gemi 0.183.1 → 0.184.0

package/dist/auth/AuthController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthController.d.ts","sourceRoot":"","sources":["../../auth/AuthController.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAelD,OAAO,KAAK,EAAc,IAAI,EAAE,MAAM,SAAS,CAAC;AAgGhD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,yFAAyF;AACzF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAItD;AAoCD,cAAM,aAAc,SAAQ,WAAW,CACrC;IACE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;;;;;MASJ;CACH;AAED,cAAM,qBAAsB,SAAQ,WAAW,CAC7C;IACE,KAAK,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;MAKJ;CACH;AAED,cAAM,oBAAqB,SAAQ,WAAW,CAC5C;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;MAKJ;CACH;AA8DD,qBAAa,cAAe,SAAQ,UAAU;IACtC,EAAE;IAUF,WAAW,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IAuBtD,mBAAmB,CAAC,GAAG,4DAAoB;;;;;;;IAoDjD;;;;;OAKG;YACW,gBAAgB;IAiCxB,eAAe,CACnB,GAAG;eAA4B,MAAM;aAAO,MAAM;6BAAK;IAqBnD,aAAa,CAAC,GAAG;eAA4B,MAAM;aAAO,MAAM;6BAAK;;;IAoBrE,QAAQ,CAAC,GAAG,gBAAsB;;;;;;;;;;;IAkDlC,MAAM,CAAC,GAAG,gBAAsB;;;;;;;;;;;IAkDhC,MAAM;IAsHN,OAAO,CAAC,GAAG,4DAAoB;IAiD/B,cAAc,CAAC,GAAG,wBAA8B;IAoChD,aAAa,CAAC,GAAG,uBAA6B;IA0D9C,cAAc,CAClB,GAAG;qBAAkC,MAAM;qBAAe,MAAM;6BAAK;IA2CjE,aAAa,CAAC,GAAG,4DAAoB;;;IAwDrC,aAAa,CAAC,GAAG,4DAAoB;iBAmT7B,IAAI;eAAS,MAAM;oBAAc,MAAM,GAAG,IAAI;;;;;IAhD5D;;;;;;OAMG;cACa,2BAA2B,CAAC,IAAI,EAAE;QAChD,+DAA+D;QAC/D,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBjB;;;;;;;OAOG;IACH,SAAS,CAAC,YAAY,CACpB,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,MAAM,GACZ;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAuB9D;;;;;OAKG;cACa,gBAAgB,CAAC,IAAI,EAAE;QACrC,+DAA+D;QAC/D,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,2CAA2C;QAC3C,KAAK,EAAE,MAAM,CAAC;QACd,mFAAmF;QACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf;;;;WAIG;QACH,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB;;;WAGG;QACH,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GAAG,OAAO,CACT;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,IAAI,CAC1F;IAsGK,oBAAoB,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IA2BrE;;;;;;;OAOG;IACG,gBAAgB,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IAqBjE;;;;;;;;;OASG;IACG,eAAe,CACnB,GAAG;eAA4B,MAAM;cAAQ,MAAM;eAAS,MAAM;6BAAK;;;;CAyF1E"}
+{"version":3,"file":"AuthController.d.ts","sourceRoot":"","sources":["../../auth/AuthController.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAelD,OAAO,KAAK,EAAc,IAAI,EAAE,MAAM,SAAS,CAAC;AAgGhD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,yFAAyF;AACzF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAItD;AAoCD,cAAM,aAAc,SAAQ,WAAW,CACrC;IACE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;;;;;MASJ;CACH;AAED,cAAM,qBAAsB,SAAQ,WAAW,CAC7C;IACE,KAAK,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;MAKJ;CACH;AAED,cAAM,oBAAqB,SAAQ,WAAW,CAC5C;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;MAKJ;CACH;AA8DD,qBAAa,cAAe,SAAQ,UAAU;IACtC,EAAE;IAUF,WAAW,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IAuBtD,mBAAmB,CAAC,GAAG,4DAAoB;;;;;;;IAoDjD;;;;;OAKG;YACW,gBAAgB;IAiCxB,eAAe,CACnB,GAAG;eAA4B,MAAM;aAAO,MAAM;6BAAK;IAqBnD,aAAa,CAAC,GAAG;eAA4B,MAAM;aAAO,MAAM;6BAAK;;;IAoBrE,QAAQ,CAAC,GAAG,gBAAsB;;;;;;;;;;;IAkDlC,MAAM,CAAC,GAAG,gBAAsB;;;;;;;;;;;IAkDhC,MAAM;IAsHN,OAAO,CAAC,GAAG,4DAAoB;IAiD/B,cAAc,CAAC,GAAG,wBAA8B;IAoChD,aAAa,CAAC,GAAG,uBAA6B;IA0D9C,cAAc,CAClB,GAAG;qBAAkC,MAAM;qBAAe,MAAM;6BAAK;IA2CjE,aAAa,CAAC,GAAG,4DAAoB;;;IAkErC,aAAa,CAAC,GAAG,4DAAoB;iBA8T7B,IAAI;eAAS,MAAM;oBAAc,MAAM,GAAG,IAAI;;;;;IAhD5D;;;;;;OAMG;cACa,2BAA2B,CAAC,IAAI,EAAE;QAChD,+DAA+D;QAC/D,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBjB;;;;;;;OAOG;IACH,SAAS,CAAC,YAAY,CACpB,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,MAAM,GACZ;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAuB9D;;;;;OAKG;cACa,gBAAgB,CAAC,IAAI,EAAE;QACrC,+DAA+D;QAC/D,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,2CAA2C;QAC3C,KAAK,EAAE,MAAM,CAAC;QACd,mFAAmF;QACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf;;;;WAIG;QACH,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB;;;WAGG;QACH,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GAAG,OAAO,CACT;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,IAAI,CAC1F;IAsGK,oBAAoB,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IA2BrE;;;;;;;OAOG;IACG,gBAAgB,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IAqBjE;;;;;;;;;OASG;IACG,eAAe,CACnB,GAAG;eAA4B,MAAM;cAAQ,MAAM;eAAS,MAAM;6BAAK;;;;CAyF1E"}

