@aooth/user 0.2.2 → 0.2.3

package/dist/atscript-db.cjs

@@ -132,8 +132,10 @@ var UsersStoreAtscriptDb = class extends require_federated_identity_store.UserSt
 			throw e;
 		}
 	}
-	async delete(id) {
-		return (await this.table.deleteMany({ id })).deletedCount > 0;
+	async delete(id, opts) {
+		const filter = { id };
+		if (opts?.expectedVersion !== void 0) filter.version = opts.expectedVersion;
+		return (await this.table.deleteMany(filter)).deletedCount > 0;
 	}
 	/**
 	* Inline retry loop rather than delegating to @atscript/db's

package/dist/atscript-db.d.cts

@@ -1,4 +1,4 @@
-import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-D10-BT9l.cjs";
+import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-Ds7Ye9qJ.cjs";
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls — kept loose so `@aooth/user` doesn't pull `@atscript/db` types
@@ -113,7 +113,9 @@ export declare class UsersStoreAtscriptDb<TUserCustom extends object = object> e
   findByIdentifier(value: string): Promise<(UserCredentials & TUserCustom) | null>;
   create(data: UserCredentials & TUserCustom): Promise<void>;
   update(id: string, update: UserStoreUpdate): Promise<boolean>;
-  delete(id: string): Promise<boolean>;
+  delete(id: string, opts?: {
+    expectedVersion?: number;
+  }): Promise<boolean>;
   /**
    * Inline retry loop rather than delegating to @atscript/db's
    * `withOptimisticRetry`: that helper expects the mutator to always return a

package/dist/atscript-db.d.mts

@@ -1,4 +1,4 @@
-import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-D10-BT9l.mjs";
+import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-Ds7Ye9qJ.mjs";
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls — kept loose so `@aooth/user` doesn't pull `@atscript/db` types
@@ -113,7 +113,9 @@ export declare class UsersStoreAtscriptDb<TUserCustom extends object = object> e
   findByIdentifier(value: string): Promise<(UserCredentials & TUserCustom) | null>;
   create(data: UserCredentials & TUserCustom): Promise<void>;
   update(id: string, update: UserStoreUpdate): Promise<boolean>;
-  delete(id: string): Promise<boolean>;
+  delete(id: string, opts?: {
+    expectedVersion?: number;
+  }): Promise<boolean>;
   /**
    * Inline retry loop rather than delegating to @atscript/db's
    * `withOptimisticRetry`: that helper expects the mutator to always return a

package/dist/atscript-db.mjs

@@ -131,8 +131,10 @@ var UsersStoreAtscriptDb = class extends UserStore {
 			throw e;
 		}
 	}
-	async delete(id) {
-		return (await this.table.deleteMany({ id })).deletedCount > 0;
+	async delete(id, opts) {
+		const filter = { id };
+		if (opts?.expectedVersion !== void 0) filter.version = opts.expectedVersion;
+		return (await this.table.deleteMany(filter)).deletedCount > 0;
 	}
 	/**
 	* Inline retry loop rather than delegating to @atscript/db's

package/dist/{federated-identity-store-D10-BT9l.d.cts → federated-identity-store-Ds7Ye9qJ.d.cts}

