@furystack/security 7.0.9 → 8.0.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [8.0.0] - 2026-04-25
+
+### 💥 Breaking Changes
+
+Password policy, hasher, and authenticator are now DI tokens, not `@Injectable` classes. See the [v7 migration guide](../../docs/migrations/v7-functional-di.md) for rationale, recipes, and pitfalls.
+
+- Removed the `@Injectable`-based `PasswordAuthenticator` and `CryptoPasswordHasher` classes. Resolve them as tokens via `injector.get(PasswordAuthenticator)` / `injector.get(CryptoPasswordHasher)`.
+- Added `SecurityPolicy` interface + token. `usePasswordPolicy(injector, overrides?)` binds the settings, the hasher defaults, and the authenticator token.
+- `PasswordCredentialStore` and `PasswordResetTokenStore` are now throw-by-default `StoreToken`s. Apps must `injector.bind(…, factory)` a persistent implementation before resolving anything downstream.
+
 ## [7.0.9] - 2026-04-17
 
 ### ⬆️ Dependencies

package/README.md

@@ -15,10 +15,10 @@ yarn add @furystack/security
 ### Setup a password policy
 
 ```ts
-import { Injector } from '@furystack/inject'
+import { createInjector } from '@furystack/inject'
 import { usePasswordPolicy, createMinLengthComplexityRule, createMaxLengthComplexityRule } from '@furystack/security'
 
-const injector = new Injector()
+const injector = createInjector()
 usePasswordPolicy(injector, {
   passwordComplexityRules: [createMinLengthComplexityRule(8), createMaxLengthComplexityRule(64)],
   passwordExpirationDays: 90,
@@ -26,12 +26,18 @@ usePasswordPolicy(injector, {
 })
 ```
 
+`usePasswordPolicy` binds the `SecurityPolicy` settings, the
+`CryptoPasswordHasher` defaults, and the `PasswordAuthenticator` token.
+Applications must also bind concrete stores for the
+`PasswordCredentialStore` and `PasswordResetTokenStore` tokens (they
+throw by default) before resolving anything that depends on them.
+
 ### Check if a user's password is valid
 
 ```ts
 import { PasswordAuthenticator } from '@furystack/security'
 
-const authenticator = injector.getInstance(PasswordAuthenticator)
+const authenticator = injector.get(PasswordAuthenticator)
 
 const userName = 'john_doe'
 const plainPassword = 'SecureP@ssw0rd!'

package/esm/crypto-password-hasher.d.ts

@@ -1,14 +1,12 @@
+import { type Token } from '@furystack/inject';
 import type { PasswordHasher } from './password-hasher.js';
-import type { PasswordCheckResult, PasswordCredential } from './models/index.js';
-export declare class CryptoPasswordHasher implements PasswordHasher {
-    private readonly iterations;
-    private readonly keylen;
-    verifyCredential(password: string, { passwordHash, salt }: PasswordCredential): Promise<PasswordCheckResult>;
-    createCredential(userName: string, password: string): Promise<{
-        userName: string;
-        salt: string;
-        passwordHash: string;
-        creationDate: string;
-    }>;
-}
+/**
+ * Default PBKDF2-based {@link PasswordHasher} implementation. Uses SHA-512
+ * with 1000 iterations and a 64-byte derived key length.
+ *
+ * Swap this token in {@link SecurityPolicy.hasher} to replace the hashing
+ * algorithm — for example with a stronger Argon2 implementation or a
+ * delegated hashing service.
