@prenta/core 0.118.0

package/dist/auth/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAIrD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,SAAS,CAAC,EAAE,mBAAmB,CAAA;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACnF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,iEAAiE;QACjE,aAAa,EAAE,MAAM,CAAA;QACrB,6EAA6E;QAC7E,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACjD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC1B,CAAA;CACF;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,iBAAiB,EAAE,MAAM,CAAA;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;CAmBT,CAAA;AAEV,MAAM,MAAM,iBAAiB,GAAG,MAAM,OAAO,aAAa,CAAA;AAW1D,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAED,wBAAsB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIjF;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wFAAwF;AACxF,wBAAgB,kBAAkB,IAAI,MAAM,CAG3C;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,MAAM,EAAE,MAAM;CAI3B;AAqBD,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAYzF;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,MAAM,CAaR;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B9E;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAoE3B;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,cAAc,EACzB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,QAAQ,EACZ,OAAO,GAAE,oBAAoB,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACrE,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAqK7F;AAED,uGAAuG;AACvG,wBAAsB,aAAa,CACjC,eAAe,EAAE,kBAAkB,EACnC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC,CAErD;AAED,qGAAqG;AACrG,wBAAsB,cAAc,CAClC,eAAe,EAAE,kBAAkB,EACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED,wEAAwE;AACxE,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,mBAAmB,EAC3B,EAAE,EAAE,OAAO,GACV,OAAO,CAAC,IAAI,CAAC,CA6Bf"}

package/dist/auth/oauth.js

@@ -0,0 +1,376 @@
+import { SignJWT, jwtVerify } from 'jose';
+import { createSession } from './session.js';
+import { encryptSecret } from '../security/secret-storage.js';
+import { createLogger } from '../diagnostics/logger.js';
+const logger = createLogger('oauth');
+const PROVIDER_URLS = {
+    google: {
+        authorize: 'https://accounts.google.com/o/oauth2/v2/auth',
+        token: 'https://oauth2.googleapis.com/token',
+        userinfo: 'https://www.googleapis.com/oauth2/v3/userinfo',
+        scopes: 'openid email profile',
+    },
+    github: {
+        authorize: 'https://github.com/login/oauth/authorize',
+        token: 'https://github.com/login/oauth/access_token',
+        userinfo: 'https://api.github.com/user',
+        scopes: 'read:user user:email',
+    },
+    microsoft: {
+        authorize: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
+        token: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+        userinfo: 'https://graph.microsoft.com/v1.0/me',
+        scopes: 'openid email profile',
+    },
+};
+function base64url(buffer) {
+    const bytes = new Uint8Array(buffer);
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+export function generateCodeVerifier() {
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    return base64url(bytes.buffer);
+}
+export async function generateCodeChallenge(codeVerifier) {
+    const encoded = new TextEncoder().encode(codeVerifier);
+    const digest = await crypto.subtle.digest('SHA-256', encoded);
+    return base64url(digest);
+}
+export async function generateState(provider, codeVerifier, returnTo, secret, nonce) {
+    const secretKey = new TextEncoder().encode(secret);
+    const payload = nonce
+        ? { provider, codeVerifier, returnTo, nonce }
+        : { provider, codeVerifier, returnTo };
+    return new SignJWT({ ...payload })
+        .setProtectedHeader({ alg: 'HS256' })
+        .setIssuedAt()
+        .setExpirationTime('10m')
+        .setIssuer('prenta-cms')
+        .sign(secretKey);
+}
+/** Generate a random base64url nonce suitable for binding state to a browser cookie. */
+export function generateOAuthNonce() {
+    const bytes = crypto.getRandomValues(new Uint8Array(16));
+    return base64url(bytes.buffer);
+}
+/**
+ * Thrown when an OAuth state token verifies cryptographically but its decoded
+ * payload doesn't match the expected `OAuthState` shape. Mapped to a 400 by
+ * the callback handler — the user is then bounced back to the login page.
