@warlock.js/auth 5.14.0 → 5.16.0

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `@warlock.js/auth` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
 
+## 5.16.0 - 2026-09-18
+
+### Added
+
+- Six new login providers: GitHub, Discord, LinkedIn, Apple, Facebook and X, configured under `auth.providers.<name>` and used through `startProviderLogin` / `completeProviderLogin`. Apple and LinkedIn verify their id_token with `jose`. The other four use plain OAuth 2.
+- `AuthProvider.callbackMode` (`"query"` | `"form_post"`). Apple uses `form_post`, so its state cookie is written with `SameSite=None; Secure` (HTTPS required). Query-mode providers keep `SameSite=Lax`.
+
+### Fixed
+
+- Provider names now resolve only from `auth.providers`' own keys, so a name inherited from the object prototype, such as `toString`, is never treated as a provider.
+- The Set-Cookie that clears the provider state cookie now repeats the attributes the cookie was written with.
+
 ## 5.13.0 - 2026-09-17
 
 ### Added

package/esm/contracts/index.d.mts

@@ -1,4 +1,4 @@
-import { AuthProvider, GoogleProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig } from "./providers.mjs";
+import { AppleProviderConfig, AuthProvider, DiscordProviderConfig, FacebookProviderConfig, GitHubProviderConfig, GoogleProviderConfig, LinkedInProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig, XProviderConfig } from "./providers.mjs";
 import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentials, AuthNotification, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair } from "./types.mjs";
 import { Authenticable } from "./auth-contract.mjs";
 import { RequestUser } from "./request-locals.mjs";

package/esm/contracts/providers.d.mts

@@ -37,6 +37,14 @@ type ProviderProfile = {
  */
 interface AuthProvider {
   readonly name: string;
+  /**
+   * How the provider's callback arrives. `"query"` (default) is a top-level
+   * GET redirect, safe for a `SameSite=Lax` state cookie. `"form_post"` is a
+   * cross-site POST (Apple, when `name`/`email` scopes are requested) — the
+   * state cookie needs `SameSite=None; Secure` to survive it.
+   * @default "query"
+   */
+  readonly callbackMode?: "query" | "form_post";
   /** The URL to send the browser to. */
   authorizationUrl(state: ProviderAuthorizationState): string | Promise<string>;
   /** Exchange the callback for a verified profile, or throw. */
@@ -49,11 +57,61 @@ type GoogleProviderConfig = {
   redirectUri: string; /** @default ["openid", "email", "profile"] */
   scopes?: string[];
 };
+/** `auth.providers.github`. */
+type GitHubProviderConfig = {
+  clientId: string;
+  clientSecret: string; /** Must exactly match the "Authorization callback URL" registered on the GitHub OAuth App. */
+  redirectUri: string; /** @default ["read:user", "user:email"] */
+  scopes?: string[];
+};
+/** `auth.providers.discord`. */
+type DiscordProviderConfig = {
+  clientId: string;
+  clientSecret: string; /** Must exactly match a redirect registered on the Discord application. */
+  redirectUri: string; /** @default ["identify", "email"] */
+  scopes?: string[];
+};
+/** `auth.providers.linkedin`. */
+type LinkedInProviderConfig = {
+  clientId: string;
+  clientSecret: string; /** Must exactly match a redirect URL registered on the LinkedIn app. */
+  redirectUri: string; /** @default ["openid", "profile", "email"] */
+  scopes?: string[];
+};
+/** `auth.providers.apple`. */
+type AppleProviderConfig = {
+  /** The Services ID (or app id) registered with Sign in with Apple. */clientId: string; /** The Apple Developer team id — signed into the client-secret JWT as `iss`. */
+  teamId: string; /** The id of the private key created for Sign in with Apple — signed into the client-secret JWT header as `kid`. */
+  keyId: string; /** The PKCS8 PEM contents of that private key (`.p8` file), used to sign the client-secret JWT. */
+  privateKey: string; /** Must exactly match a return URL registered on the Services ID. */
+  redirectUri: string; /** @default ["name", "email"] */
+  scopes?: string[];
+};
+/** `auth.providers.facebook`. */
+type FacebookProviderConfig = {
+  clientId: string;
+  clientSecret: string; /** Must exactly match a valid OAuth redirect URI registered on the Facebook app. */
+  redirectUri: string; /** @default ["email", "public_profile"] */
+  scopes?: string[];
+};
+/** `auth.providers.x`. */
+type XProviderConfig = {
+  clientId: string;
+  clientSecret: string; /** Must exactly match a callback URI registered on the X app (confidential client). */
+  redirectUri: string; /** @default ["tweet.read", "users.read"] */
+  scopes?: string[];
+};
 /** Creates the app user for a verified provider profile with no matching account. */
 type ProviderUserCreator = (profile: ProviderProfile, Model: ChildModel<Auth>) => Auth | Promise<Auth>;
 /** `auth.providers`. */
 type ProvidersConfig = {
   google?: GoogleProviderConfig;
+  github?: GitHubProviderConfig;
+  discord?: DiscordProviderConfig;
+  linkedin?: LinkedInProviderConfig;
+  apple?: AppleProviderConfig;
+  facebook?: FacebookProviderConfig;
+  x?: XProviderConfig;
   /**
    * User attribute a verified provider email is matched against.
    * @default "email"
@@ -97,5 +155,5 @@ type OtpConfig = {
   send?: OtpSender;
 };
 //#endregion
-export { AuthProvider, GoogleProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig };
+export { AppleProviderConfig, AuthProvider, DiscordProviderConfig, FacebookProviderConfig, GitHubProviderConfig, GoogleProviderConfig, LinkedInProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig, XProviderConfig };
 //# sourceMappingURL=providers.d.mts.map

