antarctic 0.5.0 → 0.7.0

package/dist/providers/okta.js

@@ -1,6 +1,6 @@
 import { CodeChallengeMethod, OAuth2Client } from "../client.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveProviderOption, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveOAuthState, resolveProviderOption, resolveScopes } from "../auth.js";
 import { joinURIAndPath } from "../request.js";
 const envPrefix = "OKTA";
 const defaultScopes = ["openid", "profile", "email"];
@@ -11,7 +11,7 @@ export class Okta {
     userinfoEndpoint;
     client;
     auth = null;
-    constructor(domainOrOptions, authorizationServerId, clientId, clientSecret, redirectURI) {
+    constructor(domainOrOptions = {}, authorizationServerId, clientId, clientSecret, redirectURI) {
         let domain;
         let serverId;
         if (typeof domainOrOptions === "object") {
@@ -57,13 +57,13 @@ export class Okta {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        return { url, state, payload };
     }
-    async getUser(query) {
-        const auth = requireAuthConfig(this.auth);
+    async getUser(query, saved) {
+        requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = resolveOAuthState(state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -80,7 +80,8 @@ export class Okta {
             name: profileString(claims.name),
             email: profileString(claims.email),
             image: profileString(claims.picture),
-            raw: claims
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/osu.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface OsuOptions extends ProviderOptions {
 }
 export declare class Osu {
@@ -7,11 +7,11 @@ export declare class Osu {
     private clientSecret;
     private redirectURI;
     private auth;
-    constructor(options: OsuOptions);
+    constructor(options?: OsuOptions);
     constructor(clientId: string, clientSecret: string, redirectURI: string | null);
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/osu.js

@@ -1,5 +1,5 @@
 import { createOAuth2Request, sendTokenRequest } from "../request.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes } from "../auth.js";
 const authorizationEndpoint = "https://osu.ppy.sh/oauth/authorize";
 const tokenEndpoint = "https://osu.ppy.sh/oauth/token";
 const userEndpoint = "https://osu.ppy.sh/api/v2/me";
@@ -10,7 +10,7 @@ export class Osu {
     clientSecret;
     redirectURI;
     auth = null;
-    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+    constructor(clientIdOrOptions = {}, clientSecret, redirectURI) {
         if (typeof clientIdOrOptions === "object") {
             this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, { clientSecret: true });
             this.clientId = this.auth.clientId;
@@ -63,13 +63,13 @@ export class Osu {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        return { url, state, payload };
     }
-    async getUser(query) {
-        const auth = requireAuthConfig(this.auth);
+    async getUser(query, saved) {
+        requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        resolveOAuthState(state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
         return {
@@ -77,7 +77,8 @@ export class Osu {
             name: profileString(profile.username),
             email: null,
             image: profileString(profile.avatar_url),
-            raw: profile
+            raw: profile,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/patreon.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface PatreonOptions extends ProviderOptions {
 }
 export declare class Patreon {
@@ -7,11 +7,11 @@ export declare class Patreon {
     private clientSecret;
     private redirectURI;
     private auth;
-    constructor(options: PatreonOptions);
+    constructor(options?: PatreonOptions);
     constructor(clientId: string, clientSecret: string, redirectURI: string);
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/patreon.js

@@ -1,5 +1,5 @@
 import { createOAuth2Request, sendTokenRequest } from "../request.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes } from "../auth.js";
 const authorizationEndpoint = "https://www.patreon.com/oauth2/authorize";
 const tokenEndpoint = "https://www.patreon.com/api/oauth2/token";
 const identityEndpoint = "https://www.patreon.com/api/oauth2/v2/identity";
@@ -10,7 +10,7 @@ export class Patreon {
     clientSecret;
     redirectURI;
     auth = null;
-    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+    constructor(clientIdOrOptions = {}, clientSecret, redirectURI) {
         if (typeof clientIdOrOptions === "object") {
             this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
                 clientSecret: true,
@@ -62,13 +62,13 @@ export class Patreon {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        return { url, state, payload };
     }
-    async getUser(query) {
-        const auth = requireAuthConfig(this.auth);
+    async getUser(query, saved) {
+        requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        resolveOAuthState(state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const url = new URL(identityEndpoint);
         url.searchParams.set("fields[user]", "email,full_name,image_url");
@@ -84,7 +84,8 @@ export class Patreon {
             name: profileString(attributes.full_name),
             email: profileString(attributes.email),
             image: profileString(attributes.image_url),
-            raw: user
+            raw: user,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/polar.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface PolarOptions extends ProviderOptions {
 }
 export declare class Polar {
@@ -7,12 +7,12 @@ export declare class Polar {
     private clientSecret;
     private redirectURI;
     private auth;
-    constructor(options: PolarOptions);
+    constructor(options?: PolarOptions);
     constructor(clientId: string, clientSecret: string | null, redirectURI: string);
     createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): Promise<URL>;
     validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/polar.js

