO,KAAK,WAAW,IAAI;AAAA,IAChE,MAAM,UAAU,OAAO,OAAO,KAAK,IAAI,IAAI;AAAA,IAC3C,SAAS,aAAa,OAAO,OAAO,KAAK,OAAO,IAAI;AAAA,IACpD,gBAAgB,oBAAoB,OAAO,QAAQ,KAAK,cAAc,IAAI;AAAA,IAC1E,KAAK,SAAS,OAAO,OAAO,KAAK,GAAG,IAAI;AAAA,EAC1C;AACF;AA4CA,eAAsB,gBACpB,WACA,kBACA,cACmD;AACnD,MAAI;AACJ,MAAI,WAA0B;AAE9B,MAAI,UAAU,UAAU;AAEtB,eAAW,cAAc,UAAU,QAAQ;AAG3C,eAAW,4BAA4B,QAAQ;AAG/C,QAAI,CAAC,YAAY,cAAc;AAC7B,iBAAW;AAAA,IACb;AAAA,EACF,WAAW,UAAU,cAAc;AAGjC,QAAI,cAAc,aAAa,OAAO,UAAU,aAAa,UAAU;AACrE,iBAAW,UAAU;AAAA,IACvB,WAAW,cAAc;AACvB,iBAAW;AAAA,IACb;AAEA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAEA,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI;AAAA,QACR,wCAAwC,QAAQ;AAAA,MAElD;AAAA,IACF;AAGA,eAAW,MAAM,cAAc,UAAU,cAAc,kBAAkB,QAAQ;AAAA,EACnF,OAAO;AACL,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAGA,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,SAAS;AAC9B;","names":["NodeCache"]}
+{"version":3,"sources":["../src/lixa.ts","../src/dao/state-cache.ts","../src/dao/session-cache.ts","../src/models/session.ts","../src/utils/user-info.ts"],"sourcesContent":["import { randomBytes } from \"crypto\";\nimport { type LixaConfig, type ProviderConfig } from \"./types\";\nimport { IProvider } from \"./providers\";\nimport { LocalStateCache } from \"./dao/state-cache\";\nimport { SessionDao, StateDao } from \"./dao/types\";\nimport crypto from \"crypto\";\nimport { LocalSessionCache } from \"./dao/session-cache\";\nimport { type Session, type SessionStrategy, DefaultSessionStrategy, type OAuthTokenResponse, type ProviderMetadata } from \"./models/session\";\n\n/**\n * Type representing the keys of configured providers\n */\ntype ConfiguredProviderKey<T extends LixaConfig<Record<string, ProviderConfig>>> = keyof T['providers'];\n\n/**\n * A flexible, provider-agnostic OAuth 2.0 and OpenID Connect (OIDC) client library.\n *\n * @remarks\n * Lixa simplifies multi-provider authentication flows and supports extensible session management.\n * Providers can be passed inline in the configuration, eliminating the need for pre-registration.\n *\n * @example\n * Using built-in providers from \\@vunexa/lixa-providers:\n * ```typescript\n * import { Lixa } from '@vunexa/lixa';\n * import { GoogleProvider } from '@vunexa/lixa-providers';\n * \n * const lixa = new Lixa({\n *   providers: {\n *     google: {\n *       provider: new GoogleProvider(),\n *       clientId: 'your-client-id',\n *       clientSecret: 'your-client-secret',\n *       redirectUri: 'https://yourapp.com/auth/google/callback',\n *       scopes: ['openid', 'email', 'profile']\n *     }\n *   }\n * });\n * ```\n * \n * @example\n * Using custom inline providers:\n * ```typescript\n * import { Lixa, IProvider } from '@vunexa/lixa';\n * \n * const customProvider: IProvider = {\n *   authorizationEndpoint: 'https://custom.com/oauth/authorize',\n *   tokenEndpoint: 'https://custom.com/oauth/token',\n *   userInfoEndpoint: 'https://custom.com/api/user'\n * };\n * \n * const lixa = new Lixa({\n *   providers: {\n *     custom: {\n *       provider: customProvider,\n *       clientId: 'your-client-id',\n *       clientSecret: 'your-client-secret',\n *       redirectUri: 'https://yourapp.com/auth/custom/callback',\n *       scopes: ['read:user']\n *     }\n *   }\n * });\n * ```\n *\n * @public\n */\nclass Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> = LixaConfig> {\n  private static DEFAULT_PROVIDERS: Map<string, IProvider> = new Map();\n  private static CONFIGURED_PROVIDERS: Map<string, IProvider> = new Map(); // Legacy registry for backward compatibility\n  private static LOCAL_STATE_CACHE = new LocalStateCache();\n  private static LOCAL_SESSION_CACHE = new LocalSessionCache();\n  private static DEFAULT_SESSION_STRATEGY = new DefaultSessionStrategy();\n  private config: TConfig;\n  private stateDao: StateDao;\n  private sesionDao: SessionDao;\n  private sessionStrategy: SessionStrategy;\n  private debug: boolean;\n\n  /**\n   * Creates a new Lixa instance with the provided configuration.\n   * \n   * @remarks\n   * Providers can be passed inline in the configuration using the `provider` field.\n   * Provider resolution priority: inline custom provider \\> default providers \\> legacy registry.\n   * \n   * @param config - The configuration object containing provider settings and optional session strategy\n   * \n   * @throws Error when provider configuration is missing required fields\n   * @throws Error when provider implementation is missing required properties\n   * @throws Error when provider is not available and no inline implementation is provided\n   */\n  constructor(config: TConfig) {\n    this.config = config;\n    this.stateDao = config.stateDao || Lixa.LOCAL_STATE_CACHE;\n    this.sesionDao = config.sessionDao || Lixa.LOCAL_SESSION_CACHE;\n    this.sessionStrategy = config.sessionStrategy || Lixa.DEFAULT_SESSION_STRATEGY;\n    this.debug = config.debug || false;\n    \n    this.log('INFO', 'Init', 'Initializing Lixa instance', { \n      providers: Object.keys(config.providers),\n      debug: this.debug \n    });\n    \n    // Validate and extract providers from configuration\n    for (const [providerName, providerConfig] of Object.entries(config.providers)) {\n      const name = providerName.toLowerCase();\n      const typedConfig: ProviderConfig = providerConfig;\n      \n      // Validate provider configuration has required credentials\n      this.validateProviderConfig(providerName, typedConfig);\n      \n      // If provider config includes a custom provider implementation, validate it\n      if (typedConfig.provider) {\n        this.validateProviderImplementation(providerName, typedConfig.provider);\n        this.log('INFO', 'Init', `Registered inline provider: ${providerName}`);\n      } else {\n        // Check if it's available in default providers or legacy registry\n        if (!Lixa.DEFAULT_PROVIDERS.has(name) && !Lixa.CONFIGURED_PROVIDERS.has(name)) {\n          this.log('ERROR', 'Init', `Provider '${providerName}' not available`);\n          throw new Error(\n            `Provider '${providerName}' is not available. ` +\n            `Either import it from '@vunexa/lixa-providers' and include it in the configuration, ` +\n            `or provide a custom implementation using the 'provider' field: ` +\n            `{ provider: new CustomProvider(), clientId: '...', ... }`\n          );\n        }\n        this.log('INFO', 'Init', `Using registered provider: ${providerName}`);\n      }\n    }\n    \n    this.log('INFO', 'Init', 'Lixa instance initialized successfully');\n  }\n  \n  /**\n   * Validates that a provider configuration has all required credentials.\n   * \n   * @param name - The provider name\n   * @param config - The provider configuration\n   * @throws Error when required fields are missing or invalid\n   */\n  private validateProviderConfig(name: string, config: ProviderConfig): void {\n    const requiredFields: (keyof ProviderConfig)[] = ['clientId', 'clientSecret', 'redirectUri', 'scopes'];\n    const missingFields = requiredFields.filter(field => {\n      const value = config[field];\n      return value === undefined || value === null || (typeof value === 'string' && value.trim() === '');\n    });\n    \n    if (missingFields.length > 0) {\n      throw new Error(\n        `Provider '${name}' configuration is missing required fields: ${missingFields.join(', ')}`\n      );\n    }\n    \n    // Validate scopes is an array\n    if (!Array.isArray(config.scopes)) {\n      throw new Error(\n        `Provider '${name}' configuration error: 'scopes' must be an array of strings`\n      );\n    }\n    \n    if (config.scopes.length === 0) {\n      throw new Error(\n        `Provider '${name}' configuration error: 'scopes' array cannot be empty`\n      );\n    }\n  }\n  \n  /**\n   * Validates that a provider implementation has all required properties.\n   * \n   * @param name - The provider name\n   * @param provider - The provider implementation\n   * @throws Error when required properties are missing\n   */\n  private validateProviderImplementation(name: string, provider: IProvider): void {\n    const requiredProps: (keyof IProvider)[] = ['authorizationEndpoint', 'tokenEndpoint', 'userInfoEndpoint'];\n    const missingProps = requiredProps.filter(prop => {\n      const value = provider[prop];\n      return !value || typeof value !