package/esm/contracts/providers.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/providers.ts"],"mappings":";;;;;;AAOA;;KAAY,0BAAA;EACV,KAAA;EACA,KAAA;EACA,YAAA;AAAA;;AAAY;AAQd;;;KAAY,sBAAA;EACV,KAAA,EAAO,MAAA;EACP,QAAA,EAAU,0BAA0B;AAAA;;KAI1B,eAAA;EAJ0B,sCAMpC,QAAA,UAFyB;EAIzB,cAAA;EACA,KAAA,WAHA;EAKA,aAAA;EACA,IAAA;EACA,MAAA,WADA;EAGA,GAAA,EAAK,MAAM;AAAA;;;AAAA;AAQb;;UAAiB,YAAA;EAAA,SACN,IAAA;EAEqD;EAA9D,gBAAA,CAAiB,KAAA,EAAO,0BAAA,YAAsC,OAAA;EAEN;EAAxD,cAAA,CAAe,MAAA,EAAQ,sBAAA,GAAyB,OAAA,CAAQ,eAAA;AAAA;;KAI9C,oBAAA;EACV,QAAA;EACA,YAAA,UARiB;EAUjB,WAAA,UARA;EAUA,MAAA;AAAA;;KAIU,mBAAA,IACV,OAAA,EAAS,eAAA,EACT,KAAA,EAAO,UAAA,CAAW,IAAA,MACf,IAAA,GAAO,OAAA,CAAQ,IAAA;;KAGR,eAAA;EACV,MAAA,GAAS,oBAAA;EAjBqB;;;;EAsB9B,UAAA,WAlBA;EAoBA,UAAA,GAAa,mBAAA,EAlBP;EAoBN,MAAA,GAAS,MAAA,SAAe,YAAA;AAAA;;KAId,cAAA;EAnBD,8EAqBT,IAAA,UApBO;EAsBP,MAAA,UArBkB;EAuBlB,MAAA;EAvBiB;;;;EA4BjB,kBAAA,WA7BkB;EA+BlB,QAAA,IAAY,IAAA,EAAM,IAAI;AAAA;;KAIZ,UAAA;EAlCY,8CAoCtB,IAAA;EACA,IAAA;EACA,SAAA,EAAW,IAAI;AAAA;;KAIL,SAAA,IAAa,KAAA,UAAe,OAAA,EAAS,UAAU,EAAE,OAAA;;KAGjD,SAAA;EAhCK;;;;;EAsCf,OAAA,WAxCa;EA0Cb,UAAA,WAxCS;EA0CT,SAAA,WA1CoC;EA4CpC,WAAA,WAxCU;EA0CV,OAAA,IAAW,IAAA;EAEX,IAAA,GAAO,SAAS;AAAA"}
+{"version":3,"file":"providers.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/providers.ts"],"mappings":";;;;;;AAOA;;KAAY,0BAAA;EACV,KAAA;EACA,KAAA;EACA,YAAA;AAAA;;AAAY;AAQd;;;KAAY,sBAAA;EACV,KAAA,EAAO,MAAA;EACP,QAAA,EAAU,0BAA0B;AAAA;;KAI1B,eAAA;EAJ0B,sCAMpC,QAAA,UAFyB;EAIzB,cAAA;EACA,KAAA,WAHA;EAKA,aAAA;EACA,IAAA;EACA,MAAA,WADA;EAGA,GAAA,EAAK,MAAM;AAAA;;;AAAA;AAQb;;UAAiB,YAAA;EAAA,SACN,IAAA;EAUqD;;;;;;;EAAA,SAFrD,YAAA;EAET;EAAA,gBAAA,CAAiB,KAAA,EAAO,0BAAA,YAAsC,OAAA;EAA7C;EAEjB,cAAA,CAAe,MAAA,EAAQ,sBAAA,GAAyB,OAAA,CAAQ,eAAA;AAAA;;KAI9C,oBAAA;EACV,QAAA;EACA,YAAA,UANuE;EAQvE,WAAA,UAJU;EAMV,MAAA;AAAA;;KAIU,oBAAA;EACV,QAAA;EACA,YAAA,UANA;EAQA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,qBAAA;EACV,QAAA;EACA,YAAA,UARA;EAUA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,sBAAA;EACV,QAAA;EACA,YAAA,UAVA;EAYA,WAAA,UARA;EAUA,MAAA;AAAA;AANF;AAAA,KAUY,mBAAA;wEAEV,QAAA,UAXA;EAaA,MAAA,UAVA;EAYA,KAAA,UAVM;EAYN,UAAA,UARU;EAUV,WAAA;EAEA,MAAA;AAAA;;KAIU,sBAAA;EACV,QAAA;EACA,YAAA,UANA;EAQA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,eAAA;EACV,QAAA;EACA,YAAA,UARA;EAUA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,mBAAA,IACV,OAAA,EAAS,eAAA,EACT,KAAA,EAAO,UAAA,CAAW,IAAA,MACf,IAAA,GAAO,OAAA,CAAQ,IAAA;;KAGR,eAAA;EACV,MAAA,GAAS,oBAAA;EACT,MAAA,GAAS,oBAAA;EACT,OAAA,GAAU,qBAAA;EACV,QAAA,GAAW,sBAAA;EACX,KAAA,GAAQ,mBAAA;EACR,QAAA,GAAW,sBAAA;EACX,CAAA,GAAI,eAAA;;;;;EAKJ,UAAA,WAfkB;EAiBlB,UAAA,GAAa,mBAAA,EAjBI;EAmBjB,MAAA,GAAS,MAAA,SAAe,YAAA;AAAA;;KAId,cAAA;EAxBQ,8EA0BlB,IAAA,UAzBG;EA2BH,MAAA,UA3BkB;EA6BlB,MAAA;EA7BsB;AAGxB;;;EA+BE,kBAAA,WA7BS;EA+BT,QAAA,IAAY,IAAA,EAAM,IAAI;AAAA;;KAIZ,UAAA;EA9BN,8CAgCJ,IAAA;EACA,IAAA;EACA,SAAA,EAAW,IAAI;AAAA;;KAIL,SAAA,IAAa,KAAA,UAAe,OAAA,EAAS,UAAU,EAAE,OAAA;;KAGjD,SAAA;EA9CD;;;;;EAoDT,OAAA,WAjDQ;EAmDR,UAAA,WAlDW;EAoDX,SAAA,WAnDI;EAqDJ,WAAA,WA9CA;EAgDA,OAAA,IAAW,IAAA,qBA9CX;EAgDA,IAAA,GAAO,SAAS;AAAA"}

package/esm/index.d.mts

@@ -4,7 +4,7 @@ import { registerJWTSecretGeneratorCommand } from "./commands/jwt-secret-generat
 import { Auth } from "./models/auth.model.mjs";
 import { AccessToken, accessTokenSchema } from "./models/access-token/access-token.model.mjs";
 import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./models/one-time-token/one-time-token.model.mjs";
-import { AuthProvider, GoogleProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig } from "./contracts/providers.mjs";
+import { AppleProviderConfig, AuthProvider, DiscordProviderConfig, FacebookProviderConfig, GitHubProviderConfig, GoogleProviderConfig, LinkedInProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig, XProviderConfig } from "./contracts/providers.mjs";
 import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentials, AuthNotification, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair } from "./contracts/types.mjs";
 import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./models/refresh-token/refresh-token.model.mjs";
 import { Authenticable } from "./contracts/auth-contract.mjs";
@@ -31,7 +31,13 @@ import { PasskeyOptionsJSON, PasskeyResponseJSON } from "./passkeys/simplewebaut
 import { generatePasskeyAuthenticationOptions, verifyPasskeyAuthentication } from "./passkeys/passkey-authentication.mjs";
 import { generatePasskeyRegistrationOptions, verifyPasskeyRegistration } from "./passkeys/passkey-registration.mjs";
 import { GOOGLE_AUTH_FEATURE, GoogleProvider, JoseModule, pkceChallenge } from "./providers/google-provider.mjs";
+import { APPLE_AUTH_FEATURE, AppleJoseModule, AppleProvider } from "./providers/apple-provider.mjs";
+import { DiscordProvider } from "./providers/discord-provider.mjs";
+import { FacebookProvider } from "./providers/facebook-provider.mjs";
+import { GitHubProvider } from "./providers/github-provider.mjs";
+import { LINKEDIN_AUTH_FEATURE, LinkedInProvider } from "./providers/linkedin-provider.mjs";
 import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./providers/provider-login.mjs";
+import { XProvider } from "./providers/x-provider.mjs";
 import { AuthEventCallback, AuthEventName, AuthEventPayloads, authEvents } from "./services/auth-events.mjs";
 import { authService } from "./services/auth.service.mjs";
 import { currentUser } from "./services/current-user.mjs";
@@ -42,5 +48,5 @@ import { IssuedOneTimeToken, consumeOneTimeToken, hashOneTimeToken, issueOneTime
 import { requestPasswordReset, resetPassword } from "./services/password-reset.mjs";
 import { safeEqual } from "./utils/safe-equal.mjs";
 import { isNeverExpiring, isUsableExpiry, tokenHasExpClaim } from "./utils/token-expiry.mjs";
-export { AccessToken, AccessTokenConfig, AccessTokenOutput, Auth, AuthConfigurations, AuthCredentials, AuthErrorCodes, AuthEventCallback, AuthEventName, AuthEventPayloads, AuthNotification, AuthProvider, AuthProviderSdkMissingError, Authenticable, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, CsrfOriginMismatchError, CsrfOriginMismatchReason, DeviceInfo, EmailNotVerifiedError, EmailVerificationConfig, GOOGLE_AUTH_FEATURE, GoogleProvider, GoogleProviderConfig, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, IssuedOneTimeToken, JoseModule, LegacyJwtConfig, LoginResult, LoginThrottleIdentifier, LoginThrottleOptions, LogoutWithoutTokenBehavior, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenPurpose, OneTimeTokenUrlBuilder, OtpConfig, OtpMessage, OtpSender, PageAuthConfig, PasskeyCredential, type PasskeyOptionsJSON, type PasskeyResponseJSON, PasskeysConfig, PasswordResetConfig, PasswordSetter, ProviderAccount, ProviderAuthorizationState, ProviderCallbackParams, ProviderEmailNotVerifiedError, ProviderProfile, ProviderUserCreator, ProvidersConfig, RefreshToken, RefreshTokenConfig, RefreshTokenIssueOptions, RequestUser, SetAuthCookieOptions, TokenFrom, TokenPair, TokenType, TokenTypeError, accessTokenSchema, assertCsrfOriginAllowed, authEvents, authMiddleware, authMigrations, authService, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, safeEqual, sendEmailVerification, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
+export { APPLE_AUTH_FEATURE, AccessToken, AccessTokenConfig, AccessTokenOutput, AppleJoseModule, AppleProvider, AppleProviderConfig, Auth, AuthConfigurations, AuthCredentials, AuthErrorCodes, AuthEventCallback, AuthEventName, AuthEventPayloads, AuthNotification, AuthProvider, AuthProviderSdkMissingError, Authenticable, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, CsrfOriginMismatchError, CsrfOriginMismatchReason, DeviceInfo, DiscordProvider, DiscordProviderConfig, EmailNotVerifiedError, EmailVerificationConfig, FacebookProvider, FacebookProviderConfig, GOOGLE_AUTH_FEATURE, GitHubProvider, GitHubProviderConfig, GoogleProvider, GoogleProviderConfig, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, IssuedOneTimeToken, JoseModule, LINKEDIN_AUTH_FEATURE, LegacyJwtConfig, LinkedInProvider, LinkedInProviderConfig, LoginResult, LoginThrottleIdentifier, LoginThrottleOptions, LogoutWithoutTokenBehavior, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenPurpose, OneTimeTokenUrlBuilder, OtpConfig, OtpMessage, OtpSender, PageAuthConfig, PasskeyCredential, type PasskeyOptionsJSON, type PasskeyResponseJSON, PasskeysConfig, PasswordResetConfig, PasswordSetter, ProviderAccount, ProviderAuthorizationState, ProviderCallbackParams, ProviderEmailNotVerifiedError, ProviderProfile, ProviderUserCreator, ProvidersConfig, RefreshToken, RefreshTokenConfig, RefreshTokenIssueOptions, RequestUser, SetAuthCookieOptions, TokenFrom, TokenPair, TokenType, TokenTypeError, XProvider, XProviderConfig, accessTokenSchema, assertCsrfOriginAllowed, authEvents, authMiddleware, authMigrations, authService, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, safeEqual, sendEmailVerification, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
 import "./contracts/request-locals.mjs";

