@madauth/server 0.2.0-beta.2 → 0.3.0-beta.2

package/dist/standalone/lambda.mjs

@@ -15,8 +15,9 @@ var init_schema = __esm({
   "src/store/schema.ts"() {
     "use strict";
     madauthSchema = {
-      version: 3,
+      version: 4,
       models: {
+        /** Someone who signed in, whichever way: the e-mail address is the identity shared by the sign-in methods. */
         user: {
           fields: {
             id: { type: "string", primaryKey: true },
@@ -28,10 +29,12 @@ var init_schema = __esm({
             lastMailAt: { type: "number" },
             /** Wrong e-mail codes in a row, counted across e-mails (since version 2). */
             wrongCodes: { type: "number" },
+            /** What admins attached to the user, as JSON, e.g. `{"roles":["admin"]}` (since version 4). */
+            claims: { type: "string", nullable: true },
             createdAt: { type: "number" }
           }
         },
-        /** How a user signs in. `key` is e.g. `password:<userId>`; later `google:<sub>` or `totp:<userId>`. */
+        /** How a user signs in. `key` is `password:<userId>` or `google:<sub>`; later e.g. `totp:<userId>`. */
         account: {
           fields: {
             id: { type: "string", primaryKey: true },
@@ -40,6 +43,8 @@ var init_schema = __esm({
             secret: { type: "string", nullable: true },
             failedAttempts: { type: "number" },
             lockedUntil: { type: "number" },
+            /** The address the provider reported at the last sign-in, e.g. Google's current primary address (since version 4). */
+            email: { type: "string", nullable: true },
             createdAt: { type: "number" }
           }
         },
@@ -54,16 +59,13 @@ var init_schema = __esm({
             expiresAt: { type: "number" }
           }
         },
-        /**
-         * The roles of an e-mail address (since version 3). `id` is the normalized address, so the roles
-         * apply whichever way its owner signs in. `roles` holds the names separated by spaces.
-         */
-        role: {
+        /** A setting admins change at runtime, as JSON (since version 4), e.g. `methods`: which sign-in methods are on. */
+        setting: {
           fields: {
             id: { type: "string", primaryKey: true },
-            roles: { type: "string" },
+            value: { type: "string" },
             updatedAt: { type: "number" },
-            /** The address of the admin who set them; empty when set from the command line. */
+            /** The address of the admin who set it; empty when set from the command line. */
             updatedBy: { type: "string", nullable: true }
           }
         }
@@ -118,8 +120,30 @@ var init_sql = __esm({
         sql: (dialect) => `ALTER TABLE ${tableName("user")} ADD COLUMN ${columnName("wrongCodes")} ${columnTypes[dialect].number} NOT NULL DEFAULT 0;`
       },
       {
+        // Roles were per e-mail address in their own table; since version 4 they are one of the user's claims.
         version: 3,
-        sql: (dialect) => createTablesSql(dialect, { version: 3, models: { role: madauthSchema.models.role } })
+        sql: (dialect) => createTablesSql(dialect, {
+          version: 3,
+          models: {
+            role: {
+              fields: {
+                id: { type: "string", primaryKey: true },
+                roles: { type: "string" },
+                updatedAt: { type: "number" },
+                updatedBy: { type: "string", nullable: true }
+              }
+            }
+          }
+        })
+      },
+      {
+        version: 4,
+        sql: (dialect) => [
+          `ALTER TABLE ${tableName("user")} ADD COLUMN ${columnName("claims")} ${columnTypes[dialect].string};`,
+          `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("email")} ${columnTypes[dialect].string};`,
+          `DROP TABLE ${tableName("role")};`,
+          createTablesSql(dialect, { version: 4, models: { setting: madauthSchema.models.setting } })
+        ].join("\n")
       }
     ];
   }
@@ -2683,6 +2707,63 @@ var cors = (options) => {
   };
 };
 
+// src/claims.ts
+var ADMIN_ROLE = "admin";
+var MAX_ROLES = 20;
+var MAX_CLAIMS_LENGTH = 2048;
+var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+var CLAIM_NAME = /^[a-zA-Z][a-zA-Z0-9_]{0,63}$/;
+function parseRoles(input) {
+  if (!Array.isArray(input)) return null;
+  if (!input.every((role) => typeof role === "string" && ROLE_NAME.test(role))) return null;
+  const roles = [...new Set(input)].sort();
+  return roles.length <= MAX_ROLES ? roles : null;
+}
+function parseClaims(input) {
+  if (!isJsonObject(input)) return null;
+  const claims = {};
+  for (const key of Object.keys(input).sort()) {
+    const value = input[key];
+    if (!CLAIM_NAME.test(key) || !isJsonValue(value)) return null;
+    if (key === "roles") {
+      const roles = parseRoles(value);
+      if (!roles) return null;
+      claims[key] = roles;
+    } else {
+      claims[key] = value;
+    }
+  }
+  return JSON.stringify(claims).length <= MAX_CLAIMS_LENGTH ? claims : null;
+}
+function isJsonObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isJsonValue(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+  if (typeof value === "number") return Number.isFinite(value);
+  if (Array.isArray(value)) return value.every(isJsonValue);
+  return isJsonObject(value) && Object.values(value).every(isJsonValue);
+}
+function sameClaims(a, b) {
+  return JSON.stringify(a ?? {}) === JSON.stringify(b ?? {});
+}
+function claimsFromJson(json) {
+  if (!json) return {};
+  try {
+    const parsed = JSON.parse(json);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function rolesOf(user) {
+  const roles = user.claims?.roles;
+  return Array.isArray(roles) ? roles.filter((role) => typeof role === "string") : [];
+}
+function isAdmin(user) {
+  return rolesOf(user).includes(ADMIN_ROLE);
+}
+
 // ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
@@ -3889,45 +3970,6 @@ function safeEqual(a, b) {
   return x.length === y.length && timingSafeEqual(x, y);
 }
 
-// src/roles.ts
-var ADMIN_ROLE = "admin";
-var MAX_ROLES = 20;
-var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
-function parseRoles(input) {
-  if (!Array.isArray(input)) return null;
-  if (!input.every((role) => typeof role === "string" && ROLE_NAME.test(role))) return null;
-  const roles = [...new Set(input)].sort();
-  return roles.length <= MAX_ROLES ? roles : null;
-}
-function sameRoles(a, b) {
-  return a.length === b.length && a.every((role, i) => role === b[i]);
-}
-var Roles = class {
-  constructor(store) {
-    this.store = store;
-  }
-  /** The address's roles, sorted; empty if it has none. */
-  async get(emailNormalized) {
-    const record = await this.store.findOne("role", { id: emailNormalized });
-    return typeof record?.roles === "string" && record.roles ? record.roles.split(" ").filter(Boolean) : [];
-  }
-  /** Replaces the address's roles. `updatedBy` is the address of the admin, or null for the command line. */
-  async set(emailNormalized, roles, updatedBy) {
-    if (!roles.length) {
-      await this.remove(emailNormalized);
-      return;
-    }
-    const data = { roles: roles.join(" "), updatedAt: Date.now(), updatedBy };
-    if (await this.store.update("role", { id: emailNormalized }, data) === 1) return;
-    if (!await this.store.create("role", { id: emailNormalized, ...data })) {
-      await this.store.update("role", { id: emailNormalized }, data);
-    }
-  }
-  async remove(emailNormalized) {
-    await this.store.delete("role", { id: emailNormalized });
-  }
-};
-
 // src/google.ts
 var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
 var googleJwks;
@@ -3952,14 +3994,13 @@ async function verifyGoogleIdToken(idToken, opts) {
   if (payload.nonce !== opts.nonce) {
     return { ok: false, error: "verification_failed", reason: "nonce mismatch" };
   }
-  if (payload.email_verified !== true) {
+  if (typeof payload.email !== "string" || !payload.email || payload.email_verified !== true) {
