@ambushsoftworks/nestjs-auth-graphql 0.17.0 → 0.18.0

package/dist/services/email-challenge.service.d.ts

@@ -0,0 +1,74 @@
+import type { AuthModuleOptions } from '../auth.module';
+import { IAuthLogger } from '../interfaces/auth-logger.interface';
+import { IEmailChallengeRepository } from '../interfaces/email-challenge-repository.interface';
+import { IEmailService } from '../interfaces/email-service.interface';
+import { IRateLimiter } from '../interfaces/rate-limiter.interface';
+export declare const DEFAULT_EMAIL_CHALLENGE_ISSUE_LIMITS: {
+    readonly cooldownSeconds: 60;
+    readonly perHour: 5;
+    readonly perIpPerHour: 30;
+};
+export type EmailChallengeFailureReason = 'WRONG' | 'EXPIRED' | 'LOCKED';
+export type EmailChallengeResult = {
+    ok: true;
+    email: string;
+    purpose: string;
+} | {
+    ok: false;
+    reason: EmailChallengeFailureReason;
+};
+export interface IssuedEmailChallenge {
+    challengeId: string;
+    expiresAt: Date;
+    expiresInMinutes: number;
+}
+interface CallOptions {
+    realm?: string | null;
+    ipAddress?: string;
+}
+export declare class EmailChallengeService {
+    private readonly repository;
+    private readonly options;
+    private readonly securityLogger;
+    private readonly rateLimiter;
+    private readonly emailService;
+    private readonly logger;
+    private readonly key;
+    private readonly realmsEnabled;
+    private readonly ipHashSalt;
+    private lastSweepAt;
+    private warnedMissingIp;
+    constructor(repository: IEmailChallengeRepository | null, options: AuthModuleOptions, securityLogger: IAuthLogger, rateLimiter: IRateLimiter, emailService?: IEmailService | null);
+    get available(): boolean;
+    issue(input: {
+        email: string;
+        purpose: string;
+        emailData?: Record<string, unknown>;
+    }, opts?: CallOptions & {
+        ttlMinutes?: number;
+    }): Promise<IssuedEmailChallenge>;
+    verify(input: {
+        challengeId: string;
+        code: string;
+        email: string;
+        purpose: string;
+    }, opts?: CallOptions): Promise<EmailChallengeResult>;
+    revoke(input: {
+        purpose: string;
+        email?: string;
+    }, opts?: CallOptions): Promise<number>;
+    private requireRepository;
+    private requireIssuing;
+    private realmOf;
+    private mac;
+    private hashEmail;
+    private hashPurpose;
+    private hashCode;
+    private issueLimits;
+    private assertWithinLimits;
+    private record;
+    private cancelUnsent;
+    private sweep;
+}
+export {};
+//# sourceMappingURL=email-challenge.service.d.ts.map

package/dist/services/email-challenge.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-challenge.service.d.ts","sourceRoot":"","sources":["../../src/services/email-challenge.service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAEL,yBAAyB,EAC1B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAsBpE,eAAO,MAAM,oCAAoC;;;;CAIvC,CAAC;AAWX,MAAM,MAAM,2BAA2B,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEzE,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IAEnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,UAAU,WAAW;IAEnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAmCD,qBACa,qBAAqB;IAU9B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAjB/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,eAAe,CAAS;gBAIb,UAAU,EAAE,yBAAyB,GAAG,IAAI,EAE5C,OAAO,EAAE,iBAAiB,EAE1B,cAAc,EAAE,WAAW,EAE3B,WAAW,EAAE,YAAY,EAEzB,YAAY,GAAE,aAAa,GAAG,IAAW;IAqB5D,IAAI,SAAS,IAAI,OAAO,CAEvB;IAqBK,KAAK,CACT,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,EAC9E,IAAI,GAAE,WAAW,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAC/C,OAAO,CAAC,oBAAoB,CAAC;IA+E1B,MAAM,CACV,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAC5E,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,oBAAoB,CAAC;IAqE1B,MAAM,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAcjG,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,OAAO;IAaf,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,WAAW;YAsCL,kBAAkB;YAYlB,MAAM;YAON,YAAY;YAaZ,KAAK;CAgBpB"}

package/dist/services/email-challenge.service.js

@@ -0,0 +1,306 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var EmailChallengeService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EmailChallengeService = exports.DEFAULT_EMAIL_CHALLENGE_ISSUE_LIMITS = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const constants_1 = require("../constants");
+const auth_logger_interface_1 = require("../interfaces/auth-logger.interface");
+const email_challenge_exceptions_1 = require("../exceptions/email-challenge.exceptions");
+const step_up_exceptions_1 = require("../exceptions/step-up.exceptions");
+const ip_hash_1 = require("../utils/ip-hash");
+const rate_limit_helpers_1 = require("../utils/rate-limit-helpers");
+const CODE_ATTEMPTS = 3;
+const DEFAULT_TTL_MINUTES = 15;
+const MAX_TTL_MINUTES = 60;
+const MAX_PURPOSE_LENGTH = 200;
+const MAX_CHALLENGE_ID_LENGTH = 128;
+const CHALLENGE_ID_BYTES = 32;
+const HOUR_MS = 3_600_000;
+const SWEEP_THROTTLE_MS = 2 * 60_000;
+const HKDF_INFO = 'nestjs-auth-graphql email-challenge/v1';
+exports.DEFAULT_EMAIL_CHALLENGE_ISSUE_LIMITS = {
+    cooldownSeconds: 60,
+    perHour: 5,
+    perIpPerHour: 30,
+};
+let EmailChallengeService = EmailChallengeService_1 = class EmailChallengeService {
+    constructor(repository, options, securityLogger, rateLimiter, emailService = null) {
+        this.repository = repository;
+        this.options = options;
+        this.securityLogger = securityLogger;
+        this.rateLimiter = rateLimiter;
+        this.emailService = emailService;
+        this.logger = new common_1.Logger(EmailChallengeService_1.name);
+        this.lastSweepAt = 0;
+        this.warnedMissingIp = false;
+        this.key = Buffer.from((0, crypto_1.hkdfSync)('sha256', options.verificationCodeSecret || options.jwtSecret, Buffer.alloc(0), HKDF_INFO, 32));