package/esm/index.mjs

@@ -42,8 +42,14 @@ import { generatePasskeyAuthenticationOptions, verifyPasskeyAuthentication } fro
 import { generatePasskeyRegistrationOptions, verifyPasskeyRegistration } from "./passkeys/passkey-registration.mjs";
 import "./passkeys/index.mjs";
 import { GOOGLE_AUTH_FEATURE, GoogleProvider, pkceChallenge } from "./providers/google-provider.mjs";
+import { APPLE_AUTH_FEATURE, AppleProvider } from "./providers/apple-provider.mjs";
+import { DiscordProvider } from "./providers/discord-provider.mjs";
+import { FacebookProvider } from "./providers/facebook-provider.mjs";
+import { GitHubProvider } from "./providers/github-provider.mjs";
+import { LINKEDIN_AUTH_FEATURE, LinkedInProvider } from "./providers/linkedin-provider.mjs";
+import { XProvider } from "./providers/x-provider.mjs";
 import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./providers/provider-login.mjs";
 import "./providers/index.mjs";
 import "./utils/index.mjs";
 
-export { AccessToken, Auth, AuthErrorCodes, AuthProviderSdkMissingError, CsrfOriginMismatchError, EmailNotVerifiedError, GOOGLE_AUTH_FEATURE, GoogleProvider, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, PasskeyCredential, ProviderAccount, ProviderEmailNotVerifiedError, RefreshToken, TokenTypeError, accessTokenSchema, assertCsrfOriginAllowed, authEvents, authMiddleware, authMigrations, authService, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, safeEqual, sendEmailVerification, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
+export { APPLE_AUTH_FEATURE, AccessToken, AppleProvider, Auth, AuthErrorCodes, AuthProviderSdkMissingError, CsrfOriginMismatchError, DiscordProvider, EmailNotVerifiedError, FacebookProvider, GOOGLE_AUTH_FEATURE, GitHubProvider, GoogleProvider, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, LINKEDIN_AUTH_FEATURE, LinkedInProvider, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, PasskeyCredential, ProviderAccount, ProviderEmailNotVerifiedError, RefreshToken, TokenTypeError, XProvider, accessTokenSchema, assertCsrfOriginAllowed, authEvents, authMiddleware, authMigrations, authService, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, safeEqual, sendEmailVerification, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };

package/esm/providers/apple-provider.d.mts

@@ -0,0 +1,74 @@
+import { AppleProviderConfig, AuthProvider, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile } from "../contracts/providers.mjs";
+import { JoseModule } from "./google-provider.mjs";
+
+//#region ../auth/src/providers/apple-provider.d.ts
+/** The `warlock add` feature that installs `jose`. */
+declare const APPLE_AUTH_FEATURE = "auth-apple";
+type AppleSignJwtBuilder = {
+  setIssuer: (issuer: string) => AppleSignJwtBuilder;
+  setIssuedAt: () => AppleSignJwtBuilder;
+  setExpirationTime: (time: number) => AppleSignJwtBuilder;
+  setAudience: (audience: string) => AppleSignJwtBuilder;
+  setSubject: (subject: string) => AppleSignJwtBuilder;
+  sign: (key: unknown) => Promise<string>;
+};
+/**
+ * The slice of `jose` the Apple provider uses on top of {@link JoseModule} —
+ * `importPKCS8` and `SignJWT` sign the ES256 client-secret JWT Apple requires
+ * instead of a static client secret.
+ */
+type AppleJoseModule = JoseModule & {
+  importPKCS8: (pkcs8: string, alg: string) => Promise<unknown>;
+  SignJWT: new (payload: Record<string, unknown>) => {
+    setProtectedHeader: (header: Record<string, unknown>) => AppleSignJwtBuilder;
+  };
+};
+/**
+ * Apple ("Sign in with Apple") is OpenID Connect over the authorization code
+ * flow with PKCE (S256), `state` and `nonce`, the same shape as
+ * {@link GoogleProvider} — with two differences that come straight from
+ * Apple's own docs (this package has no Apple developer account, so nothing
+ * here is proven against a live exchange):
+ *
+ * 1. Apple has no static client secret. The "secret" the token endpoint wants
+ *    is a fresh ES256 JWT (`iss` = team id, `sub` = client id, `aud` =
+ *    `https://appleid.apple.com`, signed with the app's private key and the
+ *    key id as `kid`) — signed once per callback here rather than cached, to
+ *    avoid ever presenting a stale one.
+ * 2. Requesting `name`/`email` (the default scopes) forces
+ *    `response_mode=form_post`: Apple POSTs `code`, `state` and, on the
+ *    user's FIRST authorization only, a `user` field — a JSON string with
+ *    `{ name: { firstName, lastName }, email } ` that never comes back again
+ *    on a later login. The callback route must therefore accept a POST body,
+ *    not just a query string, and `request.input` must read that body the
+ *    same way it already reads a GET query for the other providers.
+ *
+ * The id_token is verified with `jose` against Apple's JWKS (signature,
+ * `iss`, `aud` = the client id, `exp`), then its `nonce` is compared. Apple is
+ * also documented to send `email_verified` (and `is_private_email`) as the
+ * STRING `"true"`/`"false"` rather than a JSON boolean on some responses, so
+ * both forms are accepted here — treating only the unambiguous `"false"` (or
+ * `false`) as unverified. A private-relay address (`@privaterelay.appleid.com`)
+ * is still a real, working forwarding address and is accepted as any other.
+ */
+declare class AppleProvider implements AuthProvider {
+  private readonly settings;
+  readonly name = "apple";
+  /** Apple's default scopes (`name`, `email`) force `response_mode=form_post`. */
+  readonly callbackMode = "form_post";
+  constructor(settings: AppleProviderConfig);
+  authorizationUrl(state: ProviderAuthorizationState): string;
+  handleCallback({
+    query,
+    expected
+  }: ProviderCallbackParams): Promise<ProviderProfile>;
+  /** Sign a fresh ES256 client-secret JWT — Apple has no static one. */
+  private clientSecret;
+  /** Redeem the authorization code (with the PKCE verifier) for an id_token. */
+  private exchangeCode;
+  /** Verify signature, issuer, audience and expiry; resolve the claims. */
+  private verifyIdToken;
+}
+//#endregion
+export { APPLE_AUTH_FEATURE, AppleJoseModule, AppleProvider };
+//# sourceMappingURL=apple-provider.d.mts.map

