@krizaka/auth 0.7.0 → 0.8.0

package/README.md

@@ -3,9 +3,10 @@
 The account of a Krizaka product, behind a port: a display name, language, theme and avatar seed; the e-mail change by a link mailed to the **new** address (the verified flag is set by that very act); the password (checked before anything sensitive, other sessions signed out on change; reset by a link mailed to the account's address — the same answer whether or not the address has an account, the link used once within 30 minutes by default — `passwordResetTtlMinutes`, 5 to 1440, read by the product from its settings and said in the mail — every session signed out); the live sessions with sign-out of the others; the data export; the deletion. Each product keeps its **own** accounts — the package brings an adapter over the product's PostgreSQL and the migration it needs, nothing central.
 
 ```ts
-import { accountsMigration, dbAccounts } from "@krizaka/auth";
+import { emitMigration } from "@krizaka/db";
+import { accountsSchema, dbAccounts } from "@krizaka/auth";
 
-await db.query(accountsMigration({ backfillVerified: true })); // once, in your migrations (idempotent)
+emitMigration(accountsSchema({ backfillVerified: true }), 1, { tables: { accounts: "accounts" } }); // commit the SQL once, in your migrations (idempotent)
 const accounts = dbAccounts({ query, transaction, mail, baseUrl: "https://www.akinaza.com", product: "Akinaza", tokenPrefix: "ae", passwords: { hash, verify }, tokenHash, passwordResetTtlMinutes: 30 /* optional, 5–1440 */ }); // `transaction`: the work on one connection (BEGIN … COMMIT); the password reset needs it under concurrent requests
 await accounts.updateProfile(id, { name: "Éric", theme: "dark" });
 await accounts.sessions(id, new Date(), currentSessionId);
@@ -13,6 +14,7 @@ await accounts.requestPasswordReset(email, new Date()); // mails `<baseUrl>/<loc
 await accounts.resetPassword(token, newPassword, new Date()); // "CHANGED" | "INVALID"
 ```
 
+**Schema.** The tables are a `@krizaka/db` module (`auth`), version 1 byte-identical to the SQL this package shipped before, so a product that has them adopts with no DDL change: `adoptMigration(accountsSchema(), 1, context)` writes the marker only, `emitMigration(…)` writes the SQL for a database that lacks them. The old migration function stays, `@deprecated`, for one minor. The roles are the module `auth_roles` (`rolesSchema(roles, { scoped })`, tables `owner` and `scope`) and the federated links `auth_identity_links` (`identityLinksSchema`).
 A link mail carries `mail.link` (`kind`, `url`, `minutes` or `hours`) beside `subject` and `text`: a product that sends branded HTML (`@krizaka/email`: `passwordReset`, `emailChange`) renders it from the data.
 
 The product keeps what is its own: its session cookie and token hashing (`tokenHash`), its password hashing, its mailer, its rate limits and its HTTP answers (`AccountError` carries a status and a stable code). Time is passed in (`now`); nothing here reads the clock.
@@ -26,9 +28,9 @@ A role model is data: `defineRoles({ roles, permissions, manages })` says which
 Each product keeps its own accounts; **krizaka-users** is the federation provider behind a port, so a product holds no OAuth app of its own. `IdentityProvider` has two calls: `start(provider, returnTo, { codeChallenge? })` gives the address to send the person to, `complete(code, { codeVerifier? })` exchanges the one-time code (single use) for a verified `ExternalIdentity` (`issuer`, `subject`, `email`, `emailVerified`). A return address stays on the product (a path); an unknown provider is refused.
 
 ```ts
-import { createFederatedSignIn, dbIdentityLinks, identityLinksMigration, usersIdentityProvider } from "@krizaka/auth";
+import { createFederatedSignIn, dbIdentityLinks, identityLinksSchema, usersIdentityProvider } from "@krizaka/auth";
 
-await db.query(identityLinksMigration()); // once, in your migrations (idempotent): (issuer, subject) → account
+emitMigration(identityLinksSchema, 1, { tables: { accounts: "accounts" } }); // once, in your migrations (idempotent): (issuer, subject) → account
 const federation = usersIdentityProvider({ baseUrl: "https://auth.dev.akinaza.com", appUrl: "https://dev.akinaza.com", fetch });
 const signIn = createFederatedSignIn({ links: dbIdentityLinks(query), accounts: { findByEmail, create }, clock });
 

package/dist/{chunk-H7AKE2OH.js → chunk-U5SDV7YV.js}

@@ -44,6 +44,112 @@ function memoryIdentityProvider() {
   };
 }
 
+// src/schema.ts
+import { defineModule } from "@krizaka/db";
+function accountsSchema(options = {}) {
+  return defineModule({
+    module: "auth",
+    schema: "public",
+    tables: ["accounts"],
+    migrations: [
+      {
+        version: 1,
+        name: "accounts profile, e-mail changes, password resets",
+        sql: (c) => `
+ALTER TABLE ${c.tables.accounts} ADD COLUMN IF NOT EXISTS name text CHECK (name IS NULL OR char_length(name) <= 80);
+ALTER TABLE ${c.tables.accounts} ADD COLUMN IF NOT EXISTS avatar_seed text CHECK (avatar_seed IS NULL OR avatar_seed ~ '^[a-z0-9-]{1,40}$');
+ALTER TABLE ${c.tables.accounts} ADD COLUMN IF NOT EXISTS theme text CHECK (theme IS NULL OR theme IN ('light', 'dark', 'system'));
+ALTER TABLE ${c.tables.accounts} ADD COLUMN IF NOT EXISTS email_verified_at timestamptz;
+${options.backfillVerified ? `UPDATE ${c.tables.accounts} SET email_verified_at = created_at WHERE email_verified_at IS NULL;
+` : ""}CREATE TABLE IF NOT EXISTS email_changes (
+  id         uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  account_id uuid NOT NULL REFERENCES ${c.tables.accounts}(id) ON DELETE CASCADE,
+  new_email  text NOT NULL CHECK (new_email = lower(new_email)),
+  token_hash text NOT NULL UNIQUE,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  expires_at timestamptz NOT NULL,
+  used_at    timestamptz
+);
+CREATE TABLE IF NOT EXISTS password_resets (
+  id         uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  account_id uuid NOT NULL REFERENCES ${c.tables.accounts}(id) ON DELETE CASCADE,
+  token_hash text NOT NULL UNIQUE,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  expires_at timestamptz NOT NULL,
+  used_at    timestamptz
+);
+`
+      }
+    ]
+  });
+}
+var IDENT = /^[a-z_][a-z0-9_]{0,62}$/;
