@xylex-group/athena 2.12.1 → 2.13.0

package/dist/social-providers.js

@@ -0,0 +1,4117 @@
+import * as z from 'zod';
+import { decodeJwt, decodeProtectedHeader, jwtVerify, createRemoteJWKSet, importJWK } from 'jose';
+
+// src/auth/social-providers/registry.ts
+
+// src/auth/env/logger.ts
+var levels = ["debug", "info", "success", "warn", "error"];
+function shouldPublishLog(current, level) {
+  return levels.indexOf(level) >= levels.indexOf(current);
+}
+function resolveLogLevel() {
+  try {
+    const env = typeof process !== "undefined" && process.env ? process.env.ATHENA_AUTH_LOG_LEVEL : void 0;
+    if (env === "debug" || env === "info" || env === "warn" || env === "error" || env === "success") {
+      return env;
+    }
+  } catch {
+  }
+  return "warn";
+}
+function log(level, message, ...args) {
+  const current = resolveLogLevel();
+  if (!shouldPublishLog(current, level === "info" ? "info" : level)) return;
+  const fn = level === "error" ? console.error : level === "warn" ? console.warn : console.log;
+  fn(`[athena-auth] ${message}`, ...args);
+}
+var logger = {
+  debug: (message, ...args) => log("debug", message, ...args),
+  info: (message, ...args) => log("info", message, ...args),
+  success: (message, ...args) => log("info", message, ...args),
+  warn: (message, ...args) => log("warn", message, ...args),
+  error: (message, ...args) => log("error", message, ...args)
+};
+
+// src/auth/error/athena-auth-error.ts
+var AthenaAuthError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "AthenaAuthError";
+    this.message = message;
+    this.stack = "";
+  }
+};
+
+// src/auth/error/api-error.ts
+var APIError = class _APIError extends Error {
+  status;
+  statusCode;
+  body;
+  headers;
+  constructor(status, body) {
+    const message = typeof body === "string" ? body : body?.message ?? (typeof status === "string" ? status : `HTTP ${status}`);
+    super(message);
+    this.name = "APIError";
+    this.status = status;
+    this.statusCode = typeof status === "number" ? status : 500;
+    this.body = typeof body === "string" ? { message: body } : body;
+    this.headers = void 0;
+  }
+  static fromStatus(status, body) {
+    return new _APIError(status, body);
+  }
+  static from(status, error) {
+    return new _APIError(status, {
+      message: error.message,
+      code: error.code
+    });
+  }
+};
+
+// src/auth/utils/base64.ts
+function toUint8Array(input) {
+  if (typeof input === "string") {
+    return new TextEncoder().encode(input);
+  }
+  if (input instanceof Uint8Array) {
+    return input;
+  }
+  return new Uint8Array(input);
+}
+function bytesToBase64(bytes, urlSafe, padding) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  let encoded = btoa(binary);
+  if (urlSafe) {
+    encoded = encoded.replace(/\+/g, "-").replace(/\//g, "_");
+  }
+  if (!padding) {
+    encoded = encoded.replace(/=+$/g, "");
+  }
+  return encoded;
+}
+var base64 = {
+  encode(input) {
+    return bytesToBase64(toUint8Array(input), false, true);
+  }
+};
+var base64Url = {
+  encode(input, options) {
+    return bytesToBase64(toUint8Array(input), true, options?.padding !== false);
+  }
+};
+
+// src/auth/fetch/body.ts
+function normalizeFetchBody(body) {
+  if (body == null) return body;
+  if (typeof body === "string") return body;
+  if (body instanceof URLSearchParams) return body;
+  if (body instanceof FormData) return body;
+  if (body instanceof Blob) return body;
+  if (typeof body === "object") {
+    return JSON.stringify(body);
+  }
+  return String(body);
+}
+function applyFetchQuery(url, query) {
+  if (!query) return url;
+  const u = new URL(url);
+  for (const [key, value] of Object.entries(query)) {
+    if (value === void 0 || value === null) continue;
+    u.searchParams.set(key, String(value));
+  }
+  return u.toString();
+}
+
+// src/auth/fetch/athena-fetch.ts
+async function athenaFetch(url, options = {}) {
+  const headers = new Headers(options.headers);
+  if (options.auth?.token) {
+    const type = options.auth.type ?? "Bearer";
+    headers.set("authorization", `${type} ${options.auth.token}`);
+  }
+  const target = applyFetchQuery(url, options.query);
+  const body = normalizeFetchBody(options.body);
+  if (body != null && typeof body === "string" && !headers.has("content-type") && body.startsWith("{")) {
+    headers.set("content-type", "application/json");
+  }
+  try {
+    const response = await fetch(target, {
+      method: options.method ?? "GET",
+      headers,
+      body: body ?? void 0,
+      redirect: options.redirect ?? "follow",
+      signal: options.signal
+    });
+    options.onResponse?.({ response });
+    if (!response.ok) {
+      let message = response.statusText || `HTTP ${response.status}`;
+      try {
+        const errBody = await response.clone().json();
+        message = errBody.message || errBody.error_description || errBody.error || message;
+      } catch {
+        try {
+          message = await response.clone().text() || message;
+        } catch {
+        }
+      }
+      const error = {
+        message,
+        status: response.status,
+        statusText: response.statusText
+      };
+      options.onError?.({ response, error });
+      return { data: null, error };
+    }
+    const contentType = response.headers.get("content-type") ?? "";
+    if (contentType.includes("application/json") || contentType.includes("+json")) {
+      const data = await response.json();
+      return { data, error: null };
+    }
+    const text = await response.text();
+    if (!text) {
+      return { data: {}, error: null };
+    }
+    try {
+      return { data: JSON.parse(text), error: null };
+    } catch {
+      return { data: text, error: null };
+    }
+  } catch (cause) {
+    const error = {
+      message: cause instanceof Error ? cause.message : String(cause),
+      status: 0,
+      statusText: "NetworkError"
+    };
+    options.onError?.({
+      response: new Response(null, { status: 502, statusText: "Network Error" }),
+      error: cause
+    });
+    return { data: null, error };
+  }
+}
+
+// src/auth/oauth2/reject-redirects.ts
+var HTTP_REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+function isRedirectResponse(response) {
+  return response.type === "opaqueredirect" || HTTP_REDIRECT_STATUSES.has(response.status);
+}
+function redirectRefused(endpoint) {
+  return new AthenaAuthError(
+    `The OAuth endpoint "${endpoint}" returned an HTTP redirect. Server-side OAuth fetches refuse redirects to prevent SSRF; configure the final endpoint URL.`
+  );
+}
+var NO_FOLLOW_REDIRECT = { redirect: "manual" };
+async function fetchRefusingRedirects(url, options) {
+  let redirected = false;
+  const result = await athenaFetch(url, {
+    ...options,
+    ...NO_FOLLOW_REDIRECT,
+    onError(context) {
+      if (isRedirectResponse(context.response)) redirected = true;
+    }
+  });
+  if (redirected) throw redirectRefused(url);
+  return result;
+}
+
+// src/auth/oauth2/token-utils.ts
+function getOAuth2Tokens(data) {
+  const getDate = (seconds) => {
+    const now = /* @__PURE__ */ new Date();
+    return new Date(now.getTime() + seconds * 1e3);
+  };
+  return {
+    tokenType: data.token_type,
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    accessTokenExpiresAt: data.expires_in ? getDate(data.expires_in) : void 0,
+    refreshTokenExpiresAt: data.refresh_token_expires_in ? getDate(data.refresh_token_expires_in) : void 0,
+    scopes: data?.scope ? typeof data.scope === "string" ? data.scope.split(" ") : data.scope : [],
+    idToken: data.id_token,
+    raw: data
+  };
+}
+
+// src/auth/oauth2/client-id.ts
+function getPrimaryClientId(clientId) {
+  const value = Array.isArray(clientId) ? clientId[0] : clientId;
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+
+// src/auth/oauth2/pkce.ts
+async function generateCodeChallenge(codeVerifier) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(codeVerifier);
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return base64Url.encode(new Uint8Array(hash), {
+    padding: false
+  });
+}
+
+// src/auth/oauth2/create-authorization-url.ts
+async function createAuthorizationURL({
+  id: _id,
+  options,
+  authorizationEndpoint: authorizationEndpoint2,
+  state,
+  codeVerifier,
+  scopes,
+  claims,
+  redirectURI,
+  duration,
+  prompt,
+  accessType,
+  responseType,
+  display,
+  loginHint,
+  hd,
+  responseMode,
+  additionalParams,
+  scopeJoiner
+}) {
+  options = typeof options === "function" ? await options() : options;
+  const url = new URL(options.authorizationEndpoint || authorizationEndpoint2);
+  url.searchParams.set("response_type", responseType || "code");
+  const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+  url.searchParams.set("client_id", primaryClientId);
+  url.searchParams.set("state", state);
+  if (scopes) {
+    url.searchParams.set("scope", scopes.join(scopeJoiner || " "));
+  }
+  url.searchParams.set("redirect_uri", options.redirectURI || redirectURI);
+  duration && url.searchParams.set("duration", duration);
+  display && url.searchParams.set("display", display);
+  loginHint && url.searchParams.set("login_hint", loginHint);
+  prompt && url.searchParams.set("prompt", prompt);
+  hd && url.searchParams.set("hd", hd);
+  accessType && url.searchParams.set("access_type", accessType);
+  responseMode && url.searchParams.set("response_mode", responseMode);
+  if (codeVerifier) {
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("code_challenge", codeChallenge);
+  }
+  if (claims) {
+    const claimsObj = claims.reduce(
+      (acc, claim) => {
+        acc[claim] = null;
+        return acc;
+      },
+      {}
+    );
+    url.searchParams.set(
+      "claims",
+      JSON.stringify({
+        id_token: { email: null, email_verified: null, ...claimsObj }
+      })
+    );
+  }
+  if (additionalParams) {
+    Object.entries(additionalParams).forEach(([key, value]) => {
+      url.searchParams.set(key, value);
+    });
+  }
+  return url;
+}
+
+// src/auth/oauth2/refresh-access-token.ts
+function createRefreshAccessTokenRequest({
+  refreshToken,
+  options,
+  authentication,
+  extraParams,
+  resource
+}) {
+  const body = new URLSearchParams();
+  const headers = {
+    "content-type": "application/x-www-form-urlencoded",
+    accept: "application/json"
+  };
+  body.set("grant_type", "refresh_token");
+  body.set("refresh_token", refreshToken);
+  if (authentication === "basic") {
+    const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+    if (primaryClientId) {
+      headers["authorization"] = "Basic " + base64.encode(`${primaryClientId}:${options.clientSecret ?? ""}`);
+    } else {
+      headers["authorization"] = "Basic " + base64.encode(`:${options.clientSecret ?? ""}`);
+    }
+  } else {
+    const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+    body.set("client_id", primaryClientId);
+    if (options.clientSecret) {
+      body.set("client_secret", options.clientSecret);
