@zlooks.cn/password-auth-server 1.0.9 → 1.1.0

package/.hile-rsc/{build-mu2ebvjj-b7c71e74/client-browser/src-plugin-password-form-3bd63d69e5-4TOGMUOJ.js → build-mu41ll5m-02df9102/client-browser/src-plugin-password-form-3bd63d69e5-MO3JJSBS.js}

@@ -162,92 +162,6 @@ var require_EyeOutlined = __commonJS({
   }
 });
 
-// ../user-shared/dist/identity.js
-var USER_SERVICE_NAMESPACE = "cn.zlooks.user.server";
-
-// ../user-shared/dist/events/snapshots.js
-var userSessionRevocationReasonSchema = external_exports.enum([
-  "logout",
-  "user-request",
-  "family-limit",
-  "credential-recovery"
-]);
-var displayNameSchema = external_exports.string().refine((value) => value === value.trim().normalize("NFKC"), "Display name must be normalized").refine((value) => Array.from(value).length >= 1 && Array.from(value).length <= 160, "Display name must contain 1 to 160 Unicode code points");
-var bioSchema = external_exports.string().refine((value) => value === value.trim().normalize("NFKC"), "Bio must be normalized").refine((value) => Array.from(value).length >= 1 && Array.from(value).length <= 500, "Bio must contain 1 to 500 Unicode code points");
-var httpUrlSchema = external_exports.url().max(2048).refine((value) => {
-  const protocol = new URL(value).protocol;
-  return protocol === "http:" || protocol === "https:";
-}, "URL must use HTTP or HTTPS").refine((value) => value === new URL(value).toString(), "URL must be canonical");
-var emailSchema = external_exports.email().max(320).refine((value) => value === value.toLocaleLowerCase("en-US"), "Email must be lowercase");
-var userEventSnapshotSchema = external_exports.strictObject({
-  id: external_exports.uuid(),
-  displayName: displayNameSchema.nullable(),
-  avatar: httpUrlSchema.nullable(),
-  homepage: httpUrlSchema.nullable(),
-  bio: bioSchema.nullable(),
-  email: emailSchema.nullable(),
-  emailVerified: external_exports.boolean(),
-  status: external_exports.enum(["active", "disabled", "deleted"]),
-  createdAt: external_exports.iso.datetime({ offset: true }),
-  updatedAt: external_exports.iso.datetime({ offset: true }),
-  version: external_exports.number().int().positive()
-}).superRefine((user, context) => {
-  if (user.emailVerified && user.email === null) {
-    context.addIssue({
-      code: "custom",
-      message: "A verified user snapshot must include its email",
-      path: ["email"]
-    });
-  }
-  if (Date.parse(user.updatedAt) < Date.parse(user.createdAt)) {
-    context.addIssue({
-      code: "custom",
-      message: "User updated time must not precede creation time",
-      path: ["updatedAt"]
-    });
-  }
-}).readonly();
-var userSessionFamilyEventSnapshotSchema = external_exports.strictObject({
-  id: external_exports.uuid(),
-  userId: external_exports.uuid(),
-  createdAt: external_exports.iso.datetime({ offset: true }),
-  expiresAt: external_exports.iso.datetime({ offset: true }),
-  lastSeenAt: external_exports.iso.datetime({ offset: true }),
-  revokedAt: external_exports.iso.datetime({ offset: true }).nullable(),
-  revokeReason: userSessionRevocationReasonSchema.nullable()
-}).superRefine((session, context) => {
-  const createdAt = Date.parse(session.createdAt);
-  if (session.revokedAt === null !== (session.revokeReason === null)) {
-    context.addIssue({
-      code: "custom",
-      message: "Session revocation time and reason must be present together",
-      path: ["revokedAt"]
-    });
-  }
-  if (Date.parse(session.expiresAt) <= createdAt) {
-    context.addIssue({
-      code: "custom",
-      message: "Session expiry must follow creation time",
-      path: ["expiresAt"]
-    });
-  }
-  const lastSeenAt = Date.parse(session.lastSeenAt);
-  if (lastSeenAt < createdAt || lastSeenAt > Date.parse(session.expiresAt)) {
-    context.addIssue({
-      code: "custom",
-      message: "Session last-seen time must fall within its lifetime",
