Function lookup_account_record 

pub async fn lookup_account_record(
    users_db: &Database,
    username: impl AsRef<str>,
) -> Result<(String, AccountInfo)>

Look up an account’s record by username, without requiring the password.

Used by the service daemon’s challenge-response login flow: the daemon fetches the account’s full AccountInfo (including encrypted credentials and the account’s private-database id) and ships it to the client so the client can derive the KEK locally, decrypt the root key, sign the challenge, and then load the current encrypted bundle through exact-login-scoped native state. No credential read of _users is required. The encrypted blob is designed to survive at rest; shipping it over the local socket is the same trust boundary as filesystem read. See the Service Architecture doc § Trusted login threat model for the full rationale.

Returns

Tuple of (login_id, AccountInfo) if the account exists and is active.