@zlooks.cn/password-auth-server 1.0.0

package/dist/command/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/command/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/command/index.ts"],"names":[],"mappings":""}

package/dist/command/index.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import { fileURLToPath } from 'node:url';
+import { createRegistryDatabaseDataSource, registerDatabaseCommands, } from '@zlooks.cn/database-command';
+import { runServiceCommand } from '@zlooks.cn/service-command';
+import { passwordAuthMigrations } from '../migrations/index.js';
+import { passwordAuthEntities } from '../persistence/entities.js';
+await runServiceCommand({
+    packageRoot: fileURLToPath(new URL('../../', import.meta.url)),
+    requiresReactServer: true,
+    configure(program) {
+        registerDatabaseCommands(program, {
+            createDataSource: (envFile) => createRegistryDatabaseDataSource(envFile, {
+                commandNamespace: 'cn.zlooks.password.auth.db.command',
+                entities: [...passwordAuthEntities],
+            }),
+            migrations: passwordAuthMigrations,
+        });
+    },
+}).catch(reportStartupFailure);
+function reportStartupFailure(error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+}
+//# sourceMappingURL=index.js.map

package/dist/command/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/command/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,MAAM,iBAAiB,CAAC;IACtB,WAAW,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9D,mBAAmB,EAAE,IAAI;IACzB,SAAS,CAAC,OAAO;QACf,wBAAwB,CAAC,OAAO,EAAE;YAChC,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC5B,gCAAgC,CAAC,OAAO,EAAE;gBACxC,gBAAgB,EAAE,oCAAoC;gBACtD,QAAQ,EAAE,CAAC,GAAG,oBAAoB,CAAC;aACpC,CAAC;YACJ,UAAU,EAAE,sBAAsB;SACnC,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAE/B,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/config/schema.d.ts

@@ -0,0 +1,72 @@
+import { z } from 'zod';
+declare const schema: z.ZodObject<{
+    infrastructure: z.ZodObject<{
+        postgres: z.ZodObject<{
+            host: z.ZodString;
+            port: z.ZodNumber;
+            username: z.ZodString;
+            password: z.ZodString;
+            database: z.ZodString;
+            ssl: z.ZodBoolean;
+            poolSize: z.ZodNumber;
+        }, z.core.$strict>;
+        redis: z.ZodObject<{
+            host: z.ZodString;
+            port: z.ZodNumber;
+            username: z.ZodOptional<z.ZodString>;
+            password: z.ZodOptional<z.ZodString>;
+            database: z.ZodNumber;
+            keyPrefix: z.ZodString;
+            tls: z.ZodBoolean;
+        }, z.core.$strict>;
+        email: z.ZodObject<{
+            smtp: z.ZodObject<{
+                host: z.ZodString;
+                port: z.ZodNumber;
+                secure: z.ZodBoolean;
+                username: z.ZodString;
+                password: z.ZodString;
+            }, z.core.$strict>;
+            from: z.ZodObject<{
+                name: z.ZodString;
+                address: z.ZodEmail;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    discovery: z.ZodObject<{
+        instanceId: z.ZodLiteral<"password-auth">;
+        generation: z.ZodLiteral<2>;
+        leaseMs: z.ZodLiteral<10000>;
+    }, z.core.$strict>;
+    rsc: z.ZodObject<{
+        generation: z.ZodLiteral<2>;
+        priority: z.ZodLiteral<100>;
+    }, z.core.$strict>;
+    password: z.ZodObject<{
+        minLength: z.ZodLiteral<12>;
+        maxLength: z.ZodLiteral<128>;
+        memoryCostKiB: z.ZodLiteral<65536>;
+        timeCost: z.ZodLiteral<3>;
+        parallelism: z.ZodLiteral<1>;
+        maxFailedAttempts: z.ZodLiteral<5>;
+        lockoutMs: z.ZodLiteral<900000>;
+    }, z.core.$strict>;
+    verification: z.ZodObject<{
+        hmacKey: z.ZodString;
+        codeTtlMs: z.ZodLiteral<600000>;
+        resendIntervalMs: z.ZodLiteral<60000>;
+        maxSendsPerTransaction: z.ZodLiteral<3>;
+        maxSendsPerEmailPerHour: z.ZodLiteral<5>;
+        maxVerificationAttempts: z.ZodLiteral<5>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export interface PasswordAuthConfigSources {
+    readonly postgres: unknown;
+    readonly redis: unknown;
+    readonly email: unknown;
+    readonly passwordAuth: unknown;
+}
+export type PasswordAuthConfig = Readonly<z.infer<typeof schema>>;
+export declare function parsePasswordAuthConfig(input: PasswordAuthConfigSources): PasswordAuthConfig;
+export {};
+//# sourceMappingURL=schema.d.ts.map