+    }
+  }
+  if (resource) {
+    if (typeof resource === "string") {
+      body.append("resource", resource);
+    } else {
+      for (const _resource of resource) {
+        body.append("resource", _resource);
+      }
+    }
+  }
+  if (extraParams) {
+    for (const [key, value] of Object.entries(extraParams)) {
+      body.set(key, value);
+    }
+  }
+  return {
+    body,
+    headers
+  };
+}
+async function refreshAccessToken({
+  refreshToken,
+  options,
+  tokenEndpoint: tokenEndpoint2,
+  authentication,
+  extraParams
+}) {
+  const { body, headers } = await createRefreshAccessTokenRequest({
+    refreshToken,
+    options,
+    authentication,
+    extraParams
+  });
+  const { data, error } = await fetchRefusingRedirects(tokenEndpoint2, {
+    method: "POST",
+    body,
+    headers
+  });
+  if (error) {
+    throw error;
+  }
+  const tokens = {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    tokenType: data.token_type,
+    scopes: data.scope?.split(" "),
+    idToken: data.id_token
+  };
+  if (data.expires_in) {
+    const now = /* @__PURE__ */ new Date();
+    tokens.accessTokenExpiresAt = new Date(
+      now.getTime() + data.expires_in * 1e3
+    );
+  }
+  if (data.refresh_token_expires_in) {
+    const now = /* @__PURE__ */ new Date();
+    tokens.refreshTokenExpiresAt = new Date(
+      now.getTime() + data.refresh_token_expires_in * 1e3
+    );
+  }
+  return tokens;
+}
+async function authorizationCodeRequest({
+  code,
+  codeVerifier,
+  redirectURI,
+  options,
+  authentication,
+  deviceId,
+  headers,
+  additionalParams = {},
+  resource
+}) {
+  options = typeof options === "function" ? await options() : options;
+  return createAuthorizationCodeRequest({
+    code,
+    codeVerifier,
+    redirectURI,
+    options,
+    authentication,
+    deviceId,
+    headers,
+    additionalParams,
+    resource
+  });
+}
+function createAuthorizationCodeRequest({
+  code,
+  codeVerifier,
+  redirectURI,
+  options,
+  authentication,
+  deviceId,
+  headers,
+  additionalParams = {},
+  resource
+}) {
+  const body = new URLSearchParams();
+  const requestHeaders = {
+    "content-type": "application/x-www-form-urlencoded",
+    accept: "application/json",
+    ...headers
+  };
+  body.set("grant_type", "authorization_code");
+  body.set("code", code);
+  codeVerifier && body.set("code_verifier", codeVerifier);
+  options.clientKey && body.set("client_key", options.clientKey);
+  deviceId && body.set("device_id", deviceId);
+  body.set("redirect_uri", options.redirectURI || redirectURI);
+  if (resource) {
+    if (typeof resource === "string") {
+      body.append("resource", resource);
+    } else {
+      for (const _resource of resource) {
+        body.append("resource", _resource);
+      }
+    }
+  }
+  if (authentication === "basic") {
+    const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+    const encodedCredentials = base64.encode(
+      `${primaryClientId}:${options.clientSecret ?? ""}`
+    );
+    requestHeaders["authorization"] = `Basic ${encodedCredentials}`;
+  } else {
+    const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+    body.set("client_id", primaryClientId);
+    if (options.clientSecret) {
+      body.set("client_secret", options.clientSecret);
+    }
+  }
+  for (const [key, value] of Object.entries(additionalParams)) {
+    if (!body.has(key)) body.append(key, value);
+  }
+  return {
+    body,
+    headers: requestHeaders
+  };
+}
+async function validateAuthorizationCode({
+  code,
+  codeVerifier,
+  redirectURI,
+  options,
+  tokenEndpoint: tokenEndpoint2,
+  authentication,
+  deviceId,
+  headers,
+  additionalParams = {},
+  resource
+}) {
+  const { body, headers: requestHeaders } = await authorizationCodeRequest({
+    code,
+    codeVerifier,
+    redirectURI,
+    options,
+    authentication,
+    deviceId,
+    headers,
+    additionalParams,
+    resource
+  });
+  const { data, error } = await fetchRefusingRedirects(tokenEndpoint2, {
+    method: "POST",
+    body,
+    headers: requestHeaders
+  });
+  if (error) {
+    throw error;
+  }
+  const tokens = getOAuth2Tokens(data);
+  return tokens;
+}
+
+// src/auth/social-providers/apple-crypto.ts
+async function sha256Hex(value) {
+  const data = new TextEncoder().encode(value);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function nonceMatches(jwtNonce, nonce) {
+  if (typeof jwtNonce !== "string") {
+    return false;
+  }
+  if (jwtNonce === nonce) {
+    return true;
+  }
+  return jwtNonce === await sha256Hex(nonce);
+}
+async function getJwksPublicKey(jwksUrl, kid) {
+  const { data } = await athenaFetch(jwksUrl);
+  if (!data?.keys) {
+    throw new APIError("BAD_REQUEST", {
+      message: "Keys not found"
+    });
+  }
+  const jwk = data.keys.find((key) => key.kid === kid);
+  if (!jwk) {
+    throw new Error(`JWK with kid ${kid} not found`);
+  }
+  return await importJWK(jwk, jwk.alg);
+}
+
+// src/auth/social-providers/apple-keys.ts
+var getApplePublicKey = async (kid) => {
+  return getJwksPublicKey("https://appleid.apple.com/auth/keys", kid);
+};
+
+// src/auth/social-providers/apple.ts
+var apple = (options) => {
+  const tokenEndpoint2 = "https://appleid.apple.com/auth/token";
+  return {
+    id: "apple",
+    name: "Apple",
+    async createAuthorizationURL({ state, scopes, redirectURI }) {
+      if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
+        logger.error(
+          "Client ID and client secret are required for Apple. Make sure to provide them in the options."
+        );
+        throw new AthenaAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+      }
+      const _scope = options.disableDefaultScope ? [] : ["email", "name"];
+      if (options.scope) _scope.push(...options.scope);
+      if (scopes) _scope.push(...scopes);
+      const url = await createAuthorizationURL({
+        id: "apple",
+        options,
+        authorizationEndpoint: "https://appleid.apple.com/auth/authorize",
+        scopes: _scope,
+        state,
+        redirectURI,
+        responseMode: "form_post",
+        responseType: "code id_token"
+      });
+      return url;
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async verifyIdToken(token, nonce) {
+      if (options.disableIdTokenSignIn) {
+        return false;
+      }
+      if (options.verifyIdToken) {
+        return options.verifyIdToken(token, nonce);
+      }
+      try {
+        const decodedHeader = decodeProtectedHeader(token);
+        const { kid, alg: jwtAlg } = decodedHeader;
+        if (!kid || !jwtAlg) return false;
+        const publicKey = await getApplePublicKey(kid);
+        const { payload: jwtClaims } = await jwtVerify(token, publicKey, {
+          algorithms: [jwtAlg],
+          issuer: "https://appleid.apple.com",
+          audience: options.audience && options.audience.length ? options.audience : options.appBundleIdentifier ? options.appBundleIdentifier : options.clientId,
+          maxTokenAge: "1h"
+        });
+        ["email_verified", "is_private_email"].forEach((field) => {
+          if (jwtClaims[field] !== void 0) {
+            jwtClaims[field] = Boolean(jwtClaims[field]);
+          }
+        });
+        if (nonce && !await nonceMatches(jwtClaims.nonce, nonce)) {
+          return false;
+        }
+        return !!jwtClaims;
+      } catch {
+        return false;
+      }
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      if (!token.idToken) {
+        return null;
+      }
+      const profile = decodeJwt(token.idToken);
+      if (!profile) {
+        return null;
+      }
+      let name;
+      if (token.user?.name) {
+        const firstName = token.user.name.firstName || "";
+        const lastName = token.user.name.lastName || "";
+        const fullName = `${firstName} ${lastName}`.trim();
+        name = fullName;
+      } else {
+        name = profile.name || "";
+      }
+      const emailVerified = typeof profile.email_verified === "boolean" ? profile.email_verified : profile.email_verified === "true";
+      const enrichedProfile = {
+        ...profile,
+        name
+      };
+      const userMap = await options.mapProfileToUser?.(enrichedProfile);
+      return {
+        user: {
+          id: profile.sub,
+          name: enrichedProfile.name,
+          emailVerified,
+          email: profile.email,
+          ...userMap
+        },
+        data: enrichedProfile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/atlassian.ts
+var atlassian = (options) => {
+  const tokenEndpoint2 = "https://auth.atlassian.com/oauth/token";
+  return {
+    id: "atlassian",
+    name: "Atlassian",
+    async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+      if (!options.clientId || !options.clientSecret) {
+        logger.error("Client Id and Secret are required for Atlassian");
+        throw new AthenaAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+      }
+      if (!codeVerifier) {
+        throw new AthenaAuthError("codeVerifier is required for Atlassian");
+      }
+      const _scopes = options.disableDefaultScope ? [] : ["read:jira-user", "offline_access"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "atlassian",
+        options,
+        authorizationEndpoint: "https://auth.atlassian.com/authorize",
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI,
+        additionalParams: {
+          audience: "api.atlassian.com"
+        },
+        prompt: options.prompt
+      });
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      if (!token.accessToken) {
+        return null;
+      }
+      try {
+        const { data: profile } = await athenaFetch("https://api.atlassian.com/me", {
+          headers: { Authorization: `Bearer ${token.accessToken}` }
+        });
+        if (!profile) return null;
+        const userMap = await options.mapProfileToUser?.(profile);
+        return {
+          user: {
+            id: profile.account_id,
+            name: profile.name,
+            email: profile.email,
+            image: profile.picture,
+            emailVerified: false,
+            ...userMap
+          },
+          data: profile
+        };
+      } catch (error) {
+        logger.error("Failed to fetch user info from Figma:", error);
+        return null;
+      }
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/helpers/trim-trailing-slash.ts
+function trimTrailingSlash(value) {
+  let result = value;
+  while (result.endsWith("/")) {
+    result = result.slice(0, -1);
+  }
+  return result;
+}
+
+// src/auth/social-providers/athena.ts
+function resolveIssuer(options) {
+  if (options.issuer) return trimTrailingSlash(options.issuer);
+  if (options.authorizationEndpoint) {
+    try {
+      const url = new URL(options.authorizationEndpoint);
+      return `${url.protocol}//${url.host}`;
+    } catch {
+    }
+  }
+  throw new Error(
+    "Athena social provider requires `issuer` (or a full `authorizationEndpoint`) in options."
