@owlmeans/server-auth 0.1.18-rc.8 → 0.1.18

package/build/manager/model.js

@@ -1,14 +1,21 @@
-import { AuthenFailed, AuthenPayloadError } from '@owlmeans/auth';
-import { getPlugin } from './plugins/utils.js';
+import { AuthenFailed, AuthenPayloadError, AuthError, AuthUnavailable, authHelper } from '@owlmeans/auth';
+import { logger } from '@owlmeans/log';
+import { ENTITY_RESOLVER } from '@owlmeans/auth-common';
+import { authPluginHelper } from './plugins/utils.js';
 import { AUTH_CACHE, AUTHEN_TIMEFRAME } from '../consts.js';
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
 import { createRelyFlow } from './rely/flow.js';
 import { trusted } from './utils/trusted.js';
+import { AuthChallengeReplayPolicy } from './plugins/consts.js';
+const log = logger('server-auth');
+/** An account id as a log may carry it: an e-mail is reduced to its domain. */
+const accountOf = (userId) => userId == null ? undefined : userId.includes('@') ? `*@${userId.slice(userId.lastIndexOf('@') + 1)}` : userId;
+const compact = (value) => Object.fromEntries(Object.entries(value).filter(([, entry]) => entry != null));
 export const makeAuthModel = (context) => {
     const cache = (context) => context.resource(AUTH_CACHE);
     const model = {
         init: async (request) => {
-            const plugin = await getPlugin(request.type, context);
+            const plugin = await authPluginHelper.getPlugin(request.type, context);
             const response = await plugin.init(request);
             const envelope = makeEnvelopeModel(plugin.type);
             /**
@@ -24,40 +31,72 @@ export const makeAuthModel = (context) => {
             return { challenge };
         },
         authenticate: async (credential) => {
-            const [trustedUser, keyPair] = await trusted(context);
-            const envelope = makeEnvelopeModel(credential.challenge, EnvelopeKind.Wrap);
-            if (!await envelope.verify(keyPair)) {
-                throw new AuthenFailed('challenge');
-            }
-            const msg = envelope.message(true);
+            // The one place every manager sign-in method (each plugin) is decided — logged once here.
+            const method = credential.type;
             try {
-                await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 });
+                const [trustedUser, keyPair] = await trusted(context);
+                const envelope = makeEnvelopeModel(credential.challenge, EnvelopeKind.Wrap);
+                if (!await envelope.verify(keyPair)) {
+                    throw new AuthenFailed('challenge');
+                }
+                const msg = envelope.message(true);
+                const plugin = await authPluginHelper.getPlugin(envelope.type(), context);
+                if (plugin.challengeReplayPolicy !== AuthChallengeReplayPolicy.Plugin) {
+                    try {
+                        await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 });
+                    }
+                    catch (e) {
+                        const error = new AuthenFailed('challenge');
+                        if (e instanceof Error) {
+                            error.oiriginalStack = `${e} : ${e.stack}`;
+                        }
+                        throw error;
+                    }
+                }
+                if (credential.userId == null) {
+                    throw new AuthenPayloadError('userId');
+                }
+                // @TODO this token PROBABLY needs to be registered somewhere and rechecked
+                // from time to time to make sure that the session is not deleted 
+                // or permission hasn't changed.
+                // Alternative solution is to have permissions cached and cleaned 
+                // when some broadcast message is sent from authentication system.
+                const challenge = credential.challenge;
+                const { token } = await plugin.authenticate(Object.assign(credential, { challenge: msg }));
+                credential.challenge = token === '' ? challenge : token;
+                // Plugins accept whatever the caller typed — a current slug, a slug the organization has
+                // since retired, or (for a token minted before slugs existed) its stable key. The token is
+                // signed once and read for as long as it lives, so the value is canonicalized here rather
+                // than at every place that later reads it back.
+                const entitySlug = authHelper.entitySlugOf(credential);
+                if (entitySlug != null && context.hasService(ENTITY_RESOLVER)) {
+                    const entity = await context.service(ENTITY_RESOLVER).resolve(entitySlug);
+                    if (entity == null) {
+                        throw new AuthenFailed('entity');
+                    }
+                    credential.entitySlug = entity.slug;
+                }
+                credential.credential = trustedUser.id;
+                const result = {
+                    token: await makeEnvelopeModel(credential.type)
+                        .send(credential, AUTHEN_TIMEFRAME)
+                        .sign(keyPair, EnvelopeKind.Token)
+                };
+                log.info('Signed in', compact({
+                    method, accountId: accountOf(credential.userId), profileId: credential.profileId,
+                    entitySlug: credential.entitySlug,
+                }), { event: 'auth.signed-in' });
+                return result;
             }
-            catch (e) {
-                const error = new AuthenFailed('challenge');
-                if (e instanceof Error) {
-                    error.oiriginalStack = `${e} : ${e.stack}`;
+            catch (error) {
+                // An outage (`AuthUnavailable`) is not a refusal; it propagates and is logged as a failure.
+                if (error instanceof AuthError && !(error instanceof AuthUnavailable)) {
+                    log.warn('Sign-in refused', compact({
+                        method, accountId: accountOf(credential.userId), reason: error.message,
+                    }), { event: 'auth.refused' });
                 }
                 throw error;
             }
-            if (credential.userId == null) {
-                throw new AuthenPayloadError('userId');
-            }
-            const plugin = await getPlugin(envelope.type(), context);
-            // @TODO this token PROBABLY needs to be registered somewhere and rechecked
-            // from time to time to make sure that the session is not deleted 
-            // or permission hasn't changed.
-            // Alternative solution is to have permissions cached and cleaned 
-            // when some broadcast message is sent from authentication system.
-            const challenge = credential.challenge;
-            const { token } = await plugin.authenticate(Object.assign(credential, { challenge: msg }));
-            credential.challenge = token === '' ? challenge : token;
-            credential.credential = trustedUser.id;
-            return {
-                token: await makeEnvelopeModel(credential.type)
-                    .send(credential, AUTHEN_TIMEFRAME)
-                    .sign(keyPair, EnvelopeKind.Token)
-            };
         },
         rely: async (conn, auth) => {
             conn.authenticate = createRelyFlow(context, conn, auth);

