@madauth/server 0.3.0-beta.1 → 0.4.0-beta.1

package/dist/{chunk-DCDTO5LG.js → chunk-A7UYZRBL.js}

@@ -57,6 +57,7 @@ function userFromClaims(claims) {
   if (claims.name) user.name = claims.name;
   if (claims.picture) user.picture = claims.picture;
   if (claims.claims && typeof claims.claims === "object" && Object.keys(claims.claims).length) user.claims = claims.claims;
+  if (Array.isArray(claims.amr)) user.amr = claims.amr.filter((value) => typeof value === "string");
   return user;
 }
 

package/dist/{chunk-CD7Y4T66.js → chunk-GA4TF7EI.js}

@@ -1,6 +1,6 @@
 // src/store/schema.ts
 var madauthSchema = {
-  version: 4,
+  version: 5,
   models: {
     /** Someone who signed in, whichever way: the e-mail address is the identity shared by the sign-in methods. */
     user: {
@@ -19,7 +19,10 @@ var madauthSchema = {
         createdAt: { type: "number" }
       }
     },
-    /** How a user signs in. `key` is `password:<userId>` or `google:<sub>`; later e.g. `totp:<userId>`. */
+    /**
+     * How a user signs in. `key` is `password:<userId>`, `google:<sub>` or `totp:<userId>` (the authenticator
+     * app, whose `secret` is encrypted).
+     */
     account: {
       fields: {
         id: { type: "string", primaryKey: true },
@@ -30,6 +33,25 @@ var madauthSchema = {
         lockedUntil: { type: "number" },
         /** The address the provider reported at the last sign-in, e.g. Google's current primary address (since version 4). */
         email: { type: "string", nullable: true },
+        /** The time step of the last authenticator code that was accepted, so a code works once; 0 before (since version 5). */
+        lastUsedStep: { type: "number" },
+        /**
+         * The setup an authenticator secret came from; its recovery codes carry the same id, so the app and
+         * its codes always belong together. Empty for other accounts (since version 5).
+         */
+        setupId: { type: "string", nullable: true },
+        createdAt: { type: "number" }
+      }
+    },
+    /**
+     * A recovery code of a user's authenticator app (since version 5). `id` is the code's keyed hash; the
+     * record goes when the code is used. It works only while the account's `setupId` is its own.
+     */
+    recoveryCode: {
+      fields: {
+        id: { type: "string", primaryKey: true },
+        userId: { type: "string", index: true },
+        setupId: { type: "string" },
         createdAt: { type: "number" }
       }
     },

package/dist/{chunk-ODITZLMM.js → chunk-ISJGOCF3.js}

@@ -8,7 +8,7 @@ import {
   WEBHOOK_TYPES,
   checkWebhookSecret,
   generateWebhookSecret
-} from "./chunk-NPNM26J3.js";
+} from "./chunk-Y7ZSUROX.js";
 
 // src/claims.ts
 var ADMIN_ROLE = "admin";
@@ -67,75 +67,13 @@ function isAdmin(user) {
   return rolesOf(user).includes(ADMIN_ROLE);
 }
 
-// src/settings.ts
-var SIGN_IN_METHODS = ["google", "password"];
-var METHODS_SETTING = "methods";
-function parseMethodSettings(input) {
-  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
-  const settings = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (!SIGN_IN_METHODS.includes(key) || typeof value !== "boolean") return null;
-    settings[key] = value;
-  }
-  return settings;
-}
-var MAX_TRIES = 3;
-var Settings = class {
-  constructor(store) {
-    this.store = store;
-  }
-  /** The setting's value, or undefined if it was never set. */
-  async get(id) {
-    return (await this.read(id)).value;
-  }
-  /** The stored JSON and what it holds; both undefined if the setting was never set. */
-  async read(id) {
-    const record = await this.store.findOne("setting", { id });
-    if (typeof record?.value !== "string") return {};
-    try {
-      return { json: record.value, value: JSON.parse(record.value) };
-    } catch {
-      return { json: record.value };
-    }
-  }
-  /**
-   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
-   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
-   * again with the newer value. Resolves to the new value, or null if `apply` refused.
-   * `updatedBy` is the address of the admin, or null for the command line.
-   */
-  async change(id, apply, updatedBy) {
-    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
-      const { json, value } = await this.read(id);
-      const next = apply(value);
-      if (next === null) return null;
-      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
-      const written = json === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json }, patch) === 1;
-      if (written) return next;
-    }
-    throw new Error(`Setting "${id}" kept changing; try again.`);
-  }
-  /** Replaces the setting. */
-  async set(id, value, updatedBy) {
-    await this.change(id, () => value, updatedBy);
-  }
-  /** Which sign-in methods are on; a method that was never switched off is on. */
-  async methods() {
-    return parseMethodSettings(await this.get(METHODS_SETTING)) ?? {};
-  }
-  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
-  async changeMethods(apply, updatedBy) {
-    return this.change(METHODS_SETTING, (current) => apply(parseMethodSettings(current) ?? {}), updatedBy);
-  }
-};
-function isOn(method, available, methods) {
-  return available(method) && methods[method] !== false;
+// src/config.ts
+function sendsVerificationEmails(config) {
+  return !!config.webhook?.events.has("email.verify");
 }
-function anyOn(available, methods) {
-  return SIGN_IN_METHODS.some((method) => isOn(method, available, methods));
+function methodConfig(config) {
+  return { google: config.google, password: config.password, emailVerification: sendsVerificationEmails(config) };
 }
-
-// src/config.ts
 var envVars = {
   MADAUTH_ISSUER: true,
   MADAUTH_SIGNING_KEY: true,
@@ -144,6 +82,7 @@ var envVars = {
   GOOGLE_CLIENT_SECRET: false,
   DATABASE_URL: true,
   PASSWORD_MIN_LENGTH: false,
+  TOTP_ISSUER: false,
   WEBHOOK_URL: false,
   WEBHOOK_SECRET: false,
   WEBHOOK_EVENTS: false,
@@ -214,9 +153,10 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
   const sendsEmails = !!webhook && REQUIRED_EMAIL_TYPES.every((type) => webhook.events.has(type));
   const password = sendsEmails ? { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")) } : void 0;
-  if (!clientId && !password) {
+  const emailVerification = !!webhook && webhook.events.has("email.verify");
+  if (!clientId && !password && !emailVerification) {
     throw new ConfigError(
-      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See docs/server.md.`
+      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails: e-mail & password sign-in needs email.verify and email.reset, sign-up with the authenticator app needs email.verify. For development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered,email.no_password. See docs/server.md.`
     );
   }
   const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
@@ -244,6 +184,7 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
     sessionTtlSeconds,
     renewalTtlSeconds,
     cookieDomain: read("COOKIE_DOMAIN"),
+    totpIssuer: read("TOTP_ISSUER"),
     google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
     store,
     password,
@@ -333,7 +274,7 @@ WEBHOOK_SECRET=${generateWebhookSecret()}
     throw new ConfigError(
       `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
 
-WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered
+WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered,email.no_password
 
 For one that only wants to know who signed in:
 
@@ -352,6 +293,125 @@ WEBHOOK_EVENTS=user.signed_in
   return { url: parsed.href, secret, events: selected };
 }
 
