najm-auth 3.3.2 → 3.4.0

package/dist/index.js

@@ -5399,7 +5399,7 @@ function toSingular(plural) {
 }
 __name(toSingular, "toSingular");
 function createResourceGuards(ownershipClass, resourceType, resource, options) {
-  var _a27, _b15;
+  var _a28, _b15;
   const writeGuard = options?.adminGuard ?? isAdmin;
   let AccessGuard = class AccessGuard {
     static {
@@ -5420,7 +5420,7 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
     __param12(1, Params4("id")),
     __metadata31("design:type", Function),
     __metadata31("design:paramtypes", [Object, String]),
-    __metadata31("design:returntype", typeof (_a27 = typeof Promise !== "undefined" && Promise) === "function" ? _a27 : Object)
+    __metadata31("design:returntype", typeof (_a28 = typeof Promise !== "undefined" && Promise) === "function" ? _a28 : Object)
   ], AccessGuard.prototype, "canActivate", null);
   AccessGuard = __decorate31([
     Injectable15()
@@ -5581,7 +5581,7 @@ function configureOwnership(config) {
     Injectable15()
   ], GeneratedOwnershipService);
   function bodyGuard(resourceType, bodyField, optional = false) {
-    var _a27;
+    var _a28;
     let BodyAccessGuard = class BodyAccessGuard {
       static {
         __name(this, "BodyAccessGuard");
@@ -5603,7 +5603,7 @@ function configureOwnership(config) {
       __param12(1, Body6()),
       __metadata31("design:type", Function),
       __metadata31("design:paramtypes", [Object, Object]),
-      __metadata31("design:returntype", typeof (_a27 = typeof Promise !== "undefined" && Promise) === "function" ? _a27 : Object)
+      __metadata31("design:returntype", typeof (_a28 = typeof Promise !== "undefined" && Promise) === "function" ? _a28 : Object)
     ], BodyAccessGuard.prototype, "canActivate", null);
     BodyAccessGuard = __decorate31([
       Injectable15()
@@ -6158,17 +6158,162 @@ GoogleOAuthProvider = __decorate34([
   __metadata34("design:paramtypes", [typeof (_a21 = typeof GoogleTokenVerifier !== "undefined" && GoogleTokenVerifier) === "function" ? _a21 : Object])
 ], GoogleOAuthProvider);
 
+// src/oauth/github/GitHubOAuthProvider.ts
+import { Inject as Inject19, Injectable as Injectable19 } from "najm-core";
+var __decorate35 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata35 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AUTHORIZATION_ENDPOINT2 = "https://github.com/login/oauth/authorize";
+var TOKEN_ENDPOINT2 = "https://github.com/login/oauth/access_token";
+var USER_ENDPOINT = "https://api.github.com/user";
+var EMAILS_ENDPOINT = "https://api.github.com/user/emails";
+var API_VERSION = "2022-11-28";
+var GitHubOAuthProvider = class GitHubOAuthProvider2 {
+  static {
+    __name(this, "GitHubOAuthProvider");
+  }
+  config;
+  authorizationUrl(attempt, codeChallenge) {
+    const github = this.githubConfig();
+    const url = new URL(AUTHORIZATION_ENDPOINT2);
+    url.search = new URLSearchParams({
+      client_id: github.clientId,
+      redirect_uri: github.callbackUrl,
+      scope: "user:email",
+      state: attempt.state,
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256"
+    }).toString();
+    return url.toString();
+  }
+  async exchange(code, attempt) {
+    const github = this.githubConfig();
+    const token = await this.exchangeCode(code, attempt.codeVerifier, github);
+    const headers = {
+      accept: "application/vnd.github+json",
+      authorization: `Bearer ${token}`,
+      "user-agent": "najm-auth",
+      "x-github-api-version": API_VERSION
+    };
+    const [user, emails] = await Promise.all([
+      this.fetchJson(USER_ENDPOINT, headers),
+      this.fetchJson(EMAILS_ENDPOINT, headers)
+    ]);
+    const primary = Array.isArray(emails) ? emails.find((entry) => entry.primary === true && entry.verified === true) : void 0;
+    const email2 = primary?.email?.trim().toLowerCase();
+    const providerAccountId = user.id === void 0 ? "" : String(user.id);
+    const login = user.login?.trim() ?? "";
+    if (!providerAccountId || !login || !email2) {
+      throw new OAuthFlowError("oauth_verified_email_required", 403);
+    }
+    return {
+      provider: "github",
+      providerAccountId,
+      email: email2,
+      emailVerified: true,
+      login,
+      name: user.name?.trim() || login,
+      picture: user.avatar_url?.trim() || void 0
+    };
+  }
+  async exchangeCode(code, codeVerifier, github) {
+    let response;
+    try {
+      response = await fetch(TOKEN_ENDPOINT2, {
+        method: "POST",
+        headers: {
+          accept: "application/json",
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          client_id: github.clientId,
+          client_secret: github.clientSecret,
+          code,
+          redirect_uri: github.callbackUrl,
+          code_verifier: codeVerifier
+        }),
+        signal: AbortSignal.timeout(15e3)
+      });
+    } catch {
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    }
+    if (!response.ok)
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    }
+    const accessToken = body.access_token;
+    if (typeof accessToken !== "string" || !accessToken) {