package/dist/auth/oauth/GitHubOAuthProvider.d.ts

@@ -0,0 +1,60 @@
+import type { HttpRequest } from "../../http/HttpRequest";
+import { type OAuthClientResolver, type ResolvedOAuthClient } from "./client";
+import { type OAuthAuthorizationContext, type OAuthCallbackContext, OAuthProvider, type OAuthProfile } from "./OAuthProvider";
+export interface GitHubOAuthProviderConfig {
+    /** The OAuth app's client id. Default `process.env.GITHUB_CLIENT_ID`. */
+    clientId: string;
+    /** The OAuth app's client secret. Default `process.env.GITHUB_CLIENT_SECRET`. */
+    clientSecret: string;
+    /**
+     * The callback path, on `HOST_NAME` (or the origin `resolve` answers): the
+     * `redirect_uri` of both the authorization URL and the code exchange.
+     * Default `/auth/oauth/github/callback`.
+     */
+    redirectPath: string;
+    /** Default `read:user user:email`: the profile, and the addresses to find the verified primary one. */
+    scope: string;
+    /**
+     * Extra parameters for GitHub's authorization URL, such as
+     * `{ allow_signup: "false" }` or `{ prompt: "select_account" }`. They cannot
+     * replace `state`, the PKCE challenge, `redirect_uri` or `client_id`.
+     */
+    authorizationParams: Record<string, string>;
+    /**
+     * The client and callback origin per request (#1140):
+     * `({ req, origin }) => ({ clientId, clientSecret, origin })`. What it
+     * leaves out comes from the options above; `null` turns the provider off
+     * for the request.
+     */
+    resolve?: OAuthClientResolver;
+}
+/**
+ * "Sign in with GitHub", through a GitHub OAuth app.
+ *
+ * ```ts
+ * oauthProviders: { github: new GitHubOAuthProvider() }
+ * ```
+ *
+ * The account's identity (`providerId`) is its numeric GitHub user id, as a
+ * string, never the login, which its owner can change and someone else can
+ * then take. The email is the account's **primary, verified** address from
+ * `GET /user/emails` (the `user:email` scope), reported with
+ * `emailVerified: true`. Without one (no verified primary address, or the
+ * scope was not granted) the profile's public email is returned, if any, as
+ * unverified, which the callback does not sign into an existing user by.
+ */
+export declare class GitHubOAuthProvider extends OAuthProvider {
+    config: GitHubOAuthProviderConfig;
+    constructor(config?: Partial<GitHubOAuthProviderConfig>);
+    /** The app origin (`HOST_NAME`, else `APP_URL`) + `redirectPath`, the same for the authorization and the exchange. */
+    redirectUri(): string;
+    protected clientFor(req: HttpRequest<any, any> | null): Promise<ResolvedOAuthClient>;
+    private staticClient;
+    /** Synchronous without `resolve`. */
+    getRedirectUrl(req?: HttpRequest, ctx?: OAuthAuthorizationContext): string | Promise<string>;
+    private authorizationUrl;
+    onCallback(req: HttpRequest, ctx?: OAuthCallbackContext): Promise<OAuthProfile>;
+    /** The primary address from `GET /user/emails` when it is verified, else `undefined`. */
+    private primaryVerifiedEmail;
+}
+//# sourceMappingURL=GitHubOAuthProvider.d.ts.map