-      path: ["lastSeenAt"]
-    });
-  }
-  if (session.revokedAt !== null && Date.parse(session.revokedAt) < createdAt) {
-    context.addIssue({
-      code: "custom",
-      message: "Session revoked time must not precede creation time",
-      path: ["revokedAt"]
-    });
-  }
-}).readonly();
-
 // ../event-bus/dist/index.js
 var EVENT_PROTOCOL = "zlooks.event";
 var EVENT_PROTOCOL_VERSION = 1;
@@ -390,6 +304,92 @@ function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+// ../user-shared/dist/identity.js
+var USER_SERVICE_NAMESPACE = "cn.zlooks.user.server";
+
+// ../user-shared/dist/events/snapshots.js
+var userSessionRevocationReasonSchema = external_exports.enum([
+  "logout",
+  "user-request",
+  "family-limit",
+  "credential-recovery"
+]);
+var displayNameSchema = external_exports.string().refine((value) => value === value.trim().normalize("NFKC"), "Display name must be normalized").refine((value) => Array.from(value).length >= 1 && Array.from(value).length <= 160, "Display name must contain 1 to 160 Unicode code points");
+var bioSchema = external_exports.string().refine((value) => value === value.trim().normalize("NFKC"), "Bio must be normalized").refine((value) => Array.from(value).length >= 1 && Array.from(value).length <= 500, "Bio must contain 1 to 500 Unicode code points");
+var httpUrlSchema = external_exports.url().max(2048).refine((value) => {
+  const protocol = new URL(value).protocol;
+  return protocol === "http:" || protocol === "https:";
+}, "URL must use HTTP or HTTPS").refine((value) => value === new URL(value).toString(), "URL must be canonical");
+var emailSchema = external_exports.email().max(320).refine((value) => value === value.toLocaleLowerCase("en-US"), "Email must be lowercase");
+var userEventSnapshotSchema = external_exports.strictObject({
+  id: external_exports.uuid(),
+  displayName: displayNameSchema.nullable(),
+  avatar: httpUrlSchema.nullable(),
+  homepage: httpUrlSchema.nullable(),
+  bio: bioSchema.nullable(),
+  email: emailSchema.nullable(),
+  emailVerified: external_exports.boolean(),
+  status: external_exports.enum(["active", "disabled", "deleted"]),
+  createdAt: external_exports.iso.datetime({ offset: true }),
+  updatedAt: external_exports.iso.datetime({ offset: true }),
+  version: external_exports.number().int().positive()
+}).superRefine((user, context) => {
+  if (user.emailVerified && user.email === null) {
+    context.addIssue({
+      code: "custom",
+      message: "A verified user snapshot must include its email",
+      path: ["email"]
+    });
+  }
+  if (Date.parse(user.updatedAt) < Date.parse(user.createdAt)) {
+    context.addIssue({
+      code: "custom",
+      message: "User updated time must not precede creation time",
+      path: ["updatedAt"]
+    });
+  }
+}).readonly();
+var userSessionFamilyEventSnapshotSchema = external_exports.strictObject({
+  id: external_exports.uuid(),
+  userId: external_exports.uuid(),
+  createdAt: external_exports.iso.datetime({ offset: true }),
+  expiresAt: external_exports.iso.datetime({ offset: true }),
+  lastSeenAt: external_exports.iso.datetime({ offset: true }),
+  revokedAt: external_exports.iso.datetime({ offset: true }).nullable(),
+  revokeReason: userSessionRevocationReasonSchema.nullable()
+}).superRefine((session, context) => {
+  const createdAt = Date.parse(session.createdAt);
+  if (session.revokedAt === null !== (session.revokeReason === null)) {
+    context.addIssue({
+      code: "custom",
+      message: "Session revocation time and reason must be present together",
+      path: ["revokedAt"]
+    });
+  }
+  if (Date.parse(session.expiresAt) <= createdAt) {
+    context.addIssue({
+      code: "custom",
+      message: "Session expiry must follow creation time",
+      path: ["expiresAt"]
+    });
+  }
+  const lastSeenAt = Date.parse(session.lastSeenAt);
