@zlooks.cn/password-auth-server 1.0.0

package/dist/password/credential-repository.d.ts

@@ -0,0 +1,41 @@
+export interface PasswordCredential {
+    readonly subject: string;
+    readonly identifier: string;
+    readonly passwordHash: string;
+    readonly failedAttempts?: number;
+    readonly lockedUntil?: Date;
+    readonly emailVerifiedAt?: Date;
+    readonly passwordChangedAt?: Date;
+    readonly registrationTransactionId?: string;
+    readonly passwordChangedTransactionId?: string;
+}
+export interface PasswordCredentialLifecycleEvent {
+    readonly transactionId: string;
+    readonly kind: 'registration' | 'recovery';
+    readonly subject: string;
+    readonly identifier: string;
+    readonly occurredAt: Date;
+}
+export interface PasswordCredentialRepository {
+    findByIdentifier(identifier: string): Promise<PasswordCredential | undefined>;
+    create(credential: PasswordCredential): Promise<boolean>;
+    createWithLifecycleEvent(credential: PasswordCredential, event: PasswordCredentialLifecycleEvent): Promise<boolean>;
+    recordFailure(identifier: string, lockedUntil?: Date): Promise<void>;
+    recordSuccess(identifier: string): Promise<void>;
+    markEmailVerified(identifier: string, verifiedAt: Date): Promise<void>;
+    updatePassword(identifier: string, passwordHash: string, changedAt: Date): Promise<void>;
+    updatePasswordWithLifecycleEvent(identifier: string, passwordHash: string, changedAt: Date, event: PasswordCredentialLifecycleEvent): Promise<void>;
+}
+/** Test and local-development implementation; not a production persistence boundary. */
+export declare class InMemoryPasswordCredentialRepository implements PasswordCredentialRepository {
+    #private;
+    findByIdentifier(identifier: string): Promise<PasswordCredential | undefined>;
+    create(credential: PasswordCredential): Promise<boolean>;
+    createWithLifecycleEvent(credential: PasswordCredential, event: PasswordCredentialLifecycleEvent): Promise<boolean>;
+    recordFailure(identifier: string, lockedUntil?: Date): Promise<void>;
+    recordSuccess(identifier: string): Promise<void>;
+    markEmailVerified(identifier: string, verifiedAt: Date): Promise<void>;
+    updatePassword(identifier: string, passwordHash: string, changedAt: Date): Promise<void>;
+    updatePasswordWithLifecycleEvent(identifier: string, passwordHash: string, changedAt: Date, event: PasswordCredentialLifecycleEvent): Promise<void>;
+}
+//# sourceMappingURL=credential-repository.d.ts.map

package/dist/password/credential-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-repository.d.ts","sourceRoot":"","sources":["../../src/password/credential-repository.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IAClC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC;CAChD;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,4BAA4B;IAC3C,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAC9E,MAAM,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,wBAAwB,CACtB,UAAU,EAAE,kBAAkB,EAC9B,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,gCAAgC,CAC9B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,IAAI,EACf,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,wFAAwF;AACxF,qBAAa,oCAAqC,YAAW,4BAA4B;;IAG1E,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAGzF;IAEY,MAAM,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAIpE;IAEY,wBAAwB,CACnC,UAAU,EAAE,kBAAkB,EAC9B,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,OAAO,CAAC,CAElB;IAEY,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhF;IAEY,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5D;IAEY,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlF;IAEY,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAepG;IAEY,gCAAgC,CAC3C,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,IAAI,EACf,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,IAAI,CAAC,CASf;CACF"}

package/dist/password/credential-repository.js

@@ -0,0 +1,64 @@
+/** Test and local-development implementation; not a production persistence boundary. */
+export class InMemoryPasswordCredentialRepository {
+    #credentials = new Map();
+    async findByIdentifier(identifier) {
+        const value = this.#credentials.get(identifier);
+        return value ? structuredClone(value) : undefined;
+    }
+    async create(credential) {
+        if (this.#credentials.has(credential.identifier))
+            return false;
+        this.#credentials.set(credential.identifier, structuredClone(credential));
+        return true;
+    }
+    async createWithLifecycleEvent(credential, event) {
+        return this.create({ ...credential, registrationTransactionId: event.transactionId });
+    }
+    async recordFailure(identifier, lockedUntil) {
+        const credential = this.#credentials.get(identifier);
+        if (!credential)
+            return;
+        this.#credentials.set(identifier, {
+            ...credential,
+            failedAttempts: (credential.failedAttempts ?? 0) + 1,
+            ...(lockedUntil ? { lockedUntil } : {}),
+        });
+    }
+    async recordSuccess(identifier) {
+        const credential = this.#credentials.get(identifier);
+        if (!credential)
+            return;
+        const { lockedUntil: _lockedUntil, ...rest } = credential;
+        this.#credentials.set(identifier, { ...rest, failedAttempts: 0 });
+    }
+    async markEmailVerified(identifier, verifiedAt) {
+        const credential = this.#credentials.get(identifier);
+        if (!credential)
+            return;
+        this.#credentials.set(identifier, { ...credential, emailVerifiedAt: verifiedAt });
+    }
+    async updatePassword(identifier, passwordHash, changedAt) {
+        const credential = this.#credentials.get(identifier);
+        if (!credential)
+            return;
+        const { lockedUntil: _lockedUntil, passwordChangedTransactionId: _passwordChangedTransactionId, ...rest } = credential;
+        this.#credentials.set(identifier, {
+            ...rest,
+            passwordHash,
+            passwordChangedAt: changedAt,
+            emailVerifiedAt: credential.emailVerifiedAt ?? changedAt,
+            failedAttempts: 0,
+        });
+    }
+    async updatePasswordWithLifecycleEvent(identifier, passwordHash, changedAt, event) {
+        await this.updatePassword(identifier, passwordHash, changedAt);
+        const credential = this.#credentials.get(identifier);
+        if (credential) {
+            this.#credentials.set(identifier, {
+                ...credential,
+                passwordChangedTransactionId: event.transactionId,
+            });
+        }
+    }
+}
+//# sourceMappingURL=credential-repository.js.map