package/build/manager/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEjE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAQ5C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA8B,EAAa,EAAE;IACzE,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,KAAK,GAAc;QACvB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACrD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAE3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAE/C;;;;;eAKG;YACH,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI;gBAC3C,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAA;YAElE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAExG,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YACrD,MAAM,QAAQ,GAAkB,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAC1F,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;YACrC,CAAC;YAED,MAAM,GAAG,GAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAE1C,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,gBAAgB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;YACvG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;gBAC3C,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;oBACvB,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;gBAC5C,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;YAED,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;YAExD,2EAA2E;YAC3E,kEAAkE;YAClE,gCAAgC;YAChC,kEAAkE;YAClE,kEAAkE;YAElE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;YACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;YAC1F,UAAU,CAAC,SAAS,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;YAEvD,UAAU,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,CAAA;YAEtC,OAAO;gBACL,KAAK,EAAE,MAAM,iBAAiB,CAAkB,UAAU,CAAC,IAAI,CAAC;qBAC7D,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC;qBAClC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;aACrC,CAAA;QACH,CAAC;QAED,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACzD,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAwB,MAAM,gBAAgB,CAAA;AAC/H,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAA8B,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAsB,MAAM,0BAA0B,CAAA;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAG5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAI/D,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;AAEjC,+EAA+E;AAC/E,MAAM,SAAS,GAAG,CAAC,MAA0B,EAAsB,EAAE,CACnE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;AAE/G,MAAM,OAAO,GAAG,CAAoC,KAAQ,EAAc,EAAE,CAC1E,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAe,CAAA;AAE9F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA8B,EAAa,EAAE;IACzE,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,KAAK,GAAc;QACvB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACtE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAE3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAE/C;;;;;eAKG;YACH,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI;gBAC3C,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAA;YAElE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAExG,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,0FAA0F;YAC1F,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAA;YAC9B,IAAI,CAAC;gBACH,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;gBACrD,MAAM,QAAQ,GAAkB,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;gBAC1F,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBACpC,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;gBACrC,CAAC;gBAED,MAAM,GAAG,GAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAE1C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;gBAEzE,IAAI,MAAM,CAAC,qBAAqB,KAAK,yBAAyB,CAAC,MAAM,EAAE,CAAC;oBACtE,IAAI,CAAC;wBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,gBAAgB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;oBACvG,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;wBAC3C,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;4BACvB,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;wBAC5C,CAAC;wBACD,MAAM,KAAK,CAAA;oBACb,CAAC;gBACH,CAAC;gBAED,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;oBAC9B,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;gBACxC,CAAC;gBAED,2EAA2E;gBAC3E,kEAAkE;gBAClE,gCAAgC;gBAChC,kEAAkE;gBAClE,kEAAkE;gBAElE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;gBACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;gBAC1F,UAAU,CAAC,SAAS,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;gBAEvD,yFAAyF;gBACzF,2FAA2F;gBAC3F,0FAA0F;gBAC1F,gDAAgD;gBAChD,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;gBACtD,IAAI,UAAU,IAAI,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;oBAChG,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;wBACnB,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAA;oBAClC,CAAC;oBACD,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;gBACrC,CAAC;gBAED,UAAU,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,CAAA;gBAEtC,MAAM,MAAM,GAAG;oBACb,KAAK,EAAE,MAAM,iBAAiB,CAAkB,UAAU,CAAC,IAAI,CAAC;yBAC7D,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC;yBAClC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;iBACrC,CAAA;gBACD,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC;oBAC5B,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS;oBAChF,UAAU,EAAE,UAAU,CAAC,UAAU;iBAClC,CAAC,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;gBAEhC,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,4FAA4F;gBAC5F,IAAI,KAAK,YAAY,SAAS,IAAI,CAAC,CAAC,KAAK,YAAY,eAAe,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC;wBAClC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO;qBACvE,CAAC,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;gBAChC,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QAED,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACzD,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/manager/plugins/basic-ed25519.d.ts

