gemi 0.112.0 → 0.113.0

package/dist/app/index.js

@@ -1,4 +1,4 @@
 // @bun
-import{Ha as a}from"../chunk-ryzcfxq7.js";import"../chunk-5waxjsvv.js";import"../chunk-ddad3902.js";export{a as App};
+import{Ha as a}from"../chunk-kp7k4s5c.js";import"../chunk-fnkjmq94.js";import"../chunk-8mbyyh8j.js";export{a as App};
 
 //# debugId=288F3EAB17F12DE464756E2164756E21

package/dist/auth/AuthController.d.ts

@@ -109,12 +109,26 @@ export declare class AuthController extends Controller {
         destination: string;
     }>;
     oauthCallback(req?: HttpRequest<Record<string, never>, Record<string, never>>): Promise<{
-        session: any;
-        redirectTo?: undefined;
+        session: null;
+        error: string;
+        redirectTo: string | null;
     } | {
         session: import("./types").SessionWithUser;
         redirectTo: string;
     }>;
+    /**
+     * A refused OAuth callback: the reason code and the page the sign-in was
+     * meant to return to. With `auth.oauthFailurePath` set, the browser is
+     * redirected there as `?error=<code>&redirect=<page>`; otherwise the
+     * callback view renders with `{ session: null, error, redirectTo }`.
+     *
+     * Not a route — `protected` keeps it off the controller's public surface.
+     */
+    protected oauthFailure(req: HttpRequest<any, any>, error: string): {
+        session: null;
+        error: string;
+        redirectTo: string | null;
+    };
     /**
      * Step 2 of `oauthCallback`: an identity that resolved to nobody, matched by
      * email. Returns null when the callback must be refused.
@@ -124,7 +138,10 @@ export declare class AuthController extends Controller {
     protected linkOAuthAccount(args: {
         provider: string;
         providerId?: string;
+        /** Normalised: trimmed and lower-cased. */
         email: string;
+        /** As the provider returned it, for users stored before emails were normalised. */
+        rawEmail?: string;
         name?: string;
         username?: string;
         locale: string;

