@oimlsmart/platform-server 0.1.6 → 0.1.8

package/src/store/sqlite/op-accounts-store.ts

@@ -13,6 +13,9 @@
 import { randomUUID } from 'crypto'
 import { getDb } from './store'
 import type {
+  AccountEmail,
+  AddAccountEmailResult,
+  AuthUserPayload,
   CompleteEmailChangeResult,
   CompleteEnrollmentResult,
   EmailChangeToken,
@@ -23,6 +26,27 @@ import type {
   UserAdminRow,
 } from '../../store'
 
+/** The AuthUserPayload projection of a users row (the sqlite/store.ts
+ *  userPayload shape — the full assigned role set rides along). */
+function accountPayload(row: Record<string, unknown>): AuthUserPayload {
+  let roles: string[] | undefined
+  try {
+    const parsed = JSON.parse((row.roles as string | null) ?? 'null') as unknown
+    roles = Array.isArray(parsed) && parsed.length ? parsed.filter((v): v is string => typeof v === 'string') : undefined
+  } catch { roles = undefined }
+  return {
+    id: row.id as string,
+    email: row.email as string,
+    name: row.name as string,
+    role: row.role as string,
+    ...(roles?.length ? { roles } : {}),
+    orgId: (row.org_id as string | null) ?? null,
+    avatarUrl: (row.avatar_url as string | null) ?? undefined,
+    provider: row.provider as string,
+    emailVerifiedAt: (row.email_verified_at as string | null) ?? null,
+  }
+}
+
 function toEnrollmentToken(row: Record<string, unknown>): EnrollmentToken {
   return {
     token: row.token as string,
@@ -35,7 +59,9 @@ function toEnrollmentToken(row: Record<string, unknown>): EnrollmentToken {
 }
 
 /** Create the OP password account. Answers null when the email is taken
- *  (the invite route's 409; the UNIQUE constraint is the race backstop). */
+ *  (the invite route's 409; the UNIQUE constraint is the race backstop).
+ *  TODO.identity-features/01: the taken read spans BOTH address tables —
+ *  an additional on another account blocks the address as a primary. */
 export function createOpAccount(input: {
   email: string
   name: string
@@ -44,6 +70,8 @@ export function createOpAccount(input: {
 }): UserAdminRow | null {
   const db = getDb()
   const id = randomUUID()
+  const additional = db.prepare('SELECT user_id FROM account_emails WHERE email = ?').get(input.email.trim().toLowerCase())
+  if (additional) return null
   try {
     db.prepare(
       "INSERT INTO users (id, email, name, provider, role) VALUES (?, ?, ?, 'password', ?)",
@@ -68,13 +96,26 @@ export function createOpAccount(input: {
 