== 'string' || value.trim() === '';\n    });\n    \n    if (missingProps.length > 0) {\n      throw new Error(\n        `Provider '${name}' implementation is missing required properties: ${missingProps.join(', ')}. ` +\n        `All IProvider implementations must define: authorizationEndpoint, tokenEndpoint, and userInfoEndpoint.`\n      );\n    }\n  }\n\n  /**\n   * Structured debug logging with standardized format.\n   * \n   * @param level - Log level (INFO, WARN, ERROR)\n   * @param context - Context of the log (Init, Auth, Token, Session, State)\n   * @param message - Log message\n   * @param data - Optional data to log\n   * \n   * @remarks\n   * Format: [Lixa] [timestamp] [level] [context] message\n   * Only logs when debug mode is enabled.\n   */\n  private log(level: 'INFO' | 'WARN' | 'ERROR', context: 'Init' | 'Auth' | 'Token' | 'Session' | 'State', message: string, data?: Record<string, string | number | boolean | string[]>): void {\n    if (!this.debug) return;\n    \n    const timestamp = new Date().toISOString();\n    const prefix = `[Lixa] [${timestamp}] [${level}] [${context}]`;\n    \n    if (data !== undefined) {\n      console.log(`${prefix} ${message}`, data);\n    } else {\n      console.log(`${prefix} ${message}`);\n    }\n  }\n\n  /**\n   * Checks if a provider is configured for this instance.\n   * This is a type guard that narrows the provider type for use with getAuthUrl.\n   *\n   * @param provider - The provider name to check (case-insensitive)\n   * @returns True if the provider is configured, false otherwise\n   *\n   * @example\n   * ```typescript\n   * if (lixa.isProviderConfigured(provider)) {\n   *   // TypeScript now knows provider is a valid ConfiguredProviderKey\n   *   const authUrl = lixa.getAuthUrl(provider, state);\n   * }\n   * ```\n   */\n  public isProviderConfigured<T extends string>(provider: T): provider is T & ConfiguredProviderKey<TConfig> {\n    const providerType = provider.toLowerCase();\n    return this.config.providers.hasOwnProperty(providerType);\n  }\n  \n  /**\n   * Gets a provider implementation by name.\n   * Resolution priority: inline custom provider \\> default providers \\> legacy registry\n   * \n   * @param name - The provider name (case-insensitive)\n   * @param config - The provider configuration\n   * @returns The provider implementation\n   * @throws Error when provider is not found\n   */\n  private getProvider(name: string, config: ProviderConfig): IProvider {\n    // First check if provider is inline in config\n    if (config.provider) {\n      return config.provider;\n    }\n    \n    // Then check default providers\n    const lowerName = name.toLowerCase();\n    const defaultProvider = Lixa.DEFAULT_PROVIDERS.get(lowerName);\n    if (defaultProvider) {\n      return defaultProvider;\n    }\n    \n    // Finally check legacy registry for backward compatibility\n    const legacyProvider = Lixa.CONFIGURED_PROVIDERS.get(lowerName);\n    if (legacyProvider) {\n      return legacyProvider;\n    }\n    \n    throw new Error(\n      `Provider '${name}' not found. ` +\n      `Ensure the provider is included in the configuration with a 'provider' field, ` +\n      `or registered using Lixa.registerProvider().`\n    );\n  }\n\n  /**\n   * Registers custom OAuth providers for use with Lixa.\n   * \n   * @deprecated This method is maintained for backward compatibility.\n   * The recommended approach is to pass providers inline in the configuration:\n   * ```typescript\n   * const lixa = new Lixa({\n   *   providers: {\n   *     custom: {\n   *       provider: new CustomProvider(),\n   *       clientId: '...',\n   *       // ...\n   *     }\n   *   }\n   * });\n   * ```\n   *\n   * @param providerMap - A map of provider names to IProvider implementations\n   *\n   * @example\n   * Legacy usage (still supported):\n   * ```typescript\n   * class CustomProvider implements IProvider {\n   *   authorizationEndpoint = 'https://custom.com/oauth/authorize';\n   *   tokenEndpoint = 'https://custom.com/oauth/token';\n   *   userInfoEndpoint = 'https://custom.com/api/user';\n   * }\n   *\n   * Lixa.registerProvider({ custom: new CustomProvider() });\n   * ```\n   */\n  public static registerProvider<T extends Record<string, IProvider>>(providerMap: T): void {\n    Object.entries(providerMap).forEach(([key, providerImpl]) => {\n      Lixa.CONFIGURED_PROVIDERS.set(key.toLowerCase(), providerImpl);\n    });\n  }\n\n  /**\n   * Gets the list of registered provider names.\n   * \n   * @returns Array of registered provider names\n   */\n  public static getRegisteredProviders(): string[] {\n    return Array.from(Lixa.CONFIGURED_PROVIDERS.keys());\n  }\n\n  /**\n   * Creates a type-safe configuration.\n   * \n   * @deprecated This method is maintained for backward compatibility.\n   * You can now pass configuration directly to the Lixa constructor without this helper.\n   * \n   * @param config - Configuration object with provider settings\n   * @returns The same configuration object with type safety\n   * \n   * @example\n   * New approach (recommended):\n   * ```typescript\n   * const lixa = new Lixa({\n   *   providers: {\n   *     google: {\n   *       provider: new GoogleProvider(),\n   *       clientId: '...',\n   *       // ...\n   *     }\n   *   }\n   * });\n   * ```\n   */\n  public static createConfig<T extends Record<string, ProviderConfig>>(\n    config: LixaConfig<T> & { providers: T }\n  ): LixaConfig<T> {\n    return config;\n  }\n\n  /**\n   * Generates a cryptographically secure random state parameter for OAuth flows.\n   *\n   * @returns A 32-character hexadecimal string\n   *\n   * @remarks\n   * The state parameter is used to prevent CSRF attacks in OAuth flows.\n   */\n  public static generateRandomState(): string {\n    return randomBytes(16).toString(\"hex\");\n  }\n\n  /**\n   * Generates a cryptographically secure code verifier for PKCE flows.\n   *\n   * @returns A 64-character hexadecimal string (32 random bytes encoded as hex)\n   *\n   * @remarks\n   * This method implements the code verifier generation as specified in RFC 7636 (PKCE).\n   * \n   * **PKCE (Proof Key for Code Exchange)** is a security extension to OAuth 2.0 that\n   * prevents authorization code interception attacks. It's especially important for\n   * public clients (mobile apps, SPAs) but is recommended for all OAuth flows.\n   * \n   * **Generation methodology:**\n   * 1. Generate 32 cryptographically random bytes using Node.js crypto.randomBytes()\n   * 2. Encode the bytes as a hexadecimal string (64 characters)\n   * 3. The verifier is stored securely and used later in the token exchange\n   * \n   * **RFC 7636 Requirements:**\n   * - Minimum length: 43 characters\n   * - Maximum length: 128 characters\n   * - Character set: [A-Z] / [a-z] / [0-9] / \"-\" / \".\" / \"_\" / \"~\"\n   * - This implementation produces 64 hex characters, meeting the requirements\n   * \n   * The code verifier is:\n   * - Generated when creating the authorization URL\n   * - Stored in state cache with the state parameter\n   * - Retrieved during callback handling\n   * - Sent to the token endpoint to prove the client's identity\n   * \n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7636 | RFC 7636 - PKCE}\n   * @see buildCodeChallenge for the corresponding challenge generation\n   * \n   * @internal\n   */\n  private static generateCodeVerifier(): string {\n    return randomBytes(32).toString(\"hex\");\n  }\n\n  /**\n   * Generates a code challenge from a code verifier for PKCE flows.\n   *\n   * @param codeVerifier - The code verifier string (64 hex characters)\n   * @returns A base64url-encoded SHA-256 hash of the code verifier\n   *\n   * @remarks\n   * This method implements the code challenge generation as specified in RFC 7636 (PKCE)\n   * using the S256 (SHA-256) transformation method.