     return { ok: false, error: "email_unverified", reason: "e-mail address not verified" };
   }
-  const user = { id: `google:${payload.sub}` };
-  if (typeof payload.email === "string") user.email = payload.email;
-  if (typeof payload.name === "string") user.name = payload.name;
-  if (typeof payload.picture === "string") user.picture = payload.picture;
-  return { ok: true, user };
+  const profile = { sub: payload.sub, email: payload.email };
+  if (typeof payload.name === "string") profile.name = payload.name;
+  if (typeof payload.picture === "string") profile.picture = payload.picture;
+  return { ok: true, profile };
 }
 
 // src/user.ts
@@ -3993,7 +4034,7 @@ function signSession(keys, issuer, ttlSeconds, user, amr, extra = {}) {
     email_verified: user.email ? true : void 0,
     name: user.name,
     picture: user.picture,
-    roles: user.roles?.length ? user.roles : void 0,
+    claims: user.claims && Object.keys(user.claims).length ? user.claims : void 0,
     amr
   };
   return signToken(keys, issuer, SESSION_TYP, claims, ttlSeconds);
@@ -4015,353 +4056,100 @@ function userFromClaims(claims) {
   if (claims.email) user.email = claims.email;
   if (claims.name) user.name = claims.name;
   if (claims.picture) user.picture = claims.picture;
-  if (Array.isArray(claims.roles) && claims.roles.length) user.roles = claims.roles;
+  if (claims.claims && typeof claims.claims === "object" && Object.keys(claims.claims).length) user.claims = claims.claims;
   return user;
 }
 
-// src/routes/google.ts
-var NONCE_COOKIE = "madauth_nonce";
-var NONCE_TYP = "madauth-nonce+jwt";
-var NONCE_TTL = 5 * 60;
-var OAUTH_COOKIE = "madauth_oauth";
-var OAUTH_TYP = "madauth-oauth-state+jwt";
-var OAUTH_TTL = 10 * 60;
-var GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
-var GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-var REDIRECT_ERROR_PARAM = "madauth_error";
-async function pkceChallenge(verifier) {
-  const digest2 = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-  return base64url_exports.encode(new Uint8Array(digest2));
-}
-function googleRoutes(app, ctx, google) {
-  const { config, keys, secure } = ctx;
-  const { issuer } = config;
-  const callbackUrl = `${issuer}/auth/google/callback`;
-  app.post("/auth/google/nonce", async (c) => {
-    const nonce = randomString();
-    const token = await signToken(await keys, issuer, NONCE_TYP, { nonce }, NONCE_TTL);
-    setCookie(c, NONCE_COOKIE, token, {
-      path: "/auth/google",
-      httpOnly: true,
-      secure,
-      sameSite: "Strict",
-      maxAge: NONCE_TTL
-    });
-    return c.json({ nonce });
-  });
-  app.post("/auth/google/verify", async (c) => {
-    const body = await c.req.json().catch(() => ({}));
-    if (typeof body.credential !== "string" || !body.credential) {
-      return c.json({ error: "verification_failed", message: "credential is missing" }, 400);
-    }
-    const nonceClaims = await readToken(await keys, issuer, NONCE_TYP, getCookie(c, NONCE_COOKIE));
-    if (!nonceClaims) {
-      return c.json({ error: "verification_failed", message: "nonce cookie missing or expired" }, 401);
-    }
-    const result = await verifyGoogleIdToken(body.credential, {
-      clientId: google.clientId,
-      nonce: nonceClaims.nonce,
-      keys: config.jwksResolver
-    });
-    if (!result.ok) {
-      return c.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
-    }
-    deleteCookie(c, NONCE_COOKIE, { path: "/auth/google", secure });
-    const user = await ctx.startSession(c, result.user, ["google"]);
-    await ctx.emit("user.signed_in", { user, method: "google" });
-    return c.json({ user });
-  });
-  const requireCodeFlow = async (c, next) => {
-    if (!google.clientSecret) return c.json({ error: "not_found" }, 404);
-    await next();
-  };
-  app.get("/auth/google/start", requireCodeFlow, async (c) => {
-    const returnUrl = ctx.allowedUrl(c.req.query("return_to"));
-    if (!returnUrl) return c.text("return_to must be an absolute URL whose origin is in ALLOWED_ORIGINS", 400);
-    const oauth = {
-      state: randomString(),
-      nonce: randomString(),
-      verifier: randomString(),
-      returnTo: returnUrl.href
-    };
-    const token = await signToken(await keys, issuer, OAUTH_TYP, { ...oauth }, OAUTH_TTL);
-    setCookie(c, OAUTH_COOKIE, token, {
-      path: "/auth/google",
-      httpOnly: true,
-      secure,
-      sameSite: "Lax",
-      maxAge: OAUTH_TTL
-    });
-    const url = new URL(GOOGLE_AUTH_ENDPOINT);
-    url.search = new URLSearchParams({
-      client_id: google.clientId,
-      redirect_uri: callbackUrl,
-      response_type: "code",
-      scope: "openid email profile",
-      state: oauth.state,
-      nonce: oauth.nonce,
-      code_challenge: await pkceChallenge(oauth.verifier),
-      code_challenge_method: "S256"
-    }).toString();
-    return c.redirect(url.href, 302);
-  });
-  app.get("/auth/google/callback", requireCodeFlow, async (c) => {
-    const oauth = await readToken(await keys, issuer, OAUTH_TYP, getCookie(c, OAUTH_COOKIE));
-    if (!oauth) return c.text("Sign-in expired or was started in another browser. Please try again.", 400);
-    deleteCookie(c, OAUTH_COOKIE, { path: "/auth/google", secure });
-    const back = (error) => {
-      const url = new URL(oauth.returnTo);
-      if (error) url.hash = `${REDIRECT_ERROR_PARAM}=${error}`;
-      return c.redirect(url.href, 302);
-    };
-    if (c.req.query("error")) return back(c.req.query("error") === "access_denied" ? "cancelled" : "verification_failed");
-    const code = c.req.query("code");
-    if (!code || c.req.query("state") !== oauth.state) return back("verification_failed");
-    let idToken;
+// src/users.ts
+import { randomBytes as randomBytes2 } from "crypto";
+
+// src/settings.ts
+var SIGN_IN_METHODS = ["google", "password"];
+var METHODS_SETTING = "methods";
+function parseMethodSettings(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const settings = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (!SIGN_IN_METHODS.includes(key) || typeof value !== "boolean") return null;
+    settings[key] = value;
+  }
+  return settings;
+}
+var MAX_TRIES = 3;
+var Settings = class {
+  constructor(store) {
+    this.store = store;
+  }
+  /** The setting's value, or undefined if it was never set. */
+  async get(id) {
+    return (await this.read(id)).value;
+  }
+  /** The stored JSON and what it holds; both undefined if the setting was never set. */
+  async read(id) {
+    const record = await this.store.findOne("setting", { id });
+    if (typeof record?.value !== "string") return {};
     try {
-      const res = await fetch(GOOGLE_TOKEN_ENDPOINT, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-          code,
-          client_id: google.clientId,
-          client_secret: google.clientSecret,
-          redirect_uri: callbackUrl,
-          grant_type: "authorization_code",
-          code_verifier: oauth.verifier
-        })
-      });
-      if (!res.ok) return back("verification_failed");
-      ({ id_token: idToken } = await res.json());
+      return { json: record.value, value: JSON.parse(record.value) };
     } catch {
-      return back("verification_failed");
+      return { json: record.value };
     }
-    if (typeof idToken !== "string") return back("verification_failed");
-    const result = await verifyGoogleIdToken(idToken, {
-      clientId: google.clientId,
-      nonce: oauth.nonce,
-      keys: config.jwksResolver
-    });
-    if (!result.ok) return back(result.error);
-    const user = await ctx.startSession(c, result.user, ["google"]);
-    await ctx.emit("user.signed_in", { user, method: "google" });
-    return back();
-  });
+  }
+  /**
+   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
+   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
+   * again with the newer value. Resolves to the new value, or null if `apply` refused.
+   * `updatedBy` is the address of the admin, or null for the command line.
