create-croissant 0.1.0 → 0.1.1

package/template/apps/web/node_modules/@better-auth/core/dist/instrumentation/tracer.mjs

@@ -0,0 +1,53 @@
+import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
+import { getOpenTelemetryAPI } from "./api.mjs";
+//#region src/instrumentation/tracer.ts
+const INSTRUMENTATION_SCOPE = "better-auth";
+const INSTRUMENTATION_VERSION = "1.6.6";
+/**
+* Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth
+* callbacks). These are APIErrors with 3xx status codes and should not be
+* recorded as span errors.
+*/
+function isRedirectError(err) {
+	if (err != null && typeof err === "object" && "name" in err && err.name === "APIError" && "statusCode" in err) {
+		const status = err.statusCode;
+		return status >= 300 && status < 400;
+	}
+	return false;
+}
+function endSpanWithError(span, err) {
+	const { SpanStatusCode } = getOpenTelemetryAPI();
+	if (isRedirectError(err)) {
+		span.setAttribute(ATTR_HTTP_RESPONSE_STATUS_CODE, err.statusCode);
+		span.setStatus({ code: SpanStatusCode.OK });
+	} else {
+		span.recordException(err);
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: String(err?.message ?? err)
+		});
+	}
+	span.end();
+}
+function withSpan(name, attributes, fn) {
+	const { trace } = getOpenTelemetryAPI();
+	return trace.getTracer(INSTRUMENTATION_SCOPE, INSTRUMENTATION_VERSION).startActiveSpan(name, { attributes }, (span) => {
+		try {
+			const result = fn();
+			if (result instanceof Promise) return result.then((value) => {
+				span.end();
+				return value;
+			}).catch((err) => {
+				endSpanWithError(span, err);
+				throw err;
+			});
+			span.end();
+			return result;
+		} catch (err) {
+			endSpanWithError(span, err);
+			throw err;
+		}
+	});
+}
+//#endregion
+export { withSpan };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/client-credentials-token.d.mts

@@ -0,0 +1,56 @@
+import { AwaitableFunction } from "../types/helper.mjs";
+import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
+
+//#region src/oauth2/client-credentials-token.d.ts
+declare function clientCredentialsTokenRequest({
+  options,
+  scope,
+  authentication,
+  resource
+}: {
+  options: AwaitableFunction<ProviderOptions & {
+    clientSecret: string;
+  }>;
+  scope?: string | undefined;
+  authentication?: ("basic" | "post") | undefined;
+  resource?: (string | string[]) | undefined;
+}): Promise<{
+  body: URLSearchParams;
+  headers: Record<string, any>;
+}>;
+/**
+ * @deprecated use async'd clientCredentialsTokenRequest instead
+ */
+declare function createClientCredentialsTokenRequest({
+  options,
+  scope,
+  authentication,
+  resource
+}: {
+  options: ProviderOptions & {
+    clientSecret: string;
+  };
+  scope?: string | undefined;
+  authentication?: ("basic" | "post") | undefined;
+  resource?: (string | string[]) | undefined;
+}): {
+  body: URLSearchParams;
+  headers: Record<string, any>;
+};
+declare function clientCredentialsToken({
+  options,
+  tokenEndpoint,
+  scope,
+  authentication,
+  resource
+}: {
+  options: AwaitableFunction<ProviderOptions & {
+    clientSecret: string;
+  }>;
+  tokenEndpoint: string;
+  scope: string;
+  authentication?: ("basic" | "post") | undefined;
+  resource?: (string | string[]) | undefined;
+}): Promise<OAuth2Tokens>;
+//#endregion
+export { clientCredentialsToken, clientCredentialsTokenRequest, createClientCredentialsTokenRequest };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/client-credentials-token.mjs