package/esm/providers/apple-provider.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-provider.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/apple-provider.ts"],"mappings":";;;;;cAqBa,kBAAA;AAAA,KAER,mBAAA;EACH,SAAA,GAAY,MAAA,aAAmB,mBAAA;EAC/B,WAAA,QAAmB,mBAAA;EACnB,iBAAA,GAAoB,IAAA,aAAiB,mBAAA;EACrC,WAAA,GAAc,QAAA,aAAqB,mBAAA;EACnC,UAAA,GAAa,OAAA,aAAoB,mBAAA;EACjC,IAAA,GAAO,GAAA,cAAiB,OAAA;AAAA;;;;;;KAQd,eAAA,GAAkB,UAAA;EAC5B,WAAA,GAAc,KAAA,UAAe,GAAA,aAAgB,OAAA;EAC7C,OAAA,OAAc,OAAA,EAAS,MAAA;IACrB,kBAAA,GAAqB,MAAA,EAAQ,MAAA,sBAA4B,mBAAA;EAAA;AAAA;;;;;;;;;;;;;;;;AAX5B;AAQjC;;;;;;;;;;;;cAsCa,aAAA,YAAyB,YAAA;EAAA,iBAKA,QAAA;EAAA,SAJpB,IAAA;EArChB;EAAA,SAuCgB,YAAA;cAEoB,QAAA,EAAU,mBAAA;EAEvC,gBAAA,CAAiB,KAAA,EAAO,0BAAA;EAqBlB,cAAA;IACX,KAAA;IACA;EAAA,GACC,sBAAA,GAAyB,OAAA,CAAQ,eAAA;EAlEb;EAAA,QAkGT,YAAA;EAlGgE;EAAA,QAqHhE,YAAA;EAlFH;EAAA,QAyHG,aAAA;AAAA"}

package/esm/providers/apple-provider.mjs

@@ -0,0 +1,157 @@
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { loadOptionalPeer } from "../services/optional-peer.mjs";
+import { pkceChallenge } from "./google-provider.mjs";
+
+//#region ../auth/src/providers/apple-provider.ts
+const AUTHORIZATION_ENDPOINT = "https://appleid.apple.com/auth/authorize";
+const TOKEN_ENDPOINT = "https://appleid.apple.com/auth/token";
+const JWKS_URI = "https://appleid.apple.com/auth/keys";
+const ISSUER = "https://appleid.apple.com";
+const DEFAULT_SCOPES = ["name", "email"];
+/** Apple's own recommendation for a per-request client secret: minutes, not the 6-month maximum it allows. */
+const CLIENT_SECRET_TTL_SECONDS = 300;
+/** The `warlock add` feature that installs `jose`. */
+const APPLE_AUTH_FEATURE = "auth-apple";
+/** Apple's key set, created once per process; `jose` caches the fetched JWKS inside it. */
+let appleKeySet;
+/**
+* Apple ("Sign in with Apple") is OpenID Connect over the authorization code
+* flow with PKCE (S256), `state` and `nonce`, the same shape as
+* {@link GoogleProvider} — with two differences that come straight from
+* Apple's own docs (this package has no Apple developer account, so nothing
+* here is proven against a live exchange):
+*
+* 1. Apple has no static client secret. The "secret" the token endpoint wants
+*    is a fresh ES256 JWT (`iss` = team id, `sub` = client id, `aud` =
+*    `https://appleid.apple.com`, signed with the app's private key and the
+*    key id as `kid`) — signed once per callback here rather than cached, to
+*    avoid ever presenting a stale one.
+* 2. Requesting `name`/`email` (the default scopes) forces
+*    `response_mode=form_post`: Apple POSTs `code`, `state` and, on the
+*    user's FIRST authorization only, a `user` field — a JSON string with
+*    `{ name: { firstName, lastName }, email } ` that never comes back again
+*    on a later login. The callback route must therefore accept a POST body,
+*    not just a query string, and `request.input` must read that body the
+*    same way it already reads a GET query for the other providers.
+*
+* The id_token is verified with `jose` against Apple's JWKS (signature,
+* `iss`, `aud` = the client id, `exp`), then its `nonce` is compared. Apple is
+* also documented to send `email_verified` (and `is_private_email`) as the
+* STRING `"true"`/`"false"` rather than a JSON boolean on some responses, so
+* both forms are accepted here — treating only the unambiguous `"false"` (or
+* `false`) as unverified. A private-relay address (`@privaterelay.appleid.com`)
+* is still a real, working forwarding address and is accepted as any other.
+*/
+var AppleProvider = class {
+	constructor(settings) {
+		this.settings = settings;
+		this.name = "apple";
+		this.callbackMode = "form_post";
+	}
+	authorizationUrl(state) {
+		const scopes = this.settings.scopes ?? DEFAULT_SCOPES;
+		const url = new URL(AUTHORIZATION_ENDPOINT);
+		url.searchParams.set("client_id", this.settings.clientId);
+		url.searchParams.set("redirect_uri", this.settings.redirectUri);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("scope", scopes.join(" "));
+		url.searchParams.set("state", state.state);
+		url.searchParams.set("nonce", state.nonce);
+		url.searchParams.set("code_challenge", pkceChallenge(state.codeVerifier));
+		url.searchParams.set("code_challenge_method", "S256");
+		if (scopes.includes("name") || scopes.includes("email")) url.searchParams.set("response_mode", "form_post");
+		return url.toString();
+	}
+	async handleCallback({ query, expected }) {
+		const jose = await loadOptionalPeer("jose", APPLE_AUTH_FEATURE);
+		const code = query.code;
+		if (typeof code !== "string" || code.length === 0) throw new InvalidProviderCallbackError("missing-code");
+		const idToken = await this.exchangeCode(jose, code, expected.codeVerifier);
+		const claims = await this.verifyIdToken(jose, idToken);
+		if (typeof claims.nonce !== "string" || claims.nonce !== expected.nonce) throw new InvalidProviderCallbackError("nonce-mismatch");
+		if (typeof claims.sub !== "string" || claims.sub.length === 0) throw new InvalidProviderCallbackError("missing-subject");
+		return {
+			provider: this.name,
+			providerUserId: claims.sub,
+			email: typeof claims.email === "string" ? claims.email : void 0,
+			emailVerified: isVerifiedFlag(claims.email_verified),
+			name: nameFromUserField(query.user),
+			raw: claims
+		};
+	}
+	/** Sign a fresh ES256 client-secret JWT — Apple has no static one. */
+	async clientSecret(jose) {
+		const key = await jose.importPKCS8(this.settings.privateKey, "ES256");
+		const now = Math.floor(Date.now() / 1e3);
+		try {
+			return await new jose.SignJWT({}).setProtectedHeader({
+				alg: "ES256",
+				kid: this.settings.keyId
+			}).setIssuer(this.settings.teamId).setIssuedAt().setExpirationTime(now + CLIENT_SECRET_TTL_SECONDS).setAudience(ISSUER).setSubject(this.settings.clientId).sign(key);
+		} catch (error) {
+			throw new InvalidProviderCallbackError("client-secret-signing-failed", error);
+		}
+	}
+	/** Redeem the authorization code (with the PKCE verifier) for an id_token. */
+	async exchangeCode(jose, code, codeVerifier) {
+		const clientSecret = await this.clientSecret(jose);
+		let body;
+		try {
+			const response = await fetch(TOKEN_ENDPOINT, {
+				method: "POST",
+				headers: { "content-type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({
+					code,
+					client_id: this.settings.clientId,
+					client_secret: clientSecret,
+					redirect_uri: this.settings.redirectUri,
+					grant_type: "authorization_code",
+					code_verifier: codeVerifier
+				})
+			});
+			if (!response.ok) throw new Error(`Apple token endpoint answered ${response.status}`);
+			body = await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("code-exchange-failed", error);
+		}
+		if (typeof body.id_token !== "string") throw new InvalidProviderCallbackError("missing-id-token");
+		return body.id_token;
+	}
+	/** Verify signature, issuer, audience and expiry; resolve the claims. */
+	async verifyIdToken(jose, idToken) {
+		appleKeySet ??= jose.createRemoteJWKSet(new URL(JWKS_URI));
+		try {
+			const { payload } = await jose.jwtVerify(idToken, appleKeySet, {
+				issuer: [ISSUER],
+				audience: this.settings.clientId
+			});
+			return payload;
+		} catch (error) {
+			throw new InvalidProviderCallbackError("invalid-id-token", error);
+		}
+	}
+};
+/** Apple's `email_verified` arrives as a JSON boolean on some responses, a `"true"`/`"false"` string on others. */
+function isVerifiedFlag(value) {
+	return value === true || value === "true";
+}
+/**
+* Apple sends the account name only once, on the FIRST authorization, as a
+* `user` form field holding a JSON string: `{"name":{"firstName","lastName"}}`.
+* Every later login omits it entirely — callers that need the name must save
+* it themselves the first time.
+*/
+function nameFromUserField(user) {
+	if (typeof user !== "string" || user.length === 0) return void 0;
+	try {
+		const parsed = JSON.parse(user);
+		const name = [parsed.name?.firstName, parsed.name?.lastName].filter((part) => Boolean(part)).join(" ");
+		return name.length > 0 ? name : void 0;
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+export { APPLE_AUTH_FEATURE, AppleProvider };
+//# sourceMappingURL=apple-provider.mjs.map