+// src/settings.ts
+var SIGN_IN_METHODS = ["google", "password", "totp"];
+var METHODS_WITH_SECOND_FACTOR = ["google", "password"];
+var SECOND_FACTOR_POLICIES = ["none", "optional", "required"];
+var METHODS_SETTING = "methods";
+var isSignInMethod = (value) => SIGN_IN_METHODS.includes(value);
+var isPolicy = (value) => SECOND_FACTOR_POLICIES.includes(value);
+function parseMethodSettings(input, options = {}) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const settings = {};
+  for (const [method, value] of Object.entries(input)) {
+    if (!isSignInMethod(method)) return null;
+    if (typeof value === "boolean") {
+      if (!options.booleans) return null;
+      if (value) settings[method] = {};
+      continue;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+    const setting = {};
+    for (const [field, fieldValue] of Object.entries(value)) {
+      if (field !== "secondFactor" || method === "totp" || !isPolicy(fieldValue)) return null;
+      setting.secondFactor = fieldValue;
+    }
+    settings[method] = setting;
+  }
+  return settings;
+}
+function isConfigured(config, method) {
+  if (method === "google") return !!config.google;
+  if (method === "password") return !!config.password;
+  return true;
+}
+function canSignUp(config, method) {
+  return method === "totp" ? !!config.emailVerification : isConfigured(config, method);
+}
+function initialMethods(config) {
+  const methods = {};
+  if (config.google) methods.google = { secondFactor: "none" };
+  if (config.password) methods.password = { secondFactor: "none" };
+  if (!config.google && !config.password && config.emailVerification) methods.totp = {};
+  return methods;
+}
+var MAX_TRIES = 3;
+var Settings = class {
+  /** `initial` is what counts until the methods are set, see {@link initialMethods}. */
+  constructor(store, initial = {}) {
+    this.store = store;
+    this.initial = initial;
+    this.warned = false;
+  }
+  /** The setting's value, or undefined if it was never set. */
+  async get(id) {
+    return (await this.read(id)).value;
+  }
+  /** The stored JSON and what it holds; both undefined if the setting was never set. */
+  async read(id) {
+    const record = await this.store.findOne("setting", { id });
+    if (typeof record?.value !== "string") return {};
+    try {
+      return { json: record.value, value: JSON.parse(record.value) };
+    } catch {
+      return { json: record.value };
+    }
+  }
+  /**
+   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
+   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
+   * again with the newer value. Resolves to the new value, or null if `apply` refused.
+   * `updatedBy` is the address of the admin, or null for the command line.
+   */
+  async change(id, apply, updatedBy) {
+    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
+      const { json, value } = await this.read(id);
+      const next = apply(value);
+      if (next === null) return null;
+      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
+      const written = json === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json }, patch) === 1;
+      if (written) return next;
+    }
+    throw new Error(`Setting "${id}" kept changing; try again.`);
+  }
+  /** Replaces the setting. */
+  async set(id, value, updatedBy) {
+    await this.change(id, () => value, updatedBy);
+  }
+  /** Which sign-in methods are on, with their settings; the initial ones until an admin set them. */
+  async methods() {
+    return this.current(await this.get(METHODS_SETTING));
+  }
+  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
+  async changeMethods(apply, updatedBy) {
+    return this.change(METHODS_SETTING, (current) => apply(this.current(current)), updatedBy);
+  }
+  /** The stored methods, or the initial ones if nothing (usable) is stored. */
+  current(stored) {
+    if (stored === void 0) return this.initial;
+    const parsed = parseMethodSettings(stored);
+    if (parsed) return parsed;
+    if (!this.warned) {
+      this.warned = true;
+      console.warn("[madauth] The stored sign-in methods are not in the form this version expects (they were set by an older one?). Set them again with set-methods; until then the initial methods count.");
+    }
+    return this.initial;
+  }
+};
+function isOn(method, configured, methods) {
+  return configured(method) && methods[method] !== void 0;
+}
+function policyOf(method, methods) {
+  return methods[method]?.secondFactor ?? "none";
+}
+function anyOn(signsUp, methods) {
+  return SIGN_IN_METHODS.some((method) => signsUp(method) && methods[method] !== void 0);
+}
+function authenticatorOn(configured, methods) {
+  if (isOn("totp", configured, methods)) return true;