+        this.realmsEnabled = Boolean(options.realmExtractorInstance);
+        this.ipHashSalt = process.env.AUTH_IP_HASH_SALT || options.jwtSecret || '';
+    }
+    get available() {
+        return this.repository !== null && typeof this.emailService?.sendEmailChallengeCode === 'function';
+    }
+    async issue(input, opts = {}) {
+        const { repository, send } = this.requireIssuing();
+        const realm = this.realmOf(opts);
+        const email = (0, rate_limit_helpers_1.normaliseEmail)(input.email);
+        const purpose = requirePurpose(input.purpose);
+        const emailData = requireEmailData(input.emailData);
+        const ttlMinutes = requireTtl(opts.ttlMinutes ?? this.options.emailChallenge?.ttlMinutes);
+        const emailHash = this.hashEmail(email, realm);
+        const purposeHash = this.hashPurpose(purpose, realm);
+        const { cooldown, hourly, perIp } = this.issueLimits(emailHash, purposeHash, realm, opts.ipAddress);
+        await this.assertWithinLimits([cooldown, hourly, perIp]);
+        await this.record([cooldown, perIp]);
+        const id = (0, crypto_1.randomBytes)(CHALLENGE_ID_BYTES).toString('base64url');
+        const code = String((0, crypto_1.randomInt)(0, 1_000_000)).padStart(6, '0');
+        const now = Date.now();
+        const expiresAt = new Date(now + ttlMinutes * 60_000);
+        await repository.invalidateChallenges({ purposeHash, emailHash });
+        await repository.createChallenge({
+            id,
+            emailHash,
+            purposeHash,
+            codeHash: this.hashCode(id, code),
+            attempts: 0,
+            consumedAt: null,
+            expiresAt,
+            createdAt: new Date(now),
+        });
+        try {
+            await send(email, code, ttlMinutes, {
+                purpose,
+                ...(emailData !== undefined ? { data: emailData } : {}),
+            });
+        }
+        catch (error) {
+            await this.cancelUnsent(repository, id);
+            this.securityLogger.error('Email challenge code could not be sent', error instanceof Error ? error.stack : String(error), 'EmailChallengeService');
+            throw new email_challenge_exceptions_1.EmailChallengeSendFailedException();
+        }
+        await this.record([hourly]);
+        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.EMAIL_CHALLENGE_ISSUED, {
+            email,
+            purpose,
+            realm,
+            ipAddress: opts.ipAddress,
+            challenge: challengeRef(id),
+            expiresAt,
+        });
+        void this.sweep(repository);
+        return { challengeId: id, expiresAt, expiresInMinutes: ttlMinutes };
+    }
+    async verify(input, opts = {}) {
+        const repository = this.requireRepository();
+        const realm = this.realmOf(opts);
+        const email = (0, rate_limit_helpers_1.normaliseEmail)(input.email);
+        const purpose = requirePurpose(input.purpose);
+        const id = input.challengeId;
+        const refuse = (reason, cause) => {
+            this.securityLogger.log(reason === 'LOCKED' ? auth_logger_interface_1.SecurityEvent.EMAIL_CHALLENGE_LOCKED : auth_logger_interface_1.SecurityEvent.EMAIL_CHALLENGE_FAILED, {
+                email,
+                purpose,
+                realm,
+                ipAddress: opts.ipAddress,
+                ...(typeof id === 'string' ? { challenge: challengeRef(id) } : {}),
+                reason: cause,
+            });
+            return { ok: false, reason };
+        };
+        if (typeof id !== 'string' || id === '' || id.length > MAX_CHALLENGE_ID_LENGTH) {
+            return refuse('EXPIRED', 'challenge_malformed');
+        }
+        const challenge = await repository.findChallenge(id);
+        if (!challenge)
+            return refuse('EXPIRED', 'challenge_unknown');
+        if (!sameHash(challenge.emailHash, this.hashEmail(email, realm))) {
+            return refuse('EXPIRED', 'email_mismatch');
+        }
+        if (!sameHash(challenge.purposeHash, this.hashPurpose(purpose, realm))) {
+            return refuse('EXPIRED', 'purpose_mismatch');
+        }
+        if (challenge.expiresAt.getTime() <= Date.now())
+            return refuse('EXPIRED', 'challenge_expired');
+        if (!(await repository.registerAttempt(id, CODE_ATTEMPTS))) {
+            const latest = await repository.findChallenge(id);
+            return latest && latest.consumedAt === null
+                ? refuse('LOCKED', 'attempts_exhausted')
+                : refuse('EXPIRED', 'challenge_consumed');
+        }
+        if (typeof input.code !== 'string' || !sameHash(challenge.codeHash, this.hashCode(id, input.code))) {
+            return refuse('WRONG', 'code_wrong');
+        }
+        if (!(await repository.consumeChallenge(id)))
+            return refuse('EXPIRED', 'challenge_consumed');
+        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.EMAIL_CHALLENGE_VERIFIED, {
+            email,
+            purpose,
+            realm,
+            ipAddress: opts.ipAddress,
+            challenge: challengeRef(id),
+        });
+        return { ok: true, email, purpose };
+    }
+    async revoke(input, opts = {}) {
+        const repository = this.requireRepository();
+        const realm = this.realmOf(opts);
+        const purpose = requirePurpose(input.purpose);
+        return repository.invalidateChallenges({
+            purposeHash: this.hashPurpose(purpose, realm),
+            ...(input.email !== undefined ? { emailHash: this.hashEmail((0, rate_limit_helpers_1.normaliseEmail)(input.email), realm) } : {}),
+        });
+    }
+    requireRepository() {
+        if (!this.repository)
+            throw new email_challenge_exceptions_1.EmailChallengeUnavailableException();
+        return this.repository;
+    }
+    requireIssuing() {