package/esm/providers/apple-provider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-provider.mjs","names":[],"sources":["../../../../../../../auth/src/providers/apple-provider.ts"],"sourcesContent":["import type {\n  AppleProviderConfig,\n  AuthProvider,\n  ProviderAuthorizationState,\n  ProviderCallbackParams,\n  ProviderProfile,\n} from \"../contracts/providers\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport { loadOptionalPeer } from \"../services/optional-peer\";\nimport type { JoseModule } from \"./google-provider\";\nimport { pkceChallenge } from \"./google-provider\";\n\nconst AUTHORIZATION_ENDPOINT = \"https://appleid.apple.com/auth/authorize\";\nconst TOKEN_ENDPOINT = \"https://appleid.apple.com/auth/token\";\nconst JWKS_URI = \"https://appleid.apple.com/auth/keys\";\nconst ISSUER = \"https://appleid.apple.com\";\nconst DEFAULT_SCOPES = [\"name\", \"email\"];\n/** Apple's own recommendation for a per-request client secret: minutes, not the 6-month maximum it allows. */\nconst CLIENT_SECRET_TTL_SECONDS = 5 * 60;\n\n/** The `warlock add` feature that installs `jose`. */\nexport const APPLE_AUTH_FEATURE = \"auth-apple\";\n\ntype AppleSignJwtBuilder = {\n  setIssuer: (issuer: string) => AppleSignJwtBuilder;\n  setIssuedAt: () => AppleSignJwtBuilder;\n  setExpirationTime: (time: number) => AppleSignJwtBuilder;\n  setAudience: (audience: string) => AppleSignJwtBuilder;\n  setSubject: (subject: string) => AppleSignJwtBuilder;\n  sign: (key: unknown) => Promise<string>;\n};\n\n/**\n * The slice of `jose` the Apple provider uses on top of {@link JoseModule} —\n * `importPKCS8` and `SignJWT` sign the ES256 client-secret JWT Apple requires\n * instead of a static client secret.\n */\nexport type AppleJoseModule = JoseModule & {\n  importPKCS8: (pkcs8: string, alg: string) => Promise<unknown>;\n  SignJWT: new (payload: Record<string, unknown>) => {\n    setProtectedHeader: (header: Record<string, unknown>) => AppleSignJwtBuilder;\n  };\n};\n\n/** Apple's key set, created once per process; `jose` caches the fetched JWKS inside it. */\nlet appleKeySet: unknown;\n\n/**\n * Apple (\"Sign in with Apple\") is OpenID Connect over the authorization code\n * flow with PKCE (S256), `state` and `nonce`, the same shape as\n * {@link GoogleProvider} — with two differences that come straight from\n * Apple's own docs (this package has no Apple developer account, so nothing\n * here is proven against a live exchange):\n *\n * 1. Apple has no static client secret. The \"secret\" the token endpoint wants\n *    is a fresh ES256 JWT (`iss` = team id, `sub` = client id, `aud` =\n *    `https://appleid.apple.com`, signed with the app's private key and the\n *    key id as `kid`) — signed once per callback here rather than cached, to\n *    avoid ever presenting a stale one.\n * 2. Requesting `name`/`email` (the default scopes) forces\n *    `response_mode=form_post`: Apple POSTs `code`, `state` and, on the\n *    user's FIRST authorization only, a `user` field — a JSON string with\n *    `{ name: { firstName, lastName }, email } ` that never comes back again\n *    on a later login. The callback route must therefore accept a POST body,\n *    not just a query string, and `request.input` must read that body the\n *    same way it already reads a GET query for the other providers.\n *\n * The id_token is verified with `jose` against Apple's JWKS (signature,\n * `iss`, `aud` = the client id, `exp`), then its `nonce` is compared. Apple is\n * also documented to send `email_verified` (and `is_private_email`) as the\n * STRING `\"true\"`/`\"false\"` rather than a JSON boolean on some responses, so\n * both forms are accepted here — treating only the unambiguous `\"false\"` (or\n * `false`) as unverified. A private-relay address (`@privaterelay.appleid.com`)\n * is still a real, working forwarding address and is accepted as any other.\n */\nexport class AppleProvider implements AuthProvider {\n  public readonly name = \"apple\";\n  /** Apple's default scopes (`name`, `email`) force `response_mode=form_post`. */\n  public readonly callbackMode = \"form_post\";\n\n  public constructor(private readonly settings: AppleProviderConfig) {}\n\n  public authorizationUrl(state: ProviderAuthorizationState): string {\n    const scopes = this.settings.scopes ?? DEFAULT_SCOPES;\n    const url = new URL(AUTHORIZATION_ENDPOINT);\n\n    url.searchParams.set(\"client_id\", this.settings.clientId);\n    url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"scope\", scopes.join(\" \"));\n    url.searchParams.set(\"state\", state.state);\n    url.searchParams.set(\"nonce\", state.nonce);\n    url.searchParams.set(\"code_challenge\", pkceChallenge(state.codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    // Apple requires form_post whenever name/email scopes are requested.\n    if (scopes.includes(\"name\") || scopes.includes(\"email\")) {\n      url.searchParams.set(\"response_mode\", \"form_post\");\n    }\n\n    return url.toString();\n  }\n\n  public async handleCallback({\n    query,\n    expected,\n  }: ProviderCallbackParams): Promise<ProviderProfile> {\n    // Load the peer first: a missing SDK fails loudly before any network call.\n    const jose = await loadOptionalPeer<AppleJoseModule>(\"jose\", APPLE_AUTH_FEATURE);\n\n    const code = query.code;\n\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-code\");\n    }\n\n    const idToken = await this.exchangeCode(jose, code, expected.codeVerifier);\n    const claims = await this.verifyIdToken(jose, idToken);\n\n    if (typeof claims.nonce !== \"string\" || claims.nonce !== expected.nonce) {\n      throw new InvalidProviderCallbackError(\"nonce-mismatch\");\n    }\n\n    if (typeof claims.sub !== \"string\" || claims.sub.