package/dist/config/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAaV,CAAC;AAUH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AACD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC;AAClE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,CAmB5F"}

package/dist/config/schema.js

@@ -0,0 +1,48 @@
+import { emailConfigSchema, postgresConfigSchema, redisConfigSchema } from '@zlooks.cn/infrastructure';
+import { deepFreeze, joinKeyPrefix } from '@zlooks.cn/utils';
+import { z } from 'zod';
+const schema = z.strictObject({
+    infrastructure: z.strictObject({ postgres: postgresConfigSchema, redis: redisConfigSchema, email: emailConfigSchema }),
+    discovery: z.strictObject({ instanceId: z.literal('password-auth'), generation: z.literal(2), leaseMs: z.literal(10_000) }),
+    rsc: z.strictObject({ generation: z.literal(2), priority: z.literal(100) }),
+    password: z.strictObject({ minLength: z.literal(12), maxLength: z.literal(128), memoryCostKiB: z.literal(65_536), timeCost: z.literal(3), parallelism: z.literal(1), maxFailedAttempts: z.literal(5), lockoutMs: z.literal(900_000) }),
+    verification: z.strictObject({
+        hmacKey: z.string(),
+        codeTtlMs: z.literal(600_000),
+        resendIntervalMs: z.literal(60_000),
+        maxSendsPerTransaction: z.literal(3),
+        maxSendsPerEmailPerHour: z.literal(5),
+        maxVerificationAttempts: z.literal(5),
+    }),
+});
+const passwordAuthSourceSchema = z.strictObject({
+    verificationCodeHmacKey: z.string().regex(/^[A-Za-z0-9+/]{43}=$/).refine((value) => {
+        try {
+            return Buffer.from(value, 'base64').byteLength === 32;
+        }
+        catch {
+            return false;
+        }
+    }, 'Verification code HMAC key must be a base64-encoded 32-byte key'),
+});
+export function parsePasswordAuthConfig(input) {
+    const postgres = postgresConfigSchema.parse(input.postgres);
+    const redis = redisConfigSchema.parse(input.redis);
+    const email = emailConfigSchema.parse(input.email);
+    const passwordAuth = passwordAuthSourceSchema.parse(input.passwordAuth);
+    return deepFreeze(schema.parse({
+        infrastructure: { postgres, redis: { ...redis, keyPrefix: joinKeyPrefix(redis.keyPrefix, 'password-auth') }, email },
+        discovery: { instanceId: 'password-auth', generation: 2, leaseMs: 10_000 },
+        rsc: { generation: 2, priority: 100 },
+        password: { minLength: 12, maxLength: 128, memoryCostKiB: 65_536, timeCost: 3, parallelism: 1, maxFailedAttempts: 5, lockoutMs: 900_000 },
+        verification: {
+            hmacKey: passwordAuth.verificationCodeHmacKey,
+            codeTtlMs: 600_000,
+            resendIntervalMs: 60_000,
+            maxSendsPerTransaction: 3,
+            maxSendsPerEmailPerHour: 5,
+            maxVerificationAttempts: 5,
+        },
+    }));
+}
+//# sourceMappingURL=schema.js.map

package/dist/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACvG,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5B,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtH,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3H,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3E,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IACtO,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC7B,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACpC,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACtC,CAAC;CACH,CAAC,CAAC;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9C,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACjF,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,EAAE,iEAAiE,CAAC;CACtE,CAAC,CAAC;AAQH,MAAM,UAAU,uBAAuB,CAAC,KAAgC;IACtE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxE,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;QAC7B,cAAc,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE;QACpH,SAAS,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE;QAC1E,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE;QACrC,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE;QACzI,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY,CAAC,uBAAuB;YAC7C,SAAS,EAAE,OAAO;YAClB,gBAAgB,EAAE,MAAM;YACxB,sBAAsB,EAAE,CAAC;YACzB,uBAAuB,EAAE,CAAC;YAC1B,uBAAuB,EAAE,CAAC;SAC3B;KACF,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/email/nodemailer-verification-email-sender.d.ts