package/dist/password/credential-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-repository.js","sourceRoot":"","sources":["../../src/password/credential-repository.ts"],"names":[],"mappings":"AAuCA,wFAAwF;AACxF,MAAM,OAAO,oCAAoC;IACtC,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEvD,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,UAA8B;QAChD,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,wBAAwB,CACnC,UAA8B,EAC9B,KAAuC;QAEvC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,yBAAyB,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;IACxF,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,WAAkB;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE;YAChC,GAAG,UAAU;YACb,cAAc,EAAE,CAAC,UAAU,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC;YACpD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,UAAkB;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,UAAkB,EAAE,UAAgB;QACjE,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACpF,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,UAAkB,EAAE,YAAoB,EAAE,SAAe;QACnF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,EACJ,WAAW,EAAE,YAAY,EACzB,4BAA4B,EAAE,6BAA6B,EAC3D,GAAG,IAAI,EACR,GAAG,UAAU,CAAC;QACf,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE;YAChC,GAAG,IAAI;YACP,YAAY;YACZ,iBAAiB,EAAE,SAAS;YAC5B,eAAe,EAAE,UAAU,CAAC,eAAe,IAAI,SAAS;YACxD,cAAc,EAAE,CAAC;SAClB,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,gCAAgC,CAC3C,UAAkB,EAClB,YAAoB,EACpB,SAAe,EACf,KAAuC;QAEvC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE;gBAChC,GAAG,UAAU;gBACb,4BAA4B,EAAE,KAAK,CAAC,aAAa;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/password/password-authenticator.d.ts

@@ -0,0 +1,59 @@
+import type { PasswordAuthConfig } from '../config/schema.js';
+import type { PasswordCredentialRepository } from './credential-repository.js';
+import type { PasswordAttemptCoordinator } from './attempt-coordinator.js';
+type PasswordPolicy = PasswordAuthConfig['password'];
+export type RegistrationResult = {
+    readonly ok: true;
+    readonly subject: string;
+    readonly identifier: string;
+} | {
+    readonly ok: false;
+    readonly code: 'registration-rejected';
+};
+export type VerificationResult = {
+    readonly ok: true;
+    readonly subject: string;
+    readonly identifier: string;
+    readonly emailVerified: boolean;
+} | {
+    readonly ok: false;
+    readonly code: 'invalid-credentials';
+};
+export declare class PasswordAuthenticator {
+    private readonly repository;
+    private readonly policy;
+    private readonly unknownCredentialHash;
+    private readonly clock;
+    private readonly attemptCoordinator?;
+    private constructor();
+    static create(repository: PasswordCredentialRepository, policy: PasswordPolicy, clock?: () => Date, attemptCoordinator?: PasswordAttemptCoordinator): Promise<PasswordAuthenticator>;
+    register(input: {
+        readonly identifier: string;
+        readonly password: string;
+    }): Promise<RegistrationResult>;
+    private registerCredential;
+    private recoverRegistration;
+    verify(input: {
+        readonly identifier: string;
+        readonly password: string;
+    }): Promise<VerificationResult>;
+    private verifyCredential;
+    inspectIdentifier(value: string): Promise<Readonly<{
+        identifier?: string;
+        exists: boolean;
+    }>>;
+    registerVerified(input: {
+        readonly transactionId: string;
+        readonly identifier: string;
+        readonly password: string;
+    }): Promise<RegistrationResult>;
+    verifyEmailIdentity(value: string): Promise<VerificationResult>;
+    resetPassword(input: {
+        readonly transactionId: string;
+        readonly identifier: string;
+        readonly password: string;
+    }): Promise<VerificationResult>;
+}
+export declare function normalizeEmailIdentifier(value: string): string | undefined;
+export {};
+//# sourceMappingURL=password-authenticator.d.ts.map

