@madauth/server 0.3.0-beta.1 → 0.4.0-beta.1

package/dist/standalone/lambda.mjs

@@ -15,7 +15,7 @@ var init_schema = __esm({
   "src/store/schema.ts"() {
     "use strict";
     madauthSchema = {
-      version: 4,
+      version: 5,
       models: {
         /** Someone who signed in, whichever way: the e-mail address is the identity shared by the sign-in methods. */
         user: {
@@ -34,7 +34,10 @@ var init_schema = __esm({
             createdAt: { type: "number" }
           }
         },
-        /** How a user signs in. `key` is `password:<userId>` or `google:<sub>`; later e.g. `totp:<userId>`. */
+        /**
+         * How a user signs in. `key` is `password:<userId>`, `google:<sub>` or `totp:<userId>` (the authenticator
+         * app, whose `secret` is encrypted).
+         */
         account: {
           fields: {
             id: { type: "string", primaryKey: true },
@@ -45,6 +48,25 @@ var init_schema = __esm({
             lockedUntil: { type: "number" },
             /** The address the provider reported at the last sign-in, e.g. Google's current primary address (since version 4). */
             email: { type: "string", nullable: true },
+            /** The time step of the last authenticator code that was accepted, so a code works once; 0 before (since version 5). */
+            lastUsedStep: { type: "number" },
+            /**
+             * The setup an authenticator secret came from; its recovery codes carry the same id, so the app and
+             * its codes always belong together. Empty for other accounts (since version 5).
+             */
+            setupId: { type: "string", nullable: true },
+            createdAt: { type: "number" }
+          }
+        },
+        /**
+         * A recovery code of a user's authenticator app (since version 5). `id` is the code's keyed hash; the
+         * record goes when the code is used. It works only while the account's `setupId` is its own.
+         */
+        recoveryCode: {
+          fields: {
+            id: { type: "string", primaryKey: true },
+            userId: { type: "string", index: true },
+            setupId: { type: "string" },
             createdAt: { type: "number" }
           }
         },
@@ -76,7 +98,7 @@ var init_schema = __esm({
 
 // src/store/sql.ts
 function tableName(model) {
-  return `madauth_${model}`;
+  return `madauth_${columnName(model)}`;
 }
 function columnName(field) {
   return field.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
@@ -144,6 +166,15 @@ var init_sql = __esm({
           `DROP TABLE ${tableName("role")};`,
           createTablesSql(dialect, { version: 4, models: { setting: madauthSchema.models.setting } })
         ].join("\n")
+      },
+      {
+        // The authenticator app: which code was used last, and the recovery codes.
+        version: 5,
+        sql: (dialect) => [
+          `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("lastUsedStep")} ${columnTypes[dialect].number} NOT NULL DEFAULT 0;`,
+          `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("setupId")} ${columnTypes[dialect].string};`,
+          createTablesSql(dialect, { version: 5, models: { recoveryCode: madauthSchema.models.recoveryCode } })
+        ].join("\n")
       }
     ];
   }
@@ -296,16 +327,16 @@ function stillMatches(where) {
   });
   return { text: parts.join(" AND "), names, values };
 }
-function failedWrite(error) {
-  const { name, CancellationReasons } = error;
+function failedWrite(error2) {
+  const { name, CancellationReasons } = error2;
   if (name === "ConditionalCheckFailedException") return "refused";
-  if (name && RETRYABLE_ERRORS.includes(name)) return { retry: error };
+  if (name && RETRYABLE_ERRORS.includes(name)) return { retry: error2 };
   if (name === "TransactionCanceledException") {
     const reasons = (CancellationReasons ?? []).map((r) => r.Code ?? "None").filter((code) => code !== "None");
     if (reasons.includes("ConditionalCheckFailed")) return "refused";
-    if (reasons.length && reasons.every((code) => RETRYABLE_REASONS.includes(code))) return { retry: error };
+    if (reasons.length && reasons.every((code) => RETRYABLE_REASONS.includes(code))) return { retry: error2 };
   }
-  throw error;
+  throw error2;
 }
 function createDynamoDbAdapter(options) {
   const { tableName: tableName2 } = options;
@@ -534,9 +565,9 @@ var handle = (app, { isContentTypeBinary } = { isContentTypeBinary: void 0 }) =>
     try {
       req = processor.createRequest