@@ -0,0 +1,11 @@
+import type { Transporter } from 'nodemailer';
+import type { EmailConfig } from '@zlooks.cn/infrastructure';
+import type { VerificationEmailSender } from './verification-email-sender.js';
+export declare class NodemailerVerificationEmailSender implements VerificationEmailSender {
+    #private;
+    private readonly config;
+    constructor(config: EmailConfig, transporter?: Transporter);
+    send(input: Parameters<VerificationEmailSender['send']>[0]): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=nodemailer-verification-email-sender.d.ts.map

package/dist/email/nodemailer-verification-email-sender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodemailer-verification-email-sender.d.ts","sourceRoot":"","sources":["../../src/email/nodemailer-verification-email-sender.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E,qBAAa,iCAAkC,YAAW,uBAAuB;;IAK5D,OAAO,CAAC,QAAQ,CAAC,MAAM;IAA1C,YAAoC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,WAAW,EAWjF;IAEY,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBtF;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAIlC;CACF"}

package/dist/email/nodemailer-verification-email-sender.js

@@ -0,0 +1,54 @@
+import nodemailer from 'nodemailer';
+export class NodemailerVerificationEmailSender {
+    config;
+    #transporter;
+    #inFlight = new Set();
+    #closing = false;
+    constructor(config, transporter) {
+        this.config = config;
+        this.#transporter = transporter ?? nodemailer.createTransport({
+            host: config.smtp.host,
+            port: config.smtp.port,
+            secure: config.smtp.secure,
+            auth: { user: config.smtp.username, pass: config.smtp.password },
+            pool: true,
+            connectionTimeout: 10_000,
+            greetingTimeout: 10_000,
+            socketTimeout: 20_000,
+        });
+    }
+    async send(input) {
+        if (this.#closing)
+            throw new Error('Email delivery is shutting down');
+        const purpose = input.intent === 'registration'
+            ? '注册账号'
+            : input.intent === 'recovery'
+                ? '找回密码'
+                : '登录账号';
+        const operation = Promise.resolve().then(() => this.#transporter.sendMail({
+            from: { name: this.config.from.name, address: this.config.from.address },
+            to: input.email,
+            subject: `ZLOOKS ${purpose}验证码`,
+            text: `你的验证码是 ${input.code}，${input.expiresInMinutes} 分钟内有效。请勿将验证码告诉他人。`,
+            html: `<p>你的验证码是：</p><p style="font-size:28px;font-weight:700;letter-spacing:6px">${input.code}</p><p>${input.expiresInMinutes} 分钟内有效。请勿将验证码告诉他人。</p>`,
+        }));
+        this.#inFlight.add(operation);
+        let result;
+        try {
+            result = await operation;
+        }
+        finally {
+            this.#inFlight.delete(operation);
+        }
+        if (!Array.isArray(result.accepted)
+            || !result.accepted.some((address) => String(address).toLocaleLowerCase('en-US') === input.email)) {
+            throw new Error('SMTP server did not accept the verification email recipient');
+        }
+    }
+    async close() {
+        this.#closing = true;
+        await Promise.allSettled(this.#inFlight);
+        this.#transporter.close();
+    }
+}
+//# sourceMappingURL=nodemailer-verification-email-sender.js.map

package/dist/email/nodemailer-verification-email-sender.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodemailer-verification-email-sender.js","sourceRoot":"","sources":["../../src/email/nodemailer-verification-email-sender.ts"],"names":[],"mappings":"AACA,OAAO,UAAU,MAAM,YAAY,CAAC;AAIpC,MAAM,OAAO,iCAAiC;IAKR,MAAM;IAJjC,YAAY,CAAc;IAC1B,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IACjD,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAoC,MAAmB,EAAE,WAAyB;sBAA9C,MAAM;QACxC,IAAI,CAAC,YAAY,GAAG,WAAW,IAAI,UAAU,CAAC,eAAe,CAAC;YAC5D,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE;YAChE,IAAI,EAAE,IAAI;YACV,iBAAiB,EAAE,MAAM;YACzB,eAAe,EAAE,MAAM;YACvB,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,KAAqD;QACrE,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,cAAc;YAC7C,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU;gBAC3B,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,MAAM,CAAC;QACb,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;YACxE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;YACxE,EAAE,EAAE,KAAK,CAAC,KAAK;YACf,OAAO,EAAE,UAAU,OAAO,KAAK;YAC/B,IAAI,EAAE,UAAU,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,gBAAgB,oBAAoB;YACxE,IAAI,EAAE,8EAA8E,KAAK,CAAC,IAAI,UAAU,KAAK,CAAC,gBAAgB,wBAAwB;SACvJ,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,MAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;eAC9B,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF"}