@@ -1,4 +1,4 @@
 import type { AuthPlugin } from './types.js';
 import type { AppConfig, AppContext } from '../types.js';
-export declare const basicEd25519: <C extends AppConfig, T extends AppContext<C>>(context: T) => AuthPlugin;
+export declare const makeBasicEd25519Plugin: <C extends AppConfig, T extends AppContext<C>>(context: T) => AuthPlugin;
 //# sourceMappingURL=basic-ed25519.d.ts.map

package/build/manager/plugins/basic-ed25519.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"basic-ed25519.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/basic-ed25519.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAK5C,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxD,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,KAAG,UA6CvF,CAAA"}
+{"version":3,"file":"basic-ed25519.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/basic-ed25519.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAK5C,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxD,eAAO,MAAM,sBAAsB,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,KAAG,UA6CjG,CAAA"}

package/build/manager/plugins/basic-ed25519.js

@@ -1,14 +1,14 @@
 import { AuthenticationType, AuthenFailed, ALL_SCOPES, AuthRole } from '@owlmeans/auth';
-import { assertType } from './utils.js';
-import { randomBytes } from '@noble/hashes/utils';
+import { authPluginHelper } from './utils.js';
+import { randomBytes } from '@noble/hashes/utils.js';
 import { base64 } from '@scure/base';
-import { fromPubKey } from '@owlmeans/basic-keys';
+import { keyHelper } from '@owlmeans/basic-keys';
 import { TRUSTED } from '@owlmeans/config';
-export const basicEd25519 = (context) => {
+export const makeBasicEd25519Plugin = (context) => {
     const plugin = {
         type: AuthenticationType.BasicEd25519,
         init: async (request) => {
-            assertType(request.type, plugin);
+            authPluginHelper.assertType(request.type, plugin);
             const challenge = base64.encode(randomBytes(32));
             return { challenge };
         },
@@ -24,7 +24,7 @@ export const basicEd25519 = (context) => {
             if (systemUser.credential == null) {
                 throw new SyntaxError('System user missconfigured');
             }
-            const key = fromPubKey(systemUser.credential);
+            const key = keyHelper.fromPubKey(systemUser.credential);
             if (!await key.verify(credential.challenge, credential.credential)) {
                 throw new AuthenFailed(`challenge:${plugin.type}`);
             }

package/build/manager/plugins/basic-ed25519.js.map

@@ -1 +1 @@
-{"version":3,"file":"basic-ed25519.js","sourceRoot":"","sources":["../../../src/manager/plugins/basic-ed25519.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEvF,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAG1C,MAAM,CAAC,MAAM,YAAY,GAAG,CAA+C,OAAU,EAAc,EAAE;IACnG,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,kBAAkB,CAAC,YAAY;QACrC,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAEhD,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B;;eAEG;YACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;iBACxD,IAAI,CAAgB,UAAU,CAAC,MAAM,CAAC,CAAA;YAEzC,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,WAAW,CAAC,4BAA4B,CAAC,CAAA;YACrD,CAAC;YAED,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YAE7C,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,YAAY,CAAC,aAAa,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAE5C,8DAA8D;YAC9D,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAA;YACpC,UAAU,CAAC,SAAS,GAAG,KAAK,CAAA;YAC5B,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,YAAY,CAAA;YAEjD,OAAO,EAAE,KAAK,EAAE,CAAA;QAClB,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"basic-ed25519.js","sourceRoot":"","sources":["../../../src/manager/plugins/basic-ed25519.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEhD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAG1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAA+C,OAAU,EAAc,EAAE;IAC7G,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,kBAAkB,CAAC,YAAY;QACrC,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEjD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAEhD,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B;;eAEG;YACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAgB,OAAO,CAAC;iBACvE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAE1B,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,WAAW,CAAC,4BAA4B,CAAC,CAAA;YACrD,CAAC;YAED,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YAEvD,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,YAAY,CAAC,aAAa,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAE5C,8DAA8D;YAC9D,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAA;YACpC,UAAU,CAAC,SAAS,GAAG,KAAK,CAAA;YAC5B,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,YAAY,CAAA;YAEjD,OAAO,EAAE,KAAK,EAAE,CAAA;QAClB,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/manager/plugins/basic-rely.d.ts

@@ -1,4 +1,4 @@
 import type { AppContext } from '../types.js';
 import type { AuthPlugin } from './types.js';
-export declare const basicRely: (context: AppContext, type?: string) => AuthPlugin;
+export declare const makeBasicRelyPlugin: (context: AppContext, type?: string) => AuthPlugin;
 //# sourceMappingURL=basic-rely.d.ts.map

package/build/manager/plugins/basic-rely.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"basic-rely.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/basic-rely.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAqC,MAAM,aAAa,CAAA;AAChF,OAAO,KAAK,EAAE,UAAU,EAAiC,MAAM,YAAY,CAAA;AAS3E,eAAO,MAAM,SAAS,GAAI,SAAS,UAAU,EAAE,OAAO,MAAM,KAAG,UA0J9D,CAAA"}
+{"version":3,"file":"basic-rely.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/basic-rely.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAqC,MAAM,aAAa,CAAA;AAChF,OAAO,KAAK,EAAE,UAAU,EAAiC,MAAM,YAAY,CAAA;AAa3E,eAAO,MAAM,mBAAmB,YAAa,UAAU,SAAS,MAAM,KAAG,UA2JxE,CAAA"}

