@owlmeans/server-auth-otp 0.1.18-rc.52 → 0.1.18-rc.54

package/README.md

@@ -12,7 +12,7 @@ Email OTP `AuthPlugin` for OwlMeans servers — passwordless login via time-limi
 ## Installation
 
 ```bash
-bun add @owlmeans/server-auth-otp@^0.1.18-rc.52
+bun add @owlmeans/server-auth-otp@^0.1.18-rc.54
 ```
 
 ## Usage
@@ -47,7 +47,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.48
+npx @owlmeans/agent-skills@^0.1.18-rc.51
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth-otp",
-  "version": "0.1.18-rc.52",
-  "generatedAt": "2026-10-05T08:32:19.110Z",
+  "version": "0.1.18-rc.54",
+  "generatedAt": "2026-10-06T11:45:57.663Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth-otp/SKILL.md

@@ -8,7 +8,7 @@ metadata:
 
 # Using `@owlmeans/server-auth-otp`
 
-**Install:** `"@owlmeans/server-auth-otp": "^0.1.18-rc.52"` in `dependencies`
+**Install:** `"@owlmeans/server-auth-otp": "^0.1.18-rc.54"` in `dependencies`
 
 Email OTP authentication plugin for the OwlMeans auth-manager plugin system. Relies on `@owlmeans/auth-otp` for the OTP service interface, a Redis resource for code storage, and a `MailerService` to send codes.
 

package/build/index.d.ts

@@ -1,8 +1,12 @@
 export * from './types.js';
+export type * from './keys/types.js';
+export type * from './throttle-keys/types.js';
 export * from './consts.js';
 export * from './service.js';
 export * from './plugin.js';
 export * from './errors.js';
 export * from './throttle.js';
 export * from './challenge.js';
+export * from './keys.js';
+export * from './throttle-keys.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,mBAAmB,iBAAiB,CAAA;AACpC,mBAAmB,0BAA0B,CAAA;AAC7C,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,WAAW,CAAA;AACzB,cAAc,oBAAoB,CAAA"}

package/build/index.js

@@ -5,4 +5,6 @@ export * from './plugin.js';
 export * from './errors.js';
 export * from './throttle.js';
 export * from './challenge.js';
+export * from './keys.js';
+export * from './throttle-keys.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAG1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,WAAW,CAAA;AACzB,cAAc,oBAAoB,CAAA"}

package/build/keys/types.d.ts

@@ -0,0 +1,10 @@
+/** The storage keys of one OTP issuance: digests, never the raw address, id or code. */
+export interface OtpKeyHelper {
+    /** The challenge record key of an issuance id. */
+    otpChallengeKey: (issuanceId: string) => string;
+    /** The case-insensitive digest of the address a code was sent to. */
+    otpEmailKey: (email: string) => string;
+    /** The digest of a code, bound to its issuance. */
+    otpCodeHash: (issuanceId: string, code: string) => string;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/keys/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/keys/types.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAA;IAC/C,qEAAqE;IACrE,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IACtC,mDAAmD;IACnD,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;CAC1D"}

package/build/keys/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/keys/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/keys/types.ts"],"names":[],"mappings":""}

package/build/keys.d.ts

@@ -0,0 +1,4 @@
+import type { OtpKeyHelper } from './keys/types.js';
+export declare const createOtpKeyHelper: () => OtpKeyHelper;
+export declare const otpKeyHelper: OtpKeyHelper;
+//# sourceMappingURL=keys.d.ts.map

package/build/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAKnD,eAAO,MAAM,kBAAkB,QAAO,YAOrC,CAAA;AAED,eAAO,MAAM,YAAY,cAAuB,CAAA"}

package/build/keys.js

@@ -0,0 +1,10 @@
+import { createHash } from 'node:crypto';
+const digest = (scope, value) => createHash('sha256').update(`owlmeans:otp:${scope}\0${value}`).digest('hex');
+export const createOtpKeyHelper = () => {
+    const otpChallengeKey = (issuanceId) => `challenge:${digest('issuance', issuanceId)}`;
+    const otpEmailKey = (email) => digest('email', email.trim().toLowerCase());
+    const otpCodeHash = (issuanceId, code) => digest('code', `${issuanceId}\0${code.trim()}`);
+    return { otpChallengeKey, otpEmailKey, otpCodeHash };
+};
+export const otpKeyHelper = createOtpKeyHelper();
+//# sourceMappingURL=keys.js.map

package/build/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CACtD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,gBAAgB,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAiB,EAAE;IACnD,MAAM,eAAe,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,aAAa,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAA;IACrG,MAAM,WAAW,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IAC1F,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAE,IAAY,EAAU,EAAE,CAC/D,MAAM,CAAC,MAAM,EAAE,GAAG,UAAU,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAEjD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,CAAA;AACtD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAA"}

