@zlooks.cn/password-auth-server 1.0.0

package/dist/runtime/auth-announcement-publisher.d.ts

@@ -0,0 +1,18 @@
+import type { Application } from '@hile/micro';
+export interface AuthAnnouncementPublisherOptions {
+    readonly application: Pick<Application, 'publish'>;
+    readonly instanceId: string;
+    readonly generation: number;
+    readonly leaseMs: number;
+    readonly rscBuildId: string;
+    readonly clock?: () => Date;
+    readonly onError?: (error: unknown) => void;
+}
+export declare class AuthAnnouncementPublisher {
+    #private;
+    private readonly options;
+    constructor(options: AuthAnnouncementPublisherOptions);
+    start(): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=auth-announcement-publisher.d.ts.map

package/dist/runtime/auth-announcement-publisher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-announcement-publisher.d.ts","sourceRoot":"","sources":["../../src/runtime/auth-announcement-publisher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAc/C,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CAC7C;AAED,qBAAa,yBAAyB;;IAQjB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAA3C,YAAoC,OAAO,EAAE,gCAAgC,EAE5E;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAkBlC;IAEM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ5B;CA6DF"}

package/dist/runtime/auth-announcement-publisher.js

@@ -0,0 +1,106 @@
+import { AUTH_EXTENSION_OPERATION_PREFIX, authExtensionAnnouncementSchema, authExtensionTopic, } from '@zlooks.cn/auth-extension-contract';
+import { PASSWORD_AUTH_SERVICE_NAMESPACE } from '../service-identity.js';
+export class AuthAnnouncementPublisher {
+    options;
+    #clock;
+    #publication;
+    #timer;
+    #sequence = -1;
+    #updating;
+    #closing;
+    constructor(options) {
+        this.options = options;
+        this.#clock = options.clock ?? (() => new Date());
+    }
+    async start() {
+        if (this.#publication)
+            return;
+        const announcement = this.#createAnnouncement();
+        // Security boundary: every peer admitted to the internal Micro mesh is trusted.
+        // Registry discovery intentionally carries no per-extension secret or signature.
+        this.#publication = await this.options.application.publish(authExtensionTopic('password', this.options.instanceId), announcement);
+        this.#timer = setInterval(() => {
+            if (this.#updating)
+                return;
+            const operation = this.#refresh();
+            this.#updating = operation;
+            void operation.finally(() => {
+                if (this.#updating === operation)
+                    this.#updating = undefined;
+            }).catch((error) => this.options.onError?.(error));
+        }, Math.max(250, Math.floor(this.options.leaseMs / 2)));
+        this.#timer.unref();
+    }
+    close() {
+        if (this.#closing)
+            return this.#closing;
+        if (!this.#publication && !this.#timer && !this.#updating)
+            return Promise.resolve();
+        const operation = this.#close();
+        this.#closing = operation;
+        return operation.finally(() => {
+            if (this.#closing === operation)
+                this.#closing = undefined;
+        });
+    }
+    async #close() {
+        if (this.#timer)
+            clearInterval(this.#timer);
+        this.#timer = undefined;
+        await this.#updating?.catch(() => undefined);
+        await this.#publication?.unpublish();
+        this.#publication = undefined;
+    }
+    async #refresh() {
+        const publication = this.#publication;
+        if (!publication)
+            return;
+        await publication.update(this.#createAnnouncement());
+    }
+    #createAnnouncement() {
+        const issuedAt = this.#clock();
+        this.#sequence = Math.max(this.#sequence + 1, issuedAt.getTime());
+        return authExtensionAnnouncementSchema.parse({
+            protocol: 'zlooks.auth-extension.discovery',
+            extension: {
+                id: 'password',
+                version: '1.1.0',
+                namespace: PASSWORD_AUTH_SERVICE_NAMESPACE,
+                instanceId: this.options.instanceId,
+                generation: this.options.generation,
+            },
+            lease: {
+                issuedAt: issuedAt.toISOString(),
+                expiresAt: new Date(issuedAt.getTime() + this.options.leaseMs).toISOString(),
+                sequence: this.#sequence,
+            },
+            api: { operationPrefix: AUTH_EXTENSION_OPERATION_PREFIX },
+            methods: [{
+                    id: 'password',
+                    extensionId: 'password',
+                    version: '1.1.0',
+                    display: {
+                        fallbackLabel: '密码登录',
+                        description: '使用邮箱与密码登录',
+                        iconKey: 'password',
+                        requestedOrder: 100,
+                    },
+                    capabilities: {
+                        login: true,
+                        registration: true,
+                        linking: false,
+                        unlinking: false,
+                        reauthentication: false,
+                        recovery: true,
+                    },
+                    flowKinds: ['direct', 'challenge'],
+                    rsc: {
+                        pluginId: 'auth.password',
+                        buildId: this.options.rscBuildId,
+                        slots: { login: '/login', registration: '/register', recovery: '/recovery' },
+                    },
+                }],
+        });
+    }
+}
+//# sourceMappingURL=auth-announcement-publisher.js.map

