Improve authentication recovery and mobile gameplay

shared/initial-password.ts

@@ -0,0 +1,28 @@
+import { initialPasswordSchema } from "./account";
+
+export function generateInitialPassword() {
+  const bytes = crypto.getRandomValues(new Uint8Array(24));
+  // Every byte contributes eight random bits, encoded as two hex characters.
+  return (
+    "Aa7!" +
+    Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")
+  );
+}
+
+export async function issueInitialPassword(
+  userId: string,
+  password: string,
+  operations: {
+    claim: (id: string) => Promise<boolean>;
+    update: (id: string, password: string) => Promise<void>;
+  },
+) {
+  initialPasswordSchema.parse({ password });
+  if (!(await operations.claim(userId)))
+    throw new Error(
+      "A password is already set or was already issued. Use password recovery if needed.",
+    );
+  // A claim is never released after an uncertain Auth response: the password
+  // may already have changed, so a retry must not overwrite it with a new one.
+  await operations.update(userId, password);
+}