package/dist/email/verification-code-rate-limiter.d.ts

@@ -0,0 +1,14 @@
+import type { AuthenticationIntent } from '@zlooks.cn/auth-extension-contract';
+import type { Redis } from 'ioredis';
+export interface VerificationCodeRateLimiter {
+    consume(email: string, intent: Extract<AuthenticationIntent, 'login' | 'registration' | 'recovery'>): Promise<boolean>;
+}
+export declare class RedisVerificationCodeRateLimiter implements VerificationCodeRateLimiter {
+    #private;
+    private readonly limit;
+    private readonly hmacKey;
+    constructor(redis: Redis, limit: number, hmacKey: string);
+    consume(email: string, intent: Extract<AuthenticationIntent, 'login' | 'registration' | 'recovery'>): Promise<boolean>;
+}
+export declare function verificationRateLimitIdentity(email: string, hmacKey: string): string;
+//# sourceMappingURL=verification-code-rate-limiter.d.ts.map

package/dist/email/verification-code-rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-code-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/email/verification-code-rate-limiter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAGrC,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,oBAAoB,EAAE,OAAO,GAAG,cAAc,GAAG,UAAU,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxH;AAED,qBAAa,gCAAiC,YAAW,2BAA2B;;IAKhF,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,YACE,KAAK,EAAE,KAAK,EACK,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAGjC;IAEY,OAAO,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,OAAO,CAAC,oBAAoB,EAAE,OAAO,GAAG,cAAc,GAAG,UAAU,CAAC,GAC3E,OAAO,CAAC,OAAO,CAAC,CAOlB;CACF;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAKpF"}

package/dist/email/verification-code-rate-limiter.js

@@ -0,0 +1,27 @@
+import { defineLimit, RedisRateLimiter } from '@hile/redis-rate-limit';
+import { createHmac } from 'node:crypto';
+export class RedisVerificationCodeRateLimiter {
+    limit;
+    hmacKey;
+    #limiter;
+    constructor(redis, limit, hmacKey) {
+        this.limit = limit;
+        this.hmacKey = hmacKey;
+        this.#limiter = new RedisRateLimiter(redis, { prefix: 'verification-rate-limit:' });
+    }
+    async consume(email, intent) {
+        const result = await this.#limiter.consume(defineLimit('email-code:{intent:string}:{email:string}', {
+            algorithm: 'sliding-window',
+            limit: this.limit,
+            window: 3_600_000,
+        }), { intent, email: verificationRateLimitIdentity(email, this.hmacKey) });
+        return result.allowed;
+    }
+}
+export function verificationRateLimitIdentity(email, hmacKey) {
+    return createHmac('sha256', Buffer.from(hmacKey, 'base64'))
+        .update('email-verification-rate-limit\0')
+        .update(email)
+        .digest('hex');
+}
+//# sourceMappingURL=verification-code-rate-limiter.js.map

package/dist/email/verification-code-rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-code-rate-limiter.js","sourceRoot":"","sources":["../../src/email/verification-code-rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAGvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,MAAM,OAAO,gCAAgC;IAKxB,KAAK;IACL,OAAO;IALjB,QAAQ,CAAmB;IAEpC,YACE,KAAY,EACK,KAAa,EACb,OAAe;qBADf,KAAK;uBACL,OAAO;QAExB,IAAI,CAAC,QAAQ,GAAG,IAAI,gBAAgB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACtF,CAAC;IAEM,KAAK,CAAC,OAAO,CAClB,KAAa,EACb,MAA4E;QAE5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,2CAA2C,EAAE;YAClG,SAAS,EAAE,gBAAgB;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,SAAS;SAClB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3E,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAa,EAAE,OAAe;IAC1E,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;SACxD,MAAM,CAAC,iCAAiC,CAAC;SACzC,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC"}

package/dist/email/verification-email-sender.d.ts

@@ -0,0 +1,10 @@
+import type { AuthenticationIntent } from '@zlooks.cn/auth-extension-contract';
+export interface VerificationEmailSender {
+    send(input: Readonly<{
+        email: string;
+        code: string;
+        intent: Extract<AuthenticationIntent, 'login' | 'registration' | 'recovery'>;
+        expiresInMinutes: number;
+    }>): Promise<void>;
+}
+//# sourceMappingURL=verification-email-sender.d.ts.map