package/build/manager/plugins/basic-rely.js

@@ -5,14 +5,16 @@ import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
 import { AUTH_CACHE } from '../../consts.js';
 import { ResourceError } from '@owlmeans/resource';
 import { RELY_CALL_TIMEOUT, RELY_PIN_PERFIX, RELY_TOKEN_PREFIX } from '@owlmeans/auth-common';
+import { logger } from '@owlmeans/log';
+const log = logger('server-auth:rely');
 const _subscriptions = {};
-export const basicRely = (context, type) => {
+export const makeBasicRelyPlugin = (context, type) => {
     const plugin = {
         type: type ?? AuthenticationType.RelyHandshake,
         // This method is used by consumer and by provider (wallet)
         // to initialize shared authentication process.
-        // The idea is that both subscribe to wait for a handshake value
-        // from the peer, that in fact is a subscription to a redis message tunnel.  
+        // The idea is that both watch the record holding their own pin/token and wake
+        // up when the peer writes its handshake value into it.
         init: async (request) => {
             const [, keyPair] = await trusted(context);
             const tunnel = context.resource(AUTH_CACHE);
@@ -32,8 +34,8 @@ export const basicRely = (context, type) => {
                     }
                     if (request.provideRely != null) {
                         await Promise.all([pin, token].filter(key => key != null).map(async (key) => {
-                            _subscriptions[key] = await tunnel.subscribe(async (value) => {
-                                if (value.challenge != null) {
+                            _subscriptions[key] = await tunnel.watch(key, async (value) => {
+                                if (value?.challenge != null) {
                                     const rely = makeEnvelopeModel(value.challenge, EnvelopeKind.Wrap);
                                     if (await rely.verify(keyPair)) {
                                         [pin, token].filter(key => key != null).forEach(key => {
@@ -45,7 +47,7 @@ export const basicRely = (context, type) => {
                                         await request.provideRely?.(rely.message(), relyMsg, true);
                                     }
                                 }
-                            }, { /*ttl: RELY_CALL_TIMEOUT,*/ key, once: true });
+                            }, { once: true });
                             // @TODO they need to be killed on close - but actually live a little bit longer 
                             // then timeout for them is ok
                             setTimeout(() => {
@@ -65,7 +67,7 @@ export const basicRely = (context, type) => {
                 }
                 catch (e) {
                     if (e instanceof ResourceError) {
-                        console.error('COLISION ON TRY TO CREATE RELY PIN\TOKEN...', e);
+                        log.warn('Rely pin/token collision; retrying', e);
                     }
                     else {
                         throw e;
@@ -109,7 +111,8 @@ export const basicRely = (context, type) => {
             }
             catch (e) {
                 if (e instanceof ResourceError) {
-                    console.error(e);
+                    // The peer's pin/token is unknown; the refusal itself is logged where sign-in is decided.
+                    log.debug('Rely peer lookup failed', e);
                     throw new AuthorizationError('rely');
                 }
                 else {