package/dist/auth/AuthController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthController.d.ts","sourceRoot":"","sources":["../../auth/AuthController.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASlD,OAAO,KAAK,EAAc,IAAI,EAAE,MAAM,SAAS,CAAC;AAuFhD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,yFAAyF;AACzF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAItD;AAKD,cAAM,aAAc,SAAQ,WAAW,CACrC;IACE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;;;;;MASJ;CACH;AAED,cAAM,qBAAsB,SAAQ,WAAW,CAC7C;IACE,KAAK,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;MAKJ;CACH;AAED,cAAM,oBAAqB,SAAQ,WAAW,CAC5C;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;MAKJ;CACH;AAED,qBAAa,cAAe,SAAQ,UAAU;IACtC,EAAE;IAUF,WAAW,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IAsBtD,mBAAmB,CAAC,GAAG,4DAAoB;;;;;;;IAwCjD;;;;;OAKG;YACW,gBAAgB;IA0BxB,eAAe,CACnB,GAAG;eAA4B,MAAM;aAAO,MAAM;6BAAK;IAqBnD,aAAa,CAAC,GAAG;eAA4B,MAAM;aAAO,MAAM;6BAAK;;;IAoBrE,QAAQ,CAAC,GAAG,gBAAsB;;;;;;;;;;IA+ClC,MAAM,CAAC,GAAG,gBAAsB;;;;;;;;;;IA+ChC,MAAM;IAyGN,OAAO,CAAC,GAAG,4DAAoB;IA8C/B,cAAc,CAAC,GAAG,wBAA8B;IAiChD,aAAa,CAAC,GAAG,uBAA6B;IAuD9C,cAAc,CAClB,GAAG;qBAAkC,MAAM;qBAAe,MAAM;6BAAK;IAuCjE,aAAa,CAAC,GAAG,4DAAoB;;;IA+BrC,aAAa,CAAC,GAAG,4DAAoB;;;;;;;IAoI3C;;;;;OAKG;cACa,gBAAgB,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;IAwFzD,oBAAoB,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IA0BrE;;;;;;;OAOG;IACG,gBAAgB,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IAuBjE;;;;;;;;;OASG;IACG,eAAe,CACnB,GAAG;eAA4B,MAAM;cAAQ,MAAM;eAAS,MAAM;6BAAK;;;;CAiF1E"}
+{"version":3,"file":"AuthController.d.ts","sourceRoot":"","sources":["../../auth/AuthController.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASlD,OAAO,KAAK,EAAc,IAAI,EAAE,MAAM,SAAS,CAAC;AA+FhD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,yFAAyF;AACzF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAItD;AA2BD,cAAM,aAAc,SAAQ,WAAW,CACrC;IACE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;;;;;MASJ;CACH;AAED,cAAM,qBAAsB,SAAQ,WAAW,CAC7C;IACE,KAAK,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;MAKJ;CACH;AAED,cAAM,oBAAqB,SAAQ,WAAW,CAC5C;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;MAKJ;CACH;AAED,qBAAa,cAAe,SAAQ,UAAU;IACtC,EAAE;IAUF,WAAW,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IAsBtD,mBAAmB,CAAC,GAAG,4DAAoB;;;;;;;IAwCjD;;;;;OAKG;YACW,gBAAgB;IA0BxB,eAAe,CACnB,GAAG;eAA4B,MAAM;aAAO,MAAM;6BAAK;IAqBnD,aAAa,CAAC,GAAG;eAA4B,MAAM;aAAO,MAAM;6BAAK;;;IAoBrE,QAAQ,CAAC,GAAG,gBAAsB;;;;;;;;;;IA+ClC,MAAM,CAAC,GAAG,gBAAsB;;;;;;;;;;IA+ChC,MAAM;IAyGN,OAAO,CAAC,GAAG,4DAAoB;IA8C/B,cAAc,CAAC,GAAG,wBAA8B;IAiChD,aAAa,CAAC,GAAG,uBAA6B;IAuD9C,cAAc,CAClB,GAAG;qBAAkC,MAAM;qBAAe,MAAM;6BAAK;IAuCjE,aAAa,CAAC,GAAG,4DAAoB;;;IAmDrC,aAAa,CAAC,GAAG,4DAAoB;iBA8M7B,IAAI;eAAS,MAAM;oBAAc,MAAM,GAAG,IAAI;;;;;IAX5D;;;;;;;OAOG;IACH,SAAS,CAAC,YAAY,CACpB,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,MAAM,GACZ;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAuB9D;;;;;OAKG;cACa,gBAAgB,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,2CAA2C;QAC3C,KAAK,EAAE,MAAM,CAAC;QACd,mFAAmF;QACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;IA+FzD,oBAAoB,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IA0BrE;;;;;;;OAOG;IACG,gBAAgB,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IAuBjE;;;;;;;;;OASG;IACG,eAAe,CACnB,GAAG;eAA4B,MAAM;cAAQ,MAAM;eAAS,MAAM;6BAAK;;;;CAiF1E"}

package/dist/auth/config.d.ts

@@ -152,6 +152,15 @@ export interface AuthConfig {
     migrateLegacySession?: LegacySessionMigrator | null;
     signUpRequest?: new () => HttpRequest<any, any>;
     oauthProviders?: Record<string, OAuthProvider>;
+    /**
+     * Where a failed OAuth callback sends the browser, with the reason as
+     * `?error=` (`access_denied`, `invalid_state`, `email_not_verified`, …) and
+     * the page the sign-in was meant to return to as `?redirect=`, when there was
+     * one. A same-origin path, typically the sign-in page. `null`, the default,
+     * renders the callback view with `{ session: null, error, redirectTo }`
+     * instead.
+     */
+    oauthFailurePath?: string | null;
     verifyPassword?: (password: string, hash: string) => Promise<boolean>;
     hashPassword?: (password: string) => Promise<string>;
     generateForgotPasswordToken?: (user: User) => Promise<string>;