+ */
+export declare const CryptoPasswordHasher: Token<PasswordHasher, 'singleton'>;
 //# sourceMappingURL=crypto-password-hasher.d.ts.map

package/esm/crypto-password-hasher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto-password-hasher.d.ts","sourceRoot":"","sources":["../src/crypto-password-hasher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEhF,qBACa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAO;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAK;IAEf,gBAAgB,CAC3B,QAAQ,EAAE,MAAM,EAChB,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,kBAAkB,GACzC,OAAO,CAAC,mBAAmB,CAAC;IAgBlB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;CAcjE"}
+{"version":3,"file":"crypto-password-hasher.d.ts","sourceRoot":"","sources":["../src/crypto-password-hasher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAG7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAiB1D;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,cAAc,EAAE,WAAW,CAsBlE,CAAA"}

package/esm/crypto-password-hasher.js

@@ -1,39 +1,46 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-import { Injectable } from '@furystack/inject';
-import { randomBytes, pbkdf2 } from 'crypto';
-let CryptoPasswordHasher = class CryptoPasswordHasher {
-    iterations = 1000;
-    keylen = 64;
-    async verifyCredential(password, { passwordHash, salt }) {
-        const newHash = await new Promise((resolve, reject) => pbkdf2(password, salt, this.iterations, this.keylen, 'sha512', (err, key) => err ? reject(err) : resolve(key.toString('hex'))));
-        if (newHash === passwordHash) {
+import { defineService } from '@furystack/inject';
+import { pbkdf2, randomBytes } from 'crypto';
+const ITERATIONS = 1000;
+const KEY_LENGTH = 64;
+const SALT_BYTES = 16;
+const deriveHash = (password, salt) => new Promise((resolve, reject) => {
+    pbkdf2(password, salt, ITERATIONS, KEY_LENGTH, 'sha512', (err, key) => {
+        if (err) {
+            reject(err);
+            return;
+        }
+        resolve(key.toString('hex'));
+    });
+});
+/**
+ * Default PBKDF2-based {@link PasswordHasher} implementation. Uses SHA-512
+ * with 1000 iterations and a 64-byte derived key length.
+ *
+ * Swap this token in {@link SecurityPolicy.hasher} to replace the hashing
+ * algorithm — for example with a stronger Argon2 implementation or a
+ * delegated hashing service.
+ */
+export const CryptoPasswordHasher = defineService({
+    name: 'furystack/security/CryptoPasswordHasher',
+    lifetime: 'singleton',
+    factory: () => ({
+        verifyCredential: async (password, { passwordHash, salt }) => {
+            const candidate = await deriveHash(password, salt);
+            if (candidate === passwordHash) {
+                return { isValid: true };
+            }
+            return { isValid: false, reason: 'badUsernameOrPassword' };
+        },
+        createCredential: async (userName, password) => {
+            const salt = randomBytes(SALT_BYTES).toString('hex');
+            const passwordHash = await deriveHash(password, salt);
             return {
-                isValid: true,
+                userName,
+                salt,
+                passwordHash,
+                creationDate: new Date().toISOString(),
             };
-        }
-        return {
-            isValid: false,
-            reason: 'badUsernameOrPassword',
-        };
-    }
-    async createCredential(userName, password) {
-        const salt = randomBytes(16).toString('hex');
-        const passwordHash = await new Promise((resolve, reject) => pbkdf2(password, salt, this.iterations, this.keylen, 'sha512', (err, key) => err ? reject(err) : resolve(key.toString('hex'))));
-        return {
-            userName,
-            salt,
-            passwordHash,
-            creationDate: new Date().toISOString(),
-        };
-    }
-};
-CryptoPasswordHasher = __decorate([
-    Injectable({ lifetime: 'singleton' })
-], CryptoPasswordHasher);
-export { CryptoPasswordHasher };
+        },
+    }),
+});
 //# sourceMappingURL=crypto-password-hasher.js.map