package/build/manager/plugins/basic-rely.js.map

@@ -1 +1 @@
-{"version":3,"file":"basic-rely.js","sourceRoot":"","sources":["../../../src/manager/plugins/basic-rely.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAI3H,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAE7F,MAAM,cAAc,GAAqC,EAAE,CAAA;AAC3D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAmB,EAAE,IAAa,EAAc,EAAE;IAC1E,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,IAAI,IAAI,kBAAkB,CAAC,aAAa;QAE9C,2DAA2D;QAC3D,+CAA+C;QAC/C,gEAAgE;QAChE,6EAA6E;QAC7E,IAAI,EAAE,KAAK,EAAE,OAA6B,EAA8B,EAAE;YACxE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAoB,UAAU,CAAC,CAAA;YAC9D,IAAI,OAAkB,CAAA;YACtB,GAAG,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAA;oBAE3E,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;oBACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;oBAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;oBAEnF,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAA;oBAE3E,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;wBAChB,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;oBAC3E,CAAC;oBACD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;wBAClB,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;oBAC7E,CAAC;oBAED,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;wBAChC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;4BACxE,cAAc,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;gCACzD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;oCAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAY,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;oCAC7E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;wCAC/B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;4CACpD,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;4CACvB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gDAChC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;4CAC5B,CAAC;wCACH,CAAC,CAAC,CAAA;wCACF,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;oCAC5D,CAAC;gCACH,CAAC;4BACH,CAAC,EAAE,EAAE,2BAA2B,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;4BAEnD,iFAAiF;4BACjF,8BAA8B;4BAC9B,UAAU,CAAC,GAAG,EAAE;gCACd,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;oCAChC,IAAI,CAAC;wCACH,KAAK,cAAc,CAAC,GAAG,CAAC,EAAE,CAAA;wCAC1B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;oCAC5B,CAAC;4CAAS,CAAC;wCACT,KAAK,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;oCAC5B,CAAC;gCACH,CAAC;4BACH,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAA;wBAC9B,CAAC,CAAC,CAAC,CAAA;oBACL,CAAC;oBAED,OAAO,QAAQ,CAAA;gBACjB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;wBAC/B,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAA;oBACjE,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,CAAA;oBACT,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;YACxD,CAAC,QAAQ,IAAI,EAAC;QAChB,CAAC;QAED,iGAAiG;QACjG,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAoB,UAAU,CAAC,CAAA;YAE9D,6DAA6D;YAC7D,yCAAyC;YACzC,sCAAsC;YAEtC,IAAI,IAAe,CAAA;YACnB,IAAI,CAAC;gBACH,IAAI,IAAgB,CAAA;gBACpB,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACtD,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;oBACnE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;wBACpB,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAA;oBACrC,CAAC;oBACD,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;gBAChD,CAAC;qBAAM,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;oBACrE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;wBACpB,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;oBACvC,CAAC;oBACD,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;gBAChD,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAA;gBAC5C,CAAC;gBACD,MAAM,OAAO,GAAG,iBAAiB,CAAY,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;gBAC/E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,gBAAgB,EAAE,CAAA;gBAC9B,CAAC;gBACD,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;YAC1B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;oBAC/B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;oBAChB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;gBACtC,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,CAAA;gBACT,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,iBAAiB,CAAY,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YACzF,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAEjF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;YAErC;gBACE,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC7D,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;aACpE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;gBACzC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;oBAChC,KAAK,cAAc,CAAC,GAAG,CAAC,EAAE,CAAA;oBAC1B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,MAAM,KAAK,GAAG,iBAAiB,CAAc,kBAAkB,CAAC,aAAa,CAAC,CAAA;YAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YAEpC,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,aAAa,CAAA;YAElD,6FAA6F;YAC7F,gGAAgG;YAChG,iFAAiF;YACjF,8FAA8F;YAC9F,4GAA4G;YAC5G,iEAAiE;YACjE,MAAM,KAAK,GAAS,UAA6B,CAAA;YACjD,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;YAC5B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAA;YAC9B,KAAK,CAAC,MAAM,GAAG,IAAI,CAAA;YAEnB,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QAC/B,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"basic-rely.js","sourceRoot":"","sources":["../../../src/manager/plugins/basic-rely.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAI3H,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC7F,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAEtC,MAAM,cAAc,GAAgC,EAAE,CAAA;AACtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAmB,EAAE,IAAa,EAAc,EAAE;IACpF,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,IAAI,IAAI,kBAAkB,CAAC,aAAa;QAE9C,2DAA2D;QAC3D,+CAA+C;QAC/C,8EAA8E;QAC9E,uDAAuD;QACvD,IAAI,EAAE,KAAK,EAAE,OAA6B,EAA8B,EAAE;YACxE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAoB,UAAU,CAAC,CAAA;YAC9D,IAAI,OAAkB,CAAA;YACtB,GAAG,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAA;oBAE3E,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;oBACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;oBAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;oBAEnF,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAA;oBAE3E,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;wBAChB,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;oBAC3E,CAAC;oBACD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;wBAClB,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;oBAC7E,CAAC;oBAED,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;wBAChC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;4BACxE,cAAc,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;gCAC1D,IAAI,KAAK,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;oCAC7B,MAAM,IAAI,GAAG,iBAAiB,CAAY,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;oCAC7E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;wCAC/B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;4CACpD,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;4CACvB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gDAChC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;4CAC5B,CAAC;wCACH,CAAC,CAAC,CAAA;wCACF,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;oCAC5D,CAAC;gCACH,CAAC;4BACH,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;4BAElB,iFAAiF;4BACjF,8BAA8B;4BAC9B,UAAU,CAAC,GAAG,EAAE;gCACd,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;oCAChC,IAAI,CAAC;wCACH,KAAK,cAAc,CAAC,GAAG,CAAC,EAAE,CAAA;wCAC1B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;oCAC5B,CAAC;4CAAS,CAAC;wCACT,KAAK,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;oCAC5B,CAAC;gCACH,CAAC;4BACH,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAA;wBAC9B,CAAC,CAAC,CAAC,CAAA;oBACL,CAAC;oBAED,OAAO,QAAQ,CAAA;gBACjB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;wBAC/B,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAA;oBACnD,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,CAAA;oBACT,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;YACxD,CAAC,QAAQ,IAAI,EAAC;QAChB,CAAC;QAED,iGAAiG;QACjG,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAoB,UAAU,CAAC,CAAA;YAE9D,6DAA6D;YAC7D,yCAAyC;YACzC,sCAAsC;YAEtC,IAAI,IAAe,CAAA;YACnB,IAAI,CAAC;gBACH,IAAI,IAAgB,CAAA;gBACpB,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACtD,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;oBACnE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;wBACpB,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAA;oBACrC,CAAC;oBACD,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;gBAChD,CAAC;qBAAM,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;oBACrE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;wBACpB,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;oBACvC,CAAC;oBACD,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;gBAChD,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAA;gBAC5C,CAAC;gBACD,MAAM,OAAO,GAAG,iBAAiB,CAAY,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;gBAC/E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,gBAAgB,EAAE,CAAA;gBAC9B,CAAC;gBACD,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;YAC1B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;oBAC/B,0FAA0F;oBAC1F,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAA;oBACvC,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;gBACtC,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,CAAA;gBACT,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,iBAAiB,CAAY,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YACzF,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAEjF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;YAErC;gBACE,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC7D,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;aACpE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;gBACzC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;oBAChC,KAAK,cAAc,CAAC,GAAG,CAAC,EAAE,CAAA;oBAC1B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,MAAM,KAAK,GAAG,iBAAiB,CAAc,kBAAkB,CAAC,aAAa,CAAC,CAAA;YAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YAEpC,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,aAAa,CAAA;YAElD,6FAA6F;YAC7F,gGAAgG;YAChG,iFAAiF;YACjF,8FAA8F;YAC9F,4GAA4G;YAC5G,iEAAiE;YACjE,MAAM,KAAK,GAAS,UAA6B,CAAA;YACjD,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;YAC5B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAA;YAC9B,KAAK,CAAC,MAAM,GAAG,IAAI,CAAA;YAEnB,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QAC/B,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/manager/plugins/consts.d.ts