+ */
+export class InvalidOAuthStateError extends Error {
+    constructor(reason) {
+        super(`OAuth state is malformed: ${reason}`);
+        this.name = 'InvalidOAuthStateError';
+    }
+}
+function assertOAuthState(payload) {
+    if (typeof payload !== 'object' || payload === null) {
+        throw new InvalidOAuthStateError('payload is not an object');
+    }
+    const p = payload;
+    if (typeof p.provider !== 'string' || p.provider.length === 0) {
+        throw new InvalidOAuthStateError('missing or invalid `provider`');
+    }
+    if (typeof p.codeVerifier !== 'string' || p.codeVerifier.length === 0) {
+        throw new InvalidOAuthStateError('missing or invalid `codeVerifier`');
+    }
+    if (typeof p.returnTo !== 'string') {
+        throw new InvalidOAuthStateError('missing or invalid `returnTo`');
+    }
+    if (p.nonce !== undefined && typeof p.nonce !== 'string') {
+        throw new InvalidOAuthStateError('`nonce`, when present, must be a string');
+    }
+}
+export async function verifyState(stateToken, secret) {
+    const secretKey = new TextEncoder().encode(secret);
+    const { payload } = await jwtVerify(stateToken, secretKey, { issuer: 'prenta-cms' });
+    assertOAuthState(payload);
+    // Return only the validated fields; strip extras (jose injects iat/exp/iss).
+    const safe = {
+        provider: payload.provider,
+        codeVerifier: payload.codeVerifier,
+        returnTo: payload.returnTo,
+    };
+    if (payload.nonce !== undefined)
+        safe.nonce = payload.nonce;
+    return safe;
+}
+export function getAuthorizationUrl(provider, config, state, codeChallenge) {
+    const urls = PROVIDER_URLS[provider];
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: config.clientId,
+        redirect_uri: config.redirectUri,
+        scope: urls.scopes,
+        state,
+        code_challenge: codeChallenge,
+        code_challenge_method: 'S256',
+    });
+    return `${urls.authorize}?${params.toString()}`;
+}
+export async function exchangeCodeForTokens(provider, code, codeVerifier, config) {
+    const urls = PROVIDER_URLS[provider];
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: config.redirectUri,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code_verifier: codeVerifier,
+    });
+    const headers = {
+        'Content-Type': 'application/x-www-form-urlencoded',
+    };
+    if (provider === 'github') {
+        headers['Accept'] = 'application/json';
+    }
+    const response = await fetch(urls.token, { method: 'POST', headers, body: body.toString() });
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Token exchange failed (${response.status}): ${text}`);
+    }
+    return response.json();
+}
+export async function getUserProfile(provider, accessToken) {
+    const urls = PROVIDER_URLS[provider];
+    const response = await fetch(urls.userinfo, {
+        headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to fetch user profile (${response.status})`);
+    }
+    const data = await response.json();
+    if (provider === 'github') {
+        let email = data.email ?? '';
+        if (!email) {
+            const emailRes = await fetch('https://api.github.com/user/emails', {
+                headers: {
+                    Authorization: `Bearer ${accessToken}`,
+                    Accept: 'application/vnd.github+json',
+                },
+            });
+            if (emailRes.ok) {
+                const emails = (await emailRes.json());
+                const primary = emails.find((e) => e.primary && e.verified) ?? emails.find((e) => e.verified);
+                if (primary)
+                    email = primary.email;
+            }
+        }
+        return {
+            id: String(data.id),
+            email,
+            name: data.name ?? data.login ?? '',
+            avatar: data.avatar_url,
+            // The email is sourced from GitHub's verified-emails endpoint (filtered to
+            // `verified`) or the account's public email, which GitHub requires to be
+            // a verified address.
+            emailVerified: true,
+        };
+    }
+    if (provider === 'microsoft') {
+        return {
+            id: data.id,
+            email: data.mail ?? data.userPrincipalName ?? '',
+            name: data.displayName ?? '',
+            // Microsoft Graph /me exposes no email-verification claim, and the token
+            // is accepted from the multi-tenant `common` authority — so any tenant
+            // (incl. an attacker-controlled one) can assert an arbitrary mail/UPN. We
+            // cannot treat it as verified; MS users adopt an existing account only via
+            // an explicit link from Settings, not an email match. See #562.
+            emailVerified: false,
+        };
+    }
+    // Google — OIDC userinfo returns `email_verified`; treat only a true claim as
+    // verified (it can arrive as a boolean or a string).
+    return {
+        id: data.sub,
+        email: data.email ?? '',
+        name: data.name ?? '',
+        avatar: data.picture,
+        emailVerified: data.email_verified === true || data.email_verified === 'true',
+    };
+}
+export async function handleOAuthCallback(provider, code, stateToken, providers, secret, db, options = {}) {
+    const state = await verifyState(stateToken, secret);
+    if (state.provider !== provider) {
+        throw new Error('Provider mismatch in OAuth state');
+    }
+    // Bind the state to the browser that initiated the flow. If the state was
+    // signed with a nonce, the same value must come back in the cookie that the
+    // /auth/oauth/:provider handler set.
