@krizaka/auth 0.4.0 → 0.6.0

package/README.md

@@ -1,12 +1,12 @@
 # @krizaka/auth
 
-The account of a Krizaka product, behind a port: a display name, language, theme and avatar seed; the e-mail change by a link mailed to the **new** address (the verified flag is set by that very act); the password (checked before anything sensitive, other sessions signed out on change; reset by a link mailed to the account's address — the same answer whether or not the address has an account, the link used once within 30 minutes, every session signed out); the live sessions with sign-out of the others; the data export; the deletion. Each product keeps its **own** accounts — the package brings an adapter over the product's PostgreSQL and the migration it needs, nothing central.
+The account of a Krizaka product, behind a port: a display name, language, theme and avatar seed; the e-mail change by a link mailed to the **new** address (the verified flag is set by that very act); the password (checked before anything sensitive, other sessions signed out on change; reset by a link mailed to the account's address — the same answer whether or not the address has an account, the link used once within 30 minutes by default — `passwordResetTtlMinutes`, 5 to 1440, read by the product from its settings and said in the mail — every session signed out); the live sessions with sign-out of the others; the data export; the deletion. Each product keeps its **own** accounts — the package brings an adapter over the product's PostgreSQL and the migration it needs, nothing central.
 
 ```ts
-import { accountsMigration, postgresAccounts } from "@krizaka/auth";
+import { accountsMigration, dbAccounts } from "@krizaka/auth";
 
 await db.query(accountsMigration({ backfillVerified: true })); // once, in your migrations (idempotent)
-const accounts = postgresAccounts({ query, transaction, mail, baseUrl: "https://www.akinaza.com", product: "Akinaza", tokenPrefix: "ae", passwords: { hash, verify }, tokenHash }); // `transaction`: the work on one connection (BEGIN … COMMIT); the password reset needs it under concurrent requests
+const accounts = dbAccounts({ query, transaction, mail, baseUrl: "https://www.akinaza.com", product: "Akinaza", tokenPrefix: "ae", passwords: { hash, verify }, tokenHash, passwordResetTtlMinutes: 30 /* optional, 5–1440 */ }); // `transaction`: the work on one connection (BEGIN … COMMIT); the password reset needs it under concurrent requests
 await accounts.updateProfile(id, { name: "Éric", theme: "dark" });
 await accounts.sessions(id, new Date(), currentSessionId);
 await accounts.requestPasswordReset(email, new Date()); // mails `<baseUrl>/<locale>/reset-password?token=…`
@@ -18,3 +18,22 @@ The product keeps what is its own: its session cookie and token hashing (`tokenH
 ## Roles per scope
 
 A role model is data: `defineRoles({ roles, permissions, manages })` says which roles exist, what each may do and who may hand which role to whom. `createRoles` keeps memberships (one person, several scopes, a role in each) and invitations (an e-mail invited with a role, a link used once, only its hash kept, never demoting), refuses to remove or demote the last owner, and answers `authorize(account, scope, "invoices")` with the role or a stable refusal (`NOT_A_MEMBER` 404, `FORBIDDEN` 403). `rolesMigration(roles, { scopeTable })` makes the tables.
+
+## Federated sign-in (Google, Apple, Facebook, native PKCE)
+
+Each product keeps its own accounts; **krizaka-users** is the federation provider behind a port, so a product holds no OAuth app of its own. `IdentityProvider` has two calls: `start(provider, returnTo, { codeChallenge? })` gives the address to send the person to, `complete(code, { codeVerifier? })` exchanges the one-time code (single use) for a verified `ExternalIdentity` (`issuer`, `subject`, `email`, `emailVerified`). A return address stays on the product (a path); an unknown provider is refused.
+
+```ts
+import { createFederatedSignIn, dbIdentityLinks, identityLinksMigration, usersIdentityProvider } from "@krizaka/auth";
+
+await db.query(identityLinksMigration()); // once, in your migrations (idempotent): (issuer, subject) → account
+const federation = usersIdentityProvider({ baseUrl: "https://auth.dev.akinaza.com", appUrl: "https://dev.akinaza.com", fetch });
+const signIn = createFederatedSignIn({ links: dbIdentityLinks(query), accounts: { findByEmail, create }, clock });
+
+const { url } = await federation.start("google", "/fr/account"); // redirect there
+const result = await signIn.signIn(await federation.complete(code)); // { status: "signed-in", accountId, via } | { status: "refused", code }
+```
+
+An external identity attaches to an existing account **only when the address is verified on both sides** (by the provider and by the product); otherwise it is refused (`EMAIL_NOT_VERIFIED`, `ACCOUNT_EMAIL_UNVERIFIED`), and it is never a second user table. `create` is optional: leave it out and a person without an account is refused (`NO_ACCOUNT`). Adapters run the conformance kits of `@krizaka/auth/testkit` (`identityProviderContract`, `identityLinkStoreContract`).
+
+> `postgresAccounts` was the first name of `dbAccounts`; it stays as a `@deprecated` alias for one minor and leaves in the next major.

