@rexezuge/identity 0.0.0-stage → 1.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rexezuge
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/ResolvedAccount.d.ts

@@ -0,0 +1,68 @@
+/**
+ * `users` rows — the stored form of an account.
+ *
+ * Converged from `backend-data/src/dao/UserDAO.ts` + its `UserRow` (identical in
+ * six of the seven identity-carrying repos; AWS and ChordDHT keep only the
+ * id/email core).
+ *
+ * `id` is the stable account key. `email` is the *anchor*: an immutable value
+ * that legacy `*_email` foreign keys resolve against, so history stays
+ * resolvable across an address change. `current_email` is the address the
+ * account signs in with and the one APIs report.
+ */
+export interface UserRow {
+    id?: string | null;
+    /**
+     * The frozen anchor address. Never updated — it is the foreign-key target
+     * every legacy `*_email` value resolves against, and rewriting it would
+     * cascade the rows that reference it. Read `current_email` for sign-in.
+     */
+    email: string;
+    /**
+     * Mutable sign-in address. Absent on a pre-identity database, where `email`
+     * *is* the sign-in address; read it as `current_email ?? email`.
+     */
+    current_email?: string | null;
+    created_at: number;
+    username: string | null;
+    updated_at: number | null;
+}
+/**
+ * A resolved account.
+ *
+ * `id` is the only value that should be used as an identity. `email` is the
+ * address the account currently signs in with; `anchorEmail` is the immutable
+ * value legacy columns store, and is what a pre-identity row can still be
+ * matched on.
+ */
+export interface ResolvedAccount {
+    id: string;
+    email: string;
+    anchorEmail: string;
+    username: string | null;
+}
+/** The denormalized subset routes and the permission path use. */
+export type AccountSummary = Pick<ResolvedAccount, 'id' | 'email' | 'username'>;
+/** Shape every `users` read has, whether or not the identity migration has run. */
+export type UserRowLike = Pick<UserRow, 'id' | 'email' | 'current_email' | 'username'> | undefined;
+/** Project a `users` row onto a `ResolvedAccount`. */
+export declare function summarize(row: UserRowLike): ResolvedAccount | null;
+/**
+ * The opaque account id.
+ *
+ * Prefixed so an id is never mistaken for an address in a log line or a URL,
+ * and random at 128 bits so accounts are not enumerable.
+ */
+export declare function newAccountId(): string;
+/**
+ * Opaque anchor for an account whose login address is already held as another
+ * account's anchor.
+ *
+ * It must be globally unique and must never be a real address: `email` is the
+ * anchor every legacy `*_email` foreign key resolves against, so an address
+ * parked here could never be re-registered by a different person after its
+ * original account moved off it. `.invalid` is reserved by RFC 2606 and can
+ * never be delivered to, so it can never authenticate either.
+ */
+export declare function newAnchor(): string;
+//# sourceMappingURL=ResolvedAccount.d.ts.map

package/dist/ResolvedAccount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResolvedAccount.d.ts","sourceRoot":"","sources":["../src/ResolvedAccount.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,OAAO;IACtB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,kEAAkE;AAClE,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,OAAO,GAAG,UAAU,CAAC,CAAC;AAEhF,mFAAmF;AACnF,MAAM,MAAM,WAAW,GACnB,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,OAAO,GAAG,eAAe,GAAG,UAAU,CAAC,GAC5D,SAAS,CAAC;AAEd,sDAAsD;AACtD,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,eAAe,GAAG,IAAI,CAIlE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAElC"}

package/dist/ResolvedAccount.js

@@ -0,0 +1,30 @@
+import { randomUUID } from 'node:crypto';
+/** Project a `users` row onto a `ResolvedAccount`. */
+export function summarize(row) {
+    return row?.id
+        ? { id: row.id, email: (row.current_email ?? row.email).toLowerCase(), anchorEmail: row.email, username: row.username ?? null }
+        : null;
+}
+/**
+ * The opaque account id.
+ *
+ * Prefixed so an id is never mistaken for an address in a log line or a URL,
+ * and random at 128 bits so accounts are not enumerable.
+ */
+export function newAccountId() {
+    return `usr_${randomUUID().replaceAll('-', '')}`;
+}
+/**
+ * Opaque anchor for an account whose login address is already held as another
+ * account's anchor.
+ *
+ * It must be globally unique and must never be a real address: `email` is the
+ * anchor every legacy `*_email` foreign key resolves against, so an address
+ * parked here could never be re-registered by a different person after its
+ * original account moved off it. `.invalid` is reserved by RFC 2606 and can
+ * never be delivered to, so it can never authenticate either.
+ */
+export function newAnchor() {
+    return `anchor-${randomUUID().replaceAll('-', '')}@users.invalid`;
+}
+//# sourceMappingURL=ResolvedAccount.js.map

