@owlmeans/server-auth-otp 0.1.18-rc.4 → 0.1.18-rc.40

package/README.md

@@ -12,7 +12,7 @@ Email OTP `AuthPlugin` for OwlMeans servers — passwordless login via time-limi
 ## Installation
 
 ```bash
-bun add @owlmeans/server-auth-otp
+bun add @owlmeans/server-auth-otp@^0.1.18-rc.40
 ```
 
 ## Usage
@@ -47,7 +47,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.34
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth-otp",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.506Z",
+  "version": "0.1.18-rc.40",
+  "generatedAt": "2026-09-22T20:45:24.051Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth-otp/SKILL.md

@@ -8,32 +8,50 @@ metadata:
 
 # Using `@owlmeans/server-auth-otp`
 
+**Install:** `"@owlmeans/server-auth-otp": "^0.1.18-rc.40"` in `dependencies`
+
 Email OTP authentication plugin for the OwlMeans auth-manager plugin system. Relies on `@owlmeans/auth-otp` for the OTP service interface, a Redis resource for code storage, and a `MailerService` to send codes.
 
+## `@owlmeans/auth-otp` — the contracts
+
+`@owlmeans/auth-otp` has no skill of its own because it is the contracts half of this pair. Its
+`OtpService` issues an opaque issuance id, persists and mails a code, and verifies that exact
+issuance; it also owns `OTP_SERVICE`, `OTP_AUTH_TYPE` (`'email-otp'`), `OTP_RESOURCE`,
+`OTP_TTL_SECONDS` (600), `OTP_CODE_LENGTH` (6), and the five-attempt policy. The server package
+provides the challenge stores, throttles, mailer integration and plugin.
+
+Depend on it from a shared package that must name the auth type or type the service, and depend on
+`@owlmeans/server-auth-otp` only where the server wires itself up — the same producer/consumer split
+every other contracts-and-driver pair in the framework uses. Add a constant or a method signature to
+the contracts package, never to the implementation.
+
 ## Public API surface
 
 | Symbol | Kind | Purpose |
 |--------|------|---------|
 | `makeOtpService(alias?)` | fn | Service factory — stores/verifies OTP codes |
 | `appendOtpPlugin(context)` | fn | Registers the OTP `AuthPlugin` into the server-auth plugin registry |
+| `OTP_SERVICE` | const | `'auth-otp-service'` — the service alias `makeOtpService` registers under |
 | `OTP_AUTH_TYPE` | const | `'email-otp'` — the auth type string to pass in `init` requests |
 | `OTP_RESOURCE` | const | Redis resource alias for code storage |
 | `OTP_TTL_SECONDS` | const | Code TTL (600 s = 10 min) |
 | `OTP_CODE_LENGTH` | const | 6 |
+| `SERVER_AUTH_OTP` | const | `'server-auth-otp'` — this package's own alias |
+| `OtpConfig`, `OtpContext` | type | The `cfg.otp` overrides below, as a server config/context |
 
 ## Registration requirements
 
 ```ts
 import { makeOtpService, appendOtpPlugin, OTP_RESOURCE } from '@owlmeans/server-auth-otp'
 import { makeRedisResource } from '@owlmeans/redis-resource'
-import { makeConsoleMailerService, CONSOLE_MAILER, MAILER_SERVICE } from '@owlmeans/mailer'
+import { makeDefaultConsoleMailerService, MAILER_SERVICE } from '@owlmeans/mailer'
 import { makeMailgunMailerService } from '@owlmeans/server-mailer-mailgun'
 
 // 1. Register the Redis code-cache resource.
 context.registerResource(makeRedisResource(OTP_RESOURCE))
 
-// 2. Register a MailerService (console for dev/tests, Mailgun for prod).
-context.registerService(makeConsoleMailerService(MAILER_SERVICE))
+// 2. Register a MailerService under MAILER_SERVICE (console for dev/tests, Mailgun for prod).
+context.registerService(makeDefaultConsoleMailerService())
 // or:
 context.registerService(makeMailgunMailerService(MAILER_SERVICE))
 
@@ -48,13 +66,20 @@ appendOtpPlugin(context)
 
 **Init** — client sends `{ type: 'email-otp', userId: 'user@email.com' }`:
 - OTP service generates a 6-digit code, stores it in Redis with 10 min TTL, emails it.
-- Returns `{ challenge: email }` in a signed envelope.
-
-**Authenticate** — client sends `{ challenge: <signed-envelope>, userId: email, credential: '123456', entityId: 'the-entity' }`:
-- Envelope is opened → email is extracted.