@@ -0,0 +1,8 @@
+/** Ownership of atomic replay protection for a verified authentication challenge. */
+export declare enum AuthChallengeReplayPolicy {
+    /** Default: the auth manager consumes the challenge before plugin authentication. */
+    Manager = "manager",
+    /** The plugin owns bounded attempts and atomic success consumption. */
+    Plugin = "plugin"
+}
+//# sourceMappingURL=consts.d.ts.map

package/build/manager/plugins/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/consts.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,oBAAY,yBAAyB;IACnC,qFAAqF;IACrF,OAAO,YAAY;IACnB,uEAAuE;IACvE,MAAM,WAAW;CAClB"}

package/build/manager/plugins/consts.js

@@ -0,0 +1,9 @@
+/** Ownership of atomic replay protection for a verified authentication challenge. */
+export var AuthChallengeReplayPolicy;
+(function (AuthChallengeReplayPolicy) {
+    /** Default: the auth manager consumes the challenge before plugin authentication. */
+    AuthChallengeReplayPolicy["Manager"] = "manager";
+    /** The plugin owns bounded attempts and atomic success consumption. */
+    AuthChallengeReplayPolicy["Plugin"] = "plugin";
+})(AuthChallengeReplayPolicy || (AuthChallengeReplayPolicy = {}));
+//# sourceMappingURL=consts.js.map

package/build/manager/plugins/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../../src/manager/plugins/consts.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,MAAM,CAAN,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,qFAAqF;IACrF,gDAAmB,CAAA;IACnB,uEAAuE;IACvE,8CAAiB,CAAA;AACnB,CAAC,EALW,yBAAyB,KAAzB,yBAAyB,QAKpC"}

package/build/manager/plugins/export.d.ts

@@ -1,4 +1,9 @@
 export type * from './types.js';
+export type * from './re-captcha/types.js';
+export * from './consts.js';
+export * from './re-captcha/consts.js';
+export * from './re-captcha/policy.js';
+export * from './re-captcha/verifier.js';
 export * from './basic-ed25519.js';
 export * from './re-captcha.js';
 export * from './basic-rely.js';

package/build/manager/plugins/export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,mBAAmB,uBAAuB,CAAA;AAC1C,cAAc,aAAa,CAAA;AAC3B,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}

package/build/manager/plugins/export.js

@@ -1,3 +1,7 @@
+export * from './consts.js';
+export * from './re-captcha/consts.js';
+export * from './re-captcha/policy.js';
+export * from './re-captcha/verifier.js';
 export * from './basic-ed25519.js';
 export * from './re-captcha.js';
 export * from './basic-rely.js';

package/build/manager/plugins/export.js.map

@@ -1 +1 @@
-{"version":3,"file":"export.js","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AAEA,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AAGA,cAAc,aAAa,CAAA;AAC3B,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}

package/build/manager/plugins/index.d.ts

@@ -1,6 +1,5 @@
-import type { AuthPlugin } from './types.js';
-import type { AppContext, AppConfig } from '../types.js';
-export declare const plugins: Record<string, <C extends AppConfig, T extends AppContext<C>>(context: T) => AuthPlugin>;
+import type { AuthPluginFactory } from './types.js';
+export declare const plugins: Record<string, AuthPluginFactory>;
 /** Register an external AuthPlugin factory under a custom type string. */
-export declare const registerPlugin: (type: string, factory: <C extends AppConfig, T extends AppContext<C>>(context: T) => AuthPlugin) => void;
+export declare const registerPlugin: (type: string, factory: AuthPluginFactory) => void;
 //# sourceMappingURL=index.d.ts.map

package/build/manager/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAIxD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,UAAU,CAAM,CAAA;AAMnH,0EAA0E;AAC1E,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,SAAS,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,UAAU,KAChF,IAEF,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAKnD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAM,CAAA;AAM5D,0EAA0E;AAC1E,eAAO,MAAM,cAAc,SACnB,MAAM,WACH,iBAAiB,KACzB,IAEF,CAAA"}

package/build/manager/plugins/index.js

@@ -1,11 +1,11 @@
 import { AuthenticationType } from '@owlmeans/auth';
-import { basicEd25519 } from './basic-ed25519.js';
-import { reCaptcha } from './re-captcha.js';
-import { basicRely } from './basic-rely.js';
+import { makeBasicEd25519Plugin } from './basic-ed25519.js';
+import { makeReCaptchaPlugin } from './re-captcha.js';
+import { makeBasicRelyPlugin } from './basic-rely.js';
 export const plugins = {};
-plugins[AuthenticationType.BasicEd25519] = basicEd25519;
-plugins[AuthenticationType.ReCaptcha] = reCaptcha;
-plugins[AuthenticationType.RelyHandshake] = basicRely;
+plugins[AuthenticationType.BasicEd25519] = makeBasicEd25519Plugin;
+plugins[AuthenticationType.ReCaptcha] = makeReCaptchaPlugin;
+plugins[AuthenticationType.RelyHandshake] = makeBasicRelyPlugin;
 /** Register an external AuthPlugin factory under a custom type string. */
 export const registerPlugin = (type, factory) => {
     plugins[type] = factory;

package/build/manager/plugins/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/manager/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,MAAM,CAAC,MAAM,OAAO,GAA6F,EAAE,CAAA;AAEnH,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,GAAG,YAAoD,CAAA;AAC/F,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAG,SAAiD,CAAA;AACzF,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,GAAG,SAAiD,CAAA;AAE7F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,IAAY,EACZ,OAAiF,EAC3E,EAAE;IACR,OAAO,CAAC,IAAI,CAAC,GAAG,OAA+C,CAAA;AACjE,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/manager/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,MAAM,CAAC,MAAM,OAAO,GAAsC,EAAE,CAAA;AAE5D,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,GAAG,sBAA2C,CAAA;AACtF,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAG,mBAAwC,CAAA;AAChF,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,GAAG,mBAAwC,CAAA;AAEpF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,IAAY,EACZ,OAA0B,EACpB,EAAE;IACR,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAA;AACzB,CAAC,CAAA"}