package/dist/auth/oauth/GitHubOAuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubOAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/GitHubOAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,mBAAmB,EAAsB,MAAM,UAAU,CAAC;AAClG,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EAEzB,aAAa,EACb,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,yBAAyB;IACxC,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,uGAAuG;IACvG,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAiBD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,mBAAoB,SAAQ,aAAa;IACpD,MAAM,EAAE,yBAAyB,CAAC;gBAEtB,MAAM,GAAE,OAAO,CAAC,yBAAyB,CAAM;IAY3D,sHAAsH;IACtH,WAAW;cAIQ,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI;IAY9D,OAAO,CAAC,YAAY;IAQpB,qCAAqC;IACrC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,yBAAyB,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ5F,OAAO,CAAC,gBAAgB;IAkBlB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;IAqErF,yFAAyF;YAC3E,oBAAoB;CAanC"}

package/dist/auth/oauth/GoogleOAuthProvider.d.ts

@@ -1,12 +1,14 @@
 import type { HttpRequest } from "../../http/HttpRequest";
 import { type OAuthAuthorizationContext, type OAuthCallbackContext, OAuthProvider, type OAuthProfile } from "./OAuthProvider";
+import { type OAuthClientResolver, type ResolvedOAuthClient } from "./client";
 type Config = {
     clientId: string;
     scope: string;
     clientSecret: string;
     /**
-     * The callback path, on `HOST_NAME`. Used for the `redirect_uri` of both the
-     * authorization URL and the token exchange, which Google requires to match.
+     * The callback path, on `HOST_NAME` (or the origin `resolve` answers). Used
+     * for the `redirect_uri` of both the authorization URL and the token
+     * exchange, which Google requires to match.
      */
     redirectPath: string;
     /**
@@ -15,13 +17,26 @@ type Config = {
      * replace `state`, the PKCE challenge, `redirect_uri` or `client_id`.
      */
     authorizationParams: Record<string, string>;
+    /**
+     * The client and callback origin per request (#1140), for an app that
+     * serves several hosts with a Google client each:
+     * `({ req, origin }) => ({ clientId, clientSecret, origin })`. What it
+     * leaves out comes from the options above; `null` turns the provider off
+     * for the request. Without it, every request uses the static client and
+     * `HOST_NAME`.
+     */
+    resolve?: OAuthClientResolver;
 };
 export declare class GoogleOAuthProvider extends OAuthProvider {
     config: Config;
     constructor(config?: Partial<Config>);
     /** The app origin (`HOST_NAME`, else `APP_URL`) + `redirectPath`, the same for the authorization and the exchange. */
     redirectUri(): string;
-    getRedirectUrl(_req?: HttpRequest, ctx?: OAuthAuthorizationContext): string;
+    protected clientFor(req: HttpRequest<any, any> | null): Promise<ResolvedOAuthClient>;
+    /** Synchronous without `resolve`, as it has always been. */
+    getRedirectUrl(req?: HttpRequest, ctx?: OAuthAuthorizationContext): string | Promise<string>;
+    private staticClient;
+    private authorizationUrl;
     onCallback(req: HttpRequest, ctx?: OAuthCallbackContext): Promise<OAuthProfile>;
 }
 export {};