@@ -1,6 +1,6 @@
 import { createS256CodeChallenge } from "../oauth2.js";
 import { createOAuth2Request, sendTokenRequest, sendTokenRevocationRequest } from "../request.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes } from "../auth.js";
 const authorizationEndpoint = "https://polar.sh/oauth2/authorize";
 const tokenEndpoint = "https://api.polar.sh/v1/oauth2/token";
 const tokenRevocationEndpoint = "https://api.polar.sh/v1/oauth2/revoke";
@@ -13,7 +13,7 @@ export class Polar {
     clientSecret;
     redirectURI;
     auth = null;
-    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+    constructor(clientIdOrOptions = {}, clientSecret, redirectURI) {
         if (typeof clientIdOrOptions === "object") {
             this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, { redirectURI: true });
             this.clientId = this.auth.clientId;
@@ -77,13 +77,13 @@ export class Polar {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        return { url, state, payload };
     }
-    async getUser(query) {
-        const auth = requireAuthConfig(this.auth);
+    async getUser(query, saved) {
+        requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = resolveOAuthState(state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -95,7 +95,8 @@ export class Polar {
             email: profileString(claims.email),
             // Polar's userinfo response has no avatar field.
             image: null,
-            raw: claims
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/reddit.d.ts

@@ -1,15 +1,15 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface RedditOptions extends ProviderOptions {
 }
 export declare class Reddit {
     private client;
     private auth;
-    constructor(options: RedditOptions);
+    constructor(options?: RedditOptions);
     constructor(clientId: string, clientSecret: string, redirectURI: string);
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/reddit.js

@@ -1,5 +1,5 @@
 import { OAuth2Client } from "../client.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes } from "../auth.js";
 const authorizationEndpoint = "https://www.reddit.com/api/v1/authorize";
 const tokenEndpoint = "https://www.reddit.com/api/v1/access_token";
 const userEndpoint = "https://oauth.reddit.com/api/v1/me";
@@ -8,7 +8,7 @@ const defaultScopes = ["identity"];
 export class Reddit {
     client;
     auth = null;
-    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+    constructor(clientIdOrOptions = {}, clientSecret, redirectURI) {
         if (typeof clientIdOrOptions === "object") {
             this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
                 clientSecret: true,
@@ -36,13 +36,13 @@ export class Reddit {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        return { url, state, payload };
     }
-    async getUser(query) {
-        const auth = requireAuthConfig(this.auth);
+    async getUser(query, saved) {
+        requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        resolveOAuthState(state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
         return {
@@ -50,7 +50,8 @@ export class Reddit {
             name: profileString(profile.name),
             email: null,
             image: profileString(profile.icon_img),
-            raw: profile
+            raw: profile,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/roblox.d.ts

@@ -1,16 +1,16 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface RobloxOptions extends ProviderOptions {
 }
 export declare class Roblox {
     private client;
     private auth;
-    constructor(options: RobloxOptions);
+    constructor(options?: RobloxOptions);
     constructor(clientId: string, clientSecret: string | null, redirectURI: string);
     createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): Promise<URL>;
     validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/roblox.js

@@ -1,6 +1,6 @@
 import { OAuth2Client, CodeChallengeMethod } from "../client.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes } from "../auth.js";
 const authorizationEndpoint = "https://apis.roblox.com/oauth/v1/authorize";
 const tokenEndpoint = "https://apis.roblox.com/oauth/v1/token";
 const tokenRevocationEndpoint = "https://apis.roblox.com/oauth/v1/token/revoke";
@@ -10,7 +10,7 @@ const defaultScopes = ["openid", "profile"];
 export class Roblox {
     client;
     auth = null;
-    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+    constructor(clientIdOrOptions = {}, clientSecret, redirectURI) {
         if (typeof clientIdOrOptions === "object") {
             this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, { redirectURI: true });
             this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
@@ -39,13 +39,13 @@ export class Roblox {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        return { url, state, payload };
     }
-    async getUser(query) {
-        const auth = requireAuthConfig(this.auth);
+    async getUser(query, saved) {
+        requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = resolveOAuthState(state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -62,7 +62,8 @@ export class Roblox {
             name: profileString(claims.name) ?? profileString(claims.preferred_username),
             email: null,
             image: profileString(claims.picture),
-            raw: claims
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/salesforce.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface SalesforceOptions extends ProviderOptions {
     domain?: string;
 }
@@ -10,12 +10,12 @@ export declare class Salesforce {
     private userinfoEndpoint;
     private client;
     private auth;
-    constructor(options: SalesforceOptions);
+    constructor(options?: SalesforceOptions);
     constructor(domain: string, clientId: string, clientSecret: string | null, redirectURI: string);
     createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): Promise<URL>;
     validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/salesforce.js