package/dist/ResolvedAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResolvedAccount.js","sourceRoot":"","sources":["../src/ResolvedAccount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuDzC,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,GAAgB;IACxC,OAAO,GAAG,EAAE,EAAE;QACZ,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI,EAAE;QAC/H,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,UAAU,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC;AACpE,CAAC"}

package/dist/UserDAO.d.ts

@@ -0,0 +1,88 @@
+import { BaseDAO } from '@rexezuge/d1';
+import type { D1Queryable } from '@rexezuge/d1';
+import type { UserRow } from './ResolvedAccount';
+/**
+ * The stored form of a handle: lowercase.
+ *
+ * Every username read and every username write goes through this, so the two
+ * can never disagree about case. That agreement is not cosmetic: `username` has
+ * no `COLLATE NOCASE` (SQLite defaults to BINARY), so a stored `Alice2` is a
+ * *different value* from `alice2` and a lookup that lowercased its parameter
+ * would never find it. Normalising at the write points rather than relying on
+ * each caller means a future caller cannot reintroduce an unfindable handle by
+ * forgetting.
+ */
+declare function normalizeUsername(username: string): string;
+/**
+ * `users` rows. Converged from `backend-data/src/dao/UserDAO.ts` (identical in
+ * Durable-DAV, Durable-DAV-Router, Edge-Git, Mail-Otter, Mail-Meow; AWS keeps
+ * the id/email core without the username methods).
+ *
+ * Case rule everywhere in this DAO: lowercase the *parameter*, never the
+ * column — `lower(col)` makes the index or primary key unusable. It is only
+ * sound because every writer stores lowercase through this DAO's own
+ * normalisers.
+ */
+export declare class UserDAO extends BaseDAO {
+    constructor(database: D1Queryable);
+    /**
+     * Create an account, stamped with the identity columns.
+     *
+     * `INSERT ... ON CONFLICT DO NOTHING` with **no conflict target**, deliberately.
+     * `users` carries two unique constraints — the anchor primary key and the
+     * unique index on `current_email` — and SQLite applies `DO NOTHING` only to
+     * the constraints a named target covers. Naming the anchor therefore left a
+     * `current_email` collision as a raised error, which callers cannot tell from
+     * a transient D1 failure: it propagated instead of returning `null`, so the
+     * opaque-anchor retry never ran and every login request answered 500.
+     *
+     * Returns the new account's id, or `null` when the insert was a silent no-op —
+     * which this DAO establishes by reading the anchor row back and requiring its
+     * own generated id to be the one there. The read-back lives here rather than
+     * in the caller because a caller that trusted the generated id on a taken
+     * anchor would point the address registry at a *phantom* account: the address
+     * then resolves to nothing, and the opaque-anchor retry fails the same way.
+     * Making the no-op detectable here is what keeps registration from stranding
+     * an address forever.
+     */
+    createUser(input: {
+        anchor: string;
+        loginEmail: string;
+        now: number;
+    }): Promise<string | null>;
+    /**
+     * @param idOrEmail The stable account key, or an anchor address as the
+     *   pre-identity fallback. `WHERE id = ? OR email = ?` cannot use either index
+     *   as a seek, so this stays off the hot path; login resolves through
+     *   `UserIdentityService` instead.
+     */
+    ensureUsername(idOrEmail: string, username: string, now: number): Promise<void>;
+    /** @param idOrEmail The stable account key, or an anchor address. */
+    setUsername(idOrEmail: string, username: string, now: number): Promise<void>;
+    /**
+     * Anchor lookup — used for legacy `*_email` values and cascade resolution.
+     *
+     * This is *not* a login lookup: an account that has changed its address is not
+     * findable here by its new one. It is the pre-identity floor and the
+     * attribution read.
+     */
+    getByEmail(email: string): Promise<UserRow | undefined>;
+    /** The account behind a stable key. Null on a pre-identity database. */
+    getById(id: string): Promise<UserRow | undefined>;
+    /** The account currently signing in with this address. Identity-era only. */
+    getByCurrentEmail(email: string): Promise<UserRow | undefined>;
+    /**
+     * Move an account's sign-in address.
+     *
+     * The anchor `email` is deliberately untouched: it is what every legacy
+     * `*_email` column and foreign key resolves against. Ordering matters — the
+     * caller claims the new address first and revokes the old one third, so a
+     * failure between steps never leaves the account without a way to sign in.
+     */
+    setCurrentEmail(id: string, email: string, now: number): Promise<void>;
+    /** Lookup by handle. */
+    getByUsernameCi(usernameCi: string): Promise<UserRow | undefined>;
+}
+export { normalizeUsername };
+export type { UserRow };
+//# sourceMappingURL=UserDAO.d.ts.map