package/esm/crypto-password-hasher.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto-password-hasher.js","sourceRoot":"","sources":["../src/crypto-password-hasher.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAIrC,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACd,UAAU,GAAG,IAAI,CAAA;IACjB,MAAM,GAAG,EAAE,CAAA;IAErB,KAAK,CAAC,gBAAgB,CAC3B,QAAgB,EAChB,EAAE,YAAY,EAAE,IAAI,EAAsB;QAE1C,MAAM,OAAO,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACpD,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC1E,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACjD,CACF,CAAA;QACD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO,EAAE,IAAI;aACd,CAAA;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,uBAAuB;SAChC,CAAA;IACH,CAAC;IACM,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,QAAgB;QAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,YAAY,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACjE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC1E,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACjD,CACF,CAAA;QACD,OAAO;YACL,QAAQ;YACR,IAAI;YACJ,YAAY;YACZ,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAA;IACH,CAAC;CACF,CAAA;AArCY,oBAAoB;IADhC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;GACzB,oBAAoB,CAqChC"}
+{"version":3,"file":"crypto-password-hasher.js","sourceRoot":"","sources":["../src/crypto-password-hasher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAc,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAI5C,MAAM,UAAU,GAAG,IAAI,CAAA;AACvB,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,UAAU,GAAG,EAAE,CAAA;AAErB,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAmB,EAAE,CACrE,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IACtC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACpE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,GAAG,CAAC,CAAA;YACX,OAAM;QACR,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAuC,aAAa,CAAC;IACpF,IAAI,EAAE,yCAAyC;IAC/C,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,GAAmB,EAAE,CAAC,CAAC;QAC9B,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,EAAgC,EAAE;YACzF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YAClD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YAC1B,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;QAC5D,CAAC;QACD,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;YAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YACpD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YACrD,OAAO;gBACL,QAAQ;gBACR,IAAI;gBACJ,YAAY;gBACZ,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACvC,CAAA;QACH,CAAC;KACF,CAAC;CACH,CAAC,CAAA"}

package/esm/helpers.d.ts

@@ -1,14 +1,27 @@
 import type { Injector } from '@furystack/inject';
 import { SecurityPolicy } from './security-policy.js';
 /**
- * Sets up the @furystack/security with the provided settings.
+ * Rebinds the {@link SecurityPolicy} on the given injector with the default
+ * policy merged with `overrides`.
  *
- * **Prerequisite:** DataSets for `PasswordCredential` and `PasswordResetToken` must be registered
- * via `getRepository(injector).createDataSet()` before `PasswordAuthenticator` is instantiated,
- * as it resolves these DataSets through `@Injected`.
+ * Apply this at application setup before resolving any service that reads
+ * the policy — {@link PasswordAuthenticator}, {@link SecurityPolicyManager}
+ * or direct `injector.get(SecurityPolicy)` callers. Because those services
+ * capture the policy at resolve time, calling `usePasswordPolicy` after
+ * they have been resolved has no effect unless you also invalidate them.
  *
- * @param injector The Injector instance
- * @param policy The security policy to use
+ * **Prerequisite:** bind persistent implementations of
+ * `PasswordCredentialStore` and `PasswordResetTokenStore` before resolving
+ * {@link PasswordAuthenticator}. Their default factories throw on purpose
+ * so password data is never silently kept in-memory.
+ *
+ * @example
+ * ```ts
+ * usePasswordPolicy(injector, {
+ *   passwordExpirationDays: 90,
+ *   passwordComplexityRules: [createMinLengthComplexityRule(8)],
+ * })
+ * ```
  */
-export declare const usePasswordPolicy: (injector: Injector, policy?: Partial<SecurityPolicy>) => void;
+export declare const usePasswordPolicy: (injector: Injector, overrides?: Partial<SecurityPolicy>) => void;
 //# sourceMappingURL=helpers.d.ts.map

package/esm/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../src/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,QAAQ,EAAE,SAAS,OAAO,CAAC,cAAc,CAAC,SAQrF,CAAA"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../src/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAGjD,OAAO,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE5E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,QAAQ,EAAE,YAAY,OAAO,CAAC,cAAc,CAAC,KAAG,IAK3F,CAAA"}

package/esm/helpers.js

@@ -1,19 +1,33 @@
-import { SecurityPolicy } from './security-policy.js';
+import { PasswordAuthenticator } from './password-authenticator.js';
+import { SecurityPolicyManager } from './security-policy-manager.js';
+import { defaultSecurityPolicy, SecurityPolicy } from './security-policy.js';
 /**
- * Sets up the @furystack/security with the provided settings.