+  );
+}
+var athena = (options) => {
+  const issuer = () => resolveIssuer(options);
+  const authorizationEndpoint2 = () => options.authorizationEndpoint || `${issuer()}/oauth2/authorize`;
+  const tokenEndpoint2 = () => options.tokenEndpoint || `${issuer()}/oauth2/token`;
+  const userInfoEndpoint = () => options.userInfoEndpoint || `${issuer()}/oauth2/userinfo`;
+  return {
+    id: "athena",
+    name: "Athena",
+    createAuthorizationURL({
+      state,
+      scopes,
+      codeVerifier,
+      redirectURI,
+      loginHint,
+      display
+    }) {
+      const _scopes = options.disableDefaultScope ? [] : ["openid", "profile", "email"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "athena",
+        options,
+        authorizationEndpoint: authorizationEndpoint2(),
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI,
+        loginHint,
+        display,
+        prompt: options.prompt
+      });
+    },
+    validateAuthorizationCode: async ({
+      code,
+      codeVerifier,
+      redirectURI
+    }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2()
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2()
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      if (!token.accessToken) {
+        return null;
+      }
+      const { data: profile, error } = await athenaFetch(
+        userInfoEndpoint(),
+        {
+          headers: {
+            Authorization: `Bearer ${token.accessToken}`,
+            "User-Agent": "athena-auth",
+            Accept: "application/json"
+          }
+        }
+      );
+      if (error || !profile) {
+        logger.error("Athena OAuth userinfo failed:", error);
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.sub,
+          name: profile.name,
+          email: profile.email,
+          image: profile.picture,
+          emailVerified: profile.email_verified ?? false,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/cognito-keys.ts
+var getCognitoPublicKey = async (kid, region, userPoolId) => {
+  const jwksUri = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`;
+  try {
+    return await getJwksPublicKey(jwksUri, kid);
+  } catch (error) {
+    logger.error("Failed to fetch Cognito public key:", error);
+    throw error;
+  }
+};
+
+// src/auth/social-providers/cognito.ts
+var cognito = (options) => {
+  if (!options.domain || !options.region || !options.userPoolId) {
+    logger.error(
+      "Domain, region and userPoolId are required for Amazon Cognito. Make sure to provide them in the options."
+    );
+    throw new AthenaAuthError("DOMAIN_AND_REGION_REQUIRED");
+  }
+  const cleanDomain = options.domain.replace(/^https?:\/\//, "");
+  const authorizationEndpoint2 = `https://${cleanDomain}/oauth2/authorize`;
+  const tokenEndpoint2 = `https://${cleanDomain}/oauth2/token`;
+  const userInfoEndpoint = `https://${cleanDomain}/oauth2/userinfo`;
+  return {
+    id: "cognito",
+    name: "Cognito",
+    async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+      if (!getPrimaryClientId(options.clientId)) {
+        logger.error(
+          "ClientId is required for Amazon Cognito. Make sure to provide them in the options."
+        );
+        throw new AthenaAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+      }
+      if (options.requireClientSecret && !options.clientSecret) {
+        logger.error(
+          "Client Secret is required when requireClientSecret is true. Make sure to provide it in the options."
+        );
+        throw new AthenaAuthError("CLIENT_SECRET_REQUIRED");
+      }
+      const _scopes = options.disableDefaultScope ? [] : ["openid", "profile", "email"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      const url = await createAuthorizationURL({
+        id: "cognito",
+        options: {
+          ...options
+        },
+        authorizationEndpoint: authorizationEndpoint2,
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI,
+        prompt: options.prompt
+      });
+      const scopeValue = url.searchParams.get("scope");
+      if (scopeValue) {
+        url.searchParams.delete("scope");
+        const encodedScope = encodeURIComponent(scopeValue);
+        const urlString = url.toString();
+        const separator = urlString.includes("?") ? "&" : "?";
+        return new URL(`${urlString}${separator}scope=${encodedScope}`);
+      }
+      return url;
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async verifyIdToken(token, nonce) {
+      if (options.disableIdTokenSignIn) {
+        return false;
+      }
+      if (options.verifyIdToken) {
+        return options.verifyIdToken(token, nonce);
+      }
+      try {
+        const decodedHeader = decodeProtectedHeader(token);
+        const { kid, alg: jwtAlg } = decodedHeader;
+        if (!kid || !jwtAlg) return false;
+        const publicKey = await getCognitoPublicKey(
+          kid,
+          options.region,
+          options.userPoolId
+        );
+        const expectedIssuer = `https://cognito-idp.${options.region}.amazonaws.com/${options.userPoolId}`;
+        const { payload: jwtClaims } = await jwtVerify(token, publicKey, {
+          algorithms: [jwtAlg],
+          issuer: expectedIssuer,
+          audience: options.clientId,
+          maxTokenAge: "1h"
+        });
+        if (nonce && jwtClaims.nonce !== nonce) {
+          return false;
+        }
+        return true;
+      } catch (error) {
+        logger.error("Failed to verify ID token:", error);
+        return false;
+      }
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      if (token.idToken) {
+        try {
+          const profile = decodeJwt(token.idToken);
+          if (!profile) {
+            return null;
+          }
+          const name = profile.name || profile.given_name || profile.username || "";
+          const enrichedProfile = {
+            ...profile,
+            name
+          };
+          const userMap = await options.mapProfileToUser?.(enrichedProfile);
+          return {
+            user: {
+              id: profile.sub,
+              name: enrichedProfile.name,
+              email: profile.email,
+              image: profile.picture,
+              emailVerified: profile.email_verified,
+              ...userMap
+            },
+            data: enrichedProfile
+          };
+        } catch (error) {
+          logger.error("Failed to decode ID token:", error);
+        }
+      }
+      if (token.accessToken) {
+        try {
+          const { data: userInfo } = await athenaFetch(
+            userInfoEndpoint,
+            {
+              headers: {
+                Authorization: `Bearer ${token.accessToken}`
+              }
+            }
+          );
+          if (userInfo) {
+            const userMap = await options.mapProfileToUser?.(userInfo);
+            return {
+              user: {
+                id: userInfo.sub,
+                name: userInfo.name || userInfo.given_name || userInfo.username || "",
+                email: userInfo.email,
+                image: userInfo.picture,
+                emailVerified: userInfo.email_verified,
+                ...userMap
+              },
+              data: userInfo
+            };
+          }
+        } catch (error) {
+          logger.error("Failed to fetch user info from Cognito:", error);
+        }
+      }
+      return null;
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/discord.ts
+var discord = (options) => {
+  const tokenEndpoint2 = "https://discord.com/api/oauth2/token";
+  return {
+    id: "discord",
+    name: "Discord",
+    createAuthorizationURL({ state, scopes, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["identify", "email"];
+      if (scopes) _scopes.push(...scopes);
+      if (options.scope) _scopes.push(...options.scope);
+      const hasBotScope = _scopes.includes("bot");
+      const permissionsParam = hasBotScope && options.permissions !== void 0 ? `&permissions=${options.permissions}` : "";
+      return new URL(
+        `https://discord.com/api/oauth2/authorize?scope=${_scopes.join(
+          "+"
+        )}&response_type=code&client_id=${options.clientId}&redirect_uri=${encodeURIComponent(
+          options.redirectURI || redirectURI
+        )}&state=${state}&prompt=${options.prompt || "none"}${permissionsParam}`
+      );
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://discord.com/api/users/@me",
+        {
+          headers: {
+            authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error) {
+        return null;
+      }
+      if (profile.avatar === null) {
+        const defaultAvatarNumber = profile.discriminator === "0" ? Number(BigInt(profile.id) >> BigInt(22)) % 6 : parseInt(profile.discriminator) % 5;
+        profile.image_url = `https://cdn.discordapp.com/embed/avatars/${defaultAvatarNumber}.png`;
+      } else {
+        const format = profile.avatar.startsWith("a_") ? "gif" : "png";
+        profile.image_url = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.id,
+          name: profile.global_name || profile.username || "",
+          email: profile.email,
+          emailVerified: profile.verified,
+          image: profile.image_url,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/dropbox.ts
+var dropbox = (options) => {
+  const tokenEndpoint2 = "https://api.dropboxapi.com/oauth2/token";
+  return {
+    id: "dropbox",
+    name: "Dropbox",
+    createAuthorizationURL: async ({
+      state,
+      scopes,
+      codeVerifier,
+      redirectURI
+    }) => {
+      const _scopes = options.disableDefaultScope ? [] : ["account_info.read"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      const additionalParams = {};
+      if (options.accessType) {
+        additionalParams.token_access_type = options.accessType;
+      }
+      return await createAuthorizationURL({
+        id: "dropbox",
+        options,
+        authorizationEndpoint: "https://www.dropbox.com/oauth2/authorize",
+        scopes: _scopes,
+        state,
+        redirectURI,
+        codeVerifier,
+        additionalParams
+      });
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return await validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://api.dropboxapi.com/2/users/get_current_account",
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.account_id,
+          name: profile.name?.display_name,
+          email: profile.email,
+          emailVerified: profile.email_verified || false,
+          image: profile.profile_photo_url,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/facebook-verify.ts
+async function verifyFacebookAccessToken(accessToken, options) {
+  const primaryClientId = getPrimaryClientId(options.clientId);
+  if (!primaryClientId || !options.clientSecret) {
+    return null;
+  }
+  const clientIds = Array.isArray(options.clientId) ? options.clientId : [options.clientId];
+  const appAccessToken = `${primaryClientId}|${options.clientSecret}`;
+  const { data, error } = await athenaFetch(
+    "https://graph.facebook.com/debug_token",
+    {
+      query: {
+        input_token: accessToken,
+        access_token: appAccessToken
+      }
+    }
+  );
+  if (error || !data?.data) {
+    return null;
+  }
+  const { is_valid, app_id, user_id } = data.data;
+  if (is_valid !== true || !app_id || !clientIds.includes(app_id) || !user_id) {
+    return null;
+  }
+  return user_id;
+}
+
+// src/auth/social-providers/facebook.ts
+var facebook = (options) => {
+  return {
+    id: "facebook",
+    name: "Facebook",
+    async createAuthorizationURL({ state, scopes, redirectURI, loginHint }) {
+      if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
+        logger.error(
+          "Client ID and client secret are required for Facebook. Make sure to provide them in the options."
