@warlock.js/auth 5.15.0 → 5.16.0

package/esm/providers/facebook-provider.mjs

@@ -0,0 +1,94 @@
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { pkceChallenge } from "./google-provider.mjs";
+
+//#region ../auth/src/providers/facebook-provider.ts
+const AUTHORIZATION_ENDPOINT = "https://www.facebook.com/v19.0/dialog/oauth";
+const TOKEN_ENDPOINT = "https://graph.facebook.com/v19.0/oauth/access_token";
+const USER_ENDPOINT = "https://graph.facebook.com/v19.0/me";
+const DEFAULT_SCOPES = ["email", "public_profile"];
+/**
+* Facebook sign-in: plain OAuth 2 authorization code flow with PKCE (S256).
+* Facebook is not OpenID Connect — there is no `id_token`. Unlike every other
+* built-in provider, Facebook's token endpoint is redeemed with a `GET`
+* request (query-string parameters, not a POST body) — that shape comes
+* straight from Facebook's Graph API docs, not from a live exchange (this
+* package has no Facebook test app). The profile is then read once from
+* `Graph /me?fields=id,name,email,picture`, over a direct HTTPS call; no
+* Facebook SDK is involved.
+*
+* Facebook only ever returns a confirmed address for `email` — there is no
+* separate verified flag — so an email present on the profile is treated as
+* verified. An app without `email` permission granted, or one that simply has
+* no email on file, gets `email: undefined`, which `resolveProviderUser`
+* already rejects as an unverified/missing email, the same path GitHub's
+* unverified addresses take.
+*/
+var FacebookProvider = class {
+	constructor(settings) {
+		this.settings = settings;
+		this.name = "facebook";
+	}
+	authorizationUrl(state) {
+		const url = new URL(AUTHORIZATION_ENDPOINT);
+		url.searchParams.set("client_id", this.settings.clientId);
+		url.searchParams.set("redirect_uri", this.settings.redirectUri);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("scope", (this.settings.scopes ?? DEFAULT_SCOPES).join(" "));
+		url.searchParams.set("state", state.state);
+		url.searchParams.set("code_challenge", pkceChallenge(state.codeVerifier));
+		url.searchParams.set("code_challenge_method", "S256");
+		return url.toString();
+	}
+	async handleCallback({ query, expected }) {
+		const code = query.code;
+		if (typeof code !== "string" || code.length === 0) throw new InvalidProviderCallbackError("missing-code");
+		const accessToken = await this.exchangeCode(code, expected.codeVerifier);
+		const user = await this.fetchUser(accessToken);
+		if (typeof user.id !== "string" || user.id.length === 0) throw new InvalidProviderCallbackError("missing-subject");
+		return {
+			provider: this.name,
+			providerUserId: user.id,
+			email: user.email,
+			emailVerified: typeof user.email === "string" && user.email.length > 0,
+			name: user.name,
+			avatar: user.picture?.data?.url,
+			raw: user
+		};
+	}
+	/** Redeem the authorization code (with the PKCE verifier) for an access token. */
+	async exchangeCode(code, codeVerifier) {
+		let body;
+		try {
+			const url = new URL(TOKEN_ENDPOINT);
+			url.searchParams.set("client_id", this.settings.clientId);
+			url.searchParams.set("client_secret", this.settings.clientSecret);
+			url.searchParams.set("redirect_uri", this.settings.redirectUri);
+			url.searchParams.set("code", code);
+			url.searchParams.set("code_verifier", codeVerifier);
+			const response = await fetch(url.toString(), { headers: { accept: "application/json" } });
+			if (!response.ok) throw new Error(`Facebook token endpoint answered ${response.status}`);
+			body = await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("code-exchange-failed", error);
+		}
+		if (body.error) throw new InvalidProviderCallbackError("code-exchange-failed", body.error);
+		if (typeof body.access_token !== "string" || body.access_token.length === 0) throw new InvalidProviderCallbackError("missing-access-token");
+		return body.access_token;
+	}
+	async fetchUser(accessToken) {
+		try {
+			const url = new URL(USER_ENDPOINT);
+			url.searchParams.set("fields", "id,name,email,picture");
+			url.searchParams.set("access_token", accessToken);
+			const response = await fetch(url.toString(), { headers: { accept: "application/json" } });
+			if (!response.ok) throw new Error(`Facebook /me endpoint answered ${response.status}`);
+			return await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("profile-fetch-failed", error);
+		}
+	}
+};
+
+//#endregion
+export { FacebookProvider };
+//# sourceMappingURL=facebook-provider.mjs.map

package/esm/providers/facebook-provider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"facebook-provider.mjs","names":[],"sources":["../../../../../../../auth/src/providers/facebook-provider.ts"],"sourcesContent":["import type {\n  AuthProvider,\n  FacebookProviderConfig,\n  ProviderAuthorizationState,\n  ProviderCallbackParams,\n  ProviderProfile,\n} from \"../contracts/providers\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport { pkceChallenge } from \"./google-provider\";\n\nconst AUTHORIZATION_ENDPOINT = \"https://www.facebook.com/v19.0/dialog/oauth\";\nconst TOKEN_ENDPOINT = \"https://graph.facebook.com/v19.0/oauth/access_token\";\nconst USER_ENDPOINT = \"https://graph.facebook.com/v19.0/me\";\nconst DEFAULT_SCOPES = [\"email\", \"public_profile\"];\n\ntype FacebookUser = {\n  id: string;\n  name?: string;\n  email?: string;\n  picture?: { data?: { url?: string } };\n};\n\n/**\n * Facebook sign-in: plain OAuth 2 authorization code flow with PKCE (S256).\n * Facebook is not OpenID Connect — there is no `id_token`. Unlike every other\n * built-in provider, Facebook's token endpoint is redeemed with a `GET`\n * request (query-string parameters, not a POST body) — that shape comes\n * straight from Facebook's Graph API docs, not from a live exchange (this\n * package has no Facebook test app). The profile is then read once from\n * `Graph /me?fields=id,name,email,picture`, over a direct HTTPS call; no\n * Facebook SDK is involved.\n *\n * Facebook only ever returns a confirmed address for `email` — there is no\n * separate verified flag — so an email present on the profile is treated as\n * verified. An app without `email` permission granted, or one that simply has\n * no email on file, gets `email: undefined`, which `resolveProviderUser`\n * already rejects as an unverified/missing email, the same path GitHub's\n * unverified addresses take.\n */\nexport class FacebookProvider implements AuthProvider {\n  public readonly name = \"facebook\";\n\n  public constructor(private readonly settings: FacebookProviderConfig) {}\n\n  public authorizationUrl(state: ProviderAuthorizationState): string {\n    const url = new URL(AUTHORIZATION_ENDPOINT);\n\n    url.searchParams.set(\"client_id\", this.settings.clientId);\n    url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"scope\", (this.settings.scopes ?? DEFAULT_SCOPES).join(\" \"));\n    url.searchParams.set(\"state\", state.state);\n    url.searchParams.set(\"code_challenge\", pkceChallenge(state.codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    return url.toString();\n  }\n\n  public async handleCallback({\n    query,\n    expected,\n  }: ProviderCallbackParams): Promise<ProviderProfile> {\n    const code = query.code;\n\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-code\");\n    }\n\n    const accessToken = await this.exchangeCode(code, expected.codeVerifier);\n    const user = await this.fetchUser(accessToken);\n\n    if (typeof user.id !== \"string\" || user.id.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-subject\");\n    }\n\n    return {\n      provider: this.name,\n      providerUserId: user.id,\n      email: user.email,\n      // Facebook does not report a verification flag; a returned address is confirmed.\n      emailVerified: typeof user.email === \"string\" && user.email.length > 0,\n      name: user.name,\n      avatar: user.picture?.data?.url,\n      raw: user,\n    };\n  }\n\n  /** Redeem the authorization code (with the PKCE verifier) for an access token. */\n  private async exchangeCode(code: string, codeVerifier: string): Promise<string> {\n    let body: { access_token?: unknown; error?: unknown };\n\n    try {\n      const url = new URL(TOKEN_ENDPOINT);\n\n      url.searchParams.set(\"client_id\", this.settings.clientId);\n      url.searchParams.set(\"client_secret\", this.settings.clientSecret);\n      url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n      url.searchParams.set(\"code\", code);\n      url.searchParams.set(\"code_verifier\", codeVerifier);\n\n      const response = await fetch(url.toString(), { headers: { accept: \"application/json\" } });\n\n      if (!response.ok) {\n        throw new Error(`Facebook token endpoint answered ${response.status}`);\n      }\n\n      body = (await response.json()) as { access_token?: unknown; error?: unknown };\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", error);\n    }\n\n    if (body.error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", body.error);\n    }\n\n    if (typeof body.access_token !== \"string\" || body.access_token.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-access-token\");\n    }\n\n    return body.access_token;\n  }\n\n  private async fetchUser(accessToken: string): Promise<FacebookUser> {\n    try {\n      const url = new URL(USER_ENDPOINT);\n\n      url.searchParams.set(\"fields\", \"id,name,email,picture\");\n      url.searchParams.set(\"access_token\", accessToken);\n\n      const response = await fetch(url.toString(), { headers: { accept: \"application/json\" } });\n\n      if (!response.ok) {\n        throw new Error(`Facebook /me endpoint answered ${response.status}`);\n      }\n\n      return (await response.json()) as FacebookUser;\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"profile-fetch-failed\", error);\n    }\n  }\n}\n"],"mappings":";;;;AAUA,MAAM,yBAAyB;AAC/B,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB,CAAC,SAAS,gBAAgB;;;;;;;;;;;;;;;;;;AA0BjD,IAAa,mBAAb,MAAsD;CAGpD,AAAO,YAAY,AAAiB,UAAkC;EAAlC;cAFb;CAEgD;CAEvE,AAAO,iBAAiB,OAA2C;EACjE,MAAM,MAAM,IAAI,IAAI,sBAAsB;EAE1C,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;EACxD,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;EAC9D,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,UAAU,KAAK,SAAS,UAAU,eAAc,CAAE,KAAK,GAAG,CAAC;EAChF,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,kBAAkB,cAAc,MAAM,YAAY,CAAC;EACxE,IAAI,aAAa,IAAI,yBAAyB,MAAM;EAEpD,OAAO,IAAI,SAAS;CACtB;CAEA,MAAa,eAAe,EAC1B,OACA,YACmD;EACnD,MAAM,OAAO,MAAM;EAEnB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,6BAA6B,cAAc;EAGvD,MAAM,cAAc,MAAM,KAAK,aAAa,MAAM,SAAS,YAAY;EACvE,MAAM,OAAO,MAAM,KAAK,UAAU,WAAW;EAE7C,IAAI,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,WAAW,GACpD,MAAM,IAAI,6BAA6B,iBAAiB;EAG1D,OAAO;GACL,UAAU,KAAK;GACf,gBAAgB,KAAK;GACrB,OAAO,KAAK;GAEZ,eAAe,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,SAAS;GACrE,MAAM,KAAK;GACX,QAAQ,KAAK,SAAS,MAAM;GAC5B,KAAK;EACP;CACF;;CAGA,MAAc,aAAa,MAAc,cAAuC;EAC9E,IAAI;EAEJ,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,cAAc;GAElC,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;GACxD,IAAI,aAAa,IAAI,iBAAiB,KAAK,SAAS,YAAY;GAChE,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;GAC9D,IAAI,aAAa,IAAI,QAAQ,IAAI;GACjC,IAAI,aAAa,IAAI,iBAAiB,YAAY;GAElD,MAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG,EAAE,SAAS,EAAE,QAAQ,mBAAmB,EAAE,CAAC;GAExF,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,oCAAoC,SAAS,QAAQ;GAGvE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;EAEA,IAAI,KAAK,OACP,MAAM,IAAI,6BAA6B,wBAAwB,KAAK,KAAK;EAG3E,IAAI,OAAO,KAAK,iBAAiB,YAAY,KAAK,aAAa,WAAW,GACxE,MAAM,IAAI,6BAA6B,sBAAsB;EAG/D,OAAO,KAAK;CACd;CAEA,MAAc,UAAU,aAA4C;EAClE,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,aAAa;GAEjC,IAAI,aAAa,IAAI,UAAU,uBAAuB;GACtD,IAAI,aAAa,IAAI,gBAAgB,WAAW;GAEhD,MAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG,EAAE,SAAS,EAAE,QAAQ,mBAAmB,EAAE,CAAC;GAExF,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,kCAAkC,SAAS,QAAQ;GAGrE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;CACF;AACF"}