+ * Rebinds the {@link SecurityPolicy} on the given injector with the default
+ * policy merged with `overrides`.
  *
- * **Prerequisite:** DataSets for `PasswordCredential` and `PasswordResetToken` must be registered
- * via `getRepository(injector).createDataSet()` before `PasswordAuthenticator` is instantiated,
- * as it resolves these DataSets through `@Injected`.
+ * Apply this at application setup before resolving any service that reads
+ * the policy — {@link PasswordAuthenticator}, {@link SecurityPolicyManager}
+ * or direct `injector.get(SecurityPolicy)` callers. Because those services
+ * capture the policy at resolve time, calling `usePasswordPolicy` after
+ * they have been resolved has no effect unless you also invalidate them.
  *
- * @param injector The Injector instance
- * @param policy The security policy to use
+ * **Prerequisite:** bind persistent implementations of
+ * `PasswordCredentialStore` and `PasswordResetTokenStore` before resolving
+ * {@link PasswordAuthenticator}. Their default factories throw on purpose
+ * so password data is never silently kept in-memory.
+ *
+ * @example
+ * ```ts
+ * usePasswordPolicy(injector, {
+ *   passwordExpirationDays: 90,
+ *   passwordComplexityRules: [createMinLengthComplexityRule(8)],
+ * })
+ * ```
  */
-export const usePasswordPolicy = (injector, policy) => {
-    const plainPolicy = new SecurityPolicy();
-    if (policy) {
-        Object.assign(plainPolicy, policy);
-    }
-    injector.setExplicitInstance(plainPolicy, SecurityPolicy);
+export const usePasswordPolicy = (injector, overrides) => {
+    injector.bind(SecurityPolicy, () => ({ ...defaultSecurityPolicy(), ...overrides }));
+    injector.invalidate(SecurityPolicy);
+    injector.invalidate(SecurityPolicyManager);
+    injector.invalidate(PasswordAuthenticator);
 };
 //# sourceMappingURL=helpers.js.map

package/esm/helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../src/helpers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAkB,EAAE,MAAgC,EAAE,EAAE;IACxF,MAAM,WAAW,GAAG,IAAI,cAAc,EAAE,CAAA;IAExC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACpC,CAAC;IAED,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;AAC3D,CAAC,CAAA"}
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../src/helpers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE5E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAkB,EAAE,SAAmC,EAAQ,EAAE;IACjG,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,qBAAqB,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,CAAA;IACnF,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;IACnC,QAAQ,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAA;IAC1C,QAAQ,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAA;AAC5C,CAAC,CAAA"}

package/esm/index.d.ts

@@ -1,9 +1,11 @@
 export * from './crypto-password-hasher.js';
 export * from './errors/index.js';
+export * from './helpers.js';
 export * from './models/index.js';
 export * from './password-authenticator.js';
 export * from './password-complexity-rules/index.js';
+export * from './password-credential-store.js';
 export * from './password-hasher.js';
 export * from './security-policy-manager.js';
-export * from './helpers.js';
+export * from './security-policy.js';
 //# sourceMappingURL=index.d.ts.map

package/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAA;AAC3C,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,sCAAsC,CAAA;AACpD,cAAc,sBAAsB,CAAA;AACpC,cAAc,8BAA8B,CAAA;AAE5C,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAA;AAC3C,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,sCAAsC,CAAA;AACpD,cAAc,gCAAgC,CAAA;AAC9C,cAAc,sBAAsB,CAAA;AACpC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,sBAAsB,CAAA"}

package/esm/index.js

@@ -1,9 +1,11 @@
 export * from './crypto-password-hasher.js';
 export * from './errors/index.js';
+export * from './helpers.js';
 export * from './models/index.js';
 export * from './password-authenticator.js';
 export * from './password-complexity-rules/index.js';
+export * from './password-credential-store.js';
 export * from './password-hasher.js';
 export * from './security-policy-manager.js';
-export * from './helpers.js';
+export * from './security-policy.js';
 //# sourceMappingURL=index.js.map

package/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAA;AAC3C,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,sCAAsC,CAAA;AACpD,cAAc,sBAAsB,CAAA;AACpC,cAAc,8BAA8B,CAAA;AAE5C,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAA;AAC3C,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,sCAAsC,CAAA;AACpD,cAAc,gCAAgC,CAAA;AAC9C,cAAc,sBAAsB,CAAA;AACpC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,sBAAsB,CAAA"}

package/esm/password-authenticator.d.ts

@@ -1,30 +1,41 @@
+import { type Token } from '@furystack/inject';
 import type { PasswordCheckResult } from './models/index.js';
 import type { PasswordHasher } from './password-hasher.js';
 import { SecurityPolicyManager } from './security-policy-manager.js';
-export declare class PasswordAuthenticator {
-    private readonly systemInjector;
-    private readonly passwordDataSet;
-    private readonly tokenDataSet;
+/**
+ * Authenticator surface: check stored credentials, rotate passwords and
+ * consume reset tokens. All writes are funneled through a system-identity
+ * scope so the underlying DataSets skip caller-scoped authorization.