+  if (lastSeenAt < createdAt || lastSeenAt > Date.parse(session.expiresAt)) {
+    context.addIssue({
+      code: "custom",
+      message: "Session last-seen time must fall within its lifetime",
+      path: ["lastSeenAt"]
+    });
+  }
+  if (session.revokedAt !== null && Date.parse(session.revokedAt) < createdAt) {
+    context.addIssue({
+      code: "custom",
+      message: "Session revoked time must not precede creation time",
+      path: ["revokedAt"]
+    });
+  }
+}).readonly();
+
 // ../user-shared/dist/events/definition.js
 function defineUserEvent(type, aggregateType2, dataSchema5, aggregateId2) {
   return defineEvent(type, dataSchema5, {
@@ -521,6 +521,7 @@ var USER_EVENT_CATALOG = defineEventCatalog({
 
 // ../user-shared/dist/index.js
 var USER_CREDENTIAL_LIFECYCLE_PROTOCOL = "zlooks.user.credential-lifecycle";
+var USER_CREDENTIAL_LIFECYCLE_EVENT_TYPE = "cn.zlooks.password.credential-lifecycle.v1";
 var USER_ACCOUNT_HREF = "/user.account/account";
 var USER_BROWSER_AUTH_METHODS_PATH = browserApiPath(USER_SERVICE_NAMESPACE, "/api/auth/methods");
 var USER_BROWSER_AUTH_TRANSACTIONS_PATH = browserApiPath(USER_SERVICE_NAMESPACE, "/api/auth/transactions");
@@ -744,6 +745,11 @@ var userCredentialLifecycleEventSchema = external_exports.strictObject({
   email: external_exports.email().max(320),
   occurredAt: external_exports.iso.datetime({ offset: true })
 }).readonly();
+var userCredentialLifecycleDomainEvent = defineEvent(USER_CREDENTIAL_LIFECYCLE_EVENT_TYPE, userCredentialLifecycleEventSchema, {
+  producer: "cn.zlooks.password.auth.server",
+  aggregateType: "credential",
+  aggregateId: ({ subject }) => subject
+});
 var userCredentialLifecycleResponseSchema = external_exports.strictObject({
   acknowledged: external_exports.literal(true)
 }).readonly();

package/.hile-rsc/{build-mu2ebvjj-b7c71e74/client-ssr/src-plugin-password-form-3bd63d69e5-S65T2FFP.js → build-mu41ll5m-02df9102/client-ssr/src-plugin-password-form-3bd63d69e5-MWQ7H3E5.js}

@@ -119703,92 +119703,6 @@ var require_lib48 = __commonJS({
   }
 });
 
-// ../user-shared/dist/identity.js
-var USER_SERVICE_NAMESPACE = "cn.zlooks.user.server";
-
-// ../user-shared/dist/events/snapshots.js
-var userSessionRevocationReasonSchema = external_exports.enum([
-  "logout",
-  "user-request",
-  "family-limit",
-  "credential-recovery"
-]);
-var displayNameSchema = external_exports.string().refine((value) => value === value.trim().normalize("NFKC"), "Display name must be normalized").refine((value) => Array.from(value).length >= 1 && Array.from(value).length <= 160, "Display name must contain 1 to 160 Unicode code points");
-var bioSchema = external_exports.string().refine((value) => value === value.trim().normalize("NFKC"), "Bio must be normalized").refine((value) => Array.from(value).length >= 1 && Array.from(value).length <= 500, "Bio must contain 1 to 500 Unicode code points");
-var httpUrlSchema = external_exports.url().max(2048).refine((value) => {
-  const protocol = new URL(value).protocol;
-  return protocol === "http:" || protocol === "https:";
-}, "URL must use HTTP or HTTPS").refine((value) => value === new URL(value).toString(), "URL must be canonical");
-var emailSchema = external_exports.email().max(320).refine((value) => value === value.toLocaleLowerCase("en-US"), "Email must be lowercase");
-var userEventSnapshotSchema = external_exports.strictObject({
-  id: external_exports.uuid(),
-  displayName: displayNameSchema.nullable(),
-  avatar: httpUrlSchema.nullable(),
-  homepage: httpUrlSchema.nullable(),
-  bio: bioSchema.nullable(),
-  email: emailSchema.nullable(),
-  emailVerified: external_exports.boolean(),
-  status: external_exports.enum(["active", "disabled", "deleted"]),
-  createdAt: external_exports.iso.datetime({ offset: true }),
-  updatedAt: external_exports.iso.datetime({ offset: true }),
-  version: external_exports.number().int().positive()