@@ -0,0 +1,64 @@
+import { base64Url } from "@better-auth/utils/base64";
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/oauth2/client-credentials-token.ts
+async function clientCredentialsTokenRequest({ options, scope, authentication, resource }) {
+	options = typeof options === "function" ? await options() : options;
+	return createClientCredentialsTokenRequest({
+		options,
+		scope,
+		authentication,
+		resource
+	});
+}
+/**
+* @deprecated use async'd clientCredentialsTokenRequest instead
+*/
+function createClientCredentialsTokenRequest({ options, scope, authentication, resource }) {
+	const body = new URLSearchParams();
+	const headers = {
+		"content-type": "application/x-www-form-urlencoded",
+		accept: "application/json"
+	};
+	body.set("grant_type", "client_credentials");
+	scope && body.set("scope", scope);
+	if (resource) if (typeof resource === "string") body.append("resource", resource);
+	else for (const _resource of resource) body.append("resource", _resource);
+	if (authentication === "basic") {
+		const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+		headers["authorization"] = `Basic ${base64Url.encode(`${primaryClientId}:${options.clientSecret}`)}`;
+	} else {
+		const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+		body.set("client_id", primaryClientId);
+		body.set("client_secret", options.clientSecret);
+	}
+	return {
+		body,
+		headers
+	};
+}
+async function clientCredentialsToken({ options, tokenEndpoint, scope, authentication, resource }) {
+	const { body, headers } = await clientCredentialsTokenRequest({
+		options,
+		scope,
+		authentication,
+		resource
+	});
+	const { data, error } = await betterFetch(tokenEndpoint, {
+		method: "POST",
+		body,
+		headers
+	});
+	if (error) throw error;
+	const tokens = {
+		accessToken: data.access_token,
+		tokenType: data.token_type,
+		scopes: data.scope?.split(" ")
+	};
+	if (data.expires_in) {
+		const now = /* @__PURE__ */ new Date();
+		tokens.accessTokenExpiresAt = new Date(now.getTime() + data.expires_in * 1e3);
+	}
+	return tokens;
+}
+//#endregion
+export { clientCredentialsToken, clientCredentialsTokenRequest, createClientCredentialsTokenRequest };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/create-authorization-url.d.mts

@@ -0,0 +1,44 @@
+import { AwaitableFunction } from "../types/helper.mjs";
+import { ProviderOptions } from "./oauth-provider.mjs";
+//#region src/oauth2/create-authorization-url.d.ts
+declare function createAuthorizationURL({
+  id,
+  options,
+  authorizationEndpoint,
+  state,
+  codeVerifier,
+  scopes,
+  claims,
+  redirectURI,
+  duration,
+  prompt,
+  accessType,
+  responseType,
+  display,
+  loginHint,
+  hd,
+  responseMode,
+  additionalParams,
+  scopeJoiner
+}: {
+  id: string;
+  options: AwaitableFunction<ProviderOptions>;
+  redirectURI: string;
+  authorizationEndpoint: string;
+  state: string;
+  codeVerifier?: string | undefined;
+  scopes?: string[] | undefined;
+  claims?: string[] | undefined;
+  duration?: string | undefined;
+  prompt?: string | undefined;
+  accessType?: string | undefined;
+  responseType?: string | undefined;
+  display?: string | undefined;
+  loginHint?: string | undefined;
+  hd?: string | undefined;
+  responseMode?: string | undefined;
+  additionalParams?: Record<string, string> | undefined;
+  scopeJoiner?: string | undefined;
+}): Promise<URL>;
+//#endregion
+export { createAuthorizationURL };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/create-authorization-url.mjs