package/dist/chunk-H7AKE2OH.js

@@ -0,0 +1,131 @@
+// src/federation.ts
+import crypto from "crypto";
+var FEDERATED_PROVIDERS = ["google", "apple", "facebook"];
+var isFederatedProvider = (value) => FEDERATED_PROVIDERS.includes(value);
+var FEDERATION_CODE = {
+  invalidCode: "INVALID_CODE",
+  unknownProvider: "UNKNOWN_PROVIDER",
+  badReturn: "BAD_RETURN_TO",
+  unavailable: "UNAVAILABLE"
+};
+var FederationError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "FederationError";
+  }
+  code;
+};
+var pkceChallenge = (verifier) => crypto.createHash("sha256").update(verifier).digest("base64url");
+var isLocalReturn = (returnTo) => returnTo.startsWith("/") && !returnTo.startsWith("//") && !returnTo.includes("\\") && [...returnTo].every((c) => c.charCodeAt(0) > 31);
+function memoryIdentityProvider() {
+  const pending = /* @__PURE__ */ new Map();
+  let counter = 0;
+  return {
+    async start(provider, returnTo) {
+      if (!isFederatedProvider(provider)) throw new FederationError(FEDERATION_CODE.unknownProvider, `Unknown provider ${String(provider)}`);
+      if (!isLocalReturn(returnTo)) throw new FederationError(FEDERATION_CODE.badReturn, "That return address is not allowed");
+      counter += 1;
+      const state = `state-${counter}`;
+      return { url: `https://auth.test/${provider}/start?state=${state}`, state };
+    },
+    async complete(code, options = {}) {
+      const entry = pending.get(code);
+      pending.delete(code);
+      if (!entry) throw new FederationError(FEDERATION_CODE.invalidCode, "That code is not valid");
+      if (entry.challenge !== null && (!options.codeVerifier || pkceChallenge(options.codeVerifier) !== entry.challenge)) throw new FederationError(FEDERATION_CODE.invalidCode, "That code is not valid");
+      return entry.identity;
+    },
+    issue(identity, challenge) {
+      counter += 1;
+      pending.set(`code-${counter}`, { identity, challenge: challenge ?? null });
+      return `code-${counter}`;
+    }
+  };
+}
+
+// src/identity-links.ts
+import { compareAsc } from "date-fns";
+var IdentityLinkError = class extends Error {
+  code = "ALREADY_LINKED";
+  constructor() {
+    super("That external identity is already linked to another account");
+    this.name = "IdentityLinkError";
+  }
+};
+function memoryIdentityLinks() {
+  const rows = /* @__PURE__ */ new Map();
+  const key = (issuer, subject) => `${issuer}
+${subject}`;
+  return {
+    async find(issuer, subject) {
+      return rows.get(key(issuer, subject))?.accountId ?? null;
+    },
+    async link(accountId, issuer, subject, now) {
+      const existing = rows.get(key(issuer, subject));
+      if (existing && existing.accountId !== accountId) throw new IdentityLinkError();
+      if (!existing) rows.set(key(issuer, subject), { accountId, issuer, subject, linkedAt: now });
+    },
+    async unlink(accountId, issuer, subject) {
+      const existing = rows.get(key(issuer, subject));
+      if (existing?.accountId !== accountId) return false;
+      rows.delete(key(issuer, subject));
+      return true;
+    },
+    async list(accountId) {
+      return [...rows.values()].filter((r) => r.accountId === accountId).sort((a, b) => compareAsc(a.linkedAt, b.linkedAt)).map(({ issuer, subject, linkedAt }) => ({ issuer, subject, linkedAt }));
+    }
+  };
+}
+function identityLinksMigration() {
+  return `
+CREATE TABLE IF NOT EXISTS external_identities (
+  issuer     text NOT NULL CHECK (char_length(issuer) BETWEEN 1 AND 200),
+  subject    text NOT NULL CHECK (char_length(subject) BETWEEN 1 AND 200),
+  account_id uuid NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+  linked_at  timestamptz NOT NULL,
+  PRIMARY KEY (issuer, subject)
+);
+CREATE INDEX IF NOT EXISTS external_identities_account ON external_identities(account_id, linked_at);
+`;
+}
+function dbIdentityLinks(query) {
+  return {
+    async find(issuer, subject) {
+      const [row] = await query("SELECT account_id FROM external_identities WHERE issuer = $1 AND subject = $2", [issuer, subject]);
+      return row?.account_id ?? null;
+    },
+    async link(accountId, issuer, subject, now) {
+      const rows = await query(
+        `INSERT INTO external_identities (issuer, subject, account_id, linked_at) VALUES ($1, $2, $3, $4)
+         ON CONFLICT (issuer, subject) DO UPDATE SET issuer = excluded.issuer WHERE external_identities.account_id = excluded.account_id
+         RETURNING account_id`,
+        [issuer, subject, accountId, now]
+      );
+      if (rows.length === 0) throw new IdentityLinkError();
+    },
+    async unlink(accountId, issuer, subject) {
+      const rows = await query("DELETE FROM external_identities WHERE issuer = $1 AND subject = $2 AND account_id = $3 RETURNING 1", [issuer, subject, accountId]);
+      return rows.length > 0;
+    },
+    async list(accountId) {
+      const rows = await query("SELECT issuer, subject, linked_at FROM external_identities WHERE account_id = $1 ORDER BY linked_at, issuer, subject", [accountId]);
+      return rows.map((r) => ({ issuer: r.issuer, subject: r.subject, linkedAt: r.linked_at }));
+    }
+  };
+}
+
+export {
+  FEDERATED_PROVIDERS,
+  isFederatedProvider,
+  FEDERATION_CODE,
+  FederationError,
+  pkceChallenge,
+  isLocalReturn,
+  memoryIdentityProvider,
+  IdentityLinkError,
+  memoryIdentityLinks,
+  identityLinksMigration,
+  dbIdentityLinks
+};
+//# sourceMappingURL=chunk-H7AKE2OH.js.map

package/dist/chunk-H7AKE2OH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/federation.ts","../src/identity-links.ts"],"sourcesContent":["import crypto from \"node:crypto\";\n\n/**\n * Federated sign-in (Google, Apple, Facebook, a native app's PKCE) delegated to krizaka-users, behind a PORT. The product keeps its\n * own accounts (`postgresAccounts`); this port only answers « who is this person, according to the provider ». An external\n * identity is never a second user table: it is a link to an account the product already has.