package/dist/runtime/auth-announcement-publisher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-announcement-publisher.js","sourceRoot":"","sources":["../../src/runtime/auth-announcement-publisher.ts"],"names":[],"mappings":"AACA,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,EAC/B,kBAAkB,GAEnB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAiBzE,MAAM,OAAO,yBAAyB;IAQA,OAAO;IAPlC,MAAM,CAAa;IAC5B,YAAY,CAA0B;IACtC,MAAM,CAA6B;IACnC,SAAS,GAAG,CAAC,CAAC,CAAC;IACf,SAAS,CAA4B;IACrC,QAAQ,CAA4B;IAEpC,YAAoC,OAAyC;uBAAzC,OAAO;QACzC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,gFAAgF;QAChF,iFAAiF;QACjF,IAAI,CAAC,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CACxD,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EACvD,YAAY,CACb,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO;YAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC3B,KAAK,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1B,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;oBAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC/D,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAEM,KAAK;QACV,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACpF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,OAAO,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;YAC5B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,MAAM;YAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,mBAAmB;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,OAAO,+BAA+B,CAAC,KAAK,CAAC;YAC3C,QAAQ,EAAE,iCAAiC;YAC3C,SAAS,EAAE;gBACT,EAAE,EAAE,UAAU;gBACd,OAAO,EAAE,OAAO;gBAChB,SAAS,EAAE,+BAA+B;gBAC1C,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBACnC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;aACpC;YACD,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;gBAChC,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;gBAC5E,QAAQ,EAAE,IAAI,CAAC,SAAS;aACzB;YACD,GAAG,EAAE,EAAE,eAAe,EAAE,+BAA+B,EAAE;YACzD,OAAO,EAAE,CAAC;oBACR,EAAE,EAAE,UAAU;oBACd,WAAW,EAAE,UAAU;oBACvB,OAAO,EAAE,OAAO;oBAChB,OAAO,EAAE;wBACP,aAAa,EAAE,MAAM;wBACrB,WAAW,EAAE,WAAW;wBACxB,OAAO,EAAE,UAAU;wBACnB,cAAc,EAAE,GAAG;qBACpB;oBACD,YAAY,EAAE;wBACZ,KAAK,EAAE,IAAI;wBACX,YAAY,EAAE,IAAI;wBAClB,OAAO,EAAE,KAAK;wBACd,SAAS,EAAE,KAAK;wBAChB,gBAAgB,EAAE,KAAK;wBACvB,QAAQ,EAAE,IAAI;qBACf;oBACD,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;oBAClC,GAAG,EAAE;wBACH,QAAQ,EAAE,eAAe;wBACzB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;wBAChC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE;qBAC7E;iBACF,CAAC;SACH,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/runtime/password-auth-runtime.d.ts

@@ -0,0 +1,33 @@
+import { type AuthenticationIntent, type AuthExtensionBeginResponse, type AuthExtensionCompleteResponse } from '@zlooks.cn/auth-extension-contract';
+import type { VerificationCodeRateLimiter } from '../email/verification-code-rate-limiter.js';
+import type { VerificationEmailSender } from '../email/verification-email-sender.js';
+import { type PasswordAuthenticator } from '../password/password-authenticator.js';
+import { type PasswordTransactionStateStore } from './password-state-store.js';
+type SupportedIntent = Extract<AuthenticationIntent, 'login' | 'registration' | 'recovery'>;
+export interface PasswordVerificationConfig {
+    readonly hmacKey: string;
+    readonly codeTtlMs: number;
+    readonly resendIntervalMs: number;
+    readonly maxSendsPerTransaction: number;
+    readonly maxVerificationAttempts: number;
+}
+export declare class PasswordAuthRuntime {
+    #private;
+    private readonly authenticator;
+    private readonly states;
+    private readonly clock;
+    private readonly verification?;
+    constructor(authenticator: PasswordAuthenticator, states: PasswordTransactionStateStore, clock?: () => Date, verification?: Readonly<{
+        config: PasswordVerificationConfig;
+        sender: VerificationEmailSender;
+        rateLimiter: VerificationCodeRateLimiter;
+        onDeliveryError?: (error: unknown, context: Readonly<{
+            transactionId: string;
+            intent: SupportedIntent;
+        }>) => void;
+    }> | undefined);
+    begin(input: unknown): Promise<AuthExtensionBeginResponse>;
+    complete(input: unknown): Promise<AuthExtensionCompleteResponse>;
+}
+export {};
+//# sourceMappingURL=password-auth-runtime.d.ts.map

