antarctic 0.2.0

package/dist/providers/epicgames.js

@@ -0,0 +1,60 @@
+import { OAuth2Client } from "../client.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://www.epicgames.com/id/authorize";
+const tokenEndpoint = "https://api.epicgames.dev/epic/oauth/v2/token";
+const tokenRevocationEndpoint = "https://api.epicgames.dev/epic/oauth/v2/revoke";
+const userinfoEndpoint = "https://api.epicgames.dev/epic/oauth/v2/userInfo";
+const envPrefix = "EPIC_GAMES";
+const defaultScopes = ["basic_profile"];
+export class EpicGames {
+    client;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            this.client = new OAuth2Client(clientIdOrOptions, clientSecret ?? null, redirectURI ?? null);
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = this.client.createAuthorizationURL(authorizationEndpoint, state, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const tokens = await this.client.validateAuthorizationCode(tokenEndpoint, code, null);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const tokens = await this.client.refreshAccessToken(tokenEndpoint, refreshToken, []);
+        return tokens;
+    }
+    async revokeToken(token) {
+        await this.client.revokeToken(tokenRevocationEndpoint, token);
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const claims = await fetchUserProfile(userinfoEndpoint, tokens.accessToken());
+        return {
+            id: profileId(claims.sub),
+            name: profileString(claims.preferred_username),
+            // Epic Games does not expose user emails or avatars.
+            email: null,
+            image: null
+        };
+    }
+}

package/dist/providers/etsy.d.ts

@@ -0,0 +1,15 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface EtsyOptions extends ProviderOptions {
+}
+export declare class Etsy {
+    private client;
+    private auth;
+    constructor(options: EtsyOptions);
+    constructor(clientId: string, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/etsy.js

@@ -0,0 +1,68 @@
+import { CodeChallengeMethod, OAuth2Client } from "../client.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://www.etsy.com/oauth/connect";
+const tokenEndpoint = "https://api.etsy.com/v3/public/oauth/token";
+const meEndpoint = "https://openapi.etsy.com/v3/application/users/me";
+const userEndpoint = "https://openapi.etsy.com/v3/application/users";
+const envPrefix = "ETSY";
+const defaultScopes = ["email_r"];
+export class Etsy {
+    client;
+    auth = null;
+    constructor(clientIdOrOptions, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, { redirectURI: true });
+            this.client = new OAuth2Client(this.auth.clientId, null, this.auth.redirectURI);
+        }
+        else {
+            this.client = new OAuth2Client(clientIdOrOptions, null, redirectURI ?? null);
+        }
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = this.client.createAuthorizationURLWithPKCE(authorizationEndpoint, state, CodeChallengeMethod.S256, codeVerifier, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const tokens = await this.client.validateAuthorizationCode(tokenEndpoint, code, codeVerifier);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const tokens = await this.client.refreshAccessToken(tokenEndpoint, refreshToken, []);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        const accessToken = tokens.accessToken();
+        // Etsy requires the app keystring as an API key header on every request.
+        const headers = { "x-api-key": auth.clientId };
+        const me = await fetchUserProfile(meEndpoint, accessToken, headers);
+        const userId = profileId(me.user_id);
+        const profile = await fetchUserProfile(`${userEndpoint}/${userId}`, accessToken, headers);
+        const firstName = profileString(profile.first_name);
+        const lastName = profileString(profile.last_name);
+        let name = null;
+        if (firstName !== null || lastName !== null) {
+            name = [firstName, lastName].filter((part) => part !== null).join(" ");
+        }
+        return {
+            id: userId,
+            name,
+            email: profileString(profile.primary_email),
+            image: profileString(profile.image_url_75x75)
+        };
+    }
+}

package/dist/providers/facebook.d.ts

@@ -0,0 +1,16 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface FacebookOptions extends ProviderOptions {
+}
+export declare class Facebook {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: FacebookOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/facebook.js

@@ -0,0 +1,80 @@
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://www.facebook.com/v16.0/dialog/oauth";
+const tokenEndpoint = "https://graph.facebook.com/v16.0/oauth/access_token";
+const userEndpoint = "https://graph.facebook.com/v16.0/me";
+const envPrefix = "FACEBOOK";
+const defaultScopes = ["public_profile", "email"];
+export class Facebook {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const url = new URL(userEndpoint);
+        url.searchParams.set("fields", "id,name,email,picture.width(256)");
+        const profile = await fetchUserProfile(url, tokens.accessToken());
+        let image = null;
+        if (typeof profile.picture === "object" && profile.picture !== null) {
+            const data = profile.picture.data;
+            if (typeof data === "object" && data !== null) {
+                image = profileString(data.url);
+            }
+        }
+        return {
+            id: profileId(profile.id),
+            name: profileString(profile.name),
+            email: profileString(profile.email),
+            image
+        };
+    }
+}

package/dist/providers/figma.d.ts

@@ -0,0 +1,15 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface FigmaOptions extends ProviderOptions {
+}
+export declare class Figma {
+    private client;
+    private auth;
+    constructor(options: FigmaOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/figma.js