package/dist/password/password-authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-authenticator.d.ts","sourceRoot":"","sources":["../../src/password/password-authenticator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAE3E,KAAK,cAAc,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;AAErD,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAA;CAAE,CAAC;AAEnE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;CAAE,GAC7G;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAEjE,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IALtC,OAAO,eAMH;IAEJ,OAAoB,MAAM,CACxB,UAAU,EAAE,4BAA4B,EACxC,MAAM,EAAE,cAAc,EACtB,KAAK,GAAE,MAAM,IAAuB,EACpC,kBAAkB,CAAC,EAAE,0BAA0B,GAC9C,OAAO,CAAC,qBAAqB,CAAC,CAGhC;IAEY,QAAQ,CAAC,KAAK,EAAE;QAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQ9B;YAEa,kBAAkB;YAkBlB,mBAAmB;IAWpB,MAAM,CAAC,KAAK,EAAE;QACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAM9B;YAEa,gBAAgB;IAmCjB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC,CAAC,CAIF;IAEY,gBAAgB,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoC9B;IAEY,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAM3E;IAEY,aAAa,CAAC,KAAK,EAAE;QAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA6B9B;CACF;AAaD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1E"}

package/dist/password/password-authenticator.js

@@ -0,0 +1,184 @@
+import { randomBytes, randomUUID } from 'node:crypto';
+import { hash, verify } from '@node-rs/argon2';
+import { z } from 'zod';
+export class PasswordAuthenticator {
+    repository;
+    policy;
+    unknownCredentialHash;
+    clock;
+    attemptCoordinator;
+    constructor(repository, policy, unknownCredentialHash, clock, attemptCoordinator) {
+        this.repository = repository;
+        this.policy = policy;
+        this.unknownCredentialHash = unknownCredentialHash;
+        this.clock = clock;
+        this.attemptCoordinator = attemptCoordinator;
+    }
+    static async create(repository, policy, clock = () => new Date(), attemptCoordinator) {
+        const unknownCredentialHash = await hash(randomBytes(32), argonOptions(policy));
+        return new PasswordAuthenticator(repository, policy, unknownCredentialHash, clock, attemptCoordinator);
+    }
+    async register(input) {
+        const identifier = normalizeEmailIdentifier(input.identifier);
+        if (!identifier || !validPassword(input.password, this.policy)) {
+            return { ok: false, code: 'registration-rejected' };
+        }
+        const operation = () => this.registerCredential(identifier, input.password);
+        return this.attemptCoordinator ? this.attemptCoordinator.run(identifier, operation) : operation();
+    }
+    async registerCredential(identifier, password) {
+        const existing = await this.repository.findByIdentifier(identifier);
+        if (existing)
+            return this.recoverRegistration(identifier, password);
+        const passwordHash = await hash(password, argonOptions(this.policy));
+        const subject = randomUUID();
+        const created = await this.repository.create({
+            subject,
+            identifier,
+            passwordHash,
+        });
+        if (!created)
+            return this.recoverRegistration(identifier, password);
+        return { ok: true, subject, identifier };
+    }
+    async recoverRegistration(identifier, password) {
+        const verified = await this.verifyCredential(identifier, password);
+        return verified.ok
+            ? {
+                ok: true,
+                subject: verified.subject,
+                identifier: verified.identifier,
+            }
+            : { ok: false, code: 'registration-rejected' };
+    }
+    async verify(input) {
+        const identifier = normalizeEmailIdentifier(input.identifier);
+        if (identifier && this.attemptCoordinator) {
+            return this.attemptCoordinator.run(identifier, async () => this.verifyCredential(identifier, input.password));
+        }
+        return this.verifyCredential(identifier, input.password);
+    }
+    async verifyCredential(identifier, password) {
+        const credential = identifier
+            ? await this.repository.findByIdentifier(identifier)
+            : undefined;
+        const valid = await verify(credential?.passwordHash ?? this.unknownCredentialHash, password).catch(() => false);
+        if (!credential)
+            return { ok: false, code: 'invalid-credentials' };
+        const now = this.clock();
+        if (credential.lockedUntil && credential.lockedUntil > now) {
+            return { ok: false, code: 'invalid-credentials' };
+        }
+        if (!valid) {
+            const failures = (credential.failedAttempts ?? 0) + 1;
+            await this.repository.recordFailure(identifier, failures >= this.policy.maxFailedAttempts
+                ? new Date(now.getTime() + this.policy.lockoutMs)
+                : undefined);
+            return { ok: false, code: 'invalid-credentials' };
+        }
+        await this.repository.recordSuccess(identifier);
+        return {