-- OTP service verifies the code (throws `AuthenFailed` if wrong or expired), then deletes it.
-- `IdentityLinkingService` finds or creates the user profile scoped to `entityId`.
-- Sets `credential.type = AuthenticationType.OneTimeToken` and returns the signed auth token.
+- Returns an opaque issuance id in a signed envelope. The id never contains the email or code.
+
+**Authenticate** — client sends `{ challenge: <signed-envelope>, userId: email, credential: '123456', type: 'email-otp', role: AuthRole.User, scopes: [ALL_SCOPES] }`:
+- Envelope is opened → the plugin verifies the opaque issuance and code atomically. Five failed
+  attempts invalidate it; one concurrent correct verification can consume it.
+- `IdentityLinkingService` finds the linked profile, or links this email to the person's platform
+  identity — registering an account, a profile and an organization entity only when the address is
+  new to the platform.
+- Copies `userId`, `profileId`, `entitySlug`, `role` and `scopes` from the resolved payload onto the
+  credential, sets `credential.type = AuthenticationType.OneTimeToken`, and returns the signed auth
+  token.
+- `type`, `role`, `scopes` are required by the shared `AuthCredentialsSchema` (spread from
+  `AuthPayloadSchema.required`) even though the OTP plugin overwrites `role`/`scopes`/`type` on
+  success — a caller that omits them never reaches the plugin at all (see Gotchas).
 
 ## Config overrides (optional)
 
@@ -70,16 +95,52 @@ cfg.otp = {
 
 ## Rules
 
-- Always register the Redis resource AND the mailer service BEFORE the OTP service.
+- Always register the Redis challenge store, Redis throttle service, and mailer service BEFORE the
+  OTP service. Production uses `makeRedisOtpChallengeStore` and `makeRedisThrottleService`; memory
+  implementations are local/test defaults only.
 - Call `appendOtpPlugin(context)` once per context — it adds to the shared plugin registry singleton.
-- The `credential.entityId` in the authenticate request determines which entity the resulting identity profile is scoped to. Pass it from the OIDC interaction.
+- `credential.entitySlug` on the authenticate request **selects nothing**. The plugin copies it into
+  the linking details as `clientId` (defaulting to `'default'`) and `entityId`, and
+  `@owlmeans/server-auth-identity` reads neither: `getLinkedProfile` keys on the external login key
+  built from the auth type, the `'email'` service and the address, and `linkProfile` either reuses
+  the person's existing platform profile — matched on the account name — or mints a brand-new
+  organization entity. Whatever the caller sent is then overwritten with the linked profile's own
+  slug before the envelope is signed, so the address alone decides which identity and which
+  organization the token names.
 - Errors from this plugin are `AuthenFailed` (from `@owlmeans/auth`) — callers catch that, not raw `Error`.
-- For tests, use `makeConsoleMailerService()` and read `svc.captured[n].text` to extract the code.
-
-## Related instructions
-
-- `@owlmeans/auth-otp` (common) — `OtpService` interface and constants
-- `@owlmeans/mailer` (common) — `MailerService` interface, console transport
-- `@owlmeans/server-mailer-mailgun` (common) — production Mailgun transport
-- `@owlmeans/server-auth` (common) — auth-manager plugin system
-- `auth-protocol` instructions — error hierarchy, identity read rules
+- Use the email throttle for the public integrated-IAM flow: one issuance per minute and ten per
+  hour, with a 429 and Retry-After. The companion IP throttle is available for an ingress that
+  safely supplies a normalized client address; throttle keys hash email/IP values and never store
+  the raw identifier.
+- For tests, register `makeDefaultConsoleMailerService()` and read `svc.captured[n].text` to extract
+  the code. Bare `makeConsoleMailerService()` registers under `CONSOLE_MAILER` (`'console-mailer'`),
+  which is not the alias `makeOtpService` resolves — it looks up `cfg.otp?.mailerAlias ?? MAILER_SERVICE`.
+
+## Gotchas
+
+- **The OTP challenge must be opaque and plugin-owned.** The generic auth-manager replay policy
+  does not consume it before the OTP store can count attempts; the plugin atomically owns verify
+  and consume. Never encode the email or code in the issuance id, and never replace the bounded
+  attempt counter with a bare auth-cache replay key.