package/esm/providers/github-provider.d.mts

@@ -0,0 +1,31 @@
+import { AuthProvider, GitHubProviderConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile } from "../contracts/providers.mjs";
+
+//#region ../auth/src/providers/github-provider.d.ts
+/**
+ * GitHub sign-in: plain OAuth 2 authorization code flow with PKCE (S256).
+ * GitHub is not OpenID Connect — there is no `id_token` and nothing to verify
+ * against a JWKS. The access token is redeemed once for the profile, over a
+ * direct HTTPS call to GitHub's API; no vendor SDK is involved.
+ *
+ * The account email is fetched separately from `/user/emails`, because
+ * `/user.email` is `null` unless the user made it public — the emails
+ * endpoint is also where GitHub reports whether an address is verified.
+ */
+declare class GitHubProvider implements AuthProvider {
+  private readonly settings;
+  readonly name = "github";
+  constructor(settings: GitHubProviderConfig);
+  authorizationUrl(state: ProviderAuthorizationState): string;
+  handleCallback({
+    query,
+    expected
+  }: ProviderCallbackParams): Promise<ProviderProfile>;
+  /** Redeem the authorization code (with the PKCE verifier) for an access token. */
+  private exchangeCode;
+  private fetchUser;
+  /** The primary, verified email — `undefined` when none is both primary and verified. */
+  private fetchPrimaryEmail;
+}
+//#endregion
+export { GitHubProvider };
+//# sourceMappingURL=github-provider.d.mts.map

package/esm/providers/github-provider.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-provider.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/github-provider.ts"],"mappings":";;;;;AA0CA;;;;;;;;cAAa,cAAA,YAA0B,YAAA;EAAA,iBAGD,QAAA;EAAA,SAFpB,IAAA;cAEoB,QAAA,EAAU,oBAAA;EAEvC,gBAAA,CAAiB,KAAA,EAAO,0BAAA;EAclB,cAAA;IACX,KAAA;IACA;EAAA,GACC,sBAAA,GAAyB,OAAA,CAAQ,eAAA;EAnBA;EAAA,QA8CtB,YAAA;EAAA,QAwCA,SAAA;EAtFgC;EAAA,QA2GhC,iBAAA;AAAA"}

package/esm/providers/github-provider.mjs

@@ -0,0 +1,115 @@
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { pkceChallenge } from "./google-provider.mjs";
+
+//#region ../auth/src/providers/github-provider.ts
+const AUTHORIZATION_ENDPOINT = "https://github.com/login/oauth/authorize";
+const TOKEN_ENDPOINT = "https://github.com/login/oauth/access_token";
+const USER_ENDPOINT = "https://api.github.com/user";
+const EMAILS_ENDPOINT = "https://api.github.com/user/emails";
+const DEFAULT_SCOPES = ["read:user", "user:email"];
+/** GitHub requires a `User-Agent`; identify the framework, not the app. */
+const USER_AGENT = "warlock.js-auth";
+/**
+* GitHub sign-in: plain OAuth 2 authorization code flow with PKCE (S256).
+* GitHub is not OpenID Connect — there is no `id_token` and nothing to verify
+* against a JWKS. The access token is redeemed once for the profile, over a
+* direct HTTPS call to GitHub's API; no vendor SDK is involved.
+*
+* The account email is fetched separately from `/user/emails`, because
+* `/user.email` is `null` unless the user made it public — the emails
+* endpoint is also where GitHub reports whether an address is verified.
+*/
+var GitHubProvider = class {
+	constructor(settings) {
+		this.settings = settings;
+		this.name = "github";
+	}
+	authorizationUrl(state) {
+		const url = new URL(AUTHORIZATION_ENDPOINT);
+		url.searchParams.set("client_id", this.settings.clientId);
+		url.searchParams.set("redirect_uri", this.settings.redirectUri);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("scope", (this.settings.scopes ?? DEFAULT_SCOPES).join(" "));
+		url.searchParams.set("state", state.state);
+		url.searchParams.set("code_challenge", pkceChallenge(state.codeVerifier));
+		url.searchParams.set("code_challenge_method", "S256");
+		return url.toString();
+	}
+	async handleCallback({ query, expected }) {
+		const code = query.code;
+		if (typeof code !== "string" || code.length === 0) throw new InvalidProviderCallbackError("missing-code");
+		const accessToken = await this.exchangeCode(code, expected.codeVerifier);
+		const user = await this.fetchUser(accessToken);
+		const email = await this.fetchPrimaryEmail(accessToken);
+		if (typeof user.id !== "number") throw new InvalidProviderCallbackError("missing-subject");
+		return {
+			provider: this.name,
+			providerUserId: String(user.id),
+			email: email?.email,
+			emailVerified: email?.verified === true,
+			name: user.name ?? user.login,
+			avatar: user.avatar_url,
+			raw: user
+		};
+	}
+	/** Redeem the authorization code (with the PKCE verifier) for an access token. */
+	async exchangeCode(code, codeVerifier) {
+		let body;
+		try {
+			const response = await fetch(TOKEN_ENDPOINT, {
+				method: "POST",
+				headers: {
+					"content-type": "application/x-www-form-urlencoded",
+					accept: "application/json"
+				},
+				body: new URLSearchParams({
+					code,
+					client_id: this.settings.clientId,
+					client_secret: this.settings.clientSecret,
+					redirect_uri: this.settings.redirectUri,
+					code_verifier: codeVerifier
+				})
+			});
+			if (!response.ok) throw new Error(`GitHub token endpoint answered ${response.status}`);
+			body = await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("code-exchange-failed", error);
+		}
+		if (body.error) throw new InvalidProviderCallbackError("code-exchange-failed", body.error);
+		if (typeof body.access_token !== "string" || body.access_token.length === 0) throw new InvalidProviderCallbackError("missing-access-token");
+		return body.access_token;
+	}
+	async fetchUser(accessToken) {
+		try {
+			const response = await fetch(USER_ENDPOINT, { headers: {
+				authorization: `Bearer ${accessToken}`,
+				accept: "application/vnd.github+json",
+				"user-agent": USER_AGENT
+			} });
+			if (!response.ok) throw new Error(`GitHub user endpoint answered ${response.status}`);
+			return await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("profile-fetch-failed", error);
+		}
+	}
+	/** The primary, verified email — `undefined` when none is both primary and verified. */
+	async fetchPrimaryEmail(accessToken) {
+		let emails;
+		try {
+			const response = await fetch(EMAILS_ENDPOINT, { headers: {
+				authorization: `Bearer ${accessToken}`,
+				accept: "application/vnd.github+json",
+				"user-agent": USER_AGENT
+			} });
+			if (!response.ok) throw new Error(`GitHub emails endpoint answered ${response.status}`);
+			emails = await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("profile-fetch-failed", error);
+		}
+		return emails.find((email) => email.primary && email.verified);
+	}
+};
+
+//#endregion
+export { GitHubProvider };
+//# sourceMappingURL=github-provider.mjs.map