\n   * \n   * **Challenge generation methodology:**\n   * 1. Hash the code verifier using SHA-256\n   * 2. Encode the hash as base64\n   * 3. Convert to base64url format (RFC 4648):\n   *    - Replace '+' with '-'\n   *    - Replace '/' with '_'\n   *    - Remove trailing '=' padding\n   * \n   * **PKCE Flow:**\n   * 1. Client generates code_verifier (random string)\n   * 2. Client creates code_challenge = BASE64URL(SHA256(code_verifier))\n   * 3. Client sends code_challenge to authorization endpoint\n   * 4. Authorization server stores the code_challenge\n   * 5. Client sends code_verifier to token endpoint\n   * 6. Authorization server verifies: SHA256(code_verifier) == code_challenge\n   * \n   * **Security Benefits:**\n   * - Prevents authorization code interception attacks\n   * - Even if an attacker intercepts the authorization code, they cannot\n   *   exchange it for tokens without the original code_verifier\n   * - The challenge is sent in the authorization request (public)\n   * - The verifier is sent in the token request (should be kept secret)\n   * \n   * **RFC 7636 Transformation Methods:**\n   * - plain: code_challenge = code_verifier (not recommended)\n   * - S256: code_challenge = BASE64URL(SHA256(code_verifier)) (recommended, used here)\n   * \n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7636 | RFC 7636 - PKCE}\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc4648#section-5 | RFC 4648 - Base64url Encoding}\n   * @see generateCodeVerifier for the verifier generation\n   * \n   * @internal\n   */\n  private static buildCodeChallenge(codeVerifier: string): string {\n    const hash = crypto\n      .createHash(\"sha256\")\n      .update(codeVerifier)\n      .digest(\"base64\");\n\n    // Convert to base64url (RFC 4648 Section 5)\n    return hash.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n  }\n\n  /**\n   * Generates the authorization URL for the specified provider.\n   *\n   * @param provider - The provider name (must be a configured provider key)\n   * @param state - The state parameter for CSRF protection\n   * @returns The complete authorization URL to redirect users to\n   *\n   * @throws Error when the provider is not configured\n   *\n   * @example\n   * ```typescript\n   * const state = Lixa.generateRandomState();\n   * const authUrl = lixa.getAuthUrl('google', state);\n   * res.redirect(authUrl);\n   * ```\n   */\n  public getAuthUrl(provider: ConfiguredProviderKey<TConfig> | string, state: string): string {\n    const providerType = String(provider).toLowerCase();\n    \n    this.log('INFO', 'Auth', `Generating authorization URL for provider: ${providerType}`);\n    \n    const providerConfig = this.findProviderByType(providerType);\n\n    if (!providerConfig) {\n      this.log('ERROR', 'Auth', `Provider '${String(provider)}' is not configured`);\n      throw new Error(`Provider '${String(provider)}' is not configured in this Lixa instance`);\n    }\n\n    const providerImpl = this.getProvider(providerType, providerConfig);\n\n    const codeVerifier = Lixa.generateCodeVerifier();\n    const codeChallenge = Lixa.buildCodeChallenge(codeVerifier);\n\n    this.log('INFO', 'State', `Saving state for provider: ${providerType}`, { state });\n\n    // Cache the state paramaeter with TTL of 5 minutes (300 seconds)\n    // We dont care about value. we are onl interested in key existence\n    this.stateDao.saveState(\n      state,\n      {\n        createdAt: Date.now(),\n        provider: providerType,\n        codeVerifier,\n      },\n      300 // 5 minutes in seconds\n    );\n\n    const params = new URLSearchParams({\n      client_id: providerConfig.clientId,\n      redirect_uri: providerConfig.redirectUri,\n      scope: providerConfig.scopes.join(\" \"),\n      state,\n      response_type: \"code\",\n      code_challenge: codeChallenge,\n      code_challenge_method: \"S256\",\n      ...providerConfig.extraConfig,\n    });\n\n    const authUrl = `${providerImpl.authorizationEndpoint}?${params.toString()}`;\n    this.log('INFO', 'Auth', `Authorization URL generated successfully`, { \n      provider: providerType,\n      endpoint: providerImpl.authorizationEndpoint \n    });\n\n    return authUrl;\n  }\n\n  /**\n   * Handles the OAuth callback and creates a user session.\n   *\n   * @param provider - The provider name (must be a configured provider key)\n   * @param code - The authorization code from the provider\n   * @param state - The state parameter for validation\n   * @returns A Promise that resolves to the session ID\n   *\n   * @throws Error when code or state is missing/invalid, or provider is not configured\n   *\n   * @example\n   * ```typescript\n   * const sessionId = await lixa.handleCallback({\n   *   provider: 'google',\n   *   code: req.query.code,\n   *   state: req.query.state\n   * });\n   * ```\n   */\n  public async handleCallback({\n    provider,\n    code,\n    state,\n  }: {\n    provider: ConfiguredProviderKey<TConfig> | string;\n    code: string;\n    state?: string;\n  }): Promise<string> {\n    const providerType = String(provider).toLowerCase();\n    this.log('INFO', 'Auth', `Handling OAuth callback for provider: ${providerType}`);\n\n    if (!code || code.trim() === \"\") {\n      this.log('ERROR', 'Auth', 'Invalid or missing authorization code in callback');\n      throw new Error(\"Invalid or missing code in callback\");\n    }\n\n    if (!state || state.trim() === \"\") {\n      this.log('ERROR', 'Auth', 'Invalid or missing state in callback');\n      throw new Error(\"Invalid or missing state in callback\");\n    }\n\n    this.log('INFO', 'State', 'Validating state parameter', { state });\n\n    //Validate state here\n    const cachedState = await this.stateDao.getState(state);\n    if (!cachedState) {\n      this.log('ERROR', 'State', 'State validation failed: state not found or expired', { state });\n      throw new Error(\"Invalid or expired state\");\n    }\n    \n    this.log('INFO', 'State', 'State validated successfully, removing from cache');\n    // State is valid, remove it from cache to prevent reuse\n    await this.stateDao.deleteState(state);\n\n    //Get code verifier from cached state\n    const codeVerifier = cachedState.codeVerifier;\n\n    const providerConfig = this.findProviderByType(providerType);\n\n    if (!providerConfig) {\n      this.log('ERROR', 'Auth', `Provider '${String(provider)}' is not configured`);\n      throw new Error(`Provider '${String(provider)}' is not configured in this Lixa instance`);\n    }\n\n    const providerImpl = this.getProvider(providerType, providerConfig);\n\n    this.log('INFO', 'Token', `Exchanging authorization code for tokens`, { provider: providerType });\n\n    // Exchange code for tokens and fetch user info here.\n    const tokens = await this.exchangeCodeForToken(\n      code,\n      providerConfig,\n      providerImpl,\n      codeVerifier\n    );\n\n    this.log('INFO', 'Token', 'Token exchange successful');\n    this.log('INFO', 'Session', 'Creating user session');\n    \n    // Create provider metadata for session strategy\n    const providerMetadata: ProviderMetadata = {\n      name: providerType,\n      endpoints: {\n        authorization: providerImpl.authorizationEndpoint,\n        token: providerImpl.tokenEndpoint,\n        userInfo: providerImpl.userInfoEndpoint\n      }\n    };\n    \n    const session = await this.sessionStrategy.createSession(tokens, providerMetadata);\n\n    // Generate unique session ID\n    const sessionId = randomBytes(32).toString(\"hex\");\n\n    this.log('INFO', 'Session', 'Storing session', { sessionId });\n    // Store session with 24 hour TTL (86400 seconds)\n    await this.sesionDao.saveSession(sessionId, session, 86400);\n\n    this.log('INFO', 'Session', 'Session created successfully', { sessionId });\n\n    return sessionId;\n  }\n\n  public async fetchSessionInfo(sessionId: string): Promise<Session | null> {\n    return await this.sesionDao.getSession<Session>(sessionId);\n  }\n\n  private async exchangeCodeForToken(\n    code: string,\n    providerConfig: ProviderConfig,\n    providerImpl: IProvider,\n    codeVerifier: string\n  ): Promise<OAuthTokenResponse> {\n    // Build the request body\n    const body: Record<string, string> = {\n      client_id: providerConfig.clientId,\n      client_secret: providerConfig.clientSecret,\n      code,\n      redirect_uri: providerConfig.redirectUri,\n      grant_type: \"authorization_code\",\n    };\n\n    if (codeVerifier) {\n      body.code_verifier = codeVerifier;\n    }\n    const params = new URLSearchParams(body);\n\n    this.log('INFO', 'Token', 'Sending token exchange request', { \n      endpoint: providerImpl.tokenEndpoint \n    });\n    \n    const response = await