package/dist/email/verification-email-sender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-email-sender.d.ts","sourceRoot":"","sources":["../../src/email/verification-email-sender.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,OAAO,CAAC,oBAAoB,EAAE,OAAO,GAAG,cAAc,GAAG,UAAU,CAAC,CAAC;QAC7E,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB"}

package/dist/email/verification-email-sender.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=verification-email-sender.js.map

package/dist/email/verification-email-sender.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-email-sender.js","sourceRoot":"","sources":["../../src/email/verification-email-sender.ts"],"names":[],"mappings":""}

package/dist/messages/auth-extension/begin.msg.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@hile/message-loader").MessageRegisterProps<any, import("@hile/micro").MicroMessageHandlerExtras>;
+export default _default;
+//# sourceMappingURL=begin.msg.d.ts.map

package/dist/messages/auth-extension/begin.msg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"begin.msg.d.ts","sourceRoot":"","sources":["../../../src/messages/auth-extension/begin.msg.ts"],"names":[],"mappings":""}

package/dist/messages/auth-extension/begin.msg.js

@@ -0,0 +1,8 @@
+import { loadService } from '@hile/core';
+import { defineMicroMessage } from '@hile/micro';
+import passwordRuntimeService from '../../services/password-runtime.service.js';
+export default defineMicroMessage(async ({ data }) => {
+    const runtime = await loadService(passwordRuntimeService);
+    return runtime.begin(data);
+});
+//# sourceMappingURL=begin.msg.js.map

package/dist/messages/auth-extension/begin.msg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"begin.msg.js","sourceRoot":"","sources":["../../../src/messages/auth-extension/begin.msg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,sBAAsB,MAAM,4CAA4C,CAAC;AAEhF,eAAe,kBAAkB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;IACnD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC,CAAC,CAAC"}

package/dist/messages/auth-extension/complete.msg.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@hile/message-loader").MessageRegisterProps<any, import("@hile/micro").MicroMessageHandlerExtras>;
+export default _default;
+//# sourceMappingURL=complete.msg.d.ts.map

package/dist/messages/auth-extension/complete.msg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete.msg.d.ts","sourceRoot":"","sources":["../../../src/messages/auth-extension/complete.msg.ts"],"names":[],"mappings":""}

package/dist/messages/auth-extension/complete.msg.js

@@ -0,0 +1,8 @@
+import { loadService } from '@hile/core';
+import { defineMicroMessage } from '@hile/micro';
+import passwordRuntimeService from '../../services/password-runtime.service.js';
+export default defineMicroMessage(async ({ data }) => {
+    const runtime = await loadService(passwordRuntimeService);
+    return runtime.complete(data);
+});
+//# sourceMappingURL=complete.msg.js.map

package/dist/messages/auth-extension/complete.msg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete.msg.js","sourceRoot":"","sources":["../../../src/messages/auth-extension/complete.msg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,sBAAsB,MAAM,4CAA4C,CAAC;AAEhF,eAAe,kBAAkB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;IACnD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC"}

package/dist/migrations/index.d.ts

@@ -0,0 +1,3 @@
+import type { DatabaseMigration } from '@zlooks.cn/database-command';
+export declare const passwordAuthMigrations: readonly DatabaseMigration[];
+//# sourceMappingURL=index.d.ts.map

package/dist/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE,eAAO,MAAM,sBAAsB,EAAE,SAAS,iBAAiB,EAAO,CAAC"}

package/dist/migrations/index.js

@@ -0,0 +1,2 @@
+export const passwordAuthMigrations = [];
+//# sourceMappingURL=index.js.map

package/dist/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,sBAAsB,GAAiC,EAAE,CAAC"}

package/dist/password/attempt-coordinator.d.ts

@@ -0,0 +1,12 @@
+import type { Redis } from 'ioredis';
+export interface PasswordAttemptCoordinator {
+    run<T>(identifier: string, operation: () => Promise<T>): Promise<T>;
+}
+export declare class RedisPasswordAttemptCoordinator implements PasswordAttemptCoordinator {
+    #private;
+    private readonly hmacKey;
+    constructor(redis: Redis, hmacKey: string);
+    run<T>(identifier: string, operation: () => Promise<T>): Promise<T>;
+}
+export declare function passwordAttemptIdentity(identifier: string, hmacKey: string): string;
+//# sourceMappingURL=attempt-coordinator.d.ts.map

package/dist/password/attempt-coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attempt-coordinator.d.ts","sourceRoot":"","sources":["../../src/password/attempt-coordinator.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACrE;AAED,qBAAa,+BAAgC,YAAW,0BAA0B;;IAG/C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAzD,YAAmB,KAAK,EAAE,KAAK,EAAmB,OAAO,EAAE,MAAM,EAEhE;IAEY,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAO/E;CACF;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAKnF"}