package/esm/providers/github-provider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-provider.mjs","names":[],"sources":["../../../../../../../auth/src/providers/github-provider.ts"],"sourcesContent":["import type {\n  AuthProvider,\n  GitHubProviderConfig,\n  ProviderAuthorizationState,\n  ProviderCallbackParams,\n  ProviderProfile,\n} from \"../contracts/providers\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport { pkceChallenge } from \"./google-provider\";\n\nconst AUTHORIZATION_ENDPOINT = \"https://github.com/login/oauth/authorize\";\nconst TOKEN_ENDPOINT = \"https://github.com/login/oauth/access_token\";\nconst USER_ENDPOINT = \"https://api.github.com/user\";\nconst EMAILS_ENDPOINT = \"https://api.github.com/user/emails\";\nconst DEFAULT_SCOPES = [\"read:user\", \"user:email\"];\n\n/** GitHub requires a `User-Agent`; identify the framework, not the app. */\nconst USER_AGENT = \"warlock.js-auth\";\n\ntype GitHubUser = {\n  id: number;\n  login: string;\n  name?: string | null;\n  avatar_url?: string;\n};\n\ntype GitHubEmail = {\n  email: string;\n  primary: boolean;\n  verified: boolean;\n};\n\n/**\n * GitHub sign-in: plain OAuth 2 authorization code flow with PKCE (S256).\n * GitHub is not OpenID Connect — there is no `id_token` and nothing to verify\n * against a JWKS. The access token is redeemed once for the profile, over a\n * direct HTTPS call to GitHub's API; no vendor SDK is involved.\n *\n * The account email is fetched separately from `/user/emails`, because\n * `/user.email` is `null` unless the user made it public — the emails\n * endpoint is also where GitHub reports whether an address is verified.\n */\nexport class GitHubProvider implements AuthProvider {\n  public readonly name = \"github\";\n\n  public constructor(private readonly settings: GitHubProviderConfig) {}\n\n  public authorizationUrl(state: ProviderAuthorizationState): string {\n    const url = new URL(AUTHORIZATION_ENDPOINT);\n\n    url.searchParams.set(\"client_id\", this.settings.clientId);\n    url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"scope\", (this.settings.scopes ?? DEFAULT_SCOPES).join(\" \"));\n    url.searchParams.set(\"state\", state.state);\n    url.searchParams.set(\"code_challenge\", pkceChallenge(state.codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    return url.toString();\n  }\n\n  public async handleCallback({\n    query,\n    expected,\n  }: ProviderCallbackParams): Promise<ProviderProfile> {\n    const code = query.code;\n\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-code\");\n    }\n\n    const accessToken = await this.exchangeCode(code, expected.codeVerifier);\n    const user = await this.fetchUser(accessToken);\n    const email = await this.fetchPrimaryEmail(accessToken);\n\n    if (typeof user.id !== \"number\") {\n      throw new InvalidProviderCallbackError(\"missing-subject\");\n    }\n\n    return {\n      provider: this.name,\n      providerUserId: String(user.id),\n      email: email?.email,\n      emailVerified: email?.verified === true,\n      name: user.name ?? user.login,\n      avatar: user.avatar_url,\n      raw: user,\n    };\n  }\n\n  /** Redeem the authorization code (with the PKCE verifier) for an access token. */\n  private async exchangeCode(code: string, codeVerifier: string): Promise<string> {\n    let body: { access_token?: unknown; error?: unknown };\n\n    try {\n      const response = await fetch(TOKEN_ENDPOINT, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          accept: \"application/json\",\n        },\n        body: new URLSearchParams({\n          code,\n          client_id: this.settings.clientId,\n          client_secret: this.settings.clientSecret,\n          redirect_uri: this.settings.redirectUri,\n          code_verifier: codeVerifier,\n        }),\n      });\n\n      if (!response.ok) {\n        throw new Error(`GitHub token endpoint answered ${response.status}`);\n      }\n\n      body = (await response.json()) as { access_token?: unknown; error?: unknown };\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", error);\n    }\n\n    // GitHub answers 200 even on a rejected code, with `error` set instead.\n    if (body.error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", body.error);\n    }\n\n    if (typeof body.access_token !== \"string\" || body.access_token.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-access-token\");\n    }\n\n    return body.access_token;\n  }\n\n  private async fetchUser(accessToken: string): Promise<GitHubUser> {\n    try {\n      const response = await fetch(USER_ENDPOINT, {\n        headers: {\n          authorization: `Bearer ${accessToken}`,\n          accept: \"application/vnd.github+json\",\n          \"user-agent\": USER_AGENT,\n        },\n      });\n\n      if (!response.ok) {\n        throw new Error(`GitHub user endpoint answered ${response.status}`);\n      }\n\n      return (await response.json()) as GitHubUser;\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"profile-fetch-failed\", error);\n    }\n  }\n\n  /** The primary, verified email — `undefined` when none is both primary and verified. */\n  private async fetchPrimaryEmail(accessToken: string): Promise<GitHubEmail | undefined> {\n    let emails: GitHubEmail[];\n\n    try {\n      const response = await fetch(EMAILS_ENDPOINT, {\n        headers: {\n          authorization: `Bearer ${accessToken}`,\n          accept: \"application/vnd.github+json\",\n          \"user-agent\": USER_AGENT,\n        },\n      });\n\n      if (!response.ok) {\n        throw new Error(`GitHub emails endpoint answered ${response.status}`);\n      }\n\n      emails = (await response.json()) as GitHubEmail[];\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"profile-fetch-failed\", error);\n    }\n\n    return emails.find((email) => email.primary && email.verified);\n  }\n}\n"],"mappings":";;;;AAUA,MAAM,yBAAyB;AAC/B,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AACxB,MAAM,iBAAiB,CAAC,aAAa,YAAY;;AAGjD,MAAM,aAAa;;;;;;;;;;;AAyBnB,IAAa,iBAAb,MAAoD;CAGlD,AAAO,YAAY,AAAiB,UAAgC;EAAhC;cAFb;CAE8C;CAErE,AAAO,iBAAiB,OAA2C;EACjE,MAAM,MAAM,IAAI,IAAI,sBAAsB;EAE1C,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;EACxD,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;EAC9D,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,UAAU,KAAK,SAAS,UAAU,eAAc,CAAE,KAAK,GAAG,CAAC;EAChF,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,kBAAkB,cAAc,MAAM,YAAY,CAAC;EACxE,IAAI,aAAa,IAAI,yBAAyB,MAAM;EAEpD,OAAO,IAAI,SAAS;CACtB;CAEA,MAAa,eAAe,EAC1B,OACA,YACmD;EACnD,MAAM,OAAO,MAAM;EAEnB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,6BAA6B,cAAc;EAGvD,MAAM,cAAc,MAAM,KAAK,aAAa,MAAM,SAAS,YAAY;EACvE,MAAM,OAAO,MAAM,KAAK,UAAU,WAAW;EAC7C,MAAM,QAAQ,MAAM,KAAK,kBAAkB,WAAW;EAEtD,IAAI,OAAO,KAAK,OAAO,UACrB,MAAM,IAAI,6BAA6B,iBAAiB;EAG1D,OAAO;GACL,UAAU,KAAK;GACf,gBAAgB,OAAO,KAAK,EAAE;GAC9B,OAAO,OAAO;GACd,eAAe,OAAO,aAAa;GACnC,MAAM,KAAK,QAAQ,KAAK;GACxB,QAAQ,KAAK;GACb,KAAK;EACP;CACF;;CAGA,MAAc,aAAa,MAAc,cAAuC;EAC9E,IAAI;EAEJ,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAC3C,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,QAAQ;IACV;IACA,MAAM,IAAI,gBAAgB;KACxB;KACA,WAAW,KAAK,SAAS;KACzB,eAAe,KAAK,SAAS;KAC7B,cAAc,KAAK,SAAS;KAC5B,eAAe;IACjB,CAAC;GACH,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,kCAAkC,SAAS,QAAQ;GAGrE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;EAGA,IAAI,KAAK,OACP,MAAM,IAAI,6BAA6B,wBAAwB,KAAK,KAAK;EAG3E,IAAI,OAAO,KAAK,iBAAiB,YAAY,KAAK,aAAa,WAAW,GACxE,MAAM,IAAI,6BAA6B,sBAAsB;EAG/D,OAAO,KAAK;CACd;CAEA,MAAc,UAAU,aAA0C;EAChE,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,eAAe,EAC1C,SAAS;IACP,eAAe,UAAU;IACzB,QAAQ;IACR,cAAc;GAChB,EACF,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,iCAAiC,SAAS,QAAQ;GAGpE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;CACF;;CAGA,MAAc,kBAAkB,aAAuD;EACrF,IAAI;EAEJ,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,iBAAiB,EAC5C,SAAS;IACP,eAAe,UAAU;IACzB,QAAQ;IACR,cAAc;GAChB,EACF,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,mCAAmC,SAAS,QAAQ;GAGtE,SAAU,MAAM,SAAS,KAAK;EAChC,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;EAEA,OAAO,OAAO,MAAM,UAAU,MAAM,WAAW,MAAM,QAAQ;CAC/D;AACF"}