@@ -58,10 +58,11 @@ interface AccountData {
   lastLogin: number;
   /**
    * True while the user record exists from an admin-issued invite but the
-   * invitee has not yet accepted (set password + activate). Used by
-   * `InviteWorkflow` to gate the accept tail, reject duplicate invites, and
-   * power `auth/invite/resend` / `auth/invite/cancel`. Absent / `false` once
-   * the invite has been accepted.
+   * invitee has not yet accepted (set password + activate). The invite
+   * workflow uses it to gate the accept tail and to detect re-invites
+   * (`'reuse'` refreshes the pending row and sends a new link);
+   * `UserService.revokeInvitation()` deletes only rows that still have it.
+   * Absent / `false` once the invite has been accepted.
    */
   pendingInvitation?: boolean;
   /** Id of the user who issued the pending invite (written by the invite flow). */
@@ -293,9 +294,14 @@ declare abstract class UserStore<T extends object = object> {
   abstract update(id: string, update: UserStoreUpdate): Promise<boolean>;
   /**
    * Hard-delete the row by `id`. Returns `true` when a row was removed, `false`
-   * when the id was not found.
+   * when the id was not found. With `opts.expectedVersion`, delete only while
+   * the row's `version` still equals it (`false` otherwise) — a custom store
+   * that ignores it makes `UserService.revokeInvitation()` delete
+   * unconditionally after its re-check.
    */
-  abstract delete(id: string): Promise<boolean>;
+  abstract delete(id: string, opts?: {
+    expectedVersion?: number;
+  }): Promise<boolean>;
   /**
    * Run a read-modify-write cycle under optimistic concurrency, keyed by `id`.
    * Each attempt re-reads (via `findById`), calls `mutator`, and applies the

package/dist/{federated-identity-store-D10-BT9l.d.mts → federated-identity-store-Ds7Ye9qJ.d.mts}

@@ -58,10 +58,11 @@ interface AccountData {
   lastLogin: number;
   /**
    * True while the user record exists from an admin-issued invite but the
-   * invitee has not yet accepted (set password + activate). Used by
-   * `InviteWorkflow` to gate the accept tail, reject duplicate invites, and
-   * power `auth/invite/resend` / `auth/invite/cancel`. Absent / `false` once
-   * the invite has been accepted.
+   * invitee has not yet accepted (set password + activate). The invite
+   * workflow uses it to gate the accept tail and to detect re-invites
+   * (`'reuse'` refreshes the pending row and sends a new link);
+   * `UserService.revokeInvitation()` deletes only rows that still have it.
+   * Absent / `false` once the invite has been accepted.
    */
   pendingInvitation?: boolean;
   /** Id of the user who issued the pending invite (written by the invite flow). */
@@ -293,9 +294,14 @@ declare abstract class UserStore<T extends object = object> {
   abstract update(id: string, update: UserStoreUpdate): Promise<boolean>;
   /**
    * Hard-delete the row by `id`. Returns `true` when a row was removed, `false`
-   * when the id was not found.
+   * when the id was not found. With `opts.expectedVersion`, delete only while
+   * the row's `version` still equals it (`false` otherwise) — a custom store
+   * that ignores it makes `UserService.revokeInvitation()` delete
+   * unconditionally after its re-check.
    */
-  abstract delete(id: string): Promise<boolean>;
+  abstract delete(id: string, opts?: {
+    expectedVersion?: number;
+  }): Promise<boolean>;
   /**
    * Run a read-modify-write cycle under optimistic concurrency, keyed by `id`.
    * Each attempt re-reads (via `findById`), calls `mutator`, and applies the