+            ok: true,
+            subject: credential.subject,
+            identifier: credential.identifier,
+            emailVerified: credential.emailVerifiedAt !== undefined,
+        };
+    }
+    async inspectIdentifier(value) {
+        const identifier = normalizeEmailIdentifier(value);
+        if (!identifier)
+            return { exists: false };
+        return { identifier, exists: (await this.repository.findByIdentifier(identifier)) !== undefined };
+    }
+    async registerVerified(input) {
+        const identifier = normalizeEmailIdentifier(input.identifier);
+        if (!identifier || !validPassword(input.password, this.policy)) {
+            return { ok: false, code: 'registration-rejected' };
+        }
+        const operation = async () => {
+            const existing = await this.repository.findByIdentifier(identifier);
+            if (existing?.registrationTransactionId === input.transactionId) {
+                return await verify(existing.passwordHash, input.password).catch(() => false)
+                    ? { ok: true, subject: existing.subject, identifier }
+                    : { ok: false, code: 'registration-rejected' };
+            }
+            if (existing) {
+                return { ok: false, code: 'registration-rejected' };
+            }
+            const now = this.clock();
+            const subject = randomUUID();
+            const created = await this.repository.createWithLifecycleEvent({
+                subject,
+                identifier,
+                passwordHash: await hash(input.password, argonOptions(this.policy)),
+                emailVerifiedAt: now,
+                passwordChangedAt: now,
+            }, {
+                transactionId: input.transactionId,
+                kind: 'registration',
+                subject,
+                identifier,
+                occurredAt: now,
+            });
+            if (!created)
+                return { ok: false, code: 'registration-rejected' };
+            const credential = await this.repository.findByIdentifier(identifier);
+            if (!credential)
+                throw new Error('Created password credential is unavailable');
+            return { ok: true, subject: credential.subject, identifier };
+        };
+        return this.attemptCoordinator ? this.attemptCoordinator.run(identifier, operation) : operation();
+    }
+    async verifyEmailIdentity(value) {
+        const identifier = normalizeEmailIdentifier(value);
+        const credential = identifier ? await this.repository.findByIdentifier(identifier) : undefined;
+        if (!identifier || !credential)
+            return { ok: false, code: 'invalid-credentials' };
+        await this.repository.markEmailVerified(identifier, this.clock());
+        return { ok: true, subject: credential.subject, identifier, emailVerified: true };
+    }
+    async resetPassword(input) {
+        const identifier = normalizeEmailIdentifier(input.identifier);
+        if (!identifier || !validPassword(input.password, this.policy)) {
+            return { ok: false, code: 'invalid-credentials' };
+        }
+        const operation = async () => {
+            const credential = await this.repository.findByIdentifier(identifier);
+            if (!credential)
+                return { ok: false, code: 'invalid-credentials' };
+            if (credential.passwordChangedTransactionId === input.transactionId) {
+                return await verify(credential.passwordHash, input.password).catch(() => false)
+                    ? { ok: true, subject: credential.subject, identifier, emailVerified: true }
+                    : { ok: false, code: 'invalid-credentials' };
+            }
+            const changedAt = this.clock();
+            await this.repository.updatePasswordWithLifecycleEvent(identifier, await hash(input.password, argonOptions(this.policy)), changedAt, {
+                transactionId: input.transactionId,
+                kind: 'recovery',
+                subject: credential.subject,
+                identifier,
+                occurredAt: changedAt,
+            });
+            return { ok: true, subject: credential.subject, identifier, emailVerified: true };
+        };
+        return this.attemptCoordinator ? this.attemptCoordinator.run(identifier, operation) : operation();
+    }
+}
+function argonOptions(policy) {
+    return {
+        memoryCost: policy.memoryCostKiB,
+        timeCost: policy.timeCost,
+        parallelism: policy.parallelism,
+        outputLen: 32,
+    };
+}
+const emailIdentifierSchema = z.email().max(320);
+export function normalizeEmailIdentifier(value) {
+    const normalized = value.trim().normalize('NFKC').toLocaleLowerCase('en-US');
+    return emailIdentifierSchema.safeParse(normalized).success ? normalized : undefined;
+}
+function validPassword(password, policy) {
+    const bytes = new TextEncoder().encode(password).byteLength;
+    return bytes >= policy.minLength && bytes <= policy.maxLength;
+}
+//# sourceMappingURL=password-authenticator.js.map