@@ -1,6 +1,6 @@
 import { OAuth2Client, CodeChallengeMethod } from "../client.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveOAuthState, resolveScopes } from "../auth.js";
 const envPrefix = "SALESFORCE";
 const defaultScopes = ["openid", "profile", "email"];
 export class Salesforce {
@@ -10,7 +10,7 @@ export class Salesforce {
     userinfoEndpoint;
     client;
     auth = null;
-    constructor(domainOrOptions, clientId, clientSecret, redirectURI) {
+    constructor(domainOrOptions = {}, clientId, clientSecret, redirectURI) {
         let domain;
         if (typeof domainOrOptions === "object") {
             this.auth = resolveAuthConfig(envPrefix, domainOrOptions, { redirectURI: true });
@@ -46,13 +46,13 @@ export class Salesforce {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        return { url, state, payload };
     }
-    async getUser(query) {
-        const auth = requireAuthConfig(this.auth);
+    async getUser(query, saved) {
+        requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = resolveOAuthState(state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -69,7 +69,8 @@ export class Salesforce {
             name: profileString(claims.name) ?? profileString(claims.preferred_username),
             email: profileString(claims.email),
             image: profileString(claims.picture),
-            raw: claims
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/shikimori.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface ShikimoriOptions extends ProviderOptions {
 }
 export declare class Shikimori {
@@ -7,11 +7,11 @@ export declare class Shikimori {
     private clientSecret;
     private redirectURI;
     private auth;
-    constructor(options: ShikimoriOptions);
+    constructor(options?: ShikimoriOptions);
     constructor(clientId: string, clientSecret: string, redirectURI: string);
     createAuthorizationURL(state: string): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/shikimori.js

@@ -1,5 +1,5 @@
 import { createOAuth2Request, sendTokenRequest } from "../request.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://shikimori.one/oauth/authorize";
 const tokenEndpoint = "https://shikimori.one/oauth/token";
 const userEndpoint = "https://shikimori.one/api/users/whoami";
@@ -9,7 +9,7 @@ export class Shikimori {
     clientSecret;
     redirectURI;
     auth = null;
-    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+    constructor(clientIdOrOptions = {}, clientSecret, redirectURI) {
         if (typeof clientIdOrOptions === "object") {
             this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
                 clientSecret: true,
@@ -55,16 +55,16 @@ export class Shikimori {
         return tokens;
     }
     async getAuthorizationURL() {
-        const auth = requireAuthConfig(this.auth);
+        requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state);
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        return { url, state, payload };
     }
-    async getUser(query) {
-        const auth = requireAuthConfig(this.auth);
+    async getUser(query, saved) {
+        requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        resolveOAuthState(state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
         let image = null;
@@ -76,7 +76,8 @@ export class Shikimori {
             name: profileString(profile.nickname),
             email: null,
             image: image ?? profileString(profile.avatar),
-            raw: profile
+            raw: profile,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/slack.d.ts

@@ -1,14 +1,14 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface SlackOptions extends ProviderOptions {
 }
 export declare class Slack {
     private client;
     private auth;
-    constructor(options: SlackOptions);
+    constructor(options?: SlackOptions);
     constructor(clientId: string, clientSecret: string, redirectURI: string | null);
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/slack.js

@@ -1,6 +1,6 @@
 import { OAuth2Client } from "../client.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes } from "../auth.js";
 const authorizationEndpoint = "https://slack.com/openid/connect/authorize";
 const tokenEndpoint = "https://slack.com/api/openid.connect.token";
 const userinfoEndpoint = "https://slack.com/api/openid.connect.userInfo";
@@ -9,7 +9,7 @@ const defaultScopes = ["openid", "profile", "email"];
 export class Slack {
     client;
     auth = null;
-    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+    constructor(clientIdOrOptions = {}, clientSecret, redirectURI) {
         if (typeof clientIdOrOptions === "object") {
             this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, { clientSecret: true });
             this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
@@ -30,13 +30,13 @@ export class Slack {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        return { url, state, payload };
     }
-    async getUser(query) {
-        const auth = requireAuthConfig(this.auth);
+    async getUser(query, saved) {
+        requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        resolveOAuthState(state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         let claims;
         if ("id_token" in tokens.data) {
@@ -54,7 +54,8 @@ export class Slack {
             name: profileString(claims.name),
             email: profileString(claims.email),
             image: profileString(claims.picture),
-            raw: claims
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/spotify.d.ts

@@ -1,15 +1,15 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface SpotifyOptions extends ProviderOptions {
 }
 export declare class Spotify {
     private client;
     private auth;
-    constructor(options: SpotifyOptions);
+    constructor(options?: SpotifyOptions);
     constructor(clientId: string, clientSecret: string | null, redirectURI: string);
     createAuthorizationURL(state: string, codeVerifier: string | null, scopes: string[]): Promise<URL>;
     validateAuthorizationCode(code: string, codeVerifier: string | null): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
 }