\n */\nexport type FederatedProvider = \"google\" | \"apple\" | \"facebook\";\n\n/** The providers the port knows; anything else is refused before it reaches the adapter. */\nexport const FEDERATED_PROVIDERS: readonly FederatedProvider[] = [\"google\", \"apple\", \"facebook\"];\n\nexport const isFederatedProvider = (value: unknown): value is FederatedProvider => FEDERATED_PROVIDERS.includes(value as FederatedProvider);\n\n/** Who the provider says the person is. `issuer` + `subject` identify them for good; the address can change. */\nexport interface ExternalIdentity {\n  /** The authority that vouches (`https://accounts.google.com`, `https://appleid.apple.com`…). */\n  issuer: string;\n  /** The person's stable id at that authority. */\n  subject: string;\n  email: string | null;\n  /** The provider checked the address (a Facebook address, for one, may not be). */\n  emailVerified: boolean;\n  name: string | null;\n}\n\n/** What a sign-in is started with: a native app sends the PKCE challenge, a browser flow does not. */\nexport interface StartOptions {\n  /** The S256 challenge of a PKCE flow (a native app); the matching verifier goes to `complete`. */\n  codeChallenge?: string;\n}\n\nexport interface StartedSignIn {\n  /** Where to send the person: the provider's consent page, through krizaka-users. */\n  url: string;\n  /** Echoed back with the code: the product checks it against the one it kept for this browser. */\n  state: string;\n}\n\nexport interface CompleteOptions {\n  /** The PKCE verifier of the challenge given to `start`. */\n  codeVerifier?: string;\n}\n\nexport interface IdentityProvider {\n  /** Starts a sign-in with `provider`; the person comes back to `returnTo` (a path or an address the adapter allows) with a one-time code. */\n  start(provider: FederatedProvider, returnTo: string, options?: StartOptions): Promise<StartedSignIn>;\n  /** Exchanges the one-time code (single use) for the verified identity. Throws `FederationError(\"INVALID_CODE\")` for a code that is unknown, used or expired. */\n  complete(code: string, options?: CompleteOptions): Promise<ExternalIdentity>;\n}\n\nexport const FEDERATION_CODE = {\n  invalidCode: \"INVALID_CODE\",\n  unknownProvider: \"UNKNOWN_PROVIDER\",\n  badReturn: \"BAD_RETURN_TO\",\n  unavailable: \"UNAVAILABLE\",\n} as const;\nexport type FederationCode = (typeof FEDERATION_CODE)[keyof typeof FEDERATION_CODE];\n\nexport class FederationError extends Error {\n  constructor(\n    readonly code: FederationCode,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"FederationError\";\n  }\n}\n\n/** The S256 challenge of a PKCE verifier: base64url(SHA-256(verifier)). A native app computes it; the adapter and the in-memory provider check it. */\nexport const pkceChallenge = (verifier: string): string => crypto.createHash(\"sha256\").update(verifier).digest(\"base64url\");\n\n/** A return address stays on the product: a path (`/fr/account`), never `//host` or a scheme. */\nexport const isLocalReturn = (returnTo: string): boolean => returnTo.startsWith(\"/\") && !returnTo.startsWith(\"//\") && !returnTo.includes(\"\\\\\") && [...returnTo].every((c) => c.charCodeAt(0) > 31);\n\n/** An in-memory provider: the tests' adapter, and the reference the contract is written against. */\nexport function memoryIdentityProvider(): IdentityProvider & {\n  /** Test seam: the one-time code the provider would hand back for this identity (with the PKCE challenge it was started with, if any). */\n  issue(identity: ExternalIdentity, challenge?: string): string;\n} {\n  const pending = new Map<string, { identity: ExternalIdentity; challenge: string | null }>();\n  let counter = 0;\n  return {\n    async start(provider, returnTo) {\n      if (!isFederatedProvider(provider)) throw new FederationError(FEDERATION_CODE.unknownProvider, `Unknown provider ${String(provider)}`);\n      if (!isLocalReturn(returnTo)) throw new FederationError(FEDERATION_CODE.badReturn, \"That return address is not allowed\");\n      counter += 1;\n      const state = `state-${counter}`;\n      return { url: `https://auth.test/${provider}/start?state=${state}`, state };\n    },\n    async complete(code, options = {}) {\n      const entry = pending.get(code);\n      pending.delete(code); // single use, whatever happens next\n      if (!entry) throw new FederationError(FEDERATION_CODE.invalidCode, \"That code is not valid\");\n      if (entry.challenge !== null && (!options.codeVerifier || pkceChallenge(options.codeVerifier) !== entry.challenge)) throw new FederationError(FEDERATION_CODE.invalidCode, \"That code is not valid\");\n      return entry.identity;\n    },\n    issue(identity, challenge) {\n      counter += 1;\n      pending.set(`code-${counter}`, { identity, challenge: challenge ?? null });\n      return `code-${counter}`;\n    },\n  };\n}\n","import { compareAsc } from \"date-fns\";\n\nimport type { Query } from \"./accounts\";\n\n/**\n * Which external identity belongs to which account. Never a second user table: a row is only `(issuer, subject) → account`.\n * The product's `accounts` stays the one place a person lives.\n */\nexport interface IdentityLinkStore {\n  /** The account this external identity is linked to, or null. */\n  find(issuer: string, subject: string): Promise<string | null>;\n  /** Links it. Idempotent for the same account; throws when the identity is already linked to another one. */\n  link(accountId: string, issuer: string, subject: string, now: Date): Promise<void>;\n  /** Removes the link (the person unlinks Google); true when there was one. */\n  unlink(accountId: string, issuer: string, subject: string): Promise<boolean>;\n  /** The identities linked to an account, oldest first. */\n  list(accountId: string): Promise<{ issuer: string; subject: string; linkedAt: Date }[]>;\n}\n\nexport class IdentityLinkError extends Error {\n  readonly code = \"ALREADY_LINKED\";\n  constructor() {\n    super(\"That external identity is already linked to another account\");\n    this.name = \"IdentityLinkError\";\n  }\n}\n\n/** An in-memory store: the tests' adapter, and the reference the contract is written against. */\nexport function memoryIdentityLinks(): IdentityLinkStore {\n  const rows = new Map<string, { accountId: string; issuer: string; subject: string; linkedAt: Date }>();\n  const key = (issuer: string, subject: string) => `${issuer}\\n${subject}`;\n  return {\n    async find(issuer, subject) {\n      return rows.get(key(issuer, subject))?.accountId ?? null;\n    },\n    async link(accountId, issuer, subject, now) {\n      const existing = rows.get(key(issuer, subject));\n      if (existing && existing.accountId !== accountId) throw new IdentityLinkError();\n      if (!existing) rows.set(key(issuer, subject), { accountId, issuer, subject, linkedAt: now });\n    },\n    async unlink(accountId, issuer, subject) {\n      const existing = rows.get(key(issuer, subject));\n      if (existing?.accountId !