@warlock.js/auth 5.15.0 → 5.17.0

package/esm/providers/apple-provider.mjs

@@ -0,0 +1,157 @@
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { loadOptionalPeer } from "../services/optional-peer.mjs";
+import { pkceChallenge } from "./google-provider.mjs";
+
+//#region ../auth/src/providers/apple-provider.ts
+const AUTHORIZATION_ENDPOINT = "https://appleid.apple.com/auth/authorize";
+const TOKEN_ENDPOINT = "https://appleid.apple.com/auth/token";
+const JWKS_URI = "https://appleid.apple.com/auth/keys";
+const ISSUER = "https://appleid.apple.com";
+const DEFAULT_SCOPES = ["name", "email"];
+/** Apple's own recommendation for a per-request client secret: minutes, not the 6-month maximum it allows. */
+const CLIENT_SECRET_TTL_SECONDS = 300;
+/** The `warlock add` feature that installs `jose`. */
+const APPLE_AUTH_FEATURE = "auth-apple";
+/** Apple's key set, created once per process; `jose` caches the fetched JWKS inside it. */
+let appleKeySet;
+/**
+* Apple ("Sign in with Apple") is OpenID Connect over the authorization code
+* flow with PKCE (S256), `state` and `nonce`, the same shape as
+* {@link GoogleProvider} — with two differences that come straight from
+* Apple's own docs (this package has no Apple developer account, so nothing
+* here is proven against a live exchange):
+*
+* 1. Apple has no static client secret. The "secret" the token endpoint wants
+*    is a fresh ES256 JWT (`iss` = team id, `sub` = client id, `aud` =
+*    `https://appleid.apple.com`, signed with the app's private key and the
+*    key id as `kid`) — signed once per callback here rather than cached, to
+*    avoid ever presenting a stale one.
+* 2. Requesting `name`/`email` (the default scopes) forces
+*    `response_mode=form_post`: Apple POSTs `code`, `state` and, on the
+*    user's FIRST authorization only, a `user` field — a JSON string with
+*    `{ name: { firstName, lastName }, email } ` that never comes back again
+*    on a later login. The callback route must therefore accept a POST body,
+*    not just a query string, and `request.input` must read that body the
+*    same way it already reads a GET query for the other providers.
+*
+* The id_token is verified with `jose` against Apple's JWKS (signature,
+* `iss`, `aud` = the client id, `exp`), then its `nonce` is compared. Apple is
+* also documented to send `email_verified` (and `is_private_email`) as the
+* STRING `"true"`/`"false"` rather than a JSON boolean on some responses, so
+* both forms are accepted here — treating only the unambiguous `"false"` (or
+* `false`) as unverified. A private-relay address (`@privaterelay.appleid.com`)
+* is still a real, working forwarding address and is accepted as any other.
+*/
+var AppleProvider = class {
+	constructor(settings) {
+		this.settings = settings;
+		this.name = "apple";
+		this.callbackMode = "form_post";
+	}
+	authorizationUrl(state) {
+		const scopes = this.settings.scopes ?? DEFAULT_SCOPES;
+		const url = new URL(AUTHORIZATION_ENDPOINT);
+		url.searchParams.set("client_id", this.settings.clientId);
+		url.searchParams.set("redirect_uri", this.settings.redirectUri);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("scope", scopes.join(" "));
+		url.searchParams.set("state", state.state);
+		url.searchParams.set("nonce", state.nonce);
+		url.searchParams.set("code_challenge", pkceChallenge(state.codeVerifier));
+		url.searchParams.set("code_challenge_method", "S256");
+		if (scopes.includes("name") || scopes.includes("email")) url.searchParams.set("response_mode", "form_post");
+		return url.toString();
+	}
+	async handleCallback({ query, expected }) {
+		const jose = await loadOptionalPeer("jose", APPLE_AUTH_FEATURE);
+		const code = query.code;
+		if (typeof code !== "string" || code.length === 0) throw new InvalidProviderCallbackError("missing-code");
+		const idToken = await this.exchangeCode(jose, code, expected.codeVerifier);
+		const claims = await this.verifyIdToken(jose, idToken);
+		if (typeof claims.nonce !== "string" || claims.nonce !== expected.nonce) throw new InvalidProviderCallbackError("nonce-mismatch");
+		if (typeof claims.sub !== "string" || claims.sub.length === 0) throw new InvalidProviderCallbackError("missing-subject");
+		return {
+			provider: this.name,
+			providerUserId: claims.sub,
+			email: typeof claims.email === "string" ? claims.email : void 0,
+			emailVerified: isVerifiedFlag(claims.email_verified),
+			name: nameFromUserField(query.user),
+			raw: claims
+		};
+	}
+	/** Sign a fresh ES256 client-secret JWT — Apple has no static one. */
+	async clientSecret(jose) {
+		const key = await jose.importPKCS8(this.settings.privateKey, "ES256");
+		const now = Math.floor(Date.now() / 1e3);
+		try {
+			return await new jose.SignJWT({}).setProtectedHeader({
+				alg: "ES256",
+				kid: this.settings.keyId
+			}).setIssuer(this.settings.teamId).setIssuedAt().setExpirationTime(now + CLIENT_SECRET_TTL_SECONDS).setAudience(ISSUER).setSubject(this.settings.clientId).sign(key);
+		} catch (error) {
+			throw new InvalidProviderCallbackError("client-secret-signing-failed", error);
+		}
+	}
+	/** Redeem the authorization code (with the PKCE verifier) for an id_token. */
+	async exchangeCode(jose, code, codeVerifier) {
+		const clientSecret = await this.clientSecret(jose);
+		let body;
+		try {
+			const response = await fetch(TOKEN_ENDPOINT, {
+				method: "POST",
+				headers: { "content-type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({
+					code,
+					client_id: this.settings.clientId,
+					client_secret: clientSecret,
+					redirect_uri: this.settings.redirectUri,
+					grant_type: "authorization_code",
+					code_verifier: codeVerifier
+				})
+			});
+			if (!response.ok) throw new Error(`Apple token endpoint answered ${response.status}`);
+			body = await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("code-exchange-failed", error);
+		}
+		if (typeof body.id_token !== "string") throw new InvalidProviderCallbackError("missing-id-token");
+		return body.id_token;
+	}
+	/** Verify signature, issuer, audience and expiry; resolve the claims. */
+	async verifyIdToken(jose, idToken) {
+		appleKeySet ??= jose.createRemoteJWKSet(new URL(JWKS_URI));
+		try {
+			const { payload } = await jose.jwtVerify(idToken, appleKeySet, {
+				issuer: [ISSUER],
+				audience: this.settings.clientId
+			});
+			return payload;
+		} catch (error) {
+			throw new InvalidProviderCallbackError("invalid-id-token", error);
+		}
+	}
+};
+/** Apple's `email_verified` arrives as a JSON boolean on some responses, a `"true"`/`"false"` string on others. */
+function isVerifiedFlag(value) {
+	return value === true || value === "true";
+}
+/**
+* Apple sends the account name only once, on the FIRST authorization, as a
+* `user` form field holding a JSON string: `{"name":{"firstName","lastName"}}`.
+* Every later login omits it entirely — callers that need the name must save
+* it themselves the first time.
+*/
+function nameFromUserField(user) {
+	if (typeof user !== "string" || user.length === 0) return void 0;
+	try {
+		const parsed = JSON.parse(user);
+		const name = [parsed.name?.firstName, parsed.name?.lastName].filter((part) => Boolean(part)).join(" ");
+		return name.length > 0 ? name : void 0;
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+export { APPLE_AUTH_FEATURE, AppleProvider };
+//# sourceMappingURL=apple-provider.mjs.map