@@ -0,0 +1,41 @@
+import { generateCodeChallenge } from "./utils.mjs";
+//#region src/oauth2/create-authorization-url.ts
+async function createAuthorizationURL({ id, options, authorizationEndpoint, state, codeVerifier, scopes, claims, redirectURI, duration, prompt, accessType, responseType, display, loginHint, hd, responseMode, additionalParams, scopeJoiner }) {
+	options = typeof options === "function" ? await options() : options;
+	const url = new URL(options.authorizationEndpoint || authorizationEndpoint);
+	url.searchParams.set("response_type", responseType || "code");
+	const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+	url.searchParams.set("client_id", primaryClientId);
+	url.searchParams.set("state", state);
+	if (scopes) url.searchParams.set("scope", scopes.join(scopeJoiner || " "));
+	url.searchParams.set("redirect_uri", options.redirectURI || redirectURI);
+	duration && url.searchParams.set("duration", duration);
+	display && url.searchParams.set("display", display);
+	loginHint && url.searchParams.set("login_hint", loginHint);
+	prompt && url.searchParams.set("prompt", prompt);
+	hd && url.searchParams.set("hd", hd);
+	accessType && url.searchParams.set("access_type", accessType);
+	responseMode && url.searchParams.set("response_mode", responseMode);
+	if (codeVerifier) {
+		const codeChallenge = await generateCodeChallenge(codeVerifier);
+		url.searchParams.set("code_challenge_method", "S256");
+		url.searchParams.set("code_challenge", codeChallenge);
+	}
+	if (claims) {
+		const claimsObj = claims.reduce((acc, claim) => {
+			acc[claim] = null;
+			return acc;
+		}, {});
+		url.searchParams.set("claims", JSON.stringify({ id_token: {
+			email: null,
+			email_verified: null,
+			...claimsObj
+		} }));
+	}
+	if (additionalParams) Object.entries(additionalParams).forEach(([key, value]) => {
+		url.searchParams.set(key, value);
+	});
+	return url;
+}
+//#endregion
+export { createAuthorizationURL };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/index.d.mts

@@ -0,0 +1,8 @@
+import { OAuth2Tokens, OAuth2UserInfo, OAuthProvider, ProviderOptions } from "./oauth-provider.mjs";
+import { clientCredentialsToken, clientCredentialsTokenRequest, createClientCredentialsTokenRequest } from "./client-credentials-token.mjs";
+import { createAuthorizationURL } from "./create-authorization-url.mjs";
+import { createRefreshAccessTokenRequest, refreshAccessToken, refreshAccessTokenRequest } from "./refresh-access-token.mjs";
+import { generateCodeChallenge, getOAuth2Tokens } from "./utils.mjs";
+import { authorizationCodeRequest, createAuthorizationCodeRequest, validateAuthorizationCode, validateToken } from "./validate-authorization-code.mjs";
+import { getJwks, verifyAccessToken, verifyJwsAccessToken } from "./verify.mjs";
+export { type OAuth2Tokens, type OAuth2UserInfo, type OAuthProvider, type ProviderOptions, authorizationCodeRequest, clientCredentialsToken, clientCredentialsTokenRequest, createAuthorizationCodeRequest, createAuthorizationURL, createClientCredentialsTokenRequest, createRefreshAccessTokenRequest, generateCodeChallenge, getJwks, getOAuth2Tokens, refreshAccessToken, refreshAccessTokenRequest, validateAuthorizationCode, validateToken, verifyAccessToken, verifyJwsAccessToken };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/index.mjs

@@ -0,0 +1,7 @@
+import { clientCredentialsToken, clientCredentialsTokenRequest, createClientCredentialsTokenRequest } from "./client-credentials-token.mjs";
+import { generateCodeChallenge, getOAuth2Tokens } from "./utils.mjs";
+import { createAuthorizationURL } from "./create-authorization-url.mjs";
+import { createRefreshAccessTokenRequest, refreshAccessToken, refreshAccessTokenRequest } from "./refresh-access-token.mjs";
+import { authorizationCodeRequest, createAuthorizationCodeRequest, validateAuthorizationCode, validateToken } from "./validate-authorization-code.mjs";
+import { getJwks, verifyAccessToken, verifyJwsAccessToken } from "./verify.mjs";
+export { authorizationCodeRequest, clientCredentialsToken, clientCredentialsTokenRequest, createAuthorizationCodeRequest, createAuthorizationURL, createClientCredentialsTokenRequest, createRefreshAccessTokenRequest, generateCodeChallenge, getJwks, getOAuth2Tokens, refreshAccessToken, refreshAccessTokenRequest, validateAuthorizationCode, validateToken, verifyAccessToken, verifyJwsAccessToken };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/oauth-provider.d.mts