+ */
+export interface PasswordAuthenticator {
+    /** The hasher bound by the active {@link SecurityPolicy}. Exposed for use in tests and migration helpers. */
     readonly hasher: PasswordHasher;
+    /** The {@link SecurityPolicyManager} resolved at construction. */
+    readonly policyManager: SecurityPolicyManager;
     /**
-     * @param userName The User's unique name
-     * @param plainPassword The plain password to check
-     * @returns An object that contains an { isValid } value that indicates if the password is valid
+     * Verifies that the stored credential for `userName` matches
+     * `plainPassword` and honours the policy's expiration rules.
      */
     checkPasswordForUser(userName: string, plainPassword: string): Promise<PasswordCheckResult>;
     /**
-     * Sets the password for the specific user
-     * @param userName The user to set the password for
-     * @param lastPassword The last user password
-     * @param plainPassword The password as a plain string
+     * Replaces the stored credential for `userName` with one derived from
+     * `plainPassword`. Requires the current `lastPassword` to be valid and
+     * `plainPassword` to pass the configured complexity rules.
      */
     setPasswordForUser(userName: string, lastPassword: string, plainPassword: string): Promise<void>;
     /**
-     * Resets the password with a Password Reset token entry
-     * @param resetToken The Reset Token value
-     * @param plainPassword The new password in plain string
+     * Consumes `resetToken` and rotates the associated user's password to
+     * one derived from `plainPassword`. Expired tokens are rejected and
+     * cleaned up; bad tokens raise {@link UnauthenticatedError}.
      */
     resetPasswordForUser(resetToken: string, plainPassword: string): Promise<void>;
-    policyManager: SecurityPolicyManager;
 }
+/**
+ * DI token for the singleton {@link PasswordAuthenticator}.
+ *
+ * The factory creates a system-identity child scope once (at first
+ * resolution) and uses it for every credential mutation. The scope is
+ * torn down alongside the owning injector via `onDispose`.