package/esm/providers/apple-provider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-provider.mjs","names":[],"sources":["../../../../../../../auth/src/providers/apple-provider.ts"],"sourcesContent":["import type {\n  AppleProviderConfig,\n  AuthProvider,\n  ProviderAuthorizationState,\n  ProviderCallbackParams,\n  ProviderProfile,\n} from \"../contracts/providers\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport { loadOptionalPeer } from \"../services/optional-peer\";\nimport type { JoseModule } from \"./google-provider\";\nimport { pkceChallenge } from \"./google-provider\";\n\nconst AUTHORIZATION_ENDPOINT = \"https://appleid.apple.com/auth/authorize\";\nconst TOKEN_ENDPOINT = \"https://appleid.apple.com/auth/token\";\nconst JWKS_URI = \"https://appleid.apple.com/auth/keys\";\nconst ISSUER = \"https://appleid.apple.com\";\nconst DEFAULT_SCOPES = [\"name\", \"email\"];\n/** Apple's own recommendation for a per-request client secret: minutes, not the 6-month maximum it allows. */\nconst CLIENT_SECRET_TTL_SECONDS = 5 * 60;\n\n/** The `warlock add` feature that installs `jose`. */\nexport const APPLE_AUTH_FEATURE = \"auth-apple\";\n\ntype AppleSignJwtBuilder = {\n  setIssuer: (issuer: string) => AppleSignJwtBuilder;\n  setIssuedAt: () => AppleSignJwtBuilder;\n  setExpirationTime: (time: number) => AppleSignJwtBuilder;\n  setAudience: (audience: string) => AppleSignJwtBuilder;\n  setSubject: (subject: string) => AppleSignJwtBuilder;\n  sign: (key: unknown) => Promise<string>;\n};\n\n/**\n * The slice of `jose` the Apple provider uses on top of {@link JoseModule} —\n * `importPKCS8` and `SignJWT` sign the ES256 client-secret JWT Apple requires\n * instead of a static client secret.\n */\nexport type AppleJoseModule = JoseModule & {\n  importPKCS8: (pkcs8: string, alg: string) => Promise<unknown>;\n  SignJWT: new (payload: Record<string, unknown>) => {\n    setProtectedHeader: (header: Record<string, unknown>) => AppleSignJwtBuilder;\n  };\n};\n\n/** Apple's key set, created once per process; `jose` caches the fetched JWKS inside it. */\nlet appleKeySet: unknown;\n\n/**\n * Apple (\"Sign in with Apple\") is OpenID Connect over the authorization code\n * flow with PKCE (S256), `state` and `nonce`, the same shape as\n * {@link GoogleProvider} — with two differences that come straight from\n * Apple's own docs (this package has no Apple developer account, so nothing\n * here is proven against a live exchange):\n *\n * 1. Apple has no static client secret. The \"secret\" the token endpoint wants\n *    is a fresh ES256 JWT (`iss` = team id, `sub` = client id, `aud` =\n *    `https://appleid.apple.com`, signed with the app's private key and the\n *    key id as `kid`) — signed once per callback here rather than cached, to\n *    avoid ever presenting a stale one.\n * 2. Requesting `name`/`email` (the default scopes) forces\n *    `response_mode=form_post`: Apple POSTs `code`, `state` and, on the\n *    user's FIRST authorization only, a `user` field — a JSON string with\n *    `{ name: { firstName, lastName }, email } ` that never comes back again\n *    on a later login. The callback route must therefore accept a POST body,\n *    not just a query string, and `request.input` must read that body the\n *    same way it already reads a GET query for the other providers.\n *\n * The id_token is verified with `jose` against Apple's JWKS (signature,\n * `iss`, `aud` = the client id, `exp`), then its `nonce` is compared. Apple is\n * also documented to send `email_verified` (and `is_private_email`) as the\n * STRING `\"true\"`/`\"false\"` rather than a JSON boolean on some responses, so\n * both forms are accepted here — treating only the unambiguous `\"false\"` (or\n * `false`) as unverified. A private-relay address (`@privaterelay.appleid.com`)\n * is still a real, working forwarding address and is accepted as any other.\n */\nexport class AppleProvider implements AuthProvider {\n  public readonly name = \"apple\";\n  /** Apple's default scopes (`name`, `email`) force `response_mode=form_post`. */\n  public readonly callbackMode = \"form_post\";\n\n  public constructor(private readonly settings: AppleProviderConfig) {}\n\n  public authorizationUrl(state: ProviderAuthorizationState): string {\n    const scopes = this.settings.scopes ?? DEFAULT_SCOPES;\n    const url = new URL(AUTHORIZATION_ENDPOINT);\n\n    url.searchParams.set(\"client_id\", this.settings.clientId);\n    url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"scope\", scopes.join(\" \"));\n    url.searchParams.set(\"state\", state.state);\n    url.searchParams.set(\"nonce\", state.nonce);\n    url.searchParams.set(\"code_challenge\", pkceChallenge(state.codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    // Apple requires form_post whenever name/email scopes are requested.\n    if (scopes.includes(\"name\") || scopes.includes(\"email\")) {\n      url.searchParams.set(\"response_mode\", \"form_post\");\n    }\n\n    return url.toString();\n  }\n\n  public async handleCallback({\n    query,\n    expected,\n  }: ProviderCallbackParams): Promise<ProviderProfile> {\n    // Load the peer first: a missing SDK fails loudly before any network call.\n    const jose = await loadOptionalPeer<AppleJoseModule>(\"jose\", APPLE_AUTH_FEATURE);\n\n    const code = query.code;\n\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-code\");\n    }\n\n    const idToken = await this.exchangeCode(jose, code, expected.codeVerifier);\n    const claims = await this.verifyIdToken(jose, idToken);\n\n    if (typeof claims.nonce !== \"string\" || claims.nonce !== expected.nonce) {\n      throw new InvalidProviderCallbackError(\"nonce-mismatch\");\n    }\n\n    if (typeof claims.sub !== \"string\" || claims.sub.