package/dist/auth/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../auth/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,iGAAiG;IACjG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,GAAG,CAAC;IACb,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC;IAC3D,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE;IACH,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB,KACE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAGhC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6BAA6B,CAAC,EAAE,MAAM,CAAC;IAEvC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAEpD,aAAa,CAAC,EAAE,UAAU,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAE/C,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,2BAA2B,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC9B,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAGrE,aAAa,CAAC,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,IAAI,EACV,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,CACT,OAAO,EAAE,GAAG,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACnD,gBAAgB,CAAC,EAAE,CACjB,IAAI,EAAE,GAAG,EACT,iBAAiB,EAAE,MAAM,KACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,kBAAkB,CAAC,EAAE,CACnB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,KAChD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE1B,gGAAgG;IAChG,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,MAAM,KACV,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAEpE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACrE;AAcD,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,eAAoB,GAAG,QAAQ,CAAC,eAAe,CAAC,CAiCzF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAE/D;AAID,wBAAgB,kBAAkB,CAChC,MAAM,GAAE,UAAe,GACtB,QAAQ,CAAC,UAAU,CAAC,CA4CtB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../auth/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,iGAAiG;IACjG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,GAAG,CAAC;IACb,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC;IAC3D,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE;IACH,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB,KACE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAGhC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6BAA6B,CAAC,EAAE,MAAM,CAAC;IAEvC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAEpD,aAAa,CAAC,EAAE,UAAU,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,2BAA2B,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC9B,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAGrE,aAAa,CAAC,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,IAAI,EACV,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,CACT,OAAO,EAAE,GAAG,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACnD,gBAAgB,CAAC,EAAE,CACjB,IAAI,EAAE,GAAG,EACT,iBAAiB,EAAE,MAAM,KACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,kBAAkB,CAAC,EAAE,CACnB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,KAChD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE1B,gGAAgG;IAChG,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,MAAM,KACV,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAEpE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACrE;AAcD,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,eAAoB,GAAG,QAAQ,CAAC,eAAe,CAAC,CAiCzF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAE/D;AAID,wBAAgB,kBAAkB,CAChC,MAAM,GAAE,UAAe,GACtB,QAAQ,CAAC,UAAU,CAAC,CA6CtB"}

package/dist/auth/oauth/GoogleOAuthProvider.d.ts

@@ -1,29 +1,28 @@
 import type { HttpRequest } from "../../http/HttpRequest";
-import { OAuthProvider } from "./OAuthProvider";
+import { type OAuthAuthorizationContext, type OAuthCallbackContext, OAuthProvider, type OAuthProfile } from "./OAuthProvider";
 type Config = {
     clientId: string;
     scope: string;
     clientSecret: string;
+    /**
+     * The callback path, on `HOST_NAME`. Used for the `redirect_uri` of both the
+     * authorization URL and the token exchange, which Google requires to match.
+     */
     redirectPath: string;
+    /**
+     * Extra parameters for Google's authorization URL, such as
+     * `{ prompt: "select_account" }` or `{ hd: "example.com" }`. They cannot
+     * replace `state`, the PKCE challenge, `redirect_uri` or `client_id`.
+     */
+    authorizationParams: Record<string, string>;
 };
 export declare class GoogleOAuthProvider extends OAuthProvider {
-    config: {
-        clientId: string;
-        clientSecret: string;
-        redirectPath: string;
-        scope: string;
-    };
+    config: Config;
     constructor(config?: Partial<Config>);
-    getRedirectUrl(): string;
-    onCallback(req: HttpRequest): Promise<{
-        providerId?: undefined;
-        name?: undefined;
-        email?: undefined;
-    } | {
-        providerId: any;
-        name: any;
-        email: any;
-    }>;
+    /** `HOST_NAME` + `redirectPath`, the same for the authorization and the exchange. */
+    redirectUri(): string;
+    getRedirectUrl(_req?: HttpRequest, ctx?: OAuthAuthorizationContext): string;
+    onCallback(req: HttpRequest, ctx?: OAuthCallbackContext): Promise<OAuthProfile>;
 }
 export {};
 //# sourceMappingURL=GoogleOAuthProvider.d.ts.map

package/dist/auth/oauth/GoogleOAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GoogleOAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/GoogleOAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,KAAK,MAAM,GAAG;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAUF,qBAAa,mBAAoB,SAAQ,aAAa;IACpD,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;gBACU,MAAM,GAAE,OAAO,CAAC,MAAM,CAAM;IAKxC,cAAc;IAuBR,UAAU,CAAC,GAAG,EAAE,WAAW;;;;;;;;;CA+ClC"}
+{"version":3,"file":"GoogleOAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/GoogleOAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EAEzB,aAAa,EACb,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AAEzB,KAAK,MAAM,GAAG;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C,CAAC;AAgBF,qBAAa,mBAAoB,SAAQ,aAAa;IACpD,MAAM,EAAE,MAAM,CAAC;gBACH,MAAM,GAAE,OAAO,CAAC,MAAM,CAAM;IAKxC,qFAAqF;IACrF,WAAW;IAIX,cAAc,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,yBAAyB;IAuB5D,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;CAwDtF"}