-}).superRefine((user, context) => {
-  if (user.emailVerified && user.email === null) {
-    context.addIssue({
-      code: "custom",
-      message: "A verified user snapshot must include its email",
-      path: ["email"]
-    });
-  }
-  if (Date.parse(user.updatedAt) < Date.parse(user.createdAt)) {
-    context.addIssue({
-      code: "custom",
-      message: "User updated time must not precede creation time",
-      path: ["updatedAt"]
-    });
-  }
-}).readonly();
-var userSessionFamilyEventSnapshotSchema = external_exports.strictObject({
-  id: external_exports.uuid(),
-  userId: external_exports.uuid(),
-  createdAt: external_exports.iso.datetime({ offset: true }),
-  expiresAt: external_exports.iso.datetime({ offset: true }),
-  lastSeenAt: external_exports.iso.datetime({ offset: true }),
-  revokedAt: external_exports.iso.datetime({ offset: true }).nullable(),
-  revokeReason: userSessionRevocationReasonSchema.nullable()
-}).superRefine((session, context) => {
-  const createdAt = Date.parse(session.createdAt);
-  if (session.revokedAt === null !== (session.revokeReason === null)) {
-    context.addIssue({
-      code: "custom",
-      message: "Session revocation time and reason must be present together",
-      path: ["revokedAt"]
-    });
-  }
-  if (Date.parse(session.expiresAt) <= createdAt) {
-    context.addIssue({
-      code: "custom",
-      message: "Session expiry must follow creation time",
-      path: ["expiresAt"]
-    });
-  }
-  const lastSeenAt = Date.parse(session.lastSeenAt);
-  if (lastSeenAt < createdAt || lastSeenAt > Date.parse(session.expiresAt)) {
-    context.addIssue({
-      code: "custom",
-      message: "Session last-seen time must fall within its lifetime",
-      path: ["lastSeenAt"]
-    });
-  }
-  if (session.revokedAt !== null && Date.parse(session.revokedAt) < createdAt) {
-    context.addIssue({
-      code: "custom",
-      message: "Session revoked time must not precede creation time",
-      path: ["revokedAt"]
-    });
-  }
-}).readonly();
-
 // ../event-bus/dist/index.js
 var EVENT_PROTOCOL = "zlooks.event";
 var EVENT_PROTOCOL_VERSION = 1;
@@ -119931,6 +119845,92 @@ function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+// ../user-shared/dist/identity.js
+var USER_SERVICE_NAMESPACE = "cn.zlooks.user.server";
+
+// ../user-shared/dist/events/snapshots.js
+var userSessionRevocationReasonSchema = external_exports.enum([
+  "logout",
+  "user-request",
+  "family-limit",
+  "credential-recovery"
+]);
+var displayNameSchema = external_exports.string().refine((value) => value === value.trim().normalize("NFKC"), "Display name must be normalized").refine((value) => Array.from(value).length >= 1 && Array.from(value).length <= 160, "Display name must contain 1 to 160 Unicode code points");
+var bioSchema = external_exports.string().refine((value) => value === value.trim().normalize("NFKC"), "Bio must be normalized").refine((value) => Array.from(value).length >= 1 && Array.from(value).length <= 500, "Bio must contain 1 to 500 Unicode code points");
+var httpUrlSchema = external_exports.url().max(2048).refine((value) => {
+  const protocol = new URL(value).protocol;
+  return protocol === "http:" || protocol === "https:";
+}, "URL must use HTTP or HTTPS").refine((value) => value === new URL(value).toString(), "URL must be canonical");
+var emailSchema = external_exports.email().max(320).refine((value) => value === value.toLocaleLowerCase("en-US"), "Email must be lowercase");
+var userEventSnapshotSchema = external_exports.strictObject({
+  id: external_exports.uuid(),
+  displayName: displayNameSchema.nullable(),
+  avatar: httpUrlSchema.nullable(),
+  homepage: httpUrlSchema.nullable(),
+  bio: bioSchema.nullable(),
+  email: emailSchema.nullable(),
+  emailVerified: external_exports.boolean(),
+  status: external_exports.enum(["active", "disabled", "deleted"]),