+- **`AuthCredentialsSchema.credential` has a `minLength` floor** (from `@owlmeans/auth`) sized for
+  long tokens/signatures from other plugins (Ed25519 signature, OAuth code). A 6-digit OTP code is
+  legitimately shorter — the floor is `minLength: 1` and must stay low enough to admit it, or every
+  authenticate call 400s before the plugin ever runs.
+- **`scopes`/`role`/`type` are schema-required on the authenticate body**, spread from
+  `AuthPayloadSchema.required` into `AuthCredentialsSchema` — even though this plugin overwrites
+  all three on success. A caller built without going through `@owlmeans/client-auth`'s
+  `AuthenticationControl` (which fills them automatically) must set them explicitly or the request
+  fails Fastify schema validation (`FST_ERR_VALIDATION`) before reaching this plugin at all.
+- **The resulting auth token can exceed 1024 characters** — it wraps the full `AuthCredentials`
+  envelope, including the original allowance challenge, base64-encoded. A consumer route that
+  accepts this token (e.g. an OIDC `PROVIDER_INTERACTION` finalizer) must size its own `token`
+  field schema accordingly; the generic `AuthTokenSchema` (`maxLength: 1024`) is too small.
+
+## Related
+
+- `@owlmeans/auth-otp` — the `OtpService` interface and the shared constants
+- `@owlmeans/mailer` — `MailerService`, the console transport
+- `@owlmeans/server-mailer-mailgun` — the production Mailgun transport
+- `server-auth` skill — the auth-manager plugin system this plugin registers into
+- `server-auth-identity` skill — how the linked profile and its organization entity are stored
+- `auth-protocol` skill — error hierarchy and identity read rules

package/build/challenge.d.ts

@@ -0,0 +1,8 @@
+import type { OtpChallengeStore } from './types.js';
+type Clock = () => number;
+/** Real in-memory challenge store with synchronous consume/update semantics. */
+export declare const makeMemoryOtpChallengeStore: (alias?: string, now?: Clock) => OtpChallengeStore;
+/** Redis challenge store: compare, attempt increment, exhaustion, and consume are one operation. */
+export declare const makeRedisOtpChallengeStore: (alias?: string, resourceAlias?: string) => OtpChallengeStore;
+export {};
+//# sourceMappingURL=challenge.d.ts.map

package/build/challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../src/challenge.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACyB,iBAAiB,EACrD,MAAM,YAAY,CAAA;AAGnB,KAAK,KAAK,GAAG,MAAM,MAAM,CAAA;AAGzB,gFAAgF;AAChF,eAAO,MAAM,2BAA2B,yBACJ,KAAK,KACtC,iBA+BF,CAAA;AA0BD,oGAAoG;AACpG,eAAO,MAAM,0BAA0B,8CAEpC,iBAqCF,CAAA"}

package/build/challenge.js

@@ -0,0 +1,98 @@
+import { appendContextual, createService } from '@owlmeans/context';
+import { OtpUnavailable } from './errors.js';
+import { OTP_CHALLENGE_STORE, OTP_RESOURCE } from './consts.js';
+import { OtpChallengeOutcome as Outcome } from './types.js';
+/** Real in-memory challenge store with synchronous consume/update semantics. */
+export const makeMemoryOtpChallengeStore = (alias = OTP_CHALLENGE_STORE, now = Date.now) => {
+    const records = new Map();
+    return createService(alias, {
+        issue: async (challenge, ttlSeconds) => {
+            const current = records.get(challenge.id);
+            if (current != null && current.expiresAt > now())
+                return false;
+            records.set(challenge.id, {
+                ...challenge, failedAttempts: 0, expiresAt: now() + ttlSeconds * 1000,
+            });
+            return true;
+        },
+        verify: async (id, emailKey, codeHash, maxFailedAttempts) => {
+            const record = records.get(id);
+            if (record == null || record.expiresAt <= now()) {
+                records.delete(id);
+                return Outcome.Missing;
+            }
+            if (record.emailKey === emailKey && record.codeHash === codeHash) {
+                records.delete(id);
+                return Outcome.Verified;
+            }
+            record.failedAttempts += 1;
+            if (record.failedAttempts >= maxFailedAttempts) {
+                records.delete(id);
+                return Outcome.Exhausted;
+            }
+            return Outcome.Invalid;
+        },
+    });
+};
+const REDIS_VERIFY_SCRIPT = `
+local raw = redis.call('GET', KEYS[1])
+if not raw then return 0 end