package/dist/UserDAO.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserDAO.d.ts","sourceRoot":"","sources":["../src/UserDAO.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,iBAAS,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;;;;;GASG;AACH,qBAAa,OAAQ,SAAQ,OAAO;gBACf,QAAQ,EAAE,WAAW;IAIxC;;;;;;;;;;;;;;;;;;;OAmBG;IACU,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc3G;;;;;OAKG;IACU,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS5F,qEAAqE;IACxD,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASzF;;;;;;OAMG;IACU,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAIpE,wEAAwE;IAC3D,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAI9D,6EAA6E;IAChE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAI3E;;;;;;;OAOG;IACU,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInF,wBAAwB;IACX,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;CAG/E;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7B,YAAY,EAAE,OAAO,EAAE,CAAC"}

package/dist/UserDAO.js

@@ -0,0 +1,122 @@
+import { BaseDAO } from '@rexezuge/d1';
+import { newAccountId } from './ResolvedAccount';
+/**
+ * The stored form of a handle: lowercase.
+ *
+ * Every username read and every username write goes through this, so the two
+ * can never disagree about case. That agreement is not cosmetic: `username` has
+ * no `COLLATE NOCASE` (SQLite defaults to BINARY), so a stored `Alice2` is a
+ * *different value* from `alice2` and a lookup that lowercased its parameter
+ * would never find it. Normalising at the write points rather than relying on
+ * each caller means a future caller cannot reintroduce an unfindable handle by
+ * forgetting.
+ */
+function normalizeUsername(username) {
+    return username.trim().toLowerCase();
+}
+/**
+ * `users` rows. Converged from `backend-data/src/dao/UserDAO.ts` (identical in
+ * Durable-DAV, Durable-DAV-Router, Edge-Git, Mail-Otter, Mail-Meow; AWS keeps
+ * the id/email core without the username methods).
+ *
+ * Case rule everywhere in this DAO: lowercase the *parameter*, never the
+ * column — `lower(col)` makes the index or primary key unusable. It is only
+ * sound because every writer stores lowercase through this DAO's own
+ * normalisers.
+ */
+export class UserDAO extends BaseDAO {
+    constructor(database) {
+        super(database);
+    }
+    /**
+     * Create an account, stamped with the identity columns.
+     *
+     * `INSERT ... ON CONFLICT DO NOTHING` with **no conflict target**, deliberately.
+     * `users` carries two unique constraints — the anchor primary key and the
+     * unique index on `current_email` — and SQLite applies `DO NOTHING` only to
+     * the constraints a named target covers. Naming the anchor therefore left a
+     * `current_email` collision as a raised error, which callers cannot tell from
+     * a transient D1 failure: it propagated instead of returning `null`, so the
+     * opaque-anchor retry never ran and every login request answered 500.
+     *
+     * Returns the new account's id, or `null` when the insert was a silent no-op —
+     * which this DAO establishes by reading the anchor row back and requiring its
+     * own generated id to be the one there. The read-back lives here rather than
+     * in the caller because a caller that trusted the generated id on a taken
+     * anchor would point the address registry at a *phantom* account: the address
+     * then resolves to nothing, and the opaque-anchor retry fails the same way.
+     * Making the no-op detectable here is what keeps registration from stranding
+     * an address forever.
+     */
+    async createUser(input) {
+        const anchor = input.anchor.toLowerCase();
+        const loginEmail = input.loginEmail.toLowerCase();
+        const id = newAccountId();
+        await this.run('INSERT INTO users (email, created_at, id, current_email) VALUES (?, ?, ?, ?) ON CONFLICT DO NOTHING', [
+            anchor,
+            input.now,
+            id,
+            loginEmail,
+        ]);
+        const row = await this.getByEmail(anchor);
+        return row?.id === id ? id : null;
+    }
+    /**
+     * @param idOrEmail The stable account key, or an anchor address as the
+     *   pre-identity fallback. `WHERE id = ? OR email = ?` cannot use either index
+     *   as a seek, so this stays off the hot path; login resolves through
+     *   `UserIdentityService` instead.
+     */
+    async ensureUsername(idOrEmail, username, now) {
+        await this.run('UPDATE users SET username = COALESCE(username, ?), updated_at = COALESCE(updated_at, ?) WHERE id = ? OR email = ?', [
+            normalizeUsername(username),
+            now,
+            idOrEmail,
+            idOrEmail,
+        ]);
+    }
+    /** @param idOrEmail The stable account key, or an anchor address. */
+    async setUsername(idOrEmail, username, now) {
+        await this.run('UPDATE users SET username = ?, updated_at = ? WHERE id = ? OR email = ?', [
+            normalizeUsername(username),
+            now,
+            idOrEmail,
+            idOrEmail,
+        ]);
+    }
+    /**
+     * Anchor lookup — used for legacy `*_email` values and cascade resolution.
+     *
+     * This is *not* a login lookup: an account that has changed its address is not
+     * findable here by its new one. It is the pre-identity floor and the
+     * attribution read.
+     */
+    async getByEmail(email) {
+        return this.first('SELECT * FROM users WHERE email = ? LIMIT 1', [email.toLowerCase()]);
+    }
+    /** The account behind a stable key. Null on a pre-identity database. */
+    async getById(id) {
+        return this.first('SELECT * FROM users WHERE id = ? LIMIT 1', [id]);
+    }
+    /** The account currently signing in with this address. Identity-era only. */
+    async getByCurrentEmail(email) {
+        return this.first('SELECT * FROM users WHERE current_email = ? LIMIT 1', [email.toLowerCase()]);
+    }
+    /**
+     * Move an account's sign-in address.
+     *
+     * The anchor `email` is deliberately untouched: it is what every legacy
+     * `*_email` column and foreign key resolves against. Ordering matters — the
+     * caller claims the new address first and revokes the old one third, so a
+     * failure between steps never leaves the account without a way to sign in.
+     */
+    async setCurrentEmail(id, email, now) {
+        await this.run('UPDATE users SET current_email = ?, updated_at = ? WHERE id = ?', [email.toLowerCase(), now, id]);
+    }
+    /** Lookup by handle. */
+    async getByUsernameCi(usernameCi) {
+        return this.first('SELECT * FROM users WHERE username = ? LIMIT 1', [usernameCi.toLowerCase()]);
+    }
+}
+export { normalizeUsername };
+//# sourceMappingURL=UserDAO.js.map

package/dist/UserDAO.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserDAO.js","sourceRoot":"","sources":["../src/UserDAO.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,OAAQ,SAAQ,OAAO;IAClC,YAAmB,QAAqB;QACtC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACI,KAAK,CAAC,UAAU,CAAC,KAA0D;QAChF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,CAAC,GAAG,CAAC,qGAAqG,EAAE;YACpH,MAAM;YACN,KAAK,CAAC,GAAG;YACT,EAAE;YACF,UAAU;SACX,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,QAAgB,EAAE,GAAW;QAC1E,MAAM,IAAI,CAAC,GAAG,CAAC,mHAAmH,EAAE;YAClI,iBAAiB,CAAC,QAAQ,CAAC;YAC3B,GAAG;YACH,SAAS;YACT,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAC9D,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,QAAgB,EAAE,GAAW;QACvE,MAAM,IAAI,CAAC,GAAG,CAAC,yEAAyE,EAAE;YACxF,iBAAiB,CAAC,QAAQ,CAAC;YAC3B,GAAG;YACH,SAAS;YACT,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,UAAU,CAAC,KAAa;QACnC,OAAO,IAAI,CAAC,KAAK,CAAU,6CAA6C,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IAED,wEAAwE;IACjE,KAAK,CAAC,OAAO,CAAC,EAAU;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAU,0CAA0C,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,6EAA6E;IACtE,KAAK,CAAC,iBAAiB,CAAC,KAAa;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAU,qDAAqD,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,eAAe,CAAC,EAAU,EAAE,KAAa,EAAE,GAAW;QACjE,MAAM,IAAI,CAAC,GAAG,CAAC,iEAAiE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACpH,CAAC;IAED,wBAAwB;IACjB,KAAK,CAAC,eAAe,CAAC,UAAkB;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAU,gDAAgD,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3G,CAAC;CACF;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/UserEmailDAO.d.ts

@@ -0,0 +1,50 @@
+import { BaseDAO } from '@rexezuge/d1';
+import type { D1Queryable } from '@rexezuge/d1';
+/**
+ * One known address for an account.
+ *
+ * `is_verified` gates login: `1` means the address may authenticate the
+ * account, `0` means it was changed away from and is retained only so rows
+ * written before the change still resolve. A revoked row is re-pointed (not
+ * deleted) when a later account legitimately claims the address, so an address
+ * is never permanently reserved.
+ *
+ * Converged from `backend-data/src/dao/UserEmailDAO.ts` (identical in Durable-DAV,
+ * Durable-DAV-Router, Edge-Git, Mail-Otter).
+ */
+export interface UserEmailRow {
+    email: string;
+    user_id: string;
+    is_verified: number;
+    created_at: number;
+}
+export type EmailClaim = 'claimed' | 'already-claimed';
+export declare class UserEmailDAO extends BaseDAO {
+    constructor(database: D1Queryable);
+    /**
+     * Claim an address for an account.
+     *
+     * An existing verified row is left alone: the address already belongs to
+     * someone, and silently re-pointing it would hand one account's identity to
+     * another. Callers check `resolveVerified` first and reject on a hit.
+     * An unverified (revoked) row is re-pointed, which releases the address.
+     */
+    register(input: {
+        email: string;
+        userId: string;
+        isVerified: boolean;
+        now: number;
+    }): Promise<EmailClaim>;
+    get(email: string): Promise<UserEmailRow | undefined>;
+    /** Login resolution: only a verified address identifies an account. */
+    resolveVerified(email: string): Promise<UserEmailRow | undefined>;
+    listByUserId(userId: string): Promise<UserEmailRow[]>;
+    /** Revoke an address for login while keeping it resolvable for attribution. */
+    revoke(email: string): Promise<void>;
+    /**
+     * Revoke every verified address for an account. Used when an account's login
+     * address changes, so only the new address can authenticate it.
+     */
+    revokeAllVerified(userId: string, exceptEmail: string): Promise<void>;
+}
+//# sourceMappingURL=UserEmailDAO.d.ts.map

package/dist/UserEmailDAO.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserEmailDAO.d.ts","sourceRoot":"","sources":["../src/UserEmailDAO.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAEvD,qBAAa,YAAa,SAAQ,OAAO;gBACpB,QAAQ,EAAE,WAAW;IAIxC;;;;;;;OAOG;IACU,QAAQ,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAazG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAOlE,uEAAuE;IAC1D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAIjE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAIlE,+EAA+E;IAClE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD;;;OAGG;IACU,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGnF"}