+  createdAt: external_exports.iso.datetime({ offset: true }),
+  updatedAt: external_exports.iso.datetime({ offset: true }),
+  version: external_exports.number().int().positive()
+}).superRefine((user, context) => {
+  if (user.emailVerified && user.email === null) {
+    context.addIssue({
+      code: "custom",
+      message: "A verified user snapshot must include its email",
+      path: ["email"]
+    });
+  }
+  if (Date.parse(user.updatedAt) < Date.parse(user.createdAt)) {
+    context.addIssue({
+      code: "custom",
+      message: "User updated time must not precede creation time",
+      path: ["updatedAt"]
+    });
+  }
+}).readonly();
+var userSessionFamilyEventSnapshotSchema = external_exports.strictObject({
+  id: external_exports.uuid(),
+  userId: external_exports.uuid(),
+  createdAt: external_exports.iso.datetime({ offset: true }),
+  expiresAt: external_exports.iso.datetime({ offset: true }),
+  lastSeenAt: external_exports.iso.datetime({ offset: true }),
+  revokedAt: external_exports.iso.datetime({ offset: true }).nullable(),
+  revokeReason: userSessionRevocationReasonSchema.nullable()
+}).superRefine((session, context) => {
+  const createdAt = Date.parse(session.createdAt);
+  if (session.revokedAt === null !== (session.revokeReason === null)) {
+    context.addIssue({
+      code: "custom",
+      message: "Session revocation time and reason must be present together",
+      path: ["revokedAt"]
+    });
+  }
+  if (Date.parse(session.expiresAt) <= createdAt) {
+    context.addIssue({
+      code: "custom",
+      message: "Session expiry must follow creation time",
+      path: ["expiresAt"]
+    });
+  }
+  const lastSeenAt = Date.parse(session.lastSeenAt);
+  if (lastSeenAt < createdAt || lastSeenAt > Date.parse(session.expiresAt)) {
+    context.addIssue({
+      code: "custom",
+      message: "Session last-seen time must fall within its lifetime",
+      path: ["lastSeenAt"]
+    });
+  }
+  if (session.revokedAt !== null && Date.parse(session.revokedAt) < createdAt) {
+    context.addIssue({
+      code: "custom",
+      message: "Session revoked time must not precede creation time",
+      path: ["revokedAt"]
+    });
+  }
+}).readonly();
+
 // ../user-shared/dist/events/definition.js
 function defineUserEvent(type, aggregateType2, dataSchema5, aggregateId2) {
   return defineEvent(type, dataSchema5, {
@@ -120062,6 +120062,7 @@ var USER_EVENT_CATALOG = defineEventCatalog({
 
 // ../user-shared/dist/index.js
 var USER_CREDENTIAL_LIFECYCLE_PROTOCOL = "zlooks.user.credential-lifecycle";
+var USER_CREDENTIAL_LIFECYCLE_EVENT_TYPE = "cn.zlooks.password.credential-lifecycle.v1";
 var USER_ACCOUNT_HREF = "/user.account/account";
 var USER_BROWSER_AUTH_METHODS_PATH = browserApiPath(USER_SERVICE_NAMESPACE, "/api/auth/methods");
 var USER_BROWSER_AUTH_TRANSACTIONS_PATH = browserApiPath(USER_SERVICE_NAMESPACE, "/api/auth/transactions");
@@ -120285,6 +120286,11 @@ var userCredentialLifecycleEventSchema = external_exports.strictObject({
   email: external_exports.email().max(320),
   occurredAt: external_exports.iso.datetime({ offset: true })
 }).readonly();
+var userCredentialLifecycleDomainEvent = defineEvent(USER_CREDENTIAL_LIFECYCLE_EVENT_TYPE, userCredentialLifecycleEventSchema, {
+  producer: "cn.zlooks.password.auth.server",
+  aggregateType: "credential",
+  aggregateId: ({ subject }) => subject
+});
 var userCredentialLifecycleResponseSchema = external_exports.strictObject({
   acknowledged: external_exports.literal(true)
 }).readonly();

package/.hile-rsc/{build-mu2ebvjj-b7c71e74 → build-mu41ll5m-02df9102}/plugin.json

@@ -1,7 +1,7 @@
 {
   "protocolVersion": 1,
   "pluginId": "auth.password",
-  "buildId": "build-mu2ebvjj-b7c71e74",
+  "buildId": "build-mu41ll5m-02df9102",
   "runtime": {
     "react": "19.2.8",
     "reactDom": "19.2.8",
@@ -9,8 +9,8 @@
   },
   "server": {