+  return METHODS_WITH_SECOND_FACTOR.some((method) => isOn(method, configured, methods) && policyOf(method, methods) !== "none");
+}
+
 // src/password.ts
 import { createHash, createHmac, hkdfSync, randomBytes, randomInt, scrypt, timingSafeEqual } from "crypto";
 var HASH_PARAMS = { logN: 15, r: 8, p: 3 };
@@ -438,6 +498,9 @@ function passwordAccountKey(userId) {
 function googleAccountKey(sub) {
   return `google:${sub}`;
 }
+function totpAccountKey(userId) {
+  return `totp:${userId}`;
+}
 function toMadauthUser(user, profile = {}) {
   const result = { id: user.id, email: user.email };
   const name = user.name ?? profile.name;
@@ -466,12 +529,32 @@ var Users = class {
   async passwordAccount(userId) {
     return this.findAccountByKey(passwordAccountKey(userId));
   }
+  /** The user's authenticator app, if they set one up. */
+  async totpAccount(userId) {
+    return this.findAccountByKey(totpAccountKey(userId));
+  }
+  /** Whether the user has any way to sign in; a sign-up with the authenticator app has none until it is set up. */
+  async hasAccounts(userId) {
+    return (await this.store.findMany("account", { userId }, { limit: 1 })).length > 0;
+  }
+  /**
+   * The ways the user can sign in, from their accounts: e.g. `['google']` for a user without a password.
+   * The authenticator app counts only when it signs in on its own (`methods` lists it); as a second
+   * factor it is a step of another method, not a way in.
+   */
+  async signInMethods(userId, methods) {
+    const accounts = await this.store.findMany("account", { userId });
+    const keys = accounts.map((account) => String(account.key).split(":")[0]);
+    return SIGN_IN_METHODS.filter((method) => keys.includes(method) && (method !== "totp" || methods.totp !== void 0));
+  }
   async findAccountByKey(key) {
     return await this.store.findOne("account", { key });
   }
   /**
-   * Creates a user with their first account. Resolves to null if the e-mail address or the account key is
-   * taken. `account.key` is `password:<userId>` for a password (its hash as `secret`), or e.g. `google:<sub>`.
+   * Creates a user, with their first account if given. Resolves to null if the e-mail address or the
+   * account key is taken. `account.key` is `password:<userId>` for a password (its hash as `secret`), or
+   * e.g. `google:<sub>`. A sign-up with the authenticator app creates the user without an account: the app
+   * is set up once the address is confirmed.
    */
   async createUser(data) {
     const user = {
@@ -487,6 +570,7 @@ var Users = class {
       createdAt: Date.now()
     };
     if (!await this.store.create("user", user)) return null;
+    if (!data.account) return user;
     const account = typeof data.account === "function" ? data.account(user.id) : data.account;
     if (!await this.linkAccount(user.id, account)) {
       await this.store.delete("user", { id: user.id });
@@ -508,6 +592,16 @@ var Users = class {
   async deleteAccount(id) {
     await this.store.delete("account", { id });
   }
+  /** Removes a sign-in method by its key. Resolves to false if there was none. */
+  async unlinkAccount(key) {
+    return await this.store.delete("account", { key }) === 1;
+  }
+  /** Removes the user's authenticator app and recovery codes. Resolves to false if they had no app. */
+  async removeTotp(userId) {
+    const removed = await this.unlinkAccount(totpAccountKey(userId));
+    await this.clearRecoveryCodes(userId);
+    return removed;
+  }
   /** Adds a sign-in method to a user. Resolves to null if the account key is taken. */
   async linkAccount(userId, account) {
     const record = {
@@ -518,10 +612,70 @@ var Users = class {
       failedAttempts: 0,
       lockedUntil: 0,
       email: account.email ?? null,
+      lastUsedStep: account.lastUsedStep ?? 0,
+      setupId: account.setupId ?? null,
       createdAt: Date.now()
     };
     return await this.store.create("account", record) ? record : null;
   }
+  /**
+   * Writes the secret of a confirmed setup over the authenticator account, only if the account still has the
+   * setup it had when this setup started (`replaces`): the write count decides, so of two setups confirmed
+   * at once exactly one wins, and the other is told to start again.
+   */
+  async confirmTotpSetup(accountId, replaces, patch) {
+    return await this.store.update("account", { id: accountId, setupId: replaces }, patch) === 1;
+  }
+  /**
+   * Marks the time step of an accepted authenticator code as used and resets the failed attempts, only if
+   * no other request accepted a code meanwhile: the write count decides, so the same code sent twice signs
+   * in once.
+   */
+  async useTotpStep(account, step) {
+    const changed = await this.store.update(
+      "account",
+      { id: account.id, lastUsedStep: account.lastUsedStep ?? null },
