LanderDK/blitzware-node-web-sdk ? reverse-engineered prompt

Build me a Node.js OAuth login SDK that works with both Express and Koa, and make it easy to drop into a traditional server rendered app.

I want it to handle the full BlitzWare login flow for me, including login, logout, and the callback route, plus session handling so I can tell if a user is signed in on the home page. It should protect routes like a profile page, redirect unauthenticated users to login, and expose the logged in user on the session. Please include support for PKCE and state so the flow is secure, and make the setup feel simple with one config object and environment variables for client id, client secret, redirect URI, and session secret.

If you need current docs or best practices for Express or Koa, look them up online. Also include a couple of working examples I can run right away.