package/dist/UserEmailDAO.js

@@ -0,0 +1,49 @@
+import { BaseDAO } from '@rexezuge/d1';
+export class UserEmailDAO extends BaseDAO {
+    constructor(database) {
+        super(database);
+    }
+    /**
+     * Claim an address for an account.
+     *
+     * An existing verified row is left alone: the address already belongs to
+     * someone, and silently re-pointing it would hand one account's identity to
+     * another. Callers check `resolveVerified` first and reject on a hit.
+     * An unverified (revoked) row is re-pointed, which releases the address.
+     */
+    async register(input) {
+        const email = input.email.toLowerCase();
+        const existing = await this.get(email);
+        if (existing && existing.is_verified === 1)
+            return 'already-claimed';
+        await this.run(`INSERT INTO user_emails (email, user_id, is_verified, created_at)
+       VALUES (?, ?, ?, ?)
+       ON CONFLICT(email) DO UPDATE SET user_id = excluded.user_id, is_verified = excluded.is_verified`, [email, input.userId, input.isVerified ? 1 : 0, input.now]);
+        return 'claimed';
+    }
+    async get(email) {
+        // Lowercase the *parameter*: the column is stored lowercased by every
+        // writer, so `lower(email) = ?` matched identically while making the
+        // primary key unusable.
+        return this.first('SELECT * FROM user_emails WHERE email = ? LIMIT 1', [email.toLowerCase()]);
+    }
+    /** Login resolution: only a verified address identifies an account. */
+    async resolveVerified(email) {
+        return this.first('SELECT * FROM user_emails WHERE email = ? AND is_verified = 1 LIMIT 1', [email.toLowerCase()]);
+    }
+    async listByUserId(userId) {
+        return this.all('SELECT * FROM user_emails WHERE user_id = ? ORDER BY is_verified DESC, created_at ASC', [userId]);
+    }
+    /** Revoke an address for login while keeping it resolvable for attribution. */
+    async revoke(email) {
+        await this.run('UPDATE user_emails SET is_verified = 0 WHERE email = ?', [email.toLowerCase()]);
+    }
+    /**
+     * Revoke every verified address for an account. Used when an account's login
+     * address changes, so only the new address can authenticate it.
+     */
+    async revokeAllVerified(userId, exceptEmail) {
+        await this.run('UPDATE user_emails SET is_verified = 0 WHERE user_id = ? AND email != ?', [userId, exceptEmail.toLowerCase()]);
+    }
+}
+//# sourceMappingURL=UserEmailDAO.js.map

package/dist/UserEmailDAO.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserEmailDAO.js","sourceRoot":"","sources":["../src/UserEmailDAO.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAwBvC,MAAM,OAAO,YAAa,SAAQ,OAAO;IACvC,YAAmB,QAAqB;QACtC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,QAAQ,CAAC,KAA0E;QAC9F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,KAAK,CAAC;YAAE,OAAO,iBAAiB,CAAC;QACrE,MAAM,IAAI,CAAC,GAAG,CACZ;;uGAEiG,EACjG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAC3D,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,KAAa;QAC5B,sEAAsE;QACtE,qEAAqE;QACrE,wBAAwB;QACxB,OAAO,IAAI,CAAC,KAAK,CAAe,mDAAmD,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9G,CAAC;IAED,uEAAuE;IAChE,KAAK,CAAC,eAAe,CAAC,KAAa;QACxC,OAAO,IAAI,CAAC,KAAK,CAAe,uEAAuE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAClI,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,MAAc;QACtC,OAAO,IAAI,CAAC,GAAG,CAAe,uFAAuF,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACnI,CAAC;IAED,+EAA+E;IACxE,KAAK,CAAC,MAAM,CAAC,KAAa;QAC/B,MAAM,IAAI,CAAC,GAAG,CAAC,wDAAwD,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,WAAmB;QAChE,MAAM,IAAI,CAAC,GAAG,CAAC,yEAAyE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjI,CAAC;CACF"}

