antarctic 0.5.0 → 0.6.0

package/dist/providers/github.d.ts

@@ -1,5 +1,5 @@
 import { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface GitHubOptions extends ProviderOptions {
 }
 export declare class GitHub {
@@ -12,6 +12,6 @@ export declare class GitHub {
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/github.js

@@ -1,6 +1,6 @@
 import { ArcticFetchError, createOAuth2Request, createOAuth2RequestError, encodeBasicCredentials, UnexpectedErrorResponseBodyError, UnexpectedResponseError } from "../request.js";
 import { OAuth2Tokens } from "../oauth2.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://github.com/login/oauth/authorize";
 const tokenEndpoint = "https://github.com/login/oauth/access_token";
 const userEndpoint = "https://api.github.com/user";
@@ -65,13 +65,14 @@ export class GitHub {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        await resolveOAuthState(auth.store, state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const accessToken = tokens.accessToken();
         const profile = await fetchUserProfile(userEndpoint, accessToken);
@@ -84,7 +85,8 @@ export class GitHub {
             name: profileString(profile.name) ?? profileString(profile.login),
             email,
             image: profileString(profile.avatar_url),
-            raw: profile
+            raw: profile,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/gitlab.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface GitLabOptions extends ProviderOptions {
     baseURL?: string;
 }
@@ -16,6 +16,6 @@ export declare class GitLab {
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/gitlab.js

@@ -1,6 +1,6 @@
 import { OAuth2Client } from "../client.js";
 import { joinURIAndPath } from "../request.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const envPrefix = "GITLAB";
 const defaultScopes = ["openid", "profile", "email"];
 export class GitLab {
@@ -43,13 +43,14 @@ export class GitLab {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        await resolveOAuthState(auth.store, state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         // GitLab id_tokens omit profile claims, so always use the OIDC userinfo endpoint.
         const userinfoEndpoint = joinURIAndPath(this.baseURL, "/oauth/userinfo");
@@ -59,7 +60,8 @@ export class GitLab {
             name: profileString(claims.name) ?? profileString(claims.nickname),
             email: profileString(claims.email),
             image: profileString(claims.picture),
-            raw: claims
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/google.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface GoogleOptions extends ProviderOptions {
 }
 export declare class Google {
@@ -11,6 +11,6 @@ export declare class Google {
     validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/google.js

@@ -1,6 +1,6 @@
 import { OAuth2Client, CodeChallengeMethod } from "../client.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://accounts.google.com/o/oauth2/v2/auth";
 const tokenEndpoint = "https://oauth2.googleapis.com/token";
 const tokenRevocationEndpoint = "https://oauth2.googleapis.com/revoke";
@@ -42,13 +42,14 @@ export class Google {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = await resolveOAuthState(auth.store, state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -65,7 +66,8 @@ export class Google {
             name: profileString(claims.name),
             email: profileString(claims.email),
             image: profileString(claims.picture),
-            raw: claims
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/intuit.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface IntuitOptions extends ProviderOptions {
 }
 export declare class Intuit {
@@ -11,6 +11,6 @@ export declare class Intuit {
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/intuit.js

@@ -1,5 +1,5 @@
 import { OAuth2Client } from "../client.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://appcenter.intuit.com/connect/oauth2";
 const tokenEndpoint = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 const tokenRevocationEndpoint = "https://developer.API.intuit.com/v2/oauth2/tokens/revoke";
@@ -40,13 +40,14 @@ export class Intuit {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        await resolveOAuthState(auth.store, state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         // Intuit id_tokens omit profile claims, so always use the OIDC userinfo endpoint.
         const claims = await fetchUserProfile(userinfoEndpoint, tokens.accessToken());
@@ -61,7 +62,8 @@ export class Intuit {
             name,
             email: profileString(claims.email),
             image: null,
-            raw: claims
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/kakao.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface KakaoOptions extends ProviderOptions {
 }
 export declare class Kakao {
@@ -12,6 +12,6 @@ export declare class Kakao {
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/kakao.js

@@ -1,5 +1,5 @@
 import { createOAuth2Request, sendTokenRequest } from "../request.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://kauth.kakao.com/oauth/authorize";
 const tokenEndpoint = "https://kauth.kakao.com/oauth/token";
 const userEndpoint = "https://kapi.kakao.com/v2/user/me";
@@ -62,13 +62,14 @@ export class Kakao {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        await resolveOAuthState(auth.store, state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
         let name = null;
@@ -90,7 +91,8 @@ export class Kakao {
             name,
             email,
             image,
-            raw: profile
+            raw: profile,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/keycloak.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface KeyCloakOptions extends ProviderOptions {
     realmURL?: string;
 }
@@ -16,6 +16,6 @@ export declare class KeyCloak {
     validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/keycloak.js

@@ -1,6 +1,6 @@
 import { CodeChallengeMethod, OAuth2Client } from "../client.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const envPrefix = "KEYCLOAK";
 const defaultScopes = ["openid", "profile", "email"];
 export class KeyCloak {
@@ -46,13 +46,14 @@ export class KeyCloak {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = await resolveOAuthState(auth.store, state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -69,7 +70,8 @@ export class KeyCloak {
             name: profileString(claims.name) ?? profileString(claims.preferred_username),
             email: profileString(claims.email),
             image: profileString(claims.picture),
-            raw: claims
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/kick.d.ts