+        );
+        throw new AthenaAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+      }
+      const _scopes = options.disableDefaultScope ? [] : ["email", "public_profile"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return await createAuthorizationURL({
+        id: "facebook",
+        options,
+        authorizationEndpoint: "https://www.facebook.com/v24.0/dialog/oauth",
+        scopes: _scopes,
+        state,
+        redirectURI,
+        loginHint,
+        additionalParams: options.configId ? {
+          config_id: options.configId
+        } : {}
+      });
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        redirectURI,
+        options,
+        tokenEndpoint: "https://graph.facebook.com/v24.0/oauth/access_token"
+      });
+    },
+    async verifyIdToken(token, nonce) {
+      if (options.disableIdTokenSignIn) {
+        return false;
+      }
+      if (options.verifyIdToken) {
+        return options.verifyIdToken(token, nonce);
+      }
+      if (token.split(".").length === 3) {
+        try {
+          const { payload: jwtClaims } = await jwtVerify(
+            token,
+            createRemoteJWKSet(
+              // https://developers.facebook.com/docs/facebook-login/limited-login/token/#jwks
+              new URL(
+                "https://limited.facebook.com/.well-known/oauth/openid/jwks/"
+              )
+            ),
+            {
+              algorithms: ["RS256"],
+              audience: options.clientId,
+              issuer: "https://www.facebook.com"
+            }
+          );
+          if (nonce && jwtClaims.nonce !== nonce) {
+            return false;
+          }
+          return !!jwtClaims;
+        } catch {
+          return false;
+        }
+      }
+      return await verifyFacebookAccessToken(token, options) !== null;
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: "https://graph.facebook.com/v24.0/oauth/access_token"
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      if (token.idToken && token.idToken.split(".").length === 3) {
+        const profile2 = decodeJwt(token.idToken);
+        const user = {
+          id: profile2.sub,
+          name: profile2.name,
+          email: profile2.email,
+          picture: {
+            data: {
+              url: profile2.picture,
+              height: 100,
+              width: 100,
+              is_silhouette: false
+            }
+          }
+        };
+        const userMap2 = await options.mapProfileToUser?.({
+          ...user,
+          email_verified: false
+        });
+        return {
+          user: {
+            ...user,
+            emailVerified: false,
+            ...userMap2
+          },
+          data: profile2
+        };
+      }
+      const accessToken = token.accessToken;
+      if (!accessToken) {
+        return null;
+      }
+      const tokenUserId = await verifyFacebookAccessToken(accessToken, options);
+      if (!tokenUserId) {
+        return null;
+      }
+      const fields = [
+        "id",
+        "name",
+        "email",
+        "picture",
+        ...options?.fields || []
+      ];
+      const { data: profile, error } = await athenaFetch(
+        "https://graph.facebook.com/me?fields=" + fields.join(","),
+        {
+          auth: {
+            type: "Bearer",
+            token: accessToken
+          }
+        }
+      );
+      if (error) {
+        return null;
+      }
+      if (profile.id !== tokenUserId) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.id,
+          name: profile.name,
+          email: profile.email,
+          image: profile.picture.data.url,
+          emailVerified: profile.email_verified ?? false,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/figma.ts
+var figma = (options) => {
+  const tokenEndpoint2 = "https://api.figma.com/v1/oauth/token";
+  return {
+    id: "figma",
+    name: "Figma",
+    async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+      if (!options.clientId || !options.clientSecret) {
+        logger.error(
+          "Client Id and Client Secret are required for Figma. Make sure to provide them in the options."
+        );
+        throw new AthenaAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+      }
+      if (!codeVerifier) {
+        throw new AthenaAuthError("codeVerifier is required for Figma");
+      }
+      const _scopes = options.disableDefaultScope ? [] : ["current_user:read"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      const url = await createAuthorizationURL({
+        id: "figma",
+        options,
+        authorizationEndpoint: "https://www.figma.com/oauth",
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI
+      });
+      return url;
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2,
+        authentication: "basic"
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2,
+        authentication: "basic"
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      try {
+        const { data: profile } = await athenaFetch(
+          "https://api.figma.com/v1/me",
+          {
+            headers: {
+              Authorization: `Bearer ${token.accessToken}`
+            }
+          }
+        );
+        if (!profile) {
+          logger.error("Failed to fetch user from Figma");
+          return null;
+        }
+        const userMap = await options.mapProfileToUser?.(profile);
+        return {
+          user: {
+            id: profile.id,
+            name: profile.handle,
+            email: profile.email,
+            image: profile.img_url,
+            emailVerified: false,
+            ...userMap
+          },
+          data: profile
+        };
+      } catch (error) {
+        logger.error("Failed to fetch user info from Figma:", error);
+        return null;
+      }
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/github.ts
+var github = (options) => {
+  const tokenEndpoint2 = "https://github.com/login/oauth/access_token";
+  return {
+    id: "github",
+    name: "GitHub",
+    createAuthorizationURL({
+      state,
+      scopes,
+      loginHint,
+      codeVerifier,
+      redirectURI
+    }) {
+      const _scopes = options.disableDefaultScope ? [] : ["read:user", "user:email"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "github",
+        options,
+        authorizationEndpoint: "https://github.com/login/oauth/authorize",
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI,
+        loginHint,
+        prompt: options.prompt
+      });
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      const { body, headers: requestHeaders } = createAuthorizationCodeRequest({
+        code,
+        codeVerifier,
+        redirectURI,
+        options
+      });
+      const { data, error } = await athenaFetch(tokenEndpoint2, {
+        method: "POST",
+        body,
+        headers: requestHeaders
+      });
+      if (error) {
+        logger.error("GitHub OAuth token exchange failed:", error);
+        return null;
+      }
+      if ("error" in data) {
+        logger.error("GitHub OAuth token exchange failed:", data);
+        return null;
+      }
+      return getOAuth2Tokens(data);
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://api.github.com/user",
+        {
+          headers: {
+            "User-Agent": "athena-auth",
+            authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error) {
+        return null;
+      }
+      const { data: emails } = await athenaFetch("https://api.github.com/user/emails", {
+        headers: {
+          Authorization: `Bearer ${token.accessToken}`,
+          "User-Agent": "athena-auth"
+        }
+      });
+      if (!profile.email && emails) {
+        profile.email = (emails.find((e) => e.primary) ?? emails[0])?.email;
+      }
+      const emailVerified = emails?.find((e) => e.email === profile.email)?.verified ?? false;
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.id,
+          name: profile.name || profile.login || "",
+          email: profile.email,
+          image: profile.avatar_url,
+          emailVerified,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/gitlab.ts
+var cleanDoubleSlashes = (input = "") => {
+  return input.split("://").map((str) => str.replace(/\/{2,}/g, "/")).join("://");
+};
+var issuerToEndpoints = (issuer) => {
+  const baseUrl = issuer || "https://gitlab.com";
+  return {
+    authorizationEndpoint: cleanDoubleSlashes(`${baseUrl}/oauth/authorize`),
+    tokenEndpoint: cleanDoubleSlashes(`${baseUrl}/oauth/token`),
+    userinfoEndpoint: cleanDoubleSlashes(`${baseUrl}/api/v4/user`)
+  };
+};
+var gitlab = (options) => {
+  const { authorizationEndpoint: authorizationEndpoint2, tokenEndpoint: tokenEndpoint2, userinfoEndpoint: userinfoEndpoint2 } = issuerToEndpoints(options.issuer);
+  const issuerId = "gitlab";
+  const issuerName = "Gitlab";
+  return {
+    id: issuerId,
+    name: issuerName,
+    createAuthorizationURL: async ({
+      state,
+      scopes,
+      codeVerifier,
+      loginHint,
+      redirectURI
+    }) => {
+      const _scopes = options.disableDefaultScope ? [] : ["read_user"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return await createAuthorizationURL({
+        id: issuerId,
+        options,
+        authorizationEndpoint: authorizationEndpoint2,
+        scopes: _scopes,
+        state,
+        redirectURI,
+        codeVerifier,
+        loginHint
+      });
+    },
+    validateAuthorizationCode: async ({ code, redirectURI, codeVerifier }) => {
+      return validateAuthorizationCode({
+        code,
+        redirectURI,
+        options,
+        codeVerifier,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        userinfoEndpoint2,
+        { headers: { authorization: `Bearer ${token.accessToken}` } }
+      );
+      if (error || profile.state !== "active" || profile.locked) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.id,
+          name: profile.name ?? profile.username ?? "",
+          email: profile.email,
+          image: profile.avatar_url,
+          emailVerified: profile.email_verified ?? false,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/google-types.ts
+var GOOGLE_ID_TOKEN_MAX_AGE = "1h";
+
+// src/auth/social-providers/google-keys.ts
+var getGooglePublicKey = async (kid) => {
+  return getJwksPublicKey("https://www.googleapis.com/oauth2/v3/certs", kid);
+};
+
+// src/auth/social-providers/google-verify.ts
+var verifyGoogleIdToken = async ({
+  token,
+  audience,
+  nonce
+}) => {
+  try {
+    const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
+    if (!kid || !jwtAlg) return null;
+    const publicKey = await getGooglePublicKey(kid);
+    const { payload: jwtClaims } = await jwtVerify(token, publicKey, {
+      algorithms: [jwtAlg],
+      issuer: ["https://accounts.google.com", "accounts.google.com"],
+      audience,
+      maxTokenAge: GOOGLE_ID_TOKEN_MAX_AGE
+    });
+    if (nonce && jwtClaims.nonce !== nonce) {
+      return null;
+    }
+    return jwtClaims;
+  } catch {
+    return null;
+  }
+};
+var isGoogleHostedDomainAllowed = (configuredHostedDomain, tokenHostedDomain) => {
+  if (!configuredHostedDomain) return true;
+  if (typeof tokenHostedDomain !== "string" || !tokenHostedDomain) {
+    return false;
+  }
+  if (configuredHostedDomain === "*") return true;
+  return tokenHostedDomain === configuredHostedDomain;
+};
+
+// src/auth/social-providers/helpers/merge-scopes.ts
+function mergeScopes(defaults, optionScopes, requestScopes, disableDefaultScope) {
+  const scopes = disableDefaultScope ? [] : [...defaults];
+  if (optionScopes) scopes.push(...optionScopes);
+  if (requestScopes) scopes.push(...requestScopes);
+  return [...new Set(scopes)];
+}
+
+// src/auth/social-providers/google.ts
+var google = (options) => {
+  return {
+    id: "google",
+    name: "Google",
+    async createAuthorizationURL({
+      state,
+      scopes,
+      codeVerifier,
+      redirectURI,
+      loginHint,
+      display
+    }) {
+      if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
+        logger.error(
+          "Client Id and Client Secret is required for Google. Make sure to provide them in the options."