+        const service = this.emailService;
+        const send = service?.sendEmailChallengeCode;
+        if (!this.repository || !service || typeof send !== 'function') {
+            throw new email_challenge_exceptions_1.EmailChallengeUnavailableException();
+        }
+        return { repository: this.repository, send: send.bind(service) };
+    }
+    realmOf(opts) {
+        const realm = opts.realm ?? undefined;
+        if (this.realmsEnabled && realm === undefined) {
+            throw new common_1.BadRequestException('Realm required');
+        }
+        return realm;
+    }
+    mac(...parts) {
+        return (0, crypto_1.createHmac)('sha256', this.key).update(JSON.stringify(parts)).digest('hex');
+    }
+    hashEmail(email, realm) {
+        return this.mac('email', realm ?? null, email);
+    }
+    hashPurpose(purpose, realm) {
+        return this.mac('purpose', realm ?? null, purpose);
+    }
+    hashCode(challengeId, code) {
+        return this.mac('code', challengeId, code);
+    }
+    issueLimits(emailHash, purposeHash, realm, ipAddress) {
+        const configured = this.options.emailChallenge?.issueLimits;
+        const cooldownSeconds = configured?.cooldownSeconds ?? exports.DEFAULT_EMAIL_CHALLENGE_ISSUE_LIMITS.cooldownSeconds;
+        const perHour = configured?.perHour ?? exports.DEFAULT_EMAIL_CHALLENGE_ISSUE_LIMITS.perHour;
+        const perIpPerHour = configured?.perIpPerHour ?? exports.DEFAULT_EMAIL_CHALLENGE_ISSUE_LIMITS.perIpPerHour;
+        const subject = `${emailHash.slice(0, 32)}:${purposeHash.slice(0, 32)}`;
+        if (perIpPerHour > 0 && !ipAddress && !this.warnedMissingIp) {
+            this.warnedMissingIp = true;
+            this.logger.warn('EmailChallengeService.issue was called without opts.ipAddress, so the per-IP limit on ' +
+                'sending codes is not applied. Pass the client IP.');
+        }
+        return {
+            ...(cooldownSeconds > 0
+                ? { cooldown: { key: `auth:emailChallenge:cooldown:${subject}`, max: 1, windowMs: cooldownSeconds * 1000 } }
+                : {}),
+            hourly: { key: `auth:emailChallenge:hour:${subject}`, max: perHour, windowMs: HOUR_MS },
+            ...(perIpPerHour > 0 && ipAddress
+                ? {
+                    perIp: {
+                        key: `auth:emailChallenge:ip:${(0, rate_limit_helpers_1.realmKeyPrefix)(realm)}${(0, ip_hash_1.hashIp)(ipAddress, this.ipHashSalt)}`,
+                        max: perIpPerHour,
+                        windowMs: HOUR_MS,
+                    },
+                }
+                : {}),
+        };
+    }
+    async assertWithinLimits(limits) {
+        let retryAfter = 0;
+        for (const limit of limits) {
+            if (!limit)
+                continue;
+            const { allowed, resetAt } = await this.rateLimiter.checkRateLimit(limit.key, limit.max, limit.windowMs);
+            if (!allowed)
+                retryAfter = Math.max(retryAfter, (0, rate_limit_helpers_1.retryAfterSeconds)(resetAt));
+        }
+        if (retryAfter > 0) {
+            throw new step_up_exceptions_1.AuthRateLimitException('Too many code requests. Please try again later.', retryAfter);
+        }
+    }
+    async record(limits) {
+        for (const limit of limits) {
+            if (limit)
+                await this.rateLimiter.recordAttempt(limit.key, limit.windowMs);
+        }
+    }
+    async cancelUnsent(repository, id) {
+        try {
+            await repository.consumeChallenge(id);
+        }
+        catch (error) {
+            this.securityLogger.error('Email challenge could not be cancelled after its email failed to send; it expires on its own', error instanceof Error ? error.stack : String(error), 'EmailChallengeService');
+        }
+    }
+    async sweep(repository) {
+        const now = Date.now();
+        if (now - this.lastSweepAt < SWEEP_THROTTLE_MS) {
+            return;
+        }
+        this.lastSweepAt = now;
+        try {
+            await repository.deleteExpiredChallenges();
+        }
+        catch (error) {
+            this.logger.warn(`Sweeping expired email challenges failed: ${error instanceof Error ? error.message : String(error)}. Challenges still expire: verify checks expiry.`);
+        }
+    }
+};
+exports.EmailChallengeService = EmailChallengeService;
+exports.EmailChallengeService = EmailChallengeService = EmailChallengeService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.EMAIL_CHALLENGE_REPOSITORY)),
+    __param(1, (0, common_1.Inject)(constants_1.AUTH_MODULE_OPTIONS)),
+    __param(2, (0, common_1.Inject)(constants_1.AUTH_LOGGER)),
+    __param(3, (0, common_1.Inject)(constants_1.RATE_LIMITER)),
+    __param(4, (0, common_1.Inject)(constants_1.EMAIL_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, Object, Object, Object])
+], EmailChallengeService);
+function challengeRef(id) {
+    return (0, crypto_1.createHash)('sha256').update(id).digest('hex').slice(0, 16);
+}
+function sameHash(a, b) {
+    const left = Buffer.from(String(a), 'utf8');
+    const right = Buffer.from(b, 'utf8');
+    return left.length === right.length && (0, crypto_1.timingSafeEqual)(left, right);
+}
+function requirePurpose(purpose) {
+    if (typeof purpose !== 'string' || purpose.length === 0 || purpose.length > MAX_PURPOSE_LENGTH) {
+        throw new common_1.BadRequestException(`An email challenge needs a purpose: a non-empty string of at most ${MAX_PURPOSE_LENGTH} characters`);
+    }
+    return purpose;
+}
+function requireTtl(ttlMinutes) {
+    if (ttlMinutes === undefined)
+        return DEFAULT_TTL_MINUTES;
+    if (typeof ttlMinutes !== 'number' || !Number.isInteger(ttlMinutes) || ttlMinutes < 1 || ttlMinutes > MAX_TTL_MINUTES) {
+        throw new common_1.BadRequestException(`ttlMinutes must be an integer from 1 to ${MAX_TTL_MINUTES}`);