fetch(providerImpl.tokenEndpoint, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/x-www-form-urlencoded\",\n        Accept: \"application/json\",\n      },\n      body: params.toString(),\n    });\n\n    if (!response.ok) {\n      const errorBody = await response.text();\n      this.log('ERROR', 'Token', 'Token exchange failed', { \n        status: response.status, \n        statusText: response.statusText,\n        error: errorBody \n      });\n      throw new Error(\n        `Token exchange failed: ${response.status} ${response.statusText} - ${errorBody}`\n      );\n    }\n\n    this.log('INFO', 'Token', 'Token exchange response received successfully');\n    return response.json();\n  }\n\n  private findProviderByType(providerType: string): ProviderConfig | undefined {\n    // Use Object.entries to safely iterate and find the provider\n    for (const [key, value] of Object.entries(this.config.providers)) {\n      if (key.toLowerCase() === providerType.toLowerCase()) {\n        return value;\n      }\n    }\n    return undefined;\n  }\n}\n\nexport { Lixa };\n","import NodeCache from 'node-cache';\nimport { StateDao, StateData } from \"./types\";\n\nclass LocalStateCache implements StateDao {\n  private cache: NodeCache;\n\n  constructor(defaultTtlSeconds: number = 600) {\n    this.cache = new NodeCache({ stdTTL: defaultTtlSeconds });\n  }\n\n  async saveState(state: string, data: StateData, expiresInSeconds: number): Promise<void> {\n    this.cache.set(state, data, expiresInSeconds);\n  }\n\n  async getState(state: string): Promise<StateData | null> {\n    return this.cache.get<StateData>(state) || null;\n  }\n\n  async deleteState(state: string): Promise<void> {\n    this.cache.del(state);\n  }\n}\n\nexport { LocalStateCache };\n","import NodeCache from 'node-cache';\nimport { SessionDao } from \"./types\";\nimport type { Session } from \"../models/session\";\n\nclass LocalSessionCache implements SessionDao {\n  private cache: NodeCache;\n\n  constructor(defaultTtlSeconds: number = 600) {\n    this.cache = new NodeCache({ stdTTL: defaultTtlSeconds });\n  }\n\n  async saveSession<T extends Session>(state: string, data: T, expiresInSeconds: number): Promise<void> {\n    this.cache.set(state, data, expiresInSeconds);\n  }\n\n  async getSession<T extends Session>(state: string): Promise<T | null> {\n    return this.cache.get<T>(state) || null;\n  }\n\n  async deleteSession(state: string): Promise<void> {\n    this.cache.del(state);\n  }\n}\n\nexport { LocalSessionCache };\n","/**\n * OAuth 2.0 token response structure.\n * Based on RFC 6749 Section 5.1 and OpenID Connect Core 1.0 Section 3.1.3.3\n * \n * @remarks\n * This interface represents the standard OAuth 2.0 token response with\n * optional OpenID Connect extensions. All OAuth providers should return\n * at minimum the required fields (access_token, token_type).\n * \n * @public\n */\nexport interface OAuthTokenResponse {\n  /** \n   * OAuth 2.0 access token (required).\n   * Used to access protected resources on behalf of the user.\n   */\n  access_token: string;\n  \n  /** \n   * Token type (required).\n   * Typically \"Bearer\" for OAuth 2.0.\n   */\n  token_type: string;\n  \n  /** \n   * Token expiration time in seconds (optional).\n   * Time until the access token expires.\n   */\n  expires_in?: number;\n  \n  /** \n   * OAuth 2.0 refresh token (optional).\n   * Used to obtain new access tokens without re-authentication.\n   */\n  refresh_token?: string;\n  \n  /** \n   * Granted OAuth scopes (optional).\n   * Space-separated list of scopes that were granted.\n   */\n  scope?: string;\n  \n  /** \n   * OpenID Connect ID token (optional).\n   * JWT containing user identity claims (only present for OIDC providers).\n   */\n  id_token?: string;\n  \n  /**\n   * Additional provider-specific fields.\n   * Some providers may include extra fields like user_id, account_id, etc.\n   */\n  [key: string]: string | number | boolean | undefined;\n}\n\n/**\n * Represents a user session after successful OAuth authentication.\n * \n * @remarks\n * The Session object is returned by SessionStrategy.createSession() and contains\n * the session identifier and any additional data needed for your application.\n * \n * The structure is intentionally flexible to support various session management\n * approaches (JWT tokens, session IDs, etc.).\n *\n * @public\n */\nexport interface Session<TRaw = OAuthTokenResponse> {\n  /** \n   * The session token or identifier.\n   * This could be an access token, a session ID, a JWT, or any other identifier\n   * that your application uses to track authenticated users.\n   */\n  token: string;\n  \n  /** \n   * Raw session data.\n   * Contains the complete OAuth token response and any additional data\n   * your SessionStrategy adds (user info, database IDs, etc.).\n   * \n   * Typical OAuth token data includes:\n   * - access_token: OAuth access token\n   * - refresh_token: OAuth refresh token (if requested)\n   * - expires_in: Token expiration time in seconds\n   * - token_type: Token type (usually \"Bearer\")\n   * - id_token: OpenID Connect ID token (if using OIDC)\n   * - scope: Granted scopes\n   */\n  raw: TRaw;\n}\n\n/**\n * Provider metadata passed to session strategy.\n * Contains provider name and endpoints for user info extraction.\n * \n * @public\n */\nexport interface ProviderMetadata {\n  /** The provider name (e.g., 'google', 'github') */\n  name: string;\n  \n  /** Provider endpoints */\n  endpoints: {\n    /** Authorization endpoint URL */\n    authorization: string;\n    /** Token endpoint URL */\n    token: string;\n    /** UserInfo endpoint URL */\n    userInfo: string;\n  };\n}\n\n/**\n * Strategy interface for custom session creation.\n * \n * @remarks\n * Implement this interface to customize how OAuth tokens are converted into\n * application sessions. This is where you typically:\n * - Decode ID tokens (for OpenID Connect)\n * - Look up or create users in your database\n * - Generate session identifiers\n * - Store session data\n * - Add custom claims or metadata\n * \n * The default implementation (DefaultSessionStrategy) simply extracts the\n * access token and returns it as the session token.\n * \n * @example\n * Custom session strategy with database integration:\n * ```typescript\n * interface CustomSessionData {\n *   userId: string;\n *   email: string;\n *   provider: string;\n *   accessToken: string;\n *   refreshToken?: string;\n *   expiresAt: number;\n * }\n * \n * class DatabaseSessionStrategy implements SessionStrategy {\n *   constructor(private db: Database) {}\n *   \n *   async createSession(oauthContext: OAuthContext): Promise<Session<CustomSessionData>> {\n *     // User info is already extracted by Lixa!\n *     const { userInfo, provider, tokenData } = oauthContext;\n *     \n *     // Create or update user in database\n *     const user = await this.db.users.upsert({\n *       email: userInfo.email,\n *       name: userInfo.name,\n *       picture: userInfo.picture\n *     });\n *     \n *     // Generate session ID\n *     const sessionId = generateSecureId();\n *     \n *     // Store session with tokens\n *     await this.db.sessions.create({\n *       id: sessionId,\n *       userId: user.id,\n *       accessToken: tokenData.access_token,\n *       refreshToken: tokenData.refresh_token,\n *       expiresAt: new Date(Date.now() + (tokenData.expires_in || 3600) * 1000)\n *     });\n *     \n *     return {\n *       token: sessionId,\n *       raw: {\n *         userId: user.id,\n *         email: user.email,\n *         provider,\n *         accessToken: tokenData.access_token,\n *         refreshToken: tokenData.refresh_token,\n *         expiresAt: Date.now() + (tokenData.expires_in || 3600) * 1000\n *       }\n *     };\n *   }\n * }\n * ```\n *\n * @public\n */\nexport interface SessionStrategy {\n  /**\n   * Creates a session from OAuth token data.