+        );
+        throw new AthenaAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+      }
+      if (!codeVerifier) {
+        throw new AthenaAuthError("codeVerifier is required for Google");
+      }
+      const _scopes = mergeScopes(
+        ["email", "profile", "openid"],
+        options.scope,
+        scopes,
+        options.disableDefaultScope
+      );
+      const url = await createAuthorizationURL({
+        id: "google",
+        options,
+        authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI,
+        prompt: options.prompt,
+        accessType: options.accessType,
+        display: display || options.display,
+        loginHint,
+        hd: options.hd,
+        additionalParams: {
+          include_granted_scopes: "true"
+        }
+      });
+      return url;
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: "https://oauth2.googleapis.com/token"
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: "https://oauth2.googleapis.com/token"
+      });
+    },
+    async verifyIdToken(token, nonce) {
+      if (options.disableIdTokenSignIn) {
+        return false;
+      }
+      if (options.verifyIdToken) {
+        return options.verifyIdToken(token, nonce);
+      }
+      const jwtClaims = await verifyGoogleIdToken({
+        token,
+        audience: options.clientId,
+        nonce
+      });
+      if (!jwtClaims) {
+        return false;
+      }
+      return isGoogleHostedDomainAllowed(options.hd, jwtClaims.hd);
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      if (!token.idToken) {
+        return null;
+      }
+      const user = decodeJwt(token.idToken);
+      if (!isGoogleHostedDomainAllowed(options.hd, user.hd)) {
+        logger.error(
+          `Google sign-in rejected: id token hosted domain (hd) "${user.hd ?? "<missing>"}" does not satisfy the configured "hd" option "${options.hd}".`
+        );
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(user);
+      return {
+        user: {
+          id: user.sub,
+          name: user.name,
+          email: user.email,
+          image: user.picture,
+          emailVerified: user.email_verified,
+          ...userMap
+        },
+        data: user
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/huggingface.ts
+var huggingface = (options) => {
+  const tokenEndpoint2 = "https://huggingface.co/oauth/token";
+  return {
+    id: "huggingface",
+    name: "Hugging Face",
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["openid", "profile", "email"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "huggingface",
+        options,
+        authorizationEndpoint: "https://huggingface.co/oauth/authorize",
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI
+      });
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://huggingface.co/oauth/userinfo",
+        {
+          method: "GET",
+          headers: {
+            Authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.sub,
+          name: profile.name || profile.preferred_username || "",
+          email: profile.email,
+          image: profile.picture,
+          emailVerified: profile.email_verified ?? false,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/kakao.ts
+var kakao = (options) => {
+  const tokenEndpoint2 = "https://kauth.kakao.com/oauth/token";
+  return {
+    id: "kakao",
+    name: "Kakao",
+    createAuthorizationURL({ state, scopes, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["account_email", "profile_image", "profile_nickname"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "kakao",
+        options,
+        authorizationEndpoint: "https://kauth.kakao.com/oauth/authorize",
+        scopes: _scopes,
+        state,
+        redirectURI
+      });
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://kapi.kakao.com/v2/user/me",
+        {
+          headers: {
+            Authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error || !profile) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      const account = profile.kakao_account || {};
+      const kakaoProfile = account.profile || {};
+      const user = {
+        id: String(profile.id),
+        name: kakaoProfile.nickname || account.name || "",
+        email: account.email,
+        image: kakaoProfile.profile_image_url || kakaoProfile.thumbnail_image_url,
+        emailVerified: !!account.is_email_valid && !!account.is_email_verified,
+        ...userMap
+      };
+      return {
+        user,
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/kick.ts
+var kick = (options) => {
+  return {
+    id: "kick",
+    name: "Kick",
+    createAuthorizationURL({ state, scopes, redirectURI, codeVerifier }) {
+      const _scopes = options.disableDefaultScope ? [] : ["user:read"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "kick",
+        redirectURI,
+        options,
+        authorizationEndpoint: "https://id.kick.com/oauth/authorize",
+        scopes: _scopes,
+        codeVerifier,
+        state
+      });
+    },
+    async validateAuthorizationCode({ code, redirectURI, codeVerifier }) {
+      return validateAuthorizationCode({
+        code,
+        redirectURI,
+        options,
+        tokenEndpoint: "https://id.kick.com/oauth/token",
+        codeVerifier
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: "https://id.kick.com/oauth/token"
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data, error } = await athenaFetch("https://api.kick.com/public/v1/users", {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${token.accessToken}`
+        }
+      });
+      if (error) {
+        return null;
+      }
+      const profile = data.data[0];
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.user_id,
+          name: profile.name,
+          email: profile.email,
+          image: profile.profile_picture,
+          emailVerified: false,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+var line = (options) => {
+  const authorizationEndpoint2 = "https://access.line.me/oauth2/v2.1/authorize";
+  const tokenEndpoint2 = "https://api.line.me/oauth2/v2.1/token";
+  const userInfoEndpoint = "https://api.line.me/oauth2/v2.1/userinfo";
+  const verifyIdTokenEndpoint = "https://api.line.me/oauth2/v2.1/verify";
+  return {
+    id: "line",
+    name: "LINE",
+    async createAuthorizationURL({
+      state,
+      scopes,
+      codeVerifier,
+      redirectURI,
+      loginHint
+    }) {
+      const _scopes = options.disableDefaultScope ? [] : ["openid", "profile", "email"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return await createAuthorizationURL({
+        id: "line",
+        options,
+        authorizationEndpoint: authorizationEndpoint2,
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI,
+        loginHint
+      });
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async verifyIdToken(token, nonce) {
+      if (options.disableIdTokenSignIn) {
+        return false;
+      }
+      if (options.verifyIdToken) {
+        return options.verifyIdToken(token, nonce);
+      }
+      const body = new URLSearchParams();
+      body.set("id_token", token);
+      body.set("client_id", options.clientId);
+      if (nonce) body.set("nonce", nonce);
+      const { data, error } = await athenaFetch(
+        verifyIdTokenEndpoint,
+        {
+          method: "POST",
+          headers: {
+            "content-type": "application/x-www-form-urlencoded"
+          },
+          body
+        }
+      );
+      if (error || !data) {
+        return false;
+      }
+      if (data.aud !== options.clientId) return false;
+      if (data.nonce && data.nonce !== nonce) return false;
+      return true;
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      let profile = null;
+      if (token.idToken) {
+        try {
+          profile = decodeJwt(token.idToken);
+        } catch {
+        }
+      }
+      if (!profile) {
+        const { data } = await athenaFetch(userInfoEndpoint, {
+          headers: {
+            authorization: `Bearer ${token.accessToken}`
+          }
+        });
+        profile = data || null;
+      }
+      if (!profile) return null;
+      const userMap = await options.mapProfileToUser?.(profile);
+      const id = profile.sub || profile.userId;
+      const name = profile.name || profile.displayName || "";
+      const image = profile.picture || profile.pictureUrl || void 0;
+      const email = profile.email;
+      return {
+        user: {
+          id,
+          name,
+          email,
+          image,
+          // LINE does not expose email verification status in ID token/userinfo
+          emailVerified: false,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/linear.ts
+var linear = (options) => {
+  const tokenEndpoint2 = "https://api.linear.app/oauth/token";
+  return {
+    id: "linear",
+    name: "Linear",
+    createAuthorizationURL({ state, scopes, loginHint, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["read"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "linear",
+        options,
+        authorizationEndpoint: "https://linear.app/oauth/authorize",
+        scopes: _scopes,
+        state,
+        redirectURI,
+        loginHint
+      });
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://api.linear.app/graphql",
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${token.accessToken}`
+          },
+          body: JSON.stringify({
+            query: `
+							query {
+								viewer {
+									id
+									name
+									email
+									avatarUrl
+									active
+									createdAt
+									updatedAt
+								}
+							}
+						`
+          })
+        }
+      );
+      if (error || !profile?.data?.viewer) {
+        return null;
+      }
+      const userData = profile.data.viewer;
+      const userMap = await options.mapProfileToUser?.(userData);
+      return {
+        user: {
+          id: profile.data.viewer.id,
+          name: profile.data.viewer.name,
+          email: profile.data.viewer.email,
+          image: profile.data.viewer.avatarUrl,
+          emailVerified: false,
+          ...userMap
+        },
+        data: userData
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/linkedin.ts
+var linkedin = (options) => {
+  const authorizationEndpoint2 = "https://www.linkedin.com/oauth/v2/authorization";
+  const tokenEndpoint2 = "https://www.linkedin.com/oauth/v2/accessToken";
+  return {
+    id: "linkedin",
+    name: "Linkedin",
+    createAuthorizationURL: async ({
+      state,
+      scopes,
+      redirectURI,
+      loginHint
+    }) => {
+      const _scopes = options.disableDefaultScope ? [] : ["profile", "email", "openid"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return await createAuthorizationURL({
+        id: "linkedin",
+        options,
+        authorizationEndpoint: authorizationEndpoint2,
+        scopes: _scopes,
+        state,
+        loginHint,
+        redirectURI
+      });
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      return await validateAuthorizationCode({
+        code,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://api.linkedin.com/v2/userinfo",
+        {
+          method: "GET",
+          headers: {
+            Authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.sub,
+          name: profile.name,
+          email: profile.email,
+          emailVerified: profile.email_verified ?? false,
+          image: profile.picture,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/microsoft-keys.ts
+var getMicrosoftPublicKey = async (kid, tenant, authority) => {
+  return getJwksPublicKey(
+    `${authority}/${tenant}/discovery/v2.0/keys`,
+    kid
+  );
+};
+
+// src/auth/social-providers/microsoft-types.ts
+var MICROSOFT_CONSUMER_TENANT_ID = "9188040d-6c67-4c5b-b112-36a304b66dad";
+
+// src/auth/social-providers/microsoft-entra-id.ts
+var microsoft = (options) => {
+  const tenant = options.tenantId || "common";
+  const authority = trimTrailingSlash(
+    options.authority || "https://login.microsoftonline.com"
+  );
+  const authorizationEndpoint2 = `${authority}/${tenant}/oauth2/v2.0/authorize`;
+  const tokenEndpoint2 = `${authority}/${tenant}/oauth2/v2.0/token`;
+  return {
+    id: "microsoft",
+    name: "Microsoft EntraID",
+    createAuthorizationURL(data) {
+      if (!getPrimaryClientId(options.clientId)) {
+        logger.error(
+          "Client Id is required for Microsoft Entra ID. Make sure to provide it in the options."