package/esm/providers/index.d.mts

@@ -1,2 +1,8 @@
 import { GOOGLE_AUTH_FEATURE, GoogleProvider, JoseModule, pkceChallenge } from "./google-provider.mjs";
-import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./provider-login.mjs";
+import { APPLE_AUTH_FEATURE, AppleJoseModule, AppleProvider } from "./apple-provider.mjs";
+import { DiscordProvider } from "./discord-provider.mjs";
+import { FacebookProvider } from "./facebook-provider.mjs";
+import { GitHubProvider } from "./github-provider.mjs";
+import { LINKEDIN_AUTH_FEATURE, LinkedInProvider } from "./linkedin-provider.mjs";
+import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./provider-login.mjs";
+import { XProvider } from "./x-provider.mjs";

package/esm/providers/index.mjs

@@ -1,4 +1,10 @@
 import { GOOGLE_AUTH_FEATURE, GoogleProvider, pkceChallenge } from "./google-provider.mjs";
+import { APPLE_AUTH_FEATURE, AppleProvider } from "./apple-provider.mjs";
+import { DiscordProvider } from "./discord-provider.mjs";
+import { FacebookProvider } from "./facebook-provider.mjs";
+import { GitHubProvider } from "./github-provider.mjs";
+import { LINKEDIN_AUTH_FEATURE, LinkedInProvider } from "./linkedin-provider.mjs";
+import { XProvider } from "./x-provider.mjs";
 import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./provider-login.mjs";
 
 export {  };

package/esm/providers/linkedin-provider.d.mts

@@ -0,0 +1,35 @@
+import { AuthProvider, LinkedInProviderConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile } from "../contracts/providers.mjs";
+
+//#region ../auth/src/providers/linkedin-provider.d.ts
+/** The `warlock add` feature that installs `jose`. */
+declare const LINKEDIN_AUTH_FEATURE = "auth-linkedin";
+/**
+ * LinkedIn sign-in: OpenID Connect authorization code flow with PKCE (S256)
+ * and `state` and `nonce` — LinkedIn's "Sign In with LinkedIn using OpenID
+ * Connect" product, the same shape as {@link GoogleProvider}. The code is
+ * exchanged with plain `fetch`; the id_token is verified with `jose` against
+ * LinkedIn's JWKS (signature, `iss`, `aud` = the client id, `exp`), then its
+ * `nonce` is compared. No LinkedIn SDK.
+ *
+ * The exact issuer string LinkedIn signs (`ISSUERS` above) and whether its
+ * token endpoint honours `code_verifier` are asserted from LinkedIn's public
+ * OIDC docs, not from a live exchange — this package has no LinkedIn test
+ * credentials. See the worker report for what is and is not proven.
+ */
+declare class LinkedInProvider implements AuthProvider {
+  private readonly settings;
+  readonly name = "linkedin";
+  constructor(settings: LinkedInProviderConfig);
+  authorizationUrl(state: ProviderAuthorizationState): string;
+  handleCallback({
+    query,
+    expected
+  }: ProviderCallbackParams): Promise<ProviderProfile>;
+  /** Redeem the authorization code (with the PKCE verifier) for an id_token. */
+  private exchangeCode;
+  /** Verify signature, issuer, audience and expiry; resolve the claims. */
+  private verifyIdToken;
+}
+//#endregion
+export { LINKEDIN_AUTH_FEATURE, LinkedInProvider };
+//# sourceMappingURL=linkedin-provider.d.mts.map

package/esm/providers/linkedin-provider.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkedin-provider.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/linkedin-provider.ts"],"mappings":";;;;cAmBa,qBAAA;AAAb;;;;AAAkC;AAkBlC;;;;;;;;AAlBA,cAkBa,gBAAA,YAA4B,YAAA;EAAA,iBAGH,QAAA;EAAA,SAFpB,IAAA;cAEoB,QAAA,EAAU,sBAAA;EAEvC,gBAAA,CAAiB,KAAA,EAAO,0BAAA;EAelB,cAAA;IACX,KAAA;IACA;EAAA,GACC,sBAAA,GAAyB,OAAA,CAAQ,eAAA;EApBA;EAAA,QAsDtB,YAAA;;UAkCA,aAAA;AAAA"}