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    }
+    return accessToken;
+  }
+  async fetchJson(url, headers) {
+    let response;
+    try {
+      response = await fetch(url, {
+        headers,
+        signal: AbortSignal.timeout(15e3)
+      });
+    } catch {
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    }
+    if (!response.ok)
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    try {
+      return await response.json();
+    } catch {
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    }
+  }
+  githubConfig() {
+    const github = this.config.oauth?.github;
+    if (!github)
+      throw new OAuthFlowError("oauth_provider_disabled", 404);
+    return github;
+  }
+};
+__decorate35([
+  Inject19(AUTH_CONFIG),
+  __metadata35("design:type", Object)
+], GitHubOAuthProvider.prototype, "config", void 0);
+GitHubOAuthProvider = __decorate35([
+  Injectable19()
+], GitHubOAuthProvider);
+
+// src/oauth/GitHubOAuthController.ts
+import { createHash as createHash5 } from "crypto";
+import { Controller as Controller6, Ctx as Ctx2, Get as Get5, Post as Post6, Query as Query2, User as User5 } from "najm-core";
+import { RateLimit as RateLimit3 } from "najm-rate";
+
+// src/oauth/OAuthService.ts
+import { Inject as Inject22, Injectable as Injectable22, Log as Log2 } from "najm-core";
+
+// src/oauth/OAuthAccountService.ts
+import { randomBytes as randomBytes3 } from "crypto";
+import { Inject as Inject21, Injectable as Injectable20 } from "najm-core";
+import { Transaction as Transaction5 } from "najm-database";
+
 // src/oauth/OAuthAccountRepository.ts
 import { and as and6, eq as eq9 } from "drizzle-orm";
-import { Inject as Inject19, Repository as Repository7 } from "najm-core";
+import { Inject as Inject20, Repository as Repository7 } from "najm-core";
 import { DB as DB7 } from "najm-database";
-var __decorate35 = function(decorators, target, key, desc) {
+var __decorate36 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata35 = function(k, v) {
+var __metadata36 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var OAuthAccountRepository = class OAuthAccountRepository2 {
@@ -6196,29 +6341,26 @@ var OAuthAccountRepository = class OAuthAccountRepository2 {
     return account;
   }
 };
-__decorate35([
+__decorate36([
   DB7(),
-  __metadata35("design:type", Object)
+  __metadata36("design:type", Object)
 ], OAuthAccountRepository.prototype, "db", void 0);
-__decorate35([
-  Inject19(AUTH_SCHEMA),
-  __metadata35("design:type", Object)
+__decorate36([
+  Inject20(AUTH_SCHEMA),
+  __metadata36("design:type", Object)
 ], OAuthAccountRepository.prototype, "schema", void 0);
-OAuthAccountRepository = __decorate35([
+OAuthAccountRepository = __decorate36([
   Repository7()
 ], OAuthAccountRepository);
 
 // src/oauth/OAuthAccountService.ts
-import { randomBytes as randomBytes3 } from "crypto";
-import { Inject as Inject20, Injectable as Injectable19 } from "najm-core";
-import { Transaction as Transaction5 } from "najm-database";
-var __decorate36 = function(decorators, target, key, desc) {
+var __decorate37 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata36 = function(k, v) {
+var __metadata37 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var _a22;
@@ -6237,18 +6379,18 @@ var OAuthAccountService = class OAuthAccountService2 {
     this.users = users;
   }
   async resolveForLogin(identity) {
-    const linked = await this.accounts.getByProviderAccount("google", identity.providerAccountId);
+    const linked = await this.accounts.getByProviderAccount(identity.provider, identity.providerAccountId);
     if (linked)
       return this.users.getById(linked.userId);
     const existingUser = await this.users.findByEmailInsensitive(identity.email);
     if (existingUser) {
-      if (!this.googleConfig().autoLinkVerifiedEmail) {
+      if (!this.providerConfig(identity.provider).autoLinkVerifiedEmail) {
         throw new OAuthFlowError("oauth_account_link_required", 409);
       }
       await this.createLink(existingUser.id, identity);
       return this.users.getById(existingUser.id);
     }
-    if (!this.googleConfig().allowSignup) {
+    if (!this.providerConfig(identity.provider).allowSignup) {
       throw new OAuthFlowError("oauth_signup_disabled", 403);
     }
     const password = `${randomBytes3(32).toString("base64url")}Aa1`;
@@ -6266,13 +6408,13 @@ var OAuthAccountService = class OAuthAccountService2 {
     const user = await this.users.getById(userId);
     if (user.status !== "active")
       throw new OAuthFlowError("oauth_account_inactive", 403);
-    const providerAccount = await this.accounts.getByProviderAccount("google", identity.providerAccountId);
+    const providerAccount = await this.accounts.getByProviderAccount(identity.provider, identity.providerAccountId);
     if (providerAccount && providerAccount.userId !== userId) {
       throw new OAuthFlowError("oauth_provider_account_linked", 409);
     }
     if (providerAccount)
       return user;
-    const userProvider = await this.accounts.getByUserProvider(userId, "google");