+local record = cjson.decode(raw)
+if record.emailKey == ARGV[1] and record.codeHash == ARGV[2] then
+  redis.call('DEL', KEYS[1])
+  return 1
+end
+record.failedAttempts = tonumber(record.failedAttempts or 0) + 1
+if record.failedAttempts >= tonumber(ARGV[3]) then
+  redis.call('DEL', KEYS[1])
+  return -2
+end
+local ttl = redis.call('PTTL', KEYS[1])
+if ttl <= 0 then
+  redis.call('DEL', KEYS[1])
+  return 0
+end
+redis.call('SET', KEYS[1], cjson.encode(record), 'XX', 'PX', ttl)
+return -1
+`;
+/** Redis challenge store: compare, attempt increment, exhaustion, and consume are one operation. */
+export const makeRedisOtpChallengeStore = (alias = OTP_CHALLENGE_STORE, resourceAlias = OTP_RESOURCE) => {
+    const service = appendContextual(alias, {
+        issue: async (challenge, ttlSeconds) => {
+            const ctx = service.ctx;
+            const resource = ctx.resource(resourceAlias);
+            try {
+                const result = await resource.db.client.set(resource.key(challenge.id), JSON.stringify({ ...challenge, failedAttempts: 0 }), 'EX', ttlSeconds, 'NX');
+                return result === 'OK';
+            }
+            catch (error) {
+                const unavailable = new OtpUnavailable('challenge');
+                if (error instanceof Error)
+                    unavailable.oiriginalStack = `${error}: ${error.stack}`;
+                throw unavailable;
+            }
+        },
+        verify: async (id, emailKey, codeHash, maxFailedAttempts) => {
+            const ctx = service.ctx;
+            const resource = ctx.resource(resourceAlias);
+            try {
+                const result = Number(await resource.db.client.eval(REDIS_VERIFY_SCRIPT, 1, resource.key(id), emailKey, codeHash, String(maxFailedAttempts)));
+                if (result === 1)
+                    return Outcome.Verified;
+                if (result === -1)
+                    return Outcome.Invalid;
+                if (result === -2)
+                    return Outcome.Exhausted;
+                return Outcome.Missing;
+            }
+            catch (error) {
+                const unavailable = new OtpUnavailable('challenge');
+                if (error instanceof Error)
+                    unavailable.oiriginalStack = `${error}: ${error.stack}`;
+                throw unavailable;
+            }
+        },
+    });
+    return service;
+};
+//# sourceMappingURL=challenge.js.map

package/build/challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../src/challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAI/D,OAAO,EAAE,mBAAmB,IAAI,OAAO,EAAE,MAAM,YAAY,CAAA;AAK3D,gFAAgF;AAChF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,KAAK,GAAG,mBAAmB,EAAE,GAAG,GAAU,IAAI,CAAC,GAAG,EAC/B,EAAE;IACrB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAA;IAElD,OAAO,aAAa,CAAoB,KAAK,EAAE;QAC7C,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAoB,EAAE;YACvD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACzC,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;gBAAE,OAAO,KAAK,CAAA;YAC9D,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE;gBACxB,GAAG,SAAS,EAAE,cAAc,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI;aACtE,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAgC,EAAE;YACxF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC9B,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC;gBAChD,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBAClB,OAAO,OAAO,CAAC,OAAO,CAAA;YACxB,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBAClB,OAAO,OAAO,CAAC,QAAQ,CAAA;YACzB,CAAC;YACD,MAAM,CAAC,cAAc,IAAI,CAAC,CAAA;YAC1B,IAAI,MAAM,CAAC,cAAc,IAAI,iBAAiB,EAAE,CAAC;gBAC/C,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBAClB,OAAO,OAAO,CAAC,SAAS,CAAA;YAC1B,CAAC;YAED,OAAO,OAAO,CAAC,OAAO,CAAA;QACxB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC,CAAA;AAID,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;CAoB3B,CAAA;AAED,oGAAoG;AACpG,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,KAAK,GAAG,mBAAmB,EAAE,aAAa,GAAG,YAAY,EACtC,EAAE;IACrB,MAAM,OAAO,GAAG,gBAAgB,CAAoB,KAAK,EAAE;QACzD,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAoB,EAAE;YACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAA4B,CAAA;YAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAyC,aAAa,CAAC,CAAA;YACpF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