antarctic 0.2.0

package/dist/providers/tumblr.js

@@ -0,0 +1,63 @@
+import { OAuth2Client } from "../client.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://www.tumblr.com/oauth2/authorize";
+const tokenEndpoint = "https://api.tumblr.com/v2/oauth2/token";
+const userEndpoint = "https://api.tumblr.com/v2/user/info";
+const envPrefix = "TUMBLR";
+const defaultScopes = ["basic"];
+export class Tumblr {
+    client;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            this.client = new OAuth2Client(clientIdOrOptions, clientSecret ?? null, redirectURI ?? null);
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = this.client.createAuthorizationURL(authorizationEndpoint, state, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const tokens = await this.client.validateAuthorizationCode(tokenEndpoint, code, null);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const tokens = await this.client.refreshAccessToken(tokenEndpoint, refreshToken, []);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        let user = {};
+        if (typeof profile.response === "object" && profile.response !== null) {
+            const inner = profile.response.user;
+            if (typeof inner === "object" && inner !== null) {
+                user = inner;
+            }
+        }
+        // Tumblr only exposes the username: no stable numeric id, email, or avatar.
+        return {
+            id: profileId(user.name),
+            name: profileString(user.name),
+            email: null,
+            image: null
+        };
+    }
+}

package/dist/providers/twitch.d.ts

@@ -0,0 +1,17 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface TwitchOptions extends ProviderOptions {
+}
+export declare class Twitch {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: TwitchOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/twitch.js

@@ -0,0 +1,91 @@
+// Does not support HTTP Basic Auth scheme.
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://id.twitch.tv/oauth2/authorize";
+const tokenEndpoint = "https://id.twitch.tv/oauth2/token";
+const userEndpoint = "https://api.twitch.tv/helix/users";
+const envPrefix = "TWITCH";
+const defaultScopes = ["user:read:email"];
+export class Twitch {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", refreshToken);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    // No token revocation since the error responses are not spec-compliant
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        // Helix requires the Client-Id header alongside the user access token.
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken(), {
+            "Client-Id": this.clientId
+        });
+        const entries = profile.data;
+        if (!Array.isArray(entries) || typeof entries[0] !== "object" || entries[0] === null) {
+            throw new OAuthProviderError("Unexpected user profile response body");
+        }
+        const user = entries[0];
+        return {
+            id: profileId(user.id),
+            name: profileString(user.display_name) ?? profileString(user.login),
+            email: profileString(user.email),
+            image: profileString(user.profile_image_url)
+        };
+    }
+}

package/dist/providers/twitter.d.ts

@@ -0,0 +1,16 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface TwitterOptions extends ProviderOptions {
+}
+export declare class Twitter {
+    private client;
+    private auth;
+    constructor(options: TwitterOptions);
+    constructor(clientId: string, clientSecret: string | null, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    revokeToken(token: string): Promise<void>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/twitter.js

@@ -0,0 +1,67 @@
+import { OAuth2Client, CodeChallengeMethod } from "../client.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://twitter.com/i/oauth2/authorize";
+const tokenEndpoint = "https://api.twitter.com/2/oauth2/token";
+const tokenRevocationEndpoint = "https://api.twitter.com/2/oauth2/revoke";
+const userEndpoint = "https://api.twitter.com/2/users/me";
+const envPrefix = "TWITTER";
+const defaultScopes = ["users.read", "tweet.read"];
+export class Twitter {
+    client;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, { redirectURI: true });
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            this.client = new OAuth2Client(clientIdOrOptions, clientSecret ?? null, redirectURI ?? null);
+        }
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = this.client.createAuthorizationURLWithPKCE(authorizationEndpoint, state, CodeChallengeMethod.S256, codeVerifier, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const tokens = await this.client.validateAuthorizationCode(tokenEndpoint, code, codeVerifier);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const tokens = await this.client.refreshAccessToken(tokenEndpoint, refreshToken, []);
+        return tokens;
+    }
+    async revokeToken(token) {
+        await this.client.revokeToken(tokenRevocationEndpoint, token);
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        const url = new URL(userEndpoint);
+        url.searchParams.set("user.fields", "profile_image_url");
+        const profile = await fetchUserProfile(url, tokens.accessToken());
+        let user = {};
+        if (typeof profile.data === "object" && profile.data !== null) {
+            user = profile.data;
+        }
+        // The Twitter API does not expose an email address.
+        return {
+            id: profileId(user.id),
+            name: profileString(user.name) ?? profileString(user.username),
+            email: null,
+            image: profileString(user.profile_image_url)
+        };
+    }
+}

package/dist/providers/vk.d.ts

@@ -0,0 +1,16 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface VKOptions extends ProviderOptions {
+}
+export declare class VK {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: VKOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/vk.js