 /** The password sign-in's lookup: the credential + the active flag, by
  *  (normalized) email. The credential's EXISTENCE is the qualifier — an
- *  account that holds a password may sign in with it. */
+ *  account that holds a password may sign in with it.
+ *  TODO.identity-features/01: the address resolves by ANY of the
+ *  account's VERIFIED addresses — the primary first (the primary owner
+ *  always wins, the deterministic rule), then a proven account_emails
+ *  row; an unverified additional never resolves. */
 export function getPasswordLogin(email: string): { userId: string; hash: string; active: boolean } | null {
-  const row = getDb().prepare(
+  const db = getDb()
+  const normalized = email.trim().toLowerCase()
+  let row = db.prepare(
     `SELECT u.id AS user_id, u.active AS active, p.hash AS hash
      FROM users u JOIN passwords p ON p.user_id = u.id
      WHERE u.email = ?`,
-  ).get(email.trim().toLowerCase()) as Record<string, unknown> | undefined
+  ).get(normalized) as Record<string, unknown> | undefined
+  if (!row) {
+    row = db.prepare(
+      `SELECT u.id AS user_id, u.active AS active, p.hash AS hash
+       FROM users u JOIN passwords p ON p.user_id = u.id
+       WHERE u.id = (SELECT user_id FROM account_emails WHERE email = ? AND verified_at IS NOT NULL)`,
+    ).get(normalized) as Record<string, unknown> | undefined
+  }
   if (!row) return null
   return { userId: row.user_id as string, hash: row.hash as string, active: row.active !== 0 }
 }
@@ -272,10 +313,15 @@ export function revokeOpUserCredentials(userId: string): { sessions: number; acc
 /** The registry's edit act (name/email). The email UNIQUE conflict
  *  throws 'unique' (the route maps it to a 409, never a silent take).
  *  TODO.identity/06: an admin-set address never went through the
- *  verify-new-email ceremony, so the verification state resets. */
+ *  verify-new-email ceremony, so the verification state resets.
+ *  TODO.identity-features/01: the conflict read spans BOTH address
+ *  tables — an additional row (on any account, this one included) holds
+ *  the address too. */
 export function updateOpAccount(id: string, input: { name?: string; email?: string }): boolean {
   const db = getDb()
   if (input.email !== undefined) {
+    const additional = db.prepare('SELECT user_id FROM account_emails WHERE email = ?').get(input.email.trim().toLowerCase())
+    if (additional) throw new Error(`unique: ${input.email}`)
     try {
       db.prepare('UPDATE users SET email = ?, email_verified_at = NULL WHERE id = ?').run(input.email.trim().toLowerCase(), id)
     } catch (e) {
@@ -313,6 +359,8 @@ export function eraseOpAccount(userId: string): {
   tokens: number
   factors: number
   personalAccessTokens: number
+  consentGrants: number
+  emails: number
 } | null {
   const db = getDb()
   const row = db.prepare('SELECT 1 AS ok FROM users WHERE id = ?').get(userId)
@@ -339,6 +387,12 @@ export function eraseOpAccount(userId: string): {
   // TODO.identity-features/08: the developer tokens die with the account
   // (the hashed rows go — a tombstone's tokens never exchange again).
   const personalAccessTokens = db.prepare('DELETE FROM personal_access_tokens WHERE user_id = ?').run(userId).changes
+  // TODO.identity-features/12: the remembered consent grants die with the
+  // account (a tombstone never skips a consent page again).
+  const consentGrants = db.prepare('DELETE FROM oidc_consent_grants WHERE user_id = ?').run(userId).changes
+  // TODO.identity-features/01: the additional addresses die with the
+  // account (a tombstone's addresses never resolve a sign-in again).
+  const emails = db.prepare('DELETE FROM account_emails WHERE user_id = ?').run(userId).changes
   db.prepare(
     `UPDATE users SET
        email = ?, name = 'Deleted account', provider = 'erased',
@@ -346,7 +400,7 @@ export function eraseOpAccount(userId: string): {
        avatar_url = NULL, email_verified_at = NULL, active = 0
      WHERE id = ?`,
   ).run(`deleted-${userId}@erased.invalid`, userId)
-  return { ...revoked, links, clientRoles, memberships, tokens, factors, personalAccessTokens }
+  return { ...revoked, links, clientRoles, memberships, tokens, factors, personalAccessTokens, consentGrants, emails }
 }
 
 /** The last OP-side sign-in per account, FROM THE AUDIT CHAIN: the
@@ -409,29 +463,44 @@ function toEmailChangeToken(row: Record<string, unknown>): EmailChangeToken {
     userId: row.user_id as string,
     newEmail: row.new_email as string,
     deliveredBy: row.delivered_by === 'mailer' ? 'mailer' : 'shown',
+    // TODO.identity-features/01: rows predating the kind column read as
+    // the legacy ceremony.
+    kind: row.kind === 'add' ? 'add' : 'change',
     createdAt: row.created_at as string,
     expiresAt: row.expires_at as string,
     consumedAt: (row.consumed_at as string | null) ?? null,
   }
 }
 