+    const userProvider = await this.accounts.getByUserProvider(userId, identity.provider);
     if (userProvider && userProvider.providerAccountId !== identity.providerAccountId) {
       throw new OAuthFlowError("oauth_user_provider_linked", 409);
     }
@@ -6283,69 +6425,61 @@ var OAuthAccountService = class OAuthAccountService2 {
   async createLink(userId, identity) {
     const created = await this.accounts.create({
       userId,
-      provider: "google",
+      provider: identity.provider,
       providerAccountId: identity.providerAccountId
     });
     if (created)
       return;
-    const linked = await this.accounts.getByProviderAccount("google", identity.providerAccountId);
+    const linked = await this.accounts.getByProviderAccount(identity.provider, identity.providerAccountId);
     if (!linked || linked.userId !== userId) {
       throw new OAuthFlowError("oauth_provider_account_linked", 409);
     }
   }
-  googleConfig() {
-    const google = this.config.oauth?.google;
-    if (!google)
+  providerConfig(provider) {
+    const providerConfig = this.config.oauth?.[provider];
+    if (!providerConfig)
       throw new OAuthFlowError("oauth_provider_disabled", 404);
-    return google;
+    return providerConfig;
   }
 };
-__decorate36([
-  Inject20(AUTH_CONFIG),
-  __metadata36("design:type", Object)
+__decorate37([
+  Inject21(AUTH_CONFIG),
+  __metadata37("design:type", Object)
 ], OAuthAccountService.prototype, "config", void 0);
-__decorate36([
+__decorate37([
   Transaction5(),
-  __metadata36("design:type", Function),
-  __metadata36("design:paramtypes", [Object]),
-  __metadata36("design:returntype", typeof (_c9 = typeof Promise !== "undefined" && Promise) === "function" ? _c9 : Object)
+  __metadata37("design:type", Function),
+  __metadata37("design:paramtypes", [Object]),
+  __metadata37("design:returntype", typeof (_c9 = typeof Promise !== "undefined" && Promise) === "function" ? _c9 : Object)
 ], OAuthAccountService.prototype, "resolveForLogin", null);
-__decorate36([
+__decorate37([
   Transaction5(),
-  __metadata36("design:type", Function),
-  __metadata36("design:paramtypes", [String, Object]),
-  __metadata36("design:returntype", typeof (_d7 = typeof Promise !== "undefined" && Promise) === "function" ? _d7 : Object)
+  __metadata37("design:type", Function),
+  __metadata37("design:paramtypes", [String, Object]),
+  __metadata37("design:returntype", typeof (_d7 = typeof Promise !== "undefined" && Promise) === "function" ? _d7 : Object)
 ], OAuthAccountService.prototype, "linkUser", null);
-OAuthAccountService = __decorate36([
-  Injectable19(),
-  __metadata36("design:paramtypes", [typeof (_a22 = typeof OAuthAccountRepository !== "undefined" && OAuthAccountRepository) === "function" ? _a22 : Object, typeof (_b12 = typeof UserService !== "undefined" && UserService) === "function" ? _b12 : Object])
+OAuthAccountService = __decorate37([
+  Injectable20(),
+  __metadata37("design:paramtypes", [typeof (_a22 = typeof OAuthAccountRepository !== "undefined" && OAuthAccountRepository) === "function" ? _a22 : Object, typeof (_b12 = typeof UserService !== "undefined" && UserService) === "function" ? _b12 : Object])
 ], OAuthAccountService);
 
-// src/oauth/OAuthController.ts
-import { createHash as createHash5 } from "crypto";
-import { Controller as Controller6, Ctx as Ctx2, Get as Get5, Post as Post6, Query as Query2, User as User5 } from "najm-core";
-import { RateLimit as RateLimit3 } from "najm-rate";
-
-// src/oauth/OAuthService.ts
-import { Inject as Inject21, Injectable as Injectable21, Log as Log2 } from "najm-core";
-
 // src/oauth/OAuthStateService.ts
 import { createHash as createHash4, randomBytes as randomBytes4, timingSafeEqual } from "crypto";
-import { Injectable as Injectable20 } from "najm-core";
+import { Injectable as Injectable21 } from "najm-core";
 import { CookieService as CookieService3 } from "najm-cookies";
-var __decorate37 = function(decorators, target, key, desc) {
+var __decorate38 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata37 = function(k, v) {
+var __metadata38 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var _a23;
 var _b13;
 var ATTEMPT_TTL_MS = 10 * 60 * 1e3;
-var COOKIE_PREFIX = "najm.oauth.google.";
+var COOKIE_PREFIX = "najm.oauth.";
 var OAuthStateService = class OAuthStateService2 {
   static {
     __name(this, "OAuthStateService");
@@ -6360,7 +6494,7 @@ var OAuthStateService = class OAuthStateService2 {
     const state = randomBytes4(32).toString("base64url");
     const codeVerifier = randomBytes4(48).toString("base64url");
     const attempt = {
-      provider: "google",
+      provider: input.provider,
       intent: input.intent,
       state,
       nonce: randomBytes4(32).toString("base64url"),
@@ -6370,7 +6504,7 @@ var OAuthStateService = class OAuthStateService2 {
       sessionVersion: input.sessionVersion,
       createdAt: Date.now()
     };
-    this.cookies.set(this.cookieName(state), this.encryption.encrypt(JSON.stringify(attempt)), {
+    this.cookies.set(this.cookieName(input.provider, state), this.encryption.encrypt(JSON.stringify(attempt)), {
