antarctic 0.2.0

package/dist/providers/google.js

@@ -0,0 +1,70 @@
+import { OAuth2Client, CodeChallengeMethod } from "../client.js";
+import { decodeIdToken } from "../oidc.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://accounts.google.com/o/oauth2/v2/auth";
+const tokenEndpoint = "https://oauth2.googleapis.com/token";
+const tokenRevocationEndpoint = "https://oauth2.googleapis.com/revoke";
+const userinfoEndpoint = "https://openidconnect.googleapis.com/v1/userinfo";
+const envPrefix = "GOOGLE";
+const defaultScopes = ["openid", "profile", "email"];
+export class Google {
+    client;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            this.client = new OAuth2Client(clientIdOrOptions, clientSecret ?? null, redirectURI ?? null);
+        }
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = this.client.createAuthorizationURLWithPKCE(authorizationEndpoint, state, CodeChallengeMethod.S256, codeVerifier, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const tokens = await this.client.validateAuthorizationCode(tokenEndpoint, code, codeVerifier);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const tokens = await this.client.refreshAccessToken(tokenEndpoint, refreshToken, []);
+        return tokens;
+    }
+    async revokeToken(token) {
+        await this.client.revokeToken(tokenRevocationEndpoint, token);
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        let claims;
+        if ("id_token" in tokens.data) {
+            claims = decodeIdToken(tokens.idToken());
+        }
+        else {
+            claims = await fetchUserProfile(userinfoEndpoint, tokens.accessToken());
+        }
+        return {
+            id: profileId(claims.sub),
+            name: profileString(claims.name),
+            email: profileString(claims.email),
+            image: profileString(claims.picture)
+        };
+    }
+}

package/dist/providers/intuit.d.ts

@@ -0,0 +1,16 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface IntuitOptions extends ProviderOptions {
+}
+export declare class Intuit {
+    private client;
+    private auth;
+    constructor(options: IntuitOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    revokeToken(token: string): Promise<void>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/intuit.js

@@ -0,0 +1,66 @@
+import { OAuth2Client } from "../client.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://appcenter.intuit.com/connect/oauth2";
+const tokenEndpoint = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
+const tokenRevocationEndpoint = "https://developer.API.intuit.com/v2/oauth2/tokens/revoke";
+const userinfoEndpoint = "https://accounts.platform.intuit.com/v1/openid_connect/userinfo";
+const envPrefix = "INTUIT";
+const defaultScopes = ["openid", "profile", "email"];
+export class Intuit {
+    client;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            this.client = new OAuth2Client(clientIdOrOptions, clientSecret ?? null, redirectURI ?? null);
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = this.client.createAuthorizationURL(authorizationEndpoint, state, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const tokens = await this.client.validateAuthorizationCode(tokenEndpoint, code, null);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const tokens = await this.client.refreshAccessToken(tokenEndpoint, refreshToken, []);
+        return tokens;
+    }
+    async revokeToken(token) {
+        await this.client.revokeToken(tokenRevocationEndpoint, token);
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        // Intuit id_tokens omit profile claims, so always use the OIDC userinfo endpoint.
+        const claims = await fetchUserProfile(userinfoEndpoint, tokens.accessToken());
+        const givenName = profileString(claims.givenName);
+        const familyName = profileString(claims.familyName);
+        let name = null;
+        if (givenName !== null || familyName !== null) {
+            name = [givenName, familyName].filter((part) => part !== null).join(" ");
+        }
+        return {
+            id: profileId(claims.sub),
+            name,
+            email: profileString(claims.email),
+            image: null
+        };
+    }
+}

package/dist/providers/kakao.d.ts

@@ -0,0 +1,17 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface KakaoOptions extends ProviderOptions {
+}
+export declare class Kakao {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: KakaoOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/kakao.js