+var ident = (name) => {
+  if (!IDENT.test(name)) throw new Error(`not a safe SQL identifier: ${name}`);
+  return name;
+};
+function rolesSchema(roles, options = {}) {
+  const list = roles.map((r) => `'${ident(r)}'`).join(", ");
+  return defineModule({
+    module: "auth_roles",
+    schema: "public",
+    tables: options.scoped ? ["owner", "scope"] : ["owner"],
+    migrations: [
+      {
+        version: 1,
+        name: "memberships and invitations",
+        sql: (c) => {
+          const scope = options.scoped ? ` REFERENCES ${c.tables.scope}(id) ON DELETE CASCADE` : "";
+          return `
+CREATE TABLE IF NOT EXISTS memberships (
+  scope_id   uuid NOT NULL${scope},
+  account_id uuid NOT NULL REFERENCES ${c.tables.owner}(id) ON DELETE CASCADE,
+  role       text NOT NULL CHECK (role IN (${list})),
+  invited_by uuid REFERENCES ${c.tables.owner}(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL,
+  PRIMARY KEY (scope_id, account_id)
+);
+CREATE INDEX IF NOT EXISTS memberships_account ON memberships(account_id);
+CREATE TABLE IF NOT EXISTS invitations (
+  id         uuid PRIMARY KEY,
+  scope_id   uuid NOT NULL${scope},
+  email      text NOT NULL CHECK (email = lower(email)),
+  role       text NOT NULL CHECK (role IN (${list})),
+  token_hash text NOT NULL UNIQUE,
+  invited_by uuid REFERENCES ${c.tables.owner}(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL,
+  expires_at timestamptz NOT NULL,
+  used_at    timestamptz
+);
+CREATE INDEX IF NOT EXISTS invitations_scope ON invitations(scope_id) WHERE used_at IS NULL;
+`;
+        }
+      }
+    ]
+  });
+}
+var identityLinksSchema = defineModule({
+  module: "auth_identity_links",
+  schema: "public",
+  tables: ["accounts"],
+  migrations: [
+    {
+      version: 1,
+      name: "external identities",
+      sql: (c) => `
+CREATE TABLE IF NOT EXISTS external_identities (
+  issuer     text NOT NULL CHECK (char_length(issuer) BETWEEN 1 AND 200),
+  subject    text NOT NULL CHECK (char_length(subject) BETWEEN 1 AND 200),
+  account_id uuid NOT NULL REFERENCES ${c.tables.accounts}(id) ON DELETE CASCADE,
+  linked_at  timestamptz NOT NULL,
+  PRIMARY KEY (issuer, subject)
+);
+CREATE INDEX IF NOT EXISTS external_identities_account ON external_identities(account_id, linked_at);
+`
+    }
+  ]
+});
+
 // src/identity-links.ts
 import { compareAsc } from "date-fns";
 var IdentityLinkError = class extends Error {
@@ -78,16 +184,7 @@ ${subject}`;
   };
 }
 function identityLinksMigration() {
-  return `
-CREATE TABLE IF NOT EXISTS external_identities (
-  issuer     text NOT NULL CHECK (char_length(issuer) BETWEEN 1 AND 200),
-  subject    text NOT NULL CHECK (char_length(subject) BETWEEN 1 AND 200),
-  account_id uuid NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
-  linked_at  timestamptz NOT NULL,
-  PRIMARY KEY (issuer, subject)
-);
-CREATE INDEX IF NOT EXISTS external_identities_account ON external_identities(account_id, linked_at);
-`;
+  return identityLinksSchema.migrations[0].sql({ schema: "public", tables: { accounts: "accounts" } });
 }
 function dbIdentityLinks(query) {
   return {
@@ -123,9 +220,12 @@ export {
   pkceChallenge,
   isLocalReturn,
   memoryIdentityProvider,
+  accountsSchema,
+  rolesSchema,
+  identityLinksSchema,
   IdentityLinkError,
   memoryIdentityLinks,
   identityLinksMigration,
   dbIdentityLinks
 };
-//# sourceMappingURL=chunk-H7AKE2OH.js.map
+//# sourceMappingURL=chunk-U5SDV7YV.js.map

package/dist/chunk-U5SDV7YV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/federation.ts","../src/schema.ts","../src/identity-links.ts"],"sourcesContent":["import crypto from \"node:crypto\";\n\n/**\n * Federated sign-in (Google, Apple, Facebook, a native app's PKCE) delegated to krizaka-users, behind a PORT. The product keeps its\n * own accounts (`postgresAccounts`); this port only answers « who is this person, according to the provider ». An external\n * identity is never a second user table: it is a link to an account the product already has.\n */\nexport type FederatedProvider = \"google\" | \"apple\" | \"facebook\";\n\n/** The providers the port knows; anything else is refused before it reaches the adapter. */\nexport const FEDERATED_PROVIDERS: readonly FederatedProvider[] = [\"google\", \"apple\", \"facebook\"];\n\nexport const isFederatedProvider = (value: unknown): value is FederatedProvider => FEDERATED_PROVIDERS.includes(value as FederatedProvider);\n\n/** Who the provider says the person is. `issuer` + `subject` identify them for good; the address can change. */\nexport interface ExternalIdentity {\n  /** The authority that vouches (`https://accounts.google.com`, `https://appleid.apple.com`…). */\n  issuer: string;\n  /** The person's stable id at that authority. */\n  subject: string;\n  email: string | null;\n  /** The provider checked the address (a Facebook address, for one, may not be). */\n  emailVerified: boolean;\n  name: string | null;\n}\n\n/** What a sign-in is started with: a native app sends the PKCE challenge, a browser flow does not. */\nexport interface StartOptions {\n  /** The S256 challenge of a PKCE flow (a native app); the matching verifier goes to `complete`. */\n  codeChallenge?: string;\n}\n\nexport interface StartedSignIn {\n  /** Where to send the person: the provider's consent page, through krizaka-users. */\n  url: string;\n  /** Echoed back with the code: the product checks it against the one it kept for this browser. */\n  state: string;\n}\n\nexport interface CompleteOptions {\n  /** The PKCE verifier of the challenge given to `start`. */\n  codeVerifier?: string;\n}\n\nexport interface IdentityProvider {\n  /** Starts a sign-in with `provider`; the person comes back to `returnTo` (a path or an address the adapter allows) with a one-time code. */\n  start(provider: FederatedProvider, returnTo: string, options?: StartOptions): Promise<StartedSignIn>;\n  /** Exchanges the one-time code (single use) for the verified identity. Throws `FederationError(\"INVALID_CODE\")` for a code that is unknown, used or expired. */\n  complete(code: string, options?: CompleteOptions): Promise<ExternalIdentity>;\n}\n\nexport const FEDERATION_CODE = {\n  invalidCode: \"INVALID_CODE\",\n  unknownProvider: \"UNKNOWN_PROVIDER\",\n  