package/dist/password/attempt-coordinator.js

@@ -0,0 +1,25 @@
+import { createHmac } from 'node:crypto';
+import { RedisLock } from '@hile/redis-lock';
+export class RedisPasswordAttemptCoordinator {
+    hmacKey;
+    #locks;
+    constructor(redis, hmacKey) {
+        this.hmacKey = hmacKey;
+        this.#locks = new RedisLock(redis, { prefix: 'locks:', defaultTtl: 30_000 });
+    }
+    async run(identifier, operation) {
+        const key = passwordAttemptIdentity(identifier, this.hmacKey);
+        return this.#locks.withLock(`password-attempt:${key}`, {
+            wait: 5_000,
+            ttl: 30_000,
+            renew: true,
+        }, async () => operation());
+    }
+}
+export function passwordAttemptIdentity(identifier, hmacKey) {
+    return createHmac('sha256', Buffer.from(hmacKey, 'base64'))
+        .update('password-attempt-lock\0')
+        .update(identifier)
+        .digest('hex');
+}
+//# sourceMappingURL=attempt-coordinator.js.map

package/dist/password/attempt-coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attempt-coordinator.js","sourceRoot":"","sources":["../../src/password/attempt-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAO7C,MAAM,OAAO,+BAA+B;IAGQ,OAAO;IAFhD,MAAM,CAAY;IAE3B,YAAmB,KAAY,EAAmB,OAAe;uBAAf,OAAO;QACvD,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC;IAEM,KAAK,CAAC,GAAG,CAAI,UAAkB,EAAE,SAA2B;QACjE,MAAM,GAAG,GAAG,uBAAuB,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,GAAG,EAAE,EAAE;YACrD,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,MAAM;YACX,KAAK,EAAE,IAAI;SACZ,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CAAC,UAAkB,EAAE,OAAe;IACzE,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;SACxD,MAAM,CAAC,yBAAyB,CAAC;SACjC,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC"}

package/dist/password/credential-lifecycle-outbox.d.ts

@@ -0,0 +1,42 @@
+import { type ExecutionContext } from '@hile/context';
+import type { Redis } from 'ioredis';
+import { type DataSource } from 'typeorm';
+import { type PasswordCredentialLifecycleOutboxRow } from '../persistence/entities.js';
+export type PendingCredentialLifecycleEvent = Readonly<Pick<PasswordCredentialLifecycleOutboxRow, 'transactionId' | 'kind' | 'subject' | 'identifier' | 'occurredAt' | 'attempts'>>;
+export interface PasswordCredentialLifecycleOutboxStore {
+    readDue(now: Date, limit: number): Promise<readonly PendingCredentialLifecycleEvent[]>;
+    acknowledge(transactionId: string): Promise<void>;
+    recordFailure(transactionId: string, attempts: number, nextAttemptAt: Date): Promise<void>;
+}
+export interface CredentialLifecycleMicroCaller {
+    call(namespace: string, operation: string, data: unknown, options: Readonly<{
+        context: ExecutionContext;
+        timeout: number;
+        retries: number;
+        signal: AbortSignal;
+    }>): Promise<unknown>;
+}
+export declare class TypeOrmPasswordCredentialLifecycleOutboxStore implements PasswordCredentialLifecycleOutboxStore {
+    private readonly dataSource;
+    constructor(dataSource: DataSource);
+    readDue(now: Date, limit: number): Promise<readonly PendingCredentialLifecycleEvent[]>;
+    acknowledge(transactionId: string): Promise<void>;
+    recordFailure(transactionId: string, attempts: number, nextAttemptAt: Date): Promise<void>;
+}
+export declare class PasswordCredentialLifecyclePublisher {
+    #private;
+    private readonly options;
+    constructor(options: {
+        readonly application: CredentialLifecycleMicroCaller;
+        readonly redis: Redis;
+        readonly store: PasswordCredentialLifecycleOutboxStore;
+        readonly clock?: () => Date;
+        readonly onError?: (error: unknown, event?: PendingCredentialLifecycleEvent) => void;
+    });
+    start(): void;
+    close(): Promise<void>;
+    flush(): Promise<void>;
+    private runFlush;
+    private publish;
+}
+//# sourceMappingURL=credential-lifecycle-outbox.d.ts.map

