the username, or the address on the entry when no recovery code is required
the surface it came through
Optionalextra: { address?: string; code?: string }
address and code when a recovery code is required
a promise of { ok: true, message, outcome }
Handles a person asking for a reset link: mails a single-use link to the address on the entry when everything checks out, and fires RISC recovery-activated.
With a recovery code required, all three of username, address and code must be right, and the code is spent. The answer is the same sentence whatever happened;
outcomemust never be shown.