+   */
+  async change(id, apply, updatedBy) {
+    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
+      const { json, value } = await this.read(id);
+      const next = apply(value);
+      if (next === null) return null;
+      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
+      const written = json === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json }, patch) === 1;
+      if (written) return next;
+    }
+    throw new Error(`Setting "${id}" kept changing; try again.`);
+  }
+  /** Replaces the setting. */
+  async set(id, value, updatedBy) {
+    await this.change(id, () => value, updatedBy);
+  }
+  /** Which sign-in methods are on; a method that was never switched off is on. */
+  async methods() {
+    return parseMethodSettings(await this.get(METHODS_SETTING)) ?? {};
+  }
+  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
+  async changeMethods(apply, updatedBy) {
+    return this.change(METHODS_SETTING, (current) => apply(parseMethodSettings(current) ?? {}), updatedBy);
+  }
+};
+function isOn(method, available, methods) {
+  return available(method) && methods[method] !== false;
+}
+function anyOn(available, methods) {
+  return SIGN_IN_METHODS.some((method) => isOn(method, available, methods));
 }
 
-// src/routes/password.ts
-var FREE_ATTEMPTS = 5;
-var MAX_LOCK_MS = 15 * 60 * 1e3;
-var MAIL_INTERVAL_MS = 60 * 1e3;
-var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
-var RESET_TTL_MS = 30 * 60 * 1e3;
-var WEBHOOK_TIMEOUT_MS = 1e4;
-var VERIFY_LINK_PARAM = "madauth_verify";
-var RESET_LINK_PARAM = "madauth_reset";
-var MAX_NAME_LENGTH = 100;
-var MAX_LOCALE_LENGTH = 35;
-function toMadauthUser(user) {
+// src/users.ts
+var MAX_CODE_ATTEMPTS = 5;
+var MAX_WRONG_CODES = 10;
+var newId = (prefix) => `${prefix}_${randomBytes2(16).toString("base64url")}`;
+function passwordAccountKey(userId) {
+  return `password:${userId}`;
+}
+function googleAccountKey(sub) {
+  return `google:${sub}`;
+}
+function toMadauthUser(user, profile = {}) {
   const result = { id: user.id, email: user.email };
-  if (user.name) result.name = user.name;
+  const name = user.name ?? profile.name;
+  if (name) result.name = name;
+  if (profile.picture) result.picture = profile.picture;
+  const claims = claimsFromJson(user.claims);
+  if (Object.keys(claims).length) result.claims = claims;
   return result;
 }
-function passwordRoutes(app, ctx, password, users, webhook) {
-  const { minLength } = password;
-  const body = async (c) => {
-    const data = await c.req.json().catch(() => null);
-    return data && typeof data === "object" ? data : {};
-  };
-  const error = (c, status, code, message2) => c.json({ error: code, message: message2 }, status);
-  const unavailable = (c) => error(c, 503, "temporarily_unavailable", "E-mails can not be sent right now. Please try again later.");
-  const accepted = (c) => c.json({}, 202);
-  const redirectTarget = (c, value) => {
-    const url = ctx.allowedUrl(value);
-    return url ?? error(c, 400, "invalid_options", "redirectTo must be an absolute URL whose origin is in ALLOWED_ORIGINS.");
-  };
-  const sendEmail = async (user, type, data) => {
-    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
-    const result = await webhook.call(type, { to: user.email, user: { id: user.id, name: user.name ?? void 0 }, ...data }, WEBHOOK_TIMEOUT_MS);
-    if (!result.ok) {
-      console.error(`[madauth] Webhook "${type}" for ${user.email} failed: ${result.reason}`);
-      return false;
-    }
-    await users.updateUser(user.id, { lastMailAt: Date.now() });
-    return true;
-  };
-  const sendLinkEmail = async (user, purpose, target, locale) => {
-    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
-    const ttl = purpose === "verify" ? VERIFY_TTL_MS : RESET_TTL_MS;
-    const { token, code } = await users.issueVerification(user.id, purpose, ttl);
-    const link = new URL(target);
-    link.hash = `${purpose === "verify" ? VERIFY_LINK_PARAM : RESET_LINK_PARAM}=${token}`;
-    return sendEmail(user, purpose === "verify" ? "email.verify" : "email.reset", {
-      link: link.href,
-      code,
-      expiresAt: Date.now() + ttl,
-      site: target.host,
-      locale
-    });
-  };
-  const localeOf = (data) => typeof data.locale === "string" && data.locale.length <= MAX_LOCALE_LENGTH ? data.locale : void 0;
-  const consume = async (data, purpose) => {
-    if (typeof data.token === "string" && data.token) {
-      return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
-    }
-    if (isValidEmail(data.email) && typeof data.code === "string") {
-      const user = await users.findByEmail(normalizeEmail(data.email));
-      if (!user) return { userId: null, via: "code" };
-      return { ...await users.consumeCode(user, purpose, data.code.replace(/\s/g, "")), via: "code" };
-    }
-    return { userId: null, via: "code" };
-  };
-  const invalidVerification = (c, { via, locked }) => {
-    if (locked) {
-      return error(c, 429, "codes_locked", "Too many wrong codes. Please ask for a new e-mail and use the link in it.");
-    }
-    return via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
-  };
-  app.post("/auth/password/signin", async (c) => {
-    const data = await body(c);
-    const wrong = () => error(c, 401, "invalid_credentials", "E-mail or password is wrong.");
-    const pw = typeof data.password === "string" ? data.password : "";
-    if (!isValidEmail(data.email) || !pw || pw.length > MAX_PASSWORD_LENGTH * 4) return wrong();
-    const user = await users.findByEmail(normalizeEmail(data.email));
-    const account = user ? await users.passwordAccount(user.id) : null;
-    if (!user || !account?.secret) {
-      await verifyAgainstDummy(pw);
-      return wrong();
-    }
-    const now = Date.now();
-    if (account.lockedUntil > now) {
-      const seconds = Math.ceil((account.lockedUntil - now) / 1e3);
-      return error(c, 429, "too_many_attempts", `Too many failed attempts. Try again in ${seconds} seconds.`);
-    }
-    const failed = account.failedAttempts + 1;
-    const lockedUntil = failed >= FREE_ATTEMPTS ? now + Math.min(2 ** (failed - FREE_ATTEMPTS) * 1e3, MAX_LOCK_MS) : 0;
-    if (!await users.countAttempt(account, { failedAttempts: failed, lockedUntil })) {
-      return error(c, 429, "too_many_attempts", "Too many attempts at once. Please try again.");
-    }
-    const { ok, needsRehash } = await verifyPassword(pw, account.secret);
-    if (!ok) return wrong();
-    await users.updateAccount(account.id, {
-      failedAttempts: 0,
-      lockedUntil: 0,
-      ...needsRehash ? { secret: await hashPassword(pw) } : {}
-    });
-    if (!user.emailVerified) {
-      return error(c, 403, "email_unverified", "Please confirm your e-mail address first. We can send the e-mail again.");
-    }
-    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
-    await ctx.emit("user.signed_in", { user: result, method: "password" });
-    return c.json({ user: result });
-  });
-  app.post("/auth/password/signup", async (c) => {
-    const data = await body(c);
-    const target = redirectTarget(c, data.redirectTo);
-    if (target instanceof Response) return target;
-    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
-    const policy = checkPasswordPolicy(data.password, minLength);
-    if (policy) return error(c, 400, "weak_password", policy);
-    const name = typeof data.name === "string" && data.name.trim() ? data.name.trim().slice(0, MAX_NAME_LENGTH) : null;
-    const email = data.email.trim();
-    const locale = localeOf(data);
-    if (webhook.wants("signup.before")) {
-      const check2 = await webhook.call("signup.before", { email, name: name ?? void 0, locale }, WEBHOOK_TIMEOUT_MS);
-      if (!check2.ok) {
-        console.error(`[madauth] Webhook "signup.before" failed: ${check2.reason}`);
-        return unavailable(c);
-      }
-      const answer = check2.body;
-      if (answer?.allow === false) {
-        const message2 = typeof answer.message === "string" && answer.message ? answer.message : "Sign-up is not possible with this e-mail address.";
-        return error(c, 403, "signup_rejected", message2);
-      }
-    }
-    const passwordHash = await hashPassword(data.password);
-    const existing = await users.findByEmail(normalizeEmail(email));
-    if (existing?.emailVerified) {
-      if (!webhook.wants("email.already_registered")) return accepted(c);
-      const sent = await sendEmail(existing, "email.already_registered", { link: target.href, site: target.host, locale });
-      return sent ? accepted(c) : unavailable(c);
-    }
-    if (existing) {
-      if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
-      const account = await users.passwordAccount(existing.id);
-      if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
-      await users.updateUser(existing.id, { name });
-      return await sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
-    }
-    const user = await users.createPasswordUser({
-      email,
-      emailNormalized: normalizeEmail(email),
-      name,
-      passwordHash,
-      emailVerified: false
-    });
-    if (!user) return accepted(c);
-    await ctx.emit("user.created", { user: toMadauthUser(user) });
-    return await sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
-  });
-  app.post("/auth/password/send-verification", async (c) => {
-    const data = await body(c);
-    const target = redirectTarget(c, data.redirectTo);
-    if (target instanceof Response) return target;
-    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
-    const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && !user.emailVerified && await users.passwordAccount(user.id)) {
-      if (!await sendLinkEmail(user, "verify", target, localeOf(data))) return unavailable(c);
-    }
-    return accepted(c);
-  });
-  app.post("/auth/password/verify-email", async (c) => {
-    const consumed = await consume(await body(c), "verify");
-    const { userId, via } = consumed;
-    const user = userId ? await users.findById(userId) : null;
-    if (!user) return invalidVerification(c, consumed);
-    await users.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
-    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
-    await ctx.emit("email.verified", { user: result, via });
-    await ctx.emit("user.signed_in", { user: result, method: "password" });
-    return c.json({ user: result });
-  });
-  app.post("/auth/password/send-reset", async (c) => {
-    const data = await body(c);
-    const target = redirectTarget(c, data.redirectTo);
-    if (target instanceof Response) return target;
-    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
-    const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && await users.passwordAccount(user.id)) {
-      if (!await sendLinkEmail(user, "reset", target, localeOf(data))) return unavailable(c);
-    }
-    return accepted(c);
-  });
-  app.post("/auth/password/reset", async (c) => {
-    const data = await body(c);
-    const policy = checkPasswordPolicy(data.password, minLength);
-    if (policy) return error(c, 400, "weak_password", policy);
-    const consumed = await consume(data, "reset");
-    const user = consumed.userId ? await users.findById(consumed.userId) : null;
-    const account = user ? await users.passwordAccount(user.id) : null;
-    if (!user || !account) return invalidVerification(c, consumed);
-    await users.updateAccount(account.id, { secret: await hashPassword(data.password), failedAttempts: 0, lockedUntil: 0 });
-    const sessionVersion = user.sessionVersion + 1;
-    await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
-    await users.clearVerifications(user.id);
-    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: sessionVersion });
-    await ctx.emit("password.reset", { user: result });
-    await ctx.emit("user.signed_in", { user: result, method: "password" });
-    return c.json({ user: result });
-  });
-}
-
-// src/users.ts
-import { randomBytes as randomBytes2 } from "crypto";
-var MAX_CODE_ATTEMPTS = 5;
-var MAX_WRONG_CODES = 10;
-var newId = (prefix) => `${prefix}_${randomBytes2(16).toString("base64url")}`;
-function passwordAccountKey(userId) {
-  return `password:${userId}`;
-}
 var Users = class {
   /** `codeKey` keys the e-mail codes (see deriveCodeKey); only needed to issue and check them. */
   constructor(store, codeKey) {
@@ -4379,11 +4167,22 @@ var Users = class {
     return await this.store.findOne("user", { id });
   }
   async passwordAccount(userId) {
-    return await this.store.findOne("account", { key: passwordAccountKey(userId) });
+    return this.findAccountByKey(passwordAccountKey(userId));
   }
-  /** Creates a user with a password. Resolves to null if the e-mail address is taken. */
-  async createPasswordUser(data) {
-    const now = Date.now();
+  /** How the user signs in, from their accounts: e.g. `['google']` for a user without a password. */
+  async signInMethods(userId) {
+    const accounts = await this.store.findMany("account", { userId });
+    const methods = accounts.map((account) => String(account.key).split(":")[0]);
+    return SIGN_IN_METHODS.filter((method) => methods.includes(method));
+  }
+  async findAccountByKey(key) {
+    return await this.store.findOne("account", { key });
+  }
+  /**
+   * Creates a user with their first account. Resolves to null if the e-mail address or the account key is
+   * taken. `account.key` is `password:<userId>` for a password (its hash as `secret`), or e.g. `google:<sub>`.