CACzC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,SAAS,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,EAC/E,IAAI,EAAE,UAAU,EAAE,IAAI,CACvB,CAAA;gBACD,OAAO,MAAM,KAAK,IAAI,CAAA;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,WAAW,GAAG,IAAI,cAAc,CAAC,WAAW,CAAC,CAAA;gBACnD,IAAI,KAAK,YAAY,KAAK;oBAAE,WAAW,CAAC,cAAc,GAAG,GAAG,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAA;gBACnF,MAAM,WAAW,CAAA;YACnB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAgC,EAAE;YACxF,MAAM,GAAG,GAAG,OAAO,CAAC,GAA4B,CAAA;YAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAyC,aAAa,CAAC,CAAA;YACpF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CACjD,mBAAmB,EAAE,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,iBAAiB,CAAC,CACxF,CAAC,CAAA;gBACF,IAAI,MAAM,KAAK,CAAC;oBAAE,OAAO,OAAO,CAAC,QAAQ,CAAA;gBACzC,IAAI,MAAM,KAAK,CAAC,CAAC;oBAAE,OAAO,OAAO,CAAC,OAAO,CAAA;gBACzC,IAAI,MAAM,KAAK,CAAC,CAAC;oBAAE,OAAO,OAAO,CAAC,SAAS,CAAA;gBAC3C,OAAO,OAAO,CAAC,OAAO,CAAA;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,WAAW,GAAG,IAAI,cAAc,CAAC,WAAW,CAAC,CAAA;gBACnD,IAAI,KAAK,YAAY,KAAK;oBAAE,WAAW,CAAC,cAAc,GAAG,GAAG,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAA;gBACnF,MAAM,WAAW,CAAA;YACnB,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/consts.d.ts

@@ -1,4 +1,13 @@
 export declare const SERVER_AUTH_OTP = "server-auth-otp";
+export declare const OTP_CHALLENGE_STORE = "auth-otp-challenge-store";
+export declare const OTP_THROTTLE_SERVICE = "auth-otp-throttle";
+export declare const OTP_EMAIL_THROTTLE_RULES: readonly (Readonly<{
+    limit: 1;
+    windowSeconds: 60;
+}> | Readonly<{
+    limit: 10;
+    windowSeconds: number;
+}>)[];
 /** The OTP auth plugin type key — passed as credential.type in init requests */
-export { OTP_AUTH_TYPE, OTP_SERVICE, OTP_RESOURCE, OTP_TTL_SECONDS, OTP_CODE_LENGTH } from '@owlmeans/auth-otp';
+export { OTP_AUTH_TYPE, OTP_SERVICE, OTP_RESOURCE, OTP_TTL_SECONDS, OTP_CODE_LENGTH, OTP_MAX_FAILED_ATTEMPTS, } from '@owlmeans/auth-otp';
 //# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,oBAAoB,CAAA;AAEhD,gFAAgF;AAChF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,oBAAoB,CAAA;AAChD,eAAO,MAAM,mBAAmB,6BAA6B,CAAA;AAC7D,eAAO,MAAM,oBAAoB,sBAAsB,CAAA;AAEvD,eAAO,MAAM,wBAAwB;;;;;;KAGnC,CAAA;AAEF,gFAAgF;AAChF,OAAO,EACL,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAC1E,uBAAuB,GACxB,MAAM,oBAAoB,CAAA"}

package/build/consts.js

@@ -1,4 +1,10 @@
 export const SERVER_AUTH_OTP = 'server-auth-otp';
+export const OTP_CHALLENGE_STORE = 'auth-otp-challenge-store';
+export const OTP_THROTTLE_SERVICE = 'auth-otp-throttle';
+export const OTP_EMAIL_THROTTLE_RULES = Object.freeze([
+    Object.freeze({ limit: 1, windowSeconds: 60 }),
+    Object.freeze({ limit: 10, windowSeconds: 60 * 60 }),
+]);
 /** The OTP auth plugin type key — passed as credential.type in init requests */
-export { OTP_AUTH_TYPE, OTP_SERVICE, OTP_RESOURCE, OTP_TTL_SECONDS, OTP_CODE_LENGTH } from '@owlmeans/auth-otp';
+export { OTP_AUTH_TYPE, OTP_SERVICE, OTP_RESOURCE, OTP_TTL_SECONDS, OTP_CODE_LENGTH, OTP_MAX_FAILED_ATTEMPTS, } from '@owlmeans/auth-otp';
 //# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD,gFAAgF;AAChF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAA;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAA;AAEvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IACpD,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;CACrD,CAAC,CAAA;AAEF,gFAAgF;AAChF,OAAO,EACL,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAC1E,uBAAuB,GACxB,MAAM,oBAAoB,CAAA"}

package/build/errors.d.ts

@@ -0,0 +1,18 @@
+import { ResilientError } from '@owlmeans/error';
+export declare class OtpError extends ResilientError {
+    static typeName: string;
+    constructor(message?: string);
+}
+export declare class OtpThrottled extends OtpError {
+    static typeName: string;
+    static httpStatus: number;
+    readonly retryAfter: number;
+    constructor(retryAfter?: number | string, stack?: string);
+}
+export declare class OtpUnavailable extends OtpError {
+    static typeName: string;
+    static httpStatus: number;
+    static allowServerErrorStatus: boolean;