badReturn: \"BAD_RETURN_TO\",\n  unavailable: \"UNAVAILABLE\",\n} as const;\nexport type FederationCode = (typeof FEDERATION_CODE)[keyof typeof FEDERATION_CODE];\n\nexport class FederationError extends Error {\n  constructor(\n    readonly code: FederationCode,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"FederationError\";\n  }\n}\n\n/** The S256 challenge of a PKCE verifier: base64url(SHA-256(verifier)). A native app computes it; the adapter and the in-memory provider check it. */\nexport const pkceChallenge = (verifier: string): string => crypto.createHash(\"sha256\").update(verifier).digest(\"base64url\");\n\n/** A return address stays on the product: a path (`/fr/account`), never `//host` or a scheme. */\nexport const isLocalReturn = (returnTo: string): boolean => returnTo.startsWith(\"/\") && !returnTo.startsWith(\"//\") && !returnTo.includes(\"\\\\\") && [...returnTo].every((c) => c.charCodeAt(0) > 31);\n\n/** An in-memory provider: the tests' adapter, and the reference the contract is written against. */\nexport function memoryIdentityProvider(): IdentityProvider & {\n  /** Test seam: the one-time code the provider would hand back for this identity (with the PKCE challenge it was started with, if any). */\n  issue(identity: ExternalIdentity, challenge?: string): string;\n} {\n  const pending = new Map<string, { identity: ExternalIdentity; challenge: string | null }>();\n  let counter = 0;\n  return {\n    async start(provider, returnTo) {\n      if (!isFederatedProvider(provider)) throw new FederationError(FEDERATION_CODE.unknownProvider, `Unknown provider ${String(provider)}`);\n      if (!isLocalReturn(returnTo)) throw new FederationError(FEDERATION_CODE.badReturn, \"That return address is not allowed\");\n      counter += 1;\n      const state = `state-${counter}`;\n      return { url: `https://auth.test/${provider}/start?state=${state}`, state };\n    },\n    async complete(code, options = {}) {\n      const entry = pending.get(code);\n      pending.delete(code); // single use, whatever happens next\n      if (!entry) throw new FederationError(FEDERATION_CODE.invalidCode, \"That code is not valid\");\n      if (entry.challenge !== null && (!options.codeVerifier || pkceChallenge(options.codeVerifier) !== entry.challenge)) throw new FederationError(FEDERATION_CODE.invalidCode, \"That code is not valid\");\n      return entry.identity;\n    },\n    issue(identity, challenge) {\n      counter += 1;\n      pending.set(`code-${counter}`, { identity, challenge: challenge ?? null });\n      return `code-${counter}`;\n    },\n  };\n}\n","import { defineModule, type ModuleSchema } from \"@krizaka/db\";\n\n/**\n * The tables of « auth », declared as modules (ADR-001 §3). They are added to a product's own `accounts` and `sessions` tables, which\n * existed before the module schemas: they stay in `public`, un-qualified, and a product that has them adopts version 1\n * (`adoptMigration`, markers only) while one that does not emits it (`emitMigration`). Version 1 of each is frozen once released:\n * a change is version 2. The one product table every one of them references is declared by the product (`accounts`, `owner`).\n */\n\n/**\n * What the account adapter needs from a product's database, safe to run on a database that already has `accounts` and `sessions`:\n * a display name, a theme, an avatar seed, the verified-address flag, and the table of e-mail changes (a link mailed to the NEW\n * address) and the table of password resets (a link mailed to the account's address). `accounts` needs `id`, `email`, `locale`, `password_hash`;\n * `sessions` needs `account_id`, `created_at`, `expires_at`, `ip`, `user_agent`.\n * @param options `backfillVerified`: for accounts that exist already, treat the address as verified (invitation-only products)\n */\nexport function accountsSchema(options: { backfillVerified?: boolean } = {}): ModuleSchema {\n  return defineModule({\n    module: \"auth\",\n    schema: \"public\",\n    tables: [\"accounts\"],\n    migrations: [\n      {\n        version: 1,\n        name: \"accounts profile, e-mail changes, password resets\",\n        sql: (c) => `\nALTER TABLE ${c.tables.accounts} ADD COLUMN IF NOT EXISTS name text CHECK (name IS NULL OR char_length(name) <= 80);\nALTER TABLE ${c.tables.accounts} ADD COLUMN IF NOT EXISTS avatar_seed text CHECK (avatar_seed IS NULL OR avatar_seed ~ '^[a-z0-9-]{1,40}$');\nALTER TABLE ${c.tables.accounts} ADD COLUMN IF NOT EXISTS theme text CHECK (theme IS NULL OR theme IN ('light', 'dark', 'system'));\nALTER TABLE ${c.tables.accounts} ADD COLUMN IF NOT EXISTS email_verified_at timestamptz;\n${options.backfillVerified ? `UPDATE ${c.tables.accounts} SET email_verified_at = created_at WHERE email_verified_at IS NULL;\\n` : \"\"}CREATE TABLE IF NOT EXISTS email_changes (\n  id         uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n  account_id uuid NOT NULL REFERENCES ${c.tables.accounts}(id) ON DELETE CASCADE,\n  new_email  text NOT NULL CHECK (new_email = lower(new_email)),\n  token_hash text NOT NULL UNIQUE,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  expires_at timestamptz NOT NULL,\n  used_at    timestamptz\n);\nCREATE TABLE IF NOT EXISTS password_resets (\n  id         uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n  account_id uuid NOT NULL REFERENCES ${c.tables.accounts}(id) ON DELETE CASCADE,\n  token_hash text NOT NULL UNIQUE,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  expires_at timestamptz NOT NULL,\n  used_at    timestamptz\n);\n`,\n      },\n    ],\n  });\n}\n\nconst IDENT = /^[a-z_][a-z0-9_]{0,62}$/;\nconst ident = (name: string) => {\n  if (!IDENT.test(name)) throw new Error(`not a safe SQL identifier: ${name}`);\n  return name;\n};\n\n/**\n * Memberships (who has which role in which scope) and invitations (an e-mail address invited with a role, by a link used once), from the\n * product's role model. Declares the account table (`owner`) and, when the roles are scoped, the scope table (`scope`: shops, workspaces):\n * a membership and an invitation then point at it. Idempotent.