+ */
+export declare const PasswordAuthenticator: Token<PasswordAuthenticator, 'singleton'>;
 //# sourceMappingURL=password-authenticator.d.ts.map

package/esm/password-authenticator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-authenticator.d.ts","sourceRoot":"","sources":["../src/password-authenticator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEpE,qBACa,qBAAqB;IAChC,iBACyB,cAAc,CAAU;IAEjD,iBACyB,eAAe,CAAyC;IAEjF,iBACyB,YAAY,CAAsC;IAE3E,SAGwB,MAAM,EAAE,cAAc,CAAA;IAE9C;;;;OAIG;IACU,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAkBxG;;;;;OAKG;IACU,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB7G;;;;OAIG;IACU,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B5E,aAAa,EAAE,qBAAqB,CAAA;CACpD"}
+{"version":3,"file":"password-authenticator.d.ts","sourceRoot":"","sources":["../src/password-authenticator.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAG7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEpE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,6GAA6G;IAC7G,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAA;IAC7C;;;OAGG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC3F;;;;OAIG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChG;;;;OAIG;IACH,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/E;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE,WAAW,CAoE1E,CAAA"}

package/esm/password-authenticator.js

@@ -1,114 +1,78 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
 import { useSystemIdentityContext } from '@furystack/core';
-import { Injectable, Injected } from '@furystack/inject';
-import { getDataSetFor } from '@furystack/repository';
+import { defineService } from '@furystack/inject';
 import { UnauthenticatedError } from './errors/index.js';
 import { PasswordComplexityError } from './errors/password-complexity-error.js';
-import { PasswordCredential, PasswordResetToken } from './models/index.js';
+import { PasswordCredentialDataSet, PasswordResetTokenDataSet } from './password-credential-store.js';
 import { SecurityPolicyManager } from './security-policy-manager.js';
-let PasswordAuthenticator = class PasswordAuthenticator {
-    /**
-     * @param userName The User's unique name
-     * @param plainPassword The plain password to check
-     * @returns An object that contains an { isValid } value that indicates if the password is valid
-     */
-    async checkPasswordForUser(userName, plainPassword) {
-        const entry = await this.passwordDataSet.get(this.systemInjector, userName);
-        if (!entry) {
-            return {
-                isValid: false,
-                reason: 'badUsernameOrPassword',
-            };
-        }
-        const result = await this.hasher.verifyCredential(plainPassword, entry);
-        if (result.isValid && this.policyManager.hasPasswordExpired(entry)) {
-            return {
-                isValid: false,
-                reason: 'passwordExpired',
-            };
-        }
-        return result;
-    }
-    /**
-     * Sets the password for the specific user
-     * @param userName The user to set the password for
-     * @param lastPassword The last user password
-     * @param plainPassword The password as a plain string
-     */
-    async setPasswordForUser(userName, lastPassword, plainPassword) {
-        const complexityResult = await this.policyManager.matchPasswordComplexityRules(plainPassword);
-        if (!complexityResult.match) {
-            throw new PasswordComplexityError(complexityResult.errors);
-        }
-        const lastResult = await this.checkPasswordForUser(userName, lastPassword);
-        if (!lastResult.isValid) {
-            throw new UnauthenticatedError();
-        }
-        const newCredential = await this.hasher.createCredential(userName, plainPassword);
-        const existing = await this.passwordDataSet.get(this.systemInjector, userName);
-        if (existing) {
-            await this.passwordDataSet.remove(this.systemInjector, existing.userName);
-        }
-        await this.passwordDataSet.add(this.systemInjector, newCredential);
-    }
-    /**
-     * Resets the password with a Password Reset token entry
-     * @param resetToken The Reset Token value
-     * @param plainPassword The new password in plain string
-     */
-    async resetPasswordForUser(resetToken, plainPassword) {
-        const token = await this.tokenDataSet.get(this.systemInjector, resetToken);
-        if (!token) {
-            throw new UnauthenticatedError();
-        }
-        if (this.policyManager.hasTokenExpired(token)) {
-            await this.tokenDataSet.remove(this.systemInjector, resetToken);
-            throw new UnauthenticatedError();
-        }
-        const complexityResult = await this.policyManager.matchPasswordComplexityRules(plainPassword);
-        if (!complexityResult.match) {
-            throw new PasswordComplexityError(complexityResult.errors);
-        }
-        const newCredential = await this.hasher.createCredential(token.userName, plainPassword);
-        const existing = await this.passwordDataSet.get(this.systemInjector, token.userName);
-        if (existing) {
-            await this.passwordDataSet.remove(this.systemInjector, existing.userName);
-        }
-        await this.passwordDataSet.add(this.systemInjector, newCredential);
-    }
-};
-__decorate([
-    Injected((injector) => useSystemIdentityContext({ injector, username: 'PasswordAuthenticator' })),
-    __metadata("design:type", Function)
-], PasswordAuthenticator.prototype, "systemInjector", void 0);
-__decorate([
-    Injected((injector) => getDataSetFor(injector, PasswordCredential, 'userName')),
-    __metadata("design:type", Function)
-], PasswordAuthenticator.prototype, "passwordDataSet", void 0);
-__decorate([
-    Injected((injector) => getDataSetFor(injector, PasswordResetToken, 'token')),
-    __metadata("design:type", Function)
-], PasswordAuthenticator.prototype, "tokenDataSet", void 0);
-__decorate([
-    Injected(function (injector) {
-        return injector.getInstance(this.policyManager.policy.hasher);
-    }),
-    __metadata("design:type", Function)
-], PasswordAuthenticator.prototype, "hasher", void 0);
-__decorate([
-    Injected(SecurityPolicyManager),
-    __metadata("design:type", SecurityPolicyManager)
-], PasswordAuthenticator.prototype, "policyManager", void 0);
-PasswordAuthenticator = __decorate([
-    Injectable({ lifetime: 'singleton' })
-], PasswordAuthenticator);
-export { PasswordAuthenticator };
+/**
+ * DI token for the singleton {@link PasswordAuthenticator}.