== accountId) return false;\n      rows.delete(key(issuer, subject));\n      return true;\n    },\n    async list(accountId) {\n      return [...rows.values()].filter((r) => r.accountId === accountId).sort((a, b) => compareAsc(a.linkedAt, b.linkedAt)).map(({ issuer, subject, linkedAt }) => ({ issuer, subject, linkedAt }));\n    },\n  };\n}\n\n/** The table of links (idempotent). `accounts` is the product's account table. */\nexport function identityLinksMigration(): string {\n  return `\nCREATE TABLE IF NOT EXISTS external_identities (\n  issuer     text NOT NULL CHECK (char_length(issuer) BETWEEN 1 AND 200),\n  subject    text NOT NULL CHECK (char_length(subject) BETWEEN 1 AND 200),\n  account_id uuid NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,\n  linked_at  timestamptz NOT NULL,\n  PRIMARY KEY (issuer, subject)\n);\nCREATE INDEX IF NOT EXISTS external_identities_account ON external_identities(account_id, linked_at);\n`;\n}\n\n/** The store over the product's own database (`external_identities`; see `identityLinksMigration`). */\nexport function dbIdentityLinks(query: Query): IdentityLinkStore {\n  return {\n    async find(issuer, subject) {\n      const [row] = await query<{ account_id: string }>(\"SELECT account_id FROM external_identities WHERE issuer = $1 AND subject = $2\", [issuer, subject]);\n      return row?.account_id ?? null;\n    },\n    async link(accountId, issuer, subject, now) {\n      // One statement: the primary key decides a race; the same account is a no-op, another account is refused.\n      const rows = await query<{ account_id: string }>(\n        `INSERT INTO external_identities (issuer, subject, account_id, linked_at) VALUES ($1, $2, $3, $4)\n         ON CONFLICT (issuer, subject) DO UPDATE SET issuer = excluded.issuer WHERE external_identities.account_id = excluded.account_id\n         RETURNING account_id`,\n        [issuer, subject, accountId, now],\n      );\n      if (rows.length === 0) throw new IdentityLinkError();\n    },\n    async unlink(accountId, issuer, subject) {\n      const rows = await query(\"DELETE FROM external_identities WHERE issuer = $1 AND subject = $2 AND account_id = $3 RETURNING 1\", [issuer, subject, accountId]);\n      return rows.length > 0;\n    },\n    async list(accountId) {\n      const rows = await query<{ issuer: string; subject: string; linked_at: Date }>(\"SELECT issuer, subject, linked_at FROM external_identities WHERE account_id = $1 ORDER BY linked_at, issuer, subject\", [accountId]);\n      return rows.map((r) => ({ issuer: r.issuer, subject: r.subject, linkedAt: r.linked_at }));\n    },\n  };\n}\n"],"mappings":";AAAA,OAAO,YAAY;AAUZ,IAAM,sBAAoD,CAAC,UAAU,SAAS,UAAU;AAExF,IAAM,sBAAsB,CAAC,UAA+C,oBAAoB,SAAS,KAA0B;AAuCnI,IAAM,kBAAkB;AAAA,EAC7B,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,aAAa;AACf;AAGO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACzC,YACW,MACT,SACA;AACA,UAAM,OAAO;AAHJ;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAMb;AAGO,IAAM,gBAAgB,CAAC,aAA6B,OAAO,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,WAAW;AAGnH,IAAM,gBAAgB,CAAC,aAA8B,SAAS,WAAW,GAAG,KAAK,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,SAAS,SAAS,IAAI,KAAK,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE;AAG1L,SAAS,yBAGd;AACA,QAAM,UAAU,oBAAI,IAAsE;AAC1F,MAAI,UAAU;AACd,SAAO;AAAA,IACL,MAAM,MAAM,UAAU,UAAU;AAC9B,UAAI,CAAC,oBAAoB,QAAQ,EAAG,OAAM,IAAI,gBAAgB,gBAAgB,iBAAiB,oBAAoB,OAAO,QAAQ,CAAC,EAAE;AACrI,UAAI,CAAC,cAAc,QAAQ,EAAG,OAAM,IAAI,gBAAgB,gBAAgB,WAAW,oCAAoC;AACvH,iBAAW;AACX,YAAM,QAAQ,SAAS,OAAO;AAC9B,aAAO,EAAE,KAAK,qBAAqB,QAAQ,gBAAgB,KAAK,IAAI,MAAM;AAAA,IAC5E;AAAA,IACA,MAAM,SAAS,MAAM,UAAU,CAAC,GAAG;AACjC,YAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,cAAQ,OAAO,IAAI;AACnB,UAAI,CAAC,MAAO,OAAM,IAAI,gBAAgB,gBAAgB,aAAa,wBAAwB;AAC3F,UAAI,MAAM,cAAc,SAAS,CAAC,QAAQ,gBAAgB,cAAc,QAAQ,YAAY,MAAM,MAAM,WAAY,OAAM,IAAI,gBAAgB,gBAAgB,aAAa,wBAAwB;AACnM,aAAO,MAAM;AAAA,IACf;AAAA,IACA,MAAM,UAAU,WAAW;AACzB,iBAAW;AACX,cAAQ,IAAI,QAAQ,OAAO,IAAI,EAAE,UAAU,WAAW,aAAa,KAAK,CAAC;AACzE,aAAO,QAAQ,OAAO;AAAA,IACxB;AAAA,EACF;AACF;;;ACvGA,SAAS,kBAAkB;AAmBpB,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC,OAAO;AAAA,EAChB,cAAc;AACZ,UAAM,6DAA6D;AACnE,SAAK,OAAO;AAAA,EACd;AACF;AAGO,SAAS,sBAAyC;AACvD,QAAM,OAAO,oBAAI,IAAoF;AACrG,QAAM,MAAM,CAAC,QAAgB,YAAoB,GAAG,MAAM;AAAA,EAAK,OAAO;AACtE,SAAO;AAAA,IACL,MAAM,KAAK,QAAQ,SAAS;AAC1B,aAAO,KAAK,IAAI,IAAI,QAAQ,OAAO,CAAC,GAAG,aAAa;AAAA,IACtD;AAAA,IACA,MAAM,KAAK,WAAW,QAAQ,SAAS,KAAK;AAC1C,YAAM,WAAW,KAAK,IAAI,IAAI,QAAQ,OAAO,CAAC;AAC9C,UAAI,YAAY,SAAS,cAAc,UAAW,OAAM,IAAI,kBAAkB;AAC9E,UAAI,CAAC,SAAU,MAAK,IAAI,IAAI,QAAQ,OAAO,GAAG,EAAE,WAAW,QAAQ,SAAS,UAAU,IAAI,CAAC;AAAA,IAC7F;AAAA,IACA,MAAM,OAAO,WAAW,QAAQ,SAAS;AACvC,YAAM,WAAW,KAAK,IAAI,IAAI,QAAQ,OAAO,CAAC;AAC9C,UAAI,UAAU,cAAc,UAAW,QAAO;AAC9C,WAAK,OAAO,IAAI,QAAQ,OAAO,CAAC;AAChC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,KAAK,WAAW;AACpB,aAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,SAAS,EAAE,KAAK,CAAC,GAAG,MAAM,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,SAAS,SAAS,OAAO,EAAE,QAAQ,SAAS,SAAS,EAAE;AAAA,IAC9L;AAAA,EACF;AACF;AAGO,SAAS,yBAAiC;AAC/C,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUT;AAGO,SAAS,gBAAgB,OAAiC;AAC/D,SAAO;AAAA,IACL,MAAM,KAAK,QAAQ,SAAS;AAC1B,YAAM,CAAC,GAAG,IAAI,MAAM,MAA8B,iFAAiF,CAAC,QAAQ,OAAO,CAAC;AACpJ,aAAO,KAAK,cAAc;AAAA,IAC5B;AAAA,IACA,MAAM,KAAK,WAAW,QAAQ,SAAS,KAAK;AAE1C,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA;AAAA;AAAA,QAGA,CAAC,QAAQ,SAAS,WAAW,GAAG;AAAA,MAClC;AACA,UAAI,KAAK,WAAW,EAAG,OAAM,IAAI,kBAAkB;AAAA,IACrD;AAAA,IACA,MAAM,OAAO,WAAW,QAAQ,SAAS;AACvC,YAAM,OAAO,MAAM,MAAM,sGAAsG,CAAC,QAAQ,SAAS,SAAS,CAAC;AAC3J,aAAO,KAAK,SAAS;AAAA,IACvB;AAAA,IACA,MAAM,KAAK,WAAW;AACpB,YAAM,OAAO,MAAM,MAA4D,wHAAwH,CAAC,SAAS,CAAC;AAClN,aAAO,KAAK,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,SAAS,EAAE,SAAS,UAAU,EAAE,UAAU,EAAE;AAAA,IAC1F;AAAA,EACF;AACF;","names":[]}

package/dist/identity-links-Dl9FNg6h.d.ts

@@ -0,0 +1,225 @@
+/**
+ * The account PORT (ADR-0008 of Yomizaka, now shared). A product's account — name, language, theme, avatar, e-mail change with
+ * verification, password (changed when signed in, or reset by a mailed link), sessions, export, deletion — behind one interface. Every product keeps its OWN accounts: no central
+ * service, no runtime dependency between products.