package/dist/UserIdentityService.d.ts

@@ -0,0 +1,91 @@
+import type { D1Queryable } from '@rexezuge/d1';
+import type { AccountLookupDeps } from './accountLookup';
+import type { ResolvedAccount } from './ResolvedAccount';
+interface UserIdentityEnv {
+    DB: D1Queryable;
+}
+export type { UserIdentityEnv };
+/**
+ * Injected DAO factories. All optional: each defaults to a real DAO over the
+ * same D1 binding, so tests override only what they need.
+ */
+export type UserIdentityDeps = Partial<AccountLookupDeps>;
+/**
+ * The account behind an address, plus the address-change operations.
+ *
+ * Converged from `backend-services/src/identity/UserIdentityService.ts`
+ * (identical in Durable-DAV, Durable-DAV-Router, Edge-Git, Mail-Otter; AWS and
+ * Mail-Meow keep the resolve core). Canonical names merge the two spellings the
+ * repos used — `resolveUserById` (Durable-DAV family) and
+ * `resolveAccountById` (AWS) are one method, `resolveAccountById`.
+ *
+ * The instance is one per request scope: the ownership and permission paths
+ * resolve the same caller several times each, and a per-instance address memo
+ * costs one query per request rather than one per comparison. Bind it once in
+ * the composition root and share it — constructing per consumer is the bug the
+ * memo exists to prevent.
+ *
+ * Resolution itself lives in `accountLookup` (free functions, shared with any
+ * account bootstrap); this class adds memoization and the change operations.
+ */
+export declare class UserIdentityService {
+    private readonly deps;
+    private readonly byEmail;
+    constructor(env: UserIdentityEnv, deps?: UserIdentityDeps);
+    /**
+     * Resolve a sign-in address to its account, or null when unknown.
+     *
+     * Only a verified address resolves. A revoked address (changed away from) is
+     * retained so pre-change rows stay attributable, but it must never
+     * authenticate, otherwise a reassigned address would inherit the previous
+     * holder's account.
+     */
+    resolveAccount(email: string): Promise<ResolvedAccount | null>;
+    /** Account id for a sign-in address, or null when unknown. */
+    resolveAccountId(email: string): Promise<string | null>;
+    /**
+     * Account behind a stable key. The inverse direction, for a caller that
+     * already holds one (a resource owner) and needs the current address.
+     */
+    resolveAccountById(userId: string): Promise<ResolvedAccount | null>;
+    /**
+     * Resolve-or-create, for a login path that may see a first-time user.
+     *
+     * Returns null when the address exists but cannot be resolved (a revoked
+     * address) — a caller that needs "guaranteed account" must distinguish that
+     * from "created now" through its own route, because silently registering on a
+     * revoked address would hand the previous holder's history to the new one.
+     */
+    resolveOrRegister(email: string, now?: number): Promise<ResolvedAccount | null>;
+    /**
+     * Every address known for an account, verified ones first.
+     */
+    listAddresses(userId: string): Promise<Array<{
+        email: string;
+        isVerified: boolean;
+    }>>;
+    /**
+     * Point an account at a new sign-in address.
+     *
+     * The account id, the frozen anchor, and every id-keyed row are untouched:
+     * only which address authenticates the account moves. The previous address is
+     * revoked rather than deleted, so rows written before the change still resolve
+     * to this account, and it is released for a later legitimate holder.
+     *
+     * Rejects an address already verified for another account. That check is the
+     * whole reason this is not simply an `UPDATE`: an unverified change would let
+     * anyone claim an address and inherit its history.
+     *
+     * Order is load-bearing, and it is the one the ops CLI (`change-email.ts`)
+     * already gets right: claim first, move `current_email` second, revoke third.
+     * Inverting it opens a window in which nothing authenticates if a later step
+     * fails.
+     */
+    setPrimaryEmail(userId: string, newEmail: string, now?: number): Promise<ResolvedAccount>;
+    /**
+     * Ops/migration path: attach an address that has already been proven, without
+     * making it the sign-in address.
+     */
+    linkVerifiedEmail(userId: string, email: string, now?: number): Promise<void>;
+}
+//# sourceMappingURL=UserIdentityService.d.ts.map

package/dist/UserIdentityService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserIdentityService.d.ts","sourceRoot":"","sources":["../src/UserIdentityService.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIzD,UAAU,eAAe;IACvB,EAAE,EAAE,WAAW,CAAC;CACjB;AAED,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IAEnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6C;gBAElD,GAAG,EAAE,eAAe,EAAE,IAAI,GAAE,gBAAqB;IAQpE;;;;;;;OAOG;IACU,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAS3E,8DAA8D;IACjD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKpE;;;OAGG;IACU,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAMhF;;;;;;;OAOG;IACU,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAmD,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAYtI;;OAEG;IACU,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAMlG;;;;;;;;;;;;;;;;OAgBG;IACU,eAAe,CAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,SAAmD,GACrD,OAAO,CAAC,eAAe,CAAC;IAsB3B;;;OAGG;IACU,iBAAiB,CAC5B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,GAAG,SAAmD,GACrD,OAAO,CAAC,IAAI,CAAC;CAOjB"}