package/dist/index.cjs

@@ -410,8 +410,8 @@ var UserService = class {
 	}
 	/**
 	* Creates a user with `account.active: false`. The invite workflow relies
-	* on this default (see `InviteWorkflow.acceptInvite` — pending invitees stay
-	* inactive until they accept). For setup scripts / seeders / tests that
+	* on this default (pending invitees stay inactive until they accept the
+	* invite). For setup scripts / seeders / tests that
 	* don't go through invite, follow up with `activateAccount(id)` or `login()`
 	* will throw `UserAuthError("INACTIVE")` — which the login workflow
 	* deliberately re-maps to `"Invalid credentials"` to avoid account
@@ -540,8 +540,9 @@ var UserService = class {
 	}
 	/**
 	* Hard-delete the user row by `id`. Returns nothing on success. Throws
-	* `UserAuthError("NOT_FOUND")` when no row matches. Used by the invite
-	* workflow's `auth/invite/cancel` to revoke a pending invitation.
+	* `UserAuthError("NOT_FOUND")` when no row matches. To revoke a pending
+	* invitation use {@link revokeInvitation}, which never deletes an account
+	* whose invite was accepted meanwhile.
 	*/
 	async deleteUser(id) {
 		if (!await this.store.delete(id)) throw new require_federated_identity_store.UserAuthError("NOT_FOUND");
@@ -550,7 +551,6 @@ var UserService = class {
 	* Deep-merge `patch` into the user record (top-level fields are shallow-
 	* merged; `account` / `mfa` / `password` are merged per their
 	* `@db.patch.strategy 'merge'` declaration). Returns the patched record.
-	* Used by the invite workflow's `applyProfile` default fallback.
 	*/
 	async update(id, patch) {
 		if (!await this.store.update(id, { set: patch })) throw new require_federated_identity_store.UserAuthError("NOT_FOUND");
@@ -577,6 +577,36 @@ var UserService = class {
 		return accepted;
 	}
 	/**
+	* Revoke a pending invitation: delete the invited account, so its invite
+	* link stops working (the invite workflow answers it with 410
+	* `INVITE_CANCELLED`). Returns `false` and deletes nothing when the account
+	* is not pending — the invite was already accepted — or when the row
+	* changed while the revoke ran. Throws `UserAuthError("NOT_FOUND")` when no
+	* row matches `id`.
+	*
+	* Safe against a concurrent acceptance or re-invite: one compare-and-set
+	* write first rotates `account.inviteNonce` while the row is still pending
+	* (an accept racing it fails), and the delete is conditional on the row's
+	* `version` still being the one that write produced — any write in between
+	* (a re-invite, an acceptance) makes it delete nothing. The bundled stores
+	* honour the conditional delete; a custom store whose `delete()` ignores
+	* `expectedVersion` leaves a window of one round-trip between the re-check
+	* and the delete.
+	*/
+	async revokeInvitation(id) {
+		const nonce = (0, node_crypto.randomBytes)(16).toString("base64url");
+		let pending = false;
+		await this.store.withCas(id, (user) => {
+			pending = user.account.pendingInvitation === true;
+			if (!pending) return null;
+			return { set: { account: { inviteNonce: nonce } } };
+		});
+		if (!pending) return false;
+		const claimed = await this.store.findById(id);
+		if (!claimed?.account.pendingInvitation || claimed.account.inviteNonce !== nonce) return false;
+		return this.store.delete(id, { expectedVersion: claimed.version ?? 0 });
+	}
+	/**
 	* Flip the account active. `opts.verifiedEmail` lets callers that just
 	* proved an inbox (invite magic link, signup OTP) record the correspondence
 	* address in the same store write — see {@link setVerifiedEmail}.
@@ -1200,7 +1230,10 @@ var UserStoreMemory = class extends require_federated_identity_store.UserStore {
 		user.version = (user.version ?? 0) + 1;
 		return true;
 	}
-	async delete(id) {
+	async delete(id, opts) {
+		const user = this.store.get(id);
+		if (!user) return false;
+		if (opts?.expectedVersion !== void 0 && (user.version ?? 0) !== opts.expectedVersion) return false;
 		return this.store.delete(id);
 	}
 	async withCas(id, mutator, opts) {