+        );
+        throw new AthenaAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+      }
+      const scopes = options.disableDefaultScope ? [] : ["openid", "profile", "email", "User.Read", "offline_access"];
+      if (options.scope) scopes.push(...options.scope);
+      if (data.scopes) scopes.push(...data.scopes);
+      return createAuthorizationURL({
+        id: "microsoft",
+        options,
+        authorizationEndpoint: authorizationEndpoint2,
+        state: data.state,
+        codeVerifier: data.codeVerifier,
+        scopes,
+        redirectURI: data.redirectURI,
+        prompt: options.prompt,
+        loginHint: data.loginHint
+      });
+    },
+    validateAuthorizationCode({ code, codeVerifier, redirectURI }) {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async verifyIdToken(token, nonce) {
+      if (options.disableIdTokenSignIn) {
+        return false;
+      }
+      if (options.verifyIdToken) {
+        return options.verifyIdToken(token, nonce);
+      }
+      try {
+        const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
+        if (!kid || !jwtAlg) return false;
+        const publicKey = await getMicrosoftPublicKey(kid, tenant, authority);
+        const verifyOptions = {
+          algorithms: [jwtAlg],
+          audience: options.clientId,
+          maxTokenAge: "1h"
+        };
+        if (tenant !== "common" && tenant !== "organizations" && tenant !== "consumers") {
+          verifyOptions.issuer = `${authority}/${tenant}/v2.0`;
+        }
+        const { payload: jwtClaims } = await jwtVerify(
+          token,
+          publicKey,
+          verifyOptions
+        );
+        if (nonce && jwtClaims.nonce !== nonce) {
+          return false;
+        }
+        const tid = jwtClaims.tid;
+        if (typeof tid !== "string" || jwtClaims.iss !== `${authority}/${tid}/v2.0`) {
+          return false;
+        }
+        if (tenant === "organizations" && tid === MICROSOFT_CONSUMER_TENANT_ID) {
+          return false;
+        }
+        if (tenant === "consumers" && tid !== MICROSOFT_CONSUMER_TENANT_ID) {
+          return false;
+        }
+        return true;
+      } catch (error) {
+        logger.error("Failed to verify ID token:", error);
+        return false;
+      }
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      if (!token.idToken) {
+        return null;
+      }
+      const user = decodeJwt(token.idToken);
+      const profilePhotoSize = options.profilePhotoSize || 48;
+      await athenaFetch(
+        `https://graph.microsoft.com/v1.0/me/photos/${profilePhotoSize}x${profilePhotoSize}/$value`,
+        {
+          headers: {
+            Authorization: `Bearer ${token.accessToken}`
+          },
+          async onResponse(context) {
+            if (options.disableProfilePhoto || !context.response.ok) {
+              return;
+            }
+            try {
+              const response = context.response.clone();
+              const pictureBuffer = await response.arrayBuffer();
+              const pictureBase64 = base64.encode(pictureBuffer);
+              user.picture = `data:image/jpeg;base64, ${pictureBase64}`;
+            } catch (e) {
+              logger.error(
+                e && typeof e === "object" && "name" in e ? e.name : "",
+                e
+              );
+            }
+          }
+        }
+      );
+      const userMap = await options.mapProfileToUser?.(user);
+      const emailVerified = user.email_verified !== void 0 ? user.email_verified : user.email && (user.verified_primary_email?.includes(user.email) || user.verified_secondary_email?.includes(user.email)) ? true : false;
+      return {
+        user: {
+          id: user.sub,
+          name: user.name,
+          email: user.email,
+          image: user.picture,
+          emailVerified,
+          ...userMap
+        },
+        data: user
+      };
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      const scopes = options.disableDefaultScope ? [] : ["openid", "profile", "email", "User.Read", "offline_access"];
+      if (options.scope) scopes.push(...options.scope);
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientSecret: options.clientSecret
+        },
+        extraParams: {
+          scope: scopes.join(" ")
+          // Include the scopes in request to microsoft
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/naver.ts
+var naver = (options) => {
+  const tokenEndpoint2 = "https://nid.naver.com/oauth2.0/token";
+  return {
+    id: "naver",
+    name: "Naver",
+    createAuthorizationURL({ state, scopes, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["profile", "email"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "naver",
+        options,
+        authorizationEndpoint: "https://nid.naver.com/oauth2.0/authorize",
+        scopes: _scopes,
+        state,
+        redirectURI
+      });
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://openapi.naver.com/v1/nid/me",
+        {
+          headers: {
+            Authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error || !profile || profile.resultcode !== "00") {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      const res = profile.response || {};
+      const user = {
+        id: res.id,
+        name: res.name || res.nickname || "",
+        email: res.email,
+        image: res.profile_image,
+        emailVerified: false,
+        ...userMap
+      };
+      return {
+        user,
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/notion.ts
+var notion = (options) => {
+  const tokenEndpoint2 = "https://api.notion.com/v1/oauth/token";
+  return {
+    id: "notion",
+    name: "Notion",
+    createAuthorizationURL({ state, scopes, loginHint, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : [];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "notion",
+        options,
+        authorizationEndpoint: "https://api.notion.com/v1/oauth/authorize",
+        scopes: _scopes,
+        state,
+        redirectURI,
+        loginHint,
+        additionalParams: {
+          owner: "user"
+        }
+      });
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2,
+        authentication: "basic"
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch("https://api.notion.com/v1/users/me", {
+        headers: {
+          Authorization: `Bearer ${token.accessToken}`,
+          "Notion-Version": "2022-06-28"
+        }
+      });
+      if (error || !profile) {
+        return null;
+      }
+      const userProfile = profile.bot?.owner?.user;
+      if (!userProfile) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(userProfile);
+      return {
+        user: {
+          id: userProfile.id,
+          name: userProfile.name || "",
+          email: userProfile.person?.email || null,
+          image: userProfile.avatar_url,
+          emailVerified: false,
+          ...userMap
+        },
+        data: userProfile
+      };
+    },
+    options
+  };
+};
+var paybin = (options) => {
+  const issuer = options.issuer || "https://idp.paybin.io";
+  const authorizationEndpoint2 = `${issuer}/oauth2/authorize`;
+  const tokenEndpoint2 = `${issuer}/oauth2/token`;
+  return {
+    id: "paybin",
+    name: "Paybin",
+    async createAuthorizationURL({
+      state,
+      scopes,
+      codeVerifier,
+      redirectURI,
+      loginHint
+    }) {
+      if (!options.clientId || !options.clientSecret) {
+        logger.error(
+          "Client Id and Client Secret is required for Paybin. Make sure to provide them in the options."
+        );
+        throw new AthenaAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+      }
+      if (!codeVerifier) {
+        throw new AthenaAuthError("codeVerifier is required for Paybin");
+      }
+      const _scopes = options.disableDefaultScope ? [] : ["openid", "email", "profile"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      const url = await createAuthorizationURL({
+        id: "paybin",
+        options,
+        authorizationEndpoint: authorizationEndpoint2,
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI,
+        prompt: options.prompt,
+        loginHint
+      });
+      return url;
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      if (!token.idToken) {
+        return null;
+      }
+      const user = decodeJwt(token.idToken);
+      const userMap = await options.mapProfileToUser?.(user);
+      return {
+        user: {
+          id: user.sub,
+          name: user.name || user.preferred_username || "",
+          email: user.email,
+          image: user.picture,
+          emailVerified: user.email_verified || false,
+          ...userMap
+        },
+        data: user
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/paypal-keys.ts
+var getPayPalPublicKey = async (kid, jwksUri) => {
+  return getJwksPublicKey(jwksUri, kid);
+};
+
+// src/auth/social-providers/paypal.ts
+var PAYPAL_ID_TOKEN_ALGORITHMS = ["RS256", "HS256"];
+var paypal = (options) => {
+  const environment = options.environment || "sandbox";
+  const isSandbox = environment === "sandbox";
+  const authorizationEndpoint2 = isSandbox ? "https://www.sandbox.paypal.com/signin/authorize" : "https://www.paypal.com/signin/authorize";
+  const tokenEndpoint2 = isSandbox ? "https://api-m.sandbox.paypal.com/v1/oauth2/token" : "https://api-m.paypal.com/v1/oauth2/token";
+  const userInfoEndpoint = isSandbox ? "https://api-m.sandbox.paypal.com/v1/identity/oauth2/userinfo" : "https://api-m.paypal.com/v1/identity/oauth2/userinfo";
+  const issuer = isSandbox ? "https://www.sandbox.paypal.com" : "https://www.paypal.com";
+  const jwksEndpoint = isSandbox ? "https://api.sandbox.paypal.com/v1/oauth2/certs" : "https://api.paypal.com/v1/oauth2/certs";
+  return {
+    id: "paypal",
+    name: "PayPal",
+    async createAuthorizationURL({ state, codeVerifier, redirectURI }) {
+      if (!options.clientId || !options.clientSecret) {
+        logger.error(
+          "Client Id and Client Secret is required for PayPal. Make sure to provide them in the options."
+        );
+        throw new AthenaAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+      }
+      const _scopes = [];
+      const url = await createAuthorizationURL({
+        id: "paypal",
+        options,
+        authorizationEndpoint: authorizationEndpoint2,
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI,
+        prompt: options.prompt
+      });
+      return url;
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      const credentials = base64.encode(
+        `${options.clientId}:${options.clientSecret}`
+      );
+      try {
+        const response = await athenaFetch(tokenEndpoint2, {
+          method: "POST",
+          headers: {
+            Authorization: `Basic ${credentials}`,
+            Accept: "application/json",
+            "Accept-Language": "en_US",
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          body: new URLSearchParams({
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: redirectURI
+          }).toString()
+        });
+        if (!response.data) {
+          throw new AthenaAuthError("FAILED_TO_GET_ACCESS_TOKEN");
+        }
+        const data = response.data;
+        const result = {
+          accessToken: data.access_token,
+          refreshToken: data.refresh_token,
+          accessTokenExpiresAt: data.expires_in ? new Date(Date.now() + data.expires_in * 1e3) : void 0,
+          idToken: data.id_token
+        };
+        return result;
+      } catch (error) {
+        logger.error("PayPal token exchange failed:", error);
+        throw new AthenaAuthError("FAILED_TO_GET_ACCESS_TOKEN");
+      }
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      const credentials = base64.encode(
+        `${options.clientId}:${options.clientSecret}`
+      );
+      try {
+        const response = await athenaFetch(tokenEndpoint2, {
+          method: "POST",
+          headers: {
+            Authorization: `Basic ${credentials}`,
+            Accept: "application/json",
+            "Accept-Language": "en_US",
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken
+          }).toString()
+        });
+        if (!response.data) {
+          throw new AthenaAuthError("FAILED_TO_REFRESH_ACCESS_TOKEN");
+        }
+        const data = response.data;
+        return {
+          accessToken: data.access_token,
+          refreshToken: data.refresh_token,
+          accessTokenExpiresAt: data.expires_in ? new Date(Date.now() + data.expires_in * 1e3) : void 0
+        };
+      } catch (error) {
+        logger.error("PayPal token refresh failed:", error);
+        throw new AthenaAuthError("FAILED_TO_REFRESH_ACCESS_TOKEN");
+      }
+    },
+    async verifyIdToken(token, nonce) {
+      if (options.disableIdTokenSignIn) {
+        return false;
+      }
+      if (options.verifyIdToken) {
+        return options.verifyIdToken(token, nonce);
+      }
+      try {
+        const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
+        if (!jwtAlg) return false;
+        if (!PAYPAL_ID_TOKEN_ALGORITHMS.includes(
+          jwtAlg
+        )) {
+          return false;
+        }
+        const key = jwtAlg === "HS256" ? new TextEncoder().encode(options.clientSecret) : kid ? await getPayPalPublicKey(kid, jwksEndpoint) : void 0;
+        if (!key) return false;
+        const { payload: jwtClaims } = await jwtVerify(token, key, {
+          algorithms: [jwtAlg],
+          issuer,
+          audience: options.clientId,
+          maxTokenAge: "1h"
+        });
+        if (nonce && jwtClaims.nonce !== nonce) {
+          return false;
+        }
+        return true;
+      } catch (error) {
+        logger.error("Failed to verify PayPal ID token:", error);
+        return false;
+      }
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      if (!token.accessToken) {
+        logger.error("Access token is required to fetch PayPal user info");
+        return null;
+      }
+      try {
+        const response = await athenaFetch(
+          `${userInfoEndpoint}?schema=paypalv1.1`,