\n * @param roles the role names of the model: each becomes a value of the `role` check, so each must be a safe identifier\n * @param options `scoped`: true when the product declares a `scope` table\n * @throws Error for a role that is not a safe SQL identifier\n */\nexport function rolesSchema(roles: readonly string[], options: { scoped?: boolean } = {}): ModuleSchema {\n  const list = roles.map((r) => `'${ident(r)}'`).join(\", \");\n  return defineModule({\n    module: \"auth_roles\",\n    schema: \"public\",\n    tables: options.scoped ? [\"owner\", \"scope\"] : [\"owner\"],\n    migrations: [\n      {\n        version: 1,\n        name: \"memberships and invitations\",\n        sql: (c) => {\n          const scope = options.scoped ? ` REFERENCES ${c.tables.scope}(id) ON DELETE CASCADE` : \"\";\n          return `\nCREATE TABLE IF NOT EXISTS memberships (\n  scope_id   uuid NOT NULL${scope},\n  account_id uuid NOT NULL REFERENCES ${c.tables.owner}(id) ON DELETE CASCADE,\n  role       text NOT NULL CHECK (role IN (${list})),\n  invited_by uuid REFERENCES ${c.tables.owner}(id) ON DELETE SET NULL,\n  created_at timestamptz NOT NULL,\n  PRIMARY KEY (scope_id, account_id)\n);\nCREATE INDEX IF NOT EXISTS memberships_account ON memberships(account_id);\nCREATE TABLE IF NOT EXISTS invitations (\n  id         uuid PRIMARY KEY,\n  scope_id   uuid NOT NULL${scope},\n  email      text NOT NULL CHECK (email = lower(email)),\n  role       text NOT NULL CHECK (role IN (${list})),\n  token_hash text NOT NULL UNIQUE,\n  invited_by uuid REFERENCES ${c.tables.owner}(id) ON DELETE SET NULL,\n  created_at timestamptz NOT NULL,\n  expires_at timestamptz NOT NULL,\n  used_at    timestamptz\n);\nCREATE INDEX IF NOT EXISTS invitations_scope ON invitations(scope_id) WHERE used_at IS NULL;\n`;\n        },\n      },\n    ],\n  });\n}\n\n/** Which external identity belongs to which account (federated sign-in): `(issuer, subject) → account`, never a second user table. Idempotent. */\nexport const identityLinksSchema = defineModule({\n  module: \"auth_identity_links\",\n  schema: \"public\",\n  tables: [\"accounts\"],\n  migrations: [\n    {\n      version: 1,\n      name: \"external identities\",\n      sql: (c) => `\nCREATE TABLE IF NOT EXISTS external_identities (\n  issuer     text NOT NULL CHECK (char_length(issuer) BETWEEN 1 AND 200),\n  subject    text NOT NULL CHECK (char_length(subject) BETWEEN 1 AND 200),\n  account_id uuid NOT NULL REFERENCES ${c.tables.accounts}(id) ON DELETE CASCADE,\n  linked_at  timestamptz NOT NULL,\n  PRIMARY KEY (issuer, subject)\n);\nCREATE INDEX IF NOT EXISTS external_identities_account ON external_identities(account_id, linked_at);\n`,\n    },\n  ],\n});\n","import { compareAsc } from \"date-fns\";\n\nimport type { Query } from \"./accounts\";\nimport { identityLinksSchema } from \"./schema\";\n\n/**\n * Which external identity belongs to which account. Never a second user table: a row is only `(issuer, subject) → account`.\n * The product's `accounts` stays the one place a person lives.\n */\nexport interface IdentityLinkStore {\n  /** The account this external identity is linked to, or null. */\n  find(issuer: string, subject: string): Promise<string | null>;\n  /** Links it. Idempotent for the same account; throws when the identity is already linked to another one. */\n  link(accountId: string, issuer: string, subject: string, now: Date): Promise<void>;\n  /** Removes the link (the person unlinks Google); true when there was one. */\n  unlink(accountId: string, issuer: string, subject: string): Promise<boolean>;\n  /** The identities linked to an account, oldest first. */\n  list(accountId: string): Promise<{ issuer: string; subject: string; linkedAt: Date }[]>;\n}\n\nexport class IdentityLinkError extends Error {\n  readonly code = \"ALREADY_LINKED\";\n  constructor() {\n    super(\"That external identity is already linked to another account\");\n    this.name = \"IdentityLinkError\";\n  }\n}\n\n/** An in-memory store: the tests' adapter, and the reference the contract is written against. */\nexport function memoryIdentityLinks(): IdentityLinkStore {\n  const rows = new Map<string, { accountId: string; issuer: string; subject: string; linkedAt: Date }>();\n  const key = (issuer: string, subject: string) => `${issuer}\\n${subject}`;\n  return {\n    async find(issuer, subject) {\n      return rows.get(key(issuer, subject))?.accountId ?? null;\n    },\n    async link(accountId, issuer, subject, now) {\n      const existing = rows.get(key(issuer, subject));\n      if (existing && existing.accountId !== accountId) throw new IdentityLinkError();\n      if (!existing) rows.set(key(issuer, subject), { accountId, issuer, subject, linkedAt: now });\n    },\n    async unlink(accountId, issuer, subject) {\n      const existing = rows.get(key(issuer, subject));\n      if (existing?.accountId !== accountId) return false;\n      rows.delete(key(issuer, subject));\n      return true;\n    },\n    async list(accountId) {\n      return [...rows.values()].filter((r) => r.accountId === accountId).sort((a, b) => compareAsc(a.linkedAt, b.linkedAt)).map(({ issuer, subject, linkedAt }) => ({ issuer, subject, linkedAt }));\n    },\n  };\n}\n\n/**\n * The table of links (idempotent). `accounts` is the product's account table.\n * @deprecated Use `identityLinksSchema` with `emitMigration` or `adoptMigration` from `@krizaka/db`. Removed in the next major.\n */\nexport function identityLinksMigration(): string {\n  return identityLinksSchema.migrations[0]!.sql({ schema: \"public\", tables: { accounts: \"accounts\" } });\n}\n\n/** The store over the product's own database (`external_identities`; see `identityLinksMigration`). */\nexport function dbIdentityLinks(query: Query): IdentityLinkStore {\n  return {\n    async find(issuer, subject) {\n      const [row] = await query<{ account_id: string }>(\"SELECT account_id FROM external_identities WHERE issuer = $1 AND subject = $2\", [issuer, subject]);\n      return row?.account_id ?? null;\n    },\n    async link(accountId, issuer, subject, now) {\n      // One statement: the primary key decides a race; the same account is a no-op, another account is refused.