-/** Mint the ceremony's token; the account's earlier pending rows are
- *  VOIDED first (only the newest link works). */
+/** Mint the ceremony's token. The void rule keeps ONE live link per
+ *  ceremony target: a 'change' request voids the account's earlier
+ *  pending 'change' rows (only the newest change link works — the
+ *  pre-01 doctrine); an 'add' request voids the account's earlier
+ *  pending 'add' rows FOR THE SAME address (other addresses' links
+ *  stand). */
 export function createEmailChangeToken(input: {
   token: string
   userId: string
   newEmail: string
   deliveredBy: 'mailer' | 'shown'
+  kind?: 'change' | 'add'
   ttlMs: number
 }): EmailChangeToken {
   const db = getDb()
-  db.prepare(
-    "UPDATE email_change_tokens SET consumed_at = datetime('now') WHERE user_id = ? AND consumed_at IS NULL",
-  ).run(input.userId)
+  const kind = input.kind ?? 'change'
+  if (kind === 'change') {
+    db.prepare(
+      "UPDATE email_change_tokens SET consumed_at = datetime('now') WHERE user_id = ? AND kind = 'change' AND consumed_at IS NULL",
+    ).run(input.userId)
+  } else {
+    db.prepare(
+      "UPDATE email_change_tokens SET consumed_at = datetime('now') WHERE user_id = ? AND kind = 'add' AND new_email = ? AND consumed_at IS NULL",
+    ).run(input.userId, input.newEmail.trim().toLowerCase())
+  }
   const expiresAt = new Date(Date.now() + input.ttlMs).toISOString()
   db.prepare(
-    'INSERT INTO email_change_tokens (token, user_id, new_email, delivered_by, expires_at) VALUES (?, ?, ?, ?, ?)',
-  ).run(input.token, input.userId, input.newEmail.trim().toLowerCase(), input.deliveredBy, expiresAt)
+    'INSERT INTO email_change_tokens (token, user_id, new_email, delivered_by, kind, expires_at) VALUES (?, ?, ?, ?, ?, ?)',
+  ).run(input.token, input.userId, input.newEmail.trim().toLowerCase(), input.deliveredBy, kind, expiresAt)
   return getEmailChangeToken(input.token)!
 }
 
@@ -440,22 +509,29 @@ export function getEmailChangeToken(token: string): EmailChangeToken | null {
   return row ? toEmailChangeToken(row) : null
 }
 
-/** The account's pending change (the newest live row), so the console
- *  can show it. */
+/** The account's pending PRIMARY change (the newest live 'change' row),
+ *  so the console can show it. The per-address verifications are the
+ *  account_emails rows' own state (verified_at NULL = waiting), never a
+ *  pending read here. */
 export function getPendingEmailChange(userId: string): EmailChangeToken | null {
   const row = getDb().prepare(
     `SELECT * FROM email_change_tokens
-     WHERE user_id = ? AND consumed_at IS NULL AND expires_at > datetime('now')
+     WHERE user_id = ? AND kind = 'change' AND consumed_at IS NULL AND expires_at > datetime('now')
      ORDER BY created_at DESC LIMIT 1`,
   ).get(userId) as Record<string, unknown> | undefined
   return row ? toEmailChangeToken(row) : null
 }
 