+      { lastUsedStep: step, failedAttempts: 0, lockedUntil: 0 }
+    );
+    return changed === 1;
+  }
+  /** Replaces the user's recovery codes with new ones, given as their hashes. */
+  /** Stores the recovery codes of a setup (their hashes), next to whatever codes the user has. */
+  async addRecoveryCodes(userId, setupId, hashes) {
+    const createdAt = Date.now();
+    for (const id of hashes) await this.store.create("recoveryCode", { id, userId, setupId, createdAt });
+  }
+  /** New recovery codes for the user's current app: the codes they had before stop working. */
+  async replaceRecoveryCodes(account, hashes) {
+    const before = await this.store.findMany("recoveryCode", { userId: account.userId });
+    await this.addRecoveryCodes(account.userId, account.setupId ?? "", hashes);
+    for (const old of before) await this.store.delete("recoveryCode", { id: old.id });
+  }
+  /**
+   * Uses up the recovery code with this hash for the user's authenticator account. Resolves to false if it
+   * is not theirs, belongs to another setup than the account's, or was used already.
+   */
+  async consumeRecoveryCode(account, hash) {
+    const record = await this.store.findOne("recoveryCode", { id: hash });
+    if (!record || record.userId !== account.userId || record.setupId !== (account.setupId ?? "")) return false;
+    return await this.store.delete("recoveryCode", { id: hash }) === 1;
+  }
+  /** How many recovery codes of the account's setup are left. */
+  async countRecoveryCodes(account) {
+    const codes = await this.store.findMany("recoveryCode", { userId: account.userId });
+    return codes.filter((code) => code.setupId === (account.setupId ?? "")).length;
+  }
+  /** Deletes the user's recovery codes: all of them, or only those of one setup, or all but one setup's. */
+  async clearRecoveryCodes(userId, which = {}) {
+    if (which.only === void 0 && which.except === void 0) {
+      await this.store.delete("recoveryCode", { userId });
+      return;
+    }
+    for (const code of await this.store.findMany("recoveryCode", { userId })) {
+      const match = which.only !== void 0 ? code.setupId === which.only : code.setupId !== which.except;
+      if (match) await this.store.delete("recoveryCode", { id: code.id });
+    }
+  }
   /**
    * Deletes the user and everything stored for them. Resolves to false if there is no such user (any more).
    */
@@ -532,6 +686,7 @@ var Users = class {
     try {
       await this.store.delete("account", { userId: user.id });
       await this.store.delete("verification", { userId: user.id });
+      await this.store.delete("recoveryCode", { userId: user.id });
     } catch (e) {
       console.error(`[madauth] Deleted user ${user.id}, but not all of their records: ${e.message}`);
     }
@@ -540,8 +695,9 @@ var Users = class {
   async updateUser(id, patch) {
     await this.store.update("user", { id }, patch);
   }
+  /** Changes an account. Resolves to false if it is gone meanwhile. */
   async updateAccount(id, patch) {
-    await this.store.update("account", { id }, patch);
+    return await this.store.update("account", { id }, patch) === 1;
   }
   /**
    * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
@@ -574,6 +730,11 @@ var Users = class {
     await this.store.create("verification", record);
     return { token, code };
   }
+  /** The user ID a link token belongs to, without using the verification up; null if invalid, expired or used. */
+  async peekLinkToken(token, purpose) {
+    const record = await this.store.findOne("verification", { id: hashLinkToken(token), purpose });
+    return record && record.expiresAt > Date.now() ? record.userId : null;
+  }
   /** Uses up the verification a link token belongs to. Resolves to its user ID, or null if invalid, expired or used. */
   async consumeLinkToken(token, purpose) {
     const id = hashLinkToken(token);
@@ -627,6 +788,14 @@ export {
   sameClaims,
   claimsFromJson,
   isAdmin,
+  sendsVerificationEmails,
+  methodConfig,
+  envVars,
+  resolveEnv,
+  ConfigError,
+  loadConfig,
+  loadUserStoreConfig,
+  loadStore,
   MAX_PASSWORD_LENGTH,
   hashPassword,
   verifyPassword,
@@ -635,19 +804,24 @@ export {
   normalizeEmail,
   isValidEmail,
   deriveCodeKey,
-  passwordAccountKey,
-  googleAccountKey,
-  toMadauthUser,
-  Users,
+  hashCode,
+  safeEqual,
   SIGN_IN_METHODS,
+  METHODS_WITH_SECOND_FACTOR,
+  SECOND_FACTOR_POLICIES,
   parseMethodSettings,
+  isConfigured,
+  canSignUp,
+  initialMethods,
   Settings,
   isOn,
+  policyOf,
   anyOn,
-  envVars,
-  resolveEnv,
-  ConfigError,
-  loadConfig,
-  loadUserStoreConfig,
-  loadStore
+  authenticatorOn,
+  newId,
+  passwordAccountKey,
+  googleAccountKey,
+  totpAccountKey,
+  toMadauthUser,
+  Users
 };