+   */
+  async createUser(data) {
     const user = {
       id: newId("usr"),
       email: data.email,
@@ -4393,45 +4192,66 @@ var Users = class {
       sessionVersion: 0,
       lastMailAt: 0,
       wrongCodes: 0,
-      createdAt: now
+      claims: null,
+      createdAt: Date.now()
     };
     if (!await this.store.create("user", user)) return null;
-    const account = {
-      id: newId("acc"),
-      userId: user.id,
-      key: passwordAccountKey(user.id),
-      secret: data.passwordHash,
-      failedAttempts: 0,
-      lockedUntil: 0,
-      createdAt: now
-    };
-    if (!await this.store.create("account", account)) {
+    const account = typeof data.account === "function" ? data.account(user.id) : data.account;
+    if (!await this.linkAccount(user.id, account)) {
       await this.store.delete("user", { id: user.id });
       return null;
     }
     return user;
   }
   /**
-   * Deletes the user with this e-mail address and everything stored for them. Resolves to the deleted
-   * user's ID, or null if there is no such user (any more).
+   * A provider verified the user's address: an unconfirmed password sign-up with it, whose password nobody
+   * has proven, is dropped (the account and its pending links and codes), and the user counts as verified.
+   */
+  async verifyByProvider(user) {
+    if (user.emailVerified) return;
+    await this.store.delete("account", { key: passwordAccountKey(user.id) });
+    await this.clearVerifications(user.id);
+    await this.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
+  }
+  /** Removes an account record, e.g. one left behind by a deletion that did not finish. */
+  async deleteAccount(id) {
+    await this.store.delete("account", { id });
+  }
+  /** Adds a sign-in method to a user. Resolves to null if the account key is taken. */
+  async linkAccount(userId, account) {
+    const record = {
+      id: newId("acc"),
+      userId,
+      key: account.key,
+      secret: account.secret ?? null,
+      failedAttempts: 0,
+      lockedUntil: 0,
+      email: account.email ?? null,
+      createdAt: Date.now()
+    };
+    return await this.store.create("account", record) ? record : null;
+  }
+  /**
+   * Deletes the user and everything stored for them. Resolves to false if there is no such user (any more).
    */
-  async deleteByEmail(emailNormalized) {
-    const user = await this.findByEmail(emailNormalized);
-    if (!user) return null;
-    if (await this.store.delete("user", { id: user.id }) !== 1) return null;
+  async deleteById(id) {
+    const user = await this.findById(id);
+    if (!user) return false;
+    if (await this.store.delete("user", { id: user.id }) !== 1) return false;
     try {
       await this.store.delete("account", { userId: user.id });
       await this.store.delete("verification", { userId: user.id });
     } catch (e) {
       console.error(`[madauth] Deleted user ${user.id}, but not all of their records: ${e.message}`);
     }
-    return user.id;
+    return true;
   }
   async updateUser(id, patch) {
     await this.store.update("user", { id }, patch);
   }
+  /** Changes an account. Resolves to false if it is gone meanwhile. */
   async updateAccount(id, patch) {
-    await this.store.update("account", { id }, patch);
+    return await this.store.update("account", { id }, patch) === 1;
   }
   /**
    * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
@@ -4489,98 +4309,490 @@ var Users = class {
       if (attempts >= MAX_CODE_ATTEMPTS) await this.store.delete("verification", { id: record.id });
       return { userId: null, locked: wrongCodes >= MAX_WRONG_CODES };
     }
-    return { userId: await this.consume(record), locked: false };
-  }
-  /** Counts a code for the user and resolves to the new count; null if other requests kept changing it. */
-  async countWrongCode(user) {
-    let current = user;
-    for (let attempt = 0; attempt < 3 && current; attempt++) {
-      const wrongCodes = (current.wrongCodes ?? 0) + 1;
-      if (await this.store.update("user", { id: user.id, wrongCodes: current.wrongCodes ?? null }, { wrongCodes }) === 1) {
-        return wrongCodes;
-      }
-      current = await this.findById(user.id);
+    return { userId: await this.consume(record), locked: false };
+  }
+  /** Counts a code for the user and resolves to the new count; null if other requests kept changing it. */
+  async countWrongCode(user) {
+    let current = user;
+    for (let attempt = 0; attempt < 3 && current; attempt++) {
+      const wrongCodes = (current.wrongCodes ?? 0) + 1;
+      if (await this.store.update("user", { id: user.id, wrongCodes: current.wrongCodes ?? null }, { wrongCodes }) === 1) {
+        return wrongCodes;
+      }
+      current = await this.findById(user.id);
+    }
+    return null;
+  }
+  async consume(record) {
+    const deleted = await this.store.delete("verification", { id: record.id });
+    if (deleted !== 1 || record.expiresAt <= Date.now()) return null;
+    return record.userId;
+  }
+};
+
+// src/webhooks.ts
+import { createHmac as createHmac2, randomBytes as randomBytes3, randomUUID, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var WEBHOOK_TYPES = [
+  "email.verify",
+  "email.reset",
+  "email.already_registered",
+  "email.no_password",
+  "signup.before",
+  "user.created",
+  "email.verified",
+  "email.password_reset",
+  "user.signed_in",
+  "user.deleted",
+  "user.claims_changed"
+];
+var WEBHOOK_TIMEOUT_MS = 1e4;
+var MAX_LOCALE_LENGTH = 35;
+function localeOf(value) {
+  return typeof value === "string" && value.length <= MAX_LOCALE_LENGTH ? value : void 0;
+}
+var REQUIRED_EMAIL_TYPES = ["email.verify", "email.reset"];
+var SECRET_PREFIX = "whsec_";
+var DEV_WEBHOOK_RECEIVER_URL = "https://github.com/inouiw/madAuth-webhooks/tree/main/dev-receiver";
+var WEBHOOK_TOLERANCE_SECONDS = 5 * 60;
+function generateWebhookSecret() {
+  return `${SECRET_PREFIX}${randomBytes3(32).toString("base64")}`;
+}
+function checkWebhookSecret(secret) {
+  if (!secret.startsWith(SECRET_PREFIX)) return `must start with "${SECRET_PREFIX}"`;
+  const key = Buffer.from(secret.slice(SECRET_PREFIX.length), "base64");
+  if (key.length < 24 || key.length > 64) return "must contain 24 to 64 bytes in base64";
+  return null;
+}
+function hmac2(secret, content) {
+  const key = Buffer.from(secret.slice(SECRET_PREFIX.length), "base64");
+  return createHmac2("sha256", key).update(content).digest("base64");
+}
+function signWebhook(secret, id, timestamp, body) {
+  return `v1,${hmac2(secret, `${id}.${timestamp}.${body}`)}`;
+}
+function createWebhookClient(settings, fetchImpl = fetch) {
+  const wants = (type) => settings.events.has(type);
+  return {
+    wants,
+    async call(type, data, timeoutMs) {
+      if (!wants(type)) return { ok: true, body: void 0 };
+      const id = `msg_${randomUUID()}`;
+      const timestamp = Math.floor(Date.now() / 1e3);
+      const body = JSON.stringify({ type, data });
+      let response;
+      try {
+        response = await fetchImpl(settings.url, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "webhook-id": id,
+            "webhook-timestamp": String(timestamp),
+            "webhook-signature": signWebhook(settings.secret, id, timestamp, body)
+          },
+          body,
+          signal: AbortSignal.timeout(timeoutMs)
+        });
+      } catch (e) {
+        const reason = e.name === "TimeoutError" ? `no answer within ${timeoutMs} ms` : e.message;
+        return { ok: false, reason };
+      }
+      const text = await response.text().catch(() => "");
+      if (!response.ok) return { ok: false, reason: `HTTP ${response.status}` };
+      let parsed;
+      try {
+        parsed = text ? JSON.parse(text) : void 0;
+      } catch {
+        parsed = void 0;
+      }
+      return { ok: true, body: parsed };
+    }
+  };
+}
+
+// src/routes/google.ts
+var NONCE_COOKIE = "madauth_nonce";
+var NONCE_TYP = "madauth-nonce+jwt";
+var NONCE_TTL = 5 * 60;
+var OAUTH_COOKIE = "madauth_oauth";
+var OAUTH_TYP = "madauth-oauth-state+jwt";
+var OAUTH_TTL = 10 * 60;
+var GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+var GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+var REDIRECT_ERROR_PARAM = "madauth_error";
+async function pkceChallenge(verifier) {
+  const digest2 = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64url_exports.encode(new Uint8Array(digest2));
+}
+function googleRoutes(app, ctx, google) {
+  const { config, keys, secure, users } = ctx;
+  const { issuer } = config;
+  const callbackUrl = `${issuer}/auth/google/callback`;
+  const resolveUser = async (profile, locale) => {
+    const key = googleAccountKey(profile.sub);
+    const emailNormalized = normalizeEmail(profile.email);
+    const signedIn = (user) => ({ ok: true, user: toMadauthUser(user, profile), sv: user.sessionVersion });