@@ -0,0 +1,56 @@
+import { OAuth2Client } from "../client.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://www.figma.com/oauth";
+const tokenEndpoint = "https://api.figma.com/v1/oauth/token";
+const refreshEndpoint = "https://api.figma.com/v1/oauth/refresh";
+const userEndpoint = "https://api.figma.com/v1/me";
+const envPrefix = "FIGMA";
+const defaultScopes = ["current_user:read"];
+export class Figma {
+    client;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            this.client = new OAuth2Client(clientIdOrOptions, clientSecret ?? null, redirectURI ?? null);
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = this.client.createAuthorizationURL(authorizationEndpoint, state, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const tokens = await this.client.validateAuthorizationCode(tokenEndpoint, code, null);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const tokens = await this.client.refreshAccessToken(refreshEndpoint, refreshToken, []);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        return {
+            id: profileId(profile.id),
+            name: profileString(profile.handle),
+            email: profileString(profile.email),
+            image: profileString(profile.img_url)
+        };
+    }
+}

package/dist/providers/gitea.d.ts

@@ -0,0 +1,19 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface GiteaOptions extends ProviderOptions {
+    baseURL?: string;
+}
+export declare class Gitea {
+    private authorizationEndpoint;
+    private tokenEndpoint;
+    private baseURL;
+    private client;
+    private auth;
+    constructor(options: GiteaOptions);
+    constructor(baseURL: string, clientId: string, clientSecret: string | null, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/gitea.js

@@ -0,0 +1,62 @@
+import { CodeChallengeMethod, OAuth2Client } from "../client.js";
+import { joinURIAndPath } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const envPrefix = "GITEA";
+const defaultScopes = ["read:user"];
+export class Gitea {
+    authorizationEndpoint;
+    tokenEndpoint;
+    baseURL;
+    client;
+    auth = null;
+    constructor(baseURLOrOptions, clientId, clientSecret, redirectURI) {
+        if (typeof baseURLOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, baseURLOrOptions, { redirectURI: true });
+            this.baseURL = requireProviderOption(baseURLOrOptions.baseURL, envPrefix, "BASE_URL", "baseURL");
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            this.baseURL = baseURLOrOptions;
+            this.client = new OAuth2Client(clientId ?? "", clientSecret ?? null, redirectURI ?? null);
+        }
+        this.authorizationEndpoint = joinURIAndPath(this.baseURL, "/login/oauth/authorize");
+        this.tokenEndpoint = joinURIAndPath(this.baseURL, "/login/oauth/access_token");
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = this.client.createAuthorizationURLWithPKCE(this.authorizationEndpoint, state, CodeChallengeMethod.S256, codeVerifier, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const tokens = await this.client.validateAuthorizationCode(this.tokenEndpoint, code, codeVerifier);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const tokens = await this.client.refreshAccessToken(this.tokenEndpoint, refreshToken, []);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        const userEndpoint = joinURIAndPath(this.baseURL, "/api/v1/user");
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        return {
+            id: profileId(profile.id),
+            name: profileString(profile.full_name) ?? profileString(profile.login),
+            email: profileString(profile.email),
+            image: profileString(profile.avatar_url)
+        };
+    }
+}

package/dist/providers/github.d.ts

@@ -0,0 +1,17 @@
+import { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface GitHubOptions extends ProviderOptions {
+}
+export declare class GitHub {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: GitHubOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string | null);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/github.js