+    }
+    return ttlMinutes;
+}
+function requireEmailData(data) {
+    if (data === undefined)
+        return undefined;
+    if (typeof data !== 'object' || data === null || Array.isArray(data)) {
+        throw new common_1.BadRequestException('emailData must be an object');
+    }
+    return data;
+}
+//# sourceMappingURL=email-challenge.service.js.map

package/dist/services/email-challenge.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-challenge.service.js","sourceRoot":"","sources":["../../src/services/email-challenge.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAiF;AACjF,mCAAmG;AACnG,4CAMsB;AAEtB,+EAAiF;AAOjF,yFAGkD;AAClD,yEAA0E;AAC1E,8CAA0C;AAC1C,oEAAgG;AAGhG,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AACrC,MAAM,SAAS,GAAG,wCAAwC,CAAC;AAG9C,QAAA,oCAAoC,GAAG;IAClD,eAAe,EAAE,EAAE;IACnB,OAAO,EAAE,CAAC;IACV,YAAY,EAAE,EAAE;CACR,CAAC;AAiEJ,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAQhC,YAEE,UAA6D,EAE7D,OAA2C,EAE3C,cAA4C,EAE5C,WAA0C,EAE1C,eAAsD,IAAI;QARzC,eAAU,GAAV,UAAU,CAAkC;QAE5C,YAAO,GAAP,OAAO,CAAmB;QAE1B,mBAAc,GAAd,cAAc,CAAa;QAE3B,gBAAW,GAAX,WAAW,CAAc;QAEzB,iBAAY,GAAZ,YAAY,CAA6B;QAjB3C,WAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;QAIzD,gBAAW,GAAG,CAAC,CAAC;QAChB,oBAAe,GAAG,KAAK,CAAC;QAgB9B,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CACpB,IAAA,iBAAQ,EACN,QAAQ,EACR,OAAO,CAAC,sBAAsB,IAAI,OAAO,CAAC,SAAS,EACnD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EACf,SAAS,EACT,EAAE,CACH,CACF,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAC7E,CAAC;IAMD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,YAAY,EAAE,sBAAsB,KAAK,UAAU,CAAC;IACrG,CAAC;IAqBD,KAAK,CAAC,KAAK,CACT,KAA8E,EAC9E,OAA8C,EAAE;QAEhD,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAA,mCAAc,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAE1F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAIpG,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAIzD,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAErC,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC;QAEtD,MAAM,UAAU,CAAC,oBAAoB,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,MAAM,UAAU,CAAC,eAAe,CAAC;YAC/B,EAAE;YACF,SAAS;YACT,WAAW;YACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;YACjC,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,IAAI;YAChB,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;SACzB,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE;gBAClC,OAAO;gBACP,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,CAAC,cAAc,CAAC,KAAK,CACvB,wCAAwC,EACxC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACpD,uBAAuB,CACxB,CAAC;YACF,MAAM,IAAI,8DAAiC,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,sBAAsB,EAAE;YAC5D,KAAK;YACL,OAAO;YACP,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;YAC3B,SAAS;SACV,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAE5B,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;IACtE,CAAC;IAeD,KAAK,CAAC,MAAM,CACV,KAA4E,EAC5E,OAAoB,EAAE;QAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAA,mCAAc,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC;QAE7B,MAAM,MAAM,GAAG,CAAC,MAAmC,EAAE,KAAa,EAAwB,EAAE;YAC1F,IAAI,CAAC,cAAc,CAAC,GAAG,CACrB,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,qCAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,qCAAa,CAAC,sBAAsB,EACjG;gBACE,KAAK;gBACL,OAAO;gBACP,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,MAAM,EAAE,KAAK;aACd,CACF,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC,CAAC;QAEF,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC/E,OAAO,MAAM,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAG9D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAK/F,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,eAAe,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;YAE3D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAClD,OAAO,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBACzC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;gBACxC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACnG,OAAO,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;QAE7F,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,wBAAwB,EAAE;YAC9D,KAAK;YACL,OAAO;YACP,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC;IAOD,KAAK,CAAC,MAAM,CAAC,KAA0C,EAAE,OAAoB,EAAE;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,UAAU,CAAC,oBAAoB,CAAC;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC;YAC7C,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAA,mCAAc,EAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxG,CAAC,CAAC;IACL,CAAC;IAMO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,+DAAkC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,cAAc;QAIpB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,EAAE,sBAAsB,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/D,MAAM,IAAI,+DAAkC,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAGO,OAAO,CAAC,IAAiB;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;QACtC,IAAI,IAAI,CAAC,aAAa,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAOO,GAAG,CAAC,GAAG,KAA2B;QACxC,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC;IAEO,SAAS,CAAC,KAAa,EAAE,KAAyB;QACxD,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAEO,WAAW,CAAC,OAAe,EAAE,KAAyB;QAC5D,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAEO,QAAQ,CAAC,WAAmB,EAAE,IAAY;QAChD,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAEO,WAAW,CACjB,SAAiB,EACjB,WAAmB,EACnB,KAAyB,EACzB,SAA6B;QAE7B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC;QAC5D,MAAM,eAAe,GAAG,UAAU,EAAE,eAAe,IAAI,4CAAoC,CAAC,eAAe,CAAC;QAC5G,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,4CAAoC,CAAC,OAAO,CAAC;QACpF,MAAM,YAAY,GAAG,UAAU,EAAE,YAAY,IAAI,4CAAoC,CAAC,YAAY,CAAC;QAEnG,MAAM,OAAO,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAExE,IAAI,YAAY,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5D,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