+    const account = await users.findAccountByKey(key);
+    if (account) {
+      const user = await users.findById(account.userId);
+      if (user) {
+        if (account.email !== profile.email) await users.updateAccount(account.id, { email: profile.email });
+        return signedIn(user);
+      }
+      await users.deleteAccount(account.id);
+    }
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const existing = await users.findByEmail(emailNormalized);
+      if (existing) {
+        await users.verifyByProvider(existing);
+        if (!await users.linkAccount(existing.id, { key, email: profile.email })) {
+          const linked = await users.findAccountByKey(key);
+          const owner = linked && await users.findById(linked.userId);
+          if (!owner) return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
+          return signedIn(owner);
+        }
+        return signedIn(existing);
+      }
+      if (attempt === 0) {
+        const check2 = await ctx.checkSignup({ email: profile.email, name: profile.name, locale, method: "google" });
+        if (!check2.ok) {
+          return check2.reason === "rejected" ? { ok: false, error: "signup_rejected", message: check2.message } : { ok: false, error: "temporarily_unavailable", message: "Signing up is not possible right now. Please try again later." };
+        }
+      }
+      const user = await users.createUser({
+        email: profile.email,
+        emailNormalized,
+        name: profile.name ?? null,
+        emailVerified: true,
+        account: { key, email: profile.email }
+      });
+      if (user) {
+        await ctx.emit("user.created", { user: toMadauthUser(user), method: "google" });
+        return signedIn(user);
+      }
+    }
+    return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
+  };
+  const disabled = (c) => c.json({ error: "method_disabled", message: "Google sign-in is switched off." }, 403);
+  app.post("/auth/google/nonce", async (c) => {
+    if (!await ctx.enabled("google")) return disabled(c);
+    const nonce = randomString();
+    const token = await signToken(await keys, issuer, NONCE_TYP, { nonce }, NONCE_TTL);
+    setCookie(c, NONCE_COOKIE, token, {
+      path: "/auth/google",
+      httpOnly: true,
+      secure,
+      sameSite: "Strict",
+      maxAge: NONCE_TTL
+    });
+    return c.json({ nonce });
+  });
+  app.post("/auth/google/verify", async (c) => {
+    if (!await ctx.enabled("google")) return disabled(c);
+    const body = await c.req.json().catch(() => ({}));
+    if (typeof body.credential !== "string" || !body.credential) {
+      return c.json({ error: "verification_failed", message: "credential is missing" }, 400);
+    }
+    const nonceClaims = await readToken(await keys, issuer, NONCE_TYP, getCookie(c, NONCE_COOKIE));
+    if (!nonceClaims) {
+      return c.json({ error: "verification_failed", message: "nonce cookie missing or expired" }, 401);
+    }
+    const result = await verifyGoogleIdToken(body.credential, {
+      clientId: google.clientId,
+      nonce: nonceClaims.nonce,
+      keys: config.jwksResolver
+    });
+    if (!result.ok) {
+      return c.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
+    }
+    deleteCookie(c, NONCE_COOKIE, { path: "/auth/google", secure });
+    const resolved = await resolveUser(result.profile, localeOf(body.locale));
+    if (!resolved.ok) {
+      return c.json({ error: resolved.error, message: resolved.message }, resolved.error === "signup_rejected" ? 403 : 503);
+    }
+    const user = await ctx.startSession(c, resolved.user, ["google"], { sv: resolved.sv });
+    await ctx.emit("user.signed_in", { user, method: "google" });
+    return c.json({ user });
+  });
+  const requireCodeFlow = async (c, next) => {
+    if (!google.clientSecret) return c.json({ error: "not_found" }, 404);
+    if (!await ctx.enabled("google")) return disabled(c);
+    await next();
+  };
+  app.get("/auth/google/start", requireCodeFlow, async (c) => {
+    const returnUrl = ctx.allowedUrl(c.req.query("return_to"));
+    if (!returnUrl) return c.text("return_to must be an absolute URL whose origin is in ALLOWED_ORIGINS", 400);
+    const oauth = {
+      state: randomString(),
+      nonce: randomString(),
+      verifier: randomString(),
+      returnTo: returnUrl.href,
+      locale: localeOf(c.req.query("locale"))
+    };
+    const token = await signToken(await keys, issuer, OAUTH_TYP, { ...oauth }, OAUTH_TTL);
+    setCookie(c, OAUTH_COOKIE, token, {
+      path: "/auth/google",
+      httpOnly: true,
+      secure,
+      sameSite: "Lax",
+      maxAge: OAUTH_TTL
+    });
+    const url = new URL(GOOGLE_AUTH_ENDPOINT);
+    url.search = new URLSearchParams({
+      client_id: google.clientId,
+      redirect_uri: callbackUrl,
+      response_type: "code",
+      scope: "openid email profile",
+      state: oauth.state,
+      nonce: oauth.nonce,
+      code_challenge: await pkceChallenge(oauth.verifier),
+      code_challenge_method: "S256"
+    }).toString();
+    return c.redirect(url.href, 302);
+  });
+  app.get("/auth/google/callback", requireCodeFlow, async (c) => {
+    const oauth = await readToken(await keys, issuer, OAUTH_TYP, getCookie(c, OAUTH_COOKIE));
+    if (!oauth) return c.text("Sign-in expired or was started in another browser. Please try again.", 400);
+    deleteCookie(c, OAUTH_COOKIE, { path: "/auth/google", secure });
+    const back = (error) => {
+      const url = new URL(oauth.returnTo);
+      if (error) url.hash = `${REDIRECT_ERROR_PARAM}=${error}`;
+      return c.redirect(url.href, 302);
+    };
+    if (c.req.query("error")) return back(c.req.query("error") === "access_denied" ? "cancelled" : "verification_failed");
+    const code = c.req.query("code");
+    if (!code || c.req.query("state") !== oauth.state) return back("verification_failed");
+    let idToken;
+    try {
+      const res = await fetch(GOOGLE_TOKEN_ENDPOINT, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          code,
+          client_id: google.clientId,
+          client_secret: google.clientSecret,
+          redirect_uri: callbackUrl,
+          grant_type: "authorization_code",
+          code_verifier: oauth.verifier
+        })
+      });
+      if (!res.ok) return back("verification_failed");
+      ({ id_token: idToken } = await res.json());
+    } catch {
+      return back("verification_failed");
+    }
+    if (typeof idToken !== "string") return back("verification_failed");
+    const result = await verifyGoogleIdToken(idToken, {
+      clientId: google.clientId,
+      nonce: oauth.nonce,
+      keys: config.jwksResolver
+    });
+    if (!result.ok) return back(result.error);
+    const resolved = await resolveUser(result.profile, typeof oauth.locale === "string" ? oauth.locale : void 0);
+    if (!resolved.ok) return back(resolved.error);
+    const user = await ctx.startSession(c, resolved.user, ["google"], { sv: resolved.sv });
+    await ctx.emit("user.signed_in", { user, method: "google" });
+    return back();
+  });
+}
+
+// src/routes/password.ts
+var FREE_ATTEMPTS = 5;
+var MAX_LOCK_MS = 15 * 60 * 1e3;
+var MAIL_INTERVAL_MS = 60 * 1e3;
+var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
+var RESET_TTL_MS = 30 * 60 * 1e3;
+var VERIFY_LINK_PARAM = "madauth_verify";
+var RESET_LINK_PARAM = "madauth_reset";
+var MAX_NAME_LENGTH = 100;
+function passwordRoutes(app, ctx, password, users, webhook) {
+  const { minLength } = password;
+  const disabled = (c) => c.json({ error: "method_disabled", message: "E-mail & password sign-in is switched off." }, 403);
+  app.use("/auth/password/*", async (c, next) => {
+    if (!await ctx.enabled("password")) return disabled(c);
+    await next();
+  });
+  const body = async (c) => {
+    const data = await c.req.json().catch(() => null);
+    return data && typeof data === "object" ? data : {};
+  };
+  const error = (c, status, code, message2) => c.json({ error: code, message: message2 }, status);
+  const unavailable = (c) => error(c, 503, "temporarily_unavailable", "E-mails can not be sent right now. Please try again later.");
+  const accepted = (c) => c.json({}, 202);
+  const redirectTarget = (c, value) => {
+    const url = ctx.allowedUrl(value);
+    return url ?? error(c, 400, "invalid_options", "redirectTo must be an absolute URL whose origin is in ALLOWED_ORIGINS.");
+  };
+  const sendEmail = async (user, type, data) => {
+    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+    const result = await webhook.call(type, { to: user.email, user: { id: user.id, name: user.name ?? void 0 }, ...data }, WEBHOOK_TIMEOUT_MS);
+    if (!result.ok) {
+      console.error(`[madauth] Webhook "${type}" for ${user.email} failed: ${result.reason}`);
+      return false;
+    }
+    await users.updateUser(user.id, { lastMailAt: Date.now() });
+    return true;