package/dist/password/credential-lifecycle-outbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-lifecycle-outbox.d.ts","sourceRoot":"","sources":["../../src/password/credential-lifecycle-outbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ9E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAEL,KAAK,oCAAoC,EAC1C,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CAAC,IAAI,CACzD,oCAAoC,EACpC,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,YAAY,GAAG,UAAU,CAChF,CAAC,CAAC;AAEH,MAAM,WAAW,sCAAsC;IACrD,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,+BAA+B,EAAE,CAAC,CAAC;IACvF,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5F;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,QAAQ,CAAC;QAChB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,WAAW,CAAC;KACrB,CAAC,GACD,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED,qBAAa,6CACb,YAAW,sCAAsC;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAA9C,YAAoC,UAAU,EAAE,UAAU,EAAI;IAEjD,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,+BAA+B,EAAE,CAAC,CAclG;IAEY,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7D;IAEY,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtG;CACF;AAED,qBAAa,oCAAoC;;IAO5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAA3C,YAAoC,OAAO,EAAE;QAC3C,QAAQ,CAAC,WAAW,EAAE,8BAA8B,CAAC;QACrD,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,sCAAsC,CAAC;QACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;QAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,+BAA+B,KAAK,IAAI,CAAC;KACtF,EAEA;IAEM,KAAK,IAAI,IAAI,CAanB;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAKlC;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CASlC;YAEa,QAAQ;YAeR,OAAO;CAmCtB"}

package/dist/password/credential-lifecycle-outbox.js

@@ -0,0 +1,119 @@
+import { createExecutionContext } from '@hile/context';
+import { Scheduler } from '@hile/schedule';
+import { parseUserCredentialLifecycleResponse, USER_CREDENTIAL_LIFECYCLE_OPERATION, USER_SERVICE_NAMESPACE, } from '@zlooks.cn/user-shared';
+import { LessThanOrEqual } from 'typeorm';
+import { PasswordCredentialLifecycleOutboxEntity, } from '../persistence/entities.js';
+export class TypeOrmPasswordCredentialLifecycleOutboxStore {
+    dataSource;
+    constructor(dataSource) {
+        this.dataSource = dataSource;
+    }
+    async readDue(now, limit) {
+        return this.dataSource.getRepository(PasswordCredentialLifecycleOutboxEntity).find({
+            where: { nextAttemptAt: LessThanOrEqual(now) },
+            order: { createdAt: 'ASC' },
+            take: limit,
+            select: {
+                transactionId: true,
+                kind: true,
+                subject: true,
+                identifier: true,
+                occurredAt: true,
+                attempts: true,
+            },
+        });
+    }
+    async acknowledge(transactionId) {
+        await this.dataSource.getRepository(PasswordCredentialLifecycleOutboxEntity).delete({ transactionId });
+    }
+    async recordFailure(transactionId, attempts, nextAttemptAt) {
+        await this.dataSource.getRepository(PasswordCredentialLifecycleOutboxEntity).update({ transactionId }, { attempts, nextAttemptAt });
+    }
+}
+export class PasswordCredentialLifecyclePublisher {
+    options;
+    #scheduler = new Scheduler();
+    #clock;
+    #inFlight = new Set();
+    #controllers = new Set();
+    #closing = false;
+    constructor(options) {
+        this.options = options;
+        this.#clock = options.clock ?? (() => new Date());
+    }
+    start() {
+        this.#scheduler.add('credential-lifecycle-outbox', '*/2 * * * * *', async () => {
+            await this.flush();
+        }, {
+            distributed: {
+                redis: this.options.redis,
+                ttl: 30_000,
+                namespace: 'zlooks.password-auth',
+                policy: 'skip-if-locked',
+                renew: true,
+            },
+            onError: (error) => this.options.onError?.(error),
+        });
+    }
+    async close() {
+        this.#closing = true;
+        this.#scheduler.stop();
+        for (const controller of this.#controllers)
+            controller.abort();
+        await Promise.allSettled(this.#inFlight);
+    }
+    async flush() {
+        if (this.#closing)
+            return;
+        const operation = this.runFlush();
+        this.#inFlight.add(operation);
+        try {
+            await operation;
+        }
+        finally {
+            this.#inFlight.delete(operation);
+        }
+    }
+    async runFlush() {
+        const controller = new AbortController();
+        this.#controllers.add(controller);
+        try {
+            const events = await this.options.store.readDue(this.#clock(), 20);
+            for (let offset = 0; offset < events.length && !controller.signal.aborted; offset += 5) {
+                await Promise.all(events.slice(offset, offset + 5).map((event) => this.publish(event, controller.signal)));
+            }
+        }
+        finally {
+            this.#controllers.delete(controller);
+        }
+    }
+    async publish(event, signal) {
+        try {
+            const payload = {
+                protocol: 'zlooks.user.credential-lifecycle',
+                kind: event.kind,
+                authenticationTransactionId: event.transactionId,
+                extensionId: 'password',
+                methodId: 'password',
+                subject: event.subject,
+                email: event.identifier,
+                occurredAt: event.occurredAt.toISOString(),
+            };
+            parseUserCredentialLifecycleResponse(await this.options.application.call(USER_SERVICE_NAMESPACE, USER_CREDENTIAL_LIFECYCLE_OPERATION, payload, {
+                context: createExecutionContext({}),
+                timeout: 5_000,
+                retries: 0,
+                signal,
+            }));
+            await this.options.store.acknowledge(event.transactionId);
+        }
+        catch (error) {
+            const attempts = event.attempts + 1;
+            const delayMs = Math.min(60_000, 1_000 * (2 ** Math.min(attempts, 6)));
+            await this.options.store.recordFailure(event.transactionId, attempts, new Date(this.#clock().getTime() + delayMs));
+            if (!signal.aborted)
+                this.options.onError?.(error, event);
+        }
+    }
+}
+//# sourceMappingURL=credential-lifecycle-outbox.js.map