package/build/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACvF,OAAO,EAAmB,yBAAyB,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAClH,OAAO,EAAmB,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChF,OAAO,EAA+B,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAEnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAEvD,gFAAgF;AAChF,MAAM,SAAS,GAAG,CAA+C,OAAU,EAAc,EAAE,CAAC,CAAC;IAC3F,IAAI,EAAE,aAAa;IACnB,qBAAqB,EAAE,yBAAyB,CAAC,MAAM;IAEvD,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACpB,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAa,WAAW,CAAC,CAAA;QACpD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,GAAG,mBAAmB,GAAG,UAAU,EAAE,EAAE,CAAA;IACrE,CAAC;IAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;QAC/B,iFAAiF;QACjF,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAA;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACvD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAA;QAElC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAClD,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,CAAA;QACpC,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAa,WAAW,CAAC,CAAA;QACpD,MAAM,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;QAElD,MAAM,aAAa,GAAI,OAAO,CAAC,GAAW,CAAC,GAAG,EAAE,aAAa,IAAI,qBAAqB,CAAA;QACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAyB,aAAa,CAAC,CAAA;QAEvE,2FAA2F;QAC3F,0FAA0F;QAC1F,kDAAkD;QAClD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAA;QACxC,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,UAAU,IAAI,SAAS;YACjC,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,UAAU;SACrB,CAAA;QAED,IAAI,OAAO,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;QACtD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACpE,CAAC;QAED,wDAAwD;QACxD,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,YAAY,CAAA;QACjD,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QACxC,UAAU,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QAC1C,UAAU,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAA;QAC/C,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAA;QAElD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAC,CAAA;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,CAA+C,OAAU,EAAK,EAAE;IAC7F,cAAc,CAAC,aAAa,EAAE,SAAiD,CAAC,CAAA;IAChF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACvF,OAAO,EAA2C,yBAAyB,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAC1I,OAAO,EAAmB,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChF,OAAO,EAA+B,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAEnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAEvD,gFAAgF;AAChF,MAAM,SAAS,GAAG,CAA+C,OAAU,EAAc,EAAE,CAAC,CAAC;IAC3F,IAAI,EAAE,aAAa;IACnB,qBAAqB,EAAE,yBAAyB,CAAC,MAAM;IAEvD,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACpB,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAa,WAAW,CAAC,CAAA;QACpD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,GAAG,mBAAmB,GAAG,UAAU,EAAE,EAAE,CAAA;IACrE,CAAC;IAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;QAC/B,iFAAiF;QACjF,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAA;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACvD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAA;QAElC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAClD,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,CAAA;QACpC,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAa,WAAW,CAAC,CAAA;QACpD,MAAM,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;QAElD,MAAM,aAAa,GAAI,OAAO,CAAC,GAAW,CAAC,GAAG,EAAE,aAAa,IAAI,qBAAqB,CAAA;QACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAyB,aAAa,CAAC,CAAA;QAEvE,2FAA2F;QAC3F,0FAA0F;QAC1F,kDAAkD;QAClD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAA;QACxC,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,UAAU,IAAI,SAAS;YACjC,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,UAAU;SACrB,CAAA;QAED,IAAI,OAAO,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;QACtD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACpE,CAAC;QAED,wDAAwD;QACxD,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,YAAY,CAAA;QACjD,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QACxC,UAAU,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QAC1C,UAAU,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAA;QAC/C,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAA;QAElD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAC,CAAA;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,CAA+C,OAAU,EAAK,EAAE;IAC7F,cAAc,CAAC,aAAa,EAAE,SAA8B,CAAC,CAAA;IAC7D,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/service.d.ts

@@ -1,6 +1,3 @@
 import { type OtpService } from '@owlmeans/auth-otp';
-export declare const otpChallengeKey: (issuanceId: string) => string;
-export declare const otpEmailKey: (email: string) => string;
-export declare const otpCodeHash: (issuanceId: string, code: string) => string;
 export declare const makeOtpService: (alias?: string) => OtpService;
 //# sourceMappingURL=service.d.ts.map

package/build/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,UAAU,EAAwF,MAAM,oBAAoB,CAAA;AAkB1I,eAAO,MAAM,eAAe,eAAgB,MAAM,KAAG,MAAuD,CAAA;AAC5G,eAAO,MAAM,WAAW,UAAW,MAAM,KAAG,MAAqD,CAAA;AACjG,eAAO,MAAM,WAAW,eAAgB,MAAM,QAAQ,MAAM,KAAG,MACd,CAAA;AAEjD,eAAO,MAAM,cAAc,sBAA0B,UA0EpD,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,UAAU,EAAwF,MAAM,oBAAoB,CAAA;AAqB1I,eAAO,MAAM,cAAc,sBAA0B,UA0EpD,CAAA"}

package/build/service.js

@@ -2,19 +2,20 @@ import { appendContextual } from '@owlmeans/context';
 import { AuthenFailed } from '@owlmeans/auth';
 import { OTP_SERVICE, OTP_TTL_SECONDS, OTP_CODE_LENGTH, OTP_MAX_FAILED_ATTEMPTS, OTP_RESOURCE } from '@owlmeans/auth-otp';
 import { MAILER_SERVICE } from '@owlmeans/mailer';
-import { createHash, randomBytes, randomInt } from 'node:crypto';
+import { randomBytes, randomInt } from 'node:crypto';
 import { OtpChallengeOutcome, OTP_CHALLENGE_STORE } from './consts.js';
-import { emailThrottleKey } from './throttle.js';
+import { throttleKeyHelper } from './throttle-keys.js';
+import { otpKeyHelper } from './keys.js';
 import { OtpThrottled, OtpUnavailable } from './errors.js';
 import { makeRedisOtpChallengeStore } from './challenge.js';
 import { logger, logThrottle } from '@owlmeans/log';
 const log = logger('server-auth-otp');
 /** An e-mail as a log may carry it: its domain only. */
 const domainOf = (email) => email.slice(email.lastIndexOf('@') + 1);
-const digest = (scope, value) => createHash('sha256').update(`owlmeans:otp:${scope}\0${value}`).digest('hex');
-export const otpChallengeKey = (issuanceId) => `challenge:${digest('issuance', issuanceId)}`;
-export const otpEmailKey = (email) => digest('email', email.trim().toLowerCase());
-export const otpCodeHash = (issuanceId, code) => digest('code', `${issuanceId}\0${code.trim()}`);
+const generateCode = () => {
+    const digits = randomInt(0, Math.pow(10, OTP_CODE_LENGTH));
+    return String(digits).padStart(OTP_CODE_LENGTH, '0');
+};
 export const makeOtpService = (alias = OTP_SERVICE) => {
     let fallbackChallenges;
     const challengeStore = (ctx) => {
@@ -41,9 +42,9 @@ export const makeOtpService = (alias = OTP_SERVICE) => {
             const throttleRules = ctx.cfg.otp?.throttleRules;
             if (throttleAlias != null && throttleRules != null) {
                 const decision = await ctx.service(throttleAlias)
-                    .consume(emailThrottleKey(email), throttleRules, issuanceId);
+                    .consume(throttleKeyHelper.emailThrottleKey(email), throttleRules, issuanceId);
                 if (!decision.allowed) {
-                    if (logThrottle(`otp-throttled:${otpEmailKey(email)}`, 60_000)) {
+                    if (logThrottle(`otp-throttled:${otpKeyHelper.otpEmailKey(email)}`, 60_000)) {
                         log.warn('Login code refused: throttled', {
                             reason: 'otp-throttled', emailDomain: domainOf(email), retryAfter: decision.retryAfter,
                         }, { event: 'auth.refused' });
@@ -52,9 +53,9 @@ export const makeOtpService = (alias = OTP_SERVICE) => {
                 }
             }
             const issued = await challenges.issue({
-                id: otpChallengeKey(issuanceId),
-                emailKey: otpEmailKey(email),
-                codeHash: otpCodeHash(issuanceId, code),
+                id: otpKeyHelper.otpChallengeKey(issuanceId),
+                emailKey: otpKeyHelper.otpEmailKey(email),
+                codeHash: otpKeyHelper.otpCodeHash(issuanceId, code),
             }, OTP_TTL_SECONDS);
             if (!issued)
                 throw new OtpUnavailable('issuance-collision');
@@ -68,7 +69,7 @@ export const makeOtpService = (alias = OTP_SERVICE) => {
         },
         verifyChallenge: async (email, issuanceId, code) => {
             const ctx = service.ctx;
-            const outcome = await challengeStore(ctx).verify(otpChallengeKey(issuanceId), otpEmailKey(email), otpCodeHash(issuanceId, code), OTP_MAX_FAILED_ATTEMPTS);
+            const outcome = await challengeStore(ctx).verify(otpKeyHelper.otpChallengeKey(issuanceId), otpKeyHelper.otpEmailKey(email), otpKeyHelper.otpCodeHash(issuanceId, code), OTP_MAX_FAILED_ATTEMPTS);
             if (outcome !== OtpChallengeOutcome.Verified) {
                 // The sign-in refusal itself (`auth.refused`) is logged where the manager decides sign-in.
                 log.debug('OTP challenge refused', { outcome, emailDomain: domainOf(email) });
@@ -78,8 +79,4 @@ export const makeOtpService = (alias = OTP_SERVICE) => {
     });
     return service;
 };
-const generateCode = () => {
-    const digits = randomInt(0, Math.pow(10, OTP_CODE_LENGTH));
-    return String(digits).padStart(OTP_CODE_LENGTH, '0');
-};
 //# sourceMappingURL=service.js.map