+    constructor(message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/build/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,qBAAa,QAAS,SAAQ,cAAc;IAC1C,OAAuB,QAAQ,SAAa;IAE5C,YAAY,OAAO,GAAE,MAAgB,EAEpC;CACF;AAED,qBAAa,YAAa,SAAQ,QAAQ;IACxC,OAAuB,QAAQ,SAAkC;IACjE,OAAc,UAAU,SAAM;IAC9B,SAAgB,UAAU,EAAE,MAAM,CAAA;IAElC,YAAY,UAAU,GAAE,MAAM,GAAG,MAAU,EAAE,KAAK,CAAC,EAAE,MAAM,EAK1D;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAAoC;IACnE,OAAc,UAAU,SAAM;IAC9B,OAAc,sBAAsB,UAAO;IAE3C,YAAY,OAAO,GAAE,MAAgB,EAGpC;CACF"}

package/build/errors.js

@@ -0,0 +1,32 @@
+import { ResilientError } from '@owlmeans/error';
+export class OtpError extends ResilientError {
+    static typeName = 'OtpError';
+    constructor(message = 'error') {
+        super(OtpError.typeName, `otp:${message}`);
+    }
+}
+export class OtpThrottled extends OtpError {
+    static typeName = `${OtpError.typeName}Throttled`;
+    static httpStatus = 429;
+    retryAfter;
+    constructor(retryAfter = 1, stack) {
+        super(typeof retryAfter === 'string' ? retryAfter : 'throttled');
+        this.type = OtpThrottled.typeName;
+        this.retryAfter = typeof retryAfter === 'number' ? Math.max(1, Math.ceil(retryAfter)) : 1;
+        if (stack != null)
+            this.oiriginalStack = stack;
+    }
+}
+export class OtpUnavailable extends OtpError {
+    static typeName = `${OtpError.typeName}Unavailable`;
+    static httpStatus = 503;
+    static allowServerErrorStatus = true;
+    constructor(message = 'store') {
+        super(`unavailable:${message}`);
+        this.type = OtpUnavailable.typeName;
+    }
+}
+ResilientError.registerErrorClass(OtpError);
+ResilientError.registerErrorClass(OtpThrottled);
+ResilientError.registerErrorClass(OtpUnavailable);
+//# sourceMappingURL=errors.js.map

package/build/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,OAAO,QAAS,SAAQ,cAAc;IACnC,MAAM,CAAU,QAAQ,GAAG,UAAU,CAAA;IAE5C,YAAY,OAAO,GAAW,OAAO;QACnC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,OAAO,EAAE,CAAC,CAAA;IAC5C,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACjC,MAAM,CAAU,QAAQ,GAAG,GAAG,QAAQ,CAAC,QAAQ,WAAW,CAAA;IAC1D,MAAM,CAAC,UAAU,GAAG,GAAG,CAAA;IACd,UAAU,CAAQ;IAElC,YAAY,UAAU,GAAoB,CAAC,EAAE,KAAc;QACzD,KAAK,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QAChE,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAA;QACjC,IAAI,CAAC,UAAU,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACzF,IAAI,KAAK,IAAI,IAAI;YAAE,IAAI,CAAC,cAAc,GAAG,KAAK,CAAA;IAChD,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,GAAG,QAAQ,CAAC,QAAQ,aAAa,CAAA;IAC5D,MAAM,CAAC,UAAU,GAAG,GAAG,CAAA;IACvB,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAA;IAE3C,YAAY,OAAO,GAAW,OAAO;QACnC,KAAK,CAAC,eAAe,OAAO,EAAE,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;CACF;AAED,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AAC3C,cAAc,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;AAC/C,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA"}

package/build/index.d.ts

@@ -1,5 +1,8 @@
-export type * from './types.js';
+export * from './types.js';
 export * from './consts.js';
 export * from './service.js';
 export * from './plugin.js';
+export * from './errors.js';
+export * from './throttle.js';
+export * from './challenge.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA"}

package/build/index.js

@@ -1,4 +1,8 @@
+export * from './types.js';
 export * from './consts.js';
 export * from './service.js';
 export * from './plugin.js';
+export * from './errors.js';
+export * from './throttle.js';
+export * from './challenge.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA"}

package/build/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAmEvD,sGAAsG;AACtG,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,KAAG,CAG1F,CAAA"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAqEvD,sGAAsG;AACtG,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,KAAG,CAG1F,CAAA"}

package/build/plugin.js

@@ -1,47 +1,48 @@
 import { ALL_SCOPES, AuthenFailed, AuthRole, AuthenticationType } from '@owlmeans/auth';
-import { registerPlugin } from '@owlmeans/server-auth/manager/plugins';
+import { AuthChallengeReplayPolicy, registerPlugin } from '@owlmeans/server-auth/manager/plugins';
 import { OTP_AUTH_TYPE, OTP_SERVICE } from '@owlmeans/auth-otp';
 import { AUTH_IDENTITY_LINKING } from '@owlmeans/server-auth-identity';
-import { createIdOfLength, IdStyle } from '@owlmeans/basic-ids';
-// Separates the email from the per-request nonce inside the challenge (see init() below).