package/build/manager/plugins/re-captcha/consts.d.ts

@@ -0,0 +1,7 @@
+/** The service alias the reCAPTCHA plugin resolves its verifier by. */
+export declare const RECAPTCHA_VERIFIER = "re-captcha-verifier";
+/** Google's siteverify endpoint — always https. */
+export declare const RECAPTCHA_SITEVERIFY_URL = "https://www.google.com/recaptcha/api/siteverify";
+/** How long the default verifier waits for Google, in ms. */
+export declare const RECAPTCHA_VERIFY_TIMEOUT = 10000;
+//# sourceMappingURL=consts.d.ts.map

package/build/manager/plugins/re-captcha/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/consts.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,wBAAwB,CAAA;AAEvD,mDAAmD;AACnD,eAAO,MAAM,wBAAwB,oDAAoD,CAAA;AAEzF,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,QAAS,CAAA"}

package/build/manager/plugins/re-captcha/consts.js

@@ -0,0 +1,7 @@
+/** The service alias the reCAPTCHA plugin resolves its verifier by. */
+export const RECAPTCHA_VERIFIER = 're-captcha-verifier';
+/** Google's siteverify endpoint — always https. */
+export const RECAPTCHA_SITEVERIFY_URL = 'https://www.google.com/recaptcha/api/siteverify';
+/** How long the default verifier waits for Google, in ms. */
+export const RECAPTCHA_VERIFY_TIMEOUT = 10_000;
+//# sourceMappingURL=consts.js.map

package/build/manager/plugins/re-captcha/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/consts.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAA;AAEvD,mDAAmD;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAG,iDAAiD,CAAA;AAEzF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAA"}

package/build/manager/plugins/re-captcha/consts.local.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The only credential fields a reCAPTCHA guest token keeps. Everything else the caller posted —
+ * a profile, an organization (`entitySlug` or `entityId`), permissions, groups, an expiry, a
+ * `source` — is dropped: the token proves a solved challenge, never an identity.
+ */
+export declare const RECAPTCHA_CREDENTIAL_FIELDS: readonly string[];
+//# sourceMappingURL=consts.local.d.ts.map

package/build/manager/plugins/re-captcha/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/consts.local.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAEvD,CAAA"}

package/build/manager/plugins/re-captcha/consts.local.js

@@ -0,0 +1,9 @@
+/**
+ * The only credential fields a reCAPTCHA guest token keeps. Everything else the caller posted —
+ * a profile, an organization (`entitySlug` or `entityId`), permissions, groups, an expiry, a
+ * `source` — is dropped: the token proves a solved challenge, never an identity.
+ */
+export const RECAPTCHA_CREDENTIAL_FIELDS = Object.freeze([
+    'type', 'role', 'userId', 'scopes', 'challenge', 'credential',
+]);
+//# sourceMappingURL=consts.local.js.map

package/build/manager/plugins/re-captcha/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/consts.local.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY;CAC9D,CAAC,CAAA"}

package/build/manager/plugins/re-captcha/policy.d.ts

@@ -0,0 +1,3 @@
+import type { ReCaptchaPluginConfig, ReCaptchaPolicyModel } from './types.js';
+export declare const makeReCaptchaPolicyModel: (record: ReCaptchaPluginConfig) => ReCaptchaPolicyModel;
+//# sourceMappingURL=policy.d.ts.map

package/build/manager/plugins/re-captcha/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAqB,MAAM,YAAY,CAAA;AAShG,eAAO,MAAM,wBAAwB,WAAY,qBAAqB,KAAG,oBA4CxE,CAAA"}

package/build/manager/plugins/re-captcha/policy.js

@@ -0,0 +1,44 @@
+import { AuthenFailed } from '@owlmeans/auth';
+import { PluginMissconfigured } from '@owlmeans/config';
+/** A comma- or space-separated config string as its entries; `''` and absent are no entries. */
+const listOf = (value) => typeof value === 'string' ? value.split(/[\s,]+/).map(entry => entry.trim()).filter(entry => entry !== '') : [];
+/** A host as it is compared: lowercased, without a trailing dot or a leading `*.`/`.`. */
+const hostOf = (value) => value.trim().toLowerCase().replace(/\.$/, '').replace(/^\*?\./, '');
+export const makeReCaptchaPolicyModel = (record) => {
+    const hostnames = () => listOf(record.hostnames).map(hostOf).filter(host => host !== '');
+    const minScore = () => {
+        const value = record.minScore;
+        if (value == null || (typeof value === 'string' && value.trim() === '')) {
+            return null;
+        }
+        const score = typeof value === 'number' ? value : Number(value);
+        if (!Number.isFinite(score) || score < 0 || score > 1) {
+            throw new PluginMissconfigured('minScore');
+        }
+        return score;
+    };
+    const actions = () => listOf(record.actions);
+    const assert = (response) => {
+        if (response.success !== true) {
+            const codes = Array.isArray(response['error-codes']) ? response['error-codes'] : [];
+            throw new AuthenFailed('recaptcha:' + (codes.length > 0 ? codes.join(',') : 'unknown'));
+        }
+        const allowed = hostnames();
+        if (allowed.length > 0) {
+            const host = typeof response.hostname === 'string' ? hostOf(response.hostname) : '';
+            if (host === '' || !allowed.some(entry => host === entry || host.endsWith(`.${entry}`))) {
+                throw new AuthenFailed('recaptcha:hostname');
+            }
+        }
+        const floor = minScore();
+        if (floor != null && typeof response.score === 'number' && response.score < floor) {
+            throw new AuthenFailed('recaptcha:score');
+        }
+        const named = actions();
+        if (named.length > 0 && (typeof response.action !== 'string' || !named.includes(response.action))) {
+            throw new AuthenFailed('recaptcha:action');
+        }
+    };
+    return { record, hostnames, minScore, actions, assert };
+};
+//# sourceMappingURL=policy.js.map