package/dist/password/password-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-authenticator.js","sourceRoot":"","sources":["../../src/password/password-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,MAAM,OAAO,qBAAqB;IAEb,UAAU;IACV,MAAM;IACN,qBAAqB;IACrB,KAAK;IACL,kBAAkB;IALrC,YACmB,UAAwC,EACxC,MAAsB,EACtB,qBAA6B,EAC7B,KAAiB,EACjB,kBAA+C;0BAJ/C,UAAU;sBACV,MAAM;qCACN,qBAAqB;qBACrB,KAAK;kCACL,kBAAkB;IAClC,CAAC;IAEG,MAAM,CAAC,KAAK,CAAC,MAAM,CACxB,UAAwC,EACxC,MAAsB,EACtB,KAAK,GAAe,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EACpC,kBAA+C;QAE/C,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QAChF,OAAO,IAAI,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACzG,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,KAGrB;QACC,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACpG,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,UAAkB,EAClB,QAAgB;QAEhB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEpE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC3C,OAAO;YACP,UAAU;YACV,YAAY;SACb,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,UAAkB,EAAE,QAAgB;QACpE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC,EAAE;YAChB,CAAC,CAAC;gBACA,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC;YACD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IACnD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAGnB;QACC,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,UAAU,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChH,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,UAA8B,EAC9B,QAAgB;QAEhB,MAAM,UAAU,GAAG,UAAU;YAC3B,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC;YACpD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GAAG,MAAM,MAAM,CACxB,UAAU,EAAE,YAAY,IAAI,IAAI,CAAC,qBAAqB,EACtD,QAAQ,CACT,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CACjC,UAAW,EACX,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBACvC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,SAAS,CACd,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,UAAW,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,aAAa,EAAE,UAAU,CAAC,eAAe,KAAK,SAAS;SACxD,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,KAAa;QAI1C,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;IACpG,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,KAI7B;QACC,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;QACtD,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,IAAiC,EAAE;YACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACpE,IAAI,QAAQ,EAAE,yBAAyB,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;gBAChE,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;oBAC3E,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE;oBACrD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;YACnD,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;YACtD,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC;gBAC7D,OAAO;gBACP,UAAU;gBACV,YAAY,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnE,eAAe,EAAE,GAAG;gBACpB,iBAAiB,EAAE,GAAG;aACvB,EAAE;gBACD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,IAAI,EAAE,cAAc;gBACpB,OAAO;gBACP,UAAU;gBACV,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;YAClE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACtE,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;QAC/D,CAAC,CAAC;QACF,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACpG,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC5C,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;QAClF,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAI1B;QACC,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,IAAiC,EAAE;YACxD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACtE,IAAI,CAAC,UAAU;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;YACnE,IAAI,UAAU,CAAC,4BAA4B,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;gBACpE,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;oBAC7E,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE;oBAC5E,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;YACjD,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,UAAU,CAAC,gCAAgC,CACpD,UAAU,EACV,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EACrD,SAAS,EACT;gBACE,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,UAAU;gBACV,UAAU,EAAE,SAAS;aACtB,CACF,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QACpF,CAAC,CAAC;QACF,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACpG,CAAC;CACF;AAED,SAAS,YAAY,CAAC,MAAsB;IAC1C,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,aAAa;QAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,EAAE;KACL,CAAC;AACb,CAAC;AAED,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEjD,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7E,OAAO,qBAAqB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,MAAsB;IAC7D,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC;IAC5D,OAAO,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC;AAChE,CAAC"}

package/dist/password/typeorm-credential-repository.d.ts

@@ -0,0 +1,15 @@
+import { type DataSource } from 'typeorm';
+import type { PasswordCredential, PasswordCredentialLifecycleEvent, PasswordCredentialRepository } from './credential-repository.js';
+export declare class TypeOrmPasswordCredentialRepository implements PasswordCredentialRepository {
+    private readonly dataSource;
+    constructor(dataSource: DataSource);
+    findByIdentifier(identifier: string): Promise<PasswordCredential | undefined>;
+    create(credential: PasswordCredential): Promise<boolean>;
+    createWithLifecycleEvent(credential: PasswordCredential, event: PasswordCredentialLifecycleEvent): Promise<boolean>;
+    recordFailure(identifier: string, lockedUntil?: Date): Promise<void>;
+    recordSuccess(identifier: string): Promise<void>;
+    markEmailVerified(identifier: string, verifiedAt: Date): Promise<void>;
+    updatePassword(identifier: string, passwordHash: string, changedAt: Date): Promise<void>;
+    updatePasswordWithLifecycleEvent(identifier: string, passwordHash: string, changedAt: Date, event: PasswordCredentialLifecycleEvent): Promise<void>;
+}
+//# sourceMappingURL=typeorm-credential-repository.d.ts.map

package/dist/password/typeorm-credential-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typeorm-credential-repository.d.ts","sourceRoot":"","sources":["../../src/password/typeorm-credential-repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAKlD,OAAO,KAAK,EACV,kBAAkB,EAClB,gCAAgC,EAChC,4BAA4B,EAC7B,MAAM,4BAA4B,CAAC;AAEpC,qBAAa,mCAAoC,YAAW,4BAA4B;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU;IAA9C,YAAoC,UAAU,EAAE,UAAU,EAAI;IAEjD,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAiBzF;IAEY,MAAM,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBpE;IAEY,wBAAwB,CACnC,UAAU,EAAE,kBAAkB,EAC9B,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,OAAO,CAAC,CAqBlB;IAEY,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhF;IAEY,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5D;IAEY,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlF;IAEY,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAYpG;IAEY,gCAAgC,CAC3C,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,IAAI,EACf,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,IAAI,CAAC,CAgBf;CACF"}