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-D10-BT9l.cjs";
+import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-Ds7Ye9qJ.cjs";
 export declare class UserAuthError extends Error {
   readonly type: UserAuthErrorType;
   readonly details?: Record<string, unknown> | undefined;
@@ -106,8 +106,8 @@ export declare class UserService<T extends object = object> {
   getUserSnapshot(id: string, scope: object): Promise<UserCredentials & T>;
   /**
    * Creates a user with `account.active: false`. The invite workflow relies
-   * on this default (see `InviteWorkflow.acceptInvite` — pending invitees stay
-   * inactive until they accept). For setup scripts / seeders / tests that
+   * on this default (pending invitees stay inactive until they accept the
+   * invite). For setup scripts / seeders / tests that
    * don't go through invite, follow up with `activateAccount(id)` or `login()`
    * will throw `UserAuthError("INACTIVE")` — which the login workflow
    * deliberately re-maps to `"Invalid credentials"` to avoid account
@@ -160,15 +160,15 @@ export declare class UserService<T extends object = object> {
   setPassword(id: string, newPassword: string): Promise<void>;
   /**
    * Hard-delete the user row by `id`. Returns nothing on success. Throws
-   * `UserAuthError("NOT_FOUND")` when no row matches. Used by the invite
-   * workflow's `auth/invite/cancel` to revoke a pending invitation.
+   * `UserAuthError("NOT_FOUND")` when no row matches. To revoke a pending
+   * invitation use {@link revokeInvitation}, which never deletes an account
+   * whose invite was accepted meanwhile.
    */
   deleteUser(id: string): Promise<void>;
   /**
    * Deep-merge `patch` into the user record (top-level fields are shallow-
    * merged; `account` / `mfa` / `password` are merged per their
    * `@db.patch.strategy 'merge'` declaration). Returns the patched record.
-   * Used by the invite workflow's `applyProfile` default fallback.
    */
   update(id: string, patch: Partial<UserCredentials & T>): Promise<UserCredentials & T>;
   /**
@@ -180,6 +180,24 @@ export declare class UserService<T extends object = object> {
    * the same account can never both complete.
    */
   acceptInvitation(id: string, nonce: string | undefined): Promise<boolean>;
+  /**
+   * Revoke a pending invitation: delete the invited account, so its invite
+   * link stops working (the invite workflow answers it with 410
+   * `INVITE_CANCELLED`). Returns `false` and deletes nothing when the account
+   * is not pending — the invite was already accepted — or when the row
+   * changed while the revoke ran. Throws `UserAuthError("NOT_FOUND")` when no
+   * row matches `id`.
+   *
+   * Safe against a concurrent acceptance or re-invite: one compare-and-set
+   * write first rotates `account.inviteNonce` while the row is still pending
+   * (an accept racing it fails), and the delete is conditional on the row's
+   * `version` still being the one that write produced — any write in between
+   * (a re-invite, an acceptance) makes it delete nothing. The bundled stores
+   * honour the conditional delete; a custom store whose `delete()` ignores
+   * `expectedVersion` leaves a window of one round-trip between the re-check
+   * and the delete.
+   */
+  revokeInvitation(id: string): Promise<boolean>;
   /**
    * Flip the account active. `opts.verifiedEmail` lets callers that just
    * proved an inbox (invite magic link, signup OTP) record the correspondence
@@ -415,7 +433,9 @@ export declare class UserStoreMemory<T extends object = object> extends UserStor
    */
   private assertHandlesUnique;
   update(id: string, update: UserStoreUpdate): Promise<boolean>;
-  delete(id: string): Promise<boolean>;
+  delete(id: string, opts?: {
+    expectedVersion?: number;
+  }): Promise<boolean>;
   withCas(id: string, mutator: (current: UserCredentials & T) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
 interface FederatedIdentityStoreMemoryOptions {