package/dist/runtime/password-auth-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-auth-runtime.d.ts","sourceRoot":"","sources":["../../src/runtime/password-auth-runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,EACnC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AAC9F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAEL,KAAK,qBAAqB,EAE3B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,KAAK,6BAA6B,EAEnC,MAAM,2BAA2B,CAAC;AAYnC,KAAK,eAAe,GAAG,OAAO,CAAC,oBAAoB,EAAE,OAAO,GAAG,cAAc,GAAG,UAAU,CAAC,CAAC;AAE5F,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;CAC1C;AAED,qBAAa,mBAAmB;;IAE5B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAJhC,YACmB,aAAa,EAAE,qBAAqB,EACpC,MAAM,EAAE,6BAA6B,EACrC,KAAK,GAAE,MAAM,IAAuB,EACpC,YAAY,CAAC,EAAE,QAAQ,CAAC;QACvC,MAAM,EAAE,0BAA0B,CAAC;QACnC,MAAM,EAAE,uBAAuB,CAAC;QAChC,WAAW,EAAE,2BAA2B,CAAC;QACzC,eAAe,CAAC,EAAE,CAChB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,QAAQ,CAAC;YAAE,aAAa,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,eAAe,CAAA;SAAE,CAAC,KAClE,IAAI,CAAC;KACX,CAAC,YAAA,EACA;IAES,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAkBtE;IAEY,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAgD5E;CAkIF"}