package/esm/providers/linkedin-provider.mjs

@@ -0,0 +1,108 @@
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { loadOptionalPeer } from "../services/optional-peer.mjs";
+import { pkceChallenge } from "./google-provider.mjs";
+
+//#region ../auth/src/providers/linkedin-provider.ts
+const AUTHORIZATION_ENDPOINT = "https://www.linkedin.com/oauth/v2/authorization";
+const TOKEN_ENDPOINT = "https://www.linkedin.com/oauth/v2/accessToken";
+const JWKS_URI = "https://www.linkedin.com/oauth/openid/jwks";
+const ISSUERS = ["https://www.linkedin.com", "https://www.linkedin.com/oauth"];
+const DEFAULT_SCOPES = [
+	"openid",
+	"profile",
+	"email"
+];
+/** The `warlock add` feature that installs `jose`. */
+const LINKEDIN_AUTH_FEATURE = "auth-linkedin";
+/** LinkedIn's key set, created once per process; `jose` caches the fetched JWKS inside it. */
+let linkedinKeySet;
+/**
+* LinkedIn sign-in: OpenID Connect authorization code flow with PKCE (S256)
+* and `state` and `nonce` — LinkedIn's "Sign In with LinkedIn using OpenID
+* Connect" product, the same shape as {@link GoogleProvider}. The code is
+* exchanged with plain `fetch`; the id_token is verified with `jose` against
+* LinkedIn's JWKS (signature, `iss`, `aud` = the client id, `exp`), then its
+* `nonce` is compared. No LinkedIn SDK.
+*
+* The exact issuer string LinkedIn signs (`ISSUERS` above) and whether its
+* token endpoint honours `code_verifier` are asserted from LinkedIn's public
+* OIDC docs, not from a live exchange — this package has no LinkedIn test
+* credentials. See the worker report for what is and is not proven.
+*/
+var LinkedInProvider = class {
+	constructor(settings) {
+		this.settings = settings;
+		this.name = "linkedin";
+	}
+	authorizationUrl(state) {
+		const url = new URL(AUTHORIZATION_ENDPOINT);
+		url.searchParams.set("client_id", this.settings.clientId);
+		url.searchParams.set("redirect_uri", this.settings.redirectUri);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("scope", (this.settings.scopes ?? DEFAULT_SCOPES).join(" "));
+		url.searchParams.set("state", state.state);
+		url.searchParams.set("nonce", state.nonce);
+		url.searchParams.set("code_challenge", pkceChallenge(state.codeVerifier));
+		url.searchParams.set("code_challenge_method", "S256");
+		return url.toString();
+	}
+	async handleCallback({ query, expected }) {
+		const jose = await loadOptionalPeer("jose", LINKEDIN_AUTH_FEATURE);
+		const code = query.code;
+		if (typeof code !== "string" || code.length === 0) throw new InvalidProviderCallbackError("missing-code");
+		const idToken = await this.exchangeCode(code, expected.codeVerifier);
+		const claims = await this.verifyIdToken(jose, idToken);
+		if (typeof claims.nonce !== "string" || claims.nonce !== expected.nonce) throw new InvalidProviderCallbackError("nonce-mismatch");
+		if (typeof claims.sub !== "string" || claims.sub.length === 0) throw new InvalidProviderCallbackError("missing-subject");
+		return {
+			provider: this.name,
+			providerUserId: claims.sub,
+			email: typeof claims.email === "string" ? claims.email : void 0,
+			emailVerified: claims.email_verified === true,
+			name: typeof claims.name === "string" ? claims.name : void 0,
+			avatar: typeof claims.picture === "string" ? claims.picture : void 0,
+			raw: claims
+		};
+	}
+	/** Redeem the authorization code (with the PKCE verifier) for an id_token. */
+	async exchangeCode(code, codeVerifier) {
+		let body;
+		try {
+			const response = await fetch(TOKEN_ENDPOINT, {
+				method: "POST",
+				headers: { "content-type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({
+					code,
+					client_id: this.settings.clientId,
+					client_secret: this.settings.clientSecret,
+					redirect_uri: this.settings.redirectUri,
+					grant_type: "authorization_code",
+					code_verifier: codeVerifier
+				})
+			});
+			if (!response.ok) throw new Error(`LinkedIn token endpoint answered ${response.status}`);
+			body = await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("code-exchange-failed", error);
+		}
+		if (typeof body.id_token !== "string") throw new InvalidProviderCallbackError("missing-id-token");
+		return body.id_token;
+	}
+	/** Verify signature, issuer, audience and expiry; resolve the claims. */
+	async verifyIdToken(jose, idToken) {
+		linkedinKeySet ??= jose.createRemoteJWKSet(new URL(JWKS_URI));
+		try {
+			const { payload } = await jose.jwtVerify(idToken, linkedinKeySet, {
+				issuer: ISSUERS,
+				audience: this.settings.clientId
+			});
+			return payload;
+		} catch (error) {
+			throw new InvalidProviderCallbackError("invalid-id-token", error);
+		}
+	}
+};
+
+//#endregion
+export { LINKEDIN_AUTH_FEATURE, LinkedInProvider };
+//# sourceMappingURL=linkedin-provider.mjs.map

package/esm/providers/linkedin-provider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkedin-provider.mjs","names":[],"sources":["../../../../../../../auth/src/providers/linkedin-provider.ts"],"sourcesContent":["import type {\n  AuthProvider,\n  LinkedInProviderConfig,\n  ProviderAuthorizationState,\n  ProviderCallbackParams,\n  ProviderProfile,\n} from \"../contracts/providers\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport { loadOptionalPeer } from \"../services/optional-peer\";\nimport type { JoseModule } from \"./google-provider\";\nimport { pkceChallenge } from \"./google-provider\";\n\nconst AUTHORIZATION_ENDPOINT = \"https://www.linkedin.com/oauth/v2/authorization\";\nconst TOKEN_ENDPOINT = \"https://www.linkedin.com/oauth/v2/accessToken\";\nconst JWKS_URI = \"https://www.linkedin.com/oauth/openid/jwks\";\nconst ISSUERS = [\"https://www.linkedin.com\", \"https://www.linkedin.com/oauth\"];\nconst DEFAULT_SCOPES = [\"openid\", \"profile\", \"email\"];\n\n/** The `warlock add` feature that installs `jose`. */\nexport const LINKEDIN_AUTH_FEATURE = \"auth-linkedin\";\n\n/** LinkedIn's key set, created once per process; `jose` caches the fetched JWKS inside it. */\nlet linkedinKeySet: unknown;\n\n/**\n * LinkedIn sign-in: OpenID Connect authorization code flow with PKCE (S256)\n * and `state` and `nonce` — LinkedIn's \"Sign In with LinkedIn using OpenID\n * Connect\" product, the same shape as {@link GoogleProvider}. The code is\n * exchanged with plain `fetch`; the id_token is verified with `jose` against\n * LinkedIn's JWKS (signature, `iss`, `aud` = the client id, `exp`), then its\n * `nonce` is compared. No LinkedIn SDK.\n *\n * The exact issuer string LinkedIn signs (`ISSUERS` above) and whether its\n * token endpoint honours `code_verifier` are asserted from LinkedIn's public\n * OIDC docs, not from a live exchange — this package has no LinkedIn test\n * credentials. See the worker report for what is and is not proven.\n */\nexport class LinkedInProvider implements AuthProvider {\n  public readonly name = \"linkedin\";\n\n  public constructor(private readonly settings: LinkedInProviderConfig) {}\n\n  public authorizationUrl(state: ProviderAuthorizationState): string {\n    const url = new URL(AUTHORIZATION_ENDPOINT);\n\n    url.searchParams.set(\"client_id\", this.settings.clientId);\n    url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"scope\", (this.settings.scopes ?? DEFAULT_SCOPES).join(\" \"));\n    url.searchParams.set(\"state\", state.state);\n    url.searchParams.set(\"nonce\", state.nonce);\n    url.searchParams.set(\"code_challenge\", pkceChallenge(state.codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    return url.toString();\n  }\n\n  public async handleCallback({\n    query,\n    expected,\n  }: ProviderCallbackParams): Promise<ProviderProfile> {\n    // Load the peer first: a missing SDK fails loudly before any network call.\n    const jose = await loadOptionalPeer<JoseModule>(\"jose\", LINKEDIN_AUTH_FEATURE);\n\n    const code = query.code;\n\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-code\");\n    }\n\n    const idToken = await this.exchangeCode(code, expected.codeVerifier);\n    const claims = await this.verifyIdToken(jose, idToken);\n\n    if (typeof claims.nonce !== \"string\" || claims.nonce !== expected.nonce) {\n      throw new InvalidProviderCallbackError(\"nonce-mismatch\");\n    }\n\n    if (typeof claims.sub !== \"string\" || claims.sub.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-subject\");\n    }\n\n    return {\n      provider: this.name,\n      providerUserId: claims.sub,\n      email: typeof claims.email === \"string\" ? claims.email : undefined,\n      // LinkedIn sends a boolean; anything else counts as NOT verified.\n      emailVerified: claims.email_verified === true,\n      name: typeof claims.name === \"string\" ? claims.name : undefined,\n      avatar: typeof claims.picture === \"string\" ? claims.picture : undefined,\n      raw: claims,\n    };\n  }\n\n  /** Redeem the authorization code (with the PKCE verifier) for an id_token. */\n  private async exchangeCode(code: string, codeVerifier: string): Promise<string> {\n    let body: { id_token?: unknown };\n\n    try {\n      const response = await fetch(TOKEN_ENDPOINT, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          code,\n          client_id: this.settings.clientId,\n          client_secret: this.settings.clientSecret,\n          redirect_uri: this.settings.redirectUri,\n          grant_type: \"authorization_code\",\n          code_verifier: codeVerifier,\n        }),\n      });\n\n      if (!response.ok) {\n        throw new Error(`LinkedIn token endpoint answered ${response.status}`);\n      }\n\n      body = (await response.json()) as { id_token?: unknown };\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", error);\n    }\n\n    if (typeof body.id_token !== \"string\") {\n      throw new InvalidProviderCallbackError(\"missing-id-token\");\n    }\n\n    return body.id_token;\n  }\n\n  /** Verify signature, issuer, audience and expiry; resolve the claims. */\n  private async verifyIdToken(jose: JoseModule, idToken: string): Promise<Record<string, unknown>> {\n    linkedinKeySet ??= jose.createRemoteJWKSet(new URL(JWKS_URI));\n\n    try {\n      const { payload } = await jose.jwtVerify(idToken, linkedinKeySet, {\n        issuer: ISSUERS,\n        audience: this.settings.clientId,\n      });\n\n      return payload;\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"invalid-id-token\", error);\n    }\n  }\n}\n"],"mappings":";;;;;AAYA,MAAM,yBAAyB;AAC/B,MAAM,iBAAiB;AACvB,MAAM,WAAW;AACjB,MAAM,UAAU,CAAC,4BAA4B,gCAAgC;AAC7E,MAAM,iBAAiB;CAAC;CAAU;CAAW;AAAO;;AAGpD,MAAa,wBAAwB;;AAGrC,IAAI;;;;;;;;;;;;;;AAeJ,IAAa,mBAAb,MAAsD;CAGpD,AAAO,YAAY,AAAiB,UAAkC;EAAlC;cAFb;CAEgD;CAEvE,AAAO,iBAAiB,OAA2C;EACjE,MAAM,MAAM,IAAI,IAAI,sBAAsB;EAE1C,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;EACxD,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;EAC9D,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,UAAU,KAAK,SAAS,UAAU,eAAc,CAAE,KAAK,GAAG,CAAC;EAChF,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,kBAAkB,cAAc,MAAM,YAAY,CAAC;EACxE,IAAI,aAAa,IAAI,yBAAyB,MAAM;EAEpD,OAAO,IAAI,SAAS;CACtB;CAEA,MAAa,eAAe,EAC1B,OACA,YACmD;EAEnD,MAAM,OAAO,MAAM,iBAA6B,QAAQ,qBAAqB;EAE7E,MAAM,OAAO,MAAM;EAEnB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,6BAA6B,cAAc;EAGvD,MAAM,UAAU,MAAM,KAAK,aAAa,MAAM,SAAS,YAAY;EACnE,MAAM,SAAS,MAAM,KAAK,cAAc,MAAM,OAAO;EAErD,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,SAAS,OAChE,MAAM,IAAI,6BAA6B,gBAAgB;EAGzD,IAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,IAAI,WAAW,GAC1D,MAAM,IAAI,6BAA6B,iBAAiB;EAG1D,OAAO;GACL,UAAU,KAAK;GACf,gBAAgB,OAAO;GACvB,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;GAEzD,eAAe,OAAO,mBAAmB;GACzC,MAAM,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;GACtD,QAAQ,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;GAC9D,KAAK;EACP;CACF;;CAGA,MAAc,aAAa,MAAc,cAAuC;EAC9E,IAAI;EAEJ,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAC3C,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,IAAI,gBAAgB;KACxB;KACA,WAAW,KAAK,SAAS;KACzB,eAAe,KAAK,SAAS;KAC7B,cAAc,KAAK,SAAS;KAC5B,YAAY;KACZ,eAAe;IACjB,CAAC;GACH,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,oCAAoC,SAAS,QAAQ;GAGvE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;EAEA,IAAI,OAAO,KAAK,aAAa,UAC3B,MAAM,IAAI,6BAA6B,kBAAkB;EAG3D,OAAO,KAAK;CACd;;CAGA,MAAc,cAAc,MAAkB,SAAmD;EAC/F,mBAAmB,KAAK,mBAAmB,IAAI,IAAI,QAAQ,CAAC;EAE5D,IAAI;GACF,MAAM,EAAE,YAAY,MAAM,KAAK,UAAU,SAAS,gBAAgB;IAChE,QAAQ;IACR,UAAU,KAAK,SAAS;GAC1B,CAAC;GAED,OAAO;EACT,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,oBAAoB,KAAK;EAClE;CACF;AACF"}

package/esm/providers/provider-login.d.mts

@@ -6,7 +6,8 @@ import { ChildModel } from "@warlock.js/cascade";
 
 //#region ../auth/src/providers/provider-login.d.ts
 /**
- * Resolve a provider by name: `google` from `auth.providers.google`, anything
+ * Resolve a provider by name: a built-in name (`google`, `github`, `discord`,
+ * `linkedin`, `apple`, `facebook`, `x`) from `auth.providers.<name>`, anything
  * else from `auth.providers.custom`. Throws naming the config key when absent.
  */
 declare function resolveAuthProvider(name: string): AuthProvider;

package/esm/providers/provider-login.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-login.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/provider-login.ts"],"mappings":";;;;;;;;;AAiBA;;iBAAgB,mBAAA,CAAoB,IAAA,WAAe,YAAY;;AAAA;AA4B/D;;;;;;;;iBAAsB,kBAAA,CACpB,QAAA,EAAU,QAAA,EACV,YAAA,WACC,OAAO;AAAA;AAgCV;;;;;;;;;;;;;;;AAhCU,iBAgCY,qBAAA,WAAgC,IAAA,EACpD,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,YAAA,UACA,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA"}
+{"version":3,"file":"provider-login.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/provider-login.ts"],"mappings":";;;;;;;;;AA+DA;;;iBAAgB,mBAAA,CAAoB,IAAA,WAAe,YAAY;AAAA;AA8B/D;;;;;;;;;AA9B+D,iBA8BzC,kBAAA,CACpB,QAAA,EAAU,QAAA,EACV,YAAA,WACC,OAAO;AAgCV;;;;;;;;;;;;;;;;AAAA,iBAAsB,qBAAA,WAAgC,IAAA,EACpD,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,YAAA,UACA,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA"}

package/esm/providers/provider-login.mjs

@@ -3,23 +3,62 @@ import { authService } from "../services/auth.service.mjs";
 import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
 import { safeEqual } from "../utils/safe-equal.mjs";
 import { GoogleProvider } from "./google-provider.mjs";
+import { AppleProvider } from "./apple-provider.mjs";
+import { DiscordProvider } from "./discord-provider.mjs";
+import { FacebookProvider } from "./facebook-provider.mjs";
+import { GitHubProvider } from "./github-provider.mjs";
+import { LinkedInProvider } from "./linkedin-provider.mjs";
+import { XProvider } from "./x-provider.mjs";
 import { randomUrlSafe, takeProviderState, writeProviderState } from "./provider-state-cookie.mjs";
 import { resolveProviderUser } from "./resolve-provider-user.mjs";
 
 //#region ../auth/src/providers/provider-login.ts
+/** Providers auth ships, by name — each built from `auth.providers.<name>`. */
+const BUILT_IN_PROVIDERS = {
+	google: () => {
+		const google = authConfig.providers.google();
+		return google ? new GoogleProvider(google) : void 0;
+	},
+	github: () => {
+		const github = authConfig.providers.github();
+		return github ? new GitHubProvider(github) : void 0;
+	},
+	discord: () => {
+		const discord = authConfig.providers.discord();
+		return discord ? new DiscordProvider(discord) : void 0;
+	},
+	linkedin: () => {
+		const linkedin = authConfig.providers.linkedin();
+		return linkedin ? new LinkedInProvider(linkedin) : void 0;
+	},
+	apple: () => {
+		const apple = authConfig.providers.apple();
+		return apple ? new AppleProvider(apple) : void 0;
+	},
+	facebook: () => {
+		const facebook = authConfig.providers.facebook();
+		return facebook ? new FacebookProvider(facebook) : void 0;
+	},
+	x: () => {
+		const x = authConfig.providers.x();
+		return x ? new XProvider(x) : void 0;
+	}
+};
 /**
-* Resolve a provider by name: `google` from `auth.providers.google`, anything
+* Resolve a provider by name: a built-in name (`google`, `github`, `discord`,
+* `linkedin`, `apple`, `facebook`, `x`) from `auth.providers.<name>`, anything
 * else from `auth.providers.custom`. Throws naming the config key when absent.
 */
 function resolveAuthProvider(name) {
-	if (name === "google") {
-		const google = authConfig.providers.google();
-		if (google) return new GoogleProvider(google);
+	const isBuiltIn = Object.hasOwn(BUILT_IN_PROVIDERS, name);
+	if (isBuiltIn) {
+		const provider = BUILT_IN_PROVIDERS[name](name);
+		if (provider) return provider;
 	} else {
 		const custom = authConfig.providers.custom(name);
 		if (custom) return custom;
 	}
-	throw new Error(`@warlock.js/auth: no login provider "${name}" — configure \`auth.providers.${name === "google" ? "google" : `custom.${name}`}\`.`);
+	throw new Error(`@warlock.js/auth: no login provider "${name}" — configure \`auth.providers.${isBuiltIn ? name : `custom.${name}`}\`.`);
 }
 /**
 * Start a redirect login: generate `state`, `nonce` and a PKCE verifier, store
@@ -39,7 +78,7 @@ async function startProviderLogin(response, providerName) {
 		codeVerifier: randomUrlSafe()
 	};
 	const url = await provider.authorizationUrl(state);
-	writeProviderState(response, provider.name, state);
+	writeProviderState(response, provider.name, state, provider.callbackMode ?? "query");
 	return url;
 }
 /**
@@ -66,7 +105,8 @@ async function completeProviderLogin(Model, providerName, request, response, dev
 	const query = {
 		code: request.input("code"),
 		state: request.input("state"),
-		error: request.input("error")
+		error: request.input("error"),
+		user: request.input("user")
 	};
 	if (query.error) throw new InvalidProviderCallbackError(`provider-error:${String(query.error)}`);
 	if (typeof query.state !== "string" || !safeEqual(query.state, expected.state)) throw new InvalidProviderCallbackError("state-mismatch");

package/esm/providers/provider-login.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"provider-login.mjs","names":[],"sources":["../../../../../../../auth/src/providers/provider-login.ts"],"sourcesContent":["import type { ChildModel } from \"@warlock.js/cascade\";\nimport type { Request, Response } from \"@warlock.js/core\";\nimport type { AuthProvider } from \"../contracts/providers\";\nimport type { DeviceInfo, LoginResult } from \"../contracts/types\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport type { Auth } from \"../models/auth.model\";\nimport { authConfig } from \"../services/auth-config\";\nimport { authService } from \"../services/auth.service\";\nimport { GoogleProvider } from \"./google-provider\";\nimport { safeEqual } from \"../utils/safe-equal\";\nimport { randomUrlSafe, takeProviderState, writeProviderState } from \"./provider-state-cookie\";\nimport { resolveProviderUser } from \"./resolve-provider-user\";\n\n/**\n * Resolve a provider by name: `google` from `auth.providers.google`, anything\n * else from `auth.providers.custom`. Throws naming the config key when absent.\n */\nexport function resolveAuthProvider(name: string): AuthProvider {\n  if (name === \"google\") {\n    const google = authConfig.providers.google();\n\n    if (google) return new GoogleProvider(google);\n  } else {\n    const custom = authConfig.providers.custom(name);\n\n    if (custom) return custom;\n  }\n\n  throw new Error(\n    `@warlock.js/auth: no login provider \"${name}\" — configure \\`auth.providers.${\n      name === \"google\" ? \"google\" : `custom.${name}`\n    }\\`.`,\n  );\n}\n\n/**\n * Start a redirect login: generate `state`, `nonce` and a PKCE verifier, store\n * them in a signed 10-minute cookie, and resolve the provider URL to redirect\n * the browser to.\n *\n * @example\n * // GET /auth/google\n * export const googleRedirect: RequestHandler = async (_request, response) =>\n *   response.redirect(await startProviderLogin(response, \"google\"));\n */\nexport async function startProviderLogin(\n  response: Response,\n  providerName: string,\n): Promise<string> {\n  const provider = resolveAuthProvider(providerName);\n\n  const state = {\n    state: randomUrlSafe(),\n    nonce: randomUrlSafe(),\n    codeVerifier: randomUrlSafe(),\n  };\n\n  const url = await provider.authorizationUrl(state);\n\n  writeProviderState(response, provider.name, state);\n\n  return url;\n}\n\n/**\n * Finish a redirect login on the provider's callback: consume the state\n * cookie, reject a missing/forged/expired cookie, a cookie from another\n * provider, a provider-reported error or a `state` mismatch; let the provider\n * verify the callback; find-or-link the user; then log them in through\n * `authService.completeLogin` — the same outcome as password login.\n *\n * @throws InvalidProviderCallbackError (400, EC009) for any callback rejection.\n * @throws ProviderEmailNotVerifiedError (403, EC010) for an unlinked, unverified email.\n * @throws AuthProviderSdkMissingError when the provider's SDK is not installed.\n *\n * @example\n * // GET /auth/google/callback\n * const { user, tokens } = await completeProviderLogin(User, \"google\", request, response);\n * authService.setAuthCookie(response, tokens.accessToken);\n */\nexport async function completeProviderLogin<T extends Auth>(\n  Model: ChildModel<T>,\n  providerName: string,\n  request: Request,\n  response: Response,\n  deviceInfo?: DeviceInfo,\n): Promise<LoginResult<T>> {\n  const provider = resolveAuthProvider(providerName);\n  const expected = takeProviderState(request, response);\n\n  if (!expected) {\n    throw new InvalidProviderCallbackError(\"missing-or-invalid-state-cookie\");\n  }\n\n  if (expected.provider !== provider.name) {\n    throw new InvalidProviderCallbackError(\"state-cookie-for-another-provider\");\n  }\n\n  const query: Record<string, unknown> = {\n    code: request.input(\"code\"),\n    state: request.input(\"state\"),\n    error: request.input(\"error\"),\n  };\n\n  if (query.error) {\n    throw new InvalidProviderCallbackError(`provider-error:${String(query.error)}`);\n  }\n\n  if (typeof query.state !== \"string\" || !safeEqual(query.state, expected.state)) {\n    throw new InvalidProviderCallbackError(\"state-mismatch\");\n  }\n\n  const profile = await provider.handleCallback({\n    query,\n    expected: { state: expected.state, nonce: expected.nonce, codeVerifier: expected.codeVerifier },\n  });\n\n  const user = await resolveProviderUser(Model, profile);\n\n  return authService.completeLogin(user, deviceInfo);\n}\n"],"mappings":";;;;;;;;;;;;;AAiBA,SAAgB,oBAAoB,MAA4B;CAC9D,IAAI,SAAS,UAAU;EACrB,MAAM,SAAS,WAAW,UAAU,OAAO;EAE3C,IAAI,QAAQ,OAAO,IAAI,eAAe,MAAM;CAC9C,OAAO;EACL,MAAM,SAAS,WAAW,UAAU,OAAO,IAAI;EAE/C,IAAI,QAAQ,OAAO;CACrB;CAEA,MAAM,IAAI,MACR,wCAAwC,KAAK,iCAC3C,SAAS,WAAW,WAAW,UAAU,OAC1C,IACH;AACF;;;;;;;;;;;AAYA,eAAsB,mBACpB,UACA,cACiB;CACjB,MAAM,WAAW,oBAAoB,YAAY;CAEjD,MAAM,QAAQ;EACZ,OAAO,cAAc;EACrB,OAAO,cAAc;EACrB,cAAc,cAAc;CAC9B;CAEA,MAAM,MAAM,MAAM,SAAS,iBAAiB,KAAK;CAEjD,mBAAmB,UAAU,SAAS,MAAM,KAAK;CAEjD,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,eAAsB,sBACpB,OACA,cACA,SACA,UACA,YACyB;CACzB,MAAM,WAAW,oBAAoB,YAAY;CACjD,MAAM,WAAW,kBAAkB,SAAS,QAAQ;CAEpD,IAAI,CAAC,UACH,MAAM,IAAI,6BAA6B,iCAAiC;CAG1E,IAAI,SAAS,aAAa,SAAS,MACjC,MAAM,IAAI,6BAA6B,mCAAmC;CAG5E,MAAM,QAAiC;EACrC,MAAM,QAAQ,MAAM,MAAM;EAC1B,OAAO,QAAQ,MAAM,OAAO;EAC5B,OAAO,QAAQ,MAAM,OAAO;CAC9B;CAEA,IAAI,MAAM,OACR,MAAM,IAAI,6BAA6B,kBAAkB,OAAO,MAAM,KAAK,GAAG;CAGhF,IAAI,OAAO,MAAM,UAAU,YAAY,CAAC,UAAU,MAAM,OAAO,SAAS,KAAK,GAC3E,MAAM,IAAI,6BAA6B,gBAAgB;CAQzD,MAAM,OAAO,MAAM,oBAAoB,OAAO,MALxB,SAAS,eAAe;EAC5C;EACA,UAAU;GAAE,OAAO,SAAS;GAAO,OAAO,SAAS;GAAO,cAAc,SAAS;EAAa;CAChG,CAAC,CAEoD;CAErD,OAAO,YAAY,cAAc,MAAM,UAAU;AACnD"}
+{"version":3,"file":"provider-login.mjs","names":[],"sources":["../../../../../../../auth/src/providers/provider-login.ts"],"sourcesContent":["import type { ChildModel } from \"@warlock.js/cascade\";\nimport type { Request, Response } from \"@warlock.js/core\";\nimport type { AuthProvider } from \"../contracts/providers\";\nimport type { DeviceInfo, LoginResult } from \"../contracts/types\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport type { Auth } from \"../models/auth.model\";\nimport { authConfig } from \"../services/auth-config\";\nimport { authService } from \"../services/auth.service\";\nimport { AppleProvider } from \"./apple-provider\";\nimport { DiscordProvider } from \"./discord-provider\";\nimport { FacebookProvider } from \"./facebook-provider\";\nimport { GitHubProvider } from \"./github-provider\";\nimport { GoogleProvider } from \"./google-provider\";\nimport { LinkedInProvider } from \"./linkedin-provider\";\nimport { XProvider } from \"./x-provider\";\nimport { safeEqual } from \"../utils/safe-equal\";\nimport { randomUrlSafe, takeProviderState, writeProviderState } from \"./provider-state-cookie\";\nimport { resolveProviderUser } from \"./resolve-provider-user\";\n\n/** Providers auth ships, by name — each built from `auth.providers.