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAmB,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC1I,OAAO,EAAsB,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEnD,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAA;AAErC,wDAAwD;AACxD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AAEnF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CACtD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,gBAAgB,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAE9E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,aAAa,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAA;AAC5G,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;AACjG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAE,IAAY,EAAU,EAAE,CACtE,MAAM,CAAC,MAAM,EAAE,GAAG,UAAU,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AAEjD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,GAAG,WAAW,EAAc,EAAE;IAChE,IAAI,kBAAiD,CAAA;IAErD,MAAM,cAAc,GAAG,CAAC,GAA0B,EAAqB,EAAE;QACvE,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,IAAI,mBAAmB,CAAA;QAC9E,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,OAAO,GAAG,CAAC,OAAO,CAAoB,cAAc,CAAC,CAAA;QAEzF,4FAA4F;QAC5F,6FAA6F;QAC7F,IAAI,kBAAkB,IAAI,IAAI,EAAE,CAAC;YAC/B,kBAAkB,GAAG,0BAA0B,CAC7C,GAAG,KAAK,kBAAkB,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,IAAI,YAAY,CACvE,CAAA;YACD,kBAAkB,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;QACzC,CAAC;QACD,OAAO,kBAAkB,CAAA;IAC3B,CAAC,CAAA;IAED,MAAM,OAAO,GAAe,gBAAgB,CAAa,KAAK,EAAE;QAC9D,cAAc,EAAE,KAAK,EAAE,KAAa,EAAmB,EAAE;YACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAA4B,CAAA;YAChD,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,IAAI,cAAc,CAAA;YAC9D,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;YACtC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAgB,WAAW,CAAC,CAAA;YACtD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAA;YAC3B,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;YAExD,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAA;YAChD,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAA;YAChD,IAAI,aAAa,IAAI,IAAI,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBACnD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAsB,aAAa,CAAC;qBACnE,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,CAAA;gBAC9D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,IAAI,WAAW,CAAC,iBAAiB,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;wBAC/D,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE;4BACxC,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU;yBACvF,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;oBAC/B,CAAC;oBACD,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;gBAC7C,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC;gBACpC,EAAE,EAAE,eAAe,CAAC,UAAU,CAAC;gBAC/B,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC;gBAC5B,QAAQ,EAAE,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC;aACxC,EAAE,eAAe,CAAC,CAAA;YACnB,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,cAAc,CAAC,oBAAoB,CAAC,CAAA;YAE3D,MAAM,MAAM,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,iBAAiB;gBAC1B,IAAI,EAAE,gCAAgC,IAAI,qBAAqB,eAAe,GAAG,EAAE,WAAW;gBAC9F,IAAI,EAAE,2CAA2C,IAAI,iCAAiC,eAAe,GAAG,EAAE,eAAe;aAC1H,CAAC,CAAA;YAEF,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,eAAe,EAAE,KAAK,EAAE,KAAa,EAAE,UAAkB,EAAE,IAAY,EAAiB,EAAE;YACxF,MAAM,GAAG,GAAG,OAAO,CAAC,GAA4B,CAAA;YAChD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,CAC9C,eAAe,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,EAC9E,uBAAuB,CACxB,CAAA;YACD,IAAI,OAAO,KAAK,mBAAmB,CAAC,QAAQ,EAAE,CAAC;gBAC7C,2FAA2F;gBAC3F,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC7E,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,GAAW,EAAE;IAChC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;AACtD,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAmB,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC1I,OAAO,EAAsB,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEpD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEnD,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAA;AAErC,wDAAwD;AACxD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AAEnF,MAAM,YAAY,GAAG,GAAW,EAAE;IAChC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;AACtD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,GAAG,WAAW,EAAc,EAAE;IAChE,IAAI,kBAAiD,CAAA;IAErD,MAAM,cAAc,GAAG,CAAC,GAA0B,EAAqB,EAAE;QACvE,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,IAAI,mBAAmB,CAAA;QAC9E,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,OAAO,GAAG,CAAC,OAAO,CAAoB,cAAc,CAAC,CAAA;QAEzF,4FAA4F;QAC5F,6FAA6F;QAC7F,IAAI,kBAAkB,IAAI,IAAI,EAAE,CAAC;YAC/B,kBAAkB,GAAG,0BAA0B,CAC7C,GAAG,KAAK,kBAAkB,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,IAAI,YAAY,CACvE,CAAA;YACD,kBAAkB,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;QACzC,CAAC;QACD,OAAO,kBAAkB,CAAA;IAC3B,CAAC,CAAA;IAED,MAAM,OAAO,GAAe,gBAAgB,CAAa,KAAK,EAAE;QAC9D,cAAc,EAAE,KAAK,EAAE,KAAa,EAAmB,EAAE;YACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAA4B,CAAA;YAChD,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,IAAI,cAAc,CAAA;YAC9D,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;YACtC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAgB,WAAW,CAAC,CAAA;YACtD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAA;YAC3B,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;YAExD,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAA;YAChD,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAA;YAChD,IAAI,aAAa,IAAI,IAAI,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBACnD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAsB,aAAa,CAAC;qBACnE,OAAO,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,CAAA;gBAChF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,IAAI,WAAW,CAAC,iBAAiB,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;wBAC5E,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE;4BACxC,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU;yBACvF,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;oBAC/B,CAAC;oBACD,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;gBAC7C,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC;gBACpC,EAAE,EAAE,YAAY,CAAC,eAAe,CAAC,UAAU,CAAC;gBAC5C,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC;gBACzC,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC;aACrD,EAAE,eAAe,CAAC,CAAA;YACnB,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,cAAc,CAAC,oBAAoB,CAAC,CAAA;YAE3D,MAAM,MAAM,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,iBAAiB;gBAC1B,IAAI,EAAE,gCAAgC,IAAI,qBAAqB,eAAe,GAAG,EAAE,WAAW;gBAC9F,IAAI,EAAE,2CAA2C,IAAI,iCAAiC,eAAe,GAAG,EAAE,eAAe;aAC1H,CAAC,CAAA;YAEF,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,eAAe,EAAE,KAAK,EAAE,KAAa,EAAE,UAAkB,EAAE,IAAY,EAAiB,EAAE;YACxF,MAAM,GAAG,GAAG,OAAO,CAAC,GAA4B,CAAA;YAChD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,CAC9C,YAAY,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,EACrH,uBAAuB,CACxB,CAAA;YACD,IAAI,OAAO,KAAK,mBAAmB,CAAC,QAAQ,EAAE,CAAC;gBAC7C,2FAA2F;gBAC3F,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC7E,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/throttle-keys/types.d.ts