+    if (state.nonce) {
+        if (!options.expectedNonce || options.expectedNonce !== state.nonce) {
+            throw new Error('OAuth state nonce mismatch — possible cross-site flow injection');
+        }
+    }
+    const providerType = provider;
+    const providerConfig = providers[providerType];
+    if (!providerConfig) {
+        throw new Error(`OAuth provider "${provider}" is not configured`);
+    }
+    const tokens = await exchangeCodeForTokens(providerType, code, state.codeVerifier, providerConfig);
+    const profile = await getUserProfile(providerType, tokens.access_token);
+    if (!profile.email) {
+        throw new Error('OAuth provider did not return an email address');
+    }
+    const normalizedEmail = profile.email.toLowerCase().trim();
+    // Lookup precedence:
+    //   1. An existing OAuth account with the same (provider, providerAccountId).
+    //      This is the only safe auto-link target — the provider asserted that
+    //      this account is the same one the user previously linked.
+    //   2. Otherwise, an existing local user with the same email — but ONLY if
+    //      they have no password set (i.e., this is a returning OAuth-only user
+    //      whose account was provisioned by an earlier login). Linking a
+    //      password-protected account requires the user to be already
+    //      authenticated (use `linkAccount()` for that flow).
+    //   3. Otherwise, self-signup if `allowSelfSignup` is true; otherwise reject.
+    const oauthAccount = await db.oAuthAccount
+        ?.findUnique?.({
+        where: { provider_providerAccountId: { provider, providerAccountId: profile.id } },
+        include: { user: true },
+    })
+        .catch(() => null);
+    let user = oauthAccount?.user ?? null;
+    if (!user) {
+        const candidate = await db.user.findFirst({
+            where: { email: { equals: normalizedEmail, mode: 'insensitive' } },
+        });
+        if (candidate) {
+            const hasPassword = typeof candidate.passwordHash === 'string' && candidate.passwordHash.length > 0;
+            if (hasPassword) {
+                // Refuse to silently link a password-protected account on the basis of
+                // a matched email. The legitimate user must explicitly link their
+                // account from inside the admin (an authenticated session).
+                throw new Error('An account already exists for this email. Sign in with your password and link your account from Settings to enable OAuth.');
+            }
+            // Only adopt an existing OAuth-only account when the provider VERIFIED the
+            // email. Otherwise a provider that lets a user assert an arbitrary
+            // unverified address (Google without `email_verified`, or Microsoft's
+            // `common` authority) could take over this account by email match
+            // (nOAuth, #562). Existing linked users are unaffected — they resolve via
+            // the (provider, providerAccountId) lookup above, before this branch.
+            if (!profile.emailVerified) {
+                throw new Error('This provider did not verify your email address, so it cannot be used to sign in to an existing account. Sign in with your original method and link this provider from Settings.');
+            }
+            user = candidate;
+        }
+    }
+    if (!user) {
+        if (!options.allowSelfSignup) {
+            throw new Error('No account found for this email. Ask an administrator to invite you before signing in with OAuth.');
+        }
+        if (options.onProvision) {
+            await options.onProvision(profile, provider);
+        }
+        user = await db.user.create({
+            data: {
+                email: normalizedEmail,
+                name: profile.name,
+                role: 'CLIENT',
+                isActive: true,
+                passwordHash: null,
+            },
+        });
+    }
+    // Ensure an OAuthAccount row exists for this (provider, providerAccountId)
+    // and store the access/refresh tokens encrypted at rest. Use upsert against
+    // the unique compound index so we never overwrite a different user's link.
+    if (db.oAuthAccount?.upsert) {
+        const accessTokenEncrypted = tokens.access_token
+            ? await encryptSecret(tokens.access_token)
+            : null;
+        const refreshTokenEncrypted = tokens.refresh_token
+            ? await encryptSecret(tokens.refresh_token)
+            : null;
+        await db.oAuthAccount
+            .upsert({
+            where: { provider_providerAccountId: { provider, providerAccountId: profile.id } },
+            create: {
+                userId: user.id,
+                provider,
+                providerAccountId: profile.id,
+                accessToken: accessTokenEncrypted,
+                refreshToken: refreshTokenEncrypted,
+            },
+            update: {
+                accessToken: accessTokenEncrypted,
+                refreshToken: refreshTokenEncrypted,
+            },
+        })
+            .catch((err) => {
+            logger.error('Failed to persist OAuthAccount', {
+                reason: err instanceof Error ? err.message : String(err),
+            });
+        });
+    }
+    // Mint the login session through the same policy the password/TOTP flows use
+    // (injected via options.session so this auth-layer file needn't import the api
+    // layer). This previously created the row with only { userId, expiresAt } —
+    // OMITTING the required, unique `token` column — so every real OAuth login
+    // threw at the DB in production; only the test fake-db (which skips required-
+    // field validation) hid it. It also ignored the configured session timeout
+    // and concurrent-session limits (#564). Mint token-first with a known id so
+    // the row carries its token, mirroring auth.ts's password flow.