\n      const rows = await query<{ account_id: string }>(\n        `INSERT INTO external_identities (issuer, subject, account_id, linked_at) VALUES ($1, $2, $3, $4)\n         ON CONFLICT (issuer, subject) DO UPDATE SET issuer = excluded.issuer WHERE external_identities.account_id = excluded.account_id\n         RETURNING account_id`,\n        [issuer, subject, accountId, now],\n      );\n      if (rows.length === 0) throw new IdentityLinkError();\n    },\n    async unlink(accountId, issuer, subject) {\n      const rows = await query(\"DELETE FROM external_identities WHERE issuer = $1 AND subject = $2 AND account_id = $3 RETURNING 1\", [issuer, subject, accountId]);\n      return rows.length > 0;\n    },\n    async list(accountId) {\n      const rows = await query<{ issuer: string; subject: string; linked_at: Date }>(\"SELECT issuer, subject, linked_at FROM external_identities WHERE account_id = $1 ORDER BY linked_at, issuer, subject\", [accountId]);\n      return rows.map((r) => ({ issuer: r.issuer, subject: r.subject, linkedAt: r.linked_at }));\n    },\n  };\n}\n"],"mappings":";AAAA,OAAO,YAAY;AAUZ,IAAM,sBAAoD,CAAC,UAAU,SAAS,UAAU;AAExF,IAAM,sBAAsB,CAAC,UAA+C,oBAAoB,SAAS,KAA0B;AAuCnI,IAAM,kBAAkB;AAAA,EAC7B,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,aAAa;AACf;AAGO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACzC,YACW,MACT,SACA;AACA,UAAM,OAAO;AAHJ;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAMb;AAGO,IAAM,gBAAgB,CAAC,aAA6B,OAAO,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,WAAW;AAGnH,IAAM,gBAAgB,CAAC,aAA8B,SAAS,WAAW,GAAG,KAAK,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,SAAS,SAAS,IAAI,KAAK,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE;AAG1L,SAAS,yBAGd;AACA,QAAM,UAAU,oBAAI,IAAsE;AAC1F,MAAI,UAAU;AACd,SAAO;AAAA,IACL,MAAM,MAAM,UAAU,UAAU;AAC9B,UAAI,CAAC,oBAAoB,QAAQ,EAAG,OAAM,IAAI,gBAAgB,gBAAgB,iBAAiB,oBAAoB,OAAO,QAAQ,CAAC,EAAE;AACrI,UAAI,CAAC,cAAc,QAAQ,EAAG,OAAM,IAAI,gBAAgB,gBAAgB,WAAW,oCAAoC;AACvH,iBAAW;AACX,YAAM,QAAQ,SAAS,OAAO;AAC9B,aAAO,EAAE,KAAK,qBAAqB,QAAQ,gBAAgB,KAAK,IAAI,MAAM;AAAA,IAC5E;AAAA,IACA,MAAM,SAAS,MAAM,UAAU,CAAC,GAAG;AACjC,YAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,cAAQ,OAAO,IAAI;AACnB,UAAI,CAAC,MAAO,OAAM,IAAI,gBAAgB,gBAAgB,aAAa,wBAAwB;AAC3F,UAAI,MAAM,cAAc,SAAS,CAAC,QAAQ,gBAAgB,cAAc,QAAQ,YAAY,MAAM,MAAM,WAAY,OAAM,IAAI,gBAAgB,gBAAgB,aAAa,wBAAwB;AACnM,aAAO,MAAM;AAAA,IACf;AAAA,IACA,MAAM,UAAU,WAAW;AACzB,iBAAW;AACX,cAAQ,IAAI,QAAQ,OAAO,IAAI,EAAE,UAAU,WAAW,aAAa,KAAK,CAAC;AACzE,aAAO,QAAQ,OAAO;AAAA,IACxB;AAAA,EACF;AACF;;;ACvGA,SAAS,oBAAuC;AAgBzC,SAAS,eAAe,UAA0C,CAAC,GAAiB;AACzF,SAAO,aAAa;AAAA,IAClB,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ,CAAC,UAAU;AAAA,IACnB,YAAY;AAAA,MACV;AAAA,QACE,SAAS;AAAA,QACT,MAAM;AAAA,QACN,KAAK,CAAC,MAAM;AAAA,cACN,EAAE,OAAO,QAAQ;AAAA,cACjB,EAAE,OAAO,QAAQ;AAAA,cACjB,EAAE,OAAO,QAAQ;AAAA,cACjB,EAAE,OAAO,QAAQ;AAAA,EAC7B,QAAQ,mBAAmB,UAAU,EAAE,OAAO,QAAQ;AAAA,IAA2E,EAAE;AAAA;AAAA,wCAE7F,EAAE,OAAO,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wCASjB,EAAE,OAAO,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOnD;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,IAAM,QAAQ;AACd,IAAM,QAAQ,CAAC,SAAiB;AAC9B,MAAI,CAAC,MAAM,KAAK,IAAI,EAAG,OAAM,IAAI,MAAM,8BAA8B,IAAI,EAAE;AAC3E,SAAO;AACT;AAUO,SAAS,YAAY,OAA0B,UAAgC,CAAC,GAAiB;AACtG,QAAM,OAAO,MAAM,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI;AACxD,SAAO,aAAa;AAAA,IAClB,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ,QAAQ,SAAS,CAAC,SAAS,OAAO,IAAI,CAAC,OAAO;AAAA,IACtD,YAAY;AAAA,MACV;AAAA,QACE,SAAS;AAAA,QACT,MAAM;AAAA,QACN,KAAK,CAAC,MAAM;AACV,gBAAM,QAAQ,QAAQ,SAAS,eAAe,EAAE,OAAO,KAAK,2BAA2B;AACvF,iBAAO;AAAA;AAAA,4BAEW,KAAK;AAAA,wCACO,EAAE,OAAO,KAAK;AAAA,6CACT,IAAI;AAAA,+BAClB,EAAE,OAAO,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAOjB,KAAK;AAAA;AAAA,6CAEY,IAAI;AAAA;AAAA,+BAElB,EAAE,OAAO,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOrC;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAGO,IAAM,sBAAsB,aAAa;AAAA,EAC9C,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ,CAAC,UAAU;AAAA,EACnB,YAAY;AAAA,IACV;AAAA,MACE,SAAS;AAAA,MACT,MAAM;AAAA,MACN,KAAK,CAAC,MAAM;AAAA;AAAA;AAAA;AAAA,wCAIsB,EAAE,OAAO,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMrD;AAAA,EACF;AACF,CAAC;;;ACjID,SAAS,kBAAkB;AAoBpB,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC,OAAO;AAAA,EAChB,cAAc;AACZ,UAAM,6DAA6D;AACnE,SAAK,OAAO;AAAA,EACd;AACF;AAGO,SAAS,sBAAyC;AACvD,QAAM,OAAO,oBAAI,IAAoF;AACrG,QAAM,MAAM,CAAC,QAAgB,YAAoB,GAAG,MAAM;AAAA,EAAK,OAAO;AACtE,SAAO;AAAA,IACL,MAAM,KAAK,QAAQ,SAAS;AAC1B,aAAO,KAAK,IAAI,IAAI,QAAQ,OAAO,CAAC,GAAG,aAAa;AAAA,IACtD;AAAA,IACA,MAAM,KAAK,WAAW,QAAQ,SAAS,KAAK;AAC1C,YAAM,WAAW,KAAK,IAAI,IAAI,QAAQ,OAAO,CAAC;AAC9C,UAAI,YAAY,SAAS,cAAc,UAAW,OAAM,IAAI,kBAAkB;AAC9E,UAAI,CAAC,SAAU,MAAK,IAAI,IAAI,QAAQ,OAAO,GAAG,EAAE,WAAW,QAAQ,SAAS,UAAU,IAAI,CAAC;AAAA,IAC7F;AAAA,IACA,MAAM,OAAO,WAAW,QAAQ,SAAS;AACvC,YAAM,WAAW,KAAK,IAAI,IAAI,QAAQ,OAAO,CAAC;AAC9C,UAAI,UAAU,cAAc,UAAW,QAAO;AAC9C,WAAK,OAAO,IAAI,QAAQ,OAAO,CAAC;AAChC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,KAAK,WAAW;AACpB,aAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,SAAS,EAAE,KAAK,CAAC,GAAG,MAAM,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,SAAS,SAAS,OAAO,EAAE,QAAQ,SAAS,SAAS,EAAE;AAAA,IAC9L;AAAA,EACF;AACF;AAMO,SAAS,yBAAiC;AAC/C,SAAO,oBAAoB,WAAW,CAAC,EAAG,IAAI,EAAE,QAAQ,UAAU,QAAQ,EAAE,UAAU,WAAW,EAAE,CAAC;AACtG;AAGO,SAAS,gBAAgB,OAAiC;AAC/D,SAAO;AAAA,IACL,MAAM,KAAK,QAAQ,SAAS;AAC1B,YAAM,CAAC,GAAG,IAAI,MAAM,MAA8B,iFAAiF,CAAC,QAAQ,OAAO,CAAC;AACpJ,aAAO,KAAK,cAAc;AAAA,IAC5B;AAAA,IACA,MAAM,KAAK,WAAW,QAAQ,SAAS,KAAK;AAE1C,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA;AAAA;AAAA,QAGA,CAAC,QAAQ,SAAS,WAAW,GAAG;AAAA,MAClC;AACA,UAAI,KAAK,WAAW,EAAG,OAAM,IAAI,kBAAkB;AAAA,IACrD;AAAA,IACA,MAAM,OAAO,WAAW,QAAQ,SAAS;AACvC,YAAM,OAAO,MAAM,MAAM,sGAAsG,CAAC,QAAQ,SAAS,SAAS,CAAC;AAC3J,aAAO,KAAK,SAAS;AAAA,IACvB;AAAA,IACA,MAAM,KAAK,WAAW;AACpB,YAAM,OAAO,MAAM,MAA4D,wHAAwH,CAAC,SAAS,CAAC;AAClN,aAAO,KAAK,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,SAAS,EAAE,SAAS,UAAU,EAAE,UAAU,EAAE;AAAA,IAC1F;AAAA,EACF;AACF;","names":[]}

package/dist/identity-links-BI3DYE2I.d.ts

@@ -0,0 +1,97 @@
+import { Query } from '@krizaka/db';
+
+/**
+ * Federated sign-in (Google, Apple, Facebook, a native app's PKCE) delegated to krizaka-users, behind a PORT. The product keeps its
+ * own accounts (`postgresAccounts`); this port only answers « who is this person, according to the provider ». An external
+ * identity is never a second user table: it is a link to an account the product already has.