@@ -1,5 +1,5 @@
 import { type OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface KickOptions extends ProviderOptions {
 }
 export declare class Kick {
@@ -13,6 +13,6 @@ export declare class Kick {
     validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/kick.js

@@ -1,6 +1,6 @@
 import { createOAuth2Request, sendTokenRequest, sendTokenRevocationRequest } from "../request.js";
 import { createS256CodeChallenge } from "../oauth2.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://id.kick.com/oauth/authorize";
 const tokenEndpoint = "https://id.kick.com/oauth/token";
 const tokenRevocationEndpoint = "https://id.kick.com/oauth/revoke";
@@ -75,13 +75,14 @@ export class Kick {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = await resolveOAuthState(auth.store, state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -98,7 +99,8 @@ export class Kick {
             name: profileString(profile.name),
             email: profileString(profile.email),
             image: profileString(profile.profile_picture),
-            raw: profile
+            raw: profile,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/lichess.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface LichessOptions extends ProviderOptions {
 }
 export declare class Lichess {
@@ -9,6 +9,6 @@ export declare class Lichess {
     constructor(clientId: string, redirectURI: string);
     createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): Promise<URL>;
     validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/lichess.js

@@ -1,5 +1,5 @@
 import { OAuth2Client, CodeChallengeMethod } from "../client.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://lichess.org/oauth";
 const tokenEndpoint = "https://lichess.org/api/token";
 const accountEndpoint = "https://lichess.org/api/account";
@@ -31,13 +31,14 @@ export class Lichess {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = await resolveOAuthState(auth.store, state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -58,7 +59,8 @@ export class Lichess {
             name: profileString(profile.username),
             email,
             image: null,
-            raw: profile
+            raw: profile,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/line.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface LineOptions extends ProviderOptions {
 }
 export declare class Line {
@@ -12,6 +12,6 @@ export declare class Line {
     createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): Promise<URL>;
     validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/line.js

@@ -1,7 +1,7 @@
 import { createS256CodeChallenge } from "../oauth2.js";
 import { createOAuth2Request, sendTokenRequest } from "../request.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://access.line.me/oauth2/v2.1/authorize";
 const tokenEndpoint = "https://api.line.me/oauth2/v2.1/token";
 const userinfoEndpoint = "https://api.line.me/oauth2/v2.1/userinfo";
@@ -69,13 +69,14 @@ export class Line {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = await resolveOAuthState(auth.store, state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -93,7 +94,8 @@ export class Line {
             name: profileString(claims.name),
             email: profileString(claims.email),
             image: profileString(claims.picture),
-            raw: claims
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/linear.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface LinearOptions extends ProviderOptions {
 }
 export declare class Linear {
@@ -11,6 +11,6 @@ export declare class Linear {
     constructor(clientId: string, clientSecret: string, redirectURI: string);
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/linear.js

@@ -1,5 +1,5 @@
 import { createOAuth2Request, sendTokenRequest } from "../request.js";
-import { consumeOAuthState, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://linear.app/oauth/authorize";
 const tokenEndpoint = "https://api.linear.app/oauth/token";
 const graphqlEndpoint = "https://api.linear.app/graphql";
@@ -52,13 +52,14 @@ export class Linear {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        await resolveOAuthState(auth.store, state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const viewer = await fetchViewer(tokens.accessToken());
         return {
@@ -66,7 +67,8 @@ export class Linear {
             name: profileString(viewer.name),
             email: profileString(viewer.email),
             image: profileString(viewer.avatarUrl),
-            raw: viewer
+            raw: viewer,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/linkedin.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface LinkedInOptions extends ProviderOptions {
 }
 export declare class LinkedIn {
@@ -12,6 +12,6 @@ export declare class LinkedIn {
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/linkedin.js

@@ -1,7 +1,7 @@
 // LinkedIn doesn't seem to support HTTP Basic Auth
 import { createOAuth2Request, sendTokenRequest } from "../request.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes, saveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://www.linkedin.com/oauth/v2/authorization";
 const tokenEndpoint = "https://www.linkedin.com/oauth/v2/accessToken";
 const userinfoEndpoint = "https://api.linkedin.com/v2/userinfo";
@@ -64,13 +64,14 @@ export class LinkedIn {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        await saveOAuthState(auth.store, state, payload);
+        return { url, state, payload };
     }
-    async getUser(query) {
+    async getUser(query, saved) {
         const auth = requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        await resolveOAuthState(auth.store, state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         let claims;
         if ("id_token" in tokens.data) {
@@ -84,7 +85,8 @@ export class LinkedIn {
             name: profileString(claims.name),
             email: profileString(claims.email),
             image: profileString(claims.picture),
-            raw: claims
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/mastodon.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface MastodonOptions extends ProviderOptions {
     baseURL?: string;
 }
@@ -15,6 +15,6 @@ export declare class Mastodon {
     createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): Promise<URL>;
     validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved?: SavedOAuthState): Promise<OAuthUser>;
 }