+          {
+            headers: {
+              Authorization: `Bearer ${token.accessToken}`,
+              Accept: "application/json"
+            }
+          }
+        );
+        if (!response.data) {
+          logger.error("Failed to fetch user info from PayPal");
+          return null;
+        }
+        const userInfo = response.data;
+        if (token.idToken) {
+          let idTokenSubject;
+          try {
+            idTokenSubject = decodeJwt(token.idToken).sub;
+          } catch (error) {
+            logger.error("Failed to decode PayPal ID token:", error);
+            return null;
+          }
+          const userInfoSubject = userInfo.sub ?? userInfo.user_id;
+          if (!idTokenSubject || userInfoSubject !== idTokenSubject) {
+            logger.error(
+              "PayPal user info subject does not match ID token subject"
+            );
+            return null;
+          }
+        }
+        const userMap = await options.mapProfileToUser?.(userInfo);
+        const result = {
+          user: {
+            id: userInfo.user_id,
+            name: userInfo.name,
+            email: userInfo.email,
+            image: userInfo.picture,
+            emailVerified: userInfo.email_verified,
+            ...userMap
+          },
+          data: userInfo
+        };
+        return result;
+      } catch (error) {
+        logger.error("Failed to fetch user info from PayPal:", error);
+        return null;
+      }
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/polar.ts
+var polar = (options) => {
+  const tokenEndpoint2 = "https://api.polar.sh/v1/oauth2/token";
+  return {
+    id: "polar",
+    name: "Polar",
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["openid", "profile", "email"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "polar",
+        options,
+        authorizationEndpoint: "https://polar.sh/oauth2/authorize",
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI,
+        prompt: options.prompt
+      });
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://api.polar.sh/v1/oauth2/userinfo",
+        {
+          headers: {
+            Authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.id,
+          name: profile.public_name || profile.username || "",
+          email: profile.email,
+          image: profile.avatar_url,
+          emailVerified: profile.email_verified ?? false,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/railway.ts
+var authorizationEndpoint = "https://backboard.railway.com/oauth/auth";
+var tokenEndpoint = "https://backboard.railway.com/oauth/token";
+var userinfoEndpoint = "https://backboard.railway.com/oauth/me";
+var railway = (options) => {
+  return {
+    id: "railway",
+    name: "Railway",
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["openid", "email", "profile"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "railway",
+        options,
+        authorizationEndpoint,
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI
+      });
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint,
+        authentication: "basic"
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint,
+        authentication: "basic"
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        userinfoEndpoint,
+        { headers: { authorization: `Bearer ${token.accessToken}` } }
+      );
+      if (error || !profile) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.sub,
+          name: profile.name,
+          email: profile.email,
+          image: profile.picture,
+          emailVerified: false,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/reddit.ts
+var reddit = (options) => {
+  return {
+    id: "reddit",
+    name: "Reddit",
+    createAuthorizationURL({ state, scopes, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["identity"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "reddit",
+        options,
+        authorizationEndpoint: "https://www.reddit.com/api/v1/authorize",
+        scopes: _scopes,
+        state,
+        redirectURI,
+        duration: options.duration
+      });
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: options.redirectURI || redirectURI
+      });
+      const headers = {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "text/plain",
+        "User-Agent": "athena-auth",
+        Authorization: `Basic ${base64.encode(
+          `${options.clientId}:${options.clientSecret}`
+        )}`
+      };
+      const { data, error } = await athenaFetch(
+        "https://www.reddit.com/api/v1/access_token",
+        {
+          method: "POST",
+          headers,
+          body: body.toString()
+        }
+      );
+      if (error) {
+        throw error;
+      }
+      return getOAuth2Tokens(data);
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        authentication: "basic",
+        tokenEndpoint: "https://www.reddit.com/api/v1/access_token"
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://oauth.reddit.com/api/v1/me",
+        {
+          headers: {
+            Authorization: `Bearer ${token.accessToken}`,
+            "User-Agent": "athena-auth"
+          }
+        }
+      );
+      if (error) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      const email = userMap?.email || `${profile.id}@reddit.invalid`;
+      return {
+        user: {
+          id: profile.id,
+          name: profile.name,
+          image: profile.icon_img?.split("?")[0],
+          ...userMap,
+          email,
+          emailVerified: userMap?.emailVerified ?? false
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/roblox.ts
+var roblox = (options) => {
+  const tokenEndpoint2 = "https://apis.roblox.com/oauth/v1/token";
+  return {
+    id: "roblox",
+    name: "Roblox",
+    createAuthorizationURL({ state, scopes, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["openid", "profile"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return new URL(
+        `https://apis.roblox.com/oauth/v1/authorize?scope=${_scopes.join(
+          "+"
+        )}&response_type=code&client_id=${options.clientId}&redirect_uri=${encodeURIComponent(
+          options.redirectURI || redirectURI
+        )}&state=${state}&prompt=${options.prompt || "select_account consent"}`
+      );
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        redirectURI: options.redirectURI || redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2,
+        authentication: "post"
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://apis.roblox.com/oauth/v1/userinfo",
+        {
+          headers: {
+            authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.sub,
+          name: profile.nickname || profile.preferred_username || "",
+          image: profile.picture,
+          email: profile.preferred_username || null,
+          // Roblox does not provide email
+          emailVerified: false,
+          ...userMap
+        },
+        data: {
+          ...profile
+        }
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/salesforce.ts
+var salesforce = (options) => {
+  const environment = options.environment ?? "production";
+  const isSandbox = environment === "sandbox";
+  const authorizationEndpoint2 = options.loginUrl ? `https://${options.loginUrl}/services/oauth2/authorize` : isSandbox ? "https://test.salesforce.com/services/oauth2/authorize" : "https://login.salesforce.com/services/oauth2/authorize";
+  const tokenEndpoint2 = options.loginUrl ? `https://${options.loginUrl}/services/oauth2/token` : isSandbox ? "https://test.salesforce.com/services/oauth2/token" : "https://login.salesforce.com/services/oauth2/token";
+  const userInfoEndpoint = options.loginUrl ? `https://${options.loginUrl}/services/oauth2/userinfo` : isSandbox ? "https://test.salesforce.com/services/oauth2/userinfo" : "https://login.salesforce.com/services/oauth2/userinfo";
+  return {
+    id: "salesforce",
+    name: "Salesforce",
+    async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+      if (!options.clientId || !options.clientSecret) {
+        logger.error(
+          "Client Id and Client Secret are required for Salesforce. Make sure to provide them in the options."
+        );
+        throw new AthenaAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+      }
+      if (!codeVerifier) {
+        throw new AthenaAuthError("codeVerifier is required for Salesforce");
+      }
+      const _scopes = options.disableDefaultScope ? [] : ["openid", "email", "profile"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "salesforce",
+        options,
+        authorizationEndpoint: authorizationEndpoint2,
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI: options.redirectURI || redirectURI
+      });
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI: options.redirectURI || redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      try {
+        const { data: user } = await athenaFetch(
+          userInfoEndpoint,
+          {
+            headers: {
+              Authorization: `Bearer ${token.accessToken}`
+            }
+          }
+        );
+        if (!user) {
+          logger.error("Failed to fetch user info from Salesforce");
+          return null;
+        }
+        const userMap = await options.mapProfileToUser?.(user);
+        return {
+          user: {
+            id: user.user_id,
+            name: user.name,
+            email: user.email,
+            image: user.photos?.picture || user.photos?.thumbnail,
+            emailVerified: user.email_verified ?? false,
+            ...userMap
+          },
+          data: user
+        };
+      } catch (error) {
+        logger.error("Failed to fetch user info from Salesforce:", error);
+        return null;
+      }
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/slack.ts
+var slack = (options) => {
+  const tokenEndpoint2 = "https://slack.com/api/openid.connect.token";
+  return {
+    id: "slack",
+    name: "Slack",
+    createAuthorizationURL({ state, scopes, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["openid", "profile", "email"];
+      if (scopes) _scopes.push(...scopes);
+      if (options.scope) _scopes.push(...options.scope);
+      const url = new URL("https://slack.com/openid/connect/authorize");
+      url.searchParams.set("scope", _scopes.join(" "));
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("client_id", options.clientId);
+      url.searchParams.set("redirect_uri", options.redirectURI || redirectURI);
+      url.searchParams.set("state", state);
+      return url;
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://slack.com/api/openid.connect.userInfo",
+        {
+          headers: {
+            authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile["https://slack.com/user_id"],
+          name: profile.name || "",
+          email: profile.email,
+          emailVerified: profile.email_verified,
+          image: profile.picture || profile["https://slack.com/user_image_512"],
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/spotify.ts
+var spotify = (options) => {
+  const tokenEndpoint2 = "https://accounts.spotify.com/api/token";
+  return {
+    id: "spotify",
+    name: "Spotify",
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["user-read-email"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "spotify",
+        options,
+        authorizationEndpoint: "https://accounts.spotify.com/authorize",
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI
+      });
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://api.spotify.com/v1/me",
+        {
+          method: "GET",
+          headers: {
+            Authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.id,
+          name: profile.display_name,
+          email: profile.email,
+          image: profile.images[0]?.url,
+          emailVerified: false,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/tiktok.ts
+var tiktok = (options) => {
+  const tokenEndpoint2 = "https://open.tiktokapis.com/v2/oauth/token/";
+  return {
+    id: "tiktok",
+    name: "TikTok",
+    createAuthorizationURL({ state, scopes, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["user.info.profile"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return new URL(
+        `https://www.tiktok.com/v2/auth/authorize?scope=${_scopes.join(
+          ","
+        )}&response_type=code&client_key=${options.clientKey}&redirect_uri=${encodeURIComponent(
+          options.redirectURI || redirectURI
+        )}&state=${state}`
+      );
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        redirectURI: options.redirectURI || redirectURI,
+        options: {
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2,
+        authentication: "post",
+        extraParams: {
+          client_key: options.clientKey
+        }
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const fields = [
+        "open_id",
+        "avatar_large_url",
+        "display_name",
+        "username"
+      ];
+      const { data: profile, error } = await athenaFetch(
+        `https://open.tiktokapis.com/v2/user/info/?fields=${fields.join(",")}`,
+        {
+          headers: {
+            authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error) {
+        return null;
+      }
+      return {
+        user: {
+          email: profile.data.user.email || profile.data.user.username,
+          id: profile.data.user.open_id,
+          name: profile.data.user.display_name || profile.data.user.username || "",
+          image: profile.data.user.avatar_large_url,
+          emailVerified: false
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+var twitch = (options) => {
+  const tokenEndpoint2 = "https://id.twitch.tv/oauth2/token";
+  return {
+    id: "twitch",
+    name: "Twitch",
+    createAuthorizationURL({ state, scopes, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["user:read:email", "openid"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "twitch",
+        redirectURI,
+        options,
+        authorizationEndpoint: "https://id.twitch.tv/oauth2/authorize",