+ */
+type FederatedProvider = "google" | "apple" | "facebook";
+/** The providers the port knows; anything else is refused before it reaches the adapter. */
+declare const FEDERATED_PROVIDERS: readonly FederatedProvider[];
+declare const isFederatedProvider: (value: unknown) => value is FederatedProvider;
+/** Who the provider says the person is. `issuer` + `subject` identify them for good; the address can change. */
+interface ExternalIdentity {
+    /** The authority that vouches (`https://accounts.google.com`, `https://appleid.apple.com`…). */
+    issuer: string;
+    /** The person's stable id at that authority. */
+    subject: string;
+    email: string | null;
+    /** The provider checked the address (a Facebook address, for one, may not be). */
+    emailVerified: boolean;
+    name: string | null;
+}
+/** What a sign-in is started with: a native app sends the PKCE challenge, a browser flow does not. */
+interface StartOptions {
+    /** The S256 challenge of a PKCE flow (a native app); the matching verifier goes to `complete`. */
+    codeChallenge?: string;
+}
+interface StartedSignIn {
+    /** Where to send the person: the provider's consent page, through krizaka-users. */
+    url: string;
+    /** Echoed back with the code: the product checks it against the one it kept for this browser. */
+    state: string;
+}
+interface CompleteOptions {
+    /** The PKCE verifier of the challenge given to `start`. */
+    codeVerifier?: string;
+}
+interface IdentityProvider {
+    /** Starts a sign-in with `provider`; the person comes back to `returnTo` (a path or an address the adapter allows) with a one-time code. */
+    start(provider: FederatedProvider, returnTo: string, options?: StartOptions): Promise<StartedSignIn>;
+    /** Exchanges the one-time code (single use) for the verified identity. Throws `FederationError("INVALID_CODE")` for a code that is unknown, used or expired. */
+    complete(code: string, options?: CompleteOptions): Promise<ExternalIdentity>;
+}
+declare const FEDERATION_CODE: {
+    readonly invalidCode: "INVALID_CODE";
+    readonly unknownProvider: "UNKNOWN_PROVIDER";
+    readonly badReturn: "BAD_RETURN_TO";
+    readonly unavailable: "UNAVAILABLE";
+};
+type FederationCode = (typeof FEDERATION_CODE)[keyof typeof FEDERATION_CODE];
+declare class FederationError extends Error {
+    readonly code: FederationCode;
+    constructor(code: FederationCode, message: string);
+}
+/** The S256 challenge of a PKCE verifier: base64url(SHA-256(verifier)). A native app computes it; the adapter and the in-memory provider check it. */
+declare const pkceChallenge: (verifier: string) => string;
+/** A return address stays on the product: a path (`/fr/account`), never `//host` or a scheme. */
+declare const isLocalReturn: (returnTo: string) => boolean;
+/** An in-memory provider: the tests' adapter, and the reference the contract is written against. */
+declare function memoryIdentityProvider(): IdentityProvider & {
+    /** Test seam: the one-time code the provider would hand back for this identity (with the PKCE challenge it was started with, if any). */
+    issue(identity: ExternalIdentity, challenge?: string): string;
+};
+
+/**
+ * Which external identity belongs to which account. Never a second user table: a row is only `(issuer, subject) → account`.
+ * The product's `accounts` stays the one place a person lives.
+ */
+interface IdentityLinkStore {
+    /** The account this external identity is linked to, or null. */
+    find(issuer: string, subject: string): Promise<string | null>;
+    /** Links it. Idempotent for the same account; throws when the identity is already linked to another one. */
+    link(accountId: string, issuer: string, subject: string, now: Date): Promise<void>;
+    /** Removes the link (the person unlinks Google); true when there was one. */
+    unlink(accountId: string, issuer: string, subject: string): Promise<boolean>;
+    /** The identities linked to an account, oldest first. */
+    list(accountId: string): Promise<{
+        issuer: string;
+        subject: string;
+        linkedAt: Date;
+    }[]>;
+}
+declare class IdentityLinkError extends Error {
+    readonly code = "ALREADY_LINKED";
+    constructor();
+}
+/** An in-memory store: the tests' adapter, and the reference the contract is written against. */
+declare function memoryIdentityLinks(): IdentityLinkStore;
+/**
+ * The table of links (idempotent). `accounts` is the product's account table.
+ * @deprecated Use `identityLinksSchema` with `emitMigration` or `adoptMigration` from `@krizaka/db`. Removed in the next major.
+ */
+declare function identityLinksMigration(): string;
+/** The store over the product's own database (`external_identities`; see `identityLinksMigration`). */
+declare function dbIdentityLinks(query: Query): IdentityLinkStore;
+
+export { type CompleteOptions as C, type ExternalIdentity as E, FEDERATED_PROVIDERS as F, type IdentityLinkStore as I, type StartOptions as S, type IdentityProvider as a, FEDERATION_CODE as b, type FederatedProvider as c, type FederationCode as d, FederationError as e, IdentityLinkError as f, type StartedSignIn as g, dbIdentityLinks as h, identityLinksMigration as i, isFederatedProvider as j, isLocalReturn as k, memoryIdentityProvider as l, memoryIdentityLinks as m, pkceChallenge as p };

package/dist/index.d.ts

@@ -1,5 +1,152 @@
-import { E as ExternalIdentity, I as IdentityLinkStore, a as IdentityProvider } from './identity-links-C5AG7Fbp.js';
-export { A as AccountDeps, b as AccountError, c as AccountProfile, d as AccountService, C as CompleteOptions, e as EMAIL_CHANGE_TTL_HOURS, F as FEDERATED_PROVIDERS, f as FEDERATION_CODE, g as FederatedProvider, h as FederationCode, i as FederationError, j as IdentityLinkError, M as Mail, k as MailLink, P as PASSWORD_RESET_MAX_MINUTES, l as PASSWORD_RESET_MIN_MINUTES, m as PASSWORD_RESET_TTL_MINUTES, n as ProfilePatch, Q as Query, S as SessionSummary, o as StartOptions, p as StartedSignIn, T as Theme, q as dbAccounts, r as dbIdentityLinks, s as emailChangeMail, t as emailChangeToken, u as identityLinksMigration, v as isEmailChangeToken, w as isFederatedProvider, x as isLinkToken, y as isLocalReturn, z as linkToken, B as memoryIdentityLinks, D as memoryIdentityProvider, G as passwordResetMail, H as pkceChallenge, J as postgresAccounts } from './identity-links-C5AG7Fbp.js';
+import { Query, ModuleSchema } from '@krizaka/db';
+export { Query } from '@krizaka/db';
+import { E as ExternalIdentity, I as IdentityLinkStore, a as IdentityProvider } from './identity-links-BI3DYE2I.js';
+export { C as CompleteOptions, F as FEDERATED_PROVIDERS, b as FEDERATION_CODE, c as FederatedProvider, d as FederationCode, e as FederationError, f as IdentityLinkError, S as StartOptions, g as StartedSignIn, h as dbIdentityLinks, i as identityLinksMigration, j as isFederatedProvider, k as isLocalReturn, m as memoryIdentityLinks, l as memoryIdentityProvider, p as pkceChallenge } from './identity-links-BI3DYE2I.js';
+
+/**
+ * The account PORT (ADR-0008 of Yomizaka, now shared). A product's account — name, language, theme, avatar, e-mail change with
+ * verification, password (changed when signed in, or reset by a mailed link), sessions, export, deletion — behind one interface. Every product keeps its OWN accounts: no central
+ * service, no runtime dependency between products.