+// Separates the email from the opaque issuance id inside the signed challenge.
 const CHALLENGE_DELIMITER = '::';
 /** Factory that creates the email-OTP AuthPlugin bound to the given context. */
 const otpPlugin = (context) => ({
     type: OTP_AUTH_TYPE,
+    challengeReplayPolicy: AuthChallengeReplayPolicy.Plugin,
     init: async (request) => {
         if (request.userId == null || !request.userId.includes('@')) {
             throw new AuthenFailed('otp:email');
         }
         const email = request.userId.trim().toLowerCase();
         const otp = context.service(OTP_SERVICE);
-        await otp.issueChallenge(email);
-        // The auth manager's anti-replay cache (AUTH_CACHE) keys on this decoded challenge, so it
-        // must be unique per request — the plaintext email alone would be identical across every
-        // independent login attempt for that address and collide with a still-cached prior one.
-        const nonce = createIdOfLength(16, IdStyle.Base58);
-        return { challenge: `${email}${CHALLENGE_DELIMITER}${nonce}` };
+        const issuanceId = await otp.issueChallenge(email);
+        return { challenge: `${email}${CHALLENGE_DELIMITER}${issuanceId}` };
     },
     authenticate: async (credential) => {
-        // credential.challenge is "email::nonce" (opened from the signed envelope in makeAuthModel).
-        const email = credential.challenge?.split(CHALLENGE_DELIMITER)[0];
+        // credential.challenge is "email::issuanceId" (opened from the signed envelope).
+        const parts = credential.challenge?.split(CHALLENGE_DELIMITER) ?? [];
+        const email = parts.length === 2 ? parts[0] : undefined;
+        const issuanceId = parts.length === 2 ? parts[1] : undefined;
         const code = credential.credential;
-        if (!email || !email.includes('@')) {
+        if (!email || !email.includes('@') || !issuanceId) {
             throw new AuthenFailed('otp:email');
         }
         if (!code) {
             throw new AuthenFailed('otp:code');
         }
         const otp = context.service(OTP_SERVICE);
-        await otp.verifyChallenge(email, code);
+        await otp.verifyChallenge(email, issuanceId, code);
         const identityAlias = context.cfg.otp?.identityAlias ?? AUTH_IDENTITY_LINKING;
         const identity = context.service(identityAlias);
-        const entityId = credential.entityId;
+        // What arrives on the credential is the organization SLUG the user is logging into — it is
+        // what a person can be asked to type. The linked profile below answers with the canonical
+        // slug, which is what the token ends up carrying.