       httpOnly: true,
       sameSite: "Lax",
       path: "/",
@@ -6381,10 +6515,10 @@ var OAuthStateService = class OAuthStateService2 {
       codeChallenge: createHash4("sha256").update(codeVerifier).digest("base64url")
     };
   }
-  consume(state) {
+  consume(provider, state) {
     if (!this.isSafeState(state))
       throw new OAuthFlowError("oauth_state_invalid");
-    const name = this.cookieName(state);
+    const name = this.cookieName(provider, state);
     const encrypted = this.cookies.get(name);
     this.cookies.delete(name, { path: "/" });
     if (!encrypted)
@@ -6396,7 +6530,7 @@ var OAuthStateService = class OAuthStateService2 {
       if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
         throw new OAuthFlowError("oauth_state_invalid");
       }
-      if (attempt.provider !== "google" || Date.now() - attempt.createdAt > ATTEMPT_TTL_MS) {
+      if (attempt.provider !== provider || Date.now() - attempt.createdAt > ATTEMPT_TTL_MS) {
         throw new OAuthFlowError("oauth_state_invalid");
       }
       attempt.returnTo = this.validateReturnTo(attempt.returnTo);
@@ -6425,26 +6559,26 @@ var OAuthStateService = class OAuthStateService2 {
       throw new OAuthFlowError("oauth_redirect_invalid");
     }
   }
-  cookieName(state) {
-    return `${COOKIE_PREFIX}${state}`;
+  cookieName(provider, state) {
+    return `${COOKIE_PREFIX}${provider}.${state}`;
   }
   isSafeState(state) {
     return /^[A-Za-z0-9_-]{40,128}$/.test(state);
   }
 };
-OAuthStateService = __decorate37([
-  Injectable20(),
-  __metadata37("design:paramtypes", [typeof (_a23 = typeof CookieService3 !== "undefined" && CookieService3) === "function" ? _a23 : Object, typeof (_b13 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _b13 : Object])
+OAuthStateService = __decorate38([
+  Injectable21(),
+  __metadata38("design:paramtypes", [typeof (_a23 = typeof CookieService3 !== "undefined" && CookieService3) === "function" ? _a23 : Object, typeof (_b13 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _b13 : Object])
 ], OAuthStateService);
 
 // src/oauth/OAuthService.ts
-var __decorate38 = function(decorators, target, key, desc) {
+var __decorate39 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata38 = function(k, v) {
+var __metadata39 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var _a24;
@@ -6454,12 +6588,14 @@ var _d8;
 var _e5;
 var _f5;
 var _g4;
+var _h3;
 var OAuthService = class OAuthService2 {
   static {
     __name(this, "OAuthService");
   }
   state;
   google;
+  github;
   accounts;
   sessions;
   tokens;
@@ -6467,9 +6603,10 @@ var OAuthService = class OAuthService2 {
   requirements;
   config;
   logger;
-  constructor(state, google, accounts, sessions, tokens, users, requirements) {
+  constructor(state, google, github, accounts, sessions, tokens, users, requirements) {
     this.state = state;
     this.google = google;
+    this.github = github;
     this.accounts = accounts;
     this.sessions = sessions;
     this.tokens = tokens;
@@ -6477,36 +6614,59 @@ var OAuthService = class OAuthService2 {
     this.requirements = requirements;
   }
   startGoogleLogin(returnTo) {
-    this.googleConfig();
-    const { attempt, codeChallenge } = this.state.create({ intent: "login", returnTo });
-    return this.google.authorizationUrl(attempt, codeChallenge);
+    return this.startLogin("google", returnTo);
+  }
+  startGitHubLogin(returnTo) {
+    return this.startLogin("github", returnTo);
+  }
+  startGoogleLink(userId, returnTo) {
+    return this.startLink("google", userId, returnTo);
+  }
+  startGitHubLink(userId, returnTo) {
+    return this.startLink("github", userId, returnTo);
+  }
+  finishGoogleCallback(params) {
+    return this.finishCallback("google", params);
+  }
+  finishGitHubCallback(params) {
+    return this.finishCallback("github", params);
+  }
+  startLogin(provider, returnTo) {
+    this.providerConfig(provider);
+    const { attempt, codeChallenge } = this.state.create({
+      provider,
+      intent: "login",
+      returnTo
+    });
+    return this.provider(provider).authorizationUrl(attempt, codeChallenge);
   }
-  async startGoogleLink(userId, returnTo) {
-    this.googleConfig();
+  async startLink(provider, userId, returnTo) {
+    this.providerConfig(provider);
     const user = await this.users.getById(userId);
     if (user.status !== "active")
       throw new OAuthFlowError("oauth_account_inactive", 403);
     const sessionVersion = await this.tokens.getSessionVersion(userId);
     const { attempt, codeChallenge } = this.state.create({
+      provider,
       intent: "link",
       returnTo,
       userId,
       sessionVersion
     });
-    return { authorizationUrl: this.google.authorizationUrl(attempt, codeChallenge) };
+    return { authorizationUrl: this.provider(provider).authorizationUrl(attempt, codeChallenge) };
   }
-  async finishGoogleCallback(params) {
+  async finishCallback(provider, params) {
     try {
-      this.googleConfig();
+      this.providerConfig(provider);
       if (!params.state)
         throw new OAuthFlowError("oauth_state_invalid");