package/dist/password/typeorm-credential-repository.js

@@ -0,0 +1,125 @@
+import { IsNull } from 'typeorm';
+import { PasswordCredentialEntity, PasswordCredentialLifecycleOutboxEntity, } from '../persistence/entities.js';
+export class TypeOrmPasswordCredentialRepository {
+    dataSource;
+    constructor(dataSource) {
+        this.dataSource = dataSource;
+    }
+    async findByIdentifier(identifier) {
+        const row = await this.dataSource.getRepository(PasswordCredentialEntity).findOneBy({ identifier });
+        return row ? {
+            subject: row.subject,
+            identifier: row.identifier,
+            passwordHash: row.passwordHash,
+            failedAttempts: row.failedAttempts,
+            ...(row.lockedUntil ? { lockedUntil: row.lockedUntil } : {}),
+            ...(row.emailVerifiedAt ? { emailVerifiedAt: row.emailVerifiedAt } : {}),
+            ...(row.passwordChangedAt ? { passwordChangedAt: row.passwordChangedAt } : {}),
+            ...(row.registrationTransactionId
+                ? { registrationTransactionId: row.registrationTransactionId }
+                : {}),
+            ...(row.passwordChangedTransactionId
+                ? { passwordChangedTransactionId: row.passwordChangedTransactionId }
+                : {}),
+        } : undefined;
+    }
+    async create(credential) {
+        try {
+            await this.dataSource.getRepository(PasswordCredentialEntity).insert({
+                subject: credential.subject,
+                identifier: credential.identifier,
+                passwordHash: credential.passwordHash,
+                failedAttempts: 0,
+                lockedUntil: null,
+                emailVerifiedAt: credential.emailVerifiedAt ?? null,
+                passwordChangedAt: credential.passwordChangedAt ?? null,
+                registrationTransactionId: credential.registrationTransactionId ?? null,
+                passwordChangedTransactionId: credential.passwordChangedTransactionId ?? null,
+            });
+            return true;
+        }
+        catch (error) {
+            if (isUniqueViolation(error))
+                return false;
+            throw error;
+        }
+    }
+    async createWithLifecycleEvent(credential, event) {
+        try {
+            await this.dataSource.transaction(async (manager) => {
+                await manager.getRepository(PasswordCredentialEntity).insert({
+                    subject: credential.subject,
+                    identifier: credential.identifier,
+                    passwordHash: credential.passwordHash,
+                    failedAttempts: 0,
+                    lockedUntil: null,
+                    emailVerifiedAt: credential.emailVerifiedAt ?? null,
+                    passwordChangedAt: credential.passwordChangedAt ?? null,
+                    registrationTransactionId: event.transactionId,
+                    passwordChangedTransactionId: credential.passwordChangedTransactionId ?? null,
+                });
+                await manager.getRepository(PasswordCredentialLifecycleOutboxEntity).insert(toOutboxRow(event));
+            });
+            return true;
+        }
+        catch (error) {
+            if (isUniqueViolation(error))
+                return false;
+            throw error;
+        }
+    }
+    async recordFailure(identifier, lockedUntil) {
+        await this.dataSource.transaction(async (manager) => {
+            const repository = manager.getRepository(PasswordCredentialEntity);
+            await repository.increment({ identifier }, 'failedAttempts', 1);
+            if (lockedUntil)
+                await repository.update({ identifier }, { lockedUntil });
+        });
+    }
+    async recordSuccess(identifier) {
+        await this.dataSource.getRepository(PasswordCredentialEntity).update({ identifier }, { failedAttempts: 0, lockedUntil: null });
+    }
+    async markEmailVerified(identifier, verifiedAt) {
+        await this.dataSource.getRepository(PasswordCredentialEntity).update({ identifier, emailVerifiedAt: IsNull() }, { emailVerifiedAt: verifiedAt });
+    }
+    async updatePassword(identifier, passwordHash, changedAt) {
+        await this.dataSource.getRepository(PasswordCredentialEntity).update({ identifier }, {
+            passwordHash,
+            passwordChangedAt: changedAt,
+            emailVerifiedAt: changedAt,
+            passwordChangedTransactionId: null,
+            failedAttempts: 0,
+            lockedUntil: null,
+        });
+    }
+    async updatePasswordWithLifecycleEvent(identifier, passwordHash, changedAt, event) {
+        await this.dataSource.transaction(async (manager) => {
+            const updated = await manager.getRepository(PasswordCredentialEntity).update({ identifier }, {
+                passwordHash,
+                passwordChangedAt: changedAt,
+                emailVerifiedAt: changedAt,
+                failedAttempts: 0,
+                lockedUntil: null,
+                passwordChangedTransactionId: event.transactionId,
+            });
+            if (updated.affected !== 1)
+                throw new Error('Password credential is unavailable');
+            await manager.getRepository(PasswordCredentialLifecycleOutboxEntity).insert(toOutboxRow(event));
+        });
+    }
+}
+function toOutboxRow(event) {
+    return {
+        transactionId: event.transactionId,
+        kind: event.kind,
+        subject: event.subject,
+        identifier: event.identifier,
+        occurredAt: event.occurredAt,
+        attempts: 0,
+        nextAttemptAt: event.occurredAt,
+    };
+}
+function isUniqueViolation(error) {
+    return typeof error === 'object' && error !== null && 'code' in error && error.code === '23505';
+}
+//# sourceMappingURL=typeorm-credential-repository.js.map