package/dist/auth/oauth/GoogleOAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GoogleOAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/GoogleOAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EAEzB,aAAa,EACb,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AAGzB,KAAK,MAAM,GAAG;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C,CAAC;AAgBF,qBAAa,mBAAoB,SAAQ,aAAa;IACpD,MAAM,EAAE,MAAM,CAAC;gBACH,MAAM,GAAE,OAAO,CAAC,MAAM,CAAM;IAKxC,sHAAsH;IACtH,WAAW;IAIX,cAAc,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,yBAAyB;IAuB5D,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;CAwDtF"}
+{"version":3,"file":"GoogleOAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/GoogleOAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EAEzB,aAAa,EACb,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,mBAAmB,EAAsB,MAAM,UAAU,CAAC;AAElG,KAAK,MAAM,GAAG;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B,CAAC;AAgBF,qBAAa,mBAAoB,SAAQ,aAAa;IACpD,MAAM,EAAE,MAAM,CAAC;gBACH,MAAM,GAAE,OAAO,CAAC,MAAM,CAAM;IAKxC,sHAAsH;IACtH,WAAW;cAIQ,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI;IAY9D,4DAA4D;IAC5D,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,yBAAyB,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU5F,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,gBAAgB;IAuBlB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;CA0DtF"}

package/dist/auth/oauth/InstagramOAuthProvider.d.ts

@@ -1,6 +1,7 @@
 import type { HttpRequest } from "../../http/HttpRequest";
 import { type InstagramEndpoints } from "./instagram";
 import { type OAuthAuthorizationContext, OAuthProvider, type OAuthProfile } from "./OAuthProvider";
+import { type OAuthClientResolver, type ResolvedOAuthClient } from "./client";
 export interface InstagramOAuthProviderConfig extends InstagramEndpoints {
     /** The Instagram app id. Default `process.env.INSTAGRAM_CLIENT_ID`. */
     clientId: string;
@@ -15,6 +16,13 @@ export interface InstagramOAuthProviderConfig extends InstagramEndpoints {
     redirectPath: string;
     /** Extra authorization URL parameters, e.g. `{ enable_fb_login: "false" }` or `{ force_reauth: "true" }`. */
     authorizationParams: Record<string, string>;
+    /**
+     * The app and callback origin per request (#1140):
+     * `({ req, origin }) => ({ clientId, clientSecret, origin })`. What it
+     * leaves out comes from the options above; `null` turns the provider off
+     * for the request.
+     */
+    resolve?: OAuthClientResolver;
 }
 /**
  * "Sign in with Instagram", through the Instagram API with Instagram Login.
@@ -40,7 +48,10 @@ export declare class InstagramOAuthProvider extends OAuthProvider {
     constructor(config?: Partial<InstagramOAuthProviderConfig>);
     /** The app origin (`HOST_NAME`, else `APP_URL`) + `redirectPath`, the same for the authorization and the exchange. */
     redirectUri(): string;
-    getRedirectUrl(_req?: HttpRequest, ctx?: OAuthAuthorizationContext): string;
+    protected clientFor(req: HttpRequest<any, any> | null): Promise<ResolvedOAuthClient>;
+    private staticClient;
+    getRedirectUrl(req?: HttpRequest, ctx?: OAuthAuthorizationContext): string | Promise<string>;
+    private authorizationUrl;
     onCallback(req: HttpRequest): Promise<OAuthProfile>;
 }
 //# sourceMappingURL=InstagramOAuthProvider.d.ts.map