@@ -0,0 +1,8 @@
+/** Throttle subjects as non-raw keys: digests of what a request is throttled by. */
+export interface ThrottleKeyHelper {
+    /** Collision-resistant, non-raw key for case-insensitive email throttles. */
+    emailThrottleKey: (email: string) => string;
+    /** Non-raw key for request-source throttles. Callers remain responsible for trusted-proxy parsing. */
+    ipThrottleKey: (ip: string) => string;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/throttle-keys/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/throttle-keys/types.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IAC3C,sGAAsG;IACtG,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAA;CACtC"}

package/build/throttle-keys/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/throttle-keys/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/throttle-keys/types.ts"],"names":[],"mappings":""}

package/build/throttle-keys.d.ts

@@ -0,0 +1,4 @@
+import type { ThrottleKeyHelper } from './throttle-keys/types.js';
+export declare const createThrottleKeyHelper: () => ThrottleKeyHelper;
+export declare const throttleKeyHelper: ThrottleKeyHelper;
+//# sourceMappingURL=throttle-keys.d.ts.map

package/build/throttle-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"throttle-keys.d.ts","sourceRoot":"","sources":["../src/throttle-keys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAKjE,eAAO,MAAM,uBAAuB,QAAO,iBAQ1C,CAAA;AAED,eAAO,MAAM,iBAAiB,mBAA4B,CAAA"}

package/build/throttle-keys.js

@@ -0,0 +1,9 @@
+import { createHash } from 'node:crypto';
+const digestKey = (kind, value) => createHash('sha256').update(`owlmeans:throttle:${kind}\0${value}`).digest('hex');
+export const createThrottleKeyHelper = () => {
+    const emailThrottleKey = (email) => `email:${digestKey('email', email.trim().toLowerCase())}`;
+    const ipThrottleKey = (ip) => `ip:${digestKey('ip', ip.trim().toLowerCase())}`;
+    return { emailThrottleKey, ipThrottleKey };
+};
+export const throttleKeyHelper = createThrottleKeyHelper();
+//# sourceMappingURL=throttle-keys.js.map

package/build/throttle-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"throttle-keys.js","sourceRoot":"","sources":["../src/throttle-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CACxD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,qBAAqB,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAElF,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAsB,EAAE;IAC7D,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAU,EAAE,CACjD,SAAS,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAA;IAE3D,MAAM,aAAa,GAAG,CAAC,EAAU,EAAU,EAAE,CAC3C,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAA;IAElD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAA;AAC5C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,EAAE,CAAA"}

package/build/throttle.d.ts

@@ -1,11 +1,11 @@
 import type { AuthThrottleService } from './types.js';
 import type { Clock } from './types.local.js';
-/** Collision-resistant, non-raw key for case-insensitive email throttles. */
-export declare const emailThrottleKey: (email: string) => string;
-/** Non-raw key for request-source throttles. Callers remain responsible for trusted-proxy parsing. */
-export declare const ipThrottleKey: (ip: string) => string;
 /** Real in-memory implementation for single-process development and deterministic unit tests. */
 export declare const makeMemoryThrottleService: (alias?: string, now?: Clock) => AuthThrottleService;
 /** Redis implementation: every configured window is checked and consumed in one Lua operation. */
 export declare const makeRedisThrottleService: (alias?: string, resourceAlias?: string) => AuthThrottleService;
+/** @deprecated compat:factory-refactor — use `throttleKeyHelper.emailThrottleKey(…)` */
+export declare const emailThrottleKey: (email: string) => string;
+/** @deprecated compat:factory-refactor — use `throttleKeyHelper.ipThrottleKey(…)` */
+export declare const ipThrottleKey: (ip: string) => string;
 //# sourceMappingURL=throttle.d.ts.map