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-subject\");\n    }\n\n    return {\n      provider: this.name,\n      providerUserId: claims.sub,\n      email: typeof claims.email === \"string\" ? claims.email : undefined,\n      emailVerified: isVerifiedFlag(claims.email_verified),\n      name: nameFromUserField(query.user),\n      raw: claims,\n    };\n  }\n\n  /** Sign a fresh ES256 client-secret JWT — Apple has no static one. */\n  private async clientSecret(jose: AppleJoseModule): Promise<string> {\n    const key = await jose.importPKCS8(this.settings.privateKey, \"ES256\");\n    const now = Math.floor(Date.now() / 1000);\n\n    try {\n      return await new jose.SignJWT({})\n        .setProtectedHeader({ alg: \"ES256\", kid: this.settings.keyId })\n        .setIssuer(this.settings.teamId)\n        .setIssuedAt()\n        .setExpirationTime(now + CLIENT_SECRET_TTL_SECONDS)\n        .setAudience(ISSUER)\n        .setSubject(this.settings.clientId)\n        .sign(key);\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"client-secret-signing-failed\", error);\n    }\n  }\n\n  /** Redeem the authorization code (with the PKCE verifier) for an id_token. */\n  private async exchangeCode(\n    jose: AppleJoseModule,\n    code: string,\n    codeVerifier: string,\n  ): Promise<string> {\n    const clientSecret = await this.clientSecret(jose);\n    let body: { id_token?: unknown };\n\n    try {\n      const response = await fetch(TOKEN_ENDPOINT, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          code,\n          client_id: this.settings.clientId,\n          client_secret: clientSecret,\n          redirect_uri: this.settings.redirectUri,\n          grant_type: \"authorization_code\",\n          code_verifier: codeVerifier,\n        }),\n      });\n\n      if (!response.ok) {\n        throw new Error(`Apple token endpoint answered ${response.status}`);\n      }\n\n      body = (await response.json()) as { id_token?: unknown };\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", error);\n    }\n\n    if (typeof body.id_token !== \"string\") {\n      throw new InvalidProviderCallbackError(\"missing-id-token\");\n    }\n\n    return body.id_token;\n  }\n\n  /** Verify signature, issuer, audience and expiry; resolve the claims. */\n  private async verifyIdToken(\n    jose: AppleJoseModule,\n    idToken: string,\n  ): Promise<Record<string, unknown>> {\n    appleKeySet ??= jose.createRemoteJWKSet(new URL(JWKS_URI));\n\n    try {\n      const { payload } = await jose.jwtVerify(idToken, appleKeySet, {\n        issuer: [ISSUER],\n        audience: this.settings.clientId,\n      });\n\n      return payload;\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"invalid-id-token\", error);\n    }\n  }\n}\n\n/** Apple's `email_verified` arrives as a JSON boolean on some responses, a `\"true\"`/`\"false\"` string on others. */\nfunction isVerifiedFlag(value: unknown): boolean {\n  return value === true || value === \"true\";\n}\n\n/**\n * Apple sends the account name only once, on the FIRST authorization, as a\n * `user` form field holding a JSON string: `{\"name\":{\"firstName\",\"lastName\"}}`.\n * Every later login omits it entirely — callers that need the name must save\n * it themselves the first time.\n */\nfunction nameFromUserField(user: unknown): string | undefined {\n  if (typeof user !== \"string\" || user.length === 0) return undefined;\n\n  try {\n    const parsed = JSON.parse(user) as { name?: { firstName?: string; lastName?: string } };\n    const first = parsed.name?.firstName;\n    const last = parsed.name?.lastName;\n    const name = [first, last].filter((part): part is string => Boolean(part)).join(\" \");\n\n    return name.length > 0 ? name : undefined;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;AAYA,MAAM,yBAAyB;AAC/B,MAAM,iBAAiB;AACvB,MAAM,WAAW;AACjB,MAAM,SAAS;AACf,MAAM,iBAAiB,CAAC,QAAQ,OAAO;;AAEvC,MAAM,4BAA4B;;AAGlC,MAAa,qBAAqB;;AAwBlC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BJ,IAAa,gBAAb,MAAmD;CAKjD,AAAO,YAAY,AAAiB,UAA+B;EAA/B;cAJb;sBAEQ;CAEqC;CAEpE,AAAO,iBAAiB,OAA2C;EACjE,MAAM,SAAS,KAAK,SAAS,UAAU;EACvC,MAAM,MAAM,IAAI,IAAI,sBAAsB;EAE1C,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;EACxD,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;EAC9D,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC;EAC9C,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,kBAAkB,cAAc,MAAM,YAAY,CAAC;EACxE,IAAI,aAAa,IAAI,yBAAyB,MAAM;EAGpD,IAAI,OAAO,SAAS,MAAM,KAAK,OAAO,SAAS,OAAO,GACpD,IAAI,aAAa,IAAI,iBAAiB,WAAW;EAGnD,OAAO,IAAI,SAAS;CACtB;CAEA,MAAa,eAAe,EAC1B,OACA,YACmD;EAEnD,MAAM,OAAO,MAAM,iBAAkC,QAAQ,kBAAkB;EAE/E,MAAM,OAAO,MAAM;EAEnB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,6BAA6B,cAAc;EAGvD,MAAM,UAAU,MAAM,KAAK,aAAa,MAAM,MAAM,SAAS,YAAY;EACzE,MAAM,SAAS,MAAM,KAAK,cAAc,MAAM,OAAO;EAErD,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,SAAS,OAChE,MAAM,IAAI,6BAA6B,gBAAgB;EAGzD,IAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,IAAI,WAAW,GAC1D,MAAM,IAAI,6BAA6B,iBAAiB;EAG1D,OAAO;GACL,UAAU,KAAK;GACf,gBAAgB,OAAO;GACvB,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;GACzD,eAAe,eAAe,OAAO,cAAc;GACnD,MAAM,kBAAkB,MAAM,IAAI;GAClC,KAAK;EACP;CACF;;CAGA,MAAc,aAAa,MAAwC;EACjE,MAAM,MAAM,MAAM,KAAK,YAAY,KAAK,SAAS,YAAY,OAAO;EACpE,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EAExC,IAAI;GACF,OAAO,MAAM,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAC9B,mBAAmB;IAAE,KAAK;IAAS,KAAK,KAAK,SAAS;GAAM,CAAC,CAAC,CAC9D,UAAU,KAAK,SAAS,MAAM,CAAC,CAC/B,YAAY,CAAC,CACb,kBAAkB,MAAM,yBAAyB,CAAC,CAClD,YAAY,MAAM,CAAC,CACnB,WAAW,KAAK,SAAS,QAAQ,CAAC,CAClC,KAAK,GAAG;EACb,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,gCAAgC,KAAK;EAC9E;CACF;;CAGA,MAAc,aACZ,MACA,MACA,cACiB;EACjB,MAAM,eAAe,MAAM,KAAK,aAAa,IAAI;EACjD,IAAI;EAEJ,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAC3C,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,IAAI,gBAAgB;KACxB;KACA,WAAW,KAAK,SAAS;KACzB,eAAe;KACf,cAAc,KAAK,SAAS;KAC5B,YAAY;KACZ,eAAe;IACjB,CAAC;GACH,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,iCAAiC,SAAS,QAAQ;GAGpE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;EAEA,IAAI,OAAO,KAAK,aAAa,UAC3B,MAAM,IAAI,6BAA6B,kBAAkB;EAG3D,OAAO,KAAK;CACd;;CAGA,MAAc,cACZ,MACA,SACkC;EAClC,gBAAgB,KAAK,mBAAmB,IAAI,IAAI,QAAQ,CAAC;EAEzD,IAAI;GACF,MAAM,EAAE,YAAY,MAAM,KAAK,UAAU,SAAS,aAAa;IAC7D,QAAQ,CAAC,MAAM;IACf,UAAU,KAAK,SAAS;GAC1B,CAAC;GAED,OAAO;EACT,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,oBAAoB,KAAK;EAClE;CACF;AACF;;AAGA,SAAS,eAAe,OAAyB;CAC/C,OAAO,UAAU,QAAQ,UAAU;AACrC;;;;;;;AAQA,SAAS,kBAAkB,MAAmC;CAC5D,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,OAAO;CAE1D,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAG9B,MAAM,OAAO,CAFC,OAAO,MAAM,WACd,OAAO,MAAM,QACD,CAAC,CAAC,QAAQ,SAAyB,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;EAEnF,OAAO,KAAK,SAAS,IAAI,OAAO;CAClC,QAAQ;EACN;CACF;AACF"}