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-D10-BT9l.mjs";
+import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-Ds7Ye9qJ.mjs";
 export declare class UserAuthError extends Error {
   readonly type: UserAuthErrorType;
   readonly details?: Record<string, unknown> | undefined;
@@ -106,8 +106,8 @@ export declare class UserService<T extends object = object> {
   getUserSnapshot(id: string, scope: object): Promise<UserCredentials & T>;
   /**
    * Creates a user with `account.active: false`. The invite workflow relies
-   * on this default (see `InviteWorkflow.acceptInvite` — pending invitees stay
-   * inactive until they accept). For setup scripts / seeders / tests that
+   * on this default (pending invitees stay inactive until they accept the
+   * invite). For setup scripts / seeders / tests that
    * don't go through invite, follow up with `activateAccount(id)` or `login()`
    * will throw `UserAuthError("INACTIVE")` — which the login workflow
    * deliberately re-maps to `"Invalid credentials"` to avoid account
@@ -160,15 +160,15 @@ export declare class UserService<T extends object = object> {
   setPassword(id: string, newPassword: string): Promise<void>;
   /**
    * Hard-delete the user row by `id`. Returns nothing on success. Throws
-   * `UserAuthError("NOT_FOUND")` when no row matches. Used by the invite
-   * workflow's `auth/invite/cancel` to revoke a pending invitation.
+   * `UserAuthError("NOT_FOUND")` when no row matches. To revoke a pending
+   * invitation use {@link revokeInvitation}, which never deletes an account
+   * whose invite was accepted meanwhile.
    */
   deleteUser(id: string): Promise<void>;
   /**
    * Deep-merge `patch` into the user record (top-level fields are shallow-
    * merged; `account` / `mfa` / `password` are merged per their
    * `@db.patch.strategy 'merge'` declaration). Returns the patched record.
-   * Used by the invite workflow's `applyProfile` default fallback.
    */
   update(id: string, patch: Partial<UserCredentials & T>): Promise<UserCredentials & T>;
   /**
@@ -180,6 +180,24 @@ export declare class UserService<T extends object = object> {
    * the same account can never both complete.
    */
   acceptInvitation(id: string, nonce: string | undefined): Promise<boolean>;
+  /**
+   * Revoke a pending invitation: delete the invited account, so its invite
+   * link stops working (the invite workflow answers it with 410
+   * `INVITE_CANCELLED`). Returns `false` and deletes nothing when the account
+   * is not pending — the invite was already accepted — or when the row
+   * changed while the revoke ran. Throws `UserAuthError("NOT_FOUND")` when no
+   * row matches `id`.
+   *
+   * Safe against a concurrent acceptance or re-invite: one compare-and-set
+   * write first rotates `account.inviteNonce` while the row is still pending
+   * (an accept racing it fails), and the delete is conditional on the row's
+   * `version` still being the one that write produced — any write in between
+   * (a re-invite, an acceptance) makes it delete nothing. The bundled stores
+   * honour the conditional delete; a custom store whose `delete()` ignores
+   * `expectedVersion` leaves a window of one round-trip between the re-check
+   * and the delete.
+   */
+  revokeInvitation(id: string): Promise<boolean>;
   /**
    * Flip the account active. `opts.verifiedEmail` lets callers that just
    * proved an inbox (invite magic link, signup OTP) record the correspondence
@@ -415,7 +433,9 @@ export declare class UserStoreMemory<T extends object = object> extends UserStor
    */
   private assertHandlesUnique;
   update(id: string, update: UserStoreUpdate): Promise<boolean>;
-  delete(id: string): Promise<boolean>;
+  delete(id: string, opts?: {
+    expectedVersion?: number;
+  }): Promise<boolean>;
   withCas(id: string, mutator: (current: UserCredentials & T) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
 interface FederatedIdentityStoreMemoryOptions {