package/dist/runtime/password-auth-runtime.js

@@ -0,0 +1,218 @@
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { authExtensionBeginRequestSchema, authExtensionCompleteRequestSchema, authIdentityAssertionSchema, } from '@zlooks.cn/auth-extension-contract';
+import { z } from 'zod';
+import { normalizeEmailIdentifier, } from '../password/password-authenticator.js';
+import {} from './password-state-store.js';
+const passwordLoginInputSchema = z.strictObject({ action: z.literal('password-login'), email: z.string(), password: z.string() });
+const legacyPasswordLoginInputSchema = z.strictObject({ identifier: z.string(), password: z.string() });
+const sendCodeInputSchema = z.strictObject({ action: z.literal('send-code'), email: z.string(), requestId: z.uuid() });
+const verifyCodeInputSchema = z.strictObject({
+    action: z.literal('verify-code'),
+    email: z.string(),
+    code: z.string().regex(/^\d{6}$/),
+    password: z.string().optional(),
+});
+export class PasswordAuthRuntime {
+    authenticator;
+    states;
+    clock;
+    verification;
+    constructor(authenticator, states, clock = () => new Date(), verification) {
+        this.authenticator = authenticator;
+        this.states = states;
+        this.clock = clock;
+        this.verification = verification;
+    }
+    async begin(input) {
+        const request = authExtensionBeginRequestSchema.parse(input);
+        if (request.methodId !== 'password')
+            throw new Error('Unsupported authentication method');
+        const intent = request.transaction.intent;
+        if (!supportedIntent(intent))
+            throw new Error('Password extension does not support this transaction intent');
+        return this.states.runExclusive(request.transaction.id, async () => {
+            const expiresAt = Date.parse(request.transaction.expiresAt);
+            const existing = await this.states.get(request.transaction.id);
+            if (existing) {
+                if (existing.expiresAt !== expiresAt || (existing.intent && existing.intent !== intent)) {
+                    throw new Error('Password authentication transaction ID was reused with different input');
+                }
+                return { status: 'input-required', providerState: existing.token };
+            }
+            const token = randomBytes(32).toString('base64url');
+            await this.states.put(request.transaction.id, { token, expiresAt, intent });
+            return { status: 'input-required', providerState: token };
+        });
+    }
+    async complete(input) {
+        const request = authExtensionCompleteRequestSchema.parse(input);
+        if (request.methodId !== 'password')
+            return { status: 'denied', code: 'policy-rejected' };
+        return this.states.runExclusive(request.transaction.id, async () => {
+            const state = await this.states.get(request.transaction.id);
+            const now = this.clock().getTime();
+            if (!state || state.expiresAt <= now || !safeEqual(state.token, request.providerState)) {
+                return { status: 'denied', code: 'expired' };
+            }
+            if (state.intent !== request.transaction.intent
+                || state.expiresAt !== Date.parse(request.transaction.expiresAt)
+                || !supportedIntent(request.transaction.intent)) {
+                return { status: 'denied', code: 'policy-rejected' };
+            }
+            if (state.verifiedAssertion) {
+                return state.verifiedAssertionExpiresAt !== undefined && state.verifiedAssertionExpiresAt > now
+                    ? { status: 'verified', assertion: state.verifiedAssertion }
+                    : { status: 'denied', code: 'expired' };
+            }
+            const sendCode = sendCodeInputSchema.safeParse(request.input);
+            if (sendCode.success)
+                return this.#sendCode(request.transaction.id, state.token, state.intent, sendCode.data);
+            const verifyCode = verifyCodeInputSchema.safeParse(request.input);
+            if (verifyCode.success) {
+                return this.#verifyCode(request.transaction.id, state.expiresAt, state.intent, state.verificationChallenge, verifyCode.data);
+            }
+            if (state.intent === 'login') {
+                const explicit = passwordLoginInputSchema.safeParse(request.input);
+                const legacy = legacyPasswordLoginInputSchema.safeParse(request.input);
+                const credentials = explicit.success
+                    ? { identifier: explicit.data.email, password: explicit.data.password }
+                    : legacy.success ? legacy.data : undefined;
+                if (credentials) {
+                    const result = await this.authenticator.verify(credentials);
+                    return result.ok
+                        ? this.#verified(request.transaction.id, state.expiresAt, result)
+                        : { status: 'denied', code: 'invalid-credentials' };
+                }
+            }
+            return { status: 'denied', code: 'invalid-credentials' };
+        });
+    }
+    async #sendCode(transactionId, providerState, intent, input) {
+        if (!this.verification)
+            return { status: 'denied', code: 'policy-rejected' };
+        const identifier = normalizeEmailIdentifier(input.email);
+        if (!identifier) {
+            return { status: 'denied', code: 'policy-rejected' };
+        }
+        const account = await this.authenticator.inspectIdentifier(identifier);
+        if (intent === 'registration' ? account.exists : !account.exists) {
+            return { status: 'denied', code: intent === 'registration' ? 'account-already-exists' : 'account-not-found' };
+        }
+        const state = await this.states.get(transactionId);
+        if (!state)
+            return { status: 'denied', code: 'expired' };
+        const prior = state.verificationChallenge;
+        if (prior?.requestId === input.requestId) {
+            return { status: 'pending', providerState, retryAfterMs: this.verification.config.resendIntervalMs };
+        }
+        const now = this.clock().getTime();
+        if ((prior && now - prior.sentAt < this.verification.config.resendIntervalMs)
+            || (prior?.sends ?? 0) >= this.verification.config.maxSendsPerTransaction
+            || (prior?.attempts ?? 0) >= this.verification.config.maxVerificationAttempts) {
+            return { status: 'denied', code: 'rate-limited' };
+        }
+        if (!await this.verification.rateLimiter.consume(identifier, intent)) {
+            return { status: 'denied', code: 'rate-limited' };
+        }
+        const challenge = {
+            id: randomUUID(), requestId: input.requestId, identifier, sentAt: now,
+            expiresAt: Math.min(now + this.verification.config.codeTtlMs, state.expiresAt),
+            sends: (prior?.sends ?? 0) + 1, attempts: prior?.attempts ?? 0,
+        };
+        await this.states.updateChallenge(transactionId, challenge);
+        try {
+            await this.verification.sender.send({
+                email: identifier,
+                code: deriveCode(this.verification.config.hmacKey, transactionId, challenge),
+                intent,
+                expiresInMinutes: Math.max(1, Math.ceil((challenge.expiresAt - now) / 60_000)),
+            });
+        }
+        catch (error) {
+            try {
+                this.verification.onDeliveryError?.(error, { transactionId, intent });
+            }
+            catch {
+                // Observability must not replace the bounded authentication response.
+            }
+            await this.states.updateChallenge(transactionId, prior);
+            return { status: 'denied', code: 'delivery-failed' };
+        }
+        return { status: 'pending', providerState, retryAfterMs: this.verification.config.resendIntervalMs };
+    }
+    async #verifyCode(transactionId, transactionExpiresAt, intent, challenge, input) {
+        if (!this.verification || !challenge)
+            return { status: 'denied', code: 'invalid-verification-code' };
+        const identifier = normalizeEmailIdentifier(input.email);
+        const expected = deriveCode(this.verification.config.hmacKey, transactionId, challenge);
+        if (!identifier || identifier !== challenge.identifier || challenge.expiresAt <= this.clock().getTime()
+            || challenge.attempts >= this.verification.config.maxVerificationAttempts || !safeEqual(expected, input.code)) {
+            const attempts = Math.min(this.verification.config.maxVerificationAttempts, challenge.attempts + 1);
+            if (attempts !== challenge.attempts) {
+                await this.states.updateChallenge(transactionId, { ...challenge, attempts });
+            }
+            return { status: 'denied', code: 'invalid-verification-code' };
+        }
+        let result;
+        if (intent === 'registration') {
+            if (!input.password)
+                return { status: 'denied', code: 'policy-rejected' };
+            result = await this.authenticator.registerVerified({
+                transactionId,
+                identifier,
+                password: input.password,
+            });
+            if (!result.ok) {
+                const inspected = await this.authenticator.inspectIdentifier(identifier);
+                return { status: 'denied', code: inspected.exists ? 'account-already-exists' : 'policy-rejected' };
+            }
+        }
+        else if (intent === 'recovery') {
+            if (!input.password)
+                return { status: 'denied', code: 'policy-rejected' };
+            result = await this.authenticator.resetPassword({
+                transactionId,
+                identifier,
+                password: input.password,
+            });
+            if (!result.ok) {
+                const inspected = await this.authenticator.inspectIdentifier(identifier);
+                return { status: 'denied', code: inspected.exists ? 'policy-rejected' : 'account-not-found' };
+            }
+        }
+        else {
+            result = await this.authenticator.verifyEmailIdentity(identifier);
+            if (!result.ok)
+                return { status: 'denied', code: 'account-not-found' };
+        }
+        return this.#verified(transactionId, transactionExpiresAt, { ...result, emailVerified: true });
+    }
+    async #verified(transactionId, transactionExpiresAt, result) {
+        const issuedAt = this.clock();
+        const assertionExpiresAt = Math.min(issuedAt.getTime() + 30_000, transactionExpiresAt);
+        if (assertionExpiresAt <= issuedAt.getTime())
+            return { status: 'denied', code: 'expired' };
+        const assertion = authIdentityAssertionSchema.parse({
+            protocol: 'zlooks.auth-extension.identity-assertion',
+            transactionId, extensionId: 'password', methodId: 'password', subject: result.subject,
+            issuedAt: issuedAt.toISOString(), expiresAt: new Date(assertionExpiresAt).toISOString(),
+            attributes: { email: result.identifier, emailVerified: result.emailVerified },
+        });
+        await this.states.markVerified(transactionId, assertion, assertionExpiresAt);
+        return { status: 'verified', assertion };
+    }
+}
+function deriveCode(hmacKey, transactionId, challenge) {
+    const digest = createHmac('sha256', Buffer.from(hmacKey, 'base64'))
+        .update(`${transactionId}\0${challenge.id}\0${challenge.identifier}`).digest();
+    return (digest.readUInt32BE(0) % 1_000_000).toString().padStart(6, '0');
+}
+function safeEqual(left, right) {
+    const leftBytes = Buffer.from(left);
+    const rightBytes = Buffer.from(right);
+    return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+function supportedIntent(value) {
+    return value === 'login' || value === 'registration' || value === 'recovery';
+}
+//# sourceMappingURL=password-auth-runtime.js.map