package/build/throttle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"throttle.d.ts","sourceRoot":"","sources":["../src/throttle.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAyD,MAAM,YAAY,CAAA;AAG5G,OAAO,KAAK,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAA;AAKrE,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,UAAW,MAAM,KAAG,MACU,CAAA;AAE3D,sGAAsG;AACtG,eAAO,MAAM,aAAa,OAAQ,MAAM,KAAG,MACO,CAAA;AASlD,iGAAiG;AACjG,eAAO,MAAM,yBAAyB,yBACD,KAAK,KACvC,mBAyBF,CAAA;AAED,kGAAkG;AAClG,eAAO,MAAM,wBAAwB,8CAElC,mBA4BF,CAAA"}
+{"version":3,"file":"throttle.d.ts","sourceRoot":"","sources":["../src/throttle.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAyD,MAAM,YAAY,CAAA;AAG5G,OAAO,KAAK,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAA;AAUrE,iGAAiG;AACjG,eAAO,MAAM,yBAAyB,yBACD,KAAK,KACvC,mBAyBF,CAAA;AAED,kGAAkG;AAClG,eAAO,MAAM,wBAAwB,8CAElC,mBA4BF,CAAA;AAED,wFAAwF;AACxF,eAAO,MAAM,gBAAgB,UAAW,MAAM,KAAG,MAAmD,CAAA;AAEpG,qFAAqF;AACrF,eAAO,MAAM,aAAa,OAAQ,MAAM,KAAG,MAA6C,CAAA"}

package/build/throttle.js

@@ -1,13 +1,9 @@
-import { createHash, randomBytes } from 'node:crypto';
+import { randomBytes } from 'node:crypto';
 import { createService, appendContextual } from '@owlmeans/context';
 import { OtpUnavailable } from './errors.js';
 import { OTP_RESOURCE, OTP_THROTTLE_SERVICE } from './consts.js';
 import { REDIS_THROTTLE_SCRIPT } from './consts.local.js';
-const digestKey = (kind, value) => createHash('sha256').update(`owlmeans:throttle:${kind}\0${value}`).digest('hex');
-/** Collision-resistant, non-raw key for case-insensitive email throttles. */
-export const emailThrottleKey = (email) => `email:${digestKey('email', email.trim().toLowerCase())}`;
-/** Non-raw key for request-source throttles. Callers remain responsible for trusted-proxy parsing. */
-export const ipThrottleKey = (ip) => `ip:${digestKey('ip', ip.trim().toLowerCase())}`;
+import { throttleKeyHelper } from './throttle-keys.js';
 const assertRules = (rules) => {
     if (rules.length === 0 || rules.some(rule => !Number.isInteger(rule.limit) || rule.limit < 1
         || !Number.isInteger(rule.windowSeconds) || rule.windowSeconds < 1)) {
@@ -64,4 +60,8 @@ export const makeRedisThrottleService = (alias = OTP_THROTTLE_SERVICE, resourceA
     });
     return service;
 };
+/** @deprecated compat:factory-refactor — use `throttleKeyHelper.emailThrottleKey(…)` */
+export const emailThrottleKey = (email) => throttleKeyHelper.emailThrottleKey(email);
+/** @deprecated compat:factory-refactor — use `throttleKeyHelper.ipThrottleKey(…)` */
+export const ipThrottleKey = (ip) => throttleKeyHelper.ipThrottleKey(ip);
 //# sourceMappingURL=throttle.js.map

package/build/throttle.js.map

@@ -1 +1 @@
-{"version":3,"file":"throttle.js","sourceRoot":"","sources":["../src/throttle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEnE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAGzD,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CACxD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,qBAAqB,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAElF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAU,EAAE,CACxD,SAAS,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAA;AAE3D,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAU,EAAU,EAAE,CAClD,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAA;AAElD,MAAM,WAAW,GAAG,CAAC,KAA8B,EAAQ,EAAE;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;WACvF,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,WAAW,CAAC,qEAAqE,CAAC,CAAA;IAC9F,CAAC;AACH,CAAC,CAAA;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,KAAK,GAAG,oBAAoB,EAAE,GAAG,GAAU,IAAI,CAAC,GAAG,EAC9B,EAAE;IACvB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAA;IAE1C,OAAO,aAAa,CAAsB,KAAK,EAAE;QAC/C,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAA6B,EAAE;YACvD,WAAW,CAAC,KAAK,CAAC,CAAA;YAClB,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;YAChB,IAAI,UAAU,GAAG,CAAC,CAAA;YAClB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;gBAC9B,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAA;gBAC3D,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAA;gBAChD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,GAAG,SAAS,CAAC,CAAA;gBAC5E,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBAC1B,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;gBACnG,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;YAC3B,CAAC,CAAC,CAAA;YAEF,IAAI,UAAU,GAAG,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;YACzD,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;YAE3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAA;QACzC,CAAC;KACF,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,KAAK,GAAG,oBAAoB,EAAE,aAAa,GAAG,YAAY,EACrC,EAAE;IACvB,MAAM,OAAO,GAAG,gBAAgB,CAAsB,KAAK,EAAE;QAC3D,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAA6B,EAAE;YAC9D,WAAW,CAAC,KAAK,CAAC,CAAA;YAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAA4B,CAAA;YAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAwC,aAAa,CAAC,CAAA;YACnF,wFAAwF;YACxF,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CACzC,aAAa,GAAG,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CACxD,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YAC3F,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;YAEnD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAC1C,qBAAqB,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CACjC,CAAA;gBAErB,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC5E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,WAAW,GAAG,IAAI,cAAc,CAAC,UAAU,CAAC,CAAA;gBAClD,IAAI,KAAK,YAAY,KAAK;oBAAE,WAAW,CAAC,cAAc,GAAG,GAAG,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAA;gBACnF,MAAM,WAAW,CAAA;YACnB,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"throttle.js","sourceRoot":"","sources":["../src/throttle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEnE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEtD,MAAM,WAAW,GAAG,CAAC,KAA8B,EAAQ,EAAE;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;WACvF,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,WAAW,CAAC,qEAAqE,CAAC,CAAA;IAC9F,CAAC;AACH,CAAC,CAAA;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,KAAK,GAAG,oBAAoB,EAAE,GAAG,GAAU,IAAI,CAAC,GAAG,EAC9B,EAAE;IACvB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAA;IAE1C,OAAO,aAAa,CAAsB,KAAK,EAAE;QAC/C,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAA6B,EAAE;YACvD,WAAW,CAAC,KAAK,CAAC,CAAA;YAClB,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;YAChB,IAAI,UAAU,GAAG,CAAC,CAAA;YAClB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;gBAC9B,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAA;gBAC3D,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAA;gBAChD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,GAAG,SAAS,CAAC,CAAA;gBAC5E,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBAC1B,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;gBACnG,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;YAC3B,CAAC,CAAC,CAAA;YAEF,IAAI,UAAU,GAAG,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;YACzD,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;YAE3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAA;QACzC,CAAC;KACF,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,KAAK,GAAG,oBAAoB,EAAE,aAAa,GAAG,YAAY,EACrC,EAAE;IACvB,MAAM,OAAO,GAAG,gBAAgB,CAAsB,KAAK,EAAE;QAC3D,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAA6B,EAAE;YAC9D,WAAW,CAAC,KAAK,CAAC,CAAA;YAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAA4B,CAAA;YAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAwC,aAAa,CAAC,CAAA;YACnF,wFAAwF;YACxF,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CACzC,aAAa,GAAG,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CACxD,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YAC3F,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;YAEnD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAC1C,qBAAqB,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CACjC,CAAA;gBAErB,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC5E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,WAAW,GAAG,IAAI,cAAc,CAAC,UAAU,CAAC,CAAA;gBAClD,IAAI,KAAK,YAAY,KAAK;oBAAE,WAAW,CAAC,cAAc,GAAG,GAAG,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAA;gBACnF,MAAM,WAAW,CAAA;YACnB,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;AAEpG,qFAAqF;AACrF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA"}