+  };
+  const sendLinkEmail = async (user, purpose, target, locale) => {
+    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+    const ttl = purpose === "verify" ? VERIFY_TTL_MS : RESET_TTL_MS;
+    const { token, code } = await users.issueVerification(user.id, purpose, ttl);
+    const link = new URL(target);
+    link.hash = `${purpose === "verify" ? VERIFY_LINK_PARAM : RESET_LINK_PARAM}=${token}`;
+    return sendEmail(user, purpose === "verify" ? "email.verify" : "email.reset", {
+      link: link.href,
+      code,
+      expiresAt: Date.now() + ttl,
+      site: target.host,
+      locale
+    });
+  };
+  const sendAccountEmail = async (user, type, target, locale) => {
+    if (!webhook.wants(type)) return true;
+    const methods = await users.signInMethods(user.id);
+    return sendEmail(user, type, { link: target.href, site: target.host, locale, methods });
+  };
+  const consume = async (data, purpose) => {
+    if (typeof data.token === "string" && data.token) {
+      return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
+    }
+    if (isValidEmail(data.email) && typeof data.code === "string") {
+      const user = await users.findByEmail(normalizeEmail(data.email));
+      if (!user) return { userId: null, via: "code" };
+      return { ...await users.consumeCode(user, purpose, data.code.replace(/\s/g, "")), via: "code" };
     }
-    return null;
-  }
-  async consume(record) {
-    const deleted = await this.store.delete("verification", { id: record.id });
-    if (deleted !== 1 || record.expiresAt <= Date.now()) return null;
-    return record.userId;
-  }
-};
-
-// src/webhooks.ts
-import { createHmac as createHmac2, randomBytes as randomBytes3, randomUUID, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var WEBHOOK_TYPES = [
-  "email.verify",
-  "email.reset",
-  "email.already_registered",
-  "signup.before",
-  "user.created",
-  "email.verified",
-  "password.reset",
-  "user.signed_in",
-  "user.deleted",
-  "roles.changed"
-];
-var REQUIRED_EMAIL_TYPES = ["email.verify", "email.reset"];
-var SECRET_PREFIX = "whsec_";
-var DEV_WEBHOOK_RECEIVER_URL = "https://github.com/inouiw/madAuth-webhooks/tree/main/dev-receiver";
-var WEBHOOK_TOLERANCE_SECONDS = 5 * 60;
-function generateWebhookSecret() {
-  return `${SECRET_PREFIX}${randomBytes3(32).toString("base64")}`;
-}
-function checkWebhookSecret(secret) {
-  if (!secret.startsWith(SECRET_PREFIX)) return `must start with "${SECRET_PREFIX}"`;
-  const key = Buffer.from(secret.slice(SECRET_PREFIX.length), "base64");
-  if (key.length < 24 || key.length > 64) return "must contain 24 to 64 bytes in base64";
-  return null;
-}
-function hmac2(secret, content) {
-  const key = Buffer.from(secret.slice(SECRET_PREFIX.length), "base64");
-  return createHmac2("sha256", key).update(content).digest("base64");
-}
-function signWebhook(secret, id, timestamp, body) {
-  return `v1,${hmac2(secret, `${id}.${timestamp}.${body}`)}`;
-}
-function createWebhookClient(settings, fetchImpl = fetch) {
-  const wants = (type) => settings.events.has(type);
-  return {
-    wants,
-    async call(type, data, timeoutMs) {
-      if (!wants(type)) return { ok: true, body: void 0 };
-      const id = `msg_${randomUUID()}`;
-      const timestamp = Math.floor(Date.now() / 1e3);
-      const body = JSON.stringify({ type, data });
-      let response;
-      try {
-        response = await fetchImpl(settings.url, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "webhook-id": id,
-            "webhook-timestamp": String(timestamp),
-            "webhook-signature": signWebhook(settings.secret, id, timestamp, body)
-          },
-          body,
-          signal: AbortSignal.timeout(timeoutMs)
-        });
-      } catch (e) {
-        const reason = e.name === "TimeoutError" ? `no answer within ${timeoutMs} ms` : e.message;
-        return { ok: false, reason };
-      }
-      const text = await response.text().catch(() => "");
-      if (!response.ok) return { ok: false, reason: `HTTP ${response.status}` };
-      let parsed;
-      try {
-        parsed = text ? JSON.parse(text) : void 0;
-      } catch {
-        parsed = void 0;
-      }
-      return { ok: true, body: parsed };
+    return { userId: null, via: "code" };
+  };
+  const invalidVerification = (c, { via, locked }) => {
+    if (locked) {
+      return error(c, 429, "codes_locked", "Too many wrong codes. Please ask for a new e-mail and use the link in it.");
     }
+    return via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
   };
+  app.post("/auth/password/signin", async (c) => {
+    const data = await body(c);
+    const wrong = () => error(c, 401, "invalid_credentials", "E-mail or password is wrong.");
+    const pw = typeof data.password === "string" ? data.password : "";
+    if (!isValidEmail(data.email) || !pw || pw.length > MAX_PASSWORD_LENGTH * 4) return wrong();
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account?.secret) {
+      await verifyAgainstDummy(pw);
+      return wrong();
+    }
+    const now = Date.now();
+    if (account.lockedUntil > now) {
+      const seconds = Math.ceil((account.lockedUntil - now) / 1e3);
+      return error(c, 429, "too_many_attempts", `Too many failed attempts. Try again in ${seconds} seconds.`);
+    }
+    const failed = account.failedAttempts + 1;
+    const lockedUntil = failed >= FREE_ATTEMPTS ? now + Math.min(2 ** (failed - FREE_ATTEMPTS) * 1e3, MAX_LOCK_MS) : 0;
+    if (!await users.countAttempt(account, { failedAttempts: failed, lockedUntil })) {
+      return error(c, 429, "too_many_attempts", "Too many attempts at once. Please try again.");
+    }
+    const { ok, needsRehash } = await verifyPassword(pw, account.secret);
+    if (!ok) return wrong();
+    await users.updateAccount(account.id, {
+      failedAttempts: 0,
+      lockedUntil: 0,
+      ...needsRehash ? { secret: await hashPassword(pw) } : {}
+    });
+    if (!user.emailVerified) {
+      return error(c, 403, "email_unverified", "Please confirm your e-mail address first. We can send the e-mail again.");
+    }
+    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
+    await ctx.emit("user.signed_in", { user: result, method: "password" });
+    return c.json({ user: result });
+  });
+  app.post("/auth/password/signup", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const policy = checkPasswordPolicy(data.password, minLength);
+    if (policy) return error(c, 400, "weak_password", policy);
+    const name = typeof data.name === "string" && data.name.trim() ? data.name.trim().slice(0, MAX_NAME_LENGTH) : null;
+    const email = data.email.trim();
+    const locale = localeOf(data.locale);
+    const check2 = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "password" });
+    if (!check2.ok) return check2.reason === "rejected" ? error(c, 403, "signup_rejected", check2.message) : unavailable(c);
+    const passwordHash = await hashPassword(data.password);
+    const existing = await users.findByEmail(normalizeEmail(email));
+    if (existing?.emailVerified) {
+      return await sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c) : unavailable(c);
+    }
+    if (existing) {
+      if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
+      const account = await users.passwordAccount(existing.id);
+      if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
+      else await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash });
+      await users.updateUser(existing.id, { name });
+      return await sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
+    }
+    const user = await users.createUser({
+      email,
+      emailNormalized: normalizeEmail(email),
+      name,
+      emailVerified: false,
+      account: (userId) => ({ key: passwordAccountKey(userId), secret: passwordHash })
+    });
+    if (!user) return accepted(c);
+    await ctx.emit("user.created", { user: toMadauthUser(user), method: "password" });
+    return await sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
+  });
+  app.post("/auth/password/send-verification", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (user && !user.emailVerified && await users.passwordAccount(user.id)) {
+      if (!await sendLinkEmail(user, "verify", target, localeOf(data.locale))) return unavailable(c);
+    }
+    return accepted(c);
+  });
+  app.post("/auth/password/verify-email", async (c) => {
+    const consumed = await consume(await body(c), "verify");
+    const { userId, via } = consumed;
+    const user = userId ? await users.findById(userId) : null;
+    if (!user) return invalidVerification(c, consumed);
+    await users.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
+    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
+    await ctx.emit("email.verified", { user: result, via });
+    await ctx.emit("user.signed_in", { user: result, method: "password" });
+    return c.json({ user: result });
+  });
+  app.post("/auth/password/send-reset", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    const locale = localeOf(data.locale);
+    if (user && await users.passwordAccount(user.id)) {
+      if (!await sendLinkEmail(user, "reset", target, locale)) return unavailable(c);
+    } else if (user) {
+      if (!await sendAccountEmail(user, "email.no_password", target, locale)) return unavailable(c);
+    }
+    return accepted(c);
+  });
+  app.post("/auth/password/reset", async (c) => {
+    const data = await body(c);
+    const policy = checkPasswordPolicy(data.password, minLength);
+    if (policy) return error(c, 400, "weak_password", policy);
+    const consumed = await consume(data, "reset");
+    const user = consumed.userId ? await users.findById(consumed.userId) : null;
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account) return invalidVerification(c, consumed);
+    const secret = await hashPassword(data.password);
+    if (!await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 })) return invalidVerification(c, consumed);
+    const sessionVersion = user.sessionVersion + 1;
+    await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
+    await users.clearVerifications(user.id);
+    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: sessionVersion });
+    await ctx.emit("email.password_reset", { user: result });
+    await ctx.emit("user.signed_in", { user: result, method: "password" });
+    return c.json({ user: result });
+  });
 }
 
 // src/app.ts
@@ -4590,12 +4802,9 @@ function createApp(config) {
   const keys = importSigningKeys(config.signingKey);
   const secure = issuer.startsWith("https:");
   const isAllowedOrigin = (origin) => !!origin && allowedOrigins.includes(origin);
-  const roles = config.password ? new Roles(config.password.store) : void 0;
-  const withRoles = async (user) => {
-    const { roles: _, ...rest } = user;
-    const current = roles && user.email ? await roles.get(normalizeEmail(user.email)) : [];
-    return current.length ? { ...rest, roles: current } : rest;
-  };
+  const users = new Users(config.store, deriveCodeKey(config.signingKey.d));
+  const settings = new Settings(config.store);
+  const available = (method) => method === "google" ? !!config.google : !!config.password;
   const issueSession = async (c, user, amr, extra) => {
     const signingKeys = await keys;
     const [sessionToken, renewalToken] = await Promise.all([
@@ -4647,12 +4856,29 @@ function createApp(config) {
       return url;
     },
     async startSession(c, user, amr, extra) {
-      const signedIn = await withRoles(user);
-      await issueSession(c, signedIn, amr, extra);
-      return signedIn;
+      await issueSession(c, user, amr, extra);
+      return user;
     },
-    users: config.password ? new Users(config.password.store, deriveCodeKey(config.signingKey.d)) : void 0,
+    users,
+    settings,
     webhook: config.webhook ? createWebhookClient(config.webhook, config.webhookFetch) : void 0,
+    async enabled(method) {
+      return isOn(method, available, await settings.methods());
+    },
+    async checkSignup(data) {
+      if (!this.webhook?.wants("signup.before")) return { ok: true };
+      const check2 = await this.webhook.call("signup.before", data, WEBHOOK_TIMEOUT_MS);
+      if (!check2.ok) {
+        console.error(`[madauth] Webhook "signup.before" failed: ${check2.reason}`);
+        return { ok: false, reason: "unavailable" };
+      }
+      const answer = check2.body;
+      if (answer?.allow === false) {
+        const message2 = typeof answer.message === "string" && answer.message ? answer.message : "Sign-up is not possible with this e-mail address.";
+        return { ok: false, reason: "rejected", message: message2 };
+      }
+      return { ok: true };
+    },
     async emit(type, data) {
       if (!this.webhook?.wants(type)) return;
       const result = await this.webhook.call(type, data, EVENT_TIMEOUT_MS);
@@ -4682,29 +4908,28 @@ function createApp(config) {
     c.header("Cache-Control", "public, max-age=3600");
     return c.json({ keys: [publicJwk] });
   });
-  app.get(
-    "/auth/config",
-    (c) => c.json({
-      google: config.google ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret } : null,
-      password: config.password ? { minLength: config.password.minLength } : null
-    })
-  );
+  app.get("/auth/config", async (c) => {
+    const methods = await settings.methods();
+    const on = (method) => isOn(method, available, methods);
+    return c.json({
+      google: on("google") ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret } : null,
+      password: on("password") ? { minLength: config.password.minLength } : null
+    });
+  });
   if (config.google) googleRoutes(app, ctx, config.google);
-  if (config.password && ctx.users && ctx.webhook) passwordRoutes(app, ctx, config.password, ctx.users, ctx.webhook);
+  if (config.password && ctx.webhook) passwordRoutes(app, ctx, config.password, users, ctx.webhook);
   const tokenClaims = async (c, cookie, typ) => readToken(await keys, issuer, typ, getCookie(c, cookie));
-  const hasEnded = async (claims) => {
-    if (!claims.sub.startsWith("usr_")) return false;
-    const stored = await ctx.users?.findById(claims.sub);
-    return !stored || stored.sessionVersion !== claims.sv;
-  };
   const checked = async (claims) => {
-    const [ended, user] = await Promise.all([hasEnded(claims), withRoles(userFromClaims(claims))]);
-    return ended ? null : user;
+    const stored = await users.findById(claims.sub);
+    if (!stored || stored.sessionVersion !== claims.sv) return null;
+    const { claims: _, ...user } = userFromClaims(claims);
+    const current = claimsFromJson(stored.claims);
+    return Object.keys(current).length ? { ...user, claims: current } : user;
   };
   const currentSession = async (c) => {
     const session = await tokenClaims(c, SESSION_COOKIE, SESSION_TYP);
     const user = session ? await checked(session) : null;
-    const upToDate = session && user && sameRoles(user.roles ?? [], session.roles ?? []) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
+    const upToDate = session && user && sameClaims(user.claims, session.claims) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
     if (upToDate) return user;
     const renewal = await tokenClaims(c, RENEWAL_COOKIE, RENEWAL_TYP);
     const sameSignIn = session && user && renewal && renewal.sub === session.sub && renewal.sv === session.sv && renewal.email === session.email;
@@ -4730,56 +4955,82 @@ function createApp(config) {
   app.post("/auth/account/delete", async (c) => {
     const user = await currentSession(c);
     if (!user) return c.json({ error: "no_session" }, 401);
-    if (roles && user.email) await roles.remove(normalizeEmail(user.email));
-    const passwordUserId = ctx.users && user.email ? await ctx.users.deleteByEmail(normalizeEmail(user.email)) : null;
+    await users.deleteById(user.id);
     clearSession(c);
-    await ctx.emit("user.deleted", { user, passwordUserId: passwordUserId ?? void 0 });
+    await ctx.emit("user.deleted", { user });
     return c.body(null, 204);
   });
-  if (roles) {
-    const admin = async (c) => {
-      const user = await currentSession(c);
-      if (!user) return { answer: c.json({ error: "no_session" }, 401) };
-      const email = user.email ? normalizeEmail(user.email) : void 0;
-      if (!email || !user.roles?.includes(ADMIN_ROLE)) {
-        return { answer: c.json({ error: "forbidden", message: `Only users with the role "${ADMIN_ROLE}" can manage roles.` }, 403) };
-      }
-      return { email };
-    };
-    const body = async (c) => {
-      const data = await c.req.json().catch(() => null);
-      return data && typeof data === "object" ? data : {};
-    };
-    const invalidEmail = (c) => c.json({ error: "invalid_email", message: "This is not a valid e-mail address." }, 400);
-    app.post("/auth/admin/roles/get", async (c) => {
-      const caller = await admin(c);
-      if ("answer" in caller) return caller.answer;
-      const data = await body(c);
-      if (!isValidEmail(data.email)) return invalidEmail(c);
-      const email = normalizeEmail(data.email);
-      return c.json({ email, roles: await roles.get(email) });
-    });
-    app.post("/auth/admin/roles/set", async (c) => {
-      const caller = await admin(c);
-      if ("answer" in caller) return caller.answer;
-      const data = await body(c);
-      if (!isValidEmail(data.email)) return invalidEmail(c);
-      const names = parseRoles(data.roles);
-      if (!names) {
-        return c.json(
-          {
-            error: "invalid_roles",
-            message: 'roles must be a list of names: lower-case letters, digits, "-" and "_", starting with a letter.'