+        const entitySlug = credential.entitySlug;
         const details = {
             type: OTP_AUTH_TYPE,
             service: 'email',
-            clientId: entityId ?? 'default',
+            clientId: entitySlug ?? 'default',
             userId: email,
-            entityId,
+            entityId: entitySlug,
         };
         let payload = await identity.getLinkedProfile(details);
         if (payload == null) {
@@ -51,7 +52,7 @@ const otpPlugin = (context) => ({
         credential.type = AuthenticationType.OneTimeToken;
         credential.userId = payload.userId;
         credential.profileId = payload.profileId;
-        credential.entityId = payload.entityId;
+        credential.entitySlug = payload.entitySlug;
         credential.role = payload.role ?? AuthRole.User;
         credential.scopes = payload.scopes ?? [ALL_SCOPES];
         return { token: '' };

package/build/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEvF,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAEtE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAG/D,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAEhC,gFAAgF;AAChF,MAAM,SAAS,GAAG,CAA+C,OAAU,EAAc,EAAE,CAAC,CAAC;IAC3F,IAAI,EAAE,aAAa;IAEnB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACpB,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAa,WAAW,CAAC,CAAA;QACpD,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QAC/B,0FAA0F;QAC1F,yFAAyF;QACzF,wFAAwF;QACxF,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QAClD,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,GAAG,mBAAmB,GAAG,KAAK,EAAE,EAAE,CAAA;IAChE,CAAC;IAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;QAC/B,6FAA6F;QAC7F,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAA;QACjE,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAA;QAElC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,CAAA;QACpC,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAa,WAAW,CAAC,CAAA;QACpD,MAAM,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAEtC,MAAM,aAAa,GAAI,OAAO,CAAC,GAAW,CAAC,GAAG,EAAE,aAAa,IAAI,qBAAqB,CAAA;QACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAyB,aAAa,CAAC,CAAA;QAEvE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAA;QACpC,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,QAAQ,IAAI,SAAS;YAC/B,MAAM,EAAE,KAAK;YACb,QAAQ;SACT,CAAA;QAED,IAAI,OAAO,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;QACtD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACpE,CAAC;QAED,wDAAwD;QACxD,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,YAAY,CAAA;QACjD,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QACxC,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QACtC,UAAU,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAA;QAC/C,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAA;QAElD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAC,CAAA;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,CAA+C,OAAU,EAAK,EAAE;IAC7F,cAAc,CAAC,aAAa,EAAE,SAAiD,CAAC,CAAA;IAChF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEvF,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAEjG,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAGtE,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAEhC,gFAAgF;AAChF,MAAM,SAAS,GAAG,CAA+C,OAAU,EAAc,EAAE,CAAC,CAAC;IAC3F,IAAI,EAAE,aAAa;IACnB,qBAAqB,EAAE,yBAAyB,CAAC,MAAM;IAEvD,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACpB,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAa,WAAW,CAAC,CAAA;QACpD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,GAAG,mBAAmB,GAAG,UAAU,EAAE,EAAE,CAAA;IACrE,CAAC;IAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;QAC/B,iFAAiF;QACjF,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAA;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACvD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAA;QAElC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAClD,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,CAAA;QACpC,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAa,WAAW,CAAC,CAAA;QACpD,MAAM,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;QAElD,MAAM,aAAa,GAAI,OAAO,CAAC,GAAW,CAAC,GAAG,EAAE,aAAa,IAAI,qBAAqB,CAAA;QACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAyB,aAAa,CAAC,CAAA;QAEvE,2FAA2F;QAC3F,0FAA0F;QAC1F,kDAAkD;QAClD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAA;QACxC,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,UAAU,IAAI,SAAS;YACjC,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,UAAU;SACrB,CAAA;QAED,IAAI,OAAO,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;QACtD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACpE,CAAC;QAED,wDAAwD;QACxD,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,YAAY,CAAA;QACjD,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QACxC,UAAU,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QAC1C,UAAU,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAA;QAC/C,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAA;QAElD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAC,CAAA;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,CAA+C,OAAU,EAAK,EAAE;IAC7F,cAAc,CAAC,aAAa,EAAE,SAAiD,CAAC,CAAA;IAChF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/service.d.ts

@@ -1,3 +1,6 @@
 import type { OtpService } from '@owlmeans/auth-otp';
+export declare const otpChallengeKey: (issuanceId: string) => string;
+export declare const otpEmailKey: (email: string) => string;
+export declare const otpCodeHash: (issuanceId: string, code: string) => string;
 export declare const makeOtpService: (alias?: string) => OtpService;
 //# sourceMappingURL=service.d.ts.map

package/build/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAgBpD,eAAO,MAAM,cAAc,sBAA0B,UA+CpD,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAkBpD,eAAO,MAAM,eAAe,eAAgB,MAAM,KAAG,MAAuD,CAAA;AAC5G,eAAO,MAAM,WAAW,UAAW,MAAM,KAAG,MAAqD,CAAA;AACjG,eAAO,MAAM,WAAW,eAAgB,MAAM,QAAQ,MAAM,KAAG,MACd,CAAA;AAEjD,eAAO,MAAM,cAAc,sBAA0B,UAiEpD,CAAA"}