package/build/types.local.d.ts

@@ -1,10 +1,12 @@
 import type { OtpChallenge } from './types.js';
 import type { ResourceRecord } from '@owlmeans/resource';
-export type Clock = () => number;
-export type StoredChallenge = OtpChallenge & {
+export interface Clock {
+    (): number;
+}
+export interface StoredChallenge extends OtpChallenge {
     failedAttempts: number;
     expiresAt: number;
-};
+}
 export interface ChallengeResourceRecord extends ResourceRecord {
     id: string;
 }

package/build/types.local.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.local.d.ts","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,CAAA;AAEhC,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1F,MAAM,WAAW,uBAAwB,SAAQ,cAAc;IAAG,EAAE,EAAE,MAAM,CAAA;CAAE;AAE9E,MAAM,WAAW,sBAAuB,SAAQ,cAAc;IAAG,EAAE,EAAE,MAAM,CAAA;CAAE"}
+{"version":3,"file":"types.local.d.ts","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,MAAM,WAAW,KAAK;IAAG,IAAI,MAAM,CAAA;CAAE;AAErC,MAAM,WAAW,eAAgB,SAAQ,YAAY;IAAG,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAEnG,MAAM,WAAW,uBAAwB,SAAQ,cAAc;IAAG,EAAE,EAAE,MAAM,CAAA;CAAE;AAE9E,MAAM,WAAW,sBAAuB,SAAQ,cAAc;IAAG,EAAE,EAAE,MAAM,CAAA;CAAE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth-otp",
-  "version": "0.1.18-rc.52",
+  "version": "0.1.18-rc.54",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,18 +22,18 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.39",
-    "@owlmeans/auth-otp": "^0.1.18-rc.33",
-    "@owlmeans/context": "^0.1.18-rc.33",
-    "@owlmeans/error": "^0.1.18-rc.37",
-    "@owlmeans/log": "^0.1.18-rc.1",
-    "@owlmeans/mailer": "^0.1.18-rc.35",
-    "@owlmeans/oidc": "^0.1.18-rc.54",
-    "@owlmeans/redis-resource": "^0.1.18-rc.43",
-    "@owlmeans/resource": "^0.1.18-rc.39",
-    "@owlmeans/server-auth": "^0.1.18-rc.53",
-    "@owlmeans/server-auth-identity": "^0.1.18-rc.46",
-    "@owlmeans/server-context": "^0.1.18-rc.42"
+    "@owlmeans/auth": "^0.1.18-rc.40",
+    "@owlmeans/auth-otp": "^0.1.18-rc.34",
+    "@owlmeans/context": "^0.1.18-rc.34",
+    "@owlmeans/error": "^0.1.18-rc.38",
+    "@owlmeans/log": "^0.1.18-rc.2",
+    "@owlmeans/mailer": "^0.1.18-rc.36",
+    "@owlmeans/oidc": "^0.1.18-rc.56",
+    "@owlmeans/redis-resource": "^0.1.18-rc.45",
+    "@owlmeans/resource": "^0.1.18-rc.40",
+    "@owlmeans/server-auth": "^0.1.18-rc.55",
+    "@owlmeans/server-auth-identity": "^0.1.18-rc.48",
+    "@owlmeans/server-context": "^0.1.18-rc.43"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",

package/src/index.ts

@@ -1,7 +1,11 @@
 export * from './types.js'
+export type * from './keys/types.js'
+export type * from './throttle-keys/types.js'
 export * from './consts.js'
 export * from './service.js'
 export * from './plugin.js'
 export * from './errors.js'
 export * from './throttle.js'
 export * from './challenge.js'
+export * from './keys.js'
+export * from './throttle-keys.js'

package/src/keys/types.ts

@@ -0,0 +1,9 @@
+/** The storage keys of one OTP issuance: digests, never the raw address, id or code. */
+export interface OtpKeyHelper {
+  /** The challenge record key of an issuance id. */
+  otpChallengeKey: (issuanceId: string) => string
+  /** The case-insensitive digest of the address a code was sent to. */
+  otpEmailKey: (email: string) => string
+  /** The digest of a code, bound to its issuance. */
+  otpCodeHash: (issuanceId: string, code: string) => string
+}

package/src/keys.ts

@@ -0,0 +1,16 @@
+import { createHash } from 'node:crypto'
+import type { OtpKeyHelper } from './keys/types.js'
+
+const digest = (scope: string, value: string): string =>
+  createHash('sha256').update(`owlmeans:otp:${scope}\0${value}`).digest('hex')
+
+export const createOtpKeyHelper = (): OtpKeyHelper => {
+  const otpChallengeKey = (issuanceId: string): string => `challenge:${digest('issuance', issuanceId)}`
+  const otpEmailKey = (email: string): string => digest('email', email.trim().toLowerCase())
+  const otpCodeHash = (issuanceId: string, code: string): string =>
+    digest('code', `${issuanceId}\0${code.trim()}`)
+
+  return { otpChallengeKey, otpEmailKey, otpCodeHash }
+}
+
+export const otpKeyHelper = createOtpKeyHelper()