+ */
+type Theme = "light" | "dark" | "system";
+interface AccountProfile {
+    id: string;
+    email: string;
+    name: string | null;
+    locale: "en" | "fr";
+    /** The theme the person chose; null = follow the device. */
+    theme: Theme | null;
+    /** A seed of the default avatars (the UI draws it); null = derived from the e-mail address. */
+    avatarSeed: string | null;
+    emailVerified: boolean;
+    /** An address awaiting its verification link, if the person asked to change it. */
+    pendingEmail: string | null;
+}
+interface ProfilePatch {
+    name?: string | null;
+    locale?: "en" | "fr";
+    theme?: Theme | null;
+    avatarSeed?: string | null;
+}
+/** A sign-in of the person: where from and when. Never the token. */
+interface SessionSummary {
+    id: string;
+    createdAt: Date;
+    expiresAt: Date;
+    ip: string | null;
+    userAgent: string | null;
+    current: boolean;
+}
+interface AccountService {
+    profile(accountId: string): Promise<AccountProfile>;
+    updateProfile(accountId: string, patch: ProfilePatch): Promise<AccountProfile>;
+    /** Asks to change the address: the password is checked, a link is mailed to the NEW address. Answers the same whether or not it is already taken (no enumeration). */
+    requestEmailChange(accountId: string, input: {
+        newEmail: string;
+        password: string;
+    }, now: Date): Promise<void>;
+    /** Applies the change from the mailed link (single use, expires); the new address is verified by that very act. */
+    confirmEmailChange(token: string, now: Date): Promise<"CHANGED" | "INVALID">;
+    /** Changes the password (the current one is checked) and signs every other session out; `keepSessionId` stays. */
+    changePassword(accountId: string, input: {
+        current: string;
+        next: string;
+    }, keepSessionId?: string): Promise<void>;
+    /** Asks for a reset link, mailed (in the person's language) when an account with a password has this address; answers the same either way (no enumeration). */
+    requestPasswordReset(email: string, now: Date): Promise<void>;
+    /** Sets a new password from the mailed link — single use, expires — and signs every session out. The new password is checked before the link is used up. */
+    resetPassword(token: string, next: string, now: Date): Promise<"CHANGED" | "INVALID">;
+    /** Checks the password. Throws `AccountError(403, "WRONG_PASSWORD")`. */
+    confirmPassword(accountId: string, password: string): Promise<void>;
+    /** The person's live sign-ins, newest first; `currentSessionId` is flagged. */
+    sessions(accountId: string, now: Date, currentSessionId?: string): Promise<SessionSummary[]>;
+    /** Signs every other session out (and returns how many); `keepSessionId` stays. */
+    signOutOthers(accountId: string, keepSessionId: string): Promise<number>;
+    /** What the product keeps about the person, as one JSON-able document: the profile, the live sign-ins, and what `extra` adds. */
+    exportAccount(accountId: string, now: Date, extra?: () => Promise<Record<string, unknown>>): Promise<Record<string, unknown>>;
+    /** Deletes the identity: the account, its sessions and everything that hangs on it (the product erases its own data first). */
+    deleteAccount(accountId: string): Promise<void>;
+}
+declare class AccountError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+
+/** A SQL executor: the rows of a statement and its parameters (the product's pool). */
+type Query = <T = Record<string, unknown>>(sql: string, params?: unknown[]) => Promise<T[]>;
+interface Mail {
+    to: string;
+    /** The language of the mail (the person's). */
+    locale: "en" | "fr";
+    subject: string;
+    text: string;
+}
+interface AccountDeps {
+    query: Query;
+    /**
+     * Runs `work` in one transaction on one connection (BEGIN … COMMIT, rolled back when `work` throws) — the product's pool
+     * knows how. The password reset runs under it: the account row is locked, the links retired and issued, the token claimed,
+     * the password set and the sessions ended as one. Without it, the statements run one by one on `query` (one process, no
+     * concurrent requests): give it in production.
+     */
+    transaction?: <T>(work: (query: Query) => Promise<T>) => Promise<T>;
+    mail: (mail: Mail) => Promise<void>;
+    /** `https://www.akinaza.com`: the e-mail change link is `<baseUrl>/<locale>/confirm-email?token=…`, the reset link `<baseUrl>/<locale>/reset-password?token=…`. */
+    baseUrl: string;
+    /** The product's name, in the words of the mail (« Akinaza »). */
+    product: string;
+    /** The product's token prefix, two or three letters (`ye1.` for Yomizaka: `ye`). The tokens are `<prefix>1.<43 base64url>`. */
+    tokenPrefix: string;
+    passwords: {
+        hash: (password: string) => Promise<string>;
+        verify: (password: string, stored: string) => Promise<boolean>;
+    };
+    /** How a token is kept: the product's own keyed hash, the one its sessions use. */
+    tokenHash: (token: string) => string;
+    /**
+     * How long a password reset link lives, in minutes: a whole number from 5 to 1440 (`PASSWORD_RESET_MIN_MINUTES`–`PASSWORD_RESET_MAX_MINUTES`),
+     * default `PASSWORD_RESET_TTL_MINUTES` (30). The product reads it from its settings; the expiry and the mailed text both use it.
+     * Out of range, `dbAccounts` throws.
