@aooth/user 0.2.1 → 0.2.3

package/dist/atscript-db.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_federated_identity_store = require("./federated-identity-store-D-LvRXdx.cjs");
+const require_federated_identity_store = require("./federated-identity-store-Cbstwl4-.cjs");
 let node_crypto = require("node:crypto");
-//#region src/atscript-db/federated-identity-store.ts
+// src/atscript-db/federated-identity-store.ts
 function isConflict$1(err) {
 	return typeof err === "object" && err !== null && err.code === "CONFLICT";
 }
@@ -71,8 +71,7 @@ var FederatedIdentityStoreAtscriptDb = class extends require_federated_identity_
 		return (await this.table.deleteMany({ userId })).deletedCount;
 	}
 };
-//#endregion
-//#region src/atscript-db/index.ts
+// src/atscript-db/index.ts
 function isConflict(err) {
 	return typeof err === "object" && err !== null && err.code === "CONFLICT";
 }
@@ -133,8 +132,10 @@ var UsersStoreAtscriptDb = class extends require_federated_identity_store.UserSt
 			throw e;
 		}
 	}
-	async delete(id) {
-		return (await this.table.deleteMany({ id })).deletedCount > 0;
+	async delete(id, opts) {
+		const filter = { id };
+		if (opts?.expectedVersion !== void 0) filter.version = opts.expectedVersion;
+		return (await this.table.deleteMany(filter)).deletedCount > 0;
 	}
 	/**
 	* Inline retry loop rather than delegating to @atscript/db's
@@ -161,6 +162,5 @@ var UsersStoreAtscriptDb = class extends require_federated_identity_store.UserSt
 		throw new require_federated_identity_store.UserAuthError("CAS_EXHAUSTED");
 	}
 };
-//#endregion
 exports.FederatedIdentityStoreAtscriptDb = FederatedIdentityStoreAtscriptDb;
 exports.UsersStoreAtscriptDb = UsersStoreAtscriptDb;

package/dist/atscript-db.d.cts

@@ -1,5 +1,4 @@
-import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-B_jEkl-a.cjs";
-//#region src/atscript-db/federated-identity-store.d.ts
+import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-Ds7Ye9qJ.cjs";
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls — kept loose so `@aooth/user` doesn't pull `@atscript/db` types
@@ -39,7 +38,7 @@ interface FederatedIdentityStoreAtscriptDbOptions {
  * is a plain indexed column, so `listForUser` / `deleteAllForUser` scan it
  * natively.
  */
-declare class FederatedIdentityStoreAtscriptDb extends FederatedIdentityStore {
+export declare class FederatedIdentityStoreAtscriptDb extends FederatedIdentityStore {
   private readonly table;
   private readonly clock;
   constructor(opts: FederatedIdentityStoreAtscriptDbOptions);
@@ -50,15 +49,13 @@ declare class FederatedIdentityStoreAtscriptDb extends FederatedIdentityStore {
   touchLogin(provider: string, subject: string, profile?: FederatedProfileSnapshot): Promise<void>;
   deleteAllForUser(userId: string): Promise<number>;
 }
-//#endregion
-//#region src/atscript-db/index.d.ts
 /**
  * Persisted row shape — `UserCredentials` plus the consumer's custom user
  * fields. The `.as` model shipped at `@aooth/user/atscript-db/model.as`
  * (`AoothUserCredentials`) matches by construction; consumers extend it with
  * their own `.as` interface to add custom columns.
  */
-type UserCredentialsRow<TUserCustom extends object = object> = UserCredentials & TUserCustom;
+export type UserCredentialsRow<TUserCustom extends object = object> = UserCredentials & TUserCustom;
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls. Kept loose to avoid pulling `@atscript/db` types into the
@@ -67,7 +64,7 @@ type UserCredentialsRow<TUserCustom extends object = object> = UserCredentials &
  *
  * Mirrors `AuthCredentialTable` from `@aooth/auth/atscript-db`.
  */
-interface AuthUserTable<TUserCustom extends object = object> {
+export interface AuthUserTable<TUserCustom extends object = object> {
   count(query: {
     filter: Record<string, unknown>;
   }): Promise<number>;
@@ -105,7 +102,7 @@ interface UsersStoreAtscriptDbOptions<TUserCustom extends object> {
  * `@meta.id` PK (`id`) and the unique `username` index, plus any
  * annotation-resolved `handleFields`; writes key on `id`.
  */
-declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends UserStore<TUserCustom> {
+export declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends UserStore<TUserCustom> {
   protected table: AuthUserTable<TUserCustom>;
   /** Secondary handle fields tried (in order) by `findByHandle` after `username`. */
   protected readonly handleFields: string[];
@@ -116,7 +113,9 @@ declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends
   findByIdentifier(value: string): Promise<(UserCredentials & TUserCustom) | null>;
   create(data: UserCredentials & TUserCustom): Promise<void>;
   update(id: string, update: UserStoreUpdate): Promise<boolean>;
-  delete(id: string): Promise<boolean>;
+  delete(id: string, opts?: {
+    expectedVersion?: number;
+  }): Promise<boolean>;
   /**
    * Inline retry loop rather than delegating to @atscript/db's
    * `withOptimisticRetry`: that helper expects the mutator to always return a
@@ -129,5 +128,4 @@ declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends
    */
   withCas(id: string, mutator: (current: UserCredentials & TUserCustom) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
-//#endregion
-export { AuthUserTable, FederatedIdentityStoreAtscriptDb, type FederatedIdentityTable, UserCredentialsRow, UsersStoreAtscriptDb };
+export type { FederatedIdentityTable };