+ */
+type Theme = "light" | "dark" | "system";
+interface AccountProfile {
+    id: string;
+    email: string;
+    name: string | null;
+    locale: "en" | "fr";
+    /** The theme the person chose; null = follow the device. */
+    theme: Theme | null;
+    /** A seed of the default avatars (the UI draws it); null = derived from the e-mail address. */
+    avatarSeed: string | null;
+    emailVerified: boolean;
+    /** An address awaiting its verification link, if the person asked to change it. */
+    pendingEmail: string | null;
+}
+interface ProfilePatch {
+    name?: string | null;
+    locale?: "en" | "fr";
+    theme?: Theme | null;
+    avatarSeed?: string | null;
+}
+/** A sign-in of the person: where from and when. Never the token. */
+interface SessionSummary {
+    id: string;
+    createdAt: Date;
+    expiresAt: Date;
+    ip: string | null;
+    userAgent: string | null;
+    current: boolean;
+}
+interface AccountService {
+    profile(accountId: string): Promise<AccountProfile>;
+    updateProfile(accountId: string, patch: ProfilePatch): Promise<AccountProfile>;
+    /** Asks to change the address: the password is checked, a link is mailed to the NEW address. Answers the same whether or not it is already taken (no enumeration). */
+    requestEmailChange(accountId: string, input: {
+        newEmail: string;
+        password: string;
+    }, now: Date): Promise<void>;
+    /** Applies the change from the mailed link (single use, expires); the new address is verified by that very act. */
+    confirmEmailChange(token: string, now: Date): Promise<"CHANGED" | "INVALID">;
+    /** Changes the password (the current one is checked) and signs every other session out; `keepSessionId` stays. */
+    changePassword(accountId: string, input: {
+        current: string;
+        next: string;
+    }, keepSessionId?: string): Promise<void>;
+    /** Asks for a reset link, mailed (in the person's language) when an account with a password has this address; answers the same either way (no enumeration). */
+    requestPasswordReset(email: string, now: Date): Promise<void>;
+    /** Sets a new password from the mailed link — single use, expires — and signs every session out. The new password is checked before the link is used up. */
+    resetPassword(token: string, next: string, now: Date): Promise<"CHANGED" | "INVALID">;
+    /** Checks the password. Throws `AccountError(403, "WRONG_PASSWORD")`. */
+    confirmPassword(accountId: string, password: string): Promise<void>;
+    /** The person's live sign-ins, newest first; `currentSessionId` is flagged. */
+    sessions(accountId: string, now: Date, currentSessionId?: string): Promise<SessionSummary[]>;
+    /** Signs every other session out (and returns how many); `keepSessionId` stays. */
+    signOutOthers(accountId: string, keepSessionId: string): Promise<number>;
+    /** What the product keeps about the person, as one JSON-able document: the profile, the live sign-ins, and what `extra` adds. */
+    exportAccount(accountId: string, now: Date, extra?: () => Promise<Record<string, unknown>>): Promise<Record<string, unknown>>;
+    /** Deletes the identity: the account, its sessions and everything that hangs on it (the product erases its own data first). */
+    deleteAccount(accountId: string): Promise<void>;
+}
+declare class AccountError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+
+interface Mail {
+    to: string;
+    /** The language of the mail (the person's). */
+    locale: "en" | "fr";
+    subject: string;
+    text: string;
+    /**
+     * The link this mail carries, as data: a product that sends branded HTML (`@krizaka/email`: `passwordReset`, `emailChange`)
+     * renders it from this instead of from `text`. Absent on a mail that is not a link.
+     */
+    link?: MailLink;
+}
+/** A mailed link: what it is for, where it goes, and how long it lives. */
+interface MailLink {
+    kind: "passwordReset" | "emailChange";
+    url: string;
+    /** `passwordReset`: the lifetime in minutes. */
+    minutes?: number;
+    /** `emailChange`: the lifetime in hours. */
+    hours?: number;
+}
+interface AccountDeps {
+    query: Query;
+    /**
+     * Runs `work` in one transaction on one connection (BEGIN … COMMIT, rolled back when `work` throws) — the product's pool
+     * knows how. The password reset runs under it: the account row is locked, the links retired and issued, the token claimed,
+     * the password set and the sessions ended as one. Without it, the statements run one by one on `query` (one process, no
+     * concurrent requests): give it in production.
+     */
+    transaction?: <T>(work: (query: Query) => Promise<T>) => Promise<T>;
+    mail: (mail: Mail) => Promise<void>;
+    /** `https://www.akinaza.com`: the e-mail change link is `<baseUrl>/<locale>/confirm-email?token=…`, the reset link `<baseUrl>/<locale>/reset-password?token=…`. */
+    baseUrl: string;
+    /** The product's name, in the words of the mail (« Akinaza »). */
+    product: string;
+    /** The product's token prefix, two or three letters (`ye1.` for Yomizaka: `ye`). The tokens are `<prefix>1.<43 base64url>`. */
+    tokenPrefix: string;
+    passwords: {
+        hash: (password: string) => Promise<string>;
+        verify: (password: string, stored: string) => Promise<boolean>;
+    };
+    /** How a token is kept: the product's own keyed hash, the one its sessions use. */
+    tokenHash: (token: string) => string;
+    /**
+     * How long a password reset link lives, in minutes: a whole number from 5 to 1440 (`PASSWORD_RESET_MIN_MINUTES`–`PASSWORD_RESET_MAX_MINUTES`),
+     * default `PASSWORD_RESET_TTL_MINUTES` (30). The product reads it from its settings; the expiry and the mailed text both use it.
+     * Out of range, `dbAccounts` throws.