+     */
+    passwordResetTtlMinutes?: number;
+    /** Test seam: the token to issue. */
+    token?: () => string;
+}
+declare const EMAIL_CHANGE_TTL_HOURS = 24;
+/** The default lifetime of a password reset link, in minutes (`AccountDeps.passwordResetTtlMinutes` changes it). */
+declare const PASSWORD_RESET_TTL_MINUTES = 30;
+declare const PASSWORD_RESET_MIN_MINUTES = 5;
+declare const PASSWORD_RESET_MAX_MINUTES = 1440;
+/** One format for every mailed link (an e-mail change, a password reset): the product's prefix, a version, 256 random bits. */
+declare const linkToken: (prefix: string) => string;
+declare const isLinkToken: (prefix: string, value: string | undefined | null) => value is string;
+declare const emailChangeToken: (prefix: string) => string;
+declare const isEmailChangeToken: (prefix: string, value: string | undefined | null) => value is string;
+declare function passwordResetMail(product: string, locale: "en" | "fr", url: string, ttlMinutes?: number): {
+    subject: string;
+    text: string;
+};
+declare function emailChangeMail(product: string, locale: "en" | "fr", url: string): {
+    subject: string;
+    text: string;
+};
+/** The adapter over the product's own PostgreSQL (`accounts`, `sessions`, `email_changes`, `password_resets`; see `accountsMigration`). */
+declare function dbAccounts(deps: AccountDeps): AccountService;
+/** @deprecated The old name of `dbAccounts` (a name says what a thing does, not the technology). Removed in the next major. */
+declare const postgresAccounts: typeof dbAccounts;
+
+/**
+ * Federated sign-in (Google, Apple, Facebook, a native app's PKCE) delegated to krizaka-users, behind a PORT. The product keeps its
+ * own accounts (`postgresAccounts`); this port only answers « who is this person, according to the provider ». An external
+ * identity is never a second user table: it is a link to an account the product already has.
+ */
+type FederatedProvider = "google" | "apple" | "facebook";
+/** The providers the port knows; anything else is refused before it reaches the adapter. */
+declare const FEDERATED_PROVIDERS: readonly FederatedProvider[];
+declare const isFederatedProvider: (value: unknown) => value is FederatedProvider;
+/** Who the provider says the person is. `issuer` + `subject` identify them for good; the address can change. */
+interface ExternalIdentity {
+    /** The authority that vouches (`https://accounts.google.com`, `https://appleid.apple.com`…). */
+    issuer: string;
+    /** The person's stable id at that authority. */
+    subject: string;
+    email: string | null;
+    /** The provider checked the address (a Facebook address, for one, may not be). */
+    emailVerified: boolean;
+    name: string | null;
+}
+/** What a sign-in is started with: a native app sends the PKCE challenge, a browser flow does not. */
+interface StartOptions {
+    /** The S256 challenge of a PKCE flow (a native app); the matching verifier goes to `complete`. */
+    codeChallenge?: string;
+}
+interface StartedSignIn {
+    /** Where to send the person: the provider's consent page, through krizaka-users. */
+    url: string;
+    /** Echoed back with the code: the product checks it against the one it kept for this browser. */
+    state: string;
+}
+interface CompleteOptions {
+    /** The PKCE verifier of the challenge given to `start`. */
+    codeVerifier?: string;
+}
+interface IdentityProvider {
+    /** Starts a sign-in with `provider`; the person comes back to `returnTo` (a path or an address the adapter allows) with a one-time code. */
+    start(provider: FederatedProvider, returnTo: string, options?: StartOptions): Promise<StartedSignIn>;
+    /** Exchanges the one-time code (single use) for the verified identity. Throws `FederationError("INVALID_CODE")` for a code that is unknown, used or expired. */
+    complete(code: string, options?: CompleteOptions): Promise<ExternalIdentity>;
+}
+declare const FEDERATION_CODE: {
+    readonly invalidCode: "INVALID_CODE";
+    readonly unknownProvider: "UNKNOWN_PROVIDER";
+    readonly badReturn: "BAD_RETURN_TO";
+    readonly unavailable: "UNAVAILABLE";
+};
+type FederationCode = (typeof FEDERATION_CODE)[keyof typeof FEDERATION_CODE];
+declare class FederationError extends Error {
+    readonly code: FederationCode;
+    constructor(code: FederationCode, message: string);
+}
+/** The S256 challenge of a PKCE verifier: base64url(SHA-256(verifier)). A native app computes it; the adapter and the in-memory provider check it. */
+declare const pkceChallenge: (verifier: string) => string;
+/** A return address stays on the product: a path (`/fr/account`), never `//host` or a scheme. */
+declare const isLocalReturn: (returnTo: string) => boolean;
+/** An in-memory provider: the tests' adapter, and the reference the contract is written against. */
+declare function memoryIdentityProvider(): IdentityProvider & {
+    /** Test seam: the one-time code the provider would hand back for this identity (with the PKCE challenge it was started with, if any). */
+    issue(identity: ExternalIdentity, challenge?: string): string;
+};
+
+/**
+ * Which external identity belongs to which account. Never a second user table: a row is only `(issuer, subject) → account`.
+ * The product's `accounts` stays the one place a person lives.
+ */
+interface IdentityLinkStore {
+    /** The account this external identity is linked to, or null. */
+    find(issuer: string, subject: string): Promise<string | null>;
+    /** Links it. Idempotent for the same account; throws when the identity is already linked to another one. */
+    link(accountId: string, issuer: string, subject: string, now: Date): Promise<void>;
+    /** Removes the link (the person unlinks Google); true when there was one. */
+    unlink(accountId: string, issuer: string, subject: string): Promise<boolean>;
+    /** The identities linked to an account, oldest first. */
+    list(accountId: string): Promise<{
+        issuer: string;
+        subject: string;
+        linkedAt: Date;
+    }[]>;
+}
+declare class IdentityLinkError extends Error {
+    readonly code = "ALREADY_LINKED";
+    constructor();
+}
+/** An in-memory store: the tests' adapter, and the reference the contract is written against. */
+declare function memoryIdentityLinks(): IdentityLinkStore;
+/** The table of links (idempotent). `accounts` is the product's account table. */
+declare function identityLinksMigration(): string;
+/** The store over the product's own database (`external_identities`; see `identityLinksMigration`). */
+declare function dbIdentityLinks(query: Query): IdentityLinkStore;
+
+export { type AccountDeps as A, memoryIdentityProvider as B, type CompleteOptions as C, passwordResetMail as D, type ExternalIdentity as E, FEDERATED_PROVIDERS as F, pkceChallenge as G, postgresAccounts as H, type IdentityLinkStore as I, type Mail as M, PASSWORD_RESET_MAX_MINUTES as P, type Query as Q, type SessionSummary as S, type Theme as T, type IdentityProvider as a, AccountError as b, type AccountProfile as c, type AccountService as d, EMAIL_CHANGE_TTL_HOURS as e, FEDERATION_CODE as f, type FederatedProvider as g, type FederationCode as h, FederationError as i, IdentityLinkError as j, PASSWORD_RESET_MIN_MINUTES as k, PASSWORD_RESET_TTL_MINUTES as l, type ProfilePatch as m, type StartOptions as n, type StartedSignIn as o, dbAccounts as p, dbIdentityLinks as q, emailChangeMail as r, emailChangeToken as s, identityLinksMigration as t, isEmailChangeToken as u, isFederatedProvider as v, isLinkToken as w, isLocalReturn as x, linkToken as y, memoryIdentityLinks as z };

package/dist/index.d.ts

@@ -1,124 +1,54 @@
-/**
- * The account PORT (ADR-0008 of Yomizaka, now shared). A product's account — name, language, theme, avatar, e-mail change with
- * verification, password (changed when signed in, or reset by a mailed link), sessions, export, deletion — behind one interface. Every product keeps its OWN accounts: no central
- * service, no runtime dependency between products.