package/dist/index.mjs

@@ -409,8 +409,8 @@ var UserService = class {
 	}
 	/**
 	* Creates a user with `account.active: false`. The invite workflow relies
-	* on this default (see `InviteWorkflow.acceptInvite` — pending invitees stay
-	* inactive until they accept). For setup scripts / seeders / tests that
+	* on this default (pending invitees stay inactive until they accept the
+	* invite). For setup scripts / seeders / tests that
 	* don't go through invite, follow up with `activateAccount(id)` or `login()`
 	* will throw `UserAuthError("INACTIVE")` — which the login workflow
 	* deliberately re-maps to `"Invalid credentials"` to avoid account
@@ -539,8 +539,9 @@ var UserService = class {
 	}
 	/**
 	* Hard-delete the user row by `id`. Returns nothing on success. Throws
-	* `UserAuthError("NOT_FOUND")` when no row matches. Used by the invite
-	* workflow's `auth/invite/cancel` to revoke a pending invitation.
+	* `UserAuthError("NOT_FOUND")` when no row matches. To revoke a pending
+	* invitation use {@link revokeInvitation}, which never deletes an account
+	* whose invite was accepted meanwhile.
 	*/
 	async deleteUser(id) {
 		if (!await this.store.delete(id)) throw new UserAuthError("NOT_FOUND");
@@ -549,7 +550,6 @@ var UserService = class {
 	* Deep-merge `patch` into the user record (top-level fields are shallow-
 	* merged; `account` / `mfa` / `password` are merged per their
 	* `@db.patch.strategy 'merge'` declaration). Returns the patched record.
-	* Used by the invite workflow's `applyProfile` default fallback.
 	*/
 	async update(id, patch) {
 		if (!await this.store.update(id, { set: patch })) throw new UserAuthError("NOT_FOUND");
@@ -576,6 +576,36 @@ var UserService = class {
 		return accepted;
 	}
 	/**
+	* Revoke a pending invitation: delete the invited account, so its invite
+	* link stops working (the invite workflow answers it with 410
+	* `INVITE_CANCELLED`). Returns `false` and deletes nothing when the account
+	* is not pending — the invite was already accepted — or when the row
+	* changed while the revoke ran. Throws `UserAuthError("NOT_FOUND")` when no
+	* row matches `id`.
+	*
+	* Safe against a concurrent acceptance or re-invite: one compare-and-set
+	* write first rotates `account.inviteNonce` while the row is still pending
+	* (an accept racing it fails), and the delete is conditional on the row's
+	* `version` still being the one that write produced — any write in between
+	* (a re-invite, an acceptance) makes it delete nothing. The bundled stores
+	* honour the conditional delete; a custom store whose `delete()` ignores
+	* `expectedVersion` leaves a window of one round-trip between the re-check
+	* and the delete.
+	*/
+	async revokeInvitation(id) {
+		const nonce = randomBytes(16).toString("base64url");
+		let pending = false;
+		await this.store.withCas(id, (user) => {
+			pending = user.account.pendingInvitation === true;
+			if (!pending) return null;
+			return { set: { account: { inviteNonce: nonce } } };
+		});
+		if (!pending) return false;
+		const claimed = await this.store.findById(id);
+		if (!claimed?.account.pendingInvitation || claimed.account.inviteNonce !== nonce) return false;
+		return this.store.delete(id, { expectedVersion: claimed.version ?? 0 });
+	}
+	/**
 	* Flip the account active. `opts.verifiedEmail` lets callers that just
 	* proved an inbox (invite magic link, signup OTP) record the correspondence
 	* address in the same store write — see {@link setVerifiedEmail}.
@@ -1199,7 +1229,10 @@ var UserStoreMemory = class extends UserStore {
 		user.version = (user.version ?? 0) + 1;
 		return true;
 	}
-	async delete(id) {
+	async delete(id, opts) {
+		const user = this.store.get(id);
+		if (!user) return false;
+		if (opts?.expectedVersion !== void 0 && (user.version ?? 0) !== opts.expectedVersion) return false;
 		return this.store.delete(id);
 	}
 	async withCas(id, mutator, opts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/user",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "User credential primitives for aoothjs",
   "keywords": [
     "aoothjs",
@@ -60,18 +60,18 @@
     "access": "public"
   },
   "devDependencies": {
-    "@atscript/core": "^0.2.3",
-    "@atscript/db": "^0.1.167",
-    "@atscript/db-sql-tools": "^0.1.167",
-    "@atscript/db-sqlite": "^0.1.167",
-    "@atscript/typescript": "^0.2.3",
+    "@atscript/core": "^0.2.4",
+    "@atscript/db": "^0.1.168",
+    "@atscript/db-sql-tools": "^0.1.168",
+    "@atscript/db-sqlite": "^0.1.168",
+    "@atscript/typescript": "^0.2.4",
     "@types/better-sqlite3": "^7.6.13",
-    "@uniqu/core": "^0.1.15",
+    "@uniqu/core": "^0.2.0",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.2.3"
+    "unplugin-atscript": "^0.2.4"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.167"
+    "@atscript/db": "^0.1.168"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {