@plumix/core 0.1.0

package/dist/auth/email/messages.js

@@ -0,0 +1,91 @@
+// Locale-keyed email subject + body fragments. Plumix's emails go out
+// pre-auth (magic-link) or to a user whose locale we know (email-change),
+// so the table is keyed by locale code with English as the fallback.
+//
+// Hand-rolled rather than going through Lingui's server-side `setupI18n`
+// — emails are a small, slow-moving surface; the operator cost of
+// maintaining a separate server catalog (loaded via `load-catalog.ts`,
+// merged into a per-locale `i18n` instance, accessed via `_()`) wasn't
+// worth it for ~10 strings. Promote to Lingui when a fifth or sixth
+// transactional email lands and the table starts duplicating chrome.
+const en = {
+    magicLink: {
+        subject: (siteName) => `Sign in to ${siteName}`,
+        body: (siteName, url, ttlSeconds) => [
+            `Sign in to ${siteName} by opening this link:`,
+            "",
+            url,
+            "",
+            `The link expires in ${Math.round(ttlSeconds / 60)} minutes.`,
+            "",
+            "If you didn't request this, you can ignore this email.",
+        ].join("\n"),
+    },
+    emailChange: {
+        subject: (siteName) => `Confirm your new email for ${siteName}`,
+        body: ({ siteName, oldEmail, newEmail, url, ttlSeconds }) => [
+            `Someone — hopefully you — asked to change the email on your ${siteName} account.`,
+            "",
+            `From: ${oldEmail}`,
+            `To:   ${newEmail}`,
+            "",
+            "Confirm the change by opening this link:",
+            "",
+            url,
+            "",
+            `The link expires in ${Math.round(ttlSeconds / 3600)} hour${Math.round(ttlSeconds / 3600) === 1 ? "" : "s"}.`,
+            "",
+            `If you didn't request this, you can ignore this email — your account stays on ${oldEmail}.`,
+        ].join("\n"),
+    },
+};
+const de = {
+    magicLink: {
+        subject: (siteName) => `Bei ${siteName} anmelden`,
+        body: (siteName, url, ttlSeconds) => [
+            `Melden Sie sich bei ${siteName} über diesen Link an:`,
+            "",
+            url,
+            "",
+            `Der Link läuft in ${Math.round(ttlSeconds / 60)} Minuten ab.`,
+            "",
+            "Falls Sie dies nicht angefordert haben, können Sie diese E-Mail ignorieren.",
+        ].join("\n"),
+    },
+    emailChange: {
+        subject: (siteName) => `Bestätigen Sie Ihre neue E-Mail für ${siteName}`,
+        body: ({ siteName, oldEmail, newEmail, url, ttlSeconds }) => [
+            `Jemand — hoffentlich Sie — hat darum gebeten, die E-Mail-Adresse Ihres ${siteName}-Kontos zu ändern.`,
+            "",
+            `Von: ${oldEmail}`,
+            `An:  ${newEmail}`,
+            "",
+            "Bestätigen Sie die Änderung über diesen Link:",
+            "",
+            url,
+            "",
+            `Der Link läuft in ${Math.round(ttlSeconds / 3600)} Stunde${Math.round(ttlSeconds / 3600) === 1 ? "" : "n"} ab.`,
+            "",
+            `Falls Sie dies nicht angefordert haben, können Sie diese E-Mail ignorieren — Ihr Konto bleibt bei ${oldEmail}.`,
+        ].join("\n"),
+    },
+};
+// Locale-fallback chain: exact match → base-language (e.g. `de-AT` → `de`)
+// → English. Same shape as `findEnabledLocale` for consistency without
+// importing the registry (avoids coupling auth/email to i18n/locale-registry
+// which only the public-route resolver consumes).
+const LOCALES = { en, de };
+function isLocaleKey(value) {
+    return value in LOCALES;
+}
+export function emailStringsFor(locale) {
+    if (!locale)
+        return en;
+    if (isLocaleKey(locale))
+        return LOCALES[locale];
+    const base = locale.split("-")[0];
+    if (base && isLocaleKey(base))
+        return LOCALES[base];
+    return en;
+}
+//# sourceMappingURL=messages.js.map

package/dist/auth/email/messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../../src/auth/email/messages.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,0EAA0E;AAC1E,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AAuBrE,MAAM,EAAE,GAAuB;IAC7B,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,QAAQ,EAAE;QAC/C,IAAI,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,CAClC;YACE,cAAc,QAAQ,wBAAwB;YAC9C,EAAE;YACF,GAAG;YACH,EAAE;YACF,uBAAuB,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC,WAAW;YAC7D,EAAE;YACF,wDAAwD;SACzD,CAAC,IAAI,CAAC,IAAI,CAAC;KACf;IACD,WAAW,EAAE;QACX,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,8BAA8B,QAAQ,EAAE;QAC/D,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAC1D;YACE,+DAA+D,QAAQ,WAAW;YAClF,EAAE;YACF,SAAS,QAAQ,EAAE;YACnB,SAAS,QAAQ,EAAE;YACnB,EAAE;YACF,0CAA0C;YAC1C,EAAE;YACF,GAAG;YACH,EAAE;YACF,uBAAuB,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,QAClD,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC7C,GAAG;YACH,EAAE;YACF,iFAAiF,QAAQ,GAAG;SAC7F,CAAC,IAAI,CAAC,IAAI,CAAC;KACf;CACF,CAAC;AAEF,MAAM,EAAE,GAAuB;IAC7B,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,QAAQ,WAAW;QACjD,IAAI,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,CAClC;YACE,uBAAuB,QAAQ,uBAAuB;YACtD,EAAE;YACF,GAAG;YACH,EAAE;YACF,qBAAqB,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC,cAAc;YAC9D,EAAE;YACF,6EAA6E;SAC9E,CAAC,IAAI,CAAC,IAAI,CAAC;KACf;IACD,WAAW,EAAE;QACX,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,uCAAuC,QAAQ,EAAE;QACxE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAC1D;YACE,0EAA0E,QAAQ,oBAAoB;YACtG,EAAE;YACF,QAAQ,QAAQ,EAAE;YAClB,QAAQ,QAAQ,EAAE;YAClB,EAAE;YACF,+CAA+C;YAC/C,EAAE;YACF,GAAG;YACH,EAAE;YACF,qBAAqB,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,UAChD,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC7C,MAAM;YACN,EAAE;YACF,qGAAqG,QAAQ,GAAG;SACjH,CAAC,IAAI,CAAC,IAAI,CAAC;KACf;CACF,CAAC;AAEF,2EAA2E;AAC3E,uEAAuE;AACvE,6EAA6E;AAC7E,kDAAkD;AAClD,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,EAAE,EAA+C,CAAC;AAGxE,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,IAAI,OAAO,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,MAA0B;IAE1B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/auth/email-change/cancel.d.ts

@@ -0,0 +1,15 @@
+import type { Db } from "../../context/app.js";
+/**
+ * Cancel any outstanding email-change verification for a user. The
+ * caller (RPC procedure) decides whether self or admin can invoke.
+ *
+ * Returns the count of deleted rows so the UI can render "no
+ * pending request" vs "cancelled". Idempotent — calling on a user
+ * with no pending request returns 0.
+ */
+export declare function cancelEmailChange(db: Db, input: {
+    userId: number;
+}): Promise<{
+    cancelled: number;
+}>;
+//# sourceMappingURL=cancel.d.ts.map

package/dist/auth/email-change/cancel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel.d.ts","sourceRoot":"","sources":["../../../src/auth/email-change/cancel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAI/C;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GACxB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAWhC"}

package/dist/auth/email-change/cancel.js

@@ -0,0 +1,18 @@
+import { and, eq } from "../../db/index.js";
+import { authTokens } from "../../db/schema/auth_tokens.js";
+/**
+ * Cancel any outstanding email-change verification for a user. The
+ * caller (RPC procedure) decides whether self or admin can invoke.
+ *
+ * Returns the count of deleted rows so the UI can render "no
+ * pending request" vs "cancelled". Idempotent — calling on a user
+ * with no pending request returns 0.
+ */
+export async function cancelEmailChange(db, input) {
+    const rows = await db
+        .delete(authTokens)
+        .where(and(eq(authTokens.type, "email_verification"), eq(authTokens.userId, input.userId)))
+        .returning({ hash: authTokens.hash });
+    return { cancelled: rows.length };
+}
+//# sourceMappingURL=cancel.js.map

package/dist/auth/email-change/cancel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel.js","sourceRoot":"","sources":["../../../src/auth/email-change/cancel.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAM,EACN,KAAyB;IAEzB,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,UAAU,CAAC;SAClB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,oBAAoB,CAAC,EACzC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACpC,CACF;SACA,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AACpC,CAAC"}

package/dist/auth/email-change/errors.d.ts

@@ -0,0 +1,13 @@
+export declare const EMAIL_CHANGE_ERROR_CODES: readonly ["missing_token", "token_invalid", "token_expired", "email_taken", "user_not_found", "account_disabled"];
+export type EmailChangeErrorCode = (typeof EMAIL_CHANGE_ERROR_CODES)[number];
+export declare class EmailChangeError extends Error {
+    readonly code: EmailChangeErrorCode;
+    private constructor();
+    static missingToken(): EmailChangeError;
+    static tokenInvalid(): EmailChangeError;
+    static tokenExpired(): EmailChangeError;
+    static emailTaken(): EmailChangeError;
+    static userNotFound(): EmailChangeError;
+    static accountDisabled(): EmailChangeError;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/email-change/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/auth/email-change/errors.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,wBAAwB,mHAO3B,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E,qBAAa,gBAAiB,SAAQ,KAAK;IAKzC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAEpC,OAAO;IAKP,MAAM,CAAC,YAAY,IAAI,gBAAgB;IAIvC,MAAM,CAAC,YAAY,IAAI,gBAAgB;IAIvC,MAAM,CAAC,YAAY,IAAI,gBAAgB;IAIvC,MAAM,CAAC,UAAU,IAAI,gBAAgB;IAIrC,MAAM,CAAC,YAAY,IAAI,gBAAgB;IAIvC,MAAM,CAAC,eAAe,IAAI,gBAAgB;CAG3C"}

package/dist/auth/email-change/errors.js

@@ -0,0 +1,45 @@
+// Typed errors for the email-change flow. Mirrors the magic-link
+// pattern: each error code maps to a stable string the verify route
+// surfaces in the redirect query and the admin's login screen renders
+// as actionable copy.
+//
+// Single source of truth: the runtime tuple drives both the type
+// union and any drift-detection unit test that wants to assert every
+// code is mapped in admin's `email-change-errors.ts`.
+export const EMAIL_CHANGE_ERROR_CODES = [
+    "missing_token",
+    "token_invalid",
+    "token_expired",
+    "email_taken",
+    "user_not_found",
+    "account_disabled",
+];
+export class EmailChangeError extends Error {
+    static {
+        EmailChangeError.prototype.name = "EmailChangeError";
+    }
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+    static missingToken() {
+        return new EmailChangeError("missing_token", "missing_token");
+    }
+    static tokenInvalid() {
+        return new EmailChangeError("token_invalid", "token_invalid");
+    }
+    static tokenExpired() {
+        return new EmailChangeError("token_expired", "token_expired");
+    }
+    static emailTaken() {
+        return new EmailChangeError("email_taken", "email_taken");
+    }
+    static userNotFound() {
+        return new EmailChangeError("user_not_found", "user_not_found");
+    }
+    static accountDisabled() {
+        return new EmailChangeError("account_disabled", "account_disabled");
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/email-change/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/auth/email-change/errors.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,oEAAoE;AACpE,sEAAsE;AACtE,sBAAsB;AACtB,EAAE;AACF,iEAAiE;AACjE,qEAAqE;AACrE,sDAAsD;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,eAAe;IACf,eAAe;IACf,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,kBAAkB;CACV,CAAC;AAIX,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC;QACE,gBAAgB,CAAC,SAAS,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACvD,CAAC;IAEQ,IAAI,CAAuB;IAEpC,YAAoB,IAA0B,EAAE,OAAe;QAC7D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,gBAAgB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,gBAAgB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,gBAAgB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,UAAU;QACf,OAAO,IAAI,gBAAgB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,eAAe;QACpB,OAAO,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IACtE,CAAC;CACF"}

package/dist/auth/email-change/index.d.ts

@@ -0,0 +1,5 @@
+export { cancelEmailChange } from "./cancel.js";
+export { EMAIL_CHANGE_ERROR_CODES, EmailChangeError, type EmailChangeErrorCode, } from "./errors.js";
+export { requestEmailChange, type RequestEmailChangeInput, type RequestEmailChangeResult, } from "./request.js";
+export { verifyEmailChange, type VerifyEmailChangeResult } from "./verify.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/email-change/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/email-change/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/auth/email-change/index.js

@@ -0,0 +1,5 @@
+export { cancelEmailChange } from "./cancel.js";
+export { EMAIL_CHANGE_ERROR_CODES, EmailChangeError, } from "./errors.js";
+export { requestEmailChange, } from "./request.js";
+export { verifyEmailChange } from "./verify.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/email-change/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/email-change/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GAEjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,GAGnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAgC,MAAM,aAAa,CAAC"}

package/dist/auth/email-change/request.d.ts

@@ -0,0 +1,55 @@
+import type { Db, Logger } from "../../context/app.js";
+import type { User } from "../../db/schema/users.js";
+import type { Mailer } from "../mailer/types.js";
+export interface RequestEmailChangeInput {
+    /** The user whose email is changing. Self or admin-driven. */
+    readonly userId: number;
+    /** The new email to verify. Already lowercase + valibot-trimmed by the caller. */
+    readonly newEmail: string;
+    /** `${origin}/_plumix/auth/verify-email?token=…` for the recipient. */
+    readonly origin: string;
+    readonly mailer: Mailer;
+    readonly siteName: string;
+    readonly ttlSeconds?: number;
+    /**
+     * Locale for the email body. Post-auth flow: caller passes
+     * `user.meta.locale`. Falls back to English when omitted or unknown.
+     * See `auth/email/messages.ts`.
+     */
+    readonly locale?: string;
+    /**
+     * Optional logger for swallowed mailer errors. Same rationale as
+     * magic-link: never throw out of the request — the verification
+     * outcome is async — but log so a broken transport is operator-
+     * visible.
+     */
+    readonly logger?: Pick<Logger, "warn">;
+}
+export interface RequestEmailChangeResult {
+    /** The user row read at request time, used by the caller for the hook payload. */
+    readonly user: User;
+    /** Server-side only; the token surfaces to the user via email. */
+    readonly token: string;
+    readonly expiresAt: Date;
+}
+/**
+ * Persist a pending email-change verification + send the confirmation
+ * mail to the *new* address. Mirrors WordPress's
+ * `send_confirmation_on_profile_email()` but harder:
+ *
+ *   - Token is hashed at rest (WP stores plaintext in user_meta).
+ *   - Single in-flight request per user — older pending tokens are
+ *     deleted before the new one lands. Avoids "I clicked the wrong
+ *     link" confusion when the user requests twice.
+ *   - Pre-checks email uniqueness so we don't bother mailing a doomed
+ *     verification. The DB unique constraint is the authoritative
+ *     guard at commit time (see verify.ts).
+ *
+ * The verify route resolves the user via the token's `userId`, so a
+ * stolen request token without the matching user is harmless. Sessions
+ * are NOT invalidated here — they're invalidated at the verify step,
+ * after the email actually changes (cancelling on the *request* would
+ * make the cancel button a footgun).
+ */
+export declare function requestEmailChange(db: Db, input: RequestEmailChangeInput): Promise<RequestEmailChangeResult>;
+//# sourceMappingURL=request.d.ts.map

package/dist/auth/email-change/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../src/auth/email-change/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAejD,MAAM,WAAW,uBAAuB;IACtC,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,wBAAwB;IACvC,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAqEnC"}

package/dist/auth/email-change/request.js

@@ -0,0 +1,93 @@
+import { and, eq, ne } from "../../db/index.js";
+import { authTokens } from "../../db/schema/auth_tokens.js";
+import { users } from "../../db/schema/users.js";
+import { emailStringsFor } from "../email/messages.js";
+import { generateToken, hashToken } from "../tokens.js";
+import { EmailChangeError } from "./errors.js";
+// 24-hour TTL — the link goes to the user's *new* mailbox, which they
+// may need a few hours to access (corporate inboxes, password managers,
+// MX delays, etc.). Magic-link uses 15 minutes because that's a sign-in
+// where the user is at-keyboard waiting for the email; an email change
+// is async — the human submits, lives life, opens the email later.
+const EMAIL_CHANGE_TTL_SECONDS = 24 * 60 * 60;
+/**
+ * Persist a pending email-change verification + send the confirmation
+ * mail to the *new* address. Mirrors WordPress's
+ * `send_confirmation_on_profile_email()` but harder:
+ *
+ *   - Token is hashed at rest (WP stores plaintext in user_meta).
+ *   - Single in-flight request per user — older pending tokens are
+ *     deleted before the new one lands. Avoids "I clicked the wrong
+ *     link" confusion when the user requests twice.
+ *   - Pre-checks email uniqueness so we don't bother mailing a doomed
+ *     verification. The DB unique constraint is the authoritative
+ *     guard at commit time (see verify.ts).
+ *
+ * The verify route resolves the user via the token's `userId`, so a
+ * stolen request token without the matching user is harmless. Sessions
+ * are NOT invalidated here — they're invalidated at the verify step,
+ * after the email actually changes (cancelling on the *request* would
+ * make the cancel button a footgun).
+ */
+export async function requestEmailChange(db, input) {
+    const newEmail = input.newEmail.trim().toLowerCase();
+    const ttlSeconds = input.ttlSeconds ?? EMAIL_CHANGE_TTL_SECONDS;
+    const user = await db.query.users.findFirst({
+        where: eq(users.id, input.userId),
+    });
+    if (!user)
+        throw EmailChangeError.userNotFound();
+    if (user.disabledAt)
+        throw EmailChangeError.accountDisabled();
+    // Pre-check uniqueness against any *other* user's email. Same-self
+    // re-request (newEmail === current) is rejected as `email_taken`
+    // for symmetry — there's nothing to verify.
+    if (newEmail === user.email) {
+        throw EmailChangeError.emailTaken();
+    }
+    const collision = await db.query.users.findFirst({
+        where: and(eq(users.email, newEmail), ne(users.id, user.id)),
+    });
+    if (collision)
+        throw EmailChangeError.emailTaken();
+    // Single in-flight request per user — purge any prior pending
+    // change before issuing the new one. Caller's previous link
+    // becomes invalid.
+    await db
+        .delete(authTokens)
+        .where(and(eq(authTokens.type, "email_verification"), eq(authTokens.userId, user.id)));
+    const token = generateToken();
+    const hash = await hashToken(token);
+    const expiresAt = new Date(Date.now() + ttlSeconds * 1000);
+    await db.insert(authTokens).values({
+        hash,
+        userId: user.id,
+        email: newEmail,
+        type: "email_verification",
+        expiresAt,
+    });
+    const verifyUrl = new URL("/_plumix/auth/verify-email", input.origin);
+    verifyUrl.searchParams.set("token", token);
+    try {
+        const strings = emailStringsFor(input.locale);
+        await input.mailer.send({
+            to: newEmail,
+            subject: strings.emailChange.subject(input.siteName),
+            text: strings.emailChange.body({
+                siteName: input.siteName,
+                oldEmail: user.email,
+                newEmail,
+                url: verifyUrl.toString(),
+                ttlSeconds,
+            }),
+        });
+    }
+    catch (error) {
+        // Don't leak transport failures to the caller — the request still
+        // succeeded persistence-wise. The user can re-request if the email
+        // never arrives. Log so operators see broken-mail-config failures.
+        input.logger?.warn("email_change_mailer_failed", { error });
+    }
+    return { user, token, expiresAt };
+}
+//# sourceMappingURL=request.js.map

package/dist/auth/email-change/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../src/auth/email-change/request.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAmC9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,KAA8B;IAE9B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,wBAAwB,CAAC;IAEhE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QAC1C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI;QAAE,MAAM,gBAAgB,CAAC,YAAY,EAAE,CAAC;IACjD,IAAI,IAAI,CAAC,UAAU;QAAE,MAAM,gBAAgB,CAAC,eAAe,EAAE,CAAC;IAE9D,mEAAmE;IACnE,iEAAiE;IACjE,4CAA4C;IAC5C,IAAI,QAAQ,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/C,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;KAC7D,CAAC,CAAC;IACH,IAAI,SAAS;QAAE,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC;IAEnD,8DAA8D;IAC9D,4DAA4D;IAC5D,mBAAmB;IACnB,MAAM,EAAE;SACL,MAAM,CAAC,UAAU,CAAC;SAClB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,oBAAoB,CAAC,EACzC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAC/B,CACF,CAAC;IAEJ,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;IAE3D,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;QACjC,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,oBAAoB;QAC1B,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,4BAA4B,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;YACtB,EAAE,EAAE,QAAQ;YACZ,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YACpD,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;gBAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,IAAI,CAAC,KAAK;gBACpB,QAAQ;gBACR,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE;gBACzB,UAAU;aACX,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC"}

package/dist/auth/email-change/routes.d.ts

@@ -0,0 +1,17 @@
+import type { AppContext } from "../../context/app.js";
+import type { PlumixApp } from "../../runtime/app.js";
+/**
+ * GET `/_plumix/auth/verify-email?token=…`
+ *
+ * Top-level navigation from the user's email client. Consumes the
+ * single-use email-change token, atomically commits the new email
+ * + resets `emailVerifiedAt`, invalidates every session for the
+ * affected user, and redirects to `/admin` (the user re-auths via
+ * passkey / magic-link / OAuth using the new email).
+ *
+ * Errors redirect to `/admin/login` with a typed
+ * `email_change_error=<code>` so the login screen can render
+ * actionable copy.
+ */
+export declare function handleEmailChangeVerify(ctx: AppContext, _app: PlumixApp): Promise<Response>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/auth/email-change/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/auth/email-change/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AActD;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,QAAQ,CAAC,CAqCnB"}

package/dist/auth/email-change/routes.js

@@ -0,0 +1,63 @@
+import { withBasePath } from "../../base-path.js";
+import { loginErrorRedirect, redirectTo } from "../../runtime/http.js";
+import { EmailChangeError } from "./errors.js";
+import { verifyEmailChange } from "./verify.js";
+const LOGIN_PATH = "/_plumix/admin/login";
+// Defensive bound on the inbound `token` query param. Same shape
+// as magic-link's verify route — protects against pathological
+// query strings.
+const MAX_TOKEN_LENGTH = 256;
+/**
+ * GET `/_plumix/auth/verify-email?token=…`
+ *
+ * Top-level navigation from the user's email client. Consumes the
+ * single-use email-change token, atomically commits the new email
+ * + resets `emailVerifiedAt`, invalidates every session for the
+ * affected user, and redirects to `/admin` (the user re-auths via
+ * passkey / magic-link / OAuth using the new email).
+ *
+ * Errors redirect to `/admin/login` with a typed
+ * `email_change_error=<code>` so the login screen can render
+ * actionable copy.
+ */
+export async function handleEmailChangeVerify(ctx, _app) {
+    const url = new URL(ctx.request.url);
+    const token = url.searchParams.get("token");
+    if (!token)
+        return loginError(ctx.basePath, "missing_token");
+    if (token.length > MAX_TOKEN_LENGTH)
+        return loginError(ctx.basePath, "token_invalid");
+    let result;
+    try {
+        result = await verifyEmailChange(ctx.db, token);
+    }
+    catch (error) {
+        if (error instanceof EmailChangeError) {
+            ctx.logger.warn("email_change_verify_rejected", { code: error.code });
+            return loginError(ctx.basePath, error.code);
+        }
+        ctx.logger.error("email_change_verify_failed", { error });
+        return loginError(ctx.basePath, "token_invalid");
+    }
+    // The change is COMMITTED at this point — email + emailVerifiedAt
+    // are written, sessions are invalidated, the token is consumed.
+    // A throwing audit-log subscriber must NOT make us redirect to
+    // `?email_change_error=…`: the user would type the old email on
+    // the login screen while the row already moved. Log the hook
+    // failure server-side and report success regardless. Same shape
+    // applies to any "hook fires after a committed write" surface;
+    // observers can record the outcome but can't fake it.
+    try {
+        await ctx.hooks.doAction("user:email_changed", result.user, {
+            previousEmail: result.previousEmail,
+        });
+    }
+    catch (error) {
+        ctx.logger.error("email_change_hook_failed", { error });
+    }
+    return redirectTo(`${withBasePath(LOGIN_PATH, ctx.basePath)}?email_change_success=1`);
+}
+function loginError(basePath, code) {
+    return loginErrorRedirect(withBasePath(LOGIN_PATH, basePath), "email_change_error", code);
+}
+//# sourceMappingURL=routes.js.map

package/dist/auth/email-change/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/auth/email-change/routes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAE1C,iEAAiE;AACjE,+DAA+D;AAC/D,iBAAiB;AACjB,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAe,EACf,IAAe;IAEf,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;QACjC,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEnD,IAAI,MAAqD,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACtE,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACnD,CAAC;IAED,kEAAkE;IAClE,gEAAgE;IAChE,+DAA+D;IAC/D,gEAAgE;IAChE,6DAA6D;IAC7D,gEAAgE;IAChE,+DAA+D;IAC/D,sDAAsD;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,EAAE;YAC1D,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,UAAU,CACf,GAAG,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CACnE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB,EAAE,IAA0B;IAC9D,OAAO,kBAAkB,CACvB,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,EAClC,oBAAoB,EACpB,IAAI,CACL,CAAC;AACJ,CAAC"}

package/dist/auth/email-change/verify.d.ts

@@ -0,0 +1,30 @@
+import type { Db } from "../../context/app.js";
+import type { User } from "../../db/schema/users.js";
+export interface VerifyEmailChangeResult {
+    /** The user row post-commit (new email, fresh `emailVerifiedAt`). */
+    readonly user: User;
+    /** What the email used to be — passed through to the `user:email_changed` hook. */
+    readonly previousEmail: string;
+}
+/**
+ * Consume an email-change verification token and commit the change
+ * atomically. Mirrors `verifyMagicLink`'s atomic compare-and-delete
+ * shape — a concurrent second click can't double-commit.
+ *
+ * On success:
+ *   - users.email = the row's stored newEmail
+ *   - users.emailVerifiedAt = now (the click is the verification)
+ *   - all sessions for the user are invalidated (security: an
+ *     attacker holding a hijacked session that triggered the change
+ *     loses access at commit time)
+ *   - the verification token row is gone
+ *
+ * Errors:
+ *   - `token_invalid` — unknown token, wrong type, or already consumed
+ *   - `token_expired` — past TTL
+ *   - `email_taken` — racey commit, the new email got taken between
+ *     request-time pre-check and now (DB unique-constraint)
+ *   - `account_disabled` — user was disabled after request was issued
+ */
+export declare function verifyEmailChange(db: Db, rawToken: string): Promise<VerifyEmailChangeResult>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/auth/email-change/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/auth/email-change/verify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAQrD,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,mFAAmF;IACnF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,uBAAuB,CAAC,CAyDlC"}

package/dist/auth/email-change/verify.js

@@ -0,0 +1,81 @@
+import { and, eq, isNull, isUniqueConstraintError } from "../../db/index.js";
+import { authTokens } from "../../db/schema/auth_tokens.js";
+import { sessions } from "../../db/schema/sessions.js";
+import { users } from "../../db/schema/users.js";
+import { hashToken } from "../tokens.js";
+import { EmailChangeError } from "./errors.js";
+/**
+ * Consume an email-change verification token and commit the change
+ * atomically. Mirrors `verifyMagicLink`'s atomic compare-and-delete
+ * shape — a concurrent second click can't double-commit.
+ *
+ * On success:
+ *   - users.email = the row's stored newEmail
+ *   - users.emailVerifiedAt = now (the click is the verification)
+ *   - all sessions for the user are invalidated (security: an
+ *     attacker holding a hijacked session that triggered the change
+ *     loses access at commit time)
+ *   - the verification token row is gone
+ *
+ * Errors:
+ *   - `token_invalid` — unknown token, wrong type, or already consumed
+ *   - `token_expired` — past TTL
+ *   - `email_taken` — racey commit, the new email got taken between
+ *     request-time pre-check and now (DB unique-constraint)
+ *   - `account_disabled` — user was disabled after request was issued
+ */
+export async function verifyEmailChange(db, rawToken) {
+    const hash = await hashToken(rawToken);
+    const [tokenRow] = await db
+        .delete(authTokens)
+        .where(and(eq(authTokens.hash, hash), eq(authTokens.type, "email_verification")))
+        .returning();
+    if (!tokenRow)
+        throw EmailChangeError.tokenInvalid();
+    if (tokenRow.expiresAt.getTime() < Date.now()) {
+        throw EmailChangeError.tokenExpired();
+    }
+    if (tokenRow.userId === null || tokenRow.email === null) {
+        // Defensive: every email_verification row written by
+        // `requestEmailChange` sets both. A null here means hand-rolled
+        // DB state.
+        throw EmailChangeError.tokenInvalid();
+    }
+    // Look up the previous email for the hook payload. The atomic
+    // commit guard is on the UPDATE itself, not this read — see below.
+    const target = await db.query.users.findFirst({
+        where: eq(users.id, tokenRow.userId),
+    });
+    if (!target)
+        throw EmailChangeError.userNotFound();
+    let updated;
+    try {
+        // Atomic guard: pin `disabledAt IS NULL` into the WHERE clause so
+        // an admin disabling the account between the read and the write
+        // can't slip a commit through. Zero rows updated → either the
+        // user vanished or got disabled mid-flight; both surface as
+        // `account_disabled` (no point distinguishing — the token is
+        // already consumed and the response is "you can't do this").
+        const [row] = await db
+            .update(users)
+            .set({ email: tokenRow.email, emailVerifiedAt: new Date() })
+            .where(and(eq(users.id, target.id), isNull(users.disabledAt)))
+            .returning();
+        if (!row)
+            throw EmailChangeError.accountDisabled();
+        updated = row;
+    }
+    catch (error) {
+        if (isUniqueConstraintError(error)) {
+            throw EmailChangeError.emailTaken();
+        }
+        throw error;
+    }
+    // Invalidate every session for this user — the new email is now
+    // canonical, any cached AuthenticatedUser carries the stale email.
+    // Forces every device to re-authenticate; magic-link / OAuth flows
+    // resolve to the new email automatically.
+    await db.delete(sessions).where(eq(sessions.userId, target.id));
+    return { user: updated, previousEmail: target.email };
+}
+//# sourceMappingURL=verify.js.map