- */
-type Theme = "light" | "dark" | "system";
-interface AccountProfile {
-    id: string;
-    email: string;
-    name: string | null;
-    locale: "en" | "fr";
-    /** The theme the person chose; null = follow the device. */
-    theme: Theme | null;
-    /** A seed of the default avatars (the UI draws it); null = derived from the e-mail address. */
-    avatarSeed: string | null;
-    emailVerified: boolean;
-    /** An address awaiting its verification link, if the person asked to change it. */
-    pendingEmail: string | null;
-}
-interface ProfilePatch {
-    name?: string | null;
-    locale?: "en" | "fr";
-    theme?: Theme | null;
-    avatarSeed?: string | null;
-}
-/** A sign-in of the person: where from and when. Never the token. */
-interface SessionSummary {
-    id: string;
-    createdAt: Date;
-    expiresAt: Date;
-    ip: string | null;
-    userAgent: string | null;
-    current: boolean;
-}
-interface AccountService {
-    profile(accountId: string): Promise<AccountProfile>;
-    updateProfile(accountId: string, patch: ProfilePatch): Promise<AccountProfile>;
-    /** Asks to change the address: the password is checked, a link is mailed to the NEW address. Answers the same whether or not it is already taken (no enumeration). */
-    requestEmailChange(accountId: string, input: {
-        newEmail: string;
-        password: string;
-    }, now: Date): Promise<void>;
-    /** Applies the change from the mailed link (single use, expires); the new address is verified by that very act. */
-    confirmEmailChange(token: string, now: Date): Promise<"CHANGED" | "INVALID">;
-    /** Changes the password (the current one is checked) and signs every other session out; `keepSessionId` stays. */
-    changePassword(accountId: string, input: {
-        current: string;
-        next: string;
-    }, keepSessionId?: string): Promise<void>;
-    /** Asks for a reset link, mailed (in the person's language) when an account with a password has this address; answers the same either way (no enumeration). */
-    requestPasswordReset(email: string, now: Date): Promise<void>;
-    /** Sets a new password from the mailed link — single use, expires — and signs every session out. The new password is checked before the link is used up. */
-    resetPassword(token: string, next: string, now: Date): Promise<"CHANGED" | "INVALID">;
-    /** Checks the password. Throws `AccountError(403, "WRONG_PASSWORD")`. */
-    confirmPassword(accountId: string, password: string): Promise<void>;
-    /** The person's live sign-ins, newest first; `currentSessionId` is flagged. */
-    sessions(accountId: string, now: Date, currentSessionId?: string): Promise<SessionSummary[]>;
-    /** Signs every other session out (and returns how many); `keepSessionId` stays. */
-    signOutOthers(accountId: string, keepSessionId: string): Promise<number>;
-    /** What the product keeps about the person, as one JSON-able document: the profile, the live sign-ins, and what `extra` adds. */
-    exportAccount(accountId: string, now: Date, extra?: () => Promise<Record<string, unknown>>): Promise<Record<string, unknown>>;
-    /** Deletes the identity: the account, its sessions and everything that hangs on it (the product erases its own data first). */
-    deleteAccount(accountId: string): Promise<void>;
-}
-declare class AccountError extends Error {
-    readonly status: number;
-    readonly code: string;
-    constructor(status: number, code: string, message: string);
-}
+import { E as ExternalIdentity, I as IdentityLinkStore, a as IdentityProvider } from './identity-links-Dl9FNg6h.js';
+export { A as AccountDeps, b as AccountError, c as AccountProfile, d as AccountService, C as CompleteOptions, e as EMAIL_CHANGE_TTL_HOURS, F as FEDERATED_PROVIDERS, f as FEDERATION_CODE, g as FederatedProvider, h as FederationCode, i as FederationError, j as IdentityLinkError, M as Mail, P as PASSWORD_RESET_MAX_MINUTES, k as PASSWORD_RESET_MIN_MINUTES, l as PASSWORD_RESET_TTL_MINUTES, m as ProfilePatch, Q as Query, S as SessionSummary, n as StartOptions, o as StartedSignIn, T as Theme, p as dbAccounts, q as dbIdentityLinks, r as emailChangeMail, s as emailChangeToken, t as identityLinksMigration, u as isEmailChangeToken, v as isFederatedProvider, w as isLinkToken, x as isLocalReturn, y as linkToken, z as memoryIdentityLinks, B as memoryIdentityProvider, D as passwordResetMail, G as pkceChallenge, H as postgresAccounts } from './identity-links-Dl9FNg6h.js';
 
-/** A SQL executor: the rows of a statement and its parameters (the product's pool). */
-type Query = <T = Record<string, unknown>>(sql: string, params?: unknown[]) => Promise<T[]>;
-interface Mail {
-    to: string;
-    /** The language of the mail (the person's). */
-    locale: "en" | "fr";
-    subject: string;
-    text: string;
+/** What federated sign-in needs from the product's accounts: no second user table, just a look-up and, when registration is open, a creation. */
+interface FederatedAccounts {
+    /** The account that holds this address (lower case), and whether the product has verified it; null when none. */
+    findByEmail(email: string): Promise<{
+        id: string;
+        emailVerified: boolean;
+    } | null>;
+    /** Creates an account for a person the provider vouches for (address verified, no password). Absent when registration is closed. */
+    create?(identity: ExternalIdentity & {
+        email: string;
+    }): Promise<string>;
 }
-interface AccountDeps {
-    query: Query;
-    /**
-     * Runs `work` in one transaction on one connection (BEGIN … COMMIT, rolled back when `work` throws) — the product's pool
-     * knows how. The password reset runs under it: the account row is locked, the links retired and issued, the token claimed,
-     * the password set and the sessions ended as one. Without it, the statements run one by one on `query` (one process, no
-     * concurrent requests): give it in production.