package/dist/{chunk-56MOVFO4.js → chunk-OMIX3ERC.js}

@@ -1,10 +1,10 @@
 import {
   madauthSchema
-} from "./chunk-CD7Y4T66.js";
+} from "./chunk-GA4TF7EI.js";
 
 // src/store/sql.ts
 function tableName(model) {
-  return `madauth_${model}`;
+  return `madauth_${columnName(model)}`;
 }
 function columnName(field) {
   return field.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
@@ -45,6 +45,15 @@ var upgrades = [
       `DROP TABLE ${tableName("role")};`,
       createTablesSql(dialect, { version: 4, models: { setting: madauthSchema.models.setting } })
     ].join("\n")
+  },
+  {
+    // The authenticator app: which code was used last, and the recovery codes.
+    version: 5,
+    sql: (dialect) => [
+      `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("lastUsedStep")} ${columnTypes[dialect].number} NOT NULL DEFAULT 0;`,
+      `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("setupId")} ${columnTypes[dialect].string};`,
+      createTablesSql(dialect, { version: 5, models: { recoveryCode: madauthSchema.models.recoveryCode } })
+    ].join("\n")
   }
 ];
 function upgradeTablesSql(dialect, fromVersion) {

package/dist/{chunk-NPNM26J3.js → chunk-Y7ZSUROX.js}

@@ -4,13 +4,17 @@ var WEBHOOK_TYPES = [
   "email.verify",
   "email.reset",
   "email.already_registered",
+  "email.no_password",
   "signup.before",
   "user.created",
   "email.verified",
   "email.password_reset",
   "user.signed_in",
   "user.deleted",
-  "user.claims_changed"
+  "user.claims_changed",
+  "totp.enabled",
+  "totp.disabled",
+  "totp.recovery_code_used"
 ];
 var WEBHOOK_TIMEOUT_MS = 1e4;
 var MAX_LOCALE_LENGTH = 35;

package/dist/{config-DEBYi8hb.d.ts → config-DkE_2D3-.d.ts}

@@ -1,6 +1,6 @@
 import { JWK, JWTVerifyGetKey } from 'jose';
-import { S as StoreAdapter } from './schema-3yhCc2jH.js';
-import { W as WebhookSettings } from './webhook-DCDP6SaE.js';
+import { S as StoreAdapter } from './schema-DTeiSuQB.js';
+import { W as WebhookSettings } from './webhook-B6P50ocX.js';
 