\n   * \n   * @param tokenData - The token data received from the OAuth provider's token endpoint\n   * @param providerMetadata - Provider metadata including name and endpoints\n   * @returns A Promise that resolves to a Session object\n   * \n   * @remarks\n   * This method is called after successfully exchanging the authorization code\n   * for tokens. You receive:\n   * \n   * Token Data:\n   * - access_token: OAuth access token\n   * - refresh_token: OAuth refresh token (optional)\n   * - expires_in: Token expiration time in seconds\n   * - token_type: Token type (usually \"Bearer\")\n   * - id_token: OpenID Connect ID token (for OIDC providers)\n   * - scope: Granted scopes\n   * \n   * Provider Metadata:\n   * - name: The provider name (e.g., 'google', 'github')\n   * - endpoints: Provider endpoints (authorization, token, userInfo)\n   * \n   * The providerMetadata.endpoints.userInfo can be used with extractUserInfo():\n   * ```typescript\n   * import { extractUserInfo } from '@vunexa/lixa';\n   * \n   * const { userInfo } = await extractUserInfo(\n   *   tokenData,\n   *   providerMetadata.endpoints.userInfo,\n   *   providerMetadata.name\n   * );\n   * ```\n   * \n   * Your session strategy should:\n   * 1. Extract user info (using extractUserInfo or decode ID token)\n   * 2. Create or lookup users in your database\n   * 3. Generate session identifiers\n   * 4. Store session data as needed\n   * 5. Return a Session object with token and raw data\n   * \n   * @throws \\{Error\\} If session creation fails (e.g., database error, invalid token)\n   * \n   * @example\n   * Simple implementation:\n   * ```typescript\n   * async createSession(tokenData: OAuthTokenResponse): Promise<Session> {\n   *   return {\n   *     token: tokenData.access_token,\n   *     raw: tokenData\n   *   };\n   * }\n   * ```\n   * \n   * @example\n   * Database integration with user info extraction:\n   * ```typescript\n   * async createSession(\n   *   tokenData: OAuthTokenResponse,\n   *   providerMetadata: ProviderMetadata\n   * ): Promise<Session> {\n   *   // Extract user info from token or userinfo endpoint\n   *   const { userInfo } = await extractUserInfo(\n   *     tokenData,\n   *     providerMetadata.endpoints.userInfo,\n   *     providerMetadata.name\n   *   );\n   *   \n   *   // Create or update user in database\n   *   const user = await db.users.upsert({\n   *     email: userInfo.email,\n   *     name: userInfo.name\n   *   });\n   *   \n   *   return {\n   *     token: generateSessionId(),\n   *     raw: { userId: user.id, provider: providerMetadata.name, ...tokenData }\n   *   };\n   * }\n   * ```\n   */\n  createSession(tokenData: OAuthTokenResponse, providerMetadata: ProviderMetadata): Promise<Session>;\n}\n\n/**\n * Default session strategy that works with any OAuth provider.\n * Extracts common token information and creates a standardized session.\n *\n * @public\n */\nexport class DefaultSessionStrategy implements SessionStrategy {\n  /**\n   * Creates a session from OAuth token data.\n   * Handles common OAuth token formats and extracts the access token.\n   *\n   * @param tokenData - The token data received from the OAuth provider\n   * @param providerMetadata - Provider metadata (not used in default implementation)\n   * @returns A Promise that resolves to a Session object\n   */\n  async createSession(tokenData: OAuthTokenResponse, providerMetadata: ProviderMetadata): Promise<Session> {\n    if (!tokenData.access_token || typeof tokenData.access_token !== 'string') {\n      throw new Error('No valid access token found in OAuth response');\n    }\n\n    return {\n      token: tokenData.access_token,\n      raw: tokenData,\n    };\n  }\n}","import type { OAuthTokenResponse } from \"../models/session\";\n\n/**\n * User information extracted from OAuth provider\n * \n * @public\n */\nexport interface UserInfo {\n  email: string;\n  id?: string | undefined;\n  sub?: string | undefined;\n  given_name?: string | undefined;\n  family_name?: string | undefined;\n  name?: string | undefined;\n  picture?: string | undefined;\n  email_verified?: boolean | undefined;\n  iss?: string | undefined;\n}\n\n/**\n * Decode JWT ID token to extract user information\n * \n * @public\n */\nexport function decodeIdToken(idToken: string): UserInfo {\n  const parts = idToken.split('.');\n  if (parts.length !== 3) {\n    throw new Error('Invalid ID token format: expected 3 parts separated by dots');\n  }\n  \n  const base64Payload = parts[1];\n  if (!base64Payload) {\n    throw new Error('Invalid ID token: missing payload section');\n  }\n  const payload = Buffer.from(base64Payload, 'base64').toString();\n  \n  try {\n    return JSON.parse(payload);\n  } catch (error) {\n    throw new Error('Invalid ID token: failed to parse payload JSON');\n  }\n}\n\n/**\n * Determine OAuth provider from ID token issuer\n * \n * @public\n */\nexport function determineProviderFromIssuer(userInfo: UserInfo): string | null {\n  if (!userInfo.iss) {\n    return null;\n  }\n  \n  const issuer = userInfo.iss.toLowerCase();\n  \n  if (issuer.includes('accounts.google.com')) {\n    return 'google';\n  }\n  \n  if (issuer.includes('github')) {\n    return 'github';\n  }\n  \n  // Unknown issuer\n  return null;\n}\n\n/**\n * Fetch user info from OAuth provider's userinfo endpoint\n * \n * @param accessToken - OAuth access token\n * @param userInfoEndpoint - The provider's userinfo endpoint URL\n * @param providerName - Provider name for error messages (optional)\n * @returns User information from the provider\n * \n * @throws Error if the request fails or response is invalid\n * \n * @public\n */\nexport async function fetchUserInfo(\n  accessToken: string, \n  userInfoEndpoint: string,\n  providerName?: string\n): Promise<UserInfo> {\n  const response = await fetch(userInfoEndpoint, {\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      Accept: 'application/json',\n    },\n  });\n  \n  if (!response.ok) {\n    const providerLabel = providerName ? ` from ${providerName}` : '';\n    throw new Error(`Failed to fetch user info${providerLabel}: ${response.status} ${response.statusText}`);\n  }\n  \n  const data = await response.json();\n  if (!data || typeof data !== 'object' || !('email' in data) || typeof data.email !== 'string') {\n    const providerLabel = providerName ? ` from ${providerName}` : '';\n    throw new Error(`Invalid user info response${providerLabel}: missing or invalid email`);\n  }\n  \n  return {\n    email: data.email,\n    id: 'id' in data ? String(data.id) : undefined,\n    sub: 'sub' in data ? String(data.sub) : undefined,\n    given_name: 'given_name' in data ? String(data.given_name) : undefined,\n    family_name: 'family_name' in data ? String(data.family_name) : undefined,\n    name: 'name' in data ? String(data.name) : undefined,\n    picture: 'picture' in data ? String(data.picture) : undefined,\n    email_verified: 'email_verified' in data ? Boolean(data.email_verified) : undefined,\n    iss: 'iss' in data ? String(data.iss) : undefined,\n  };\n}\n\n/**\n * Extract user info from OAuth token data\n * \n * @param tokenData - OAuth token response from provider\n * @param userInfoEndpoint - Optional userinfo endpoint URL (required if no ID token)\n * @param providerName - Optional provider name for error messages\n * @returns User info and detected provider name\n * \n * @remarks\n * This function attempts to extract user information in the following order:\n * 1. Decode ID token if present (preferred method)\n * 2. Fetch from userinfo endpoint using access token (requires userInfoEndpoint parameter)\n * \n * Provider detection:\n * - Primary: Extract from ID token issuer field\n * - Fallback: Use provider field in token data (if present)\n * - Fallback: Use providerName parameter\n * - Throws error if provider cannot be determined\n * \n * @throws Error if no ID token or access token is available\n * @throws Error if provider cannot be determined\n * @throws Error if userInfoEndpoint is required but not provided\n * \n * @example\n * With ID token (provider auto-detected):\n * ```typescript\n * const { userInfo, provider } = await extractUserInfo(tokenData);\n * console.log(`User ${userInfo.email} authenticated via ${provider}`);\n * ```\n * \n * @example\n * Without ID token (requires userInfoEndpoint):\n * ```typescript\n * const { userInfo, provider } = await extractUserInfo(\n *   tokenData,\n *   'https://api.example.com/user',\n *   'custom'\n * );\n * ```\n * \n * @public\n */\nexport async function extractUserInfo(\n  tokenData: OAuthTokenResponse,\n  userInfoEndpoint?: string,\n  providerName?: string\n): Promise<{ userInfo: UserInfo; provider: string }> {\n  let userInfo: UserInfo;\n  let provider: string | null = null;\n  \n  if (tokenData.id_token) {\n    // Decode ID token to get user info\n    userInfo = decodeIdToken(tokenData.id_token);\n    \n    // Try to determine provider from issuer\n    provider = determineProviderFromIssuer(userInfo);\n    \n    // Fallback to provided provider name\n    if (!provider && providerName) {\n      provider = providerName;\n    }\n  } else if (tokenData.access_token) {\n    // Without ID token, we need to know which provider to fetch from\n    // Check if provider info is in the token data (custom field)\n    if ('provider' in tokenData && typeof tokenData.provider === 'string') {\n      provider = tokenData.provider;\n    } else if (providerName) {\n      provider = providerName;\n    }\n    \n    if (!provider) {\n      throw new Error(\n        'Cannot determine OAuth provider: No ID token with issuer information, ' +\n        'no provider field in token data, and no providerName provided. Unable to fetch user info.'