+        scopes: _scopes,
+        state,
+        claims: options.claims || [
+          "email",
+          "email_verified",
+          "preferred_username",
+          "picture"
+        ]
+      });
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const idToken = token.idToken;
+      if (!idToken) {
+        logger.error("No idToken found in token");
+        return null;
+      }
+      const profile = decodeJwt(idToken);
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.sub,
+          name: profile.preferred_username,
+          email: profile.email,
+          image: profile.picture,
+          emailVerified: profile.email_verified,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/twitter.ts
+var twitter = (options) => {
+  const tokenEndpoint2 = "https://api.x.com/2/oauth2/token";
+  return {
+    id: "twitter",
+    name: "Twitter",
+    createAuthorizationURL(data) {
+      const _scopes = options.disableDefaultScope ? [] : ["users.read", "tweet.read", "offline.access", "users.email"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (data.scopes) _scopes.push(...data.scopes);
+      return createAuthorizationURL({
+        id: "twitter",
+        options,
+        authorizationEndpoint: "https://x.com/i/oauth2/authorize",
+        scopes: _scopes,
+        state: data.state,
+        codeVerifier: data.codeVerifier,
+        redirectURI: data.redirectURI
+      });
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        authentication: "basic",
+        redirectURI,
+        options,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        authentication: "basic",
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error: profileError } = await athenaFetch(
+        "https://api.x.com/2/users/me?user.fields=profile_image_url",
+        {
+          method: "GET",
+          headers: {
+            Authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (profileError) {
+        return null;
+      }
+      const { data: emailData, error: emailError } = await athenaFetch("https://api.x.com/2/users/me?user.fields=confirmed_email", {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${token.accessToken}`
+        }
+      });
+      let emailVerified = false;
+      if (!emailError && emailData?.data?.confirmed_email) {
+        profile.data.email = emailData.data.confirmed_email;
+        emailVerified = true;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.data.id,
+          name: profile.data.name,
+          email: profile.data.email || profile.data.username || null,
+          image: profile.data.profile_image_url,
+          emailVerified,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/vercel.ts
+var vercel = (options) => {
+  return {
+    id: "vercel",
+    name: "Vercel",
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+      if (!codeVerifier) {
+        throw new AthenaAuthError("codeVerifier is required for Vercel");
+      }
+      let _scopes = void 0;
+      if (options.scope !== void 0 || scopes !== void 0) {
+        _scopes = [];
+        if (options.scope) _scopes.push(...options.scope);
+        if (scopes) _scopes.push(...scopes);
+      }
+      return createAuthorizationURL({
+        id: "vercel",
+        options,
+        authorizationEndpoint: "https://vercel.com/oauth/authorize",
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI
+      });
+    },
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI,
+        options,
+        tokenEndpoint: "https://api.vercel.com/login/oauth/token"
+      });
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://api.vercel.com/login/oauth/userinfo",
+        {
+          headers: {
+            Authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error || !profile) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.sub,
+          name: profile.name ?? profile.preferred_username ?? "",
+          email: profile.email,
+          image: profile.picture,
+          emailVerified: profile.email_verified ?? false,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/vk.ts
+var vk = (options) => {
+  const tokenEndpoint2 = "https://id.vk.com/oauth2/auth";
+  return {
+    id: "vk",
+    name: "VK",
+    async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["email", "phone"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      const authorizationEndpoint2 = "https://id.vk.com/authorize";
+      return createAuthorizationURL({
+        id: "vk",
+        options,
+        authorizationEndpoint: authorizationEndpoint2,
+        scopes: _scopes,
+        state,
+        redirectURI,
+        codeVerifier
+      });
+    },
+    validateAuthorizationCode: async ({
+      code,
+      codeVerifier,
+      redirectURI,
+      deviceId
+    }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI: options.redirectURI || redirectURI,
+        options,
+        deviceId,
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      return refreshAccessToken({
+        refreshToken,
+        options: {
+          clientId: options.clientId,
+          clientKey: options.clientKey,
+          clientSecret: options.clientSecret
+        },
+        tokenEndpoint: tokenEndpoint2
+      });
+    },
+    async getUserInfo(data) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(data);
+      }
+      if (!data.accessToken) {
+        return null;
+      }
+      const formBody = new URLSearchParams({
+        access_token: data.accessToken,
+        client_id: options.clientId
+      }).toString();
+      const { data: profile, error } = await athenaFetch(
+        "https://id.vk.com/oauth2/user_info",
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          body: formBody
+        }
+      );
+      if (error) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      if (!profile.user.email && !userMap?.email) {
+        return null;
+      }
+      return {
+        user: {
+          id: profile.user.user_id,
+          first_name: profile.user.first_name,
+          last_name: profile.user.last_name,
+          email: profile.user.email,
+          image: profile.user.avatar,
+          emailVerified: false,
+          birthday: profile.user.birthday,
+          sex: profile.user.sex,
+          name: `${profile.user.first_name} ${profile.user.last_name}`,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/wechat.ts
+var wechat = (options) => {
+  return {
+    id: "wechat",
+    name: "WeChat",
+    createAuthorizationURL({ state, scopes, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["snsapi_login"];
+      options.scope && _scopes.push(...options.scope);
+      scopes && _scopes.push(...scopes);
+      const url = new URL("https://open.weixin.qq.com/connect/qrconnect");
+      url.searchParams.set("scope", _scopes.join(","));
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("appid", options.clientId);
+      url.searchParams.set("redirect_uri", options.redirectURI || redirectURI);
+      url.searchParams.set("state", state);
+      url.searchParams.set("lang", options.lang || "cn");
+      url.hash = "wechat_redirect";
+      return url;
+    },
+    // WeChat uses non-standard token exchange (appid/secret instead of
+    // client_id/client_secret, GET instead of POST), so shared helpers
+    // like validateAuthorizationCode/getOAuth2Tokens cannot be used directly.
+    validateAuthorizationCode: async ({ code }) => {
+      const params = new URLSearchParams({
+        appid: options.clientId,
+        secret: options.clientSecret,
+        code,
+        grant_type: "authorization_code"
+      });
+      const { data: tokenData, error } = await athenaFetch(
+        "https://api.weixin.qq.com/sns/oauth2/access_token?" + params.toString(),
+        {
+          method: "GET"
+        }
+      );
+      if (error || !tokenData || tokenData.errcode) {
+        throw new Error(
+          `Failed to validate authorization code: ${tokenData?.errmsg || error?.message || "Unknown error"}`
+        );
+      }
+      return {
+        tokenType: "Bearer",
+        accessToken: tokenData.access_token,
+        refreshToken: tokenData.refresh_token,
+        accessTokenExpiresAt: new Date(
+          Date.now() + tokenData.expires_in * 1e3
+        ),
+        scopes: tokenData.scope.split(","),
+        // WeChat requires openid for the userinfo endpoint, which is
+        // returned alongside the access token.
+        openid: tokenData.openid,
+        unionid: tokenData.unionid
+      };
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+      const params = new URLSearchParams({
+        appid: options.clientId,
+        grant_type: "refresh_token",
+        refresh_token: refreshToken
+      });
+      const { data: tokenData, error } = await athenaFetch(
+        "https://api.weixin.qq.com/sns/oauth2/refresh_token?" + params.toString(),
+        {
+          method: "GET"
+        }
+      );
+      if (error || !tokenData || tokenData.errcode) {
+        throw new Error(
+          `Failed to refresh access token: ${tokenData?.errmsg || error?.message || "Unknown error"}`
+        );
+      }
+      return {
+        tokenType: "Bearer",
+        accessToken: tokenData.access_token,
+        refreshToken: tokenData.refresh_token,
+        accessTokenExpiresAt: new Date(
+          Date.now() + tokenData.expires_in * 1e3
+        ),
+        scopes: tokenData.scope.split(",")
+      };
+    },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const openid = token.openid;
+      if (!openid) {
+        return null;
+      }
+      const params = new URLSearchParams({
+        access_token: token.accessToken || "",
+        openid,
+        lang: "zh_CN"
+      });
+      const { data: profile, error } = await athenaFetch("https://api.weixin.qq.com/sns/userinfo?" + params.toString(), {
+        method: "GET"
+      });
+      if (error || !profile || profile.errcode) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.unionid || profile.openid || openid,
+          name: profile.nickname,
+          // WeChat does not return an email, and the OAuth callback rejects a
+          // missing one, so the default sign-in would always fail. Synthesize a
+          // stable, non-routable placeholder (RFC 2606 `.invalid`) keyed to the
+          // user's WeChat id, left unverified. Applications that collect a real
+          // email override it via `mapProfileToUser`.
+          email: profile.email || `${profile.unionid || profile.openid || openid}@wechat.invalid`,
+          image: profile.headimgurl,
+          emailVerified: false,
+          ...userMap
+        },
+        data: profile
+      };
+    },
+    options
+  };
+};
+
+// src/auth/social-providers/zoom.ts
+var zoom = (userOptions) => {
+  const options = {
+    pkce: true,
+    ...userOptions
+  };
+  return {
+    id: "zoom",
+    name: "Zoom",
+    createAuthorizationURL: async ({ state, redirectURI, codeVerifier }) => {
+      const params = new URLSearchParams({
+        response_type: "code",
+        redirect_uri: options.redirectURI ? options.redirectURI : redirectURI,
+        client_id: options.clientId,
+        state
+      });
+      if (options.pkce) {
+        const codeChallenge = await generateCodeChallenge(codeVerifier);
+        params.set("code_challenge_method", "S256");
+        params.set("code_challenge", codeChallenge);
+      }
+      const url = new URL("https://zoom.us/oauth/authorize");
+      url.search = params.toString();
+      return url;
+    },
+    validateAuthorizationCode: async ({ code, redirectURI, codeVerifier }) => {
+      return validateAuthorizationCode({
+        code,
+        redirectURI: options.redirectURI || redirectURI,
+        codeVerifier,
+        options,
+        tokenEndpoint: "https://zoom.us/oauth/token",
+        authentication: "post"
+      });
+    },
+    refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => refreshAccessToken({
+      refreshToken,
+      options: {
+        clientId: options.clientId,
+        clientKey: options.clientKey,
+        clientSecret: options.clientSecret
+      },
+      tokenEndpoint: "https://zoom.us/oauth/token"
+    }),
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+      const { data: profile, error } = await athenaFetch(
+        "https://api.zoom.us/v2/users/me",
+        {
+          headers: {
+            authorization: `Bearer ${token.accessToken}`
+          }
+        }
+      );
+      if (error) {
+        return null;
+      }
+      const userMap = await options.mapProfileToUser?.(profile);
+      return {
+        user: {
+          id: profile.id,
+          name: profile.display_name,
+          image: profile.pic_url,
+          email: profile.email,
+          emailVerified: Boolean(profile.verified),
+          ...userMap
+        },
+        data: {
+          ...profile
+        }
+      };
+    }
+  };
+};
+
+// src/auth/social-providers/registry.ts
+var socialProviders = {
+  apple,
+  atlassian,
+  athena,
+  cognito,
+  discord,
+  facebook,
+  figma,
+  github,
+  microsoft,
+  google,
+  huggingface,
+  slack,
+  spotify,
+  twitch,
+  twitter,
+  dropbox,
+  kick,
+  linear,
+  linkedin,
+  gitlab,
+  tiktok,
+  reddit,
+  roblox,
+  salesforce,
+  vk,
+  zoom,
+  notion,
+  kakao,
+  naver,
+  line,
+  paybin,
+  paypal,
+  polar,
+  railway,
+  vercel,
+  wechat
+};
+var socialProviderList = Object.keys(socialProviders);
+var SocialProviderListEnum = z.enum(socialProviderList).or(z.string());
+
+export { MICROSOFT_CONSUMER_TENANT_ID, SocialProviderListEnum, apple, athena, atlassian, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getJwksPublicKey, getMicrosoftPublicKey, getPayPalPublicKey, github, gitlab, google, huggingface, isGoogleHostedDomainAllowed, kakao, kick, line, linear, linkedin, mergeScopes, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, trimTrailingSlash, twitch, twitter, vercel, verifyFacebookAccessToken, verifyGoogleIdToken, vk, wechat, zoom };
+//# sourceMappingURL=social-providers.js.map
+//# sourceMappingURL=social-providers.js.map