package/dist/auth/oauth/InstagramOAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"InstagramOAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/InstagramOAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,kBAAkB,EAKxB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,yBAAyB,EAE9B,aAAa,EACb,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,WAAW,4BAA6B,SAAQ,kBAAkB;IACtE,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,6GAA6G;IAC7G,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,sBAAuB,SAAQ,aAAa;IAC9C,uBAAuB,UAAQ;IAE/B,WAAW,UAAS;IAE7B,MAAM,EAAE,4BAA4B,CAAC;gBAEzB,MAAM,GAAE,OAAO,CAAC,4BAA4B,CAAM;IAY9D,sHAAsH;IACtH,WAAW;IAIX,cAAc,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,yBAAyB;IAgB5D,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;CAkC1D"}
+{"version":3,"file":"InstagramOAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/InstagramOAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,kBAAkB,EAKxB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,yBAAyB,EAE9B,aAAa,EACb,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,mBAAmB,EAAsB,MAAM,UAAU,CAAC;AAElG,MAAM,WAAW,4BAA6B,SAAQ,kBAAkB;IACtE,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,6GAA6G;IAC7G,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,sBAAuB,SAAQ,aAAa;IAC9C,uBAAuB,UAAQ;IAE/B,WAAW,UAAS;IAE7B,MAAM,EAAE,4BAA4B,CAAC;gBAEzB,MAAM,GAAE,OAAO,CAAC,4BAA4B,CAAM;IAY9D,sHAAsH;IACtH,WAAW;cAIQ,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI;IAY9D,OAAO,CAAC,YAAY;IAQpB,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,yBAAyB,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ5F,OAAO,CAAC,gBAAgB;IAgBlB,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;CAoC1D"}

package/dist/auth/oauth/OAuthProvider.d.ts

@@ -1,4 +1,5 @@
 import { HttpRequest } from "../../http/HttpRequest";
+import type { ResolvedOAuthClient } from "./client";
 /**
  * What `oauthRedirect` hands `getRedirectUrl`: the round trip's `state` and
  * PKCE challenge, which gemi has already stored for the callback to check.
@@ -83,6 +84,28 @@ export declare abstract class OAuthProvider {
      * email. `createUsers = false` still refuses them with `signup_disabled`.
      */
     createUsersWithoutEmail?: boolean;
+    /**
+     * The client this provider uses for `req`, for a provider whose client or
+     * callback origin depends on the request (#1140). The built-in providers
+     * answer from their `resolve` option, else their static config. `null`:
+     * the provider is not offered on this request, so its routes answer 404 and
+     * `Auth.oauthProviders()` leaves it out. `undefined` (the default): the
+     * provider has no per-request client, and is always offered.
+     *
+     * `req` is `null` outside a request, where a per-request client cannot be
+     * resolved.
+     */
+    protected clientFor(_req: HttpRequest<any, any> | null): Promise<ResolvedOAuthClient | null | undefined>;
+    /** Whether this provider is offered on `req`: `clientFor` does not answer `null`. */
+    isAvailable(req: HttpRequest<any, any> | null): Promise<boolean>;
+    /**
+     * The `redirect_uri` this provider sends for `req`, when it has one to
+     * report. `oauthRedirect` keeps it with the round trip's state, and
+     * `oauthCallback` refuses a callback for which it answers otherwise
+     * (`redirect_mismatch`): the code is then exchanged by the client, and with
+     * the `redirect_uri`, that asked for it.
+     */
+    redirectUriFor(req: HttpRequest<any, any>): Promise<string | undefined>;
     /**
      * The provider's authorization URL. Put `ctx.state` on it unchanged — a
      * callback whose `state` does not match is refused — and `ctx.codeChallenge`