 interface MadauthConfig {
     /** Public base URL of the server (MADAUTH_ISSUER). */
@@ -15,6 +15,8 @@ interface MadauthConfig {
     renewalTtlSeconds: number;
     /** Cookie domain, e.g. `.example.com` (COOKIE_DOMAIN). */
     cookieDomain?: string;
+    /** The name authenticator apps show next to the account (TOTP_ISSUER). Default: the host of the app that asked for the setup. */
+    totpIssuer?: string;
     /** Google sign-in; off when GOOGLE_CLIENT_ID is not set. */
     google?: {
         /** OAuth web client ID (GOOGLE_CLIENT_ID). */
@@ -45,6 +47,7 @@ declare const envVars: {
     readonly GOOGLE_CLIENT_SECRET: false;
     readonly DATABASE_URL: true;
     readonly PASSWORD_MIN_LENGTH: false;
+    readonly TOTP_ISSUER: false;
     readonly WEBHOOK_URL: false;
     readonly WEBHOOK_SECRET: false;
     readonly WEBHOOK_EVENTS: false;

package/dist/dynamodb.js

@@ -1,6 +1,6 @@
 import {
   madauthSchema
-} from "./chunk-CD7Y4T66.js";
+} from "./chunk-GA4TF7EI.js";
 
 // src/store/dynamodb.ts
 var SORT_KEY = "#";

package/dist/entry/azure.d.ts

@@ -1,7 +1,7 @@
-import { E as EntryOptions } from '../config-DEBYi8hb.js';
+import { E as EntryOptions } from '../config-DkE_2D3-.js';
 import 'jose';
-import '../schema-3yhCc2jH.js';
-import '../webhook-DCDP6SaE.js';
+import '../schema-DTeiSuQB.js';
+import '../webhook-B6P50ocX.js';
 
 /**
  * Registers madAuth as an Azure Functions v4 HTTP function that handles every route. Pass `store` to use your

package/dist/entry/azure.js

@@ -1,13 +1,13 @@
 import {
   createApp
-} from "../chunk-ZSBKNV5W.js";
-import "../chunk-DCDTO5LG.js";
+} from "../chunk-3PACOYTG.js";
+import "../chunk-A7UYZRBL.js";
 import {
   loadConfig,
   resolveEnv
-} from "../chunk-ODITZLMM.js";
+} from "../chunk-ISJGOCF3.js";
 import "../chunk-JDQLSL36.js";
-import "../chunk-NPNM26J3.js";
+import "../chunk-Y7ZSUROX.js";
 
 // src/entry/azure.ts
 import { app } from "@azure/functions";

package/dist/entry/lambda.d.ts

@@ -1,8 +1,8 @@
 import { LambdaEvent, LambdaContext, handle } from 'hono/aws-lambda';
-import { E as EntryOptions } from '../config-DEBYi8hb.js';
+import { E as EntryOptions } from '../config-DkE_2D3-.js';
 import 'jose';
-import '../schema-3yhCc2jH.js';
-import '../webhook-DCDP6SaE.js';
+import '../schema-DTeiSuQB.js';
+import '../webhook-B6P50ocX.js';
 
 type LambdaHandler = (event: LambdaEvent, context: LambdaContext) => ReturnType<ReturnType<typeof handle>>;
 /**

package/dist/entry/lambda.js

@@ -1,13 +1,13 @@
 import {
   createApp
-} from "../chunk-ZSBKNV5W.js";
-import "../chunk-DCDTO5LG.js";
+} from "../chunk-3PACOYTG.js";
+import "../chunk-A7UYZRBL.js";
 import {
   loadConfig,
   resolveEnv
-} from "../chunk-ODITZLMM.js";
+} from "../chunk-ISJGOCF3.js";
 import "../chunk-JDQLSL36.js";
-import "../chunk-NPNM26J3.js";
+import "../chunk-Y7ZSUROX.js";
 
 // src/entry/lambda.ts
 import { handle } from "hono/aws-lambda";