+    const maxAgeSeconds = options.session?.maxAgeSeconds ?? 7 * 24 * 60 * 60;
+    await options.session?.enforceLimits?.(user.id);
+    const sessionId = crypto.randomUUID();
+    const token = await createSession({ userId: user.id, role: user.role, sessionId }, { secret, maxAge: maxAgeSeconds });
+    await db.session.create({
+        data: {
+            id: sessionId,
+            userId: user.id,
+            token,
+            expiresAt: new Date(Date.now() + maxAgeSeconds * 1000),
+            ipAddress: options.session?.ipAddress ?? null,
+            userAgent: options.session?.userAgent ?? null,
+        },
+    });
+    return {
+        token,
+        user: { id: user.id, email: user.email, name: user.name, role: user.role },
+    };
+}
+/** @deprecated Use `initiateOAuth` pattern — kept for backward compat with auth/index.ts re-exports */
+export async function initiateOAuth(_providerConfig, _callbackUrl) {
+    throw new Error('Use generateState + getAuthorizationUrl instead');
+}
+/** @deprecated Use `handleOAuthCallback` — kept for backward compat with auth/index.ts re-exports */
+export async function handleCallback(_providerConfig, _code, _state) {
+    throw new Error('Use handleOAuthCallback instead');
+}
+/** Link an OAuth account to an existing, already-authenticated user. */
+export async function linkAccount(userId, result, db) {
+    const d = db;
+    const accessToken = result.accessToken ? await encryptSecret(result.accessToken) : null;
+    const refreshToken = result.refreshToken ? await encryptSecret(result.refreshToken) : null;
+    if (d.oAuthAccount?.upsert) {
+        await d.oAuthAccount.upsert({
+            where: {
+                provider_providerAccountId: {
+                    provider: result.provider,
+                    providerAccountId: result.providerAccountId,
+                },
+            },
+            create: {
+                userId,
+                provider: result.provider,
+                providerAccountId: result.providerAccountId,
+                accessToken,
+                refreshToken,
+                expiresAt: result.expiresAt ?? null,
+            },
+            update: {
+                userId,
+                accessToken,
+                refreshToken,
+                expiresAt: result.expiresAt ?? null,
+            },
+        });
+    }
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAGvD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;AAiFpC,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,SAAS,EAAE,8CAA8C;QACzD,KAAK,EAAE,qCAAqC;QAC5C,QAAQ,EAAE,+CAA+C;QACzD,MAAM,EAAE,sBAAsB;KAC/B;IACD,MAAM,EAAE;QACN,SAAS,EAAE,0CAA0C;QACrD,KAAK,EAAE,6CAA6C;QACpD,QAAQ,EAAE,6BAA6B;QACvC,MAAM,EAAE,sBAAsB;KAC/B;IACD,SAAS,EAAE;QACT,SAAS,EAAE,gEAAgE;QAC3E,KAAK,EAAE,4DAA4D;QACnE,QAAQ,EAAE,qCAAqC;QAC/C,MAAM,EAAE,sBAAsB;KAC/B;CACO,CAAA;AAIV,SAAS,SAAS,CAAC,MAAmB;IACpC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACxD,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,YAAoB;IAC9D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC7D,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,YAAoB,EACpB,QAAgB,EAChB,MAAc,EACd,KAAc;IAEd,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAClD,MAAM,OAAO,GAAe,KAAK;QAC/B,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC7C,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAA;IACxC,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;SAC/B,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,KAAK,CAAC;SACxB,SAAS,CAAC,YAAY,CAAC;SACvB,IAAI,CAAC,SAAS,CAAC,CAAA;AACpB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACxD,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,MAAc;QACxB,KAAK,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,OAAgB;IACxC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,CAAC,GAAG,OAAkC,CAAA;IAC5C,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,sBAAsB,CAAC,+BAA+B,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,sBAAsB,CAAC,mCAAmC,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,sBAAsB,CAAC,+BAA+B,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,yCAAyC,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,MAAc;IAClE,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAClD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;IACpF,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACzB,6EAA6E;IAC7E,MAAM,IAAI,GAAe;QACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAA;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3D,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAA2B,EAC3B,MAA2B,EAC3B,KAAa,EACb,aAAqB;IAErB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,KAAK;QACL,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAA;IAEF,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAA2B,EAC3B,IAAY,EACZ,YAAoB,EACpB,MAA2B;IAE3B,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IAEpC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAA;IAEF,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,mCAAmC;KACpD,CAAA;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAA;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAE5F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAA2B,EAC3B,WAAmB;IAEnB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IAEpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;QAC1C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;KACpD,CAAC,CAAA;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAElC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,KAAK,GAAW,IAAI,CAAC,KAAK,IAAI,EAAE,CAAA;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oCAAoC,EAAE