-      const attempt = this.state.consume(params.state);
+      const attempt = this.state.consume(provider, params.state);
       if (params.error) {
         throw new OAuthFlowError(params.error === "access_denied" ? "oauth_access_denied" : "oauth_provider_error");
       }
       if (!params.code)
         throw new OAuthFlowError("oauth_provider_error");
-      const identity = await this.google.exchange(params.code, attempt);
+      const identity = await this.provider(provider).exchange(params.code, attempt);
       if (attempt.intent === "link") {
         if (!attempt.userId || attempt.sessionVersion === void 0) {
           throw new OAuthFlowError("oauth_state_invalid");
@@ -6523,25 +6683,26 @@ var OAuthService = class OAuthService2 {
         }
         await this.sessions.establish(user);
       }
-      return this.frontendSuccessUrl(attempt.returnTo, attempt.intent);
+      return this.frontendSuccessUrl(provider, attempt.returnTo, attempt.intent);
     } catch (error) {
       const code = this.publicErrorCode(error);
-      this.logger.warn("Google OAuth callback failed", { provider: "google", code });
-      return this.frontendErrorUrl(code);
+      this.logger.warn("OAuth callback failed", { provider, code });
+      return this.frontendErrorUrl(provider, code);
     }
   }
-  frontendSuccessUrl(returnTo, mode) {
-    const google = this.googleConfig();
-    const url = new URL(google.frontendCallbackPath, this.config.frontendUrl);
-    url.searchParams.set("provider", "google");
+  frontendSuccessUrl(provider, returnTo, mode) {
+    const providerConfig = this.providerConfig(provider);
+    const url = new URL(providerConfig.frontendCallbackPath, this.config.frontendUrl);
+    url.searchParams.set("provider", provider);
     url.searchParams.set("mode", mode);
     url.searchParams.set("returnTo", this.state.validateReturnTo(returnTo));
     return url.toString();
   }
-  frontendErrorUrl(code) {
-    const path2 = this.config.oauth?.google?.errorRedirectPath ?? "/login";
+  frontendErrorUrl(provider, code) {
+    const path2 = this.config.oauth?.[provider]?.errorRedirectPath ?? "/login";
     const url = new URL(path2, this.config.frontendUrl);
     url.searchParams.set("oauthError", code);
+    url.searchParams.set("provider", provider);
     return url.toString();
   }
   publicErrorCode(error) {
@@ -6551,34 +6712,37 @@ var OAuthService = class OAuthService2 {
       return error.message;
     return "oauth_provider_error";
   }
-  googleConfig() {
-    const google = this.config.oauth?.google;
-    if (!google)
+  provider(provider) {
+    return provider === "google" ? this.google : this.github;
+  }
+  providerConfig(provider) {
+    const providerConfig = this.config.oauth?.[provider];
+    if (!providerConfig)
       throw new OAuthFlowError("oauth_provider_disabled", 404);
-    return google;
+    return providerConfig;
   }
 };
-__decorate38([
-  Inject21(AUTH_CONFIG),
-  __metadata38("design:type", Object)
+__decorate39([
+  Inject22(AUTH_CONFIG),
+  __metadata39("design:type", Object)
 ], OAuthService.prototype, "config", void 0);
-__decorate38([
+__decorate39([
   Log2(),
-  __metadata38("design:type", Object)
+  __metadata39("design:type", Object)
 ], OAuthService.prototype, "logger", void 0);
-OAuthService = __decorate38([
-  Injectable21(),
-  __metadata38("design:paramtypes", [typeof (_a24 = typeof OAuthStateService !== "undefined" && OAuthStateService) === "function" ? _a24 : Object, typeof (_b14 = typeof GoogleOAuthProvider !== "undefined" && GoogleOAuthProvider) === "function" ? _b14 : Object, typeof (_c10 = typeof OAuthAccountService !== "undefined" && OAuthAccountService) === "function" ? _c10 : Object, typeof (_d8 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _d8 : Object, typeof (_e5 = typeof TokenService !== "undefined" && TokenService) === "function" ? _e5 : Object, typeof (_f5 = typeof UserService !== "undefined" && UserService) === "function" ? _f5 : Object, typeof (_g4 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _g4 : Object])
+OAuthService = __decorate39([
+  Injectable22(),
+  __metadata39("design:paramtypes", [typeof (_a24 = typeof OAuthStateService !== "undefined" && OAuthStateService) === "function" ? _a24 : Object, typeof (_b14 = typeof GoogleOAuthProvider !== "undefined" && GoogleOAuthProvider) === "function" ? _b14 : Object, typeof (_c10 = typeof GitHubOAuthProvider !== "undefined" && GitHubOAuthProvider) === "function" ? _c10 : Object, typeof (_d8 = typeof OAuthAccountService !== "undefined" && OAuthAccountService) === "function" ? _d8 : Object, typeof (_e5 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _e5 : Object, typeof (_f5 = typeof TokenService !== "undefined" && TokenService) === "function" ? _f5 : Object, typeof (_g4 = typeof UserService !== "undefined" && UserService) === "function" ? _g4 : Object, typeof (_h3 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _h3 : Object])
 ], OAuthService);
 
-// src/oauth/OAuthController.ts
-var __decorate39 = function(decorators, target, key, desc) {
+// src/oauth/GitHubOAuthController.ts