wFAAwF;gBACtF,mDAAmD,CACtD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG,CAAC,eAAe,GAAG,CAAC;gBACrB,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,gCAAgC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,EAAE,EAAE;gBAC5G,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,EAAE,GAAG,EAAE,4BAA4B,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;YACvF,GAAG,CAAC,YAAY,GAAG,CAAC,IAAI,SAAS;gBAC/B,CAAC,CAAC;oBACE,KAAK,EAAE;wBACL,GAAG,EAAE,0BAA0B,IAAA,mCAAc,EAAC,KAAK,CAAC,GAAG,IAAA,gBAAM,EAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;wBAC3F,GAAG,EAAE,YAAY;wBACjB,QAAQ,EAAE,OAAO;qBAClB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,MAAgC;QAC/D,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzG,IAAI,CAAC,OAAO;gBAAE,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAA,sCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,2CAAsB,CAAC,iDAAiD,EAAE,UAAU,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAAgC;QACnD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAGO,KAAK,CAAC,YAAY,CAAC,UAAqC,EAAE,EAAU;QAC1E,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,cAAc,CAAC,KAAK,CACvB,8FAA8F,EAC9F,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACpD,uBAAuB,CACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAGO,KAAK,CAAC,KAAK,CAAC,UAAqC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,iBAAiB,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,uBAAuB,EAAE,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,kDAAkD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AA3WY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAUR,WAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAElC,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;IAE3B,WAAA,IAAA,eAAM,EAAC,uBAAW,CAAC,CAAA;IAEnB,WAAA,IAAA,eAAM,EAAC,wBAAY,CAAC,CAAA;IAEpB,WAAA,IAAA,eAAM,EAAC,yBAAa,CAAC,CAAA;;GAjBb,qBAAqB,CA2WjC;AAGD,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAmC,EAAE,CAAS;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAA,wBAAe,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,cAAc,CAAC,OAAgB;IACtC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAC/F,MAAM,IAAI,4BAAmB,CAC3B,qEAAqE,kBAAkB,aAAa,CACrG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,UAAmB;IACrC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC;IACzD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;QACtH,MAAM,IAAI,4BAAmB,CAAC,2CAA2C,eAAe,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC"}

package/dist/services/passkey-signup-token.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-signup-token.service.d.ts","sourceRoot":"","sources":["../../src/services/passkey-signup-token.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAO7C,MAAM,WAAW,oBAAoB;IAEnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IAKf,QAAQ,EAAE,OAAO,CAAC;IAElB,SAAS,EAAE,IAAI,CAAC;CACjB;AA+BD,qBACa,yBAAyB;IAMlC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGL,OAAO,EAAE,iBAAiB,EACtC,UAAU,EAAE,UAAU;IAQnC,IAAI,CACR,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;IA2BvD,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBnF,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAC1E,CAAC,oBAAoB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CACrD;IAuBD,WAAW,CAAC,OAAO,EAAE,oBAAoB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAMxF,OAAO,CAAC,QAAQ;CAGjB"}
+{"version":3,"file":"passkey-signup-token.service.d.ts","sourceRoot":"","sources":["../../src/services/passkey-signup-token.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAO7C,MAAM,WAAW,oBAAoB;IAEnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IAKf,QAAQ,EAAE,OAAO,CAAC;IAElB,SAAS,EAAE,IAAI,CAAC;CACjB;AAiCD,qBACa,yBAAyB;IAMlC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGL,OAAO,EAAE,iBAAiB,EACtC,UAAU,EAAE,UAAU;IAQnC,IAAI,CACR,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;IA2BvD,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBnF,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAC1E,CAAC,oBAAoB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CACrD;IAuBD,WAAW,CAAC,OAAO,EAAE,oBAAoB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAYxF,OAAO,CAAC,QAAQ;CAGjB"}

package/dist/services/passkey-signup-token.service.js

@@ -33,7 +33,7 @@ let PasskeySignupTokenService = class PasskeySignupTokenService {
             purpose: PURPOSE,
             email,
             ...(realm !== undefined ? { realm } : {}),
-            codeHash: this.hashCode(code),
+            codeHash: this.hashCode(code, id),
             jti: id,
         };
         const signupId = await this.jwtService.signAsync(claims, {
@@ -86,11 +86,11 @@ let PasskeySignupTokenService = class PasskeySignupTokenService {
     }
     codeMatches(pending, code) {
         const expected = Buffer.from(pending.codeHash, 'hex');
-        const actual = Buffer.from(this.hashCode(code), 'hex');
+        const actual = Buffer.from(this.hashCode(code, pending.id), 'hex');
         return expected.length === actual.length && (0, crypto_1.timingSafeEqual)(expected, actual);
     }
-    hashCode(code) {
-        return (0, crypto_1.createHmac)('sha256', this.codeSecret).update(`${PURPOSE}:${code}`).digest('hex');
+    hashCode(code, signupId) {
+        return (0, crypto_1.createHmac)('sha256', this.codeSecret).update(`${PURPOSE}:${signupId}:${code}`).digest('hex');
     }
 };
 exports.PasskeySignupTokenService = PasskeySignupTokenService;