 /** Complete the ceremony: consume ATOMICALLY (a presented link works
- *  exactly once, expired or not), judge the expiry, re-check the
- *  address's uniqueness (a conflict burns the token honestly), then move
- *  the account's email. A 'mailer'-delivered token verifies the address;
- *  a shown one applies the change with the address staying unverified. */
+ *  exactly once, expired or not), judge the expiry, then act on the
+ *  kind. 'change' (the pre-01 primary replacement): re-check the
+ *  address's uniqueness across BOTH address tables (a conflict burns the
+ *  token honestly — an additional row anywhere holds the address too,
+ *  this account's included), then move users.email. 'add' (the
+ *  per-address verification): the account_emails row landed unverified
+ *  at the request; the completion stamps it (a row removed meanwhile
+ *  burns the link as 'unknown'). A 'mailer'-delivered token verifies the
+ *  address; a shown one never does. */
 export function completeEmailChange(token: string): CompleteEmailChangeResult {
   const db = getDb()
   const res = db.prepare(
@@ -464,11 +540,123 @@ export function completeEmailChange(token: string): CompleteEmailChangeResult {
   if (res.changes === 0) return { kind: 'unknown' }
   const row = getEmailChangeToken(token)!
   if (new Date(row.expiresAt).getTime() <= Date.now()) return { kind: 'expired' }
+  const verified = row.deliveredBy === 'mailer'
+  if (row.kind === 'add') {
+    const standing = db.prepare('SELECT 1 AS ok FROM account_emails WHERE user_id = ? AND email = ?').get(row.userId, row.newEmail)
+    if (!standing) return { kind: 'unknown' }
+    if (verified) markAccountEmailVerified(row.userId, row.newEmail)
+    return { kind: 'ok', userId: row.userId, newEmail: row.newEmail, verified }
+  }
   const taken = db.prepare('SELECT id FROM users WHERE email = ?').get(row.newEmail) as { id: string } | undefined
   if (taken) return { kind: 'conflict' }
-  const verified = row.deliveredBy === 'mailer'
+  const takenAdditional = db.prepare('SELECT user_id FROM account_emails WHERE email = ?').get(row.newEmail) as { user_id: string } | undefined
+  if (takenAdditional) return { kind: 'conflict' }
   db.prepare(
     `UPDATE users SET email = ?, email_verified_at = ${verified ? "datetime('now')" : 'NULL'} WHERE id = ?`,
   ).run(row.newEmail, row.userId)
   return { kind: 'ok', userId: row.userId, newEmail: row.newEmail, verified }
 }
+
+// ── multiple emails per account (TODO.identity-features/01) ──────────
+
+function toAccountEmail(row: Record<string, unknown>, isPrimary: boolean): AccountEmail {
+  return {
+    userId: row.user_id as string,
+    email: row.email as string,
+    verifiedAt: (row.verified_at as string | null) ?? null,
+    isPrimary,
+    addedBy: (row.added_by as string | null) ?? null,
+    createdAt: row.created_at as string,
+  }
+}
+
+/** The account's addresses: the PRIMARY first (the users row's email +
+ *  its verification stamp), then the additional account_emails rows
+ *  (oldest first). */
+export function listAccountEmails(userId: string): AccountEmail[] {
+  const db = getDb()
+  const primary = db.prepare(
+    'SELECT id AS user_id, email, email_verified_at AS verified_at, created_at FROM users WHERE id = ?',
+  ).get(userId) as Record<string, unknown> | undefined
+  const rows = db.prepare(
+    'SELECT * FROM account_emails WHERE user_id = ? ORDER BY created_at, email',
+  ).all(userId) as Array<Record<string, unknown>>
+  const out: AccountEmail[] = []
+  if (primary) out.push(toAccountEmail(primary, true))
+  out.push(...rows.map(r => toAccountEmail(r, false)))
+  return out
+}
+
+/** Resolve the account by ANY of its addresses (normalized): the primary
+ *  always names it (and the primary owner always wins — the
+ *  deterministic rule); an additional ONLY when verified. */
+export function findUserByAnyEmail(email: string): AuthUserPayload | null {
+  const db = getDb()
+  const normalized = email.trim().toLowerCase()