@@ -0,0 +1,95 @@
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://kauth.kakao.com/oauth/authorize";
+const tokenEndpoint = "https://kauth.kakao.com/oauth/token";
+const userEndpoint = "https://kapi.kakao.com/v2/user/me";
+const envPrefix = "KAKAO";
+const defaultScopes = ["profile_nickname", "profile_image", "account_email"];
+export class Kakao {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", refreshToken);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        let name = null;
+        let email = null;
+        let image = null;
+        const account = profile.kakao_account;
+        if (typeof account === "object" && account !== null) {
+            const accountRecord = account;
+            email = profileString(accountRecord.email);
+            const kakaoProfile = accountRecord.profile;
+            if (typeof kakaoProfile === "object" && kakaoProfile !== null) {
+                const profileRecord = kakaoProfile;
+                name = profileString(profileRecord.nickname);
+                image = profileString(profileRecord.profile_image_url);
+            }
+        }
+        return {
+            id: profileId(profile.id),
+            name,
+            email,
+            image
+        };
+    }
+}

package/dist/providers/keycloak.d.ts

@@ -0,0 +1,21 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface KeyCloakOptions extends ProviderOptions {
+    realmURL?: string;
+}
+export declare class KeyCloak {
+    private authorizationEndpoint;
+    private tokenEndpoint;
+    private tokenRevocationEndpoint;
+    private userinfoEndpoint;
+    private client;
+    private auth;
+    constructor(options: KeyCloakOptions);
+    constructor(realmURL: string, clientId: string, clientSecret: string | null, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    revokeToken(token: string): Promise<void>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/keycloak.js

@@ -0,0 +1,74 @@
+import { CodeChallengeMethod, OAuth2Client } from "../client.js";
+import { decodeIdToken } from "../oidc.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const envPrefix = "KEYCLOAK";
+const defaultScopes = ["openid", "profile", "email"];
+export class KeyCloak {
+    authorizationEndpoint;
+    tokenEndpoint;
+    tokenRevocationEndpoint;
+    userinfoEndpoint;
+    client;
+    auth = null;
+    constructor(realmURLOrOptions, clientId, clientSecret, redirectURI) {
+        let realmURL;
+        if (typeof realmURLOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, realmURLOrOptions, { redirectURI: true });
+            realmURL = requireProviderOption(realmURLOrOptions.realmURL, envPrefix, "REALM_URL", "realmURL");
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            realmURL = realmURLOrOptions;
+            this.client = new OAuth2Client(clientId ?? "", clientSecret ?? null, redirectURI ?? null);
+        }
+        this.authorizationEndpoint = realmURL + "/protocol/openid-connect/auth";
+        this.tokenEndpoint = realmURL + "/protocol/openid-connect/token";
+        this.tokenRevocationEndpoint = realmURL + "/protocol/openid-connect/revoke";
+        this.userinfoEndpoint = realmURL + "/protocol/openid-connect/userinfo";
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = this.client.createAuthorizationURLWithPKCE(this.authorizationEndpoint, state, CodeChallengeMethod.S256, codeVerifier, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const tokens = await this.client.validateAuthorizationCode(this.tokenEndpoint, code, codeVerifier);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const tokens = await this.client.refreshAccessToken(this.tokenEndpoint, refreshToken, []);
+        return tokens;
+    }
+    async revokeToken(token) {
+        await this.client.revokeToken(this.tokenRevocationEndpoint, token);
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        let claims;
+        if ("id_token" in tokens.data) {
+            claims = decodeIdToken(tokens.idToken());
+        }
+        else {
+            claims = await fetchUserProfile(this.userinfoEndpoint, tokens.accessToken());
+        }
+        return {
+            id: profileId(claims.sub),
+            name: profileString(claims.name) ?? profileString(claims.preferred_username),
+            email: profileString(claims.email),
+            image: profileString(claims.picture)
+        };
+    }
+}

package/dist/providers/kick.d.ts

@@ -0,0 +1,18 @@
+import { type OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface KickOptions extends ProviderOptions {
+}
+export declare class Kick {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: KickOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    revokeToken(token: string): Promise<void>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/kick.js