package/dist/services/passkey-signup-token.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-signup-token.service.js","sourceRoot":"","sources":["../../src/services/passkey-signup-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,qCAAyC;AACzC,mCAA2E;AAC3E,4CAAmD;AAItC,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAE7C,MAAM,QAAQ,GAAG,oCAAoC,CAAC;AACtD,MAAM,OAAO,GAAG,gBAAgB,CAAC;AACjC,MAAM,SAAS,GAAG,uCAAuC,CAAC;AA+CnD,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAIpC,YAC+B,OAA0B,EACtC,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;QAEvC,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CACpB,IAAA,iBAAQ,EAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CACtE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,sBAAsB,IAAI,OAAO,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,IAAI,CACR,KAAa,EACb,KAAyB,EACzB,IAAY;QAEZ,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;QACxB,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,OAAO;YAChB,KAAK;YACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC7B,GAAG,EAAE,EAAE;SACR,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO;YAClB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,kCAA0B,GAAG,EAAE;SAC3C,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kCAA0B,GAAG,MAAM,CAAC,EAAE,CAAC;IACjG,CAAC;IAWD,KAAK,CAAC,YAAY,CAAC,OAAoD;QACrE,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE;YACvC,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO;YAClB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;SACrF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAA4B,EAAE,KAAyB;QAGhE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAe,QAAQ,EAAE;gBACvE,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACrF,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI;gBAClC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;aAC9C,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAGD,WAAW,CAAC,OAAoD,EAAE,IAAY;QAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,IAAA,wBAAe,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAEO,QAAQ,CAAC,IAAY;QAC3B,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,CAAC;CACF,CAAA;AAhGY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;6CACC,gBAAU;GAN9B,yBAAyB,CAgGrC"}
+{"version":3,"file":"passkey-signup-token.service.js","sourceRoot":"","sources":["../../src/services/passkey-signup-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,qCAAyC;AACzC,mCAA2E;AAC3E,4CAAmD;AAItC,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAE7C,MAAM,QAAQ,GAAG,oCAAoC,CAAC;AACtD,MAAM,OAAO,GAAG,gBAAgB,CAAC;AACjC,MAAM,SAAS,GAAG,uCAAuC,CAAC;AAiDnD,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAIpC,YAC+B,OAA0B,EACtC,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;QAEvC,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CACpB,IAAA,iBAAQ,EAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CACtE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,sBAAsB,IAAI,OAAO,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,IAAI,CACR,KAAa,EACb,KAAyB,EACzB,IAAY;QAEZ,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;QACxB,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,OAAO;YAChB,KAAK;YACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACjC,GAAG,EAAE,EAAE;SACR,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO;YAClB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,kCAA0B,GAAG,EAAE;SAC3C,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kCAA0B,GAAG,MAAM,CAAC,EAAE,CAAC;IACjG,CAAC;IAWD,KAAK,CAAC,YAAY,CAAC,OAAoD;QACrE,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE;YACvC,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO;YAClB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;SACrF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAA4B,EAAE,KAAyB;QAGhE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAe,QAAQ,EAAE;gBACvE,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACrF,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI;gBAClC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;aAC9C,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAGD,WAAW,CAAC,OAAoD,EAAE,IAAY;QAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,IAAA,wBAAe,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAQO,QAAQ,CAAC,IAAY,EAAE,QAAgB;QAC7C,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtG,CAAC;CACF,CAAA;AAtGY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;6CACC,gBAAU;GAN9B,yBAAyB,CAsGrC"}

package/dist/services/passkey.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.service.d.ts","sourceRoot":"","sources":["../../src/services/passkey.service.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAE1E,OAAO,EACL,kBAAkB,EAKnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EACL,eAAe,EAGhB,MAAM,6BAA6B,CAAC;AAsBrC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAEL,yBAAyB,EAE1B,MAAM,gCAAgC,CAAC;AAYxC,KAAK,cAAc,GAAG;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACjF,CAAC;AAmCF,qBACa,cAAc;IASvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IA1BhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,eAAe,CAAS;gBAIb,UAAU,EAAE,kBAAkB,GAAG,IAAI,EAErC,QAAQ,EAAE,eAAe,GAAG,IAAI,EAEhC,OAAO,EAAE,iBAAiB,EAE1B,cAAc,EAAE,WAAW,EAE3B,cAAc,EAAE,mBAAmB,EAEnC,WAAW,EAAE,YAAY,EACzB,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,kBAAkB,EAEhC,YAAY,GAAE,aAAa,GAAG,IAAW,EAEzC,cAAc,GAAE,eAAe,GAAG,IAAW,EAE7C,YAAY,CAAC,EAAE,yBAAyB,YAAA;IAO3D,IAAI,OAAO,IAAI,OAAO,CAErB;IAaK,mBAAmB,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAC/B,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAwD5B,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACnE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,cAAc,CAAC;IAqGpB,qBAAqB,CACzB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,sBAAsB,CAAC;IAuC5B,oBAAoB,CACxB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EACpD,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,cAAc,CAAA;KAAO,GACtE,OAAO,CAAC;QACT,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,IAAI,CAAC;KACxB,CAAC;IAoDI,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+B7F,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EACpD,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBlD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxE,IAAI,eAAe,IAAI,OAAO,CAO7B;IAiBK,WAAW,CACf,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EACxB