-     */
-    transaction?: <T>(work: (query: Query) => Promise<T>) => Promise<T>;
-    mail: (mail: Mail) => Promise<void>;
-    /** `https://www.akinaza.com`: the e-mail change link is `<baseUrl>/<locale>/confirm-email?token=…`, the reset link `<baseUrl>/<locale>/reset-password?token=…`. */
-    baseUrl: string;
-    /** The product's name, in the words of the mail (« Akinaza »). */
-    product: string;
-    /** The product's token prefix, two or three letters (`ye1.` for Yomizaka: `ye`). The tokens are `<prefix>1.<43 base64url>`. */
-    tokenPrefix: string;
-    passwords: {
-        hash: (password: string) => Promise<string>;
-        verify: (password: string, stored: string) => Promise<boolean>;
+/** Why a sign-in was refused: a stable code the product maps to its words. */
+declare const FEDERATED_REFUSAL: {
+    /** The provider did not verify the address (or gave none): nothing is linked, nothing is created. */
+    readonly emailNotVerified: "EMAIL_NOT_VERIFIED";
+    /** An account holds the address but the product never verified it: linking would let a stranger take it over. */
+    readonly accountEmailUnverified: "ACCOUNT_EMAIL_UNVERIFIED";
+    /** No account, and registration is closed. */
+    readonly noAccount: "NO_ACCOUNT";
+};
+type FederatedRefusal = (typeof FEDERATED_REFUSAL)[keyof typeof FEDERATED_REFUSAL];
+type FederatedSignInResult = 
+/** `via`: `link` already linked, `linked` attached to the account of that address now, `created` a new account. */
+{
+    status: "signed-in";
+    accountId: string;
+    via: "link" | "linked" | "created";
+} | {
+    status: "refused";
+    code: FederatedRefusal;
+};
+interface FederatedSignInDeps {
+    links: IdentityLinkStore;
+    accounts: FederatedAccounts;
+    clock: {
+        now(): Date;
     };
-    /** How a token is kept: the product's own keyed hash, the one its sessions use. */
-    tokenHash: (token: string) => string;
-    /** Test seam: the token to issue. */
-    token?: () => string;
 }
-declare const EMAIL_CHANGE_TTL_HOURS = 24;
-declare const PASSWORD_RESET_TTL_MINUTES = 30;
-/** One format for every mailed link (an e-mail change, a password reset): the product's prefix, a version, 256 random bits. */
-declare const linkToken: (prefix: string) => string;
-declare const isLinkToken: (prefix: string, value: string | undefined | null) => value is string;
-declare const emailChangeToken: (prefix: string) => string;
-declare const isEmailChangeToken: (prefix: string, value: string | undefined | null) => value is string;
-declare function passwordResetMail(product: string, locale: "en" | "fr", url: string): {
-    subject: string;
-    text: string;
-};
-declare function emailChangeMail(product: string, locale: "en" | "fr", url: string): {
-    subject: string;
-    text: string;
+/**
+ * From a verified external identity to an account of the product. The rule that matters: an identity attaches to an EXISTING account
+ * only when the address is verified on both sides — by the provider and by the product. Otherwise a stranger who registers at
+ * Facebook with your address would sign in as you.
+ */
+declare function createFederatedSignIn({ links, accounts, clock }: FederatedSignInDeps): {
+    signIn(identity: ExternalIdentity): Promise<FederatedSignInResult>;
 };
-/** The adapter over the product's own PostgreSQL (`accounts`, `sessions`, `email_changes`, `password_resets`; see `accountsMigration`). */
-declare function postgresAccounts(deps: AccountDeps): AccountService;
+type FederatedSignIn = ReturnType<typeof createFederatedSignIn>;
 
 /**
  * What the account adapter needs from a product's database, safe to run on a database that already has `accounts` and `sessions`:
@@ -241,4 +171,29 @@ declare function createRoles<Role extends string, Permission extends string>(dep
 };
 type Roles<Role extends string = string, Permission extends string = string> = ReturnType<typeof createRoles<Role, Permission>>;
 
-export { type AccountDeps, AccountError, type AccountProfile, type AccountService, EMAIL_CHANGE_TTL_HOURS, type Invitation, type Mail, type Member, PASSWORD_RESET_TTL_MINUTES, type ProfilePatch, type Query, ROLES_CODE, type RoleModel, type Roles, type RolesCode, type RolesDeps, RolesError, type RolesQuery, type SessionSummary, type Theme, accountsMigration, can, createRoles, defineRoles, emailChangeMail, emailChangeToken, isEmailChangeToken, isLinkToken, linkToken, passwordResetMail, postgresAccounts, rolesMigration };
+/** The `fetch` the adapter calls krizaka-users with (injected: no global, no network in tests). */
+type Fetcher = (url: string, init: {
+    method: "POST";
+    headers: Record<string, string>;
+    body: string;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+}>;
+interface UsersFederationOptions {
+    /** The tenant host of the product: `https://auth.dev.akinaza.com`. */
+    baseUrl: string;
+    /** The product's public address: the start URL sends the person back to it, so `returnTo` is absolute from it. */
+    appUrl: string;
+    fetch: Fetcher;
+}
+/** Reads krizaka-users' answer into an identity; anything that is not a complete identity is refused. */
+declare function parseExternalIdentity(body: unknown): ExternalIdentity;
+/**
+ * The adapter for krizaka-users (`auth.<product>` tenant host, krizaka/krizaka-users#31): `start` builds the tenant's start address,
+ * `complete` exchanges the one-time code (and the PKCE verifier of a native app) for the verified identity.
+ */
+declare function usersIdentityProvider({ baseUrl, appUrl, fetch }: UsersFederationOptions): IdentityProvider;
+
+export { ExternalIdentity, FEDERATED_REFUSAL, type FederatedAccounts, type FederatedRefusal, type FederatedSignIn, type FederatedSignInDeps, type FederatedSignInResult, type Fetcher, IdentityLinkStore, IdentityProvider, type Invitation, type Member, ROLES_CODE, type RoleModel, type Roles, type RolesCode, type RolesDeps, RolesError, type RolesQuery, type UsersFederationOptions, accountsMigration, can, createFederatedSignIn, createRoles, defineRoles, parseExternalIdentity, rolesMigration, usersIdentityProvider };