Creates a passwordless user with an email identity (used by magic-link / email-OTP request flows).

Creates a user from email + password sign-up attributes.

Creates a passwordless user with a phone identity (used by SMS OTP request flow).

Returns the user and verified email identity, creating a passwordless user when none exists.

Returns the user and verified phone identity, creating a passwordless user when none exists.

Generates a session token for the user.

Fetches the user for a valid session token.

Fetches a verified identity by type and value, returning the user it belongs to alongside.

Issues an identity verification token and dispatches it through the configured sender.

Issues an :email verification for the given identity.

Issues a recovery code and dispatches it via the configured sender.

Returns :ok even when the email is unknown, so callers cannot probe for account existence.

Revokes a single session token.

Revokes all session tokens for a user.

Updates the user's profile fields (name, username, metadata).

Verifies a short magic-code and consumes it.

The code is the human-typeable secret sent out-of-band (recovery email, SMS OTP). Because the code's entropy is low, the lookup is value-scoped to the identity it was issued for.

Verifies a magic-link token and consumes it.

The token is the long random secret embedded in a URL. Used by :email identity verification (post-signup confirm and magic-link sign-in) and similar link-style flows.