\n      );\n    }\n    \n    if (!userInfoEndpoint) {\n      throw new Error(\n        `Cannot fetch user info for provider '${provider}': No ID token available and no userInfoEndpoint provided. ` +\n        'Either ensure the provider returns an ID token or provide the userInfoEndpoint parameter.'\n      );\n    }\n    \n    // Fetch user info from provider's API\n    userInfo = await fetchUserInfo(tokenData.access_token, userInfoEndpoint, provider);\n  } else {\n    throw new Error('No ID token or access token available to fetch user info');\n  }\n  \n  // Final provider validation\n  if (!provider) {\n    throw new Error(\n      'Cannot determine OAuth provider: ID token issuer not recognized and no provider name provided.'\n    );\n  }\n  \n  return { userInfo, provider };\n}\n"],"mappings":";AAAA,SAAS,mBAAmB;;;ACA5B,OAAO,eAAe;AAGtB,IAAM,kBAAN,MAA0C;AAAA,EAChC;AAAA,EAER,YAAY,oBAA4B,KAAK;AAC3C,SAAK,QAAQ,IAAI,UAAU,EAAE,QAAQ,kBAAkB,CAAC;AAAA,EAC1D;AAAA,EAEA,MAAM,UAAU,OAAe,MAAiB,kBAAyC;AACvF,SAAK,MAAM,IAAI,OAAO,MAAM,gBAAgB;AAAA,EAC9C;AAAA,EAEA,MAAM,SAAS,OAA0C;AACvD,WAAO,KAAK,MAAM,IAAe,KAAK,KAAK;AAAA,EAC7C;AAAA,EAEA,MAAM,YAAY,OAA8B;AAC9C,SAAK,MAAM,IAAI,KAAK;AAAA,EACtB;AACF;;;ADhBA,OAAO,YAAY;;;AELnB,OAAOA,gBAAe;AAItB,IAAM,oBAAN,MAA8C;AAAA,EACpC;AAAA,EAER,YAAY,oBAA4B,KAAK;AAC3C,SAAK,QAAQ,IAAIA,WAAU,EAAE,QAAQ,kBAAkB,CAAC;AAAA,EAC1D;AAAA,EAEA,MAAM,YAA+B,OAAe,MAAS,kBAAyC;AACpG,SAAK,MAAM,IAAI,OAAO,MAAM,gBAAgB;AAAA,EAC9C;AAAA,EAEA,MAAM,WAA8B,OAAkC;AACpE,WAAO,KAAK,MAAM,IAAO,KAAK,KAAK;AAAA,EACrC;AAAA,EAEA,MAAM,cAAc,OAA8B;AAChD,SAAK,MAAM,IAAI,KAAK;AAAA,EACtB;AACF;;;AC2PO,IAAM,yBAAN,MAAwD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS7D,MAAM,cAAc,WAA+B,kBAAsD;AACvG,QAAI,CAAC,UAAU,gBAAgB,OAAO,UAAU,iBAAiB,UAAU;AACzE,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,WAAO;AAAA,MACL,OAAO,UAAU;AAAA,MACjB,KAAK;AAAA,IACP;AAAA,EACF;AACF;;;AHlOA,IAAM,OAAN,MAAM,MAA8E;AAAA,EAClF,OAAe,oBAA4C,oBAAI,IAAI;AAAA,EACnE,OAAe,uBAA+C,oBAAI,IAAI;AAAA;AAAA,EACtE,OAAe,oBAAoB,IAAI,gBAAgB;AAAA,EACvD,OAAe,sBAAsB,IAAI,kBAAkB;AAAA,EAC3D,OAAe,2BAA2B,IAAI,uBAAuB;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeR,YAAY,QAAiB;AAC3B,SAAK,SAAS;AACd,SAAK,WAAW,OAAO,YAAY,MAAK;AACxC,SAAK,YAAY,OAAO,cAAc,MAAK;AAC3C,SAAK,kBAAkB,OAAO,mBAAmB,MAAK;AACtD,SAAK,QAAQ,OAAO,SAAS;AAE7B,SAAK,IAAI,QAAQ,QAAQ,8BAA8B;AAAA,MACrD,WAAW,OAAO,KAAK,OAAO,SAAS;AAAA,MACvC,OAAO,KAAK;AAAA,IACd,CAAC;AAGD,eAAW,CAAC,cAAc,cAAc,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AAC7E,YAAM,OAAO,aAAa,YAAY;AACtC,YAAM,cAA8B;AAGpC,WAAK,uBAAuB,cAAc,WAAW;AAGrD,UAAI,YAAY,UAAU;AACxB,aAAK,+BAA+B,cAAc,YAAY,QAAQ;AACtE,aAAK,IAAI,QAAQ,QAAQ,+BAA+B,YAAY,EAAE;AAAA,MACxE,OAAO;AAEL,YAAI,CAAC,MAAK,kBAAkB,IAAI,IAAI,KAAK,CAAC,MAAK,qBAAqB,IAAI,IAAI,GAAG;AAC7E,eAAK,IAAI,SAAS,QAAQ,aAAa,YAAY,iBAAiB;AACpE,gBAAM,IAAI;AAAA,YACR,aAAa,YAAY;AAAA,UAI3B;AAAA,QACF;AACA,aAAK,IAAI,QAAQ,QAAQ,8BAA8B,YAAY,EAAE;AAAA,MACvE;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,QAAQ,wCAAwC;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,uBAAuB,MAAc,QAA8B;AACzE,UAAM,iBAA2C,CAAC,YAAY,gBAAgB,eAAe,QAAQ;AACrG,UAAM,gBAAgB,eAAe,OAAO,WAAS;AACnD,YAAM,QAAQ,OAAO,KAAK;AAC1B,aAAO,UAAU,UAAa,UAAU,QAAS,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,IACjG,CAAC;AAED,QAAI,cAAc,SAAS,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI,+CAA+C,cAAc,KAAK,IAAI,CAAC;AAAA,MAC1F;AAAA,IACF;AAGA,QAAI,CAAC,MAAM,QAAQ,OAAO,MAAM,GAAG;AACjC,YAAM,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAEA,QAAI,OAAO,OAAO,WAAW,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,+BAA+B,MAAc,UAA2B;AAC9E,UAAM,gBAAqC,CAAC,yBAAyB,iBAAiB,kBAAkB;AACxG,UAAM,eAAe,cAAc,OAAO,UAAQ;AAChD,YAAM,QAAQ,SAAS,IAAI;AAC3B,aAAO,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,IACjE,CAAC;AAED,QAAI,aAAa,SAAS,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI,oDAAoD,aAAa,KAAK,IAAI,CAAC;AAAA,MAE9F;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcQ,IAAI,OAAkC,SAA0D,SAAiB,MAAmE;AAC1L,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,UAAM,SAAS,WAAW,SAAS,MAAM,KAAK,MAAM,OAAO;AAE3D,QAAI,SAAS,QAAW;AACtB,cAAQ,IAAI,GAAG,MAAM,IAAI,OAAO,IAAI,IAAI;AAAA,IAC1C,OAAO;AACL,cAAQ,IAAI,GAAG,MAAM,IAAI,OAAO,EAAE;AAAA,IACpC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBO,qBAAuC,UAA6D;AACzG,UAAM,eAAe,SAAS,YAAY;AAC1C,WAAO,KAAK,OAAO,UAAU,eAAe,YAAY;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,YAAY,MAAc,QAAmC;AAEnE,QAAI,OAAO,UAAU;AACnB,aAAO,OAAO;AAAA,IAChB;AAGA,UAAM,YAAY,KAAK,YAAY;AACnC,UAAM,kBAAkB,MAAK,kBAAkB,IAAI,SAAS;AAC5D,QAAI,iBAAiB;AACnB,aAAO;AAAA,IACT;AAGA,UAAM,iBAAiB,MAAK,qBAAqB,IAAI,SAAS;AAC9D,QAAI,gBAAgB;AAClB,aAAO;AAAA,IACT;AAEA,UAAM,IAAI;AAAA,MACR,aAAa,IAAI;AAAA,IAGnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiCA,OAAc,iBAAsD,aAAsB;AACxF,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,YAAY,MAAM;AAC3D,YAAK,qBAAqB,IAAI,IAAI,YAAY,GAAG,YAAY;AAAA,IAC/D,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,yBAAmC;AAC/C,WAAO,MAAM,KAAK,MAAK,qBAAqB,KAAK,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,OAAc,aACZ,QACe;AACf,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,OAAc,sBAA8B;AAC1C,WAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoCA,OAAe,uBAA+B;AAC5C,WAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6CA,OAAe,mBAAmB,cAA8B;AAC9D,UAAM,OAAO,OACV,WAAW,QAAQ,EACnB,OAAO,YAAY,EACnB,OAAO,QAAQ;AAGlB,WAAO,KAAK,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBO,WAAW,UAAmD,OAAuB;AAC1F,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAElD,SAAK,IAAI,QAAQ,QAAQ,8CAA8C,YAAY,EAAE;AAErF,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAE3D,QAAI,CAAC,gBAAgB;AACnB,WAAK,IAAI,SAAS,QAAQ,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAC5E,YAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,CAAC,2CAA2C;AAAA,IAC1F;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAElE,UAAM,eAAe,MAAK,qBAAqB;AAC/C,UAAM,gBAAgB,MAAK,mBAAmB,YAAY;AAE1D,SAAK,IAAI,QAAQ,SAAS,8BAA8B,YAAY,IAAI,EAAE,MAAM,CAAC;AAIjF,SAAK,SAAS;AAAA,MACZ;AAAA,MACA;AAAA,QACE,WAAW,KAAK,IAAI;AAAA,QACpB,UAAU;AAAA,QACV;AAAA,MACF;AAAA,MACA;AAAA;AAAA,IACF;AAEA,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,eAAe;AAAA,MAC1B,cAAc,eAAe;AAAA,MAC7B,OAAO,eAAe,OAAO,KAAK,GAAG;AAAA,MACrC;AAAA,MACA,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,MACvB,GAAG,eAAe;AAAA,IACpB,CAAC;AAED,UAAM,UAAU,GAAG,aAAa,qBAAqB,IAAI,OAAO,SAAS,CAAC;AAC1E,SAAK,IAAI,QAAQ,QAAQ,4CAA4C;AAAA,MACnE,UAAU;AAAA,MACV,UAAU,aAAa;AAAA,IACzB,CAAC;AAED,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAa,eAAe;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIoB;AAClB,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAClD,SAAK,IAAI,QAAQ,QAAQ,yCAAyC,YAAY,EAAE;AAEhF,QAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,IAAI;AAC/B,WAAK,IAAI,SAAS,QAAQ,mDAAmD;AAC7E,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACvD;AAEA,QAAI,CAAC,SAAS,MAAM,KAAK,MAAM,IAAI;AACjC,WAAK,IAAI,SAAS,QAAQ,sCAAsC;AAChE,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,SAAK,IAAI,QAAQ,SAAS,8BAA8B,EAAE,MAAM,CAAC;AAGjE,UAAM,cAAc,MAAM,KAAK,SAAS,SAAS,KAAK;AACtD,QAAI,CAAC,aAAa;AAChB,WAAK,IAAI,SAAS,SAAS,uDAAuD,EAAE,MAAM,CAAC;AAC3F,YAAM,IAAI,MAAM,0BAA0B;AAAA,IAC5C;AAEA,SAAK,IAAI,QAAQ,SAAS,mDAAmD;AAE7E,UAAM,KAAK,SAAS,YAAY,KAAK;AAGrC,UAAM,eAAe,YAAY;AAEjC,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAE3D,QAAI,CAAC,gBAAgB;AACnB,WAAK,IAAI,SAAS,QAAQ,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAC5E,YAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