package/dist/atscript-db.d.mts

@@ -1,5 +1,4 @@
-import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-B_jEkl-a.mjs";
-//#region src/atscript-db/federated-identity-store.d.ts
+import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-Ds7Ye9qJ.mjs";
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls — kept loose so `@aooth/user` doesn't pull `@atscript/db` types
@@ -39,7 +38,7 @@ interface FederatedIdentityStoreAtscriptDbOptions {
  * is a plain indexed column, so `listForUser` / `deleteAllForUser` scan it
  * natively.
  */
-declare class FederatedIdentityStoreAtscriptDb extends FederatedIdentityStore {
+export declare class FederatedIdentityStoreAtscriptDb extends FederatedIdentityStore {
   private readonly table;
   private readonly clock;
   constructor(opts: FederatedIdentityStoreAtscriptDbOptions);
@@ -50,15 +49,13 @@ declare class FederatedIdentityStoreAtscriptDb extends FederatedIdentityStore {
   touchLogin(provider: string, subject: string, profile?: FederatedProfileSnapshot): Promise<void>;
   deleteAllForUser(userId: string): Promise<number>;
 }
-//#endregion
-//#region src/atscript-db/index.d.ts
 /**
  * Persisted row shape — `UserCredentials` plus the consumer's custom user
  * fields. The `.as` model shipped at `@aooth/user/atscript-db/model.as`
  * (`AoothUserCredentials`) matches by construction; consumers extend it with
  * their own `.as` interface to add custom columns.
  */
-type UserCredentialsRow<TUserCustom extends object = object> = UserCredentials & TUserCustom;
+export type UserCredentialsRow<TUserCustom extends object = object> = UserCredentials & TUserCustom;
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls. Kept loose to avoid pulling `@atscript/db` types into the
@@ -67,7 +64,7 @@ type UserCredentialsRow<TUserCustom extends object = object> = UserCredentials &
  *
  * Mirrors `AuthCredentialTable` from `@aooth/auth/atscript-db`.
  */
-interface AuthUserTable<TUserCustom extends object = object> {
+export interface AuthUserTable<TUserCustom extends object = object> {
   count(query: {
     filter: Record<string, unknown>;
   }): Promise<number>;
@@ -105,7 +102,7 @@ interface UsersStoreAtscriptDbOptions<TUserCustom extends object> {
  * `@meta.id` PK (`id`) and the unique `username` index, plus any
  * annotation-resolved `handleFields`; writes key on `id`.
  */
-declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends UserStore<TUserCustom> {
+export declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends UserStore<TUserCustom> {
   protected table: AuthUserTable<TUserCustom>;
   /** Secondary handle fields tried (in order) by `findByHandle` after `username`. */
   protected readonly handleFields: string[];
@@ -116,7 +113,9 @@ declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends
   findByIdentifier(value: string): Promise<(UserCredentials & TUserCustom) | null>;
   create(data: UserCredentials & TUserCustom): Promise<void>;
   update(id: string, update: UserStoreUpdate): Promise<boolean>;
-  delete(id: string): Promise<boolean>;
+  delete(id: string, opts?: {
+    expectedVersion?: number;
+  }): Promise<boolean>;
   /**
    * Inline retry loop rather than delegating to @atscript/db's
    * `withOptimisticRetry`: that helper expects the mutator to always return a
@@ -129,5 +128,4 @@ declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends
    */
   withCas(id: string, mutator: (current: UserCredentials & TUserCustom) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
-//#endregion
-export { AuthUserTable, FederatedIdentityStoreAtscriptDb, type FederatedIdentityTable, UserCredentialsRow, UsersStoreAtscriptDb };
+export type { FederatedIdentityTable };

package/dist/atscript-db.mjs

@@ -1,6 +1,6 @@
-import { c as setAtPath, l as UserStore, n as pickDefinedProfile, t as FederatedIdentityStore, u as UserAuthError } from "./federated-identity-store-CRycYlMj.mjs";
+import { c as setAtPath, l as UserStore, n as pickDefinedProfile, t as FederatedIdentityStore, u as UserAuthError } from "./federated-identity-store-BZRvw9Pz.mjs";
 import { randomUUID } from "node:crypto";
-//#region src/atscript-db/federated-identity-store.ts
+// src/atscript-db/federated-identity-store.ts
 function isConflict$1(err) {
 	return typeof err === "object" && err !== null && err.code === "CONFLICT";
 }
@@ -70,8 +70,7 @@ var FederatedIdentityStoreAtscriptDb = class extends FederatedIdentityStore {
 		return (await this.table.deleteMany({ userId })).deletedCount;
 	}
 };
-//#endregion
-//#region src/atscript-db/index.ts
+// src/atscript-db/index.ts
 function isConflict(err) {
 	return typeof err === "object" && err !== null && err.code === "CONFLICT";
 }
@@ -132,8 +131,10 @@ var UsersStoreAtscriptDb = class extends UserStore {
 			throw e;
 		}
 	}
-	async delete(id) {
-		return (await this.table.deleteMany({ id })).deletedCount > 0;
+	async delete(id, opts) {
+		const filter = { id };
+		if (opts?.expectedVersion !== void 0) filter.version = opts.expectedVersion;
+		return (await this.table.deleteMany(filter)).deletedCount > 0;
 	}
 	/**
 	* Inline retry loop rather than delegating to @atscript/db's
@@ -160,5 +161,4 @@ var UsersStoreAtscriptDb = class extends UserStore {
 		throw new UserAuthError("CAS_EXHAUSTED");
 	}
 };
-//#endregion
 export { FederatedIdentityStoreAtscriptDb, UsersStoreAtscriptDb };

package/dist/{federated-identity-store-CRycYlMj.mjs → federated-identity-store-BZRvw9Pz.mjs}

@@ -1,5 +1,5 @@
 import "node:crypto";
-//#region src/errors.ts
+// src/errors.ts
 const defaultMessages = {
 	NOT_FOUND: "User not found",
 	ALREADY_EXISTS: "User already exists",
@@ -24,8 +24,7 @@ var UserAuthError = class extends Error {
 		this.details = details;
 	}
 };
-//#endregion
-//#region src/store/user-store.ts
+// src/store/user-store.ts
 /**
 * Storage seam for user credentials, keyed by the stable surrogate **`id`**
 * (the token subject). Reads come in three flavours:
@@ -40,8 +39,7 @@ var UserAuthError = class extends Error {
 * Writes (`update`/`delete`/`withCas`) all key on the surrogate `id`.
 */
 var UserStore = class {};
-//#endregion
-//#region src/utils.ts
+// src/utils.ts
 function maskEmail(email) {
 	if (!email) return "";
 	const at = email.indexOf("@");
@@ -101,8 +99,7 @@ function incrementAtPath(obj, path, amount) {
 	const existing = current[leaf];
 	current[leaf] = (typeof existing === "number" ? existing : 0) + amount;
 }
-//#endregion
-//#region src/store/federated-identity-store.ts
+// src/store/federated-identity-store.ts
 /**
 * Copy only the DEFINED display fields — so a `touchLogin` / `link` with a
 * partial profile (e.g. Apple omitting the email on a repeat login) never
@@ -126,5 +123,4 @@ function pickDefinedProfile(src) {
 * keeps the federated-login core (`@aooth/idp`, phase 2) storage-agnostic.
 */
 var FederatedIdentityStore = class {};
-//#endregion
 export { maskEmail as a, setAtPath as c, incrementAtPath as i, UserStore as l, pickDefinedProfile as n, maskMfaValue as o, deepMerge as r, maskPhone as s, FederatedIdentityStore as t, UserAuthError as u };

package/dist/{federated-identity-store-D-LvRXdx.cjs → federated-identity-store-Cbstwl4-.cjs}

@@ -1,5 +1,5 @@
 require("node:crypto");
-//#region src/errors.ts
+// src/errors.ts
 const defaultMessages = {
 	NOT_FOUND: "User not found",
 	ALREADY_EXISTS: "User already exists",
@@ -24,8 +24,7 @@ var UserAuthError = class extends Error {
 		this.details = details;
 	}
 };
-//#endregion
-//#region src/store/user-store.ts
+// src/store/user-store.ts
 /**
 * Storage seam for user credentials, keyed by the stable surrogate **`id`**
 * (the token subject). Reads come in three flavours:
@@ -40,8 +39,7 @@ var UserAuthError = class extends Error {
 * Writes (`update`/`delete`/`withCas`) all key on the surrogate `id`.
 */
 var UserStore = class {};
-//#endregion
-//#region src/utils.ts
+// src/utils.ts
 function maskEmail(email) {
 	if (!email) return "";
 	const at = email.indexOf("@");
@@ -101,8 +99,7 @@ function incrementAtPath(obj, path, amount) {
 	const existing = current[leaf];
 	current[leaf] = (typeof existing === "number" ? existing : 0) + amount;
 }
-//#endregion
-//#region src/store/federated-identity-store.ts
+// src/store/federated-identity-store.ts
 /**
 * Copy only the DEFINED display fields — so a `touchLogin` / `link` with a
 * partial profile (e.g. Apple omitting the email on a repeat login) never
@@ -126,7 +123,6 @@ function pickDefinedProfile(src) {
 * keeps the federated-login core (`@aooth/idp`, phase 2) storage-agnostic.
 */
 var FederatedIdentityStore = class {};
-//#endregion
 Object.defineProperty(exports, "FederatedIdentityStore", {
 	enumerable: true,
 	get: function() {

package/dist/{federated-identity-store-B_jEkl-a.d.cts → federated-identity-store-Ds7Ye9qJ.d.cts}

@@ -1,4 +1,3 @@
-//#region src/types.d.ts
 interface UserCredentials {
   id: string;
   username: string;
@@ -59,10 +58,11 @@ interface AccountData {
   lastLogin: number;
   /**
    * True while the user record exists from an admin-issued invite but the
-   * invitee has not yet accepted (set password + activate). Used by
-   * `InviteWorkflow` to gate the accept tail, reject duplicate invites, and
-   * power `auth/invite/resend` / `auth/invite/cancel`. Absent / `false` once
-   * the invite has been accepted.
+   * invitee has not yet accepted (set password + activate). The invite
+   * workflow uses it to gate the accept tail and to detect re-invites
+   * (`'reuse'` refreshes the pending row and sends a new link);
+   * `UserService.revokeInvitation()` deletes only rows that still have it.
+   * Absent / `false` once the invite has been accepted.
    */
   pendingInvitation?: boolean;
   /** Id of the user who issued the pending invite (written by the invite flow). */
@@ -243,8 +243,6 @@ interface TotpConfig {
   /** Injectable clock for testability */
   clock?: () => number;
 }
-//#endregion
-//#region src/store/user-store.d.ts
 interface WithCasOptions {
   /**
    * Total attempts (1 initial + retries). Default `2` = one retry. Each
@@ -296,9 +294,14 @@ declare abstract class UserStore<T extends object = object> {
   abstract update(id: string, update: UserStoreUpdate): Promise<boolean>;
   /**
    * Hard-delete the row by `id`. Returns `true` when a row was removed, `false`
-   * when the id was not found.
+   * when the id was not found. With `opts.expectedVersion`, delete only while
+   * the row's `version` still equals it (`false` otherwise) — a custom store
+   * that ignores it makes `UserService.revokeInvitation()` delete
+   * unconditionally after its re-check.
    */
-  abstract delete(id: string): Promise<boolean>;
+  abstract delete(id: string, opts?: {
+    expectedVersion?: number;
+  }): Promise<boolean>;
   /**
    * Run a read-modify-write cycle under optimistic concurrency, keyed by `id`.
    * Each attempt re-reads (via `findById`), calls `mutator`, and applies the
@@ -312,8 +315,6 @@ declare abstract class UserStore<T extends object = object> {
    */
   abstract withCas(id: string, mutator: (current: UserCredentials & T) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
-//#endregion
-//#region src/store/federated-identity-store.d.ts
 /**
  * Display fields snapshotted from an IdP profile onto a federated-identity row.
  * Refreshed on each login via {@link FederatedIdentityStore.touchLogin}; never
@@ -404,5 +405,4 @@ declare abstract class FederatedIdentityStore {
    */
   abstract deleteAllForUser(userId: string): Promise<number>;
 }
-//#endregion
 export { TotpConfig as C, UserCredentials as D, UserAuthErrorType as E, UserServiceConfig as O, PolicyCheckResult as S, TrustedDeviceRecord as T, PasswordData as _, pickDefinedProfile as a, PasswordPolicyEvalFn as b, AccountData as c, LockoutConfig as d, LoginResult as f, PasswordConfig as g, MfaMethodInfo as h, NewFederatedIdentity as i, UserStoreUpdate as k, DeepPartial as l, MfaMethod as m, FederatedIdentityStore as n, UserStore as o, MfaData as p, FederatedProfileSnapshot as r, WithCasOptions as s, FederatedIdentity as t, LockStatus as u, PasswordPolicyContext as v, TransferablePolicy as w, PasswordPolicyInstance as x, PasswordPolicyDef as y };

package/dist/{federated-identity-store-B_jEkl-a.d.mts → federated-identity-store-Ds7Ye9qJ.d.mts}

@@ -1,4 +1,3 @@
-//#region src/types.d.ts
 interface UserCredentials {
   id: string;
   username: string;
@@ -59,10 +58,11 @@ interface AccountData {
   lastLogin: number;
   /**
    * True while the user record exists from an admin-issued invite but the
-   * invitee has not yet accepted (set password + activate). Used by
-   * `InviteWorkflow` to gate the accept tail, reject duplicate invites, and
-   * power `auth/invite/resend` / `auth/invite/cancel`. Absent / `false` once
-   * the invite has been accepted.
+   * invitee has not yet accepted (set password + activate). The invite
+   * workflow uses it to gate the accept tail and to detect re-invites
+   * (`'reuse'` refreshes the pending row and sends a new link);
+   * `UserService.revokeInvitation()` deletes only rows that still have it.
+   * Absent / `false` once the invite has been accepted.
    */
   pendingInvitation?: boolean;
   /** Id of the user who issued the pending invite (written by the invite flow). */
@@ -243,8 +243,6 @@ interface TotpConfig {
   /** Injectable clock for testability */
   clock?: () => number;
 }
-//#endregion
-//#region src/store/user-store.d.ts
 interface WithCasOptions {
   /**
    * Total attempts (1 initial + retries). Default `2` = one retry. Each
@@ -296,9 +294,14 @@ declare abstract class UserStore<T extends object = object> {
   abstract update(id: string, update: UserStoreUpdate): Promise<boolean>;
   /**
    * Hard-delete the row by `id`. Returns `true` when a row was removed, `false`
-   * when the id was not found.
+   * when the id was not found. With `opts.expectedVersion`, delete only while
+   * the row's `version` still equals it (`false` otherwise) — a custom store
+   * that ignores it makes `UserService.revokeInvitation()` delete
+   * unconditionally after its re-check.
    */
-  abstract delete(id: string): Promise<boolean>;
+  abstract delete(id: string, opts?: {
+    expectedVersion?: number;
+  }): Promise<boolean>;
   /**
    * Run a read-modify-write cycle under optimistic concurrency, keyed by `id`.
    * Each attempt re-reads (via `findById`), calls `mutator`, and applies the
@@ -312,8 +315,6 @@ declare abstract class UserStore<T extends object = object> {
    */
   abstract withCas(id: string, mutator: (current: UserCredentials & T) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
-//#endregion
-//#region src/store/federated-identity-store.d.ts
 /**
  * Display fields snapshotted from an IdP profile onto a federated-identity row.
  * Refreshed on each login via {@link FederatedIdentityStore.touchLogin}; never
@@ -404,5 +405,4 @@ declare abstract class FederatedIdentityStore {
    */
   abstract deleteAllForUser(userId: string): Promise<number>;
 }
-//#endregion
 export { TotpConfig as C, UserCredentials as D, UserAuthErrorType as E, UserServiceConfig as O, PolicyCheckResult as S, TrustedDeviceRecord as T, PasswordData as _, pickDefinedProfile as a, PasswordPolicyEvalFn as b, AccountData as c, LockoutConfig as d, LoginResult as f, PasswordConfig as g, MfaMethodInfo as h, NewFederatedIdentity as i, UserStoreUpdate as k, DeepPartial as l, MfaMethod as m, FederatedIdentityStore as n, UserStore as o, MfaData as p, FederatedProfileSnapshot as r, WithCasOptions as s, FederatedIdentity as t, LockStatus as u, PasswordPolicyContext as v, TransferablePolicy as w, PasswordPolicyInstance as x, PasswordPolicyDef as y };

package/dist/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_federated_identity_store = require("./federated-identity-store-D-LvRXdx.cjs");
+const require_federated_identity_store = require("./federated-identity-store-Cbstwl4-.cjs");
 let node_crypto = require("node:crypto");
-//#region src/base-x/base32.ts
+// src/base-x/base32.ts
 /**
 * Partially copied from "thirty-two" library, all credits to Chris Umbel.
 *
@@ -72,8 +72,7 @@ function decode(input) {
 	}
 	return output.subarray(0, index);
 }
-//#endregion
-//#region src/mfa/totp.ts
+// src/mfa/totp.ts
 function generateTotpSecret(bytes = 20) {
 	return encode((0, node_crypto.randomBytes)(bytes)).toString().replace(/=+$/, "").toUpperCase();
 }
@@ -127,8 +126,7 @@ function hotpCode(key, counter, digits) {
 	const offset = hmacResult[hmacResult.length - 1] & 15;
 	return (((hmacResult[offset] & 127) << 24 | (hmacResult[offset + 1] & 255) << 16 | (hmacResult[offset + 2] & 255) << 8 | hmacResult[offset + 3] & 255) % 10 ** digits).toString().padStart(digits, "0");
 }
-//#endregion
-//#region src/password/hasher.ts
+// src/password/hasher.ts
 const DEFAULTS = {
 	N: 16384,
 	r: 8,
@@ -138,11 +136,11 @@ const DEFAULTS = {
 };
 const PREFIX = "$scrypt$";
 /** Node's default scrypt memory cap (32 MiB) — kept as the floor. */
-const DEFAULT_MAXMEM = 32 * 1024 * 1024;
+const DEFAULT_MAXMEM = 33554432;
 /** Upper bound for the memory a (possibly stored, untrusted) parameter set may ask for. */
-const MAX_MAXMEM = 1024 * 1024 * 1024;
+const MAX_MAXMEM = 1073741824;
 function scryptAsync(password, salt, keyLength, options) {
-	const maxmem = Math.min(MAX_MAXMEM, Math.max(DEFAULT_MAXMEM, 256 * options.N * options.r + 1024 * 1024));
+	const maxmem = Math.min(MAX_MAXMEM, Math.max(DEFAULT_MAXMEM, 256 * options.N * options.r + 1048576));
 	return new Promise((resolve, reject) => {
 		(0, node_crypto.scrypt)(password, salt, keyLength, {
 			...options,
@@ -212,7 +210,7 @@ var PasswordHasher = class {
 		const upper = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
 		const digits = "0123456789";
 		const special = "!@#$%^&*()-_=+";
-		const all = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_=+";
+		const all = lower + upper + digits + special;
 		const bytes = (0, node_crypto.randomBytes)(minLen);
 		const result = Array.from({ length: minLen });
 		result[0] = lower[bytes[0] % 26];
@@ -228,8 +226,7 @@ var PasswordHasher = class {
 		return result.join("");
 	}
 };
-//#endregion
-//#region src/password/policy.ts
+// src/password/policy.ts
 function normalizePolicies(policies) {
 	return (policies || []).map((p) => p instanceof PasswordPolicy ? p : new PasswordPolicy(p));
 }
@@ -283,8 +280,7 @@ var PasswordPolicy = class {
 		return this.serialized !== void 0;
 	}
 };
-//#endregion
-//#region src/user-service.ts
+// src/user-service.ts
 function resolveConfig(config) {
 	return {
 		password: {
@@ -414,8 +410,8 @@ var UserService = class {
 	}
 	/**
 	* Creates a user with `account.active: false`. The invite workflow relies
-	* on this default (see `InviteWorkflow.acceptInvite` — pending invitees stay
-	* inactive until they accept). For setup scripts / seeders / tests that
+	* on this default (pending invitees stay inactive until they accept the
+	* invite). For setup scripts / seeders / tests that
 	* don't go through invite, follow up with `activateAccount(id)` or `login()`
 	* will throw `UserAuthError("INACTIVE")` — which the login workflow
 	* deliberately re-maps to `"Invalid credentials"` to avoid account
@@ -544,8 +540,9 @@ var UserService = class {
 	}
 	/**
 	* Hard-delete the user row by `id`. Returns nothing on success. Throws
-	* `UserAuthError("NOT_FOUND")` when no row matches. Used by the invite
-	* workflow's `auth/invite/cancel` to revoke a pending invitation.
+	* `UserAuthError("NOT_FOUND")` when no row matches. To revoke a pending
+	* invitation use {@link revokeInvitation}, which never deletes an account
+	* whose invite was accepted meanwhile.
 	*/
 	async deleteUser(id) {
 		if (!await this.store.delete(id)) throw new require_federated_identity_store.UserAuthError("NOT_FOUND");
@@ -554,7 +551,6 @@ var UserService = class {
 	* Deep-merge `patch` into the user record (top-level fields are shallow-
 	* merged; `account` / `mfa` / `password` are merged per their
 	* `@db.patch.strategy 'merge'` declaration). Returns the patched record.
-	* Used by the invite workflow's `applyProfile` default fallback.
 	*/
 	async update(id, patch) {
 		if (!await this.store.update(id, { set: patch })) throw new require_federated_identity_store.UserAuthError("NOT_FOUND");
@@ -581,6 +577,36 @@ var UserService = class {
 		return accepted;
 	}
 	/**
+	* Revoke a pending invitation: delete the invited account, so its invite
+	* link stops working (the invite workflow answers it with 410
+	* `INVITE_CANCELLED`). Returns `false` and deletes nothing when the account
+	* is not pending — the invite was already accepted — or when the row
+	* changed while the revoke ran. Throws `UserAuthError("NOT_FOUND")` when no
+	* row matches `id`.
+	*
+	* Safe against a concurrent acceptance or re-invite: one compare-and-set
+	* write first rotates `account.inviteNonce` while the row is still pending
+	* (an accept racing it fails), and the delete is conditional on the row's
+	* `version` still being the one that write produced — any write in between
+	* (a re-invite, an acceptance) makes it delete nothing. The bundled stores
+	* honour the conditional delete; a custom store whose `delete()` ignores
+	* `expectedVersion` leaves a window of one round-trip between the re-check
+	* and the delete.
+	*/
+	async revokeInvitation(id) {
+		const nonce = (0, node_crypto.randomBytes)(16).toString("base64url");
+		let pending = false;
+		await this.store.withCas(id, (user) => {
+			pending = user.account.pendingInvitation === true;
+			if (!pending) return null;
+			return { set: { account: { inviteNonce: nonce } } };
+		});
+		if (!pending) return false;
+		const claimed = await this.store.findById(id);
+		if (!claimed?.account.pendingInvitation || claimed.account.inviteNonce !== nonce) return false;
+		return this.store.delete(id, { expectedVersion: claimed.version ?? 0 });
+	}
+	/**
 	* Flip the account active. `opts.verifiedEmail` lets callers that just
 	* proved an inbox (invite magic link, signup OTP) record the correspondence
 	* address in the same store write — see {@link setVerifiedEmail}.
@@ -1108,8 +1134,7 @@ function observeWrites(store, hooks) {
 		return fn;
 	} });
 }
-//#endregion
-//#region src/store/memory.ts
+// src/store/memory.ts
 var UserStoreMemory = class extends require_federated_identity_store.UserStore {
 	/** Keyed by the stable surrogate `id` (the token subject). */
 	store = /* @__PURE__ */ new Map();
@@ -1205,7 +1230,10 @@ var UserStoreMemory = class extends require_federated_identity_store.UserStore {
 		user.version = (user.version ?? 0) + 1;
 		return true;
 	}
-	async delete(id) {
+	async delete(id, opts) {
+		const user = this.store.get(id);
+		if (!user) return false;
+		if (opts?.expectedVersion !== void 0 && (user.version ?? 0) !== opts.expectedVersion) return false;
 		return this.store.delete(id);
 	}
 	async withCas(id, mutator, opts) {
@@ -1223,8 +1251,7 @@ var UserStoreMemory = class extends require_federated_identity_store.UserStore {
 		throw new require_federated_identity_store.UserAuthError("CAS_EXHAUSTED");
 	}
 };
-//#endregion
-//#region src/store/federated-identity-store-memory.ts
+// src/store/federated-identity-store-memory.ts
 /**
 * In-memory {@link FederatedIdentityStore} — the offline-testable reference
 * impl (RFC IDP.md §9). Keyed by the composite `(provider, subject)`;
@@ -1282,8 +1309,7 @@ var FederatedIdentityStoreMemory = class extends require_federated_identity_stor
 function compositeKey(provider, subject) {
 	return `${provider}${subject}`;
 }
-//#endregion
-//#region src/password/policies.ts
+// src/password/policies.ts
 const ppHasMinLength = (min = 8) => definePasswordPolicy({
 	rule: (v, min) => v.length >= min,
 	args: [min],
@@ -1320,8 +1346,7 @@ const ppMaxRepeatedChars = (maxRepeated = 2) => definePasswordPolicy({
 	description: `No more than ${maxRepeated} consecutive repeated characters`,
 	errorMessage: `Password must not have more than ${maxRepeated} consecutive repeated characters`
 });
-//#endregion
-//#region src/mfa/codes.ts
+// src/mfa/codes.ts
 /**
 * SHA-256 hash of an MFA code (e.g. one-time email/SMS code or backup code).
 *
@@ -1346,7 +1371,6 @@ function verifyMfaCode(submitted, expectedHash) {
 	if (a.length !== b.length) return false;
 	return (0, node_crypto.timingSafeEqual)(a, b);
 }
-//#endregion
 exports.FederatedIdentityStore = require_federated_identity_store.FederatedIdentityStore;
 exports.FederatedIdentityStoreMemory = FederatedIdentityStoreMemory;
 exports.PasswordHasher = PasswordHasher;