@@ -0,0 +1,103 @@
+import { createOAuth2Request, sendTokenRequest, sendTokenRevocationRequest } from "../request.js";
+import { createS256CodeChallenge } from "../oauth2.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://id.kick.com/oauth/authorize";
+const tokenEndpoint = "https://id.kick.com/oauth/token";
+const tokenRevocationEndpoint = "https://id.kick.com/oauth/revoke";
+const userEndpoint = "https://api.kick.com/public/v1/users";
+const envPrefix = "KICK";
+const defaultScopes = ["user:read"];
+export class Kick {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        const codeChallenge = createS256CodeChallenge(codeVerifier);
+        url.searchParams.set("code_challenge", codeChallenge);
+        url.searchParams.set("code_challenge_method", "S256");
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const body = new URLSearchParams();
+        body.set("code", code);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("grant_type", "authorization_code");
+        body.set("code_verifier", codeVerifier);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams();
+        body.set("refresh_token", refreshToken);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        body.set("grant_type", "refresh_token");
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async revokeToken(token) {
+        const body = new URLSearchParams();
+        body.set("token", token);
+        const request = createOAuth2Request(tokenRevocationEndpoint, body);
+        await sendTokenRevocationRequest(request);
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        // Without user IDs the endpoint returns the authorized user as the only data entry.
+        const response = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        const entries = response.data;
+        if (!Array.isArray(entries) || typeof entries[0] !== "object" || entries[0] === null) {
+            throw new OAuthProviderError("Unexpected user profile response body");
+        }
+        const profile = entries[0];
+        return {
+            id: profileId(profile.user_id),
+            name: profileString(profile.name),
+            email: profileString(profile.email),
+            image: profileString(profile.profile_picture)
+        };
+    }
+}

package/dist/providers/lichess.d.ts

@@ -0,0 +1,14 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface LichessOptions extends ProviderOptions {
+}
+export declare class Lichess {
+    private client;
+    private auth;
+    constructor(options: LichessOptions);
+    constructor(clientId: string, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/lichess.js

@@ -0,0 +1,63 @@
+import { OAuth2Client, CodeChallengeMethod } from "../client.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://lichess.org/oauth";
+const tokenEndpoint = "https://lichess.org/api/token";
+const accountEndpoint = "https://lichess.org/api/account";
+const accountEmailEndpoint = "https://lichess.org/api/account/email";
+const envPrefix = "LICHESS";
+const defaultScopes = ["email:read"];
+export class Lichess {
+    client;
+    auth = null;
+    constructor(clientIdOrOptions, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, { redirectURI: true });
+            this.client = new OAuth2Client(this.auth.clientId, null, this.auth.redirectURI);
+        }
+        else {
+            this.client = new OAuth2Client(clientIdOrOptions, null, redirectURI ?? null);
+        }
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = this.client.createAuthorizationURLWithPKCE(authorizationEndpoint, state, CodeChallengeMethod.S256, codeVerifier, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const tokens = await this.client.validateAuthorizationCode(tokenEndpoint, code, codeVerifier);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        const accessToken = tokens.accessToken();
+        const profile = await fetchUserProfile(accountEndpoint, accessToken);
+        // Requires the email:read scope, so tolerate failure.
+        let email = null;
+        try {
+            const response = await fetchUserProfile(accountEmailEndpoint, accessToken);
+            email = profileString(response.email);
+        }
+        catch {
+            email = null;
+        }
+        return {
+            id: profileId(profile.id),
+            name: profileString(profile.username),
+            email,
+            image: null
+        };
+    }
+}

package/dist/providers/line.d.ts

@@ -0,0 +1,17 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface LineOptions extends ProviderOptions {
+}
+export declare class Line {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: LineOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}