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-subject\");\n    }\n\n    return {\n      provider: this.name,\n      providerUserId: claims.sub,\n      email: typeof claims.email === \"string\" ? claims.email : undefined,\n      emailVerified: isVerifiedFlag(claims.email_verified),\n      name: nameFromUserField(query.user),\n      raw: claims,\n    };\n  }\n\n  /** Sign a fresh ES256 client-secret JWT — Apple has no static one. */\n  private async clientSecret(jose: AppleJoseModule): Promise<string> {\n    const key = await jose.importPKCS8(this.settings.privateKey, \"ES256\");\n    const now = Math.floor(Date.now() / 1000);\n\n    try {\n      return await new jose.SignJWT({})\n        .setProtectedHeader({ alg: \"ES256\", kid: this.settings.keyId })\n        .setIssuer(this.settings.teamId)\n        .setIssuedAt()\n        .setExpirationTime(now + CLIENT_SECRET_TTL_SECONDS)\n        .setAudience(ISSUER)\n        .setSubject(this.settings.clientId)\n        .sign(key);\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"client-secret-signing-failed\", error);\n    }\n  }\n\n  /** Redeem the authorization code (with the PKCE verifier) for an id_token. */\n  private async exchangeCode(\n    jose: AppleJoseModule,\n    code: string,\n    codeVerifier: string,\n  ): Promise<string> {\n    const clientSecret = await this.clientSecret(jose);\n    let body: { id_token?: unknown };\n\n    try {\n      const response = await fetch(TOKEN_ENDPOINT, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          code,\n          client_id: this.settings.clientId,\n          client_secret: clientSecret,\n          redirect_uri: this.settings.redirectUri,\n          grant_type: \"authorization_code\",\n          code_verifier: codeVerifier,\n        }),\n      });\n\n      if (!response.ok) {\n        throw new Error(`Apple token endpoint answered ${response.status}`);\n      }\n\n      body = (await response.json()) as { id_token?: unknown };\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", error);\n    }\n\n    if (typeof body.id_token !== \"string\") {\n      throw new InvalidProviderCallbackError(\"missing-id-token\");\n    }\n\n    return body.id_token;\n  }\n\n  /** Verify signature, issuer, audience and expiry; resolve the claims. */\n  private async verifyIdToken(\n    jose: AppleJoseModule,\n    idToken: string,\n  ): Promise<Record<string, unknown>> {\n    appleKeySet ??= jose.createRemoteJWKSet(new URL(JWKS_URI));\n\n    try {\n      const { payload } = await jose.jwtVerify(idToken, appleKeySet, {\n        issuer: [ISSUER],\n        audience: this.settings.clientId,\n      });\n\n      return payload;\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"invalid-id-token\", error);\n    }\n  }\n}\n\n/** Apple's `email_verified` arrives as a JSON boolean on some responses, a `\"true\"`/`\"false\"` string on others. */\nfunction isVerifiedFlag(value: unknown): boolean {\n  return value === true || value === \"true\";\n}\n\n/**\n * Apple sends the account name only once, on the FIRST authorization, as a\n * `user` form field holding a JSON string: `{\"name\":{\"firstName\",\"lastName\"}}`.\n * Every later login omits it entirely — callers that need the name must save\n * it themselves the first time.\n */\nfunction nameFromUserField(user: unknown): string | undefined {\n  if (typeof user !== \"string\" || user.length === 0) return undefined;\n\n  try {\n    const parsed = JSON.parse(user) as { name?: { firstName?: string; lastName?: string } };\n    const first = parsed.name?.firstName;\n    const last = parsed.name?.lastName;\n    const name = [first, last].filter((part): part is string => Boolean(part)).join(\" \");\n\n    return name.length > 0 ? name : undefined;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;AAYA,MAAM,yBAAyB;AAC/B,MAAM,iBAAiB;AACvB,MAAM,WAAW;AACjB,MAAM,SAAS;AACf,MAAM,iBAAiB,CAAC,QAAQ,OAAO;;AAEvC,MAAM,4BAA4B;;AAGlC,MAAa,qBAAqB;;AAwBlC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BJ,IAAa,gBAAb,MAAmD;CAKjD,AAAO,YAAY,AAAiB,UAA+B;EAA/B;cAJb;sBAEQ;CAEqC;CAEpE,AAAO,iBAAiB,OAA2C;EACjE,MAAM,SAAS,KAAK,SAAS,UAAU;EACvC,MAAM,MAAM,IAAI,IAAI,sBAAsB;EAE1C,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;EACxD,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;EAC9D,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC;EAC9C,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,kBAAkB,cAAc,MAAM,YAAY,CAAC;EACxE,IAAI,aAAa,IAAI,yBAAyB,MAAM;EAGpD,IAAI,OAAO,SAAS,MAAM,KAAK,OAAO,SAAS,OAAO,GACpD,IAAI,aAAa,IAAI,iBAAiB,WAAW;EAGnD,OAAO,IAAI,SAAS;CACtB;CAEA,MAAa,eAAe,EAC1B,OACA,YACmD;EAEnD,MAAM,OAAO,MAAM,iBAAkC,QAAQ,kBAAkB;EAE/E,MAAM,OAAO,MAAM;EAEnB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,6BAA6B,cAAc;EAGvD,MAAM,UAAU,MAAM,KAAK,aAAa,MAAM,MAAM,SAAS,YAAY;EACzE,MAAM,SAAS,MAAM,KAAK,cAAc,MAAM,OAAO;EAErD,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,SAAS,OAChE,MAAM,IAAI,6BAA6B,gBAAgB;EAGzD,IAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,IAAI,WAAW,GAC1D,MAAM,IAAI,6BAA6B,iBAAiB;EAG1D,OAAO;GACL,UAAU,KAAK;GACf,gBAAgB,OAAO;GACvB,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;GACzD,eAAe,eAAe,OAAO,cAAc;GACnD,MAAM,kBAAkB,MAAM,IAAI;GAClC,KAAK;EACP;CACF;;CAGA,MAAc,aAAa,MAAwC;EACjE,MAAM,MAAM,MAAM,KAAK,YAAY,KAAK,SAAS,YAAY,OAAO;EACpE,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EAExC,IAAI;GACF,OAAO,MAAM,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAC9B,mBAAmB;IAAE,KAAK;IAAS,KAAK,KAAK,SAAS;GAAM,CAAC,CAAC,CAC9D,UAAU,KAAK,SAAS,MAAM,CAAC,CAC/B,YAAY,CAAC,CACb,kBAAkB,MAAM,yBAAyB,CAAC,CAClD,YAAY,MAAM,CAAC,CACnB,WAAW,KAAK,SAAS,QAAQ,CAAC,CAClC,KAAK,GAAG;EACb,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,gCAAgC,KAAK;EAC9E;CACF;;CAGA,MAAc,aACZ,MACA,MACA,cACiB;EACjB,MAAM,eAAe,MAAM,KAAK,aAAa,IAAI;EACjD,IAAI;EAEJ,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAC3C,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,IAAI,gBAAgB;KACxB;KACA,WAAW,KAAK,SAAS;KACzB,eAAe;KACf,cAAc,KAAK,SAAS;KAC5B,YAAY;KACZ,eAAe;IACjB,CAAC;GACH,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,iCAAiC,SAAS,QAAQ;GAGpE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;EAEA,IAAI,OAAO,KAAK,aAAa,UAC3B,MAAM,IAAI,6BAA6B,kBAAkB;EAG3D,OAAO,KAAK;CACd;;CAGA,MAAc,cACZ,MACA,SACkC;EAClC,gBAAgB,KAAK,mBAAmB,IAAI,IAAI,QAAQ,CAAC;EAEzD,IAAI;GACF,MAAM,EAAE,YAAY,MAAM,KAAK,UAAU,SAAS,aAAa;IAC7D,QAAQ,CAAC,MAAM;IACf,UAAU,KAAK,SAAS;GAC1B,CAAC;GAED,OAAO;EACT,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,oBAAoB,KAAK;EAClE;CACF;AACF;;AAGA,SAAS,eAAe,OAAyB;CAC/C,OAAO,UAAU,QAAQ,UAAU;AACrC;;;;;;;AAQA,SAAS,kBAAkB,MAAmC;CAC5D,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,OAAO;CAE1D,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAG9B,MAAM,OAAO,CAFC,OAAO,MAAM,WACd,OAAO,MAAM,QACD,CAAC,CAAC,QAAQ,SAAyB,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;EAEnF,OAAO,KAAK,SAAS,IAAI,OAAO;CAClC,QAAQ;EACN;CACF;AACF"}

package/esm/providers/discord-provider.d.mts

@@ -0,0 +1,25 @@
+import { AuthProvider, DiscordProviderConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile } from "../contracts/providers.mjs";
+
+//#region ../auth/src/providers/discord-provider.d.ts
+/**
+ * Discord sign-in: plain OAuth 2 authorization code flow with PKCE (S256).
+ * Like GitHub, Discord is not OpenID Connect — there is no `id_token`; the
+ * access token is redeemed once for `/users/@me` over a direct HTTPS call.
+ * No vendor SDK is involved.
+ */
+declare class DiscordProvider implements AuthProvider {
+  private readonly settings;
+  readonly name = "discord";
+  constructor(settings: DiscordProviderConfig);
+  authorizationUrl(state: ProviderAuthorizationState): string;
+  handleCallback({
+    query,
+    expected
+  }: ProviderCallbackParams): Promise<ProviderProfile>;
+  /** Redeem the authorization code (with the PKCE verifier) for an access token. */
+  private exchangeCode;
+  private fetchUser;
+}
+//#endregion
+export { DiscordProvider };
+//# sourceMappingURL=discord-provider.d.mts.map

package/esm/providers/discord-provider.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-provider.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/discord-provider.ts"],"mappings":";;;;;AA8BA;;;;cAAa,eAAA,YAA2B,YAAA;EAAA,iBAGF,QAAA;EAAA,SAFpB,IAAA;cAEoB,QAAA,EAAU,qBAAA;EAEvC,gBAAA,CAAiB,KAAA,EAAO,0BAAA;EAclB,cAAA;IACX,KAAA;IACA;EAAA,GACC,sBAAA,GAAyB,OAAA,CAAQ,eAAA;EAtBE;EAAA,QAkDxB,YAAA;EAAA,QAiCA,SAAA;AAAA"}

package/esm/providers/discord-provider.mjs

@@ -0,0 +1,84 @@
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { pkceChallenge } from "./google-provider.mjs";
+
+//#region ../auth/src/providers/discord-provider.ts
+const AUTHORIZATION_ENDPOINT = "https://discord.com/oauth2/authorize";
+const TOKEN_ENDPOINT = "https://discord.com/api/oauth2/token";
+const USER_ENDPOINT = "https://discord.com/api/users/@me";
+const DEFAULT_SCOPES = ["identify", "email"];
+/**
+* Discord sign-in: plain OAuth 2 authorization code flow with PKCE (S256).
+* Like GitHub, Discord is not OpenID Connect — there is no `id_token`; the
+* access token is redeemed once for `/users/@me` over a direct HTTPS call.
+* No vendor SDK is involved.
+*/
+var DiscordProvider = class {
+	constructor(settings) {
+		this.settings = settings;
+		this.name = "discord";
+	}
+	authorizationUrl(state) {
+		const url = new URL(AUTHORIZATION_ENDPOINT);
+		url.searchParams.set("client_id", this.settings.clientId);
+		url.searchParams.set("redirect_uri", this.settings.redirectUri);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("scope", (this.settings.scopes ?? DEFAULT_SCOPES).join(" "));
+		url.searchParams.set("state", state.state);
+		url.searchParams.set("code_challenge", pkceChallenge(state.codeVerifier));
+		url.searchParams.set("code_challenge_method", "S256");
+		return url.toString();
+	}
+	async handleCallback({ query, expected }) {
+		const code = query.code;
+		if (typeof code !== "string" || code.length === 0) throw new InvalidProviderCallbackError("missing-code");
+		const accessToken = await this.exchangeCode(code, expected.codeVerifier);
+		const user = await this.fetchUser(accessToken);
+		if (typeof user.id !== "string" || user.id.length === 0) throw new InvalidProviderCallbackError("missing-subject");
+		return {
+			provider: this.name,
+			providerUserId: user.id,
+			email: user.email ?? void 0,
+			emailVerified: user.verified === true,
+			name: user.global_name ?? user.username,
+			avatar: user.avatar ? `https://cdn.discordapp.com/avatars/${user.id}/${user.avatar}.png` : void 0,
+			raw: user
+		};
+	}
+	/** Redeem the authorization code (with the PKCE verifier) for an access token. */
+	async exchangeCode(code, codeVerifier) {
+		let body;
+		try {
+			const response = await fetch(TOKEN_ENDPOINT, {
+				method: "POST",
+				headers: { "content-type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({
+					code,
+					client_id: this.settings.clientId,
+					client_secret: this.settings.clientSecret,
+					redirect_uri: this.settings.redirectUri,
+					grant_type: "authorization_code",
+					code_verifier: codeVerifier
+				})
+			});
+			if (!response.ok) throw new Error(`Discord token endpoint answered ${response.status}`);
+			body = await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("code-exchange-failed", error);
+		}
+		if (typeof body.access_token !== "string" || body.access_token.length === 0) throw new InvalidProviderCallbackError("missing-access-token");
+		return body.access_token;
+	}
+	async fetchUser(accessToken) {
+		try {
+			const response = await fetch(USER_ENDPOINT, { headers: { authorization: `Bearer ${accessToken}` } });
+			if (!response.ok) throw new Error(`Discord user endpoint answered ${response.status}`);
+			return await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("profile-fetch-failed", error);
+		}
+	}
+};
+
+//#endregion
+export { DiscordProvider };
+//# sourceMappingURL=discord-provider.mjs.map

package/esm/providers/discord-provider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-provider.mjs","names":[],"sources":["../../../../../../../auth/src/providers/discord-provider.ts"],"sourcesContent":["import type {\n  AuthProvider,\n  DiscordProviderConfig,\n  ProviderAuthorizationState,\n  ProviderCallbackParams,\n  ProviderProfile,\n} from \"../contracts/providers\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport { pkceChallenge } from \"./google-provider\";\n\nconst AUTHORIZATION_ENDPOINT = \"https://discord.com/oauth2/authorize\";\nconst TOKEN_ENDPOINT = \"https://discord.com/api/oauth2/token\";\nconst USER_ENDPOINT = \"https://discord.com/api/users/@me\";\nconst DEFAULT_SCOPES = [\"identify\", \"email\"];\n\ntype DiscordUser = {\n  id: string;\n  username: string;\n  global_name?: string | null;\n  avatar?: string | null;\n  email?: string | null;\n  verified?: boolean;\n};\n\n/**\n * Discord sign-in: plain OAuth 2 authorization code flow with PKCE (S256).\n * Like GitHub, Discord is not OpenID Connect — there is no `id_token`; the\n * access token is redeemed once for `/users/@me` over a direct HTTPS call.\n * No vendor SDK is involved.\n */\nexport class DiscordProvider implements AuthProvider {\n  public readonly name = \"discord\";\n\n  public constructor(private readonly settings: DiscordProviderConfig) {}\n\n  public authorizationUrl(state: ProviderAuthorizationState): string {\n    const url = new URL(AUTHORIZATION_ENDPOINT);\n\n    url.searchParams.set(\"client_id\", this.settings.clientId);\n    url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"scope\", (this.settings.scopes ?? DEFAULT_SCOPES).join(\" \"));\n    url.searchParams.set(\"state\", state.state);\n    url.searchParams.set(\"code_challenge\", pkceChallenge(state.codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    return url.toString();\n  }\n\n  public async handleCallback({\n    query,\n    expected,\n  }: ProviderCallbackParams): Promise<ProviderProfile> {\n    const code = query.code;\n\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-code\");\n    }\n\n    const accessToken = await this.exchangeCode(code, expected.codeVerifier);\n    const user = await this.fetchUser(accessToken);\n\n    if (typeof user.id !== \"string\" || user.id.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-subject\");\n    }\n\n    return {\n      provider: this.name,\n      providerUserId: user.id,\n      email: user.email ?? undefined,\n      emailVerified: user.verified === true,\n      name: user.global_name ?? user.username,\n      avatar: user.avatar\n        ? `https://cdn.discordapp.com/avatars/${user.id}/${user.avatar}.png`\n        : undefined,\n      raw: user,\n    };\n  }\n\n  /** Redeem the authorization code (with the PKCE verifier) for an access token. */\n  private async exchangeCode(code: string, codeVerifier: string): Promise<string> {\n    let body: { access_token?: unknown };\n\n    try {\n      const response = await fetch(TOKEN_ENDPOINT, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          code,\n          client_id: this.settings.clientId,\n          client_secret: this.settings.clientSecret,\n          redirect_uri: this.settings.redirectUri,\n          grant_type: \"authorization_code\",\n          code_verifier: codeVerifier,\n        }),\n      });\n\n      if (!response.ok) {\n        throw new Error(`Discord token endpoint answered ${response.status}`);\n      }\n\n      body = (await response.json()) as { access_token?: unknown };\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", error);\n    }\n\n    if (typeof body.access_token !== \"string\" || body.access_token.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-access-token\");\n    }\n\n    return body.access_token;\n  }\n\n  private async fetchUser(accessToken: string): Promise<DiscordUser> {\n    try {\n      const response = await fetch(USER_ENDPOINT, {\n        headers: { authorization: `Bearer ${accessToken}` },\n      });\n\n      if (!response.ok) {\n        throw new Error(`Discord user endpoint answered ${response.status}`);\n      }\n\n      return (await response.json()) as DiscordUser;\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"profile-fetch-failed\", error);\n    }\n  }\n}\n"],"mappings":";;;;AAUA,MAAM,yBAAyB;AAC/B,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB,CAAC,YAAY,OAAO;;;;;;;AAiB3C,IAAa,kBAAb,MAAqD;CAGnD,AAAO,YAAY,AAAiB,UAAiC;EAAjC;cAFb;CAE+C;CAEtE,AAAO,iBAAiB,OAA2C;EACjE,MAAM,MAAM,IAAI,IAAI,sBAAsB;EAE1C,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;EACxD,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;EAC9D,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,UAAU,KAAK,SAAS,UAAU,eAAc,CAAE,KAAK,GAAG,CAAC;EAChF,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,kBAAkB,cAAc,MAAM,YAAY,CAAC;EACxE,IAAI,aAAa,IAAI,yBAAyB,MAAM;EAEpD,OAAO,IAAI,SAAS;CACtB;CAEA,MAAa,eAAe,EAC1B,OACA,YACmD;EACnD,MAAM,OAAO,MAAM;EAEnB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,6BAA6B,cAAc;EAGvD,MAAM,cAAc,MAAM,KAAK,aAAa,MAAM,SAAS,YAAY;EACvE,MAAM,OAAO,MAAM,KAAK,UAAU,WAAW;EAE7C,IAAI,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,WAAW,GACpD,MAAM,IAAI,6BAA6B,iBAAiB;EAG1D,OAAO;GACL,UAAU,KAAK;GACf,gBAAgB,KAAK;GACrB,OAAO,KAAK,SAAS;GACrB,eAAe,KAAK,aAAa;GACjC,MAAM,KAAK,eAAe,KAAK;GAC/B,QAAQ,KAAK,SACT,sCAAsC,KAAK,GAAG,GAAG,KAAK,OAAO,QAC7D;GACJ,KAAK;EACP;CACF;;CAGA,MAAc,aAAa,MAAc,cAAuC;EAC9E,IAAI;EAEJ,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAC3C,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,IAAI,gBAAgB;KACxB;KACA,WAAW,KAAK,SAAS;KACzB,eAAe,KAAK,SAAS;KAC7B,cAAc,KAAK,SAAS;KAC5B,YAAY;KACZ,eAAe;IACjB,CAAC;GACH,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,mCAAmC,SAAS,QAAQ;GAGtE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;EAEA,IAAI,OAAO,KAAK,iBAAiB,YAAY,KAAK,aAAa,WAAW,GACxE,MAAM,IAAI,6BAA6B,sBAAsB;EAG/D,OAAO,KAAK;CACd;CAEA,MAAc,UAAU,aAA2C;EACjE,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,eAAe,EAC1C,SAAS,EAAE,eAAe,UAAU,cAAc,EACpD,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,kCAAkC,SAAS,QAAQ;GAGrE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;CACF;AACF"}

package/esm/providers/facebook-provider.d.mts

@@ -0,0 +1,36 @@
+import { AuthProvider, FacebookProviderConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile } from "../contracts/providers.mjs";
+
+//#region ../auth/src/providers/facebook-provider.d.ts
+/**
+ * Facebook sign-in: plain OAuth 2 authorization code flow with PKCE (S256).
+ * Facebook is not OpenID Connect — there is no `id_token`. Unlike every other
+ * built-in provider, Facebook's token endpoint is redeemed with a `GET`
+ * request (query-string parameters, not a POST body) — that shape comes
+ * straight from Facebook's Graph API docs, not from a live exchange (this
+ * package has no Facebook test app). The profile is then read once from
+ * `Graph /me?fields=id,name,email,picture`, over a direct HTTPS call; no
+ * Facebook SDK is involved.
+ *
+ * Facebook only ever returns a confirmed address for `email` — there is no
+ * separate verified flag — so an email present on the profile is treated as
+ * verified. An app without `email` permission granted, or one that simply has
+ * no email on file, gets `email: undefined`, which `resolveProviderUser`
+ * already rejects as an unverified/missing email, the same path GitHub's
+ * unverified addresses take.
+ */
+declare class FacebookProvider implements AuthProvider {
+  private readonly settings;
+  readonly name = "facebook";
+  constructor(settings: FacebookProviderConfig);
+  authorizationUrl(state: ProviderAuthorizationState): string;
+  handleCallback({
+    query,
+    expected
+  }: ProviderCallbackParams): Promise<ProviderProfile>;
+  /** Redeem the authorization code (with the PKCE verifier) for an access token. */
+  private exchangeCode;
+  private fetchUser;
+}
+//#endregion
+export { FacebookProvider };
+//# sourceMappingURL=facebook-provider.d.mts.map

package/esm/providers/facebook-provider.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facebook-provider.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/facebook-provider.ts"],"mappings":";;;;;AAuCA;;;;;;;;;;;;;;;cAAa,gBAAA,YAA4B,YAAA;EAAA,iBAGH,QAAA;EAAA,SAFpB,IAAA;cAEoB,QAAA,EAAU,sBAAA;EAEvC,gBAAA,CAAiB,KAAA,EAAO,0BAAA;EAclB,cAAA;IACX,KAAA;IACA;EAAA,GACC,sBAAA,GAAyB,OAAA,CAAQ,eAAA;EAjBZ;EAAA,QA4CV,YAAA;EAAA,QAkCA,SAAA;AAAA"}

package/esm/providers/facebook-provider.mjs

@@ -0,0 +1,94 @@
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { pkceChallenge } from "./google-provider.mjs";
+
+//#region ../auth/src/providers/facebook-provider.ts
+const AUTHORIZATION_ENDPOINT = "https://www.facebook.com/v19.0/dialog/oauth";
+const TOKEN_ENDPOINT = "https://graph.facebook.com/v19.0/oauth/access_token";
+const USER_ENDPOINT = "https://graph.facebook.com/v19.0/me";
+const DEFAULT_SCOPES = ["email", "public_profile"];
+/**
+* Facebook sign-in: plain OAuth 2 authorization code flow with PKCE (S256).
+* Facebook is not OpenID Connect — there is no `id_token`. Unlike every other
+* built-in provider, Facebook's token endpoint is redeemed with a `GET`
+* request (query-string parameters, not a POST body) — that shape comes
+* straight from Facebook's Graph API docs, not from a live exchange (this
+* package has no Facebook test app). The profile is then read once from
+* `Graph /me?fields=id,name,email,picture`, over a direct HTTPS call; no
+* Facebook SDK is involved.
+*
+* Facebook only ever returns a confirmed address for `email` — there is no
+* separate verified flag — so an email present on the profile is treated as
+* verified. An app without `email` permission granted, or one that simply has
+* no email on file, gets `email: undefined`, which `resolveProviderUser`
+* already rejects as an unverified/missing email, the same path GitHub's
+* unverified addresses take.
+*/
+var FacebookProvider = class {
+	constructor(settings) {
+		this.settings = settings;
+		this.name = "facebook";
+	}
+	authorizationUrl(state) {
+		const url = new URL(AUTHORIZATION_ENDPOINT);
+		url.searchParams.set("client_id", this.settings.clientId);
+		url.searchParams.set("redirect_uri", this.settings.redirectUri);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("scope", (this.settings.scopes ?? DEFAULT_SCOPES).join(" "));
+		url.searchParams.set("state", state.state);
+		url.searchParams.set("code_challenge", pkceChallenge(state.codeVerifier));
+		url.searchParams.set("code_challenge_method", "S256");
+		return url.toString();
+	}
+	async handleCallback({ query, expected }) {
+		const code = query.code;
+		if (typeof code !== "string" || code.length === 0) throw new InvalidProviderCallbackError("missing-code");
+		const accessToken = await this.exchangeCode(code, expected.codeVerifier);
+		const user = await this.fetchUser(accessToken);
+		if (typeof user.id !== "string" || user.id.length === 0) throw new InvalidProviderCallbackError("missing-subject");
+		return {
+			provider: this.name,
+			providerUserId: user.id,
+			email: user.email,
+			emailVerified: typeof user.email === "string" && user.email.length > 0,
+			name: user.name,
+			avatar: user.picture?.data?.url,
+			raw: user
+		};
+	}
+	/** Redeem the authorization code (with the PKCE verifier) for an access token. */
+	async exchangeCode(code, codeVerifier) {
+		let body;
+		try {
+			const url = new URL(TOKEN_ENDPOINT);
+			url.searchParams.set("client_id", this.settings.clientId);
+			url.searchParams.set("client_secret", this.settings.clientSecret);
+			url.searchParams.set("redirect_uri", this.settings.redirectUri);
+			url.searchParams.set("code", code);
+			url.searchParams.set("code_verifier", codeVerifier);
+			const response = await fetch(url.toString(), { headers: { accept: "application/json" } });
+			if (!response.ok) throw new Error(`Facebook token endpoint answered ${response.status}`);
+			body = await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("code-exchange-failed", error);
+		}
+		if (body.error) throw new InvalidProviderCallbackError("code-exchange-failed", body.error);
+		if (typeof body.access_token !== "string" || body.access_token.length === 0) throw new InvalidProviderCallbackError("missing-access-token");
+		return body.access_token;
+	}
+	async fetchUser(accessToken) {
+		try {
+			const url = new URL(USER_ENDPOINT);
+			url.searchParams.set("fields", "id,name,email,picture");
+			url.searchParams.set("access_token", accessToken);
+			const response = await fetch(url.toString(), { headers: { accept: "application/json" } });
+			if (!response.ok) throw new Error(`Facebook /me endpoint answered ${response.status}`);
+			return await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("profile-fetch-failed", error);
+		}
+	}
+};
+
+//#endregion
+export { FacebookProvider };
+//# sourceMappingURL=facebook-provider.mjs.map

package/esm/providers/facebook-provider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"facebook-provider.mjs","names":[],"sources":["../../../../../../../auth/src/providers/facebook-provider.ts"],"sourcesContent":["import type {\n  AuthProvider,\n  FacebookProviderConfig,\n  ProviderAuthorizationState,\n  ProviderCallbackParams,\n  ProviderProfile,\n} from \"../contracts/providers\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport { pkceChallenge } from \"./google-provider\";\n\nconst AUTHORIZATION_ENDPOINT = \"https://www.facebook.com/v19.0/dialog/oauth\";\nconst TOKEN_ENDPOINT = \"https://graph.facebook.com/v19.0/oauth/access_token\";\nconst USER_ENDPOINT = \"https://graph.facebook.com/v19.0/me\";\nconst DEFAULT_SCOPES = [\"email\", \"public_profile\"];\n\ntype FacebookUser = {\n  id: string;\n  name?: string;\n  email?: string;\n  picture?: { data?: { url?: string } };\n};\n\n/**\n * Facebook sign-in: plain OAuth 2 authorization code flow with PKCE (S256).\n * Facebook is not OpenID Connect — there is no `id_token`. Unlike every other\n * built-in provider, Facebook's token endpoint is redeemed with a `GET`\n * request (query-string parameters, not a POST body) — that shape comes\n * straight from Facebook's Graph API docs, not from a live exchange (this\n * package has no Facebook test app). The profile is then read once from\n * `Graph /me?fields=id,name,email,picture`, over a direct HTTPS call; no\n * Facebook SDK is involved.\n *\n * Facebook only ever returns a confirmed address for `email` — there is no\n * separate verified flag — so an email present on the profile is treated as\n * verified. An app without `email` permission granted, or one that simply has\n * no email on file, gets `email: undefined`, which `resolveProviderUser`\n * already rejects as an unverified/missing email, the same path GitHub's\n * unverified addresses take.\n */\nexport class FacebookProvider implements AuthProvider {\n  public readonly name = \"facebook\";\n\n  public constructor(private readonly settings: FacebookProviderConfig) {}\n\n  public authorizationUrl(state: ProviderAuthorizationState): string {\n    const url = new URL(AUTHORIZATION_ENDPOINT);\n\n    url.searchParams.set(\"client_id\", this.settings.clientId);\n    url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"scope\", (this.settings.scopes ?? DEFAULT_SCOPES).join(\" \"));\n    url.searchParams.set(\"state\", state.state);\n    url.searchParams.set(\"code_challenge\", pkceChallenge(state.codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    return url.toString();\n  }\n\n  public async handleCallback({\n    query,\n    expected,\n  }: ProviderCallbackParams): Promise<ProviderProfile> {\n    const code = query.code;\n\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-code\");\n    }\n\n    const accessToken = await this.exchangeCode(code, expected.codeVerifier);\n    const user = await this.fetchUser(accessToken);\n\n    if (typeof user.id !== \"string\" || user.id.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-subject\");\n    }\n\n    return {\n      provider: this.name,\n      providerUserId: user.id,\n      email: user.email,\n      // Facebook does not report a verification flag; a returned address is confirmed.\n      emailVerified: typeof user.email === \"string\" && user.email.length > 0,\n      name: user.name,\n      avatar: user.picture?.data?.url,\n      raw: user,\n    };\n  }\n\n  /** Redeem the authorization code (with the PKCE verifier) for an access token. */\n  private async exchangeCode(code: string, codeVerifier: string): Promise<string> {\n    let body: { access_token?: unknown; error?: unknown };\n\n    try {\n      const url = new URL(TOKEN_ENDPOINT);\n\n      url.searchParams.set(\"client_id\", this.settings.clientId);\n      url.searchParams.set(\"client_secret\", this.settings.clientSecret);\n      url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n      url.searchParams.set(\"code\", code);\n      url.searchParams.set(\"code_verifier\", codeVerifier);\n\n      const response = await fetch(url.toString(), { headers: { accept: \"application/json\" } });\n\n      if (!response.ok) {\n        throw new Error(`Facebook token endpoint answered ${response.status}`);\n      }\n\n      body = (await response.json()) as { access_token?: unknown; error?: unknown };\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", error);\n    }\n\n    if (body.error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", body.error);\n    }\n\n    if (typeof body.access_token !== \"string\" || body.access_token.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-access-token\");\n    }\n\n    return body.access_token;\n  }\n\n  private async fetchUser(accessToken: string): Promise<FacebookUser> {\n    try {\n      const url = new URL(USER_ENDPOINT);\n\n      url.searchParams.set(\"fields\", \"id,name,email,picture\");\n      url.searchParams.set(\"access_token\", accessToken);\n\n      const response = await fetch(url.toString(), { headers: { accept: \"application/json\" } });\n\n      if (!response.ok) {\n        throw new Error(`Facebook /me endpoint answered ${response.status}`);\n      }\n\n      return (await response.json()) as FacebookUser;\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"profile-fetch-failed\", error);\n    }\n  }\n}\n"],"mappings":";;;;AAUA,MAAM,yBAAyB;AAC/B,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB,CAAC,SAAS,gBAAgB;;;;;;;;;;;;;;;;;;AA0BjD,IAAa,mBAAb,MAAsD;CAGpD,AAAO,YAAY,AAAiB,UAAkC;EAAlC;cAFb;CAEgD;CAEvE,AAAO,iBAAiB,OAA2C;EACjE,MAAM,MAAM,IAAI,IAAI,sBAAsB;EAE1C,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;EACxD,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;EAC9D,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,UAAU,KAAK,SAAS,UAAU,eAAc,CAAE,KAAK,GAAG,CAAC;EAChF,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,kBAAkB,cAAc,MAAM,YAAY,CAAC;EACxE,IAAI,aAAa,IAAI,yBAAyB,MAAM;EAEpD,OAAO,IAAI,SAAS;CACtB;CAEA,MAAa,eAAe,EAC1B,OACA,YACmD;EACnD,MAAM,OAAO,MAAM;EAEnB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,6BAA6B,cAAc;EAGvD,MAAM,cAAc,MAAM,KAAK,aAAa,MAAM,SAAS,YAAY;EACvE,MAAM,OAAO,MAAM,KAAK,UAAU,WAAW;EAE7C,IAAI,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,WAAW,GACpD,MAAM,IAAI,6BAA6B,iBAAiB;EAG1D,OAAO;GACL,UAAU,KAAK;GACf,gBAAgB,KAAK;GACrB,OAAO,KAAK;GAEZ,eAAe,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,SAAS;GACrE,MAAM,KAAK;GACX,QAAQ,KAAK,SAAS,MAAM;GAC5B,KAAK;EACP;CACF;;CAGA,MAAc,aAAa,MAAc,cAAuC;EAC9E,IAAI;EAEJ,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,cAAc;GAElC,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;GACxD,IAAI,aAAa,IAAI,iBAAiB,KAAK,SAAS,YAAY;GAChE,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;GAC9D,IAAI,aAAa,IAAI,QAAQ,IAAI;GACjC,IAAI,aAAa,IAAI,iBAAiB,YAAY;GAElD,MAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG,EAAE,SAAS,EAAE,QAAQ,mBAAmB,EAAE,CAAC;GAExF,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,oCAAoC,SAAS,QAAQ;GAGvE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;EAEA,IAAI,KAAK,OACP,MAAM,IAAI,6BAA6B,wBAAwB,KAAK,KAAK;EAG3E,IAAI,OAAO,KAAK,iBAAiB,YAAY,KAAK,aAAa,WAAW,GACxE,MAAM,IAAI,6BAA6B,sBAAsB;EAG/D,OAAO,KAAK;CACd;CAEA,MAAc,UAAU,aAA4C;EAClE,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,aAAa;GAEjC,IAAI,aAAa,IAAI,UAAU,uBAAuB;GACtD,IAAI,aAAa,IAAI,gBAAgB,WAAW;GAEhD,MAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG,EAAE,SAAS,EAAE,QAAQ,mBAAmB,EAAE,CAAC;GAExF,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,kCAAkC,SAAS,QAAQ;GAGrE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;CACF;AACF"}