package/esm/providers/discord-provider.d.mts

@@ -0,0 +1,25 @@
+import { AuthProvider, DiscordProviderConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile } from "../contracts/providers.mjs";
+
+//#region ../auth/src/providers/discord-provider.d.ts
+/**
+ * Discord sign-in: plain OAuth 2 authorization code flow with PKCE (S256).
+ * Like GitHub, Discord is not OpenID Connect — there is no `id_token`; the
+ * access token is redeemed once for `/users/@me` over a direct HTTPS call.
+ * No vendor SDK is involved.
+ */
+declare class DiscordProvider implements AuthProvider {
+  private readonly settings;
+  readonly name = "discord";
+  constructor(settings: DiscordProviderConfig);
+  authorizationUrl(state: ProviderAuthorizationState): string;
+  handleCallback({
+    query,
+    expected
+  }: ProviderCallbackParams): Promise<ProviderProfile>;
+  /** Redeem the authorization code (with the PKCE verifier) for an access token. */
+  private exchangeCode;
+  private fetchUser;
+}
+//#endregion
+export { DiscordProvider };
+//# sourceMappingURL=discord-provider.d.mts.map

package/esm/providers/discord-provider.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-provider.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/discord-provider.ts"],"mappings":";;;;;AA8BA;;;;cAAa,eAAA,YAA2B,YAAA;EAAA,iBAGF,QAAA;EAAA,SAFpB,IAAA;cAEoB,QAAA,EAAU,qBAAA;EAEvC,gBAAA,CAAiB,KAAA,EAAO,0BAAA;EAclB,cAAA;IACX,KAAA;IACA;EAAA,GACC,sBAAA,GAAyB,OAAA,CAAQ,eAAA;EAtBE;EAAA,QAkDxB,YAAA;EAAA,QAiCA,SAAA;AAAA"}

package/esm/providers/discord-provider.mjs

@@ -0,0 +1,84 @@
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { pkceChallenge } from "./google-provider.mjs";
+
+//#region ../auth/src/providers/discord-provider.ts
+const AUTHORIZATION_ENDPOINT = "https://discord.com/oauth2/authorize";
+const TOKEN_ENDPOINT = "https://discord.com/api/oauth2/token";
+const USER_ENDPOINT = "https://discord.com/api/users/@me";
+const DEFAULT_SCOPES = ["identify", "email"];
+/**
+* Discord sign-in: plain OAuth 2 authorization code flow with PKCE (S256).
+* Like GitHub, Discord is not OpenID Connect — there is no `id_token`; the
+* access token is redeemed once for `/users/@me` over a direct HTTPS call.
+* No vendor SDK is involved.
+*/
+var DiscordProvider = class {
+	constructor(settings) {
+		this.settings = settings;
+		this.name = "discord";
+	}
+	authorizationUrl(state) {
+		const url = new URL(AUTHORIZATION_ENDPOINT);
+		url.searchParams.set("client_id", this.settings.clientId);
+		url.searchParams.set("redirect_uri", this.settings.redirectUri);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("scope", (this.settings.scopes ?? DEFAULT_SCOPES).join(" "));
+		url.searchParams.set("state", state.state);
+		url.searchParams.set("code_challenge", pkceChallenge(state.codeVerifier));
+		url.searchParams.set("code_challenge_method", "S256");
+		return url.toString();
+	}
+	async handleCallback({ query, expected }) {
+		const code = query.code;
+		if (typeof code !== "string" || code.length === 0) throw new InvalidProviderCallbackError("missing-code");
+		const accessToken = await this.exchangeCode(code, expected.codeVerifier);
+		const user = await this.fetchUser(accessToken);
+		if (typeof user.id !== "string" || user.id.length === 0) throw new InvalidProviderCallbackError("missing-subject");
+		return {
+			provider: this.name,
+			providerUserId: user.id,
+			email: user.email ?? void 0,
+			emailVerified: user.verified === true,
+			name: user.global_name ?? user.username,
+			avatar: user.avatar ? `https://cdn.discordapp.com/avatars/${user.id}/${user.avatar}.png` : void 0,
+			raw: user
+		};
+	}
+	/** Redeem the authorization code (with the PKCE verifier) for an access token. */
+	async exchangeCode(code, codeVerifier) {
+		let body;
+		try {
+			const response = await fetch(TOKEN_ENDPOINT, {
+				method: "POST",
+				headers: { "content-type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({
+					code,
+					client_id: this.settings.clientId,
+					client_secret: this.settings.clientSecret,
+					redirect_uri: this.settings.redirectUri,
+					grant_type: "authorization_code",
+					code_verifier: codeVerifier
+				})
+			});
+			if (!response.ok) throw new Error(`Discord token endpoint answered ${response.status}`);
+			body = await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("code-exchange-failed", error);
+		}
+		if (typeof body.access_token !== "string" || body.access_token.length === 0) throw new InvalidProviderCallbackError("missing-access-token");
+		return body.access_token;
+	}
+	async fetchUser(accessToken) {
+		try {
+			const response = await fetch(USER_ENDPOINT, { headers: { authorization: `Bearer ${accessToken}` } });
+			if (!response.ok) throw new Error(`Discord user endpoint answered ${response.status}`);
+			return await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("profile-fetch-failed", error);
+		}
+	}
+};
+
+//#endregion
+export { DiscordProvider };
+//# sourceMappingURL=discord-provider.mjs.map