package/dist/auth/oauth/OAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/OAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,IAAI,EAAE,MAAM,CAAC;gBACD,IAAI,EAAE,MAAM,EAAE,OAAO,SAAmC;CAKrE;AAED,8BAAsB,aAAa;IACjC;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,OAAO,CAAQ;IAE7B;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAQ;IAE7B;;;;;;;;;;;OAWG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAS;IAE1C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CACrB,GAAG,EAAE,WAAW,EAChB,GAAG,CAAC,EAAE,yBAAyB,GAC9B,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;CACzF"}
+{"version":3,"file":"OAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/OAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,IAAI,EAAE,MAAM,CAAC;gBACD,IAAI,EAAE,MAAM,EAAE,OAAO,SAAmC;CAKrE;AAED,8BAAsB,aAAa;IACjC;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,OAAO,CAAQ;IAE7B;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAQ;IAE7B;;;;;;;;;;;OAWG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAS;IAE1C;;;;;;;;;;OAUG;IACH,SAAS,CAAC,SAAS,CACjB,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,GACjC,OAAO,CAAC,mBAAmB,GAAG,IAAI,GAAG,SAAS,CAAC;IAIlD,qFAAqF;IAC/E,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE;;;;;;OAMG;IACG,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAI7E;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CACrB,GAAG,EAAE,WAAW,EAChB,GAAG,CAAC,EAAE,yBAAyB,GAC9B,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;CACzF"}

package/dist/auth/oauth/XOAuthProvider.d.ts

@@ -1,24 +1,35 @@
 import { type TOAuth2Scope, TwitterApi } from "twitter-api-v2";
 import { HttpRequest } from "../../http/HttpRequest";
 import { type OAuthAuthorizationContext, type OAuthCallbackContext, OAuthProvider, type OAuthProfile } from "./OAuthProvider";
+import { type OAuthClientResolver, type ResolvedOAuthClient } from "./client";
 type Config = {
     clientId: string;
     scope: TOAuth2Scope[];
     clientSecret: string;
     redirectPath: string;
+    /**
+     * The client and callback origin per request (#1140):
+     * `({ req, origin }) => ({ clientId, clientSecret, origin })`. What it
+     * leaves out comes from the options above; `null` turns the provider off
+     * for the request.
+     */
+    resolve?: OAuthClientResolver;
 };
 export declare class XOAuthProvider extends OAuthProvider {
     config: Config;
     client: TwitterApi;
     constructor(config?: Partial<Config>);
     redirectUri(): string;
+    protected clientFor(req: HttpRequest<any, any> | null): Promise<ResolvedOAuthClient>;
+    private staticClient;
     /**
      * Built here rather than with `generateOAuth2AuthLink`, which mints its own
      * state and verifier: the round trip's are gemi's, kept in a cookie so that
      * any process can finish it. They used to be kept in a `Map` on this
      * instance, which a callback reaching another process could not find.
      */
-    getRedirectUrl(_req?: HttpRequest, ctx?: OAuthAuthorizationContext): string;
+    getRedirectUrl(req?: HttpRequest, ctx?: OAuthAuthorizationContext): string | Promise<string>;
+    private authorizationUrl;
     onCallback(req: HttpRequest, ctx?: OAuthCallbackContext): Promise<OAuthProfile>;
 }
 export {};