+var __decorate40 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata39 = function(k, v) {
+var __metadata40 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param13 = function(paramIndex, decorator) {
@@ -6588,63 +6752,141 @@ var __param13 = function(paramIndex, decorator) {
 };
 var _a25;
 var callbackKey = /* @__PURE__ */ __name((ctx, { clientIp }) => {
-  const ip = clientIp;
   const state = ctx.req.query("state") ?? "none";
   const fingerprint = createHash5("sha256").update(state).digest("base64url").slice(0, 24);
-  return `${ip}:${fingerprint}`;
+  return `${clientIp}:${fingerprint}`;
 }, "callbackKey");
-var OAuthController = class OAuthController2 {
+var GitHubOAuthController = class GitHubOAuthController2 {
   static {
-    __name(this, "OAuthController");
+    __name(this, "GitHubOAuthController");
   }
   oauth;
   constructor(oauth) {
     this.oauth = oauth;
   }
   start(ctx, returnTo) {
-    return ctx.redirect(this.oauth.startGoogleLogin(returnTo), 302);
+    return ctx.redirect(this.oauth.startGitHubLogin(returnTo), 302);
   }
   async callback(ctx, code, state, error) {
-    const redirect = await this.oauth.finishGoogleCallback({ code, state, error });
+    const redirect = await this.oauth.finishGitHubCallback({ code, state, error });
     return ctx.redirect(redirect, 302);
   }
   link(userId, returnTo) {
-    return this.oauth.startGoogleLink(userId, returnTo);
+    return this.oauth.startGitHubLink(userId, returnTo);
   }
 };
-__decorate39([
+__decorate40([
   Get5("/start"),
   RateLimit3({ limit: 20, window: "15m", key: "ip" }),
   __param13(0, Ctx2()),
   __param13(1, Query2("returnTo")),
-  __metadata39("design:type", Function),
-  __metadata39("design:paramtypes", [Object, String]),
-  __metadata39("design:returntype", void 0)
-], OAuthController.prototype, "start", null);
-__decorate39([
+  __metadata40("design:type", Function),
+  __metadata40("design:paramtypes", [Object, String]),
+  __metadata40("design:returntype", void 0)
+], GitHubOAuthController.prototype, "start", null);
+__decorate40([
   Get5("/callback"),
   RateLimit3({ limit: 20, window: "15m", key: callbackKey }),
   __param13(0, Ctx2()),
   __param13(1, Query2("code")),
   __param13(2, Query2("state")),
   __param13(3, Query2("error")),
-  __metadata39("design:type", Function),
-  __metadata39("design:paramtypes", [Object, String, String, String]),
-  __metadata39("design:returntype", Promise)
-], OAuthController.prototype, "callback", null);
-__decorate39([
+  __metadata40("design:type", Function),
+  __metadata40("design:paramtypes", [Object, String, String, String]),
+  __metadata40("design:returntype", Promise)
+], GitHubOAuthController.prototype, "callback", null);
+__decorate40([
   Post6("/link"),
   isAuth(),
   RateLimit3({ limit: 10, window: "15m", key: "user" }),
   __param13(0, User5("id")),
   __param13(1, Query2("returnTo")),
-  __metadata39("design:type", Function),
-  __metadata39("design:paramtypes", [String, String]),
-  __metadata39("design:returntype", void 0)
+  __metadata40("design:type", Function),
+  __metadata40("design:paramtypes", [String, String]),
+  __metadata40("design:returntype", void 0)
+], GitHubOAuthController.prototype, "link", null);
+GitHubOAuthController = __decorate40([
+  Controller6("/auth/oauth/github"),
+  __metadata40("design:paramtypes", [typeof (_a25 = typeof OAuthService !== "undefined" && OAuthService) === "function" ? _a25 : Object])
+], GitHubOAuthController);
+
+// src/oauth/OAuthController.ts
+import { createHash as createHash6 } from "crypto";
+import { Controller as Controller7, Ctx as Ctx3, Get as Get6, Post as Post7, Query as Query3, User as User6 } from "najm-core";
+import { RateLimit as RateLimit4 } from "najm-rate";
+var __decorate41 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata41 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param14 = function(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+};
+var _a26;
+var callbackKey2 = /* @__PURE__ */ __name((ctx, { clientIp }) => {
+  const ip = clientIp;
+  const state = ctx.req.query("state") ?? "none";
+  const fingerprint = createHash6("sha256").update(state).digest("base64url").slice(0, 24);
+  return `${ip}:${fingerprint}`;
+}, "callbackKey");
+var OAuthController = class OAuthController2 {
+  static {
+    __name(this, "OAuthController");
+  }
+  oauth;
+  constructor(oauth) {
+    this.oauth = oauth;
+  }
+  start(ctx, returnTo) {
+    return ctx.redirect(this.oauth.startGoogleLogin(returnTo), 302);
+  }
+  async callback(ctx, code, state, error) {
+    const redirect = await this.oauth.finishGoogleCallback({ code, state, error });
+    return ctx.redirect(redirect, 302);
+  }
+  link(userId, returnTo) {
+    return this.oauth.startGoogleLink(userId, returnTo);
+  }
+};
+__decorate41([
+  Get6("/start"),
+  RateLimit4({ limit: 20, window: "15m", key: "ip" }),
+  __param14(0, Ctx3()),
+  __param14(1, Query3("returnTo")),
+  __metadata41("design:type", Function),
+  __metadata41("design:paramtypes", [Object, String]),
+  __metadata41("design:returntype", void 0)