package/dist/runtime/password-auth-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-auth-runtime.js","sourceRoot":"","sources":["../../src/runtime/password-auth-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EACL,+BAA+B,EAC/B,kCAAkC,EAClC,2BAA2B,GAI5B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EACL,wBAAwB,GAGzB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAGN,MAAM,2BAA2B,CAAC;AAEnC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClI,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxG,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvH,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAYH,MAAM,OAAO,mBAAmB;IAEX,aAAa;IACb,MAAM;IACN,KAAK;IACL,YAAY;IAJ/B,YACmB,aAAoC,EACpC,MAAqC,EACrC,KAAK,GAAe,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EACpC,YAQf;6BAXe,aAAa;sBACb,MAAM;qBACN,KAAK;4BACL,YAAY;IAS5B,CAAC;IAEG,KAAK,CAAC,KAAK,CAAC,KAAc;QAC/B,MAAM,OAAO,GAAG,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC7G,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC/D,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;oBACxF,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;gBAC5F,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;YACrE,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,KAAc;QAClC,MAAM,OAAO,GAAG,kCAAkC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBACvF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,MAAM;mBAC1C,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC;mBAC7D,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YACvD,CAAC;YACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,0BAA0B,KAAK,SAAS,IAAI,KAAK,CAAC,0BAA0B,GAAG,GAAG;oBAC7F,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,iBAAiB,EAAE;oBAC5D,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC5C,CAAC;YAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,QAAQ,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9G,MAAM,UAAU,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC,WAAW,CACrB,OAAO,CAAC,WAAW,CAAC,EAAE,EACtB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,qBAAqB,EAC3B,UAAU,CAAC,IAAI,CAChB,CAAC;YACJ,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnE,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACvE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO;oBAClC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE;oBACvE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7C,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;oBAC5D,OAAO,MAAM,CAAC,EAAE;wBACd,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC;wBACjE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;gBACxD,CAAC;YACH,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CACb,aAAqB,EACrB,aAAqB,EACrB,MAAuB,EACvB,KAA0C;QAE1C,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAC7E,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACjE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;QAChH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,qBAAqB,CAAC;QAC1C,IAAI,KAAK,EAAE,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACvG,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,gBAAgB,CAAC;eACxE,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,sBAAsB;eACtE,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC;YAChF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,SAAS,GAAkC;YAC/C,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG;YACrE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;YAC9E,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,CAAC;SAC/D,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;gBAClC,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC;gBAC5E,MAAM;gBACN,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;aAC/E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;YACxE,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QACvD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;IACvG,CAAC;IAED,KAAK,CAAC,WAAW,CACf,aAAqB,EACrB,oBAA4B,EAC5B,MAAuB,EACvB,SAAoD,EACpD,KAA4C;QAE5C,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;QACrG,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE;eAClG,SAAS,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,uBAAuB,EAChD,SAAS,CAAC,QAAQ,GAAG,CAAC,CACvB,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,MAA2F,CAAC;QAChG,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAC1E,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC;gBACjD,aAAa;gBACb,UAAU;gBACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACzE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;YACrG,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAC1E,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;gBAC9C,aAAa;gBACb,UAAU;gBACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACzE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;YAChG,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CACnB,aAAa,EACb,oBAAoB,EACpB,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CACb,aAAqB,EACrB,oBAA4B,EAC5B,MAAiF;QAEjF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,oBAAoB,CAAC,CAAC;QACvF,IAAI,kBAAkB,IAAI,QAAQ,CAAC,OAAO,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC3F,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC;YAClD,QAAQ,EAAE,0CAA0C;YACpD,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;YACrF,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,kBAAkB,CAAC,CAAC,WAAW,EAAE;YACvF,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE;SAC9E,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAC7E,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;CACF;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,aAAqB,EAAE,SAAwC;IAClG,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;SAChE,MAAM,CAAC,GAAG,aAAa,KAAK,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACjF,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,eAAe,CAAC,KAA2B;IAClD,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,UAAU,CAAC;AAC/E,CAAC"}