package/esm/providers/github-provider.d.mts

@@ -0,0 +1,31 @@
+import { AuthProvider, GitHubProviderConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile } from "../contracts/providers.mjs";
+
+//#region ../auth/src/providers/github-provider.d.ts
+/**
+ * GitHub sign-in: plain OAuth 2 authorization code flow with PKCE (S256).
+ * GitHub is not OpenID Connect — there is no `id_token` and nothing to verify
+ * against a JWKS. The access token is redeemed once for the profile, over a
+ * direct HTTPS call to GitHub's API; no vendor SDK is involved.
+ *
+ * The account email is fetched separately from `/user/emails`, because
+ * `/user.email` is `null` unless the user made it public — the emails
+ * endpoint is also where GitHub reports whether an address is verified.
+ */
+declare class GitHubProvider implements AuthProvider {
+  private readonly settings;
+  readonly name = "github";
+  constructor(settings: GitHubProviderConfig);
+  authorizationUrl(state: ProviderAuthorizationState): string;
+  handleCallback({
+    query,
+    expected
+  }: ProviderCallbackParams): Promise<ProviderProfile>;
+  /** Redeem the authorization code (with the PKCE verifier) for an access token. */
+  private exchangeCode;
+  private fetchUser;
+  /** The primary, verified email — `undefined` when none is both primary and verified. */
+  private fetchPrimaryEmail;
+}
+//#endregion
+export { GitHubProvider };
+//# sourceMappingURL=github-provider.d.mts.map

package/esm/providers/github-provider.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-provider.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/github-provider.ts"],"mappings":";;;;;AA0CA;;;;;;;;cAAa,cAAA,YAA0B,YAAA;EAAA,iBAGD,QAAA;EAAA,SAFpB,IAAA;cAEoB,QAAA,EAAU,oBAAA;EAEvC,gBAAA,CAAiB,KAAA,EAAO,0BAAA;EAclB,cAAA;IACX,KAAA;IACA;EAAA,GACC,sBAAA,GAAyB,OAAA,CAAQ,eAAA;EAnBA;EAAA,QA8CtB,YAAA;EAAA,QAwCA,SAAA;EAtFgC;EAAA,QA2GhC,iBAAA;AAAA"}

package/esm/providers/github-provider.mjs

@@ -0,0 +1,115 @@
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { pkceChallenge } from "./google-provider.mjs";
+
+//#region ../auth/src/providers/github-provider.ts
+const AUTHORIZATION_ENDPOINT = "https://github.com/login/oauth/authorize";
+const TOKEN_ENDPOINT = "https://github.com/login/oauth/access_token";
+const USER_ENDPOINT = "https://api.github.com/user";
+const EMAILS_ENDPOINT = "https://api.github.com/user/emails";
+const DEFAULT_SCOPES = ["read:user", "user:email"];
+/** GitHub requires a `User-Agent`; identify the framework, not the app. */
+const USER_AGENT = "warlock.js-auth";
+/**
+* GitHub sign-in: plain OAuth 2 authorization code flow with PKCE (S256).
+* GitHub is not OpenID Connect — there is no `id_token` and nothing to verify
+* against a JWKS. The access token is redeemed once for the profile, over a
+* direct HTTPS call to GitHub's API; no vendor SDK is involved.
+*
+* The account email is fetched separately from `/user/emails`, because
+* `/user.email` is `null` unless the user made it public — the emails
+* endpoint is also where GitHub reports whether an address is verified.
+*/
+var GitHubProvider = class {
+	constructor(settings) {
+		this.settings = settings;
+		this.name = "github";
+	}
+	authorizationUrl(state) {
+		const url = new URL(AUTHORIZATION_ENDPOINT);
+		url.searchParams.set("client_id", this.settings.clientId);
+		url.searchParams.set("redirect_uri", this.settings.redirectUri);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("scope", (this.settings.scopes ?? DEFAULT_SCOPES).join(" "));
+		url.searchParams.set("state", state.state);
+		url.searchParams.set("code_challenge", pkceChallenge(state.codeVerifier));
+		url.searchParams.set("code_challenge_method", "S256");
+		return url.toString();
+	}
+	async handleCallback({ query, expected }) {
+		const code = query.code;
+		if (typeof code !== "string" || code.length === 0) throw new InvalidProviderCallbackError("missing-code");
+		const accessToken = await this.exchangeCode(code, expected.codeVerifier);
+		const user = await this.fetchUser(accessToken);
+		const email = await this.fetchPrimaryEmail(accessToken);
+		if (typeof user.id !== "number") throw new InvalidProviderCallbackError("missing-subject");
+		return {
+			provider: this.name,
+			providerUserId: String(user.id),
+			email: email?.email,
+			emailVerified: email?.verified === true,
+			name: user.name ?? user.login,
+			avatar: user.avatar_url,
+			raw: user
+		};
+	}
+	/** Redeem the authorization code (with the PKCE verifier) for an access token. */
+	async exchangeCode(code, codeVerifier) {
+		let body;
+		try {
+			const response = await fetch(TOKEN_ENDPOINT, {
+				method: "POST",
+				headers: {
+					"content-type": "application/x-www-form-urlencoded",
+					accept: "application/json"
+				},
+				body: new URLSearchParams({
+					code,
+					client_id: this.settings.clientId,
+					client_secret: this.settings.clientSecret,
+					redirect_uri: this.settings.redirectUri,
+					code_verifier: codeVerifier
+				})
+			});
+			if (!response.ok) throw new Error(`GitHub token endpoint answered ${response.status}`);
+			body = await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("code-exchange-failed", error);
+		}
+		if (body.error) throw new InvalidProviderCallbackError("code-exchange-failed", body.error);
+		if (typeof body.access_token !== "string" || body.access_token.length === 0) throw new InvalidProviderCallbackError("missing-access-token");
+		return body.access_token;
+	}
+	async fetchUser(accessToken) {
+		try {
+			const response = await fetch(USER_ENDPOINT, { headers: {
+				authorization: `Bearer ${accessToken}`,
+				accept: "application/vnd.github+json",
+				"user-agent": USER_AGENT
+			} });
+			if (!response.ok) throw new Error(`GitHub user endpoint answered ${response.status}`);
+			return await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("profile-fetch-failed", error);
+		}
+	}
+	/** The primary, verified email — `undefined` when none is both primary and verified. */
+	async fetchPrimaryEmail(accessToken) {
+		let emails;
+		try {
+			const response = await fetch(EMAILS_ENDPOINT, { headers: {
+				authorization: `Bearer ${accessToken}`,
+				accept: "application/vnd.github+json",
+				"user-agent": USER_AGENT
+			} });
+			if (!response.ok) throw new Error(`GitHub emails endpoint answered ${response.status}`);
+			emails = await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("profile-fetch-failed", error);
+		}
+		return emails.find((email) => email.primary && email.verified);
+	}
+};
+
+//#endregion
+export { GitHubProvider };
+//# sourceMappingURL=github-provider.mjs.map