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;IAkD3C,gBAAgB,CACpB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EACzC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,sBAAsB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAkCnD,aAAa,CACjB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAC3B,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,sBAAsB,CAAC;YAiBpB,qBAAqB;IA4C7B,cAAc,CAClB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACrF,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC;QACT,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,SAAS,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,IAAI,CAAC;KACxB,CAAC;YA0HY,cAAc;IAc5B,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,aAAa;YAeP,YAAY;IAgBpB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAStF,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAC7C,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC,cAAc,CAAC;IAqBpB,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,EAC/B,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC,IAAI,CAAC;YAmCF,SAAS;YAuET,aAAa;YAkBb,cAAc;YAmBd,KAAK;YAiBL,gBAAgB;IAY9B,OAAO,CAAC,YAAY;IAIpB,OAAO,KAAK,gBAAgB,GAE3B;IAED,OAAO,KAAK,4BAA4B,GAEvC;IAED,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,MAAM;IA2Bd,OAAO,CAAC,QAAQ;CAsBjB"}
+{"version":3,"file":"passkey.service.d.ts","sourceRoot":"","sources":["../../src/services/passkey.service.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAE1E,OAAO,EACL,kBAAkB,EAKnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EACL,eAAe,EAGhB,MAAM,6BAA6B,CAAC;AAuBrC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAEL,yBAAyB,EAE1B,MAAM,gCAAgC,CAAC;AAaxC,KAAK,cAAc,GAAG;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACjF,CAAC;AAmCF,qBACa,cAAc;IASvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IA1BhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,eAAe,CAAS;gBAIb,UAAU,EAAE,kBAAkB,GAAG,IAAI,EAErC,QAAQ,EAAE,eAAe,GAAG,IAAI,EAEhC,OAAO,EAAE,iBAAiB,EAE1B,cAAc,EAAE,WAAW,EAE3B,cAAc,EAAE,mBAAmB,EAEnC,WAAW,EAAE,YAAY,EACzB,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,kBAAkB,EAEhC,YAAY,GAAE,aAAa,GAAG,IAAW,EAEzC,cAAc,GAAE,eAAe,GAAG,IAAW,EAE7C,YAAY,CAAC,EAAE,yBAAyB,YAAA;IAO3D,IAAI,OAAO,IAAI,OAAO,CAErB;IAaK,mBAAmB,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAC/B,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAwD5B,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACnE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,cAAc,CAAC;IAqGpB,qBAAqB,CACzB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,sBAAsB,CAAC;IAuC5B,oBAAoB,CACxB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EACpD,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,cAAc,CAAA;KAAO,GACtE,OAAO,CAAC;QACT,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,IAAI,CAAC;KACxB,CAAC;IAoDI,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+B7F,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EACpD,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBlD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxE,IAAI,eAAe,IAAI,OAAO,CAO7B;IAiBK,WAAW,CACf,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EACxB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;IAkD3C,gBAAgB,CACpB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EACzC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,sBAAsB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IA2CnD,aAAa,CACjB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAC3B,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,sBAAsB,CAAC;YAiBpB,qBAAqB;IA4C7B,cAAc,CAClB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACrF,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC;QACT,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,SAAS,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,IAAI,CAAC;KACxB,CAAC;YA0HY,cAAc;IAc5B,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,aAAa;YAeP,YAAY;IAgBpB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAStF,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAC7C,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC,cAAc,CAAC;IAqBpB,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,EAC/B,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC,IAAI,CAAC;YAmCF,SAAS;YAuET,aAAa;YAkBb,cAAc;YAmBd,KAAK;YAiBL,gBAAgB;IAY9B,OAAO,CAAC,YAAY;IAIpB,OAAO,KAAK,gBAAgB,GAE3B;IAED,OAAO,KAAK,4BAA4B,GAEvC;IAED,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,MAAM;IA2Bd,OAAO,CAAC,QAAQ;CAsBjB"}

package/dist/services/passkey.service.js

@@ -24,6 +24,7 @@ const webauthn_adapter_1 = require("../passkey/webauthn-adapter");
 const passkey_exceptions_1 = require("../exceptions/passkey.exceptions");
 const step_up_exceptions_1 = require("../exceptions/step-up.exceptions");
 const ip_hash_1 = require("../utils/ip-hash");
+const rate_limit_helpers_1 = require("../utils/rate-limit-helpers");
 const provider_helpers_1 = require("../utils/provider-helpers");
 const passkey_rp_1 = require("../utils/passkey-rp");
 const auth_service_1 = require("./auth.service");
@@ -37,6 +38,7 @@ const DEFAULT_RATE_LIMIT = { maxAttempts: 10, windowMs: 60_000 };
 const MAX_NAME_LENGTH = 64;
 const DEFAULT_NAME = 'Passkey';
 const SWEEP_THROTTLE_MS = 2 * 60_000;
+const SIGNUP_CODE_ATTEMPTS = 3;
 let PasskeyService = PasskeyService_1 = class PasskeyService {
     constructor(repository, webauthn, options, securityLogger, lifecycleHooks, rateLimiter, authService, stepUpTokens, emailService = null, userRepository = null, signupTokens) {
         this.repository = repository;
@@ -66,7 +68,7 @@ let PasskeyService = PasskeyService_1 = class PasskeyService {
             throw new step_up_exceptions_1.StepUpRequiredException();
         }
         const user = await this.authService.requireActiveUser(userId);
-        await this.enforceRateLimit(`auth:passkeyReg:${scope(opts.realm)}${userId}`);