package/dist/runtime/password-state-store.d.ts

@@ -0,0 +1,49 @@
+import type { Redis } from 'ioredis';
+import { type AuthIdentityAssertion } from '@zlooks.cn/auth-extension-contract';
+export interface PasswordTransactionState {
+    readonly token: string;
+    readonly expiresAt: number;
+    readonly intent?: 'login' | 'registration' | 'recovery';
+    readonly verificationChallenge?: PasswordVerificationChallenge;
+    readonly verifiedAssertion?: AuthIdentityAssertion;
+    readonly verifiedAssertionExpiresAt?: number;
+}
+export interface PasswordVerificationChallenge {
+    readonly id: string;
+    readonly requestId: string;
+    readonly identifier: string;
+    readonly sentAt: number;
+    readonly expiresAt: number;
+    readonly sends: number;
+    readonly attempts: number;
+}
+export interface PasswordTransactionStateStore {
+    put(transactionId: string, state: PasswordTransactionState): Promise<void>;
+    get(transactionId: string): Promise<PasswordTransactionState | undefined>;
+    delete(transactionId: string): Promise<void>;
+    markVerified(transactionId: string, assertion: AuthIdentityAssertion, assertionExpiresAt: number): Promise<void>;
+    updateChallenge(transactionId: string, challenge?: PasswordVerificationChallenge): Promise<void>;
+    runExclusive<T>(transactionId: string, operation: () => Promise<T>): Promise<T>;
+}
+export declare class InMemoryPasswordTransactionStateStore implements PasswordTransactionStateStore {
+    #private;
+    put(transactionId: string, state: PasswordTransactionState): Promise<void>;
+    get(transactionId: string): Promise<PasswordTransactionState | undefined>;
+    delete(transactionId: string): Promise<void>;
+    markVerified(transactionId: string, assertion: AuthIdentityAssertion, assertionExpiresAt: number): Promise<void>;
+    updateChallenge(transactionId: string, challenge?: PasswordVerificationChallenge): Promise<void>;
+    runExclusive<T>(_transactionId: string, operation: () => Promise<T>): Promise<T>;
+}
+export declare class RedisPasswordTransactionStateStore implements PasswordTransactionStateStore {
+    #private;
+    private readonly redis;
+    constructor(redis: Redis);
+    put(transactionId: string, state: PasswordTransactionState): Promise<void>;
+    get(transactionId: string): Promise<PasswordTransactionState | undefined>;
+    delete(transactionId: string): Promise<void>;
+    markVerified(transactionId: string, assertion: AuthIdentityAssertion, assertionExpiresAt: number): Promise<void>;
+    updateChallenge(transactionId: string, challenge?: PasswordVerificationChallenge): Promise<void>;
+    runExclusive<T>(transactionId: string, operation: () => Promise<T>): Promise<T>;
+    private key;
+}
+//# sourceMappingURL=password-state-store.d.ts.map

package/dist/runtime/password-state-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-state-store.d.ts","sourceRoot":"","sources":["../../src/runtime/password-state-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,cAAc,GAAG,UAAU,CAAC;IACxD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IAC/D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;CAC9C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,6BAA6B;IAC5C,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,GAAG,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IAC1E,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,YAAY,CACV,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,qBAAqB,EAChC,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjG,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACjF;AAED,qBAAa,qCAAsC,YAAW,6BAA6B;;IAG5E,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtF;IAEY,GAAG,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAGrF;IAEY,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExD;IAEY,YAAY,CACvB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,qBAAqB,EAChC,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEY,eAAe,CAC1B,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,6BAA6B,GACxC,OAAO,CAAC,IAAI,CAAC,CAQf;IAEY,YAAY,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAE5F;CACF;AAED,qBAAa,kCAAmC,YAAW,6BAA6B;;IAGnE,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAzC,YAAoC,KAAK,EAAE,KAAK,EAE/C;IAEY,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtF;IAEY,GAAG,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAqBrF;IAEY,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExD;IAEY,YAAY,CACvB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,qBAAqB,EAChC,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,IAAI,CAAC,CAWf;IAEY,eAAe,CAC1B,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,6BAA6B,GACxC,OAAO,CAAC,IAAI,CAAC,CAWf;IAEY,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAM3F;IAED,OAAO,CAAC,GAAG;CAGZ"}