package/dist/auth/oauth/XOAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"XOAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/XOAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EAEzB,aAAa,EACb,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AAGzB,KAAK,MAAM,GAAG;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AASF,qBAAa,cAAe,SAAQ,aAAa;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;gBAEP,MAAM,GAAE,OAAO,CAAC,MAAM,CAAM;IASxC,WAAW;IAIX;;;;;OAKG;IACH,cAAc,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,yBAAyB;IAoB5D,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;CAwBtF"}
+{"version":3,"file":"XOAuthProvider.d.ts","sourceRoot":"","sources":["../../../auth/oauth/XOAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EAEzB,aAAa,EACb,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,mBAAmB,EAAsB,MAAM,UAAU,CAAC;AAElG,KAAK,MAAM,GAAG;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B,CAAC;AASF,qBAAa,cAAe,SAAQ,aAAa;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;gBAEP,MAAM,GAAE,OAAO,CAAC,MAAM,CAAM;IASxC,WAAW;cAIQ,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI;IAY9D,OAAO,CAAC,YAAY;IAQpB;;;;;OAKG;IACH,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,yBAAyB,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAW5F,OAAO,CAAC,gBAAgB;IAiBlB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;CA8BtF"}

package/dist/auth/oauth/client.d.ts

@@ -0,0 +1,69 @@
+import type { HttpRequest } from "../../http/HttpRequest";
+/**
+ * What a provider's `resolve` is asked with (#1140): the request that starts
+ * or finishes the sign-in, and the origin its client addressed.
+ */
+export interface OAuthClientContext {
+    req: HttpRequest<any, any>;
+    /**
+     * The request's public origin, `https://acme.example.com`: the one
+     * `route.domains` routes by, so behind a `trustProxy` proxy it is the
+     * forwarded host, not the one the proxy reached the app on. Without
+     * `route.domains`, the request URL's host, with the scheme of
+     * `X-Forwarded-Proto` when one is sent.
+     */
+    origin: string;
+}
+/**
+ * A provider's client for one request. Anything left out comes from the
+ * provider's static config: `clientId` and `clientSecret` from its options (or
+ * the environment), `origin` from `HOST_NAME` / `APP_URL`.
+ */
+export interface OAuthClient {
+    clientId?: string;
+    clientSecret?: string;
+    /**
+     * The origin the provider sends the browser back to: the `redirect_uri` is
+     * this + `redirectPath`. Pass `ctx.origin` to bring the user back to the host
+     * they started on, which the round trip's cookie needs (it is host-only).
+     */
+    origin?: string;
+}
+/**
+ * Picks a provider's client per request. `null` (or `undefined`) means the
+ * provider is not offered on this request: its routes answer 404 and
+ * `Auth.oauthProviders()` leaves it out, as with an `enabled` that is off.
+ */
+export type OAuthClientResolver = (ctx: OAuthClientContext) => OAuthClient | null | undefined | Promise<OAuthClient | null | undefined>;
+/** The client a built-in provider uses for one request. */
+export interface ResolvedOAuthClient {
+    clientId: string;
+    clientSecret: string;
+    /** Origin + `redirectPath`, the same for the authorization and the exchange. */
+    redirectUri: string;
+}
+/**
+ * The origin the client addressed, through the proxy in front if there is
+ * one: `route.domains`' resolver when the app has one, else the request URL's
+ * host with `X-Forwarded-Proto`'s scheme (TLS is nearly always terminated
+ * before the app, and a forged scheme only spoils the forger's own links).
+ */
+export declare function requestPublicOrigin(request: Request): string;
+/**
+ * The client `provider` uses for `req`: its static one when it has no
+ * `resolve`, else what `resolve` answers over it, asked once per request
+ * (the availability check, the authorization URL and the exchange share it).
+ * `null` when `resolve` answers that the provider is not offered, or when
+ * there is no request to ask it with.
+ */
+export declare function resolveOAuthClient(provider: object, req: HttpRequest<any, any> | null | undefined, args: {
+    name: string;
+    resolve?: OAuthClientResolver;
+    clientId: string;
+    clientSecret: string;
+    redirectPath: string;
+    /** The static `redirect_uri`, the provider's `redirectUri()`. */
+    staticRedirectUri: () => string;
+    staticOrigin: () => string;
+}): Promise<ResolvedOAuthClient | null>;
+//# sourceMappingURL=client.d.ts.map