package/dist/password/typeorm-credential-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typeorm-credential-repository.js","sourceRoot":"","sources":["../../src/password/typeorm-credential-repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAmB,MAAM,SAAS,CAAC;AAClD,OAAO,EACL,wBAAwB,EACxB,uCAAuC,GACxC,MAAM,4BAA4B,CAAC;AAOpC,MAAM,OAAO,mCAAmC;IACV,UAAU;IAA9C,YAAoC,UAAsB;0BAAtB,UAAU;IAAe,CAAC;IAEvD,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QACpG,OAAO,GAAG,CAAC,CAAC,CAAC;YACX,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,GAAG,CAAC,yBAAyB;gBAC/B,CAAC,CAAC,EAAE,yBAAyB,EAAE,GAAG,CAAC,yBAAyB,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,4BAA4B;gBAClC,CAAC,CAAC,EAAE,4BAA4B,EAAE,GAAG,CAAC,4BAA4B,EAAE;gBACpE,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,UAA8B;QAChD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC;gBACnE,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,cAAc,EAAE,CAAC;gBACjB,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,UAAU,CAAC,eAAe,IAAI,IAAI;gBACnD,iBAAiB,EAAE,UAAU,CAAC,iBAAiB,IAAI,IAAI;gBACvD,yBAAyB,EAAE,UAAU,CAAC,yBAAyB,IAAI,IAAI;gBACvE,4BAA4B,EAAE,UAAU,CAAC,4BAA4B,IAAI,IAAI;aAC9E,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,wBAAwB,CACnC,UAA8B,EAC9B,KAAuC;QAEvC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAClD,MAAM,OAAO,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC;oBAC3D,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,cAAc,EAAE,CAAC;oBACjB,WAAW,EAAE,IAAI;oBACjB,eAAe,EAAE,UAAU,CAAC,eAAe,IAAI,IAAI;oBACnD,iBAAiB,EAAE,UAAU,CAAC,iBAAiB,IAAI,IAAI;oBACvD,yBAAyB,EAAE,KAAK,CAAC,aAAa;oBAC9C,4BAA4B,EAAE,UAAU,CAAC,4BAA4B,IAAI,IAAI;iBAC9E,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,aAAa,CAAC,uCAAuC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;YAClG,CAAC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,WAAkB;QAC/D,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;YACnE,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;YAChE,IAAI,WAAW;gBAAE,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,UAAkB;QAC3C,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAClE,EAAE,UAAU,EAAE,EACd,EAAE,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CACzC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,UAAkB,EAAE,UAAgB;QACjE,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAClE,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,EACzC,EAAE,eAAe,EAAE,UAAU,EAAE,CAChC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,UAAkB,EAAE,YAAoB,EAAE,SAAe;QACnF,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAClE,EAAE,UAAU,EAAE,EACd;YACE,YAAY;YACZ,iBAAiB,EAAE,SAAS;YAC5B,eAAe,EAAE,SAAS;YAC1B,4BAA4B,EAAE,IAAI;YAClC,cAAc,EAAE,CAAC;YACjB,WAAW,EAAE,IAAI;SAClB,CACF,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,gCAAgC,CAC3C,UAAkB,EAClB,YAAoB,EACpB,SAAe,EACf,KAAuC;QAEvC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAC1E,EAAE,UAAU,EAAE,EACd;gBACE,YAAY;gBACZ,iBAAiB,EAAE,SAAS;gBAC5B,eAAe,EAAE,SAAS;gBAC1B,cAAc,EAAE,CAAC;gBACjB,WAAW,EAAE,IAAI;gBACjB,4BAA4B,EAAE,KAAK,CAAC,aAAa;aAClD,CACF,CAAC;YACF,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAClF,MAAM,OAAO,CAAC,aAAa,CAAC,uCAAuC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QAClG,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAuC;IAC1D,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,KAAK,CAAC,UAAU;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;AAClG,CAAC"}