@@ -0,0 +1,82 @@
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://oauth.vk.com/authorize";
+const tokenEndpoint = "https://oauth.vk.com/access_token";
+const userEndpoint = "https://api.vk.com/method/users.get";
+const envPrefix = "VK";
+const defaultScopes = ["email"];
+export class VK {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const url = new URL(userEndpoint);
+        url.searchParams.set("v", "5.199");
+        url.searchParams.set("fields", "photo_200");
+        const profile = await fetchUserProfile(url, tokens.accessToken());
+        const entries = profile.response;
+        if (!Array.isArray(entries) || typeof entries[0] !== "object" || entries[0] === null) {
+            throw new OAuthProviderError("Unexpected user profile response body");
+        }
+        const user = entries[0];
+        const nameParts = [profileString(user.first_name), profileString(user.last_name)].filter((part) => part !== null);
+        // The email is only returned in the token response, not by the API.
+        const email = profileString(tokens.data.email);
+        return {
+            id: profileId(user.id),
+            name: nameParts.length > 0 ? nameParts.join(" ") : null,
+            email,
+            image: profileString(user.photo_200)
+        };
+    }
+}

package/dist/providers/withings.d.ts

@@ -0,0 +1,16 @@
+import { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface WithingsOptions extends ProviderOptions {
+}
+export declare class Withings {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: WithingsOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/withings.js

@@ -0,0 +1,120 @@
+import { ArcticFetchError, createOAuth2Request, createOAuth2RequestError, UnexpectedErrorResponseBodyError, UnexpectedResponseError } from "../request.js";
+import { OAuth2Tokens } from "../oauth2.js";
+import { consumeOAuthState, generateOAuthState, parseCallbackQuery, profileId, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://account.withings.com/oauth2_user/authorize2";
+const tokenEndpoint = "https://wbsapi.withings.net/v2/oauth2";
+const envPrefix = "WITHINGS";
+const defaultScopes = ["user.info"];
+export class Withings {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        // Withings deviates from the RFC and uses a comma-delimitated string instead of spaces.
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(","));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        // Withings requires an `action` parameter.
+        body.set("action", "requesttoken");
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        // Withings has no profile API; the token response only carries the user id.
+        const data = tokens.data;
+        return {
+            id: profileId(data.userid),
+            name: null,
+            email: null,
+            image: null
+        };
+    }
+}
+async function sendTokenRequest(request) {
+    let response;
+    try {
+        response = await fetch(request);
+    }
+    catch (e) {
+        throw new ArcticFetchError(e);
+    }
+    // Withings returns a 200 even for error responses.
+    if (response.status !== 200) {
+        if (response.body !== null) {
+            await response.body.cancel();
+        }
+        throw new UnexpectedResponseError(response.status);
+    }
+    let data;
+    try {
+        data = await response.json();
+    }
+    catch {
+        throw new UnexpectedResponseError(response.status);
+    }
+    if (typeof data !== "object" || data === null) {
+        throw new UnexpectedErrorResponseBodyError(response.status, data);
+    }
+    // Withings returns an `error` field but the value deviates from the RFC.
+    // Probably better to throw `UnexpectedErrorResponseBodyError`
+    // but we're keeping `OAuth2RequestError` for now to be consistent with the other providers.
+    if ("error" in data && typeof data.error === "string") {
+        let error;
+        try {
+            error = createOAuth2RequestError(data);
+        }
+        catch {
+            throw new UnexpectedErrorResponseBodyError(response.status, data);
+        }
+        throw error;
+    }
+    // Withings returns `{"status": 0, "body": {...}}`.
+    if (!("body" in data) || typeof data.body !== "object" || data.body === null) {
+        throw new Error("Missing or invalid 'body' field");
+    }
+    const tokens = new OAuth2Tokens(data.body);
+    return tokens;
+}

package/dist/providers/workos.d.ts

@@ -0,0 +1,16 @@
+import { type OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface WorkOSOptions extends ProviderOptions {
+}
+export declare class WorkOS {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: WorkOSOptions);
+    constructor(clientId: string, clientSecret: string | null, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string | null): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string | null): Promise<OAuth2Tokens>;
+    getAuthorizationURL(): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/workos.js

@@ -0,0 +1,82 @@
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, saveOAuthState } from "../auth.js";
+import { createS256CodeChallenge } from "../oauth2.js";
+const authorizationEndpoint = "https://api.workos.com/sso/authorize";
+const tokenEndpoint = "https://api.workos.com/sso/token";
+const profileEndpoint = "https://api.workos.com/sso/profile";
+const envPrefix = "WORKOS";
+export class WorkOS {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, { redirectURI: true });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret;
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? null;
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, codeVerifier) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        if (codeVerifier !== null) {
+            const codeChallenge = createS256CodeChallenge(codeVerifier);
+            url.searchParams.set("code_challenge_method", "S256");
+            url.searchParams.set("code_challenge", codeChallenge);
+        }
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        if (this.clientSecret !== null) {
+            body.set("client_secret", this.clientSecret);
+        }
+        if (codeVerifier !== null) {
+            body.set("code_verifier", codeVerifier);
+        }
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL() {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier);
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        const profile = await fetchUserProfile(profileEndpoint, tokens.accessToken());
+        const firstName = profileString(profile.first_name);
+        const lastName = profileString(profile.last_name);
+        const fullName = [firstName, lastName].filter((part) => part !== null).join(" ");
+        return {
+            id: profileId(profile.id),
+            name: profileString(profile.name) ?? (fullName !== "" ? fullName : null),
+            email: profileString(profile.email),
+            image: profileString(profile.profile_picture_url)
+        };
+    }
+}

package/dist/providers/yahoo.d.ts

@@ -0,0 +1,15 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface YahooOptions extends ProviderOptions {
+}
+export declare class Yahoo {
+    private client;
+    private auth;
+    constructor(options: YahooOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}