package/dist/runtime/password-state-store.js

@@ -0,0 +1,130 @@
+import { RedisLock } from '@hile/redis-lock';
+import { authIdentityAssertionSchema, } from '@zlooks.cn/auth-extension-contract';
+export class InMemoryPasswordTransactionStateStore {
+    #states = new Map();
+    async put(transactionId, state) {
+        this.#states.set(transactionId, structuredClone(state));
+    }
+    async get(transactionId) {
+        const state = this.#states.get(transactionId);
+        return state ? structuredClone(state) : undefined;
+    }
+    async delete(transactionId) {
+        this.#states.delete(transactionId);
+    }
+    async markVerified(transactionId, assertion, assertionExpiresAt) {
+        const state = this.#states.get(transactionId);
+        if (!state)
+            throw new Error('Password authentication transaction is expired or unavailable');
+        this.#states.set(transactionId, { ...state, verifiedAssertion: assertion, verifiedAssertionExpiresAt: assertionExpiresAt });
+    }
+    async updateChallenge(transactionId, challenge) {
+        const state = this.#states.get(transactionId);
+        if (!state)
+            throw new Error('Password authentication transaction is expired or unavailable');
+        const { verificationChallenge: _current, ...rest } = state;
+        this.#states.set(transactionId, {
+            ...rest,
+            ...(challenge ? { verificationChallenge: structuredClone(challenge) } : {}),
+        });
+    }
+    async runExclusive(_transactionId, operation) {
+        return operation();
+    }
+}
+export class RedisPasswordTransactionStateStore {
+    redis;
+    #locks;
+    constructor(redis) {
+        this.redis = redis;
+        this.#locks = new RedisLock(redis, { prefix: 'locks:', defaultTtl: 30_000 });
+    }
+    async put(transactionId, state) {
+        const ttl = state.expiresAt - Date.now();
+        if (ttl <= 0)
+            throw new Error('Password authentication transaction is already expired');
+        const created = await this.redis.set(this.key(transactionId), JSON.stringify(state), 'PX', ttl, 'NX');
+        if (created !== 'OK')
+            throw new Error('Password authentication transaction already exists');
+    }
+    async get(transactionId) {
+        const value = await this.redis.get(this.key(transactionId));
+        if (!value)
+            return undefined;
+        const parsed = JSON.parse(value);
+        const assertion = authIdentityAssertionSchema.safeParse(parsed.verifiedAssertion);
+        return typeof parsed.token === 'string' && typeof parsed.expiresAt === 'number'
+            ? {
+                token: parsed.token,
+                expiresAt: parsed.expiresAt,
+                ...(parsed.intent === 'login' || parsed.intent === 'registration' || parsed.intent === 'recovery'
+                    ? { intent: parsed.intent }
+                    : {}),
+                ...(validChallenge(parsed.verificationChallenge) ? { verificationChallenge: parsed.verificationChallenge } : {}),
+                ...(assertion.success && typeof parsed.verifiedAssertionExpiresAt === 'number'
+                    ? {
+                        verifiedAssertion: assertion.data,
+                        verifiedAssertionExpiresAt: parsed.verifiedAssertionExpiresAt,
+                    }
+                    : {}),
+            }
+            : undefined;
+    }
+    async delete(transactionId) {
+        await this.redis.del(this.key(transactionId));
+    }
+    async markVerified(transactionId, assertion, assertionExpiresAt) {
+        const state = await this.get(transactionId);
+        if (!state)
+            throw new Error('Password authentication transaction is expired or unavailable');
+        const ttl = state.expiresAt - Date.now();
+        if (ttl <= 0)
+            throw new Error('Password authentication transaction is expired or unavailable');
+        const saved = await this.redis.set(this.key(transactionId), JSON.stringify({
+            ...state,
+            verifiedAssertion: assertion,
+            verifiedAssertionExpiresAt: assertionExpiresAt,
+        }), 'PX', ttl, 'XX');
+        if (saved !== 'OK')
+            throw new Error('Password authentication transaction is expired or unavailable');
+    }
+    async updateChallenge(transactionId, challenge) {
+        const state = await this.get(transactionId);
+        if (!state)
+            throw new Error('Password authentication transaction is expired or unavailable');
+        const ttl = state.expiresAt - Date.now();
+        if (ttl <= 0)
+            throw new Error('Password authentication transaction is expired or unavailable');
+        const { verificationChallenge: _current, ...rest } = state;
+        const saved = await this.redis.set(this.key(transactionId), JSON.stringify({
+            ...rest,
+            ...(challenge ? { verificationChallenge: challenge } : {}),
+        }), 'PX', ttl, 'XX');
+        if (saved !== 'OK')
+            throw new Error('Password authentication transaction is expired or unavailable');
+    }
+    async runExclusive(transactionId, operation) {
+        return this.#locks.withLock(`password-transaction:${transactionId}`, {
+            wait: 2_000,
+            ttl: 30_000,
+            renew: true,
+        }, async () => operation());
+    }
+    key(transactionId) {
+        return `transactions:${transactionId}`;
+    }
+}
+function validChallenge(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const challenge = value;
+    return typeof challenge.id === 'string' && UUID.test(challenge.id)
+        && typeof challenge.requestId === 'string' && UUID.test(challenge.requestId)
+        && typeof challenge.identifier === 'string' && challenge.identifier.length <= 320
+        && Number.isSafeInteger(challenge.sentAt) && (challenge.sentAt ?? -1) >= 0
+        && Number.isSafeInteger(challenge.expiresAt) && (challenge.expiresAt ?? -1) > (challenge.sentAt ?? Infinity)
+        && Number.isSafeInteger(challenge.sends) && (challenge.sends ?? -1) >= 0
+        && Number.isSafeInteger(challenge.attempts) && (challenge.attempts ?? -1) >= 0;
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+//# sourceMappingURL=password-state-store.js.map