@@ -0,0 +1,142 @@
+import { ArcticFetchError, createOAuth2Request, createOAuth2RequestError, encodeBasicCredentials, UnexpectedErrorResponseBodyError, UnexpectedResponseError } from "../request.js";
+import { OAuth2Tokens } from "../oauth2.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://github.com/login/oauth/authorize";
+const tokenEndpoint = "https://github.com/login/oauth/access_token";
+const userEndpoint = "https://api.github.com/user";
+const userEmailsEndpoint = "https://api.github.com/user/emails";
+const envPrefix = "GITHUB";
+const defaultScopes = ["read:user", "user:email"];
+export class GitHub {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, { clientSecret: true });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI;
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? null;
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        if (this.redirectURI !== null) {
+            url.searchParams.set("redirect_uri", this.redirectURI);
+        }
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        if (this.redirectURI !== null) {
+            body.set("redirect_uri", this.redirectURI);
+        }
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const encodedCredentials = encodeBasicCredentials(this.clientId, this.clientSecret);
+        request.headers.set("Authorization", `Basic ${encodedCredentials}`);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", refreshToken);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const encodedCredentials = encodeBasicCredentials(this.clientId, this.clientSecret);
+        request.headers.set("Authorization", `Basic ${encodedCredentials}`);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const accessToken = tokens.accessToken();
+        const profile = await fetchUserProfile(userEndpoint, accessToken);
+        let email = profileString(profile.email);
+        if (email === null) {
+            email = await fetchPrimaryEmail(accessToken);
+        }
+        return {
+            id: profileId(profile.id),
+            name: profileString(profile.name) ?? profileString(profile.login),
+            email,
+            image: profileString(profile.avatar_url)
+        };
+    }
+}
+// Private emails are not included in the profile and need the user:email scope.
+async function fetchPrimaryEmail(accessToken) {
+    let emails;
+    try {
+        emails = await fetchUserProfile(userEmailsEndpoint, accessToken);
+    }
+    catch {
+        return null;
+    }
+    if (!Array.isArray(emails)) {
+        return null;
+    }
+    const entries = emails.filter((entry) => typeof entry === "object" && entry !== null && typeof entry.email === "string");
+    const primary = entries.find((entry) => entry.primary === true);
+    return primary?.email ?? entries[0]?.email ?? null;
+}
+async function sendTokenRequest(request) {
+    let response;
+    try {
+        response = await fetch(request);
+    }
+    catch (e) {
+        throw new ArcticFetchError(e);
+    }
+    if (response.status !== 200) {
+        if (response.body !== null) {
+            await response.body.cancel();
+        }
+        throw new UnexpectedResponseError(response.status);
+    }
+    let data;
+    try {
+        data = await response.json();
+    }
+    catch {
+        throw new UnexpectedResponseError(response.status);
+    }
+    if (typeof data !== "object" || data === null) {
+        throw new UnexpectedErrorResponseBodyError(response.status, data);
+    }
+    if ("error" in data && typeof data.error === "string") {
+        let error;
+        try {
+            error = createOAuth2RequestError(data);
+        }
+        catch {
+            throw new UnexpectedErrorResponseBodyError(response.status, data);
+        }
+        throw error;
+    }
+    const tokens = new OAuth2Tokens(data);
+    return tokens;
+}

package/dist/providers/gitlab.d.ts

@@ -0,0 +1,21 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface GitLabOptions extends ProviderOptions {
+    baseURL?: string;
+}
+export declare class GitLab {
+    private authorizationEndpoint;
+    private tokenEndpoint;
+    private tokenRevocationEndpoint;
+    private baseURL;
+    private client;
+    private auth;
+    constructor(options: GitLabOptions);
+    constructor(baseURL: string, clientId: string, clientSecret: string | null, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    revokeToken(token: string): Promise<void>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/gitlab.js

@@ -0,0 +1,64 @@
+import { OAuth2Client } from "../client.js";
+import { joinURIAndPath } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const envPrefix = "GITLAB";
+const defaultScopes = ["openid", "profile", "email"];
+export class GitLab {
+    authorizationEndpoint;
+    tokenEndpoint;
+    tokenRevocationEndpoint;
+    baseURL;
+    client;
+    auth = null;
+    constructor(baseURLOrOptions, clientId, clientSecret, redirectURI) {
+        if (typeof baseURLOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, baseURLOrOptions, { redirectURI: true });
+            this.baseURL = requireProviderOption(baseURLOrOptions.baseURL, envPrefix, "BASE_URL", "baseURL");
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            this.baseURL = baseURLOrOptions;
+            this.client = new OAuth2Client(clientId ?? "", clientSecret ?? null, redirectURI ?? null);
+        }
+        this.authorizationEndpoint = joinURIAndPath(this.baseURL, "/oauth/authorize");
+        this.tokenEndpoint = joinURIAndPath(this.baseURL, "/oauth/token");
+        this.tokenRevocationEndpoint = joinURIAndPath(this.baseURL, "/oauth/revoke");
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = this.client.createAuthorizationURL(this.authorizationEndpoint, state, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const tokens = await this.client.validateAuthorizationCode(this.tokenEndpoint, code, null);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const tokens = await this.client.refreshAccessToken(this.tokenEndpoint, refreshToken, []);
+        return tokens;
+    }
+    async revokeToken(token) {
+        await this.client.revokeToken(this.tokenRevocationEndpoint, token);
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        // GitLab id_tokens omit profile claims, so always use the OIDC userinfo endpoint.
+        const userinfoEndpoint = joinURIAndPath(this.baseURL, "/oauth/userinfo");
+        const claims = await fetchUserProfile(userinfoEndpoint, tokens.accessToken());
+        return {
+            id: profileId(claims.sub),
+            name: profileString(claims.name) ?? profileString(claims.nickname),
+            email: profileString(claims.email),
+            image: profileString(claims.picture)
+        };
+    }
+}

package/dist/providers/google.d.ts

@@ -0,0 +1,16 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface GoogleOptions extends ProviderOptions {
+}
+export declare class Google {
+    private client;
+    private auth;
+    constructor(options: GoogleOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    revokeToken(token: string): Promise<void>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}