+  const primary = db.prepare('SELECT * FROM users WHERE email = ?').get(normalized) as Record<string, unknown> | undefined
+  if (primary) return accountPayload(primary)
+  const owner = db.prepare(
+    'SELECT user_id FROM account_emails WHERE email = ? AND verified_at IS NOT NULL',
+  ).get(normalized) as { user_id: string } | undefined
+  if (!owner) return null
+  const user = db.prepare('SELECT * FROM users WHERE id = ?').get(owner.user_id) as Record<string, unknown> | undefined
+  return user ? accountPayload(user) : null
+}
+
+/** Add an ADDITIONAL address (normalized lowercase; the row lands
+ *  UNVERIFIED). The account's own existing row answers 'present' (the
+ *  idempotent re-add); any other hold of the address — a primary
+ *  anywhere (this account's included) or another account's additional —
+ *  answers 'conflict'. The unique index is the race backstop. */
+export function addAccountEmail(userId: string, email: string, addedBy?: string | null): AddAccountEmailResult {
+  const db = getDb()
+  const normalized = email.trim().toLowerCase()
+  const takenPrimary = db.prepare('SELECT id FROM users WHERE email = ?').get(normalized)
+  if (takenPrimary) return 'conflict'
+  const existing = db.prepare('SELECT user_id FROM account_emails WHERE email = ?').get(normalized) as { user_id: string } | undefined
+  if (existing) return existing.user_id === userId ? 'present' : 'conflict'
+  try {
+    db.prepare('INSERT INTO account_emails (user_id, email, added_by) VALUES (?, ?, ?)').run(userId, normalized, addedBy ?? null)
+  } catch (e) {
+    if (String((e as Error).message).includes('UNIQUE')) return 'conflict'
+    throw e
+  }
+  return 'added'
+}
+
+/** The verification ceremony's stamp on the account's OWN row: the
+ *  guarded UPDATE flips verified_at, once. */
+export function markAccountEmailVerified(userId: string, email: string): boolean {
+  return getDb().prepare(
+    "UPDATE account_emails SET verified_at = datetime('now') WHERE user_id = ? AND email = ? AND verified_at IS NULL",
+  ).run(userId, email.trim().toLowerCase()).changes > 0
+}
+
+/** Promote a VERIFIED additional to primary: the promoted address
+ *  becomes users.email with its verification stamp; the outgoing
+ *  primary takes the row's place in account_emails with ITS stamp (it
+ *  stays a verified additional — sign-in by it keeps working). */
+export function setPrimaryAccountEmail(userId: string, email: string): 'ok' | 'unknown' | 'unverified' {
+  const db = getDb()
+  const normalized = email.trim().toLowerCase()
+  const row = db.prepare('SELECT * FROM account_emails WHERE user_id = ? AND email = ?').get(userId, normalized) as Record<string, unknown> | undefined
+  if (!row) return 'unknown'
+  if (!row.verified_at) return 'unverified'
+  const current = db.prepare('SELECT email, email_verified_at FROM users WHERE id = ?').get(userId) as { email: string; email_verified_at: string | null } | undefined
+  if (!current) return 'unknown'
+  db.prepare('UPDATE users SET email = ?, email_verified_at = ? WHERE id = ?').run(normalized, row.verified_at as string, userId)
+  db.prepare('DELETE FROM account_emails WHERE user_id = ? AND email = ?').run(userId, normalized)
+  db.prepare('INSERT INTO account_emails (user_id, email, verified_at) VALUES (?, ?, ?)').run(userId, current.email, current.email_verified_at)
+  return 'ok'
+}
+
+/** Remove an ADDITIONAL address. The primary refuses honestly
+ *  ('primary' — promote another address first). */
+export function removeAccountEmail(userId: string, email: string): 'ok' | 'primary' | 'unknown' {
+  const db = getDb()
+  const normalized = email.trim().toLowerCase()
+  const current = db.prepare('SELECT email FROM users WHERE id = ?').get(userId) as { email: string } | undefined
+  if (current?.email === normalized) return 'primary'
+  const res = db.prepare('DELETE FROM account_emails WHERE user_id = ? AND email = ?').run(userId, normalized)
+  return res.changes > 0 ? 'ok' : 'unknown'
+}

package/src/store/sqlite/schema.sql

@@ -444,11 +444,15 @@ CREATE INDEX IF NOT EXISTS idx_enrollment_tokens_user ON enrollment_tokens (user
 -- was displayed to the signed-in holder; completing it applies the change
 -- but the address stays unverified, honestly). A fresh request voids the
 -- account's earlier pending rows: only the newest link works.
+-- TODO.identity-features/01: kind names the ceremony — 'change' (the
+-- primary replacement above) or 'add' (the per-address verification of an
+-- account_emails row; completion stamps the row's verified_at).
 CREATE TABLE IF NOT EXISTS email_change_tokens (
   token TEXT PRIMARY KEY,
   user_id TEXT NOT NULL REFERENCES users(id),
   new_email TEXT NOT NULL,
   delivered_by TEXT NOT NULL DEFAULT 'shown',
+  kind TEXT NOT NULL DEFAULT 'change',
   created_at TEXT NOT NULL DEFAULT (datetime('now')),
   expires_at TEXT NOT NULL,
   consumed_at TEXT
@@ -825,3 +829,49 @@ CREATE TABLE IF NOT EXISTS personal_access_tokens (
   UNIQUE (token_hash)
 );
 CREATE INDEX IF NOT EXISTS idx_personal_access_tokens_user ON personal_access_tokens (user_id);
+
+-- ═══════════════════════════════════════════════════════════════════
+-- The remembered consent grants (TODO.identity-features/12): the OP
+-- remembers the account holder's "Allow" per (user, client, scope set) —
+-- a repeat authorization the grant COVERS skips the consent page (unless
+-- the request carries prompt=consent). scope is the canonical space-joined
+-- set spelling (normalizeOidcScopeSet); the partial unique index keys ONE
+-- LIVE grant per (user_id, client_id, scope) — revocation flips
+-- revoked_at (the row stays for the audit + the history), a revoked
+-- triple's re-allow lands a fresh row, and the account erasure removes
+-- the rows outright. The D1 migration set carries the identical end state
+-- (0021_oidc_consent_grants.sql).
+-- ═══════════════════════════════════════════════════════════════════
+CREATE TABLE IF NOT EXISTS oidc_consent_grants (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  client_id TEXT NOT NULL,
+  scope TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  revoked_at TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_consent_grants_live
+  ON oidc_consent_grants (user_id, client_id, scope) WHERE revoked_at IS NULL;
+CREATE INDEX IF NOT EXISTS idx_oidc_consent_grants_user ON oidc_consent_grants (user_id);
+
+-- ═══════════════════════════════════════════════════════════════════
+-- Multiple emails per account (TODO.identity-features/01): the account
+-- carries a primary + additional addresses. The PRIMARY stays users.email
+-- (the OIDC `email` claim never changes shape); account_emails carries
+-- the ADDITIONAL addresses, one row per (account, address), verified_at
+-- NULL until the per-address ceremony (email_change_tokens kind 'add')
+-- proves the mailbox. The unique index makes an additional address name
+-- at most one account; the store's writes check across BOTH tables, and
+-- the sign-in/recovery resolutions prefer the primary owner
+-- deterministically. The D1 migration set carries the identical end
+-- state (0022_account_emails.sql).
+-- ═══════════════════════════════════════════════════════════════════
+CREATE TABLE IF NOT EXISTS account_emails (
+  user_id TEXT NOT NULL REFERENCES users(id),
+  email TEXT NOT NULL,
+  verified_at TEXT,
+  added_by TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (user_id, email)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_account_emails_email ON account_emails (email);