package/esm/providers/discord-provider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-provider.mjs","names":[],"sources":["../../../../../../../auth/src/providers/discord-provider.ts"],"sourcesContent":["import type {\n  AuthProvider,\n  DiscordProviderConfig,\n  ProviderAuthorizationState,\n  ProviderCallbackParams,\n  ProviderProfile,\n} from \"../contracts/providers\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport { pkceChallenge } from \"./google-provider\";\n\nconst AUTHORIZATION_ENDPOINT = \"https://discord.com/oauth2/authorize\";\nconst TOKEN_ENDPOINT = \"https://discord.com/api/oauth2/token\";\nconst USER_ENDPOINT = \"https://discord.com/api/users/@me\";\nconst DEFAULT_SCOPES = [\"identify\", \"email\"];\n\ntype DiscordUser = {\n  id: string;\n  username: string;\n  global_name?: string | null;\n  avatar?: string | null;\n  email?: string | null;\n  verified?: boolean;\n};\n\n/**\n * Discord sign-in: plain OAuth 2 authorization code flow with PKCE (S256).\n * Like GitHub, Discord is not OpenID Connect — there is no `id_token`; the\n * access token is redeemed once for `/users/@me` over a direct HTTPS call.\n * No vendor SDK is involved.\n */\nexport class DiscordProvider implements AuthProvider {\n  public readonly name = \"discord\";\n\n  public constructor(private readonly settings: DiscordProviderConfig) {}\n\n  public authorizationUrl(state: ProviderAuthorizationState): string {\n    const url = new URL(AUTHORIZATION_ENDPOINT);\n\n    url.searchParams.set(\"client_id\", this.settings.clientId);\n    url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"scope\", (this.settings.scopes ?? DEFAULT_SCOPES).join(\" \"));\n    url.searchParams.set(\"state\", state.state);\n    url.searchParams.set(\"code_challenge\", pkceChallenge(state.codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    return url.toString();\n  }\n\n  public async handleCallback({\n    query,\n    expected,\n  }: ProviderCallbackParams): Promise<ProviderProfile> {\n    const code = query.code;\n\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-code\");\n    }\n\n    const accessToken = await this.exchangeCode(code, expected.codeVerifier);\n    const user = await this.fetchUser(accessToken);\n\n    if (typeof user.id !== \"string\" || user.id.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-subject\");\n    }\n\n    return {\n      provider: this.name,\n      providerUserId: user.id,\n      email: user.email ?? undefined,\n      emailVerified: user.verified === true,\n      name: user.global_name ?? user.username,\n      avatar: user.avatar\n        ? `https://cdn.discordapp.com/avatars/${user.id}/${user.avatar}.png`\n        : undefined,\n      raw: user,\n    };\n  }\n\n  /** Redeem the authorization code (with the PKCE verifier) for an access token. */\n  private async exchangeCode(code: string, codeVerifier: string): Promise<string> {\n    let body: { access_token?: unknown };\n\n    try {\n      const response = await fetch(TOKEN_ENDPOINT, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          code,\n          client_id: this.settings.clientId,\n          client_secret: this.settings.clientSecret,\n          redirect_uri: this.settings.redirectUri,\n          grant_type: \"authorization_code\",\n          code_verifier: codeVerifier,\n        }),\n      });\n\n      if (!response.ok) {\n        throw new Error(`Discord token endpoint answered ${response.status}`);\n      }\n\n      body = (await response.json()) as { access_token?: unknown };\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", error);\n    }\n\n    if (typeof body.access_token !== \"string\" || body.access_token.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-access-token\");\n    }\n\n    return body.access_token;\n  }\n\n  private async fetchUser(accessToken: string): Promise<DiscordUser> {\n    try {\n      const response = await fetch(USER_ENDPOINT, {\n        headers: { authorization: `Bearer ${accessToken}` },\n      });\n\n      if (!response.ok) {\n        throw new Error(`Discord user endpoint answered ${response.status}`);\n      }\n\n      return (await response.json()) as DiscordUser;\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"profile-fetch-failed\", error);\n    }\n  }\n}\n"],"mappings":";;;;AAUA,MAAM,yBAAyB;AAC/B,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB,CAAC,YAAY,OAAO;;;;;;;AAiB3C,IAAa,kBAAb,MAAqD;CAGnD,AAAO,YAAY,AAAiB,UAAiC;EAAjC;cAFb;CAE+C;CAEtE,AAAO,iBAAiB,OAA2C;EACjE,MAAM,MAAM,IAAI,IAAI,sBAAsB;EAE1C,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;EACxD,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;EAC9D,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,UAAU,KAAK,SAAS,UAAU,eAAc,CAAE,KAAK,GAAG,CAAC;EAChF,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,kBAAkB,cAAc,MAAM,YAAY,CAAC;EACxE,IAAI,aAAa,IAAI,yBAAyB,MAAM;EAEpD,OAAO,IAAI,SAAS;CACtB;CAEA,MAAa,eAAe,EAC1B,OACA,YACmD;EACnD,MAAM,OAAO,MAAM;EAEnB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,6BAA6B,cAAc;EAGvD,MAAM,cAAc,MAAM,KAAK,aAAa,MAAM,SAAS,YAAY;EACvE,MAAM,OAAO,MAAM,KAAK,UAAU,WAAW;EAE7C,IAAI,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,WAAW,GACpD,MAAM,IAAI,6BAA6B,iBAAiB;EAG1D,OAAO;GACL,UAAU,KAAK;GACf,gBAAgB,KAAK;GACrB,OAAO,KAAK,SAAS;GACrB,eAAe,KAAK,aAAa;GACjC,MAAM,KAAK,eAAe,KAAK;GAC/B,QAAQ,KAAK,SACT,sCAAsC,KAAK,GAAG,GAAG,KAAK,OAAO,QAC7D;GACJ,KAAK;EACP;CACF;;CAGA,MAAc,aAAa,MAAc,cAAuC;EAC9E,IAAI;EAEJ,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAC3C,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,IAAI,gBAAgB;KACxB;KACA,WAAW,KAAK,SAAS;KACzB,eAAe,KAAK,SAAS;KAC7B,cAAc,KAAK,SAAS;KAC5B,YAAY;KACZ,eAAe;IACjB,CAAC;GACH,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,mCAAmC,SAAS,QAAQ;GAGtE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;EAEA,IAAI,OAAO,KAAK,iBAAiB,YAAY,KAAK,aAAa,WAAW,GACxE,MAAM,IAAI,6BAA6B,sBAAsB;EAG/D,OAAO,KAAK;CACd;CAEA,MAAc,UAAU,aAA2C;EACjE,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,eAAe,EAC1C,SAAS,EAAE,eAAe,UAAU,cAAc,EACpD,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,kCAAkC,SAAS,QAAQ;GAGrE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;CACF;AACF"}

package/esm/providers/facebook-provider.d.mts

@@ -0,0 +1,36 @@
+import { AuthProvider, FacebookProviderConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile } from "../contracts/providers.mjs";
+
+//#region ../auth/src/providers/facebook-provider.d.ts
+/**
+ * Facebook sign-in: plain OAuth 2 authorization code flow with PKCE (S256).
+ * Facebook is not OpenID Connect — there is no `id_token`. Unlike every other
+ * built-in provider, Facebook's token endpoint is redeemed with a `GET`
+ * request (query-string parameters, not a POST body) — that shape comes
+ * straight from Facebook's Graph API docs, not from a live exchange (this
+ * package has no Facebook test app). The profile is then read once from
+ * `Graph /me?fields=id,name,email,picture`, over a direct HTTPS call; no
+ * Facebook SDK is involved.
+ *
+ * Facebook only ever returns a confirmed address for `email` — there is no
+ * separate verified flag — so an email present on the profile is treated as
+ * verified. An app without `email` permission granted, or one that simply has
+ * no email on file, gets `email: undefined`, which `resolveProviderUser`
+ * already rejects as an unverified/missing email, the same path GitHub's
+ * unverified addresses take.
+ */
+declare class FacebookProvider implements AuthProvider {
+  private readonly settings;
+  readonly name = "facebook";
+  constructor(settings: FacebookProviderConfig);
+  authorizationUrl(state: ProviderAuthorizationState): string;
+  handleCallback({
+    query,
+    expected
+  }: ProviderCallbackParams): Promise<ProviderProfile>;
+  /** Redeem the authorization code (with the PKCE verifier) for an access token. */
+  private exchangeCode;
+  private fetchUser;
+}
+//#endregion
+export { FacebookProvider };
+//# sourceMappingURL=facebook-provider.d.mts.map

package/esm/providers/facebook-provider.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facebook-provider.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/facebook-provider.ts"],"mappings":";;;;;AAuCA;;;;;;;;;;;;;;;cAAa,gBAAA,YAA4B,YAAA;EAAA,iBAGH,QAAA;EAAA,SAFpB,IAAA;cAEoB,QAAA,EAAU,sBAAA;EAEvC,gBAAA,CAAiB,KAAA,EAAO,0BAAA;EAclB,cAAA;IACX,KAAA;IACA;EAAA,GACC,sBAAA,GAAyB,OAAA,CAAQ,eAAA;EAjBZ;EAAA,QA4CV,YAAA;EAAA,QAkCA,SAAA;AAAA"}