package/dist/auth/email-change/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/auth/email-change/verify.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAS/C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAM,EACN,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEvC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC,UAAU,CAAC;SAClB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAC1E;SACA,SAAS,EAAE,CAAC;IAEf,IAAI,CAAC,QAAQ;QAAE,MAAM,gBAAgB,CAAC,YAAY,EAAE,CAAC;IACrD,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC9C,MAAM,gBAAgB,CAAC,YAAY,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACxD,qDAAqD;QACrD,gEAAgE;QAChE,YAAY;QACZ,MAAM,gBAAgB,CAAC,YAAY,EAAE,CAAC;IACxC,CAAC;IAED,8DAA8D;IAC9D,mEAAmE;IACnE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QAC5C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC;KACrC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,MAAM,gBAAgB,CAAC,YAAY,EAAE,CAAC;IAEnD,IAAI,OAAa,CAAC;IAClB,IAAI,CAAC;QACH,kEAAkE;QAClE,gEAAgE;QAChE,8DAA8D;QAC9D,4DAA4D;QAC5D,6DAA6D;QAC7D,6DAA6D;QAC7D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC3D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;aAC7D,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,GAAG;YAAE,MAAM,gBAAgB,CAAC,eAAe,EAAE,CAAC;QACnD,OAAO,GAAG,GAAG,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC;QACtC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,gEAAgE;IAChE,mEAAmE;IACnE,mEAAmE;IACnE,0CAA0C;IAC1C,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAEhE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxD,CAAC"}

package/dist/auth/flow-routes.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Aggregates every auth-flow route handler (passkey, invite, magic-link,
+ * device-flow, OAuth, email-change) into one chunk the dispatcher loads via a
+ * single memoized dynamic import — see `loadAuthFlowRoutes` for why.
+ *
+ * `parseOAuthPath` is deliberately NOT re-exported here: the dispatcher matches
+ * OAuth paths eagerly from `./oauth/match.js`, and re-exporting it would drag
+ * the heavy handler graph back onto the eager path.
+ */
+export { handleInviteRegisterOptions, handleInviteRegisterVerify, handlePasskeyLoginOptions, handlePasskeyLoginVerify, handlePasskeyRegisterOptions, handlePasskeyRegisterVerify, handleSignout, } from "./passkey/routes.js";
+export { handleMagicLinkRequest, handleMagicLinkVerify, } from "./magic-link/routes.js";
+export { handleDeviceCodeRequest, handleDeviceTokenExchange, } from "./device-flow-routes.js";
+export { handleOAuthCallback, handleOAuthStart } from "./oauth/routes.js";
+export { handleEmailChangeVerify } from "./email-change/routes.js";
+//# sourceMappingURL=flow-routes.d.ts.map

package/dist/auth/flow-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-routes.d.ts","sourceRoot":"","sources":["../../src/auth/flow-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,EAC3B,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC"}