package/build/manager/plugins/re-captcha/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAGvD,gGAAgG;AAChG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAY,EAAE,CAC1C,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAEjH,0FAA0F;AAC1F,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;AAE7G,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,MAA6B,EAAwB,EAAE;IAC9F,MAAM,SAAS,GAAG,GAAa,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAA;IAElG,MAAM,QAAQ,GAAG,GAAkB,EAAE;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAA;QAC7B,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAA;QAC5C,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,GAAa,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAEtD,MAAM,MAAM,GAAG,CAAC,QAA2B,EAAQ,EAAE;QACnD,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACnF,MAAM,IAAI,YAAY,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;QAC3B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACnF,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,YAAY,CAAC,oBAAoB,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAA;QACxB,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC;YAClF,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAA;QAC3C,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,EAAE,CAAA;QACvB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,YAAY,CAAC,kBAAkB,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC,CAAA;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AACzD,CAAC,CAAA"}

package/build/manager/plugins/re-captcha/types.d.ts

@@ -0,0 +1,79 @@
+import type { PluginConfig } from '@owlmeans/config';
+import type { InitializedService } from '@owlmeans/context';
+/** Google's siteverify answer, for a checkbox (v2) or a score-based (v3) token. */
+export interface ReCaptchaResponse {
+    success: boolean;
+    /** When the challenge was solved, as an ISO date-time string. */
+    challenge_ts: string;
+    /** The host of the page the token was solved on. */
+    hostname: string;
+    /** Score-based keys only: 0.0 (a bot) … 1.0 (a person). */
+    score?: number;
+    /** Score-based keys only: the action the page named when it asked for the token. */
+    action?: string;
+    'error-codes'?: string[];
+}
+/** The siteverify form: the key's secret, the token the browser got, optionally the browser's IP. */
+export interface ReCaptchaRequest {
+    secret: string;
+    response: string;
+    remoteip?: string;
+}
+/**
+ * Asks Google whether a reCAPTCHA token is good. The plugin resolves it by `RECAPTCHA_VERIFIER`, so a
+ * test (or a proxy) registers its own under that alias; without one, the default siteverify call runs.
+ */
+export interface ReCaptchaVerifierService extends InitializedService {
+    /**
+     * Google's answer for one token. A refusal is an answer (`success: false`), not an error.
+     *
+     * @throws {AuthUnavailable} when Google cannot be asked or answers something unreadable.
+     */
+    verify: (request: ReCaptchaRequest) => Promise<ReCaptchaResponse>;
+}
+/** The one call the default verifier makes — `fetch`, or a stand-in a test injects. */
+export interface ReCaptchaFetch {
+    (url: string, init: RequestInit): Promise<Response>;
+}
+export interface ReCaptchaVerifierOptions {
+    /** The siteverify address; must be https. Default `RECAPTCHA_SITEVERIFY_URL`. */
+    url?: string;
+    /** Default: the global `fetch`. */
+    fetch?: ReCaptchaFetch;
+    /** Milliseconds before the call is abandoned. Default `RECAPTCHA_VERIFY_TIMEOUT`. */
+    timeout?: number;
+}
+/**
+ * The `MOD_RECAPTCHA` plugin record of the server config: the secret in `value` plus the policy.
+ * Every policy field is a string as a mounted config file delivers it; `''` or absent = no check.
+ */
+export interface ReCaptchaPluginConfig extends PluginConfig {
+    /** Hosts a token may be solved on, comma- or space-separated; a subdomain of an entry passes. */
+    hostnames?: string;
+    /** The lowest score a score-based token may carry (0…1); a checkbox token has none and passes. */
+    minScore?: string | number;
+    /** The actions a token may be issued for, comma- or space-separated; a token naming none fails. */
+    actions?: string;
+}
+/** The policy one `MOD_RECAPTCHA` record states, applied to Google's answer. */
+export interface ReCaptchaPolicyModel {
+    readonly record: ReCaptchaPluginConfig;
+    /** The allowed hosts, lowercased; empty = any host. */
+    hostnames: () => string[];
+    /**
+     * The lowest accepted score, or `null` for no score check.
+     *
+     * @throws {PluginMissconfigured} when the record's value is not a number between 0 and 1.
+     */
+    minScore: () => number | null;
+    /** The allowed actions; empty = any action. */
+    actions: () => string[];
+    /**
+     * Accept Google's answer or refuse it, in this order: success, hostname, score, action.
+     *
+     * @throws {AuthenFailed} `recaptcha:<error-codes>`, `recaptcha:hostname`, `recaptcha:score`,
+     *   `recaptcha:action`.
+     */
+    assert: (response: ReCaptchaResponse) => void;
+}
+//# sourceMappingURL=types.d.ts.map