package/dist/auth/oauth/OAuthProvider.d.ts

@@ -1,6 +1,56 @@
 import { HttpRequest } from "../../http/HttpRequest";
+/**
+ * What `oauthRedirect` hands `getRedirectUrl`: the round trip's `state` and
+ * PKCE challenge, which gemi has already stored for the callback to check.
+ *
+ * A provider puts `state` on the authorization URL **as is** — the callback is
+ * refused unless the provider echoes it back. `codeChallenge` goes on the URL
+ * too (with `code_challenge_method=S256`) for a provider that supports PKCE.
+ */
+export interface OAuthAuthorizationContext {
+    state: string;
+    codeChallenge: string;
+    codeChallengeMethod: "S256";
+}
+/**
+ * What `oauthCallback` hands `onCallback`, once the `state` has been checked:
+ * the PKCE verifier to send with the token exchange.
+ */
+export interface OAuthCallbackContext {
+    state: string;
+    codeVerifier: string;
+}
+export interface OAuthProfile {
+    email?: string;
+    /**
+     * Whether the provider says it has verified `email`. `false` refuses a
+     * callback that would sign in or create a user by that email; a provider that
+     * cannot tell leaves it undefined. Report it whenever the provider exposes it
+     * (Google's `email_verified`).
+     */
+    emailVerified?: boolean;
+    name?: string;
+    username?: string;
+    providerId?: string;
+}
+/**
+ * A failed callback, carrying the reason code the app is given (`?error=` on
+ * `auth.oauthFailurePath`, and `error` in the callback view's props). Throw it
+ * from `onCallback` for a failure with a known reason — `invalid_grant` from a
+ * token exchange, say. Any other error thrown there is reported as
+ * `provider_error`.
+ */
+export declare class OAuthCallbackError extends Error {
+    code: string;
+    constructor(code: string, message?: string);
+}
 export declare abstract class OAuthProvider {
-    abstract getRedirectUrl(req: HttpRequest): string | Promise<string>;
+    /**
+     * The provider's authorization URL. Put `ctx.state` on it unchanged — a
+     * callback whose `state` does not match is refused — and `ctx.codeChallenge`
+     * when the provider supports PKCE.
+     */
+    abstract getRedirectUrl(req: HttpRequest, ctx?: OAuthAuthorizationContext): string | Promise<string>;
     /**
      * `providerId` is the provider's stable account identifier (Google's `sub`,
      * X's user id) — the value the callback recognises a returning account by.
@@ -8,12 +58,11 @@ export declare abstract class OAuthProvider {
      * email: those change, and a matching one is not the same account. A provider
      * that returns none falls back to matching by `email`, and no `SocialAccount`
      * is written for it.
+     *
+     * Called only once the round trip's `state` has been verified, and never for
+     * a callback carrying `?error=`. Send `ctx.codeVerifier` with the token
+     * exchange when the authorization URL carried a challenge.
      */
-    abstract onCallback(req: HttpRequest): Promise<{
-        email?: string;
-        name?: string;
-        username?: string;
-        providerId?: string;
-    }>;
+    abstract onCallback(req: HttpRequest, ctx?: OAuthCallbackContext): Promise<OAuthProfile>;
 }
 //# sourceMappingURL=OAuthProvider.d.ts.map

package/dist/auth/oauth/OAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/OAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,8BAAsB,aAAa;IACjC,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CACjB,GAAG,EAAE,WAAW,GACf,OAAO,CAAC;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH"}
+{"version":3,"file":"OAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/OAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,IAAI,EAAE,MAAM,CAAC;gBACD,IAAI,EAAE,MAAM,EAAE,OAAO,SAAmC;CAKrE;AAED,8BAAsB,aAAa;IACjC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CACrB,GAAG,EAAE,WAAW,EAChB,GAAG,CAAC,EAAE,yBAAyB,GAC9B,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;CACzF"}