<name>`. */\nconst BUILT_IN_PROVIDERS: Record<string, (name: string) => AuthProvider | undefined> = {\n  google: () => {\n    const google = authConfig.providers.google();\n\n    return google ? new GoogleProvider(google) : undefined;\n  },\n  github: () => {\n    const github = authConfig.providers.github();\n\n    return github ? new GitHubProvider(github) : undefined;\n  },\n  discord: () => {\n    const discord = authConfig.providers.discord();\n\n    return discord ? new DiscordProvider(discord) : undefined;\n  },\n  linkedin: () => {\n    const linkedin = authConfig.providers.linkedin();\n\n    return linkedin ? new LinkedInProvider(linkedin) : undefined;\n  },\n  apple: () => {\n    const apple = authConfig.providers.apple();\n\n    return apple ? new AppleProvider(apple) : undefined;\n  },\n  facebook: () => {\n    const facebook = authConfig.providers.facebook();\n\n    return facebook ? new FacebookProvider(facebook) : undefined;\n  },\n  x: () => {\n    const x = authConfig.providers.x();\n\n    return x ? new XProvider(x) : undefined;\n  },\n};\n\n/**\n * Resolve a provider by name: a built-in name (`google`, `github`, `discord`,\n * `linkedin`, `apple`, `facebook`, `x`) from `auth.providers.<name>`, anything\n * else from `auth.providers.custom`. Throws naming the config key when absent.\n */\nexport function resolveAuthProvider(name: string): AuthProvider {\n  const isBuiltIn = Object.hasOwn(BUILT_IN_PROVIDERS, name);\n\n  if (isBuiltIn) {\n    const provider = BUILT_IN_PROVIDERS[name]!(name);\n\n    if (provider) return provider;\n  } else {\n    const custom = authConfig.providers.custom(name);\n\n    if (custom) return custom;\n  }\n\n  throw new Error(\n    `@warlock.js/auth: no login provider \"${name}\" — configure \\`auth.providers.${\n      isBuiltIn ? name : `custom.${name}`\n    }\\`.`,\n  );\n}\n\n/**\n * Start a redirect login: generate `state`, `nonce` and a PKCE verifier, store\n * them in a signed 10-minute cookie, and resolve the provider URL to redirect\n * the browser to.\n *\n * @example\n * // GET /auth/google\n * export const googleRedirect: RequestHandler = async (_request, response) =>\n *   response.redirect(await startProviderLogin(response, \"google\"));\n */\nexport async function startProviderLogin(\n  response: Response,\n  providerName: string,\n): Promise<string> {\n  const provider = resolveAuthProvider(providerName);\n\n  const state = {\n    state: randomUrlSafe(),\n    nonce: randomUrlSafe(),\n    codeVerifier: randomUrlSafe(),\n  };\n\n  const url = await provider.authorizationUrl(state);\n\n  writeProviderState(response, provider.name, state, provider.callbackMode ?? \"query\");\n\n  return url;\n}\n\n/**\n * Finish a redirect login on the provider's callback: consume the state\n * cookie, reject a missing/forged/expired cookie, a cookie from another\n * provider, a provider-reported error or a `state` mismatch; let the provider\n * verify the callback; find-or-link the user; then log them in through\n * `authService.completeLogin` — the same outcome as password login.\n *\n * @throws InvalidProviderCallbackError (400, EC009) for any callback rejection.\n * @throws ProviderEmailNotVerifiedError (403, EC010) for an unlinked, unverified email.\n * @throws AuthProviderSdkMissingError when the provider's SDK is not installed.\n *\n * @example\n * // GET /auth/google/callback\n * const { user, tokens } = await completeProviderLogin(User, \"google\", request, response);\n * authService.setAuthCookie(response, tokens.accessToken);\n */\nexport async function completeProviderLogin<T extends Auth>(\n  Model: ChildModel<T>,\n  providerName: string,\n  request: Request,\n  response: Response,\n  deviceInfo?: DeviceInfo,\n): Promise<LoginResult<T>> {\n  const provider = resolveAuthProvider(providerName);\n  const expected = takeProviderState(request, response);\n\n  if (!expected) {\n    throw new InvalidProviderCallbackError(\"missing-or-invalid-state-cookie\");\n  }\n\n  if (expected.provider !== provider.name) {\n    throw new InvalidProviderCallbackError(\"state-cookie-for-another-provider\");\n  }\n\n  const query: Record<string, unknown> = {\n    code: request.input(\"code\"),\n    state: request.input(\"state\"),\n    error: request.input(\"error\"),\n    // Apple's form_post callback carries the account name here, on the first authorization only.\n    user: request.input(\"user\"),\n  };\n\n  if (query.error) {\n    throw new InvalidProviderCallbackError(`provider-error:${String(query.error)}`);\n  }\n\n  if (typeof query.state !== \"string\" || !safeEqual(query.state, expected.state)) {\n    throw new InvalidProviderCallbackError(\"state-mismatch\");\n  }\n\n  const profile = await provider.handleCallback({\n    query,\n    expected: { state: expected.state, nonce: expected.nonce, codeVerifier: expected.codeVerifier },\n  });\n\n  const user = await resolveProviderUser(Model, profile);\n\n  return authService.completeLogin(user, deviceInfo);\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,MAAM,qBAAiF;CACrF,cAAc;EACZ,MAAM,SAAS,WAAW,UAAU,OAAO;EAE3C,OAAO,SAAS,IAAI,eAAe,MAAM,IAAI;CAC/C;CACA,cAAc;EACZ,MAAM,SAAS,WAAW,UAAU,OAAO;EAE3C,OAAO,SAAS,IAAI,eAAe,MAAM,IAAI;CAC/C;CACA,eAAe;EACb,MAAM,UAAU,WAAW,UAAU,QAAQ;EAE7C,OAAO,UAAU,IAAI,gBAAgB,OAAO,IAAI;CAClD;CACA,gBAAgB;EACd,MAAM,WAAW,WAAW,UAAU,SAAS;EAE/C,OAAO,WAAW,IAAI,iBAAiB,QAAQ,IAAI;CACrD;CACA,aAAa;EACX,MAAM,QAAQ,WAAW,UAAU,MAAM;EAEzC,OAAO,QAAQ,IAAI,cAAc,KAAK,IAAI;CAC5C;CACA,gBAAgB;EACd,MAAM,WAAW,WAAW,UAAU,SAAS;EAE/C,OAAO,WAAW,IAAI,iBAAiB,QAAQ,IAAI;CACrD;CACA,SAAS;EACP,MAAM,IAAI,WAAW,UAAU,EAAE;EAEjC,OAAO,IAAI,IAAI,UAAU,CAAC,IAAI;CAChC;AACF;;;;;;AAOA,SAAgB,oBAAoB,MAA4B;CAC9D,MAAM,YAAY,OAAO,OAAO,oBAAoB,IAAI;CAExD,IAAI,WAAW;EACb,MAAM,WAAW,mBAAmB,KAAK,CAAE,IAAI;EAE/C,IAAI,UAAU,OAAO;CACvB,OAAO;EACL,MAAM,SAAS,WAAW,UAAU,OAAO,IAAI;EAE/C,IAAI,QAAQ,OAAO;CACrB;CAEA,MAAM,IAAI,MACR,wCAAwC,KAAK,iCAC3C,YAAY,OAAO,UAAU,OAC9B,IACH;AACF;;;;;;;;;;;AAYA,eAAsB,mBACpB,UACA,cACiB;CACjB,MAAM,WAAW,oBAAoB,YAAY;CAEjD,MAAM,QAAQ;EACZ,OAAO,cAAc;EACrB,OAAO,cAAc;EACrB,cAAc,cAAc;CAC9B;CAEA,MAAM,MAAM,MAAM,SAAS,iBAAiB,KAAK;CAEjD,mBAAmB,UAAU,SAAS,MAAM,OAAO,SAAS,gBAAgB,OAAO;CAEnF,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,eAAsB,sBACpB,OACA,cACA,SACA,UACA,YACyB;CACzB,MAAM,WAAW,oBAAoB,YAAY;CACjD,MAAM,WAAW,kBAAkB,SAAS,QAAQ;CAEpD,IAAI,CAAC,UACH,MAAM,IAAI,6BAA6B,iCAAiC;CAG1E,IAAI,SAAS,aAAa,SAAS,MACjC,MAAM,IAAI,6BAA6B,mCAAmC;CAG5E,MAAM,QAAiC;EACrC,MAAM,QAAQ,MAAM,MAAM;EAC1B,OAAO,QAAQ,MAAM,OAAO;EAC5B,OAAO,QAAQ,MAAM,OAAO;EAE5B,MAAM,QAAQ,MAAM,MAAM;CAC5B;CAEA,IAAI,MAAM,OACR,MAAM,IAAI,6BAA6B,kBAAkB,OAAO,MAAM,KAAK,GAAG;CAGhF,IAAI,OAAO,MAAM,UAAU,YAAY,CAAC,UAAU,MAAM,OAAO,SAAS,KAAK,GAC3E,MAAM,IAAI,6BAA6B,gBAAgB;CAQzD,MAAM,OAAO,MAAM,oBAAoB,OAAO,MALxB,SAAS,eAAe;EAC5C;EACA,UAAU;GAAE,OAAO,SAAS;GAAO,OAAO,SAAS;GAAO,cAAc,SAAS;EAAa;CAChG,CAAC,CAEoD;CAErD,OAAO,YAAY,cAAc,MAAM,UAAU;AACnD"}