+], OAuthController.prototype, "start", null);
+__decorate41([
+  Get6("/callback"),
+  RateLimit4({ limit: 20, window: "15m", key: callbackKey2 }),
+  __param14(0, Ctx3()),
+  __param14(1, Query3("code")),
+  __param14(2, Query3("state")),
+  __param14(3, Query3("error")),
+  __metadata41("design:type", Function),
+  __metadata41("design:paramtypes", [Object, String, String, String]),
+  __metadata41("design:returntype", Promise)
+], OAuthController.prototype, "callback", null);
+__decorate41([
+  Post7("/link"),
+  isAuth(),
+  RateLimit4({ limit: 10, window: "15m", key: "user" }),
+  __param14(0, User6("id")),
+  __param14(1, Query3("returnTo")),
+  __metadata41("design:type", Function),
+  __metadata41("design:paramtypes", [String, String]),
+  __metadata41("design:returntype", void 0)
 ], OAuthController.prototype, "link", null);
-OAuthController = __decorate39([
-  Controller6("/auth/oauth/google"),
-  __metadata39("design:paramtypes", [typeof (_a25 = typeof OAuthService !== "undefined" && OAuthService) === "function" ? _a25 : Object])
+OAuthController = __decorate41([
+  Controller7("/auth/oauth/google"),
+  __metadata41("design:paramtypes", [typeof (_a26 = typeof OAuthService !== "undefined" && OAuthService) === "function" ? _a26 : Object])
 ], OAuthController);
 
 // src/oauth/index.ts
@@ -6654,13 +6896,15 @@ var OAUTH_MODULE = [
   OAuthStateService,
   GoogleTokenVerifier,
   GoogleOAuthProvider,
+  GitHubOAuthProvider,
   OAuthService,
-  OAuthController
+  OAuthController,
+  GitHubOAuthController
 ];
 
 // src/credentialSetup/CredentialSetupController.ts
-import { Body as Body7, Controller as Controller7, Get as Get6, Post as Post7, ResMsg as ResMsg6 } from "najm-core";
-import { RateLimit as RateLimit4 } from "najm-rate";
+import { Body as Body7, Controller as Controller8, Get as Get7, Post as Post8, ResMsg as ResMsg6 } from "najm-core";
+import { RateLimit as RateLimit5 } from "najm-rate";
 import { Validate as Validate6 } from "najm-validation";
 
 // src/credentialSetup/CredentialSetupDto.ts
@@ -6671,21 +6915,21 @@ var credentialSetupChangeDto = z5.object({
 });
 
 // src/credentialSetup/CredentialSetupController.ts
-var __decorate40 = function(decorators, target, key, desc) {
+var __decorate42 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata40 = function(k, v) {
+var __metadata42 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param14 = function(paramIndex, decorator) {
+var __param15 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
-var _a26;
+var _a27;
 var CredentialSetupController = class CredentialSetupController2 {
   static {
     __name(this, "CredentialSetupController");
@@ -6704,35 +6948,35 @@ var CredentialSetupController = class CredentialSetupController2 {
     return this.passwords.cancel();
   }
 };
-__decorate40([
-  Get6("/setup"),
-  RateLimit4({ limit: 30, window: "15m", key: "ip" }),
+__decorate42([
+  Get7("/setup"),
+  RateLimit5({ limit: 30, window: "15m", key: "ip" }),
   ResMsg6("auth.success.credentialSetupPending"),
-  __metadata40("design:type", Function),
-  __metadata40("design:paramtypes", []),
-  __metadata40("design:returntype", void 0)
+  __metadata42("design:type", Function),
+  __metadata42("design:paramtypes", []),
+  __metadata42("design:returntype", void 0)
 ], CredentialSetupController.prototype, "status", null);
-__decorate40([
-  Post7("/change"),
-  RateLimit4({ limit: 5, window: "15m", key: "ip" }),
+__decorate42([
+  Post8("/change"),
+  RateLimit5({ limit: 5, window: "15m", key: "ip" }),
   Validate6(credentialSetupChangeDto),
   ResMsg6("auth.success.credentialSetupPasswordReplaced"),
-  __param14(0, Body7()),
-  __metadata40("design:type", Function),
-  __metadata40("design:paramtypes", [Object]),
-  __metadata40("design:returntype", void 0)
+  __param15(0, Body7()),
+  __metadata42("design:type", Function),
+  __metadata42("design:paramtypes", [Object]),
+  __metadata42("design:returntype", void 0)
 ], CredentialSetupController.prototype, "change", null);
-__decorate40([
-  Post7("/cancel"),
-  RateLimit4({ limit: 10, window: "15m", key: "ip" }),
+__decorate42([
+  Post8("/cancel"),
+  RateLimit5({ limit: 10, window: "15m", key: "ip" }),
   ResMsg6("auth.success.credentialSetupCancelled"),
-  __metadata40("design:type", Function),
-  __metadata40("design:paramtypes", []),
-  __metadata40("design:returntype", void 0)
+  __metadata42("design:type", Function),
+  __metadata42("design:paramtypes", []),
+  __metadata42("design:returntype", void 0)
 ], CredentialSetupController.prototype, "cancel", null);
-CredentialSetupController = __decorate40([
-  Controller7("/auth/credential-setup"),
-  __metadata40("design:paramtypes", [typeof (_a26 = typeof PasswordSetupService !== "undefined" && PasswordSetupService) === "function" ? _a26 : Object])
+CredentialSetupController = __decorate42([
+  Controller8("/auth/credential-setup"),
+  __metadata42("design:paramtypes", [typeof (_a27 = typeof PasswordSetupService !== "undefined" && PasswordSetupService) === "function" ? _a27 : Object])
 ], CredentialSetupController);
 
 // src/credentialSetup/index.ts
