Module account 

Account system for Eidetica.

Provides AccountSession access with per-account key storage, database tracking, and sync preferences.

An Account is the private root database of a person, group or app, reached through AccountSession::account. Its root ID is distinct from the instance-local login UUID. Applications store and open direct database references through the session (AccountSession::set_reference, AccountSession::open_reference); there is no mandatory catalog.

Credentials, key mappings and activation preferences are installation-local; Account Entries carry references and public Auth. Enrollment remains separate.

Architecture

• Instance: Manages infrastructure (local login records, system databases, backends)
• AccountSession: Handles contextual operations (database access, key management) via sessions

Native local records hold authenticated CredentialBundle credentials and per-installation tracking. They are not Entries or inputs to Account sync. The Account’s private database stores application references and public Auth; the existing device-Read grant is retained without redesigning device authority.

Key Management

Keys are Ed25519 keypairs. The root key is encrypted at rest using the account’s password (Argon2id key derivation + AES-256-GCM). Decryption failure IS password verification — no separate password hash is stored. Each key can authenticate with multiple databases via SigKey mappings, which are auto-discovered when tracking a database.

Sync Settings

Per-database sync preferences (types::SyncSettings):

• sync_enabled: Master switch
• sync_on_commit: Trigger sync on each commit
• interval_seconds: Periodic sync interval

When multiple accounts track the same database, settings are merged to use the most aggressive settings.

Re-exports

pub use admin::InstanceAdmin;

pub use errors::AccountError;

pub use key_manager::AccountKeyManager;

pub use session::AccountSession;

pub use session::DatabaseBuilder;

pub use types::*;

Modules

admin

Instance-admin capability view.

crypto

Cryptographic functions for account system

errors

Error types for the account system

key_manager

Session-owned unlocked credentials and public installation-local key metadata.

session

AccountSession management

system_databases

System database initialization for the account system

types

Core data types for the account system

Structs

Account

An Account: the private root database of a person, group or application.

AccountSigner

An Account locator paired with one actual signer and explicit Auth identity.

CredentialBundle

An encrypted local bundle, safe to persist outside the replicated DAG.

UnlockedCredentials

Unlocked keys and their Account locator, owned by the caller.