@@ -0,0 +1,192 @@
+import { Awaitable, LiteralString } from "../types/helper.mjs";
+//#region src/oauth2/oauth-provider.d.ts
+interface OAuth2Tokens {
+  tokenType?: string | undefined;
+  accessToken?: string | undefined;
+  refreshToken?: string | undefined;
+  accessTokenExpiresAt?: Date | undefined;
+  refreshTokenExpiresAt?: Date | undefined;
+  scopes?: string[] | undefined;
+  idToken?: string | undefined;
+  /**
+   * Raw token response from the provider.
+   * Preserves provider-specific fields that are not part of the standard OAuth2 token response.
+   */
+  raw?: Record<string, unknown> | undefined;
+}
+type OAuth2UserInfo = {
+  id: string | number;
+  name?: string | undefined;
+  email?: (string | null) | undefined;
+  image?: string | undefined;
+  emailVerified: boolean;
+};
+interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O extends Record<string, any> = Partial<ProviderOptions>> {
+  id: LiteralString;
+  createAuthorizationURL: (data: {
+    state: string;
+    codeVerifier: string;
+    scopes?: string[] | undefined;
+    redirectURI: string;
+    display?: string | undefined;
+    loginHint?: string | undefined;
+  }) => Awaitable<URL>;
+  name: string;
+  validateAuthorizationCode: (data: {
+    code: string;
+    redirectURI: string;
+    codeVerifier?: string | undefined;
+    deviceId?: string | undefined;
+  }) => Promise<OAuth2Tokens | null>;
+  getUserInfo: (token: OAuth2Tokens & {
+    /**
+     * The user object from the provider
+     * This is only available for some providers like Apple
+     */
+    user?: {
+      name?: {
+        firstName?: string;
+        lastName?: string;
+      };
+      email?: string;
+    } | undefined;
+  }) => Promise<{
+    user: OAuth2UserInfo;
+    data: T;
+  } | null>;
+  /**
+   * Custom function to refresh a token
+   */
+  refreshAccessToken?: ((refreshToken: string) => Promise<OAuth2Tokens>) | undefined;
+  revokeToken?: ((token: string) => Promise<void>) | undefined;
+  /**
+   * Verify the id token
+   * @param token - The id token
+   * @param nonce - The nonce
+   * @returns True if the id token is valid, false otherwise
+   */
+  verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  /**
+   * Disable implicit sign up for new users. When set to true for the provider,
+   * sign-in need to be called with with requestSignUp as true to create new users.
+   */
+  disableImplicitSignUp?: boolean | undefined;
+  /**
+   * Disable sign up for new users.
+   */
+  disableSignUp?: boolean | undefined;
+  /**
+   * Options for the provider
+   */
+  options?: O | undefined;
+}
+type ProviderOptions<Profile extends Record<string, any> = any> = {
+  /**
+   * The client ID of your application.
+   *
+   * This is usually a string but can be any type depending on the provider.
+   */
+  clientId?: unknown | undefined;
+  /**
+   * The client secret of your application
+   */
+  clientSecret?: string | undefined;
+  /**
+   * The scopes you want to request from the provider
+   */
+  scope?: string[] | undefined;
+  /**
+   * Remove default scopes of the provider
+   */
+  disableDefaultScope?: boolean | undefined;
+  /**
+   * The redirect URL for your application. This is where the provider will
+   * redirect the user after the sign in process. Make sure this URL is
+   * whitelisted in the provider's dashboard.
+   */
+  redirectURI?: string | undefined;
+  /**
+   * Custom authorization endpoint URL.
+   * Use this to override the default authorization endpoint of the provider.
+   * Useful for testing with local OAuth servers or using sandbox environments.
+   */
+  authorizationEndpoint?: string | undefined;
+  /**
+   * The client key of your application
+   * Tiktok Social Provider uses this field instead of clientId
+   */
+  clientKey?: string | undefined;
+  /**
+   * Disable provider from allowing users to sign in
+   * with this provider with an id token sent from the
+   * client.
+   */
+  disableIdTokenSignIn?: boolean | undefined;
+  /**
+   * verifyIdToken function to verify the id token
+   */
+  verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  /**
+   * Custom function to get user info from the provider
+   */
+  getUserInfo?: ((token: OAuth2Tokens) => Promise<{
+    user: {
+      id: string;
+      name?: string;
+      email?: string | null;
+      image?: string;
+      emailVerified: boolean;
+      [key: string]: any;
+    };
+    data: any;
+  } | null>) | undefined;
+  /**
+   * Custom function to refresh a token
+   */
+  refreshAccessToken?: ((refreshToken: string) => Promise<OAuth2Tokens>) | undefined;
+  /**
+   * Custom function to map the provider profile to a
+   * user.
+   */
+  mapProfileToUser?: ((profile: Profile) => {
+    id?: string;
+    name?: string;
+    email?: string | null;
+    image?: string;
+    emailVerified?: boolean;
+    [key: string]: any;
+  } | Promise<{
+    id?: string;
+    name?: string;
+    email?: string | null;
+    image?: string;
+    emailVerified?: boolean;
+    [key: string]: any;
+  }>) | undefined;
+  /**
+   * Disable implicit sign up for new users. When set to true for the provider,
+   * sign-in need to be called with with requestSignUp as true to create new users.
+   */
+  disableImplicitSignUp?: boolean | undefined;
+  /**
+   * Disable sign up for new users.
+   */
+  disableSignUp?: boolean | undefined;
+  /**
+   * The prompt to use for the authorization code request
+   */
+  prompt?: ("select_account" | "consent" | "login" | "none" | "select_account consent") | undefined;
+  /**
+   * The response mode to use for the authorization code request
+   */
+  responseMode?: ("query" | "form_post") | undefined;
+  /**
+   * If enabled, the user info will be overridden with the provider user info
+   * This is useful if you want to use the provider user info to update the user info
+   *
+   * @default false
+   */
+  overrideUserInfoOnSignIn?: boolean | undefined;
+};
+//#endregion
+export { OAuth2Tokens, OAuth2UserInfo, OAuthProvider, ProviderOptions };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/refresh-access-token.d.mts