;gBACjE,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,WAAW,EAAE;oBACtC,MAAM,EAAE,6BAA6B;iBACtC;aACF,CAAC,CAAA;YACF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAInC,CAAA;gBACF,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;gBAC/E,IAAI,OAAO;oBAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;YACpC,CAAC;QACH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,2EAA2E;YAC3E,yEAAyE;YACzE,sBAAsB;YACtB,aAAa,EAAE,IAAI;SACpB,CAAA;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,iBAAiB,IAAI,EAAE;YAChD,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;YAC5B,yEAAyE;YACzE,uEAAuE;YACvE,0EAA0E;YAC1E,2EAA2E;YAC3E,gEAAgE;YAChE,aAAa,EAAE,KAAK;SACrB,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,qDAAqD;IACrD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,GAAG;QACZ,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,aAAa,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,MAAM;KAC9E,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAY,EACZ,UAAkB,EAClB,SAAyB,EACzB,MAAc,EACd,EAAY,EACZ,UAAoE,EAAE;IAEtE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAEnD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACrD,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,qCAAqC;IACrC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,QAA6B,CAAA;IAClD,MAAM,cAAc,GAAG,SAAS,CAAC,YAAY,CAAC,CAAA;IAC9C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,qBAAqB,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;IAClG,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;IAEvE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;IAE1D,qBAAqB;IACrB,8EAA8E;IAC9E,2EAA2E;IAC3E,gEAAgE;IAChE,2EAA2E;IAC3E,4EAA4E;IAC5E,qEAAqE;IACrE,kEAAkE;IAClE,0DAA0D;IAC1D,8EAA8E;IAC9E,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,YAAY;QACxC,EAAE,UAAU,EAAE,CAAC;QACb,KAAK,EAAE,EAAE,0BAA0B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE;QAClF,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;KACxB,CAAC;SACD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAEpB,IAAI,IAAI,GAAG,YAAY,EAAE,IAAI,IAAI,IAAI,CAAA;IAErC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;YACxC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;SACnE,CAAC,CAAA;QAEF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GACf,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ,IAAI,SAAS,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAA;YACjF,IAAI,WAAW,EAAE,CAAC;gBAChB,uEAAuE;gBACvE,kEAAkE;gBAClE,4DAA4D;gBAC5D,MAAM,IAAI,KAAK,CACb,2HAA2H,CAC5H,CAAA;YACH,CAAC;YACD,2EAA2E;YAC3E,mEAAmE;YACnE,sEAAsE;YACtE,kEAAkE;YAClE,0EAA0E;YAC1E,sEAAsE;YACtE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,kLAAkL,CACnL,CAAA;YACH,CAAC;YACD,IAAI,GAAG,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC9C,CAAC;QACD,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1B,IAAI,EAAE;gBACJ,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,IAAI;aACnB;SACF,CAAC,CAAA;IACJ,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAY;YAC9C,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAA;QACR,MAAM,qBAAqB,GAAG,MAAM,CAAC,aAAa;YAChD,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC;YAC3C,CAAC,CAAC,IAAI,CAAA;QAER,MAAM,EAAE,CAAC,YAAY;aAClB,MAAM,CAAC;YACN,KAAK,EAAE,EAAE,0BAA0B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE;YAClF,MAAM,EAAE;gBACN,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ;gBACR,iBAAiB,EAAE,OAAO,CAAC,EAAE;gBAC7B,WAAW,EAAE,oBAAoB;gBACjC,YAAY,EAAE,qBAAqB;aACpC;YACD,MAAM,EAAE;gBACN,WAAW,EAAE,oBAAoB;gBACjC,YAAY,EAAE,qBAAqB;aACpC;SACF,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAC7C,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACN,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;IACxE,MAAM,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAE/C,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IACrC,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,EAC/C,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAClC,CAAA;IACD,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE;YACJ,EAAE,EAAE,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK;YACL,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC;YACtD,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI;YAC7C,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI;SAC9C;KACF,CAAC,CAAA;IAEF,OAAO;QACL,KAAK;QACL,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;KAC3E,CAAA;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,eAAmC,EACnC,YAAoB;IAEpB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;AACpE,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,eAAmC,EACnC,KAAa,EACb,MAAkB;IAElB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;AACpD,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,MAA2B,EAC3B,EAAW;IAEX,MAAM,CAAC,GAAG,EAAS,CAAA;IACnB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvF,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAE1F,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;YAC1B,KAAK,EAAE;gBACL,0BAA0B,EAAE;oBAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;iBAC5C;aACF;YACD,MAAM,EAAE;gBACN,MAAM;gBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,WAAW;gBACX,YAAY;gBACZ,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;aACpC;YACD,MAAM,EAAE;gBACN,MAAM;gBACN,WAAW;gBACX,YAAY;gBACZ,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;aACpC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/auth/password.d.ts

@@ -0,0 +1,57 @@
+import type { PasswordPolicy } from '../config/types.js';
+/**
+ * PBKDF2 iteration count. Bumped from 100,000 (insufficient by 2026 standards)
+ * to 600,000 to align with OWASP/NIST 2023+ guidance for PBKDF2-HMAC-SHA256.