package/src/store/sqlite/store.ts

@@ -144,6 +144,16 @@ function migrateAuthTables(db: Database.Database): void {
   if (!amrTokenCols.some(c => c.name === 'amr')) {
     db.exec('ALTER TABLE oidc_access_tokens ADD COLUMN amr TEXT')
   }
+  // TODO.identity-features/01 (multiple emails per account): the
+  // ceremony token's kind column arrives with migration 0022 — a dev
+  // file predating it grows the column here ('change' — every existing
+  // row is the legacy primary-replacement ceremony). The account_emails
+  // table itself arrives via schema.sql's CREATE IF NOT EXISTS on every
+  // boot.
+  const emailChangeCols = db.prepare('PRAGMA table_info(email_change_tokens)').all() as Array<{ name: string }>
+  if (emailChangeCols.length && !emailChangeCols.some(c => c.name === 'kind')) {
+    db.exec("ALTER TABLE email_change_tokens ADD COLUMN kind TEXT NOT NULL DEFAULT 'change'")
+  }
 }
 
 // AuthUserPayload lives in ./backend (see the re-export above).

package/src/store/sqlite.ts

@@ -143,6 +143,7 @@ import {
   upsertIdentityProvider,
 } from './sqlite/upstream-store'
 import {
+  addAccountEmail,
   completeEmailChange,
   completeEnrollment,
   countSignInMethods,
@@ -155,24 +156,29 @@ import {
   deletePasswordHash,
   deleteSessionById,
   eraseOpAccount,
+  findUserByAnyEmail,
   getEmailChangeToken,
   getEnrollmentToken,
   getOpClientRoles,
   getPasswordLogin,
   getPendingEmailChange,
   lastAccountSignIns,
+  listAccountEmails,
   listAllOpClientRoles,
   listOpClientRoles,
   listOpLiveSessions,
   listUserSessions,
+  markAccountEmailVerified,
+  removeAccountEmail,
   revokeOpUserCredentials,
   setOpClientRoles,
   setPasswordHash,
+  setPrimaryAccountEmail,
   setUserAvatar,
   updateOpAccount,
   updateUserName,
 } from './sqlite/op-accounts-store'
-import { installStore, type AuthUserPayload, type CertificateHolderClaim, type CertificateHolderOrg, type CompleteEmailChangeResult, type CompleteEnrollmentResult, type EmailChangeToken, type EnrollmentToken, type EntityChange, type EntityRow, type EventKeyFilter, type FederationPeer, type IdentityApproval, type IdentityLink, type IdentityProvider, type InstrumentRegistration, type InstrumentRegistrationLifecycle, type InstrumentRegistrationScopeStatus, type NotifyDelivery, type NotifyDeliveryStatus, type NotifyEntityMute, type NotifyInboxState, type NotifyPreferences, type NotifyRule, type OAuthInitialAssignment, type OidcAccessToken, type OidcAuthorization, type OidcClient, type OidcClientLaunch, type OidcCode, type OidcKeyRow, type OpAccountErasure, type OpClientRoleAssignment, type OpLiveSession, type OrgJoinRequest, type OrgMembership, type OrgMembershipState, type OrgRegistryContact, type OrgRegistryOrg, type OrgRegistryState, type PersonalAccessToken, type PlatformEvent, type ServerStore, type SessionView, type SsoSignInState, type UserAdminRow, type AdvanceCounterResult, type MfaPending, type RecoveryCodeState, type TotpSecret, type WebauthnChallenge, type WebauthnCredential } from '../store'
+import { installStore, type AccountEmail, type AddAccountEmailResult, type AuthUserPayload, type CertificateHolderClaim, type CertificateHolderOrg, type CompleteEmailChangeResult, type CompleteEnrollmentResult, type EmailChangeToken, type EnrollmentToken, type EntityChange, type EntityRow, type EventKeyFilter, type FederationPeer, type IdentityApproval, type IdentityLink, type IdentityProvider, type InstrumentRegistration, type InstrumentRegistrationLifecycle, type InstrumentRegistrationScopeStatus, type NotifyDelivery, type NotifyDeliveryStatus, type NotifyEntityMute, type NotifyInboxState, type NotifyPreferences, type NotifyRule, type OAuthInitialAssignment, type OidcAccessToken, type OidcAuthorization, type OidcClient, type OidcClientLaunch, type OidcCode, type OidcConsentGrant, type OidcKeyRow, type OpAccountErasure, type OpClientRoleAssignment, type OpLiveSession, type OrgJoinRequest, type OrgMembership, type OrgMembershipState, type OrgRegistryContact, type OrgRegistryOrg, type OrgRegistryState, type PersonalAccessToken, type PlatformEvent, type ServerStore, type SessionView, type SsoSignInState, type UserAdminRow, type AdvanceCounterResult, type MfaPending, type RecoveryCodeState, type TotpSecret, type WebauthnChallenge, type WebauthnCredential } from '../store'
 import {
   advanceWebauthnCounter,
   consumeMfaPending,
@@ -205,6 +211,12 @@ import {
   revokePersonalAccessToken,
   stampPersonalAccessTokenUse,
 } from './sqlite/pat-store'
+import {
+  getConsentGrant,
+  listConsentGrants,
+  recordConsentGrant,
+  revokeConsentGrant,
+} from './sqlite/consent-grants-store'
 