,CAAC,2CAA2C;AAAA,IAC1F;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAElE,SAAK,IAAI,QAAQ,SAAS,4CAA4C,EAAE,UAAU,aAAa,CAAC;AAGhG,UAAM,SAAS,MAAM,KAAK;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,SAAS,2BAA2B;AACrD,SAAK,IAAI,QAAQ,WAAW,uBAAuB;AAGnD,UAAM,mBAAqC;AAAA,MACzC,MAAM;AAAA,MACN,WAAW;AAAA,QACT,eAAe,aAAa;AAAA,QAC5B,OAAO,aAAa;AAAA,QACpB,UAAU,aAAa;AAAA,MACzB;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,KAAK,gBAAgB,cAAc,QAAQ,gBAAgB;AAGjF,UAAM,YAAY,YAAY,EAAE,EAAE,SAAS,KAAK;AAEhD,SAAK,IAAI,QAAQ,WAAW,mBAAmB,EAAE,UAAU,CAAC;AAE5D,UAAM,KAAK,UAAU,YAAY,WAAW,SAAS,KAAK;AAE1D,SAAK,IAAI,QAAQ,WAAW,gCAAgC,EAAE,UAAU,CAAC;AAEzE,WAAO;AAAA,EACT;AAAA,EAEA,MAAa,iBAAiB,WAA4C;AACxE,WAAO,MAAM,KAAK,UAAU,WAAoB,SAAS;AAAA,EAC3D;AAAA,EAEA,MAAc,qBACZ,MACA,gBACA,cACA,cAC6B;AAE7B,UAAM,OAA+B;AAAA,MACnC,WAAW,eAAe;AAAA,MAC1B,eAAe,eAAe;AAAA,MAC9B;AAAA,MACA,cAAc,eAAe;AAAA,MAC7B,YAAY;AAAA,IACd;AAEA,QAAI,cAAc;AAChB,WAAK,gBAAgB;AAAA,IACvB;AACA,UAAM,SAAS,IAAI,gBAAgB,IAAI;AAEvC,SAAK,IAAI,QAAQ,SAAS,kCAAkC;AAAA,MAC1D,UAAU,aAAa;AAAA,IACzB,CAAC;AAED,UAAM,WAAW,MAAM,MAAM,aAAa,eAAe;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,MACA,MAAM,OAAO,SAAS;AAAA,IACxB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,WAAK,IAAI,SAAS,SAAS,yBAAyB;AAAA,QAClD,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,OAAO;AAAA,MACT,CAAC;AACD,YAAM,IAAI;AAAA,QACR,0BAA0B,SAAS,MAAM,IAAI,SAAS,UAAU,MAAM,SAAS;AAAA,MACjF;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,SAAS,+CAA+C;AACzE,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEQ,mBAAmB,cAAkD;AAE3E,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,OAAO,SAAS,GAAG;AAChE,UAAI,IAAI,YAAY,MAAM,aAAa,YAAY,GAAG;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;AI/oBO,SAAS,cAAc,SAA2B;AACvD,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AAEA,QAAM,gBAAgB,MAAM,CAAC;AAC7B,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACA,QAAM,UAAU,OAAO,KAAK,eAAe,QAAQ,EAAE,SAAS;AAE9D,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACF;AAOO,SAAS,4BAA4B,UAAmC;AAC7E,MAAI,CAAC,SAAS,KAAK;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,SAAS,IAAI,YAAY;AAExC,MAAI,OAAO,SAAS,qBAAqB,GAAG;AAC1C,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,SAAS,QAAQ,GAAG;AAC7B,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAcA,eAAsB,cACpB,aACA,kBACA,cACmB;AACnB,QAAM,WAAW,MAAM,MAAM,kBAAkB;AAAA,IAC7C,SAAS;AAAA,MACP,eAAe,UAAU,WAAW;AAAA,MACpC,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,gBAAgB,eAAe,SAAS,YAAY,KAAK;AAC/D,UAAM,IAAI,MAAM,4BAA4B,aAAa,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAAA,EACxG;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,SAAS,OAAO,KAAK,UAAU,UAAU;AAC7F,UAAM,gBAAgB,eAAe,SAAS,YAAY,KAAK;AAC/D,UAAM,IAAI,MAAM,6BAA6B,aAAa,4BAA4B;AAAA,EACxF;AAEA,SAAO;AAAA,IACL,OAAO,KAAK;AAAA,IACZ,IAAI,QAAQ,OAAO,OAAO,KAAK,EAAE,IAAI;AAAA,IACrC,KAAK,SAAS,OAAO,OAAO,KAAK,GAAG,IAAI;AAAA,IACxC,YAAY,gBAAgB,OAAO,OAAO,KAAK,UAAU,IAAI;AAAA,IAC7D,aAAa,iBAAiB,OAAO,OAAO,KAAK,WAAW,IAAI;AAAA,IAChE,MAAM,UAAU,OAAO,OAAO,KAAK,IAAI,IAAI;AAAA,IAC3C,SAAS,aAAa,OAAO,OAAO,KAAK,OAAO,IAAI;AAAA,IACpD,gBAAgB,oBAAoB,OAAO,QAAQ,KAAK,cAAc,IAAI;AAAA,IAC1E,KAAK,SAAS,OAAO,OAAO,KAAK,GAAG,IAAI;AAAA,EAC1C;AACF;AA4CA,eAAsB,gBACpB,WACA,kBACA,cACmD;AACnD,MAAI;AACJ,MAAI,WAA0B;AAE9B,MAAI,UAAU,UAAU;AAEtB,eAAW,cAAc,UAAU,QAAQ;AAG3C,eAAW,4BAA4B,QAAQ;AAG/C,QAAI,CAAC,YAAY,cAAc;AAC7B,iBAAW;AAAA,IACb;AAAA,EACF,WAAW,UAAU,cAAc;AAGjC,QAAI,cAAc,aAAa,OAAO,UAAU,aAAa,UAAU;AACrE,iBAAW,UAAU;AAAA,IACvB,WAAW,cAAc;AACvB,iBAAW;AAAA,IACb;AAEA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAEA,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI;AAAA,QACR,wCAAwC,QAAQ;AAAA,MAElD;AAAA,IACF;AAGA,eAAW,MAAM,cAAc,UAAU,cAAc,kBAAkB,QAAQ;AAAA,EACnF,OAAO;AACL,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAGA,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,SAAS;AAC9B;","names":["NodeCache"]}

package/dist/lixa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lixa.d.ts","sourceRoot":"","sources":["../src/lixa.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAKxC,OAAO,EAAE,KAAK,OAAO,EAAyE,MAAM,kBAAkB,CAAC;AAEvH;;GAEG;AACH,KAAK,qBAAqB,CAAC,CAAC,SAAS,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,cAAM,IAAI,CAAC,OAAO,SAAS,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,GAAG,UAAU;IAChF,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAqC;IACrE,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAqC;IACxE,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAyB;IACzD,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAA2B;IAC7D,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAgC;IACvE,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,KAAK,CAAU;IAEvB;;;;;;;;;;;;OAYG;gBACS,MAAM,EAAE,OAAO;IA0C3B;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IA2B9B;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAetC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,GAAG;IAaX;;;;;;;;;;;;;;OAcG;IACI,oBAAoB,CAAC,CAAC,SAAS,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC;IAK1G;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IA0BnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;WACW,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI;IAMzF;;;;OAIG;WACW,sBAAsB,IAAI,MAAM,EAAE;IAIhD;;;;;;;;;;;;;;;;;;;;;;OAsBG;WACW,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EACjE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG;QAAE,SAAS,EAAE,CAAC,CAAA;KAAE,GACvC,UAAU,CAAC,CAAC,CAAC;IAIhB;;;;;;;OAOG;WACW,mBAAmB,IAAI,MAAM;IAI3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAInC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAUjC;;;;;;;;;;;;;;;OAeG;IACI,UAAU,CAAC,QAAQ,EAAE,qBAAqB,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAmD3F;;;;;;;;;;;;;;;;;;OAkBG;IACU,cAAc,CAAC,EAC1B,QAAQ,EACR,IAAI,EACJ,KAAK,GACN,EAAE;QACD,QAAQ,EAAE,qBAAqB,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;QAClD,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,MAAM,CAAC;IAkEN,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;YAI3D,oBAAoB;IAiDlC,OAAO,CAAC,kBAAkB;CAS3B;AAED,OAAO,EAAE,IAAI,EAAE,CAAC"}
+{"version":3,"file":"lixa.d.ts","sourceRoot":"","sources":["../src/lixa.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAKxC,OAAO,EAAE,KAAK,OAAO,EAAgG,MAAM,kBAAkB,CAAC;AAE9I;;GAEG;AACH,KAAK,qBAAqB,CAAC,CAAC,SAAS,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,cAAM,IAAI,CAAC,OAAO,SAAS,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,GAAG,UAAU;IAChF,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAqC;IACrE,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAqC;IACxE,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAyB;IACzD,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAA2B;IAC7D,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAgC;IACvE,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,KAAK,CAAU;IAEvB;;;;;;;;;;;;OAYG;gBACS,MAAM,EAAE,OAAO;IA0C3B;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IA2B9B;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAetC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,GAAG;IAaX;;;;;;;;;;;;;;OAcG;IACI,oBAAoB,CAAC,CAAC,SAAS,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC;IAK1G;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IA0BnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;WACW,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI;IAMzF;;;;OAIG;WACW,sBAAsB,IAAI,MAAM,EAAE;IAIhD;;;;;;;;;;;;;;;;;;;;;;OAsBG;WACW,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EACjE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG;QAAE,SAAS,EAAE,CAAC,CAAA;KAAE,GACvC,UAAU,CAAC,CAAC,CAAC;IAIhB;;;;;;;OAOG;WACW,mBAAmB,IAAI,MAAM;IAI3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAInC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAUjC;;;;;;;;;;;;;;;OAeG;IACI,UAAU,CAAC,QAAQ,EAAE,qBAAqB,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAmD3F;;;;;;;;;;;;;;;;;;OAkBG;IACU,cAAc,CAAC,EAC1B,QAAQ,EACR,IAAI,EACJ,KAAK,GACN,EAAE;QACD,QAAQ,EAAE,qBAAqB,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;QAClD,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,MAAM,CAAC;IA4EN,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;YAI3D,oBAAoB;IAiDlC,OAAO,CAAC,kBAAkB;CAS3B;AAED,OAAO,EAAE,IAAI,EAAE,CAAC"}

package/dist/models/session.d.ts

@@ -80,6 +80,25 @@ export interface Session<TRaw = OAuthTokenResponse> {
      */
     raw: TRaw;
 }
+/**
+ * Provider metadata passed to session strategy.