package/dist/auth/oauth/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../auth/oauth/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,GAAG,EAAE,kBAAkB,KACpB,WAAW,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAE9E,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAe5D;AAgBD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,EAC7C,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,YAAY,EAAE,MAAM,MAAM,CAAC;CAC5B,GACA,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAiCrC"}

package/dist/auth/oauth/oauthState.d.ts

@@ -48,9 +48,15 @@ export interface OAuthStatePayload {
     subject?: string;
     /** A same-origin path to return to after the callback. */
     returnTo?: string;
+    /**
+     * The `redirect_uri` the authorization URL carried, when the provider
+     * reports one (#1140). The callback is refused if the provider answers
+     * another for it.
+     */
+    redirectUri?: string;
 }
 /** A fresh `state` and PKCE pair. */
-export declare function createOAuthState(provider: string, now?: number, extra?: Pick<OAuthStatePayload, "subject" | "returnTo">): {
+export declare function createOAuthState(provider: string, now?: number, extra?: Pick<OAuthStatePayload, "subject" | "returnTo" | "redirectUri">): {
     state: string;
     codeVerifier: string;
     codeChallenge: string;

package/dist/auth/oauth/oauthState.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthState.d.ts","sourceRoot":"","sources":["../../../auth/oauth/oauthState.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,eAAO,MAAM,uBAAuB,QAAU,CAAC;AAK/C;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,GAAE,MAAoB,GAAG,MAAM,CAGxF;AAED,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAiBD,qCAAqC;AACrC,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,GAAG,SAAa,EAChB,KAAK,GAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,UAAU,CAAM;;;;;EAe5D;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAGjE;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI,CA0BzF;AAyBD,iBAAiB;AACjB,wBAAgB,wBAAwB,SAEvC;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,eAAe,CAAA;CAAE,CAAC;AAE/E;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,eAAe,CAgBlB"}
+{"version":3,"file":"oauthState.d.ts","sourceRoot":"","sources":["../../../auth/oauth/oauthState.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,eAAO,MAAM,uBAAuB,QAAU,CAAC;AAK/C;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,GAAE,MAAoB,GAAG,MAAM,CAGxF;AAED,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAiBD,qCAAqC;AACrC,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,GAAG,SAAa,EAChB,KAAK,GAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,UAAU,GAAG,aAAa,CAAM;;;;;EAgB5E;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAGjE;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI,CA2BzF;AAyBD,iBAAiB;AACjB,wBAAgB,wBAAwB,SAEvC;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,eAAe,CAAA;CAAE,CAAC;AAE/E;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,eAAe,CAgBlB"}

package/dist/auth/oauth/providers.d.ts

@@ -3,8 +3,9 @@ import { type OAuthProviderEntry } from "../config";
 import type { OAuthProvider } from "./OAuthProvider";
 /**
  * The sign-in provider `name` names in `auth.oauthProviders`, or `null` when
- * there is none, its `feature` is off for this request (#885), or its
- * `enabled` answers false for it (#1135).
+ * there is none, its `feature` is off for this request (#885), its
+ * `enabled` answers false for it (#1135), or the provider itself is not
+ * offered on it (its `resolve` answers `null`, #1140).
  *
  * An `enabled` function is asked with `req`, else the ambient request. With
  * no request at all it answers off, as a feature read outside one does.

package/dist/auth/oauth/providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../../auth/oauth/providers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAoC,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAWrD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC7C,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAuB,GACnD,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAS/B;AAED,qFAAqF;AACrF,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC7C,GAAG,GAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAuB,GACnD,OAAO,CAAC,MAAM,EAAE,CAAC,CAMnB"}
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../../auth/oauth/providers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAoC,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAWrD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC7C,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAuB,GACnD,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAa/B;AAED,qFAAqF;AACrF,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC7C,GAAG,GAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAuB,GACnD,OAAO,CAAC,MAAM,EAAE,CAAC,CAMnB"}