     "entry": "server-rsc/index.js",
-    "integrity": "sha256-v1hMBHXmqD9NUJkjDZ+4xjhcN8o5Z0r+nqoXDJwcrlA=",
-    "size": 594909
+    "integrity": "sha256-l3h8Daulm0BJfwweeHGhbAFzeCJQeZDNBc9A8EnKzS0=",
+    "size": 595248
   },
   "serverFunctions": [],
   "clients": [
@@ -43,8 +43,8 @@
     },
     {
       "id": "auth.password/src/plugin/password-form#default",
-      "module": "client-browser/src-plugin-password-form-3bd63d69e5-4TOGMUOJ.js",
-      "ssrModule": "client-ssr/src-plugin-password-form-3bd63d69e5-S65T2FFP.js",
+      "module": "client-browser/src-plugin-password-form-3bd63d69e5-MO3JJSBS.js",
+      "ssrModule": "client-ssr/src-plugin-password-form-3bd63d69e5-MWQ7H3E5.js",
       "exportName": "default",
       "chunks": [
         {
@@ -60,10 +60,10 @@
           "size": 1382378
         }
       ],
-      "integrity": "sha256-EygS4s6kdU+R8Fqt19O0gQnWATY1ectKpbE/4tY5sEQ=",
-      "ssrIntegrity": "sha256-QvXih3WmaGZkM6zB4RatAD82y4jg1ar7mvwr88sDCRw=",
-      "size": 173245,
-      "ssrSize": 4801094,
+      "integrity": "sha256-GCIqr29sGLCZaBQxRIlPxAgxZ+aGCjDBHc79SryUVLE=",
+      "ssrIntegrity": "sha256-/VE2aLgO1pj4K4yr0J9owOOZsSNScwDnvM16yX+5IpI=",
+      "size": 173584,
+      "ssrSize": 4801433,
       "styles": [
         "client-browser/src-plugin-password-form-3bd63d69e5-TRYMJX4F.css"
       ]

package/.hile-rsc/{build-mu2ebvjj-b7c71e74 → build-mu41ll5m-02df9102}/server-rsc/index.js

@@ -14844,92 +14844,6 @@ function isBrowserApiFailure(response) {
   return response.code !== 0;
 }
 
-// ../user-shared/dist/identity.js
-var USER_SERVICE_NAMESPACE = "cn.zlooks.user.server";
-
-// ../user-shared/dist/events/snapshots.js
-var userSessionRevocationReasonSchema = external_exports.enum([
-  "logout",
-  "user-request",
-  "family-limit",
-  "credential-recovery"
-]);
-var displayNameSchema = external_exports.string().refine((value) => value === value.trim().normalize("NFKC"), "Display name must be normalized").refine((value) => Array.from(value).length >= 1 && Array.from(value).length <= 160, "Display name must contain 1 to 160 Unicode code points");
-var bioSchema = external_exports.string().refine((value) => value === value.trim().normalize("NFKC"), "Bio must be normalized").refine((value) => Array.from(value).length >= 1 && Array.from(value).length <= 500, "Bio must contain 1 to 500 Unicode code points");
-var httpUrlSchema = external_exports.url().max(2048).refine((value) => {
-  const protocol = new URL(value).protocol;
-  return protocol === "http:" || protocol === "https:";
-}, "URL must use HTTP or HTTPS").refine((value) => value === new URL(value).toString(), "URL must be canonical");
-var emailSchema = external_exports.email().max(320).refine((value) => value === value.toLocaleLowerCase("en-US"), "Email must be lowercase");
-var userEventSnapshotSchema = external_exports.strictObject({
-  id: external_exports.uuid(),
-  displayName: displayNameSchema.nullable(),
-  avatar: httpUrlSchema.nullable(),
-  homepage: httpUrlSchema.nullable(),
-  bio: bioSchema.nullable(),
-  email: emailSchema.nullable(),
-  emailVerified: external_exports.boolean(),
-  status: external_exports.enum(["active", "disabled", "deleted"]),
-  createdAt: external_exports.iso.datetime({ offset: true }),
-  updatedAt: external_exports.iso.datetime({ offset: true }),
-  version: external_exports.number().int().positive()
-}).superRefine((user, context) => {
-  if (user.emailVerified && user.email === null) {
-    context.addIssue({
-      code: "custom",
-      message: "A verified user snapshot must include its email",
-      path: ["email"]
-    });
-  }
-  if (Date.parse(user.updatedAt) < Date.parse(user.createdAt)) {
-    context.addIssue({
-      code: "custom",
-      message: "User updated time must not precede creation time",
-      path: ["updatedAt"]
-    });
-  }
-}).readonly();