+ *
+ * The factory creates a system-identity child scope once (at first
+ * resolution) and uses it for every credential mutation. The scope is
+ * torn down alongside the owning injector via `onDispose`.
+ */
+export const PasswordAuthenticator = defineService({
+    name: 'furystack/security/PasswordAuthenticator',
+    lifetime: 'singleton',
+    factory: ({ inject, injector, onDispose }) => {
+        const policyManager = inject(SecurityPolicyManager);
+        const hasher = inject(policyManager.policy.hasher);
+        const passwordDataSet = inject(PasswordCredentialDataSet);
+        const tokenDataSet = inject(PasswordResetTokenDataSet);
+        const systemInjector = useSystemIdentityContext({ injector, username: 'PasswordAuthenticator' });
+        onDispose(() => systemInjector[Symbol.asyncDispose]());
+        const checkPasswordForUser = async (userName, plainPassword) => {
+            const entry = await passwordDataSet.get(systemInjector, userName);
+            if (!entry) {
+                return { isValid: false, reason: 'badUsernameOrPassword' };
+            }
+            const result = await hasher.verifyCredential(plainPassword, entry);
+            if (result.isValid && policyManager.hasPasswordExpired(entry)) {
+                return { isValid: false, reason: 'passwordExpired' };
+            }
+            return result;
+        };
+        const replaceCredential = async (userName, plainPassword) => {
+            const newCredential = await hasher.createCredential(userName, plainPassword);
+            const existing = await passwordDataSet.get(systemInjector, userName);
+            if (existing) {
+                await passwordDataSet.remove(systemInjector, existing.userName);
+            }
+            await passwordDataSet.add(systemInjector, newCredential);
+        };
+        const setPasswordForUser = async (userName, lastPassword, plainPassword) => {
+            const complexityResult = await policyManager.matchPasswordComplexityRules(plainPassword);
+            if (!complexityResult.match) {
+                throw new PasswordComplexityError(complexityResult.errors);
+            }
+            const lastResult = await checkPasswordForUser(userName, lastPassword);
+            if (!lastResult.isValid) {
+                throw new UnauthenticatedError();
+            }
+            await replaceCredential(userName, plainPassword);
+        };
+        const resetPasswordForUser = async (resetToken, plainPassword) => {
+            const token = await tokenDataSet.get(systemInjector, resetToken);
+            if (!token) {
+                throw new UnauthenticatedError();
+            }
+            if (policyManager.hasTokenExpired(token)) {
+                await tokenDataSet.remove(systemInjector, resetToken);
+                throw new UnauthenticatedError();
+            }
+            const complexityResult = await policyManager.matchPasswordComplexityRules(plainPassword);
+            if (!complexityResult.match) {
+                throw new PasswordComplexityError(complexityResult.errors);
+            }
+            await replaceCredential(token.userName, plainPassword);
+        };
+        return {
+            hasher,
+            policyManager,
+            checkPasswordForUser,
+            setPasswordForUser,
+            resetPasswordForUser,
+        };
+    },
+});
 //# sourceMappingURL=password-authenticator.js.map

package/esm/password-authenticator.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-authenticator.js","sourceRoot":"","sources":["../src/password-authenticator.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAE1D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAA;AAE/E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAE1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAG7D,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAehC;;;;OAIG;IACI,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,aAAqB;QACvE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,uBAAuB;aAChC,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QACvE,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,iBAAiB;aAC1B,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,kBAAkB,CAAC,QAAgB,EAAE,YAAoB,EAAE,aAAqB;QAC3F,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;QAC7F,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAC5D,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QAC1E,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,oBAAoB,EAAE,CAAA;QAClC,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;QACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;QAC9E,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC3E,CAAC;QACD,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;IACpE,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,oBAAoB,CAAC,UAAkB,EAAE,aAAqB;QACzE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;QAE1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oBAAoB,EAAE,CAAA;QAClC,CAAC;QAED,IAAI,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;YAC/D,MAAM,IAAI,oBAAoB,EAAE,CAAA;QAClC,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;QAC7F,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAC5D,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QACpF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC3E,CAAC;QACD,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;IACpE,CAAC;CAIF,CAAA;AA5F0B;IADxB,QAAQ,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,uBAAuB,EAAE,CAAC,CAAC;;6DACjD;AAGxB;IADxB,QAAQ,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;;8DACC;AAGxD;IADxB,QAAQ,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;;2DACF;AAKnD;IAHvB,QAAQ,CAAC,UAAuC,QAAQ;QACvD,OAAO,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC/D,CAAC,CAAC;;qDAC4C;AAgF/B;IADd,QAAQ,CAAC,qBAAqB,CAAC;8BACF,qBAAqB;4DAAA;AA7FxC,qBAAqB;IADjC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;GACzB,qBAAqB,CA8FjC"}
+{"version":3,"file":"password-authenticator.js","sourceRoot":"","sources":["../src/password-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAc,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAA;AAE/E,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAErG,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AA+BpE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA8C,aAAa,CAAC;IAC5F,IAAI,EAAE,0CAA0C;IAChD,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAyB,EAAE;QAClE,MAAM,aAAa,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAClD,MAAM,eAAe,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAA;QACzD,MAAM,YAAY,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAA;QACtD,MAAM,cAAc,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,uBAAuB,EAAE,CAAC,CAAA;QAChG,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QAEtD,MAAM,oBAAoB,GAAG,KAAK,EAAE,QAAgB,EAAE,aAAqB,EAAgC,EAAE;YAC3G,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;YACjE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;YAC5D,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;YAClE,IAAI,MAAM,CAAC,OAAO,IAAI,aAAa,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;YACtD,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CAAA;QAED,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAgB,EAAE,aAAqB,EAAiB,EAAE;YACzF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;YAC5E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;YACpE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,eAAe,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,eAAe,CAAC,GAAG,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;QAC1D,CAAC,CAAA;QAED,MAAM,kBAAkB,GAAG,KAAK,EAAE,QAAgB,EAAE,YAAoB,EAAE,aAAqB,EAAiB,EAAE;YAChH,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;YACxF,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;YAC5D,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;YACrE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,oBAAoB,EAAE,CAAA;YAClC,CAAC;YACD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;QAClD,CAAC,CAAA;QAED,MAAM,oBAAoB,GAAG,KAAK,EAAE,UAAkB,EAAE,aAAqB,EAAiB,EAAE;YAC9F,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;YAChE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,oBAAoB,EAAE,CAAA;YAClC,CAAC;YACD,IAAI,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzC,MAAM,YAAY,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;gBACrD,MAAM,IAAI,oBAAoB,EAAE,CAAA;YAClC,CAAC;YACD,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;YACxF,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;YAC5D,CAAC;YACD,MAAM,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;QACxD,CAAC,CAAA;QAED,OAAO;YACL,MAAM;YACN,aAAa;YACb,oBAAoB;YACpB,kBAAkB;YAClB,oBAAoB;SACrB,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}