package/dist/password/credential-lifecycle-outbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-lifecycle-outbox.js","sourceRoot":"","sources":["../../src/password/credential-lifecycle-outbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAyB,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACL,oCAAoC,EACpC,mCAAmC,EACnC,sBAAsB,GAEvB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,eAAe,EAAmB,MAAM,SAAS,CAAC;AAC3D,OAAO,EACL,uCAAuC,GAExC,MAAM,4BAA4B,CAAC;AA2BpC,MAAM,OAAO,6CAA6C;IAEpB,UAAU;IAA9C,YAAoC,UAAsB;0BAAtB,UAAU;IAAe,CAAC;IAEvD,KAAK,CAAC,OAAO,CAAC,GAAS,EAAE,KAAa;QAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,uCAAuC,CAAC,CAAC,IAAI,CAAC;YACjF,KAAK,EAAE,EAAE,aAAa,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE;YAC9C,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;YAC3B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE;gBACN,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,IAAI;aACf;SACF,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,aAAqB;QAC5C,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,uCAAuC,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;IACzG,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,aAAqB,EAAE,QAAgB,EAAE,aAAmB;QACrF,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,uCAAuC,CAAC,CAAC,MAAM,CACjF,EAAE,aAAa,EAAE,EACjB,EAAE,QAAQ,EAAE,aAAa,EAAE,CAC5B,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,oCAAoC;IAOX,OAAO;IANlC,UAAU,GAAG,IAAI,SAAS,EAAE,CAAC;IAC7B,MAAM,CAAa;IACnB,SAAS,GAAG,IAAI,GAAG,EAAiB,CAAC;IACrC,YAAY,GAAG,IAAI,GAAG,EAAmB,CAAC;IACnD,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAoC,OAMnC;uBANmC,OAAO;QAOzC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK;QACV,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,6BAA6B,EAAE,eAAe,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC,EAAE;YACD,WAAW,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;gBACzB,GAAG,EAAE,MAAM;gBACX,SAAS,EAAE,sBAAsB;gBACjC,MAAM,EAAE,gBAAgB;gBACxB,KAAK,EAAE,IAAI;aACZ;YACD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,YAAY;YAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QAC/D,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,SAAS,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACnE,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;gBACvF,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CACpD,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAClD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAAsC,EAAE,MAAmB;QAC/E,IAAI,CAAC;YACH,MAAM,OAAO,GAAiC;gBAC5C,QAAQ,EAAE,kCAAkC;gBAC5C,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,2BAA2B,EAAE,KAAK,CAAC,aAAa;gBAChD,WAAW,EAAE,UAAU;gBACvB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,KAAK,CAAC,UAAU;gBACvB,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE;aAC3C,CAAC;YACF,oCAAoC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CACtE,sBAAsB,EACtB,mCAAmC,EACnC,OAAO,EACP;gBACE,OAAO,EAAE,sBAAsB,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,CAAC;gBACV,MAAM;aACP,CACF,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CACpC,KAAK,CAAC,aAAa,EACnB,QAAQ,EACR,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAC5C,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;CACF"}