-          },
-          400
-        );
-      }
-      const email = normalizeEmail(data.email);
-      await roles.set(email, names, caller.email);
-      await ctx.emit("roles.changed", { email, roles: names, by: caller.email });
-      return c.json({ email, roles: names });
-    });
-  }
+  const admin = async (c) => {
+    const user = await currentSession(c);
+    if (!user) return { answer: c.json({ error: "no_session" }, 401) };
+    const email = user.email ? normalizeEmail(user.email) : void 0;
+    if (!email || !isAdmin(user)) {
+      const message2 = `Only users with the role "${ADMIN_ROLE}" can manage claims and settings.`;
+      return { answer: c.json({ error: "forbidden", message: message2 }, 403) };
+    }
+    return { email };
+  };
+  const body = async (c) => {
+    const data = await c.req.json().catch(() => null);
+    return data && typeof data === "object" ? data : {};
+  };
+  const invalidEmail = (c) => c.json({ error: "invalid_email", message: "This is not a valid e-mail address." }, 400);
+  const noUser = (c) => c.json({ error: "user_not_found", message: "No user has this e-mail address." }, 404);
+  app.post("/auth/admin/claims/get", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    if (!isValidEmail(data.email)) return invalidEmail(c);
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c);
+    return c.json({ email: user.emailNormalized, userId: user.id, claims: claimsFromJson(user.claims) });
+  });
+  app.post("/auth/admin/claims/set", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    if (!isValidEmail(data.email)) return invalidEmail(c);
+    const claims = parseClaims(data.claims);
+    if (!claims) {
+      return c.json(
+        {
+          error: "invalid_claims",
+          message: 'claims must be a JSON object of at most 2048 characters whose keys are names (letters, digits and "_", starting with a letter). "roles" must be a list of names of lower-case letters, digits, "-" and "_".'
+        },
+        400
+      );
+    }
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c);
+    await users.updateUser(user.id, { claims: Object.keys(claims).length ? JSON.stringify(claims) : null });
+    const email = user.emailNormalized;
+    await ctx.emit("user.claims_changed", { userId: user.id, email, claims, by: caller.email });
+    return c.json({ email, userId: user.id, claims });
+  });
+  const settingsAnswer = (methods) => ({
+    methods: Object.fromEntries(
+      SIGN_IN_METHODS.map((method) => [method, { available: available(method), enabled: isOn(method, available, methods) }])
+    )
+  });
+  app.post("/auth/admin/settings/get", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    return c.json(settingsAnswer(await settings.methods()));
+  });
+  app.post("/auth/admin/settings/set", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    const invalid2 = (message2) => c.json({ error: "invalid_settings", message: message2 }, 400);
+    const changes = parseMethodSettings(data.methods);
+    if (!changes) return invalid2(`methods must be an object with true or false for ${SIGN_IN_METHODS.join(" and/or ")}.`);
+    const methods = await settings.changeMethods((current) => {
+      const next = { ...current, ...changes };
+      return anyOn(available, next) ? next : null;
+    }, caller.email);
+    if (!methods) return invalid2("At least one sign-in method must stay on.");
+    return c.json(settingsAnswer(methods));
+  });
   return app;
 }
 
@@ -4844,19 +5095,18 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   if (clientId && !clientId.endsWith(".apps.googleusercontent.com")) {
     throw new ConfigError(`GOOGLE_CLIENT_ID must end with ".apps.googleusercontent.com" but is "${clientId}".`);
   }
-  const sendsEmails = !!(overrides.store || read("DATABASE_URL"));
-  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"), sendsEmails);
-  if (sendsEmails && !webhook) {
+  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
+  const sendsEmails = !!webhook && REQUIRED_EMAIL_TYPES.every((type) => webhook.events.has(type));
+  const password = sendsEmails ? { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")) } : void 0;
+  if (!clientId && !password) {
     throw new ConfigError(
-      `WEBHOOK_URL is not set. E-mail & password sign-in sends its e-mails through your webhook. For development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See "Webhooks" in docs/server.md.`
+      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered,email.no_password. See docs/server.md.`
     );
   }
   const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
-  let password;
-  if (store) password = { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")), store };
-  if (!clientId && !password) {
+  if (!store) {
     throw new ConfigError(
-      "No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in and/or DATABASE_URL (e.g. sqlite:./madauth.db) for e-mail & password sign-in. See docs/server.md."
+      "DATABASE_URL is not set. madAuth stores every user, whichever way they sign in: set e.g. DATABASE_URL=sqlite:./madauth.db or DATABASE_URL=dynamodb:<table>. See docs/server.md."
     );
   }
   const ttlValue = read("SESSION_TTL");
@@ -4879,6 +5129,7 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
     renewalTtlSeconds,
     cookieDomain: read("COOKIE_DOMAIN"),
     google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
+    store,
     password,
     webhook
   };
@@ -4924,8 +5175,9 @@ async function dynamoDbStore(tableName2) {
   const { createDynamoDbAdapter: createDynamoDbAdapter2 } = await Promise.resolve().then(() => (init_dynamodb(), dynamodb_exports));
   return createDynamoDbAdapter2({ tableName: tableName2 });
 }
+var RENAMED_TYPES = { "password.reset": "email.password_reset", "roles.changed": "user.claims_changed" };
 var LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]", "host.docker.internal"];
-function webhookFromEnv(url, secret, events, sendsEmails) {
+function webhookFromEnv(url, secret, events) {
   if (!url) {
     if (secret || events) throw new ConfigError("WEBHOOK_SECRET and WEBHOOK_EVENTS need WEBHOOK_URL.");
     return void 0;
@@ -4955,24 +5207,22 @@ WEBHOOK_SECRET=${generateWebhookSecret()}
   const allTypes = `All types: ${WEBHOOK_TYPES.join(", ")}. See "Webhooks" in docs/server.md.`;
   if (!selected.size) {
     throw new ConfigError(
-      "WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. " + (sendsEmails ? `E-mail & password sign-in needs ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
+      `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
+
+WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered,email.no_password
 
-WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered
+For one that only wants to know who signed in:
 
-` : "For example:\n\nWEBHOOK_EVENTS=user.signed_in\n\n") + allTypes
+WEBHOOK_EVENTS=user.signed_in
+
+` + allTypes
     );
   }
   const unknown = [...selected].filter((e) => !WEBHOOK_TYPES.includes(e));
   if (unknown.length) {
-    throw new ConfigError(`WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. Known types: ${WEBHOOK_TYPES.join(", ")}.`);
-  }
-  const missing = sendsEmails ? REQUIRED_EMAIL_TYPES.filter((type) => !selected.has(type)) : [];
-  if (missing.length) {
+    const renamed = unknown.filter((e) => e in RENAMED_TYPES).map((e) => `${e} is now ${RENAMED_TYPES[e]}`);
     throw new ConfigError(
-      `WEBHOOK_EVENTS lacks ${missing.join(" and ")}. E-mail & password sign-in can't work without these e-mails, so your webhook receiver must send them:
-
-WEBHOOK_EVENTS=${[...selected, ...missing].join(",")}
-`
+      `WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. ${renamed.length ? `${renamed.join("; ")}. ` : ""}Known types: ${WEBHOOK_TYPES.join(", ")}.`
     );
   }
   return { url: parsed.href, secret, events: selected };