+        await this.enforceRateLimit(`auth:passkeyReg:${(0, rate_limit_helpers_1.realmKeyPrefix)(opts.realm)}${userId}`);
         const rp = this.relyingParty(opts.realm);
         const existing = await repository.listCredentials(userId, opts.realm);
         const userHandle = existing[0]?.userHandle ?? Buffer.from((0, crypto_1.randomBytes)(USER_HANDLE_BYTES)).toString('base64url');
@@ -173,7 +175,7 @@ let PasskeyService = PasskeyService_1 = class PasskeyService {
         const { webauthn } = this.require();
         this.requireRealm(opts.realm);
         if (opts.ipAddress) {
-            await this.enforceRateLimit(`auth:passkeyAuth:${scope(opts.realm)}${(0, ip_hash_1.hashIp)(opts.ipAddress, this.ipHashSalt)}`);
+            await this.enforceRateLimit(`auth:passkeyAuth:${(0, rate_limit_helpers_1.realmKeyPrefix)(opts.realm)}${(0, ip_hash_1.hashIp)(opts.ipAddress, this.ipHashSalt)}`);
         }
         else if (!this.warnedMissingIp) {
             this.warnedMissingIp = true;
@@ -238,7 +240,7 @@ let PasskeyService = PasskeyService_1 = class PasskeyService {
         if (active.length === 0) {
             throw new step_up_exceptions_1.StepUpUnavailableException('passkey');
         }
-        await this.enforceRateLimit(`auth:passkeyStepUp:${scope(opts.realm)}${userId}`);
+        await this.enforceRateLimit(`auth:passkeyStepUp:${(0, rate_limit_helpers_1.realmKeyPrefix)(opts.realm)}${userId}`);
         const timeoutSeconds = this.authenticationTimeoutSeconds;
         const options = await webauthn.authenticationOptions({
             rp: this.relyingParty(opts.realm),
@@ -288,8 +290,8 @@ let PasskeyService = PasskeyService_1 = class PasskeyService {
     async startSignup(input, opts = {}) {
         const { users, tokens, email: mailer } = this.requireSignup();
         this.requireRealm(opts.realm);
-        const email = normaliseEmail(input.email);
-        const where = scope(opts.realm);
+        const email = (0, rate_limit_helpers_1.normaliseEmail)(input.email);
+        const where = (0, rate_limit_helpers_1.realmKeyPrefix)(opts.realm);
         if (opts.ipAddress) {
             await this.enforceLimit(`auth:passkeySignupIp:${where}${(0, ip_hash_1.hashIp)(opts.ipAddress, this.ipHashSalt)}`, 5, 3_600_000);
         }
@@ -322,10 +324,11 @@ let PasskeyService = PasskeyService_1 = class PasskeyService {
         if (!pending)
             return this.failSignup('signup_expired', opts, new passkey_exceptions_1.PasskeySignupExpiredException());
         const attemptsKey = `auth:passkeySignupCode:${pending.id}`;
-        const { allowed } = await this.rateLimiter.checkRateLimit(attemptsKey, 3, passkey_signup_token_service_1.PASSKEY_SIGNUP_TTL_MINUTES * 60_000);
+        const attemptsWindowMs = passkey_signup_token_service_1.PASSKEY_SIGNUP_TTL_MINUTES * 60_000;
+        await this.rateLimiter.recordAttempt(attemptsKey, attemptsWindowMs);
+        const { allowed } = await this.rateLimiter.checkRateLimit(attemptsKey, SIGNUP_CODE_ATTEMPTS + 1, attemptsWindowMs);
         if (!allowed)
             return this.failSignup('code_exhausted', opts, new passkey_exceptions_1.PasskeySignupCodeExhaustedException(), pending);
-        await this.rateLimiter.recordAttempt(attemptsKey, passkey_signup_token_service_1.PASSKEY_SIGNUP_TTL_MINUTES * 60_000);
         if (typeof input.code !== 'string' || !tokens.codeMatches(pending, input.code)) {
             return this.failSignup('code_invalid', opts, new passkey_exceptions_1.PasskeySignupCodeInvalidException(), pending);
         }
@@ -512,7 +515,7 @@ let PasskeyService = PasskeyService_1 = class PasskeyService {
     async enforceLimit(key, maxAttempts, windowMs) {
         const { allowed, resetAt } = await this.rateLimiter.checkRateLimit(key, maxAttempts, windowMs);
         if (!allowed) {
-            throw new step_up_exceptions_1.AuthRateLimitException('Too many sign-up requests. Please try again later.', retryAfterSeconds(resetAt));
+            throw new step_up_exceptions_1.AuthRateLimitException('Too many sign-up requests. Please try again later.', (0, rate_limit_helpers_1.retryAfterSeconds)(resetAt));
         }
         await this.rateLimiter.recordAttempt(key, windowMs);
     }
@@ -652,7 +655,7 @@ let PasskeyService = PasskeyService_1 = class PasskeyService {
         const { maxAttempts, windowMs } = this.options.passkey?.rateLimit ?? DEFAULT_RATE_LIMIT;
         const { allowed, resetAt } = await this.rateLimiter.checkRateLimit(key, maxAttempts, windowMs);
         if (!allowed) {
-            throw new step_up_exceptions_1.AuthRateLimitException('Too many passkey requests. Please try again later.', retryAfterSeconds(resetAt));
+            throw new step_up_exceptions_1.AuthRateLimitException('Too many passkey requests. Please try again later.', (0, rate_limit_helpers_1.retryAfterSeconds)(resetAt));
         }
         await this.rateLimiter.recordAttempt(key, windowMs);
     }
@@ -734,22 +737,9 @@ exports.PasskeyService = PasskeyService = PasskeyService_1 = __decorate([
     __metadata("design:paramtypes", [Object, Object, Object, Object, Object, Object, auth_service_1.AuthService,
         step_up_token_service_1.StepUpTokenService, Object, Object, passkey_signup_token_service_1.PasskeySignupTokenService])
 ], PasskeyService);
-function retryAfterSeconds(resetAt) {
-    return Math.max(1, Math.ceil((resetAt.getTime() - Date.now()) / 1000));
-}
-function scope(realm) {
-    return realm ? `${realm}:` : '';
-}
 function freshBytes(length) {
     return new Uint8Array((0, crypto_1.randomBytes)(length));
 }
-function normaliseEmail(email) {
-    const normalised = typeof email === 'string' ? email.trim().toLowerCase() : '';
-    if (!/^[^\s@]+@[^\s@]+$/.test(normalised)) {
-        throw new common_1.BadRequestException('A valid email address is required');
-    }
-    return normalised;
-}
 function signupBinding(pending) {
     return `signup:${pending.id}`;
 }