package/dist/persistence/entities.d.ts

@@ -0,0 +1,29 @@
+import { EntitySchema } from 'typeorm';
+export interface PasswordCredentialRow {
+    subject: string;
+    identifier: string;
+    passwordHash: string;
+    failedAttempts: number;
+    lockedUntil: Date | null;
+    emailVerifiedAt: Date | null;
+    passwordChangedAt: Date | null;
+    registrationTransactionId: string | null;
+    passwordChangedTransactionId: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    version: number;
+}
+export interface PasswordCredentialLifecycleOutboxRow {
+    transactionId: string;
+    kind: 'registration' | 'recovery';
+    subject: string;
+    identifier: string;
+    occurredAt: Date;
+    attempts: number;
+    nextAttemptAt: Date;
+    createdAt: Date;
+}
+export declare const PasswordCredentialEntity: EntitySchema<PasswordCredentialRow>;
+export declare const PasswordCredentialLifecycleOutboxEntity: EntitySchema<PasswordCredentialLifecycleOutboxRow>;
+export declare const passwordAuthEntities: readonly [EntitySchema<PasswordCredentialRow>, EntitySchema<PasswordCredentialLifecycleOutboxRow>];
+//# sourceMappingURL=entities.d.ts.map

package/dist/persistence/entities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../../src/persistence/entities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,4BAA4B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oCAAoC;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,cAAc,GAAG,UAAU,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,IAAI,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,eAAO,MAAM,wBAAwB,qCA2BnC,CAAC;AAEH,eAAO,MAAM,uCAAuC,oDAclD,CAAC;AAEH,eAAO,MAAM,oBAAoB,oGAGvB,CAAC"}

package/dist/persistence/entities.js

@@ -0,0 +1,49 @@
+import { EntitySchema } from 'typeorm';
+export const PasswordCredentialEntity = new EntitySchema({
+    name: 'PasswordCredential',
+    tableName: 'password_credentials',
+    columns: {
+        subject: { type: 'uuid', primary: true },
+        identifier: { type: 'varchar', length: 320, unique: true },
+        passwordHash: { name: 'password_hash', type: 'text' },
+        failedAttempts: { name: 'failed_attempts', type: 'integer', default: 0 },
+        lockedUntil: { name: 'locked_until', type: 'timestamptz', nullable: true },
+        emailVerifiedAt: { name: 'email_verified_at', type: 'timestamptz', nullable: true },
+        passwordChangedAt: { name: 'password_changed_at', type: 'timestamptz', nullable: true },
+        registrationTransactionId: {
+            name: 'registration_transaction_id',
+            type: 'uuid',
+            unique: true,
+            nullable: true,
+        },
+        passwordChangedTransactionId: {
+            name: 'password_changed_transaction_id',
+            type: 'uuid',
+            unique: true,
+            nullable: true,
+        },
+        createdAt: { name: 'created_at', type: 'timestamptz', createDate: true },
+        updatedAt: { name: 'updated_at', type: 'timestamptz', updateDate: true },
+        version: { type: 'integer', version: true },
+    },
+});
+export const PasswordCredentialLifecycleOutboxEntity = new EntitySchema({
+    name: 'PasswordCredentialLifecycleOutbox',
+    tableName: 'password_credential_lifecycle_outbox',
+    columns: {
+        transactionId: { name: 'transaction_id', type: 'uuid', primary: true },
+        kind: { type: 'varchar', length: 16 },
+        subject: { type: 'uuid' },
+        identifier: { type: 'varchar', length: 320 },
+        occurredAt: { name: 'occurred_at', type: 'timestamptz' },
+        attempts: { type: 'integer', default: 0 },
+        nextAttemptAt: { name: 'next_attempt_at', type: 'timestamptz' },
+        createdAt: { name: 'created_at', type: 'timestamptz', createDate: true },
+    },
+    indices: [{ name: 'idx_password_credential_lifecycle_due', columns: ['nextAttemptAt'] }],
+});
+export const passwordAuthEntities = [
+    PasswordCredentialEntity,
+    PasswordCredentialLifecycleOutboxEntity,
+];
+//# sourceMappingURL=entities.js.map

package/dist/persistence/entities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entities.js","sourceRoot":"","sources":["../../src/persistence/entities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AA4BvC,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,YAAY,CAAwB;IAC9E,IAAI,EAAE,oBAAoB;IAC1B,SAAS,EAAE,sBAAsB;IACjC,OAAO,EAAE;QACP,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;QACxC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAC1D,YAAY,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE;QACrD,cAAc,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;QACxE,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC1E,eAAe,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QACnF,iBAAiB,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvF,yBAAyB,EAAE;YACzB,IAAI,EAAE,6BAA6B;YACnC,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI;SACf;QACD,4BAA4B,EAAE;YAC5B,IAAI,EAAE,iCAAiC;YACvC,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI;SACf;QACD,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;QACxE,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;QACxE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;KAC5C;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,IAAI,YAAY,CAAuC;IAC5G,IAAI,EAAE,mCAAmC;IACzC,SAAS,EAAE,sCAAsC;IACjD,OAAO,EAAE;QACP,aAAa,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;QACtE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzB,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE;QAC5C,UAAU,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE;QACxD,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;QACzC,aAAa,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,aAAa,EAAE;QAC/D,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;KACzE;IACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,uCAAuC,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;CACzF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,wBAAwB;IACxB,uCAAuC;CAC/B,CAAC"}