package/dist/auth/oauth/XOAuthProvider.d.ts

@@ -1,6 +1,6 @@
 import { type TOAuth2Scope, TwitterApi } from "twitter-api-v2";
 import { HttpRequest } from "../../http/HttpRequest";
-import { OAuthProvider } from "./OAuthProvider";
+import { type OAuthAuthorizationContext, type OAuthCallbackContext, OAuthProvider, type OAuthProfile } from "./OAuthProvider";
 type Config = {
     clientId: string;
     scope: TOAuth2Scope[];
@@ -10,15 +10,16 @@ type Config = {
 export declare class XOAuthProvider extends OAuthProvider {
     config: Config;
     client: TwitterApi;
-    private oauthStates;
     constructor(config?: Partial<Config>);
-    getRedirectUrl(): string;
-    onCallback(req: HttpRequest): Promise<{
-        name: any;
-        email: any;
-        username: any;
-        providerId: any;
-    }>;
+    redirectUri(): string;
+    /**
+     * Built here rather than with `generateOAuth2AuthLink`, which mints its own
+     * state and verifier: the round trip's are gemi's, kept in a cookie so that
+     * any process can finish it. They used to be kept in a `Map` on this
+     * instance, which a callback reaching another process could not find.
+     */
+    getRedirectUrl(_req?: HttpRequest, ctx?: OAuthAuthorizationContext): string;
+    onCallback(req: HttpRequest, ctx?: OAuthCallbackContext): Promise<OAuthProfile>;
 }
 export {};
 //# sourceMappingURL=XOAuthProvider.d.ts.map

package/dist/auth/oauth/XOAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"XOAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/XOAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE/D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,KAAK,MAAM,GAAG;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAcF,qBAAa,cAAe,SAAQ,aAAa;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IAEnB,OAAO,CAAC,WAAW,CAAsC;gBAE7C,MAAM,GAAE,OAAO,CAAC,MAAM,CAAM;IASxC,cAAc;IAaR,UAAU,CAAC,GAAG,EAAE,WAAW;;;;;;CA2BlC"}
+{"version":3,"file":"XOAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/XOAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EAEzB,aAAa,EACb,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AAEzB,KAAK,MAAM,GAAG;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AASF,qBAAa,cAAe,SAAQ,aAAa;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;gBAEP,MAAM,GAAE,OAAO,CAAC,MAAM,CAAM;IASxC,WAAW;IAIX;;;;;OAKG;IACH,cAAc,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,yBAAyB;IAoB5D,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;CAwBtF"}

package/dist/auth/oauth/oauthState.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The `state` and PKCE verifier of one OAuth round trip, kept in the browser
+ * that started it.
+ *
+ * `oauthRedirect` mints a random `state` and a PKCE `code_verifier`, sends the
+ * provider `state` and the verifier's S256 challenge, and writes both into a
+ * short-lived cookie. `oauthCallback` reads the cookie back, deletes it, and
+ * refuses the callback unless the `state` the provider echoed is the one in the
+ * cookie. That is what ties a callback to the browser that asked for it: a
+ * callback URL carrying someone else's `code` arrives without a matching cookie,
+ * and is refused instead of signing this browser into their account.
+ *
+ * The cookie, and not process memory: any process can finish a round trip any
+ * other process started.
+ *
+ * - **Signed** with the app's `SECRET` (HMAC-SHA256, domain-separated from the
+ *   other uses of that secret), so a tampered or hand-written cookie is refused.
+ * - **`HttpOnly`**, so page script never sees the verifier.
+ * - **`SameSite=Lax`**: the callback is a top-level navigation from the
+ *   provider's site, on which a `Strict` cookie is not sent.
+ * - **`__Host-` prefixed on https**: a browser accepts such a cookie only from
+ *   this exact host, `Secure`, `Path=/` and without `Domain`, so a sibling
+ *   subdomain cannot plant one of its own (cookie tossing).
+ * - **Ten minutes**, in the cookie's `Max-Age` and again in the signed payload.
+ * - **Single use**: the callback deletes it whatever the outcome, and a state
+ *   that has been consumed is also remembered by this process until it would
+ *   have expired.
+ */
+export declare const OAUTH_STATE_TTL_SECONDS: number;
+export declare function oauthStateCookieName(secure: boolean): string;
+export interface OAuthStatePayload {
+    /** The provider key the round trip was started for. */
+    provider: string;
+    state: string;
+    codeVerifier: string;
+    /** Epoch milliseconds after which the round trip is refused. */
+    expiresAt: number;
+}
+/** A fresh `state` and PKCE pair. */
+export declare function createOAuthState(provider: string, now?: number): {
+    state: string;
+    codeVerifier: string;
+    codeChallenge: string;
+    cookieValue: string;
+};
+/** RFC 7636 S256: base64url(sha256(verifier)). */
+export declare function pkceChallenge(codeVerifier: string): string;
+export declare function sealOAuthState(payload: OAuthStatePayload): string;
+/** The payload of a cookie this app signed, or `null` for anything else. */
+export declare function openOAuthState(value: string | null | undefined): OAuthStatePayload | null;
+/** For tests. */
+export declare function clearConsumedOAuthStates(): void;
+export type OAuthStateCheck = {
+    ok: true;
+    payload: OAuthStatePayload;
+} | {
+    ok: false;
+    reason: "missing_state" | "invalid_state" | "expired_state";
+};
+/**
+ * Whether `returnedState` (the callback's `?state=`) completes the round trip
+ * recorded in `cookieValue` for `provider`. A successful check consumes it.
+ */
+export declare function verifyOAuthState(args: {
+    provider: string;
+    cookieValue: string | null | undefined;
+    returnedState: string | null | undefined;
+    now?: number;
+}): OAuthStateCheck;
+//# sourceMappingURL=oauthState.d.ts.map