package/src/plugin.ts

@@ -1,5 +1,5 @@
 import { ALL_SCOPES, AuthenFailed, AuthRole, AuthenticationType } from '@owlmeans/auth'
-import { type AuthPlugin, AuthChallengeReplayPolicy, registerPlugin } from '@owlmeans/server-auth/manager/plugins'
+import { type AuthPlugin, type AuthPluginFactory, AuthChallengeReplayPolicy, registerPlugin } from '@owlmeans/server-auth/manager/plugins'
 import { type OtpService, OTP_AUTH_TYPE, OTP_SERVICE } from '@owlmeans/auth-otp'
 import { type IdentityLinkingService, AUTH_IDENTITY_LINKING } from '@owlmeans/server-auth-identity'
 import type { OtpConfig, OtpContext } from './types.js'
@@ -71,6 +71,6 @@ const otpPlugin = <C extends OtpConfig, T extends OtpContext<C>>(context: T): Au
 
 /** Register the email-OTP plugin into the server-auth plugin registry. Call once at context setup. */
 export const appendOtpPlugin = <C extends OtpConfig, T extends OtpContext<C>>(context: T): T => {
-  registerPlugin(OTP_AUTH_TYPE, otpPlugin as Parameters<typeof registerPlugin>[1])
+  registerPlugin(OTP_AUTH_TYPE, otpPlugin as AuthPluginFactory)
   return context
 }

package/src/service.ts

@@ -2,10 +2,11 @@ import { appendContextual } from '@owlmeans/context'
 import { AuthenFailed } from '@owlmeans/auth'
 import { type OtpService, OTP_SERVICE, OTP_TTL_SECONDS, OTP_CODE_LENGTH, OTP_MAX_FAILED_ATTEMPTS, OTP_RESOURCE } from '@owlmeans/auth-otp'
 import { type MailerService, MAILER_SERVICE } from '@owlmeans/mailer'
-import { createHash, randomBytes, randomInt } from 'node:crypto'
+import { randomBytes, randomInt } from 'node:crypto'
 import type { AuthThrottleService, OtpChallengeStore, OtpConfig, OtpContext } from './types.js'
 import { OtpChallengeOutcome, OTP_CHALLENGE_STORE } from './consts.js'
-import { emailThrottleKey } from './throttle.js'
+import { throttleKeyHelper } from './throttle-keys.js'
+import { otpKeyHelper } from './keys.js'
 import { OtpThrottled, OtpUnavailable } from './errors.js'
 import { makeRedisOtpChallengeStore } from './challenge.js'
 import { logger, logThrottle } from '@owlmeans/log'
@@ -15,13 +16,10 @@ const log = logger('server-auth-otp')
 /** An e-mail as a log may carry it: its domain only. */
 const domainOf = (email: string): string => email.slice(email.lastIndexOf('@') + 1)
 
-const digest = (scope: string, value: string): string =>
-  createHash('sha256').update(`owlmeans:otp:${scope}\0${value}`).digest('hex')
-
-export const otpChallengeKey = (issuanceId: string): string => `challenge:${digest('issuance', issuanceId)}`
-export const otpEmailKey = (email: string): string => digest('email', email.trim().toLowerCase())
-export const otpCodeHash = (issuanceId: string, code: string): string =>
-  digest('code', `${issuanceId}\0${code.trim()}`)
+const generateCode = (): string => {
+  const digits = randomInt(0, Math.pow(10, OTP_CODE_LENGTH))
+  return String(digits).padStart(OTP_CODE_LENGTH, '0')
+}
 
 export const makeOtpService = (alias = OTP_SERVICE): OtpService => {
   let fallbackChallenges: OtpChallengeStore | undefined
@@ -54,9 +52,9 @@ export const makeOtpService = (alias = OTP_SERVICE): OtpService => {
       const throttleRules = ctx.cfg.otp?.throttleRules
       if (throttleAlias != null && throttleRules != null) {
         const decision = await ctx.service<AuthThrottleService>(throttleAlias)
-          .consume(emailThrottleKey(email), throttleRules, issuanceId)
+          .consume(throttleKeyHelper.emailThrottleKey(email), throttleRules, issuanceId)
         if (!decision.allowed) {
-          if (logThrottle(`otp-throttled:${otpEmailKey(email)}`, 60_000)) {
+          if (logThrottle(`otp-throttled:${otpKeyHelper.otpEmailKey(email)}`, 60_000)) {
             log.warn('Login code refused: throttled', {
               reason: 'otp-throttled', emailDomain: domainOf(email), retryAfter: decision.retryAfter,
             }, { event: 'auth.refused' })
@@ -66,9 +64,9 @@ export const makeOtpService = (alias = OTP_SERVICE): OtpService => {
       }
 
       const issued = await challenges.issue({
-        id: otpChallengeKey(issuanceId),
-        emailKey: otpEmailKey(email),
-        codeHash: otpCodeHash(issuanceId, code),
+        id: otpKeyHelper.otpChallengeKey(issuanceId),
+        emailKey: otpKeyHelper.otpEmailKey(email),
+        codeHash: otpKeyHelper.otpCodeHash(issuanceId, code),
       }, OTP_TTL_SECONDS)
       if (!issued) throw new OtpUnavailable('issuance-collision')
 