@@ -0,0 +1,54 @@
+import { AwaitableFunction } from "../types/helper.mjs";
+import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
+
+//#region src/oauth2/refresh-access-token.d.ts
+declare function refreshAccessTokenRequest({
+  refreshToken,
+  options,
+  authentication,
+  extraParams,
+  resource
+}: {
+  refreshToken: string;
+  options: AwaitableFunction<Partial<ProviderOptions>>;
+  authentication?: ("basic" | "post") | undefined;
+  extraParams?: Record<string, string> | undefined;
+  resource?: (string | string[]) | undefined;
+}): Promise<{
+  body: URLSearchParams;
+  headers: Record<string, any>;
+}>;
+/**
+ * @deprecated use async'd refreshAccessTokenRequest instead
+ */
+declare function createRefreshAccessTokenRequest({
+  refreshToken,
+  options,
+  authentication,
+  extraParams,
+  resource
+}: {
+  refreshToken: string;
+  options: ProviderOptions;
+  authentication?: ("basic" | "post") | undefined;
+  extraParams?: Record<string, string> | undefined;
+  resource?: (string | string[]) | undefined;
+}): {
+  body: URLSearchParams;
+  headers: Record<string, any>;
+};
+declare function refreshAccessToken({
+  refreshToken,
+  options,
+  tokenEndpoint,
+  authentication,
+  extraParams
+}: {
+  refreshToken: string;
+  options: Partial<ProviderOptions>;
+  tokenEndpoint: string;
+  authentication?: ("basic" | "post") | undefined;
+  extraParams?: Record<string, string> | undefined;
+}): Promise<OAuth2Tokens>;
+//#endregion
+export { createRefreshAccessTokenRequest, refreshAccessToken, refreshAccessTokenRequest };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/refresh-access-token.mjs