package/dist/auth/oauth/oauthState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthState.d.ts","sourceRoot":"","sources":["../../../auth/oauth/oauthState.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,eAAO,MAAM,uBAAuB,QAAU,CAAC;AAK/C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAE5D;AAED,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;CACnB;AAiBD,qCAAqC;AACrC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAa;;;;;EAYlE;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAGjE;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI,CAwBzF;AAyBD,iBAAiB;AACjB,wBAAgB,wBAAwB,SAEvC;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,eAAe,CAAA;CAAE,CAAC;AAE/E;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,eAAe,CAgBlB"}

package/dist/auth/routes.d.ts

@@ -8,8 +8,9 @@ declare class OAuthViewRouter extends ViewRouter {
             destination: string;
         }>, Record<string, never>>;
         "/:provider/callback": import("../http/ViewRouter").ViewRoute<Record<string, never>, Promise<{
-            session: any;
-            redirectTo?: undefined;
+            session: null;
+            error: string;
+            redirectTo: string | null;
         } | {
             session: import("./types").SessionWithUser;
             redirectTo: string;

package/dist/auth/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,cAAM,eAAgB,SAAQ,UAAU;IACtC,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;;;MAMJ;CACH;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;MAMJ;CACH;AAED,qBAAa,aAAc,SAAQ,SAAS;IAC1C,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;;;;;;;MAiBJ;CACH"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,cAAM,eAAgB,SAAQ,UAAU;IACtC,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;;;;MAMJ;CACH;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;MAMJ;CACH;AAED,qBAAa,aAAc,SAAQ,SAAS;IAC1C,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;;;;;;;MAiBJ;CACH"}

package/dist/bun/plugin.js

@@ -1,4 +1,4 @@
 // @bun
-import{da as a}from"../chunk-es487acc.js";import"../chunk-csbc1fxa.js";import"../chunk-amvy4r59.js";import"../chunk-a9q2cr4w.js";import"../chunk-ddad3902.js";export{a as gemiPlugin};
+import{da as a}from"../chunk-bq5nqqeq.js";import"../chunk-6wymbbes.js";import"../chunk-rg4hhxj3.js";import"../chunk-571rvxe6.js";import"../chunk-8mbyyh8j.js";export{a as gemiPlugin};
 
 //# debugId=255F25075168278464756E2164756E21

package/dist/bun/preload.js

@@ -1,4 +1,4 @@
 // @bun
-import{da as k}from"../chunk-es487acc.js";import"../chunk-csbc1fxa.js";import"../chunk-amvy4r59.js";import"../chunk-a9q2cr4w.js";import{xa as j}from"../chunk-303mprnv.js";import"../chunk-ddad3902.js";var{plugin:q}=globalThis.Bun;q(k());var y=await j(process.cwd());for(let x of y.bun?.plugins??[])q(x);
+import{da as k}from"../chunk-bq5nqqeq.js";import"../chunk-6wymbbes.js";import"../chunk-rg4hhxj3.js";import"../chunk-571rvxe6.js";import{xa as j}from"../chunk-303mprnv.js";import"../chunk-8mbyyh8j.js";var{plugin:q}=globalThis.Bun;q(k());var y=await j(process.cwd());for(let x of y.bun?.plugins??[])q(x);
 
 //# debugId=E7ABFC04ABC989B264756E2164756E21