package/dist/runtime/password-state-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-state-store.js","sourceRoot":"","sources":["../../src/runtime/password-state-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EACL,2BAA2B,GAE5B,MAAM,oCAAoC,CAAC;AAkC5C,MAAM,OAAO,qCAAqC;IACvC,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAExD,KAAK,CAAC,GAAG,CAAC,aAAqB,EAAE,KAA+B;QACrE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,aAAqB;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,aAAqB;QACvC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACrC,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,aAAqB,EACrB,SAAgC,EAChC,kBAA0B;QAE1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,GAAG,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9H,CAAC;IAEM,KAAK,CAAC,eAAe,CAC1B,aAAqB,EACrB,SAAyC;QAEzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC7F,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE;YAC9B,GAAG,IAAI;YACP,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,YAAY,CAAI,cAAsB,EAAE,SAA2B;QAC9E,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;CACF;AAED,MAAM,OAAO,kCAAkC;IAGT,KAAK;IAFhC,MAAM,CAAY;IAE3B,YAAoC,KAAY;qBAAZ,KAAK;QACvC,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,aAAqB,EAAE,KAA+B;QACrE,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzC,IAAI,GAAG,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EACvB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EACrB,IAAI,EACJ,GAAG,EACH,IAAI,CACL,CAAC;QACF,IAAI,OAAO,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC9F,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,aAAqB;QACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAsC,CAAC;QACtE,MAAM,SAAS,GAAG,2BAA2B,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAClF,OAAO,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAC7E,CAAC,CAAC;gBACA,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;oBAC/F,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;oBAC3B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChH,GAAG,CAAC,SAAS,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,0BAA0B,KAAK,QAAQ;oBAC5E,CAAC,CAAC;wBACA,iBAAiB,EAAE,SAAS,CAAC,IAAI;wBACjC,0BAA0B,EAAE,MAAM,CAAC,0BAA0B;qBAC9D;oBACD,CAAC,CAAC,EAAE,CAAC;aACR;YACD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,aAAqB;QACvC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAChD,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,aAAqB,EACrB,SAAgC,EAChC,kBAA0B;QAE1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzC,IAAI,GAAG,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;YACzE,GAAG,KAAK;YACR,iBAAiB,EAAE,SAAS;YAC5B,0BAA0B,EAAE,kBAAkB;SAC/C,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACvG,CAAC;IAEM,KAAK,CAAC,eAAe,CAC1B,aAAqB,EACrB,SAAyC;QAEzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzC,IAAI,GAAG,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/F,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;YACzE,GAAG,IAAI;YACP,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACvG,CAAC;IAEM,KAAK,CAAC,YAAY,CAAI,aAAqB,EAAE,SAA2B;QAC7E,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,aAAa,EAAE,EAAE;YACnE,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,MAAM;YACX,KAAK,EAAE,IAAI;SACZ,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9B,CAAC;IAEO,GAAG,CAAC,aAAqB;QAC/B,OAAO,gBAAgB,aAAa,EAAE,CAAC;IACzC,CAAC;CACF;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,SAAS,GAAG,KAA+C,CAAC;IAClE,OAAO,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;WAC7D,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;WACzE,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,IAAI,GAAG;WAC9E,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;WACvE,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,QAAQ,CAAC;WACzG,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;WACrE,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,IAAI,GAAG,4EAA4E,CAAC"}

package/dist/service-identity.d.ts

@@ -0,0 +1,2 @@
+export declare const PASSWORD_AUTH_SERVICE_NAMESPACE = "cn.zlooks.password.auth.server";
+//# sourceMappingURL=service-identity.d.ts.map

package/dist/service-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-identity.d.ts","sourceRoot":"","sources":["../src/service-identity.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,+BAA+B,mCAAmC,CAAC"}

package/dist/service-identity.js

@@ -0,0 +1,2 @@
+export const PASSWORD_AUTH_SERVICE_NAMESPACE = 'cn.zlooks.password.auth.server';
+//# sourceMappingURL=service-identity.js.map

package/dist/service-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-identity.js","sourceRoot":"","sources":["../src/service-identity.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,+BAA+B,GAAG,gCAAgC,CAAC"}