internal/

Package account holds what every account-creating and sign-in flow of the identity module shares: creating an account with its identities, the registration event and audit, the login audit, the account state check and the session a sign-in ends with.

Package adminuser implements the admin-side account management subdomain of the identity module: user CRUD, auth methods, devices and login logs.

Package authmethodadmin implements the admin-side authentication-method subdomain of the identity module: method configuration, sender platforms and test sends.

Package authn implements the authentication subdomain of the identity module: account existence checks, password, code and device sign-in, registration, password resets and, through its oauth subpackage, OAuth sign-in.

Package devicestate owns consistent device removal shared by user and admin entry points.

Package guestaccount owns the account-creation stage of paid guest orders.

Package identitytest runs the identity module's real repositories over an in-memory SQLite database and miniredis, for behaviour tests that check what a flow wrote rather than which dependency it called.

Package oauthflow runs the provider round trip OAuth sign-in and account binding share: the authorization URL with its state, and the callback that redeems the state and turns into the identity the provider vouches for.

Package oauthprovider defines the OAuth sign-in methods: a Provider builds the authorization URL of one method and turns its callback into the identity the provider vouches for.

Package oauthstate owns the OAuth state round trip: the state issued with an authorization URL, stored with the redirect and the purpose it belongs to, and redeemed once by the callback of that purpose.

Package profile implements the self-service identity subdomain of the identity module: account info, credentials, third-party bindings, devices and notification preferences.

Package repo holds the identity module's repository implementations: the user account rows, auth methods, devices and the cross-domain cache facade (ADR-001 step-6 preparation).

Package startup implements the identity module's part of the server start: seeding the first administrator of a fresh database, finding the administrators still signing in with a published default password, and the check and data fix-up that run once the schema is current.

Package verification stores and checks the email and SMS verification codes of the identity module in Redis: the code of one identifier and purpose, and the guesses made against it.

Package verifycode implements the verification-code subdomain of the identity module: issuing and pre-checking the email and SMS codes that gate registration and account mutations.