@@ -0,0 +1,73 @@
+import { base64 } from "@better-auth/utils/base64";
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/oauth2/refresh-access-token.ts
+async function refreshAccessTokenRequest({ refreshToken, options, authentication, extraParams, resource }) {
+	options = typeof options === "function" ? await options() : options;
+	return createRefreshAccessTokenRequest({
+		refreshToken,
+		options,
+		authentication,
+		extraParams,
+		resource
+	});
+}
+/**
+* @deprecated use async'd refreshAccessTokenRequest instead
+*/
+function createRefreshAccessTokenRequest({ refreshToken, options, authentication, extraParams, resource }) {
+	const body = new URLSearchParams();
+	const headers = {
+		"content-type": "application/x-www-form-urlencoded",
+		accept: "application/json"
+	};
+	body.set("grant_type", "refresh_token");
+	body.set("refresh_token", refreshToken);
+	if (authentication === "basic") {
+		const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+		if (primaryClientId) headers["authorization"] = "Basic " + base64.encode(`${primaryClientId}:${options.clientSecret ?? ""}`);
+		else headers["authorization"] = "Basic " + base64.encode(`:${options.clientSecret ?? ""}`);
+	} else {
+		const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+		body.set("client_id", primaryClientId);
+		if (options.clientSecret) body.set("client_secret", options.clientSecret);
+	}
+	if (resource) if (typeof resource === "string") body.append("resource", resource);
+	else for (const _resource of resource) body.append("resource", _resource);
+	if (extraParams) for (const [key, value] of Object.entries(extraParams)) body.set(key, value);
+	return {
+		body,
+		headers
+	};
+}
+async function refreshAccessToken({ refreshToken, options, tokenEndpoint, authentication, extraParams }) {
+	const { body, headers } = await createRefreshAccessTokenRequest({
+		refreshToken,
+		options,
+		authentication,
+		extraParams
+	});
+	const { data, error } = await betterFetch(tokenEndpoint, {
+		method: "POST",
+		body,
+		headers
+	});
+	if (error) throw error;
+	const tokens = {
+		accessToken: data.access_token,
+		refreshToken: data.refresh_token,
+		tokenType: data.token_type,
+		scopes: data.scope?.split(" "),
+		idToken: data.id_token
+	};
+	if (data.expires_in) {
+		const now = /* @__PURE__ */ new Date();
+		tokens.accessTokenExpiresAt = new Date(now.getTime() + data.expires_in * 1e3);
+	}
+	if (data.refresh_token_expires_in) {
+		const now = /* @__PURE__ */ new Date();
+		tokens.refreshTokenExpiresAt = new Date(now.getTime() + data.refresh_token_expires_in * 1e3);
+	}
+	return tokens;
+}
+//#endregion
+export { createRefreshAccessTokenRequest, refreshAccessToken, refreshAccessTokenRequest };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/utils.d.mts

@@ -0,0 +1,7 @@
+import { OAuth2Tokens } from "./oauth-provider.mjs";
+
+//#region src/oauth2/utils.d.ts
+declare function getOAuth2Tokens(data: Record<string, any>): OAuth2Tokens;
+declare function generateCodeChallenge(codeVerifier: string): Promise<string>;
+//#endregion
+export { generateCodeChallenge, getOAuth2Tokens };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/utils.mjs

@@ -0,0 +1,25 @@
+import { base64Url } from "@better-auth/utils/base64";
+//#region src/oauth2/utils.ts
+function getOAuth2Tokens(data) {
+	const getDate = (seconds) => {
+		const now = /* @__PURE__ */ new Date();
+		return new Date(now.getTime() + seconds * 1e3);
+	};
+	return {
+		tokenType: data.token_type,
+		accessToken: data.access_token,
+		refreshToken: data.refresh_token,
+		accessTokenExpiresAt: data.expires_in ? getDate(data.expires_in) : void 0,
+		refreshTokenExpiresAt: data.refresh_token_expires_in ? getDate(data.refresh_token_expires_in) : void 0,
+		scopes: data?.scope ? typeof data.scope === "string" ? data.scope.split(" ") : data.scope : [],
+		idToken: data.id_token,
+		raw: data
+	};
+}
+async function generateCodeChallenge(codeVerifier) {
+	const data = new TextEncoder().encode(codeVerifier);
+	const hash = await crypto.subtle.digest("SHA-256", data);
+	return base64Url.encode(new Uint8Array(hash), { padding: false });
+}
+//#endregion
+export { generateCodeChallenge, getOAuth2Tokens };