-var userSessionFamilyEventSnapshotSchema = external_exports.strictObject({
-  id: external_exports.uuid(),
-  userId: external_exports.uuid(),
-  createdAt: external_exports.iso.datetime({ offset: true }),
-  expiresAt: external_exports.iso.datetime({ offset: true }),
-  lastSeenAt: external_exports.iso.datetime({ offset: true }),
-  revokedAt: external_exports.iso.datetime({ offset: true }).nullable(),
-  revokeReason: userSessionRevocationReasonSchema.nullable()
-}).superRefine((session, context) => {
-  const createdAt = Date.parse(session.createdAt);
-  if (session.revokedAt === null !== (session.revokeReason === null)) {
-    context.addIssue({
-      code: "custom",
-      message: "Session revocation time and reason must be present together",
-      path: ["revokedAt"]
-    });
-  }
-  if (Date.parse(session.expiresAt) <= createdAt) {
-    context.addIssue({
-      code: "custom",
-      message: "Session expiry must follow creation time",
-      path: ["expiresAt"]
-    });
-  }
-  const lastSeenAt = Date.parse(session.lastSeenAt);
-  if (lastSeenAt < createdAt || lastSeenAt > Date.parse(session.expiresAt)) {
-    context.addIssue({
-      code: "custom",
-      message: "Session last-seen time must fall within its lifetime",
-      path: ["lastSeenAt"]
-    });
-  }
-  if (session.revokedAt !== null && Date.parse(session.revokedAt) < createdAt) {
-    context.addIssue({
-      code: "custom",
-      message: "Session revoked time must not precede creation time",
-      path: ["revokedAt"]
-    });
-  }
-}).readonly();
-
 // ../event-bus/dist/index.js
 var EVENT_PROTOCOL = "zlooks.event";
 var EVENT_PROTOCOL_VERSION = 1;
@@ -15072,6 +14986,92 @@ function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+// ../user-shared/dist/identity.js
+var USER_SERVICE_NAMESPACE = "cn.zlooks.user.server";
+
+// ../user-shared/dist/events/snapshots.js
+var userSessionRevocationReasonSchema = external_exports.enum([
+  "logout",
+  "user-request",
+  "family-limit",
+  "credential-recovery"
+]);
+var displayNameSchema = external_exports.string().refine((value) => value === value.trim().normalize("NFKC"), "Display name must be normalized").refine((value) => Array.from(value).length >= 1 && Array.from(value).length <= 160, "Display name must contain 1 to 160 Unicode code points");
+var bioSchema = external_exports.string().refine((value) => value === value.trim().normalize("NFKC"), "Bio must be normalized").refine((value) => Array.from(value).length >= 1 && Array.from(value).length <= 500, "Bio must contain 1 to 500 Unicode code points");
+var httpUrlSchema = external_exports.url().max(2048).refine((value) => {
+  const protocol = new URL(value).protocol;
+  return protocol === "http:" || protocol === "https:";
+}, "URL must use HTTP or HTTPS").refine((value) => value === new URL(value).toString(), "URL must be canonical");
+var emailSchema = external_exports.email().max(320).refine((value) => value === value.toLocaleLowerCase("en-US"), "Email must be lowercase");
+var userEventSnapshotSchema = external_exports.strictObject({
+  id: external_exports.uuid(),
+  displayName: displayNameSchema.nullable(),
+  avatar: httpUrlSchema.nullable(),
+  homepage: httpUrlSchema.nullable(),
+  bio: bioSchema.nullable(),
+  email: emailSchema.nullable(),
+  emailVerified: external_exports.boolean(),
+  status: external_exports.enum(["active", "disabled", "deleted"]),
+  createdAt: external_exports.iso.datetime({ offset: true }),
+  updatedAt: external_exports.iso.datetime({ offset: true }),
+  version: external_exports.number().int().positive()
+}).superRefine((user, context) => {
+  if (user.emailVerified && user.email === null) {
+    context.addIssue({
+      code: "custom",
+      message: "A verified user snapshot must include its email",
+      path: ["email"]
+    });
+  }
+  if (Date.parse(user.updatedAt) < Date.parse(user.createdAt)) {
+    context.addIssue({