@@ -85,7 +83,7 @@ export const makeOtpService = (alias = OTP_SERVICE): OtpService => {
     verifyChallenge: async (email: string, issuanceId: string, code: string): Promise<void> => {
       const ctx = service.ctx as OtpContext<OtpConfig>
       const outcome = await challengeStore(ctx).verify(
-        otpChallengeKey(issuanceId), otpEmailKey(email), otpCodeHash(issuanceId, code),
+        otpKeyHelper.otpChallengeKey(issuanceId), otpKeyHelper.otpEmailKey(email), otpKeyHelper.otpCodeHash(issuanceId, code),
         OTP_MAX_FAILED_ATTEMPTS
       )
       if (outcome !== OtpChallengeOutcome.Verified) {
@@ -98,8 +96,3 @@ export const makeOtpService = (alias = OTP_SERVICE): OtpService => {
 
   return service
 }
-
-const generateCode = (): string => {
-  const digits = randomInt(0, Math.pow(10, OTP_CODE_LENGTH))
-  return String(digits).padStart(OTP_CODE_LENGTH, '0')
-}

package/src/throttle-keys/types.ts

@@ -0,0 +1,7 @@
+/** Throttle subjects as non-raw keys: digests of what a request is throttled by. */
+export interface ThrottleKeyHelper {
+  /** Collision-resistant, non-raw key for case-insensitive email throttles. */
+  emailThrottleKey: (email: string) => string
+  /** Non-raw key for request-source throttles. Callers remain responsible for trusted-proxy parsing. */
+  ipThrottleKey: (ip: string) => string
+}

package/src/throttle-keys.ts

@@ -0,0 +1,17 @@
+import { createHash } from 'node:crypto'
+import type { ThrottleKeyHelper } from './throttle-keys/types.js'
+
+const digestKey = (kind: string, value: string): string =>
+  createHash('sha256').update(`owlmeans:throttle:${kind}\0${value}`).digest('hex')
+
+export const createThrottleKeyHelper = (): ThrottleKeyHelper => {
+  const emailThrottleKey = (email: string): string =>
+    `email:${digestKey('email', email.trim().toLowerCase())}`
+
+  const ipThrottleKey = (ip: string): string =>
+    `ip:${digestKey('ip', ip.trim().toLowerCase())}`
+
+  return { emailThrottleKey, ipThrottleKey }
+}
+
+export const throttleKeyHelper = createThrottleKeyHelper()

package/src/throttle.ts

@@ -1,4 +1,4 @@
-import { createHash, randomBytes } from 'node:crypto'
+import { randomBytes } from 'node:crypto'
 import { createService, appendContextual } from '@owlmeans/context'
 import type { RedisResource } from '@owlmeans/redis-resource'
 import { OtpUnavailable } from './errors.js'
@@ -6,17 +6,7 @@ import type { AuthThrottleService, OtpConfig, OtpContext, ThrottleDecision, Thro
 import { OTP_RESOURCE, OTP_THROTTLE_SERVICE } from './consts.js'
 import { REDIS_THROTTLE_SCRIPT } from './consts.local.js'
 import type { Clock, ThrottleResourceRecord } from './types.local.js'
-
-const digestKey = (kind: string, value: string): string =>
-  createHash('sha256').update(`owlmeans:throttle:${kind}\0${value}`).digest('hex')
-
-/** Collision-resistant, non-raw key for case-insensitive email throttles. */
-export const emailThrottleKey = (email: string): string =>
-  `email:${digestKey('email', email.trim().toLowerCase())}`
-
-/** Non-raw key for request-source throttles. Callers remain responsible for trusted-proxy parsing. */
-export const ipThrottleKey = (ip: string): string =>
-  `ip:${digestKey('ip', ip.trim().toLowerCase())}`
+import { throttleKeyHelper } from './throttle-keys.js'
 
 const assertRules = (rules: readonly ThrottleRule[]): void => {
   if (rules.length === 0 || rules.some(rule => !Number.isInteger(rule.limit) || rule.limit < 1
@@ -87,3 +77,9 @@ export const makeRedisThrottleService = (
 
   return service
 }
+
+/** @deprecated compat:factory-refactor — use `throttleKeyHelper.emailThrottleKey(…)` */
+export const emailThrottleKey = (email: string): string => throttleKeyHelper.emailThrottleKey(email)
+
+/** @deprecated compat:factory-refactor — use `throttleKeyHelper.ipThrottleKey(…)` */
+export const ipThrottleKey = (ip: string): string => throttleKeyHelper.ipThrottleKey(ip)

package/src/types.local.ts

@@ -1,9 +1,9 @@
 import type { OtpChallenge } from './types.js'
 import type { ResourceRecord } from '@owlmeans/resource'
 
-export type Clock = () => number
+export interface Clock { (): number }
 
-export type StoredChallenge = OtpChallenge & { failedAttempts: number, expiresAt: number }
+export interface StoredChallenge extends OtpChallenge { failedAttempts: number, expiresAt: number }
 
 export interface ChallengeResourceRecord extends ResourceRecord { id: string }
 

package/tests/keys.spec.ts

@@ -1,23 +1,23 @@
 import { describe, expect, test } from 'bun:test'
-import { emailThrottleKey, ipThrottleKey } from '../src/throttle.js'
-import { otpEmailKey } from '../src/service.js'
+import { throttleKeyHelper } from '../src/throttle-keys.js'
+import { otpKeyHelper } from '../src/keys.js'
 
 describe('@owlmeans/server-auth-otp — privacy-preserving keys', () => {
   test('normalizes email case without storing the raw address', () => {
-    const lower = emailThrottleKey('person@example.com')
-    expect(emailThrottleKey(' PERSON@EXAMPLE.COM ')).toBe(lower)
+    const lower = throttleKeyHelper.emailThrottleKey('person@example.com')
+    expect(throttleKeyHelper.emailThrottleKey(' PERSON@EXAMPLE.COM ')).toBe(lower)
     expect(lower).not.toContain('person')
-    expect(otpEmailKey('person@example.com')).not.toContain('person')
+    expect(otpKeyHelper.otpEmailKey('person@example.com')).not.toContain('person')
   })
 
   test('does not collapse punctuation the old lossy key strategy discarded', () => {
-    expect(emailThrottleKey('a+b@example.com')).not.toBe(emailThrottleKey('a_b@example.com'))
+    expect(throttleKeyHelper.emailThrottleKey('a+b@example.com')).not.toBe(throttleKeyHelper.emailThrottleKey('a_b@example.com'))
   })
 
   test('namespaces IP and email digests independently and keeps the IP non-raw', () => {
-    const ip = ipThrottleKey('203.0.113.7')
+    const ip = throttleKeyHelper.ipThrottleKey('203.0.113.7')
     expect(ip).toStartWith('ip:')
     expect(ip).not.toContain('203.0.113.7')
-    expect(ip).not.toBe(emailThrottleKey('203.0.113.7'))
+    expect(ip).not.toBe(throttleKeyHelper.emailThrottleKey('203.0.113.7'))
   })
 })