+ * Contains provider name and endpoints for user info extraction.
+ *
+ * @public
+ */
+export interface ProviderMetadata {
+    /** The provider name (e.g., 'google', 'github') */
+    name: string;
+    /** Provider endpoints */
+    endpoints: {
+        /** Authorization endpoint URL */
+        authorization: string;
+        /** Token endpoint URL */
+        token: string;
+        /** UserInfo endpoint URL */
+        userInfo: string;
+    };
+}
 /**
  * Strategy interface for custom session creation.
  *
@@ -98,24 +117,27 @@ export interface Session<TRaw = OAuthTokenResponse> {
  * @example
  * Custom session strategy with database integration:
  * ```typescript
- * interface CustomSessionData extends OAuthTokenResponse {
+ * interface CustomSessionData {
  *   userId: string;
  *   email: string;
+ *   provider: string;
+ *   accessToken: string;
+ *   refreshToken?: string;
+ *   expiresAt: number;
  * }
  *
  * class DatabaseSessionStrategy implements SessionStrategy {
  *   constructor(private db: Database) {}
  *
- *   async createSession(tokenData: OAuthTokenResponse): Promise<Session<CustomSessionData>> {
- *     // Decode ID token for OIDC providers
- *     const idToken = tokenData.id_token;
- *     const payload = decodeJwt(idToken);
+ *   async createSession(oauthContext: OAuthContext): Promise<Session<CustomSessionData>> {
+ *     // User info is already extracted by Lixa!
+ *     const { userInfo, provider, tokenData } = oauthContext;
  *
  *     // Create or update user in database
  *     const user = await this.db.users.upsert({
- *       email: payload.email,
- *       name: payload.name,
- *       picture: payload.picture
+ *       email: userInfo.email,
+ *       name: userInfo.name,
+ *       picture: userInfo.picture
  *     });
  *
  *     // Generate session ID
@@ -135,7 +157,10 @@ export interface Session<TRaw = OAuthTokenResponse> {
  *       raw: {
  *         userId: user.id,
  *         email: user.email,
- *         ...tokenData
+ *         provider,
+ *         accessToken: tokenData.access_token,
+ *         refreshToken: tokenData.refresh_token,
+ *         expiresAt: Date.now() + (tokenData.expires_in || 3600) * 1000
  *       }
  *     };
  *   }
@@ -149,14 +174,14 @@ export interface SessionStrategy {
      * Creates a session from OAuth token data.
      *
      * @param tokenData - The token data received from the OAuth provider's token endpoint
+     * @param providerMetadata - Provider metadata including name and endpoints
      * @returns A Promise that resolves to a Session object
      *
      * @remarks
      * This method is called after successfully exchanging the authorization code
-     * for tokens. The tokenData parameter contains the raw response from the
-     * provider's token endpoint.
+     * for tokens. You receive:
      *
-     * Common token data fields:
+     * Token Data:
      * - access_token: OAuth access token
      * - refresh_token: OAuth refresh token (optional)
      * - expires_in: Token expiration time in seconds
@@ -164,6 +189,28 @@ export interface SessionStrategy {
      * - id_token: OpenID Connect ID token (for OIDC providers)
      * - scope: Granted scopes
      *
+     * Provider Metadata:
+     * - name: The provider name (e.g., 'google', 'github')
+     * - endpoints: Provider endpoints (authorization, token, userInfo)
+     *
+     * The providerMetadata.endpoints.userInfo can be used with extractUserInfo():
+     * ```typescript
+     * import { extractUserInfo } from '@vunexa/lixa';
+     *
+     * const { userInfo } = await extractUserInfo(
+     *   tokenData,
+     *   providerMetadata.endpoints.userInfo,
+     *   providerMetadata.name
+     * );
+     * ```
+     *
+     * Your session strategy should:
+     * 1. Extract user info (using extractUserInfo or decode ID token)
+     * 2. Create or lookup users in your database
+     * 3. Generate session identifiers
+     * 4. Store session data as needed
+     * 5. Return a Session object with token and raw data
+     *
      * @throws \{Error\} If session creation fails (e.g., database error, invalid token)
      *
      * @example
@@ -176,8 +223,35 @@ export interface SessionStrategy {
      *   };
      * }
      * ```
+     *
+     * @example
+     * Database integration with user info extraction:
+     * ```typescript
+     * async createSession(
+     *   tokenData: OAuthTokenResponse,
+     *   providerMetadata: ProviderMetadata
+     * ): Promise<Session> {
+     *   // Extract user info from token or userinfo endpoint
+     *   const { userInfo } = await extractUserInfo(
+     *     tokenData,
+     *     providerMetadata.endpoints.userInfo,
+     *     providerMetadata.name
+     *   );
+     *
+     *   // Create or update user in database
+     *   const user = await db.users.upsert({
+     *     email: userInfo.email,
+     *     name: userInfo.name
+     *   });
+     *
+     *   return {
+     *     token: generateSessionId(),
+     *     raw: { userId: user.id, provider: providerMetadata.name, ...tokenData }
+     *   };
+     * }
+     * ```
      */
-    createSession(tokenData: OAuthTokenResponse): Promise<Session>;
+    createSession(tokenData: OAuthTokenResponse, providerMetadata: ProviderMetadata): Promise<Session>;
 }
 /**
  * Default session strategy that works with any OAuth provider.
@@ -191,8 +265,9 @@ export declare class DefaultSessionStrategy implements SessionStrategy {
      * Handles common OAuth token formats and extracts the access token.
      *
      * @param tokenData - The token data received from the OAuth provider
+     * @param providerMetadata - Provider metadata (not used in default implementation)
      * @returns A Promise that resolves to a Session object
      */
-    createSession(tokenData: OAuthTokenResponse): Promise<Session>;
+    createSession(tokenData: OAuthTokenResponse, providerMetadata: ProviderMetadata): Promise<Session>;
 }
 //# sourceMappingURL=session.d.ts.map

package/dist/models/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/models/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CACtD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,OAAO,CAAC,IAAI,GAAG,kBAAkB;IAChD;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;;;;;;;;;OAYG;IACH,GAAG,EAAE,IAAI,CAAC;CACX;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,aAAa,CAAC,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChE;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,YAAW,eAAe;IAC5D;;;;;;OAMG;IACG,aAAa,CAAC,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;CAUrE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/models/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CACtD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,OAAO,CAAC,IAAI,GAAG,kBAAkB;IAChD;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;;;;;;;;;OAYG;IACH,GAAG,EAAE,IAAI,CAAC;CACX;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IAEb,yBAAyB;IACzB,SAAS,EAAE;QACT,iCAAiC;QACjC,aAAa,EAAE,MAAM,CAAC;QACtB,yBAAyB;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,4BAA4B;QAC5B,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgFG;IACH,aAAa,CAAC,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpG;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,YAAW,eAAe;IAC5D;;;;;;;OAOG;IACG,aAAa,CAAC,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAUzG"}

package/dist/types.d.ts

@@ -1,8 +1,9 @@
 import { SessionDao, StateDao, StateData } from "./dao/types";
-import { SessionStrategy, Session } from "./models/session";
+import { SessionStrategy, Session, ProviderMetadata } from "./models/session";
 import { IProvider } from "./providers/IProvider";
 export { SessionStrategy };
 export { Session };
+export { ProviderMetadata };
 export { OAuthTokenResponse } from "./models/session";
 export { IProvider };
 export { StateDao };

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGlD,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,OAAO,EAAE,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IAEjB,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IAErB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IAEpB,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC,GAAG,CACA;IAAE,QAAQ,CAAC,EAAE,KAAK,CAAA;CAAE,GACpB;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,WAAW,UAAU,CAAC,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC;IAC5G;;;OAGG;IACH,SAAS,EAAE,UAAU,CAAC;IAEtB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAElC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAEpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IAExB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,CAAC,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG;IACvG,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGlD,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,OAAO,EAAE,CAAC;AACnB,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IAEjB,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IAErB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IAEpB,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC,GAAG,CACA;IAAE,QAAQ,CAAC,EAAE,KAAK,CAAA;CAAE,GACpB;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,WAAW,UAAU,CAAC,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC;IAC5G;;;OAGG;IACH,SAAS,EAAE,UAAU,CAAC;IAEtB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAElC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAEpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IAExB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,CAAC,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG;IACvG,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vunexa/lixa",
-  "version": "0.0.1-alpha.27",
+  "version": "0.0.1-alpha.28",
   "description": "Lixa is a flexible, provider-agnostic OAuth and OpenID Connect (OIDC) client library that simplifies multi-provider authentication flows. It supports seamless integration with providers like Google and GitHub, offers extensible session management, and enables dynamic provider resolution based on callback URLs.",
   "keywords": [
     "oauth",