+      code: "custom",
+      message: "User updated time must not precede creation time",
+      path: ["updatedAt"]
+    });
+  }
+}).readonly();
+var userSessionFamilyEventSnapshotSchema = external_exports.strictObject({
+  id: external_exports.uuid(),
+  userId: external_exports.uuid(),
+  createdAt: external_exports.iso.datetime({ offset: true }),
+  expiresAt: external_exports.iso.datetime({ offset: true }),
+  lastSeenAt: external_exports.iso.datetime({ offset: true }),
+  revokedAt: external_exports.iso.datetime({ offset: true }).nullable(),
+  revokeReason: userSessionRevocationReasonSchema.nullable()
+}).superRefine((session, context) => {
+  const createdAt = Date.parse(session.createdAt);
+  if (session.revokedAt === null !== (session.revokeReason === null)) {
+    context.addIssue({
+      code: "custom",
+      message: "Session revocation time and reason must be present together",
+      path: ["revokedAt"]
+    });
+  }
+  if (Date.parse(session.expiresAt) <= createdAt) {
+    context.addIssue({
+      code: "custom",
+      message: "Session expiry must follow creation time",
+      path: ["expiresAt"]
+    });
+  }
+  const lastSeenAt = Date.parse(session.lastSeenAt);
+  if (lastSeenAt < createdAt || lastSeenAt > Date.parse(session.expiresAt)) {
+    context.addIssue({
+      code: "custom",
+      message: "Session last-seen time must fall within its lifetime",
+      path: ["lastSeenAt"]
+    });
+  }
+  if (session.revokedAt !== null && Date.parse(session.revokedAt) < createdAt) {
+    context.addIssue({
+      code: "custom",
+      message: "Session revoked time must not precede creation time",
+      path: ["revokedAt"]
+    });
+  }
+}).readonly();
+
 // ../user-shared/dist/events/definition.js
 function defineUserEvent(type, aggregateType2, dataSchema5, aggregateId2) {
   return defineEvent(type, dataSchema5, {
@@ -15203,6 +15203,7 @@ var USER_EVENT_CATALOG = defineEventCatalog({
 
 // ../user-shared/dist/index.js
 var USER_CREDENTIAL_LIFECYCLE_PROTOCOL = "zlooks.user.credential-lifecycle";
+var USER_CREDENTIAL_LIFECYCLE_EVENT_TYPE = "cn.zlooks.password.credential-lifecycle.v1";
 var USER_BROWSER_AUTH_METHODS_PATH = browserApiPath(USER_SERVICE_NAMESPACE, "/api/auth/methods");
 var USER_BROWSER_AUTH_TRANSACTIONS_PATH = browserApiPath(USER_SERVICE_NAMESPACE, "/api/auth/transactions");
 var USER_BROWSER_LOGOUT_PATH = browserApiPath(USER_SERVICE_NAMESPACE, "/api/auth/logout");
@@ -15425,6 +15426,11 @@ var userCredentialLifecycleEventSchema = external_exports.strictObject({
   email: external_exports.email().max(320),
   occurredAt: external_exports.iso.datetime({ offset: true })
 }).readonly();
+var userCredentialLifecycleDomainEvent = defineEvent(USER_CREDENTIAL_LIFECYCLE_EVENT_TYPE, userCredentialLifecycleEventSchema, {
+  producer: "cn.zlooks.password.auth.server",
+  aggregateType: "credential",
+  aggregateId: ({ subject }) => subject
+});
 var userCredentialLifecycleResponseSchema = external_exports.strictObject({
   acknowledged: external_exports.literal(true)
 }).readonly();
@@ -15499,7 +15505,7 @@ var __hileRemoteClientBoundary = __hileRegisterClientReference(function() {
 function __hileDefault(props) {
   return React.createElement(__hileRemoteClientBoundary, {
     pluginId: "auth.password",
-    buildId: "build-mu2ebvjj-b7c71e74",
+    buildId: "build-mu41ll5m-02df9102",
     referenceId: "auth.password/src/plugin/password-form#default",
     exportName: "default",
     props
@@ -15516,7 +15522,7 @@ var __hileRemoteClientBoundary2 = __hileRegisterClientReference2(function() {
 function __hileDefault2(props) {
   return React2.createElement(__hileRemoteClientBoundary2, {
     pluginId: "auth.password",
-    buildId: "build-mu2ebvjj-b7c71e74",
+    buildId: "build-mu41ll5m-02df9102",
     referenceId: "auth.password/src/plugin/page-frame#default",
     exportName: "default",
     props