 
 /** The workflow tables the reset wipe covers (the D1 store's
@@ -652,6 +664,20 @@ export function createSqliteServerStore(): ServerStore {
       retireOidcKey(kid)
     },
 
+    // ── the remembered consent grants (TODO.identity-features/12) ──
+    async getConsentGrant(userId: string, clientId: string, scope: string): Promise<OidcConsentGrant | null> {
+      return getConsentGrant(userId, clientId, scope)
+    },
+    async recordConsentGrant(input: { userId: string; clientId: string; scope: string }): Promise<OidcConsentGrant> {
+      return recordConsentGrant(input)
+    },
+    async listConsentGrants(userId: string): Promise<OidcConsentGrant[]> {
+      return listConsentGrants(userId)
+    },
+    async revokeConsentGrant(id: string, userId: string): Promise<boolean> {
+      return revokeConsentGrant(id, userId)
+    },
+
     // ── the upstream providers (TODO.identity/08) ──
     async listIdentityProviders(): Promise<IdentityProvider[]> {
       return listIdentityProviders()
@@ -761,6 +787,7 @@ export function createSqliteServerStore(): ServerStore {
       userId: string
       newEmail: string
       deliveredBy: 'mailer' | 'shown'
+      kind?: 'change' | 'add'
       ttlMs: number
     }): Promise<EmailChangeToken> {
       return createEmailChangeToken(input)
@@ -775,6 +802,26 @@ export function createSqliteServerStore(): ServerStore {
       return completeEmailChange(token)
     },
 
+    // ── multiple emails per account (TODO.identity-features/01) ──
+    async listAccountEmails(userId: string): Promise<AccountEmail[]> {
+      return listAccountEmails(userId)
+    },
+    async findUserByAnyEmail(email: string): Promise<AuthUserPayload | null> {
+      return findUserByAnyEmail(email)
+    },
+    async addAccountEmail(userId: string, email: string, addedBy?: string | null): Promise<AddAccountEmailResult> {
+      return addAccountEmail(userId, email, addedBy)
+    },
+    async markAccountEmailVerified(userId: string, email: string): Promise<boolean> {
+      return markAccountEmailVerified(userId, email)
+    },
+    async setPrimaryAccountEmail(userId: string, email: string): Promise<'ok' | 'unknown' | 'unverified'> {
+      return setPrimaryAccountEmail(userId, email)
+    },
+    async removeAccountEmail(userId: string, email: string): Promise<'ok' | 'primary' | 'unknown'> {
+      return removeAccountEmail(userId, email)
+    },
+
     // ── strong authentication: the factor registry (TODO.identity-sso/02 + /03) ──
     async createWebauthnChallenge(input: {
       challenge: string