+     */
+    passwordResetTtlMinutes?: number;
+    /** Test seam: the token to issue. */
+    token?: () => string;
+}
+declare const EMAIL_CHANGE_TTL_HOURS = 24;
+/** The default lifetime of a password reset link, in minutes (`AccountDeps.passwordResetTtlMinutes` changes it). */
+declare const PASSWORD_RESET_TTL_MINUTES = 30;
+declare const PASSWORD_RESET_MIN_MINUTES = 5;
+declare const PASSWORD_RESET_MAX_MINUTES = 1440;
+/** One format for every mailed link (an e-mail change, a password reset): the product's prefix, a version, 256 random bits. */
+declare const linkToken: (prefix: string) => string;
+declare const isLinkToken: (prefix: string, value: string | undefined | null) => value is string;
+declare const emailChangeToken: (prefix: string) => string;
+declare const isEmailChangeToken: (prefix: string, value: string | undefined | null) => value is string;
+declare function passwordResetMail(product: string, locale: "en" | "fr", url: string, ttlMinutes?: number): {
+    subject: string;
+    text: string;
+};
+declare function emailChangeMail(product: string, locale: "en" | "fr", url: string): {
+    subject: string;
+    text: string;
+};
+/** The adapter over the product's own PostgreSQL (`accounts`, `sessions`, `email_changes`, `password_resets`; see `accountsMigration`). */
+declare function dbAccounts(deps: AccountDeps): AccountService;
+/** @deprecated The old name of `dbAccounts` (a name says what a thing does, not the technology). Removed in the next major. */
+declare const postgresAccounts: typeof dbAccounts;
 
 /** What federated sign-in needs from the product's accounts: no second user table, just a look-up and, when registration is open, a creation. */
 interface FederatedAccounts {
@@ -51,18 +198,15 @@ declare function createFederatedSignIn({ links, accounts, clock }: FederatedSign
 type FederatedSignIn = ReturnType<typeof createFederatedSignIn>;
 
 /**
- * What the account adapter needs from a product's database, safe to run on a database that already has `accounts` and `sessions`:
- * a display name, a theme, an avatar seed, the verified-address flag, and the table of e-mail changes (a link mailed to the NEW
- * address) and the table of password resets (a link mailed to the account's address). `accounts` needs `id`, `email`, `locale`, `password_hash`; `sessions` needs `account_id`, `created_at`, `expires_at`, `ip`, `user_agent`.
- * `backfillVerified`: for accounts that exist already, treat the address as verified (invitation-only products).
+ * The SQL of version 1 of the accounts tables, for a product that runs it by hand (idempotent).
+ * @deprecated Use `accountsSchema` with `emitMigration` or `adoptMigration` from `@krizaka/db`: the SQL gets a version, a checksum and a marker. Removed in the next major.
  */
 declare function accountsMigration(options?: {
     backfillVerified?: boolean;
 }): string;
 /**
- * Memberships (who has which role in which scope) and invitations (an e-mail address invited with a role, by a link used once), from the
- * product's role model. `scopeTable` is the table of the scope (shops, workspaces): when given, a membership and an invitation point at it.
- * Idempotent.
+ * The SQL of version 1 of the memberships and invitations tables, for a product that runs it by hand (idempotent).
+ * @deprecated Use `rolesSchema` with `emitMigration` or `adoptMigration` from `@krizaka/db`. Removed in the next major.
  */
 declare function rolesMigration(roles: readonly string[], options?: {
     ownerTable?: string;
@@ -97,9 +241,8 @@ declare class RolesError extends Error {
     readonly status: number;
     constructor(code: RolesCode);
 }
-interface RolesQuery {
-    <T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<T[]>;
-}
+/** The SQL executor the roles take: `@krizaka/db`'s `Query`. */
+type RolesQuery = Query;
 interface RolesDeps<Role extends string, Permission extends string> {
     query: RolesQuery;
     model: RoleModel<Role, Permission>;
@@ -171,6 +314,36 @@ declare function createRoles<Role extends string, Permission extends string>(dep
 };
 type Roles<Role extends string = string, Permission extends string = string> = ReturnType<typeof createRoles<Role, Permission>>;
 
+/**
+ * The tables of « auth », declared as modules (ADR-001 §3). They are added to a product's own `accounts` and `sessions` tables, which
+ * existed before the module schemas: they stay in `public`, un-qualified, and a product that has them adopts version 1
+ * (`adoptMigration`, markers only) while one that does not emits it (`emitMigration`). Version 1 of each is frozen once released:
+ * a change is version 2. The one product table every one of them references is declared by the product (`accounts`, `owner`).
+ */
+/**
+ * What the account adapter needs from a product's database, safe to run on a database that already has `accounts` and `sessions`:
+ * a display name, a theme, an avatar seed, the verified-address flag, and the table of e-mail changes (a link mailed to the NEW
+ * address) and the table of password resets (a link mailed to the account's address). `accounts` needs `id`, `email`, `locale`, `password_hash`;
+ * `sessions` needs `account_id`, `created_at`, `expires_at`, `ip`, `user_agent`.
+ * @param options `backfillVerified`: for accounts that exist already, treat the address as verified (invitation-only products)
+ */
+declare function accountsSchema(options?: {
+    backfillVerified?: boolean;
+}): ModuleSchema;
+/**
+ * Memberships (who has which role in which scope) and invitations (an e-mail address invited with a role, by a link used once), from the
+ * product's role model. Declares the account table (`owner`) and, when the roles are scoped, the scope table (`scope`: shops, workspaces):
+ * a membership and an invitation then point at it. Idempotent.
+ * @param roles the role names of the model: each becomes a value of the `role` check, so each must be a safe identifier
+ * @param options `scoped`: true when the product declares a `scope` table
+ * @throws Error for a role that is not a safe SQL identifier
+ */
+declare function rolesSchema(roles: readonly string[], options?: {
+    scoped?: boolean;
+}): ModuleSchema;
+/** Which external identity belongs to which account (federated sign-in): `(issuer, subject) → account`, never a second user table. Idempotent. */
+declare const identityLinksSchema: ModuleSchema;
+
 /** The `fetch` the adapter calls krizaka-users with (injected: no global, no network in tests). */
 type Fetcher = (url: string, init: {
     method: "POST";
@@ -196,4 +369,4 @@ declare function parseExternalIdentity(body: unknown): ExternalIdentity;
  */
 declare function usersIdentityProvider({ baseUrl, appUrl, fetch }: UsersFederationOptions): IdentityProvider;
 
-export { ExternalIdentity, FEDERATED_REFUSAL, type FederatedAccounts, type FederatedRefusal, type FederatedSignIn, type FederatedSignInDeps, type FederatedSignInResult, type Fetcher, IdentityLinkStore, IdentityProvider, type Invitation, type Member, ROLES_CODE, type RoleModel, type Roles, type RolesCode, type RolesDeps, RolesError, type RolesQuery, type UsersFederationOptions, accountsMigration, can, createFederatedSignIn, createRoles, defineRoles, parseExternalIdentity, rolesMigration, usersIdentityProvider };
+export { type AccountDeps, AccountError, type AccountProfile, type AccountService, EMAIL_CHANGE_TTL_HOURS, ExternalIdentity, FEDERATED_REFUSAL, type FederatedAccounts, type FederatedRefusal, type FederatedSignIn, type FederatedSignInDeps, type FederatedSignInResult, type Fetcher, IdentityLinkStore, IdentityProvider, type Invitation, type Mail, type MailLink, type Member, PASSWORD_RESET_MAX_MINUTES, PASSWORD_RESET_MIN_MINUTES, PASSWORD_RESET_TTL_MINUTES, type ProfilePatch, ROLES_CODE, type RoleModel, type Roles, type RolesCode, type RolesDeps, RolesError, type RolesQuery, type SessionSummary, type Theme, type UsersFederationOptions, accountsMigration, accountsSchema, can, createFederatedSignIn, createRoles, dbAccounts, defineRoles, emailChangeMail, emailChangeToken, identityLinksSchema, isEmailChangeToken, isLinkToken, linkToken, parseExternalIdentity, passwordResetMail, postgresAccounts, rolesMigration, rolesSchema, usersIdentityProvider };