@@ -6758,6 +7002,19 @@ var validateFrontendPath = /* @__PURE__ */ __name((value, name) => {
   }
   return value;
 }, "validateFrontendPath");
+var validateCallbackUrl = /* @__PURE__ */ __name((value, name) => {
+  let callback;
+  try {
+    callback = new URL(value);
+  } catch {
+    throw new Error(`${name} must be an absolute URL`);
+  }
+  const local = callback.hostname === "localhost" || callback.hostname === "127.0.0.1" || callback.hostname === "[::1]" || callback.hostname === "::1";
+  if (callback.protocol !== "https:" && !(local && callback.protocol === "http:")) {
+    throw new Error(`${name} must use HTTPS (HTTP is allowed only for localhost)`);
+  }
+  return callback.toString();
+}, "validateCallbackUrl");
 var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
   const configuredGoogle = config?.oauth?.google;
   if (!configuredGoogle)
@@ -6771,20 +7028,10 @@ var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
     throw Err15.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
   const frontendUrl = config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000";
   const callbackUrl = google.callbackUrl ?? process.env.GOOGLE_CALLBACK_URL ?? `${frontendUrl.replace(/\/$/, "")}/api/auth/oauth/google/callback`;
-  let callback;
-  try {
-    callback = new URL(callbackUrl);
-  } catch {
-    throw new Error("auth.oauth.google.callbackUrl must be an absolute URL");
-  }
-  const local = callback.hostname === "localhost" || callback.hostname === "127.0.0.1" || callback.hostname === "[::1]" || callback.hostname === "::1";
-  if (callback.protocol !== "https:" && !(local && callback.protocol === "http:")) {
-    throw new Error("auth.oauth.google.callbackUrl must use HTTPS (HTTP is allowed only for localhost)");
-  }
   return {
     clientId,
     clientSecret,
-    callbackUrl: callback.toString(),
+    callbackUrl: validateCallbackUrl(callbackUrl, "auth.oauth.google.callbackUrl"),
     frontendCallbackPath: validateFrontendPath(google.frontendCallbackPath ?? "/auth/oauth/callback", "auth.oauth.google.frontendCallbackPath"),
     errorRedirectPath: validateFrontendPath(google.errorRedirectPath ?? "/login", "auth.oauth.google.errorRedirectPath"),
     allowSignup: google.allowSignup ?? true,
@@ -6792,6 +7039,29 @@ var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
     allowedHostedDomains: [...new Set((google.allowedHostedDomains ?? []).map((domain) => domain.trim().toLowerCase()).filter(Boolean))]
   };
 }, "resolveGoogleConfig");
+var resolveGitHubConfig = /* @__PURE__ */ __name((config) => {
+  const configuredGitHub = config?.oauth?.github;
+  if (!configuredGitHub)
+    return void 0;
+  const github = configuredGitHub === true ? {} : configuredGitHub;
+  const clientId = github.clientId ?? process.env.GITHUB_CLIENT_ID ?? "";
+  const clientSecret = github.clientSecret ?? process.env.GITHUB_CLIENT_SECRET ?? "";
+  if (!clientId)
+    throw Err15.configRequired("auth.oauth.github", "GITHUB_CLIENT_ID");
+  if (!clientSecret)
+    throw Err15.configRequired("auth.oauth.github", "GITHUB_CLIENT_SECRET");
+  const frontendUrl = config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000";
+  const callbackUrl = github.callbackUrl ?? process.env.GITHUB_CALLBACK_URL ?? `${frontendUrl.replace(/\/$/, "")}/api/auth/oauth/github/callback`;
+  return {
+    clientId,
+    clientSecret,
+    callbackUrl: validateCallbackUrl(callbackUrl, "auth.oauth.github.callbackUrl"),
+    frontendCallbackPath: validateFrontendPath(github.frontendCallbackPath ?? "/auth/oauth/callback", "auth.oauth.github.frontendCallbackPath"),
+    errorRedirectPath: validateFrontendPath(github.errorRedirectPath ?? "/login", "auth.oauth.github.errorRedirectPath"),
+    allowSignup: github.allowSignup ?? true,
+    autoLinkVerifiedEmail: github.autoLinkVerifiedEmail ?? false
+  };
+}, "resolveGitHubConfig");
 var resolveCredentialSetupConfig = /* @__PURE__ */ __name((config) => {
   const password = config?.credentialSetup?.password ?? {};
   const ttlMs = password.ttlMs ?? DEFAULT_CREDENTIAL_SETUP_TTL_MS;
@@ -6842,7 +7112,8 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
     },
     credentialSetup: resolveCredentialSetupConfig(config),
     oauth: {
-      google: resolveGoogleConfig(config)
+      google: resolveGoogleConfig(config),
+      github: resolveGitHubConfig(config)
     }
   };
   if (!finalConfig.jwt.accessSecret) {
@@ -6855,8 +7126,8 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
 }, "resolveAuthConfig");
 var selectAuthSchema = /* @__PURE__ */ __name((config) => {
   if (config?.schema) {
-    if (config.oauth?.google && !config.schema.oauthAccounts) {
-      throw new Error("auth.schema.oauthAccounts is required when Google OAuth is enabled");
+    if ((config.oauth?.google || config.oauth?.github) && !config.schema.oauthAccounts) {
+      throw new Error("auth.schema.oauthAccounts is required when OAuth is enabled");
     }
     if (!config.schema.credentialSetupSessions) {
       throw new Error("auth.schema.credentialSetupSessions is required \u2014 re-export it from najm-auth/pg or najm-auth/sqlite");