+ * The hash format embeds the iteration count, so existing 100k hashes still
+ * verify correctly — `verifyPassword` reads the count from the stored string,
+ * and `needsRehash` lets callers (login.ts) opportunistically upgrade old
+ * hashes when the user signs in with the correct password.
+ */
+export declare const PBKDF2_ITERATIONS = 600000;
+/** Hash a password using Web Crypto API (PBKDF2-HMAC-SHA256). */
+export declare function hashPassword(password: string): Promise<string>;
+/**
+ * Verify a password against its stored hash.
+ *
+ * Reads the iteration count from the stored hash so old hashes (100k from
+ * pre-2026 deployments) and current hashes (600k) both verify. Pair with
+ * `needsRehash` at the login site to opportunistically upgrade old hashes.
+ */
+export declare function verifyPassword(password: string, storedHash: string): Promise<boolean>;
+/**
+ * Returns true when the stored hash uses fewer iterations than current policy.
+ *
+ * Login flow should: verify -> if `needsRehash` -> hash again with current
+ * params -> persist. This upgrades old hashes silently as users sign in.
+ */
+export declare function needsRehash(storedHash: string): boolean;
+/**
+ * Returns a PBKDF2 verification result against the module-level dummy hash.
+ * The hash is shared across all calls (and across all unknown emails) — it
+ * doesn't matter that it's deterministic per-process, because the comparison
+ * itself takes constant time and the attacker only learns "not the dummy
+ * hash" — which they already know.
+ *
+ * The boolean return is meaningless for callers and is intentionally always
+ * `false` in practice; it exists so the type matches `verifyPassword`.
+ */
+export declare function compareToDummyHash(password: string): Promise<boolean>;
+/**
+ * Test-only escape hatch that resolves when the eager dummy-hash
+ * precompute has finished. Production callers MUST NOT use this — they
+ * should call `compareToDummyHash`, which awaits the same promise
+ * internally. Exported solely so timing-sensitive tests can measure
+ * verify-only latency without the variable cost of the in-flight
+ * eager init.
+ *
+ * @internal
+ */
+export declare function _waitForDummyHashReady(): Promise<void>;
+/** Validate a password against the configured policy rules. */
+export declare function validatePasswordPolicy(password: string, policy: PasswordPolicy): {
+    valid: boolean;
+    errors: string[];
+};
+/** Check if a password has appeared in a known data breach (k-anonymity). */
+export { checkBreached as checkPasswordBreach } from '../security/breach-check.js';
+//# sourceMappingURL=password.d.ts.map

package/dist/auth/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAGxD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,SAAU,CAAA;AAExC,iEAAiE;AACjE,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBpE;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA+B3F;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAOvD;AAsCD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAEtD;AAED,+DAA+D;AAC/D,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,GACrB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAoBtC;AAED,6EAA6E;AAC7E,OAAO,EAAE,aAAa,IAAI,mBAAmB,EAAE,MAAM,6BAA6B,CAAA"}

package/dist/auth/password.js

@@ -0,0 +1,150 @@
+import { timingSafeEqual } from 'node:crypto';
+/**
+ * PBKDF2 iteration count. Bumped from 100,000 (insufficient by 2026 standards)
+ * to 600,000 to align with OWASP/NIST 2023+ guidance for PBKDF2-HMAC-SHA256.
+ * The hash format embeds the iteration count, so existing 100k hashes still
+ * verify correctly — `verifyPassword` reads the count from the stored string,
+ * and `needsRehash` lets callers (login.ts) opportunistically upgrade old
+ * hashes when the user signs in with the correct password.
+ */
+export const PBKDF2_ITERATIONS = 600_000;
+/** Hash a password using Web Crypto API (PBKDF2-HMAC-SHA256). */
+export async function hashPassword(password) {
+    const salt = crypto.getRandomValues(new Uint8Array(16));
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(password), 'PBKDF2', false, ['deriveBits']);
+    const derived = await crypto.subtle.deriveBits({ name: 'PBKDF2', salt, iterations: PBKDF2_ITERATIONS, hash: 'SHA-256' }, key, 256);
+    const saltHex = Buffer.from(salt).toString('hex');
+    const hashHex = Buffer.from(derived).toString('hex');
+    return `pbkdf2:${PBKDF2_ITERATIONS}:${saltHex}:${hashHex}`;
+}
+/**
+ * Verify a password against its stored hash.
+ *
+ * Reads the iteration count from the stored hash so old hashes (100k from
+ * pre-2026 deployments) and current hashes (600k) both verify. Pair with
+ * `needsRehash` at the login site to opportunistically upgrade old hashes.
+ */
+export async function verifyPassword(password, storedHash) {
+    const parts = storedHash.split(':');
+    if (parts.length !== 4)
+        return false;
+    const [, iterStr, saltHex, hashHex] = parts;
+    if (!iterStr || !saltHex || !hashHex)
+        return false;
+    const iterations = parseInt(iterStr, 10);
+    // Bound the iteration count: refuse anything below 10k (almost certainly
+    // a corrupted hash) or above 5M (DoS guard — an attacker who controls a
+    // user's stored hash could otherwise pin a worker for tens of seconds per
+    // login attempt).
+    if (!Number.isFinite(iterations) || iterations < 10_000 || iterations > 5_000_000) {
+        return false;
+    }
+    const salt = Buffer.from(saltHex, 'hex');
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(password), 'PBKDF2', false, ['deriveBits']);
+    const derived = await crypto.subtle.deriveBits({ name: 'PBKDF2', salt, iterations, hash: 'SHA-256' }, key, 256);
+    const derivedBuf = Buffer.from(derived);
+    const storedBuf = Buffer.from(hashHex, 'hex');
+    if (derivedBuf.length !== storedBuf.length)
+        return false;
+    return timingSafeEqual(derivedBuf, storedBuf);
+}
+/**
+ * Returns true when the stored hash uses fewer iterations than current policy.
+ *
+ * Login flow should: verify -> if `needsRehash` -> hash again with current
+ * params -> persist. This upgrades old hashes silently as users sign in.
+ */
+export function needsRehash(storedHash) {
+    const parts = storedHash.split(':');
+    if (parts.length !== 4)
+        return false;
+    const iterStr = parts[1];
+    const iterations = iterStr ? parseInt(iterStr, 10) : 0;
+    if (!Number.isFinite(iterations))
+        return false;
+    return iterations < PBKDF2_ITERATIONS;
+}
+/**
+ * A stable dummy PBKDF2 hash used to keep login response time roughly constant
+ * regardless of whether the email exists. When the user is not found, the
+ * login handler still runs `verifyPassword(submittedPassword, dummyHash)` so
+ * the timing channel that distinguished "no user" from "wrong password"
+ * disappears.
+ *
+ * Initialised eagerly at module load via a top-level Promise. Without this,
+ * the very first call to `compareToDummyHash` after a cold start would have
+ * to run `hashPassword` (600k iterations) *and* `verifyPassword` (another
+ * 600k iterations) — roughly 2× the latency of a normal verify, which
+ * recreates the user-enumeration timing channel this defense is meant to
+ * close. The Promise is awaited inside `compareToDummyHash`, so callers
+ * never see a partial hash.
+ *
+ * Why a Promise instead of a string returned from a top-level await:
+ *   - The Web Crypto PBKDF2 derivation is asynchronous; we can't compute it
+ *     synchronously at module top level without forcing every importer to
+ *     also support top-level await.
+ *   - Storing the in-flight Promise lets the work start at module load and
+ *     overlap with the first request, rather than blocking on it.
+ */
+const _dummyHashPromise = (async () => {
+    const dummyPlaintext = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString('hex');
+    return hashPassword(dummyPlaintext);
+})();
+// Surface uncaught rejections so that — if the eager hash ever fails — we
+// see it in logs at startup, not on the first login. Without this handler,
+// Node would emit an unhandledRejection warning the moment a request hits
+// `compareToDummyHash`.
+_dummyHashPromise.catch((err) => {
+    // eslint-disable-next-line no-console
+    console.error('[prenta][auth] failed to precompute dummy login hash:', err);
+});
+/**
+ * Returns a PBKDF2 verification result against the module-level dummy hash.
+ * The hash is shared across all calls (and across all unknown emails) — it
+ * doesn't matter that it's deterministic per-process, because the comparison
+ * itself takes constant time and the attacker only learns "not the dummy
+ * hash" — which they already know.
+ *
+ * The boolean return is meaningless for callers and is intentionally always
+ * `false` in practice; it exists so the type matches `verifyPassword`.
+ */
+export async function compareToDummyHash(password) {
+    const dummyHash = await _dummyHashPromise;
+    return verifyPassword(password, dummyHash);
+}
+/**
+ * Test-only escape hatch that resolves when the eager dummy-hash
+ * precompute has finished. Production callers MUST NOT use this — they
+ * should call `compareToDummyHash`, which awaits the same promise
+ * internally. Exported solely so timing-sensitive tests can measure
+ * verify-only latency without the variable cost of the in-flight
+ * eager init.
+ *
+ * @internal
+ */
+export function _waitForDummyHashReady() {
+    return _dummyHashPromise.then(() => undefined);
+}
+/** Validate a password against the configured policy rules. */
+export function validatePasswordPolicy(password, policy) {
+    const errors = [];
+    if (policy.minLength && password.length < policy.minLength) {
+        errors.push(`Password must be at least ${policy.minLength} characters`);
+    }
+    if (policy.requireUppercase && !/[A-Z]/.test(password)) {
+        errors.push('Password must contain an uppercase letter');
+    }
+    if (policy.requireLowercase && !/[a-z]/.test(password)) {
+        errors.push('Password must contain a lowercase letter');
+    }
+    if (policy.requireNumbers && !/\d/.test(password)) {
+        errors.push('Password must contain a digit');
+    }
+    if (policy.requireSpecialChars && !/[^a-zA-Z0-9]/.test(password)) {
+        errors.push('Password must contain a special character');
+    }
+    return { valid: errors.length === 0, errors };
+}
+/** Check if a password has appeared in a known data breach (k-anonymity). */
+export { checkBreached as checkPasswordBreach } from '../security/breach-check.js';
+//# sourceMappingURL=password.js.map

package/dist/auth/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAA;AAExC,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAClC,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAA;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAC5C,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,EACxE,GAAG,EACH,GAAG,CACJ,CAAA;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpD,OAAO,UAAU,iBAAiB,IAAI,OAAO,IAAI,OAAO,EAAE,CAAA;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,UAAkB;IACvE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAA;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACxC,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,kBAAkB;IAClB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,MAAM,IAAI,UAAU,GAAG,SAAS,EAAE,CAAC;QAClF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAClC,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAA;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAC5C,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EACrD,GAAG,EACH,GAAG,CACJ,CAAA;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACxD,OAAO,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACxB,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9C,OAAO,UAAU,GAAG,iBAAiB,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,iBAAiB,GAAoB,CAAC,KAAK,IAAI,EAAE;IACrD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9F,OAAO,YAAY,CAAC,cAAc,CAAC,CAAA;AACrC,CAAC,CAAC,EAAE,CAAA;AAEJ,0EAA0E;AAC1E,2EAA2E;AAC3E,0EAA0E;AAC1E,wBAAwB;AACxB,iBAAiB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC9B,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAA;AAC7E,CAAC,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAA;IACzC,OAAO,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;AAChD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,MAAsB;IAEtB,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,IAAI,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,SAAS,aAAa,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAA;IAC1D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC/C,CAAC;AAED,6EAA6E;AAC7E,OAAO,EAAE,aAAa,IAAI,mBAAmB,EAAE,MAAM,6BAA6B,CAAA"}

package/dist/auth/providers/github.d.ts

@@ -0,0 +1,9 @@
+import type { AuthProviderConfig } from '../../config/types.js';
+export interface GitHubProviderOptions {
+    clientId: string;
+    clientSecret: string;
+    allowedOrgs?: string[];
+}
+/** Create a GitHub OAuth provider configuration. */
+export declare function githubProvider(options: GitHubProviderOptions): AuthProviderConfig;
+//# sourceMappingURL=github.d.ts.map

package/dist/auth/providers/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/github.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE/D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB;AAED,oDAAoD;AACpD,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,kBAAkB,CAOjF"}

package/dist/auth/providers/github.js

@@ -0,0 +1,10 @@
+/** Create a GitHub OAuth provider configuration. */
+export function githubProvider(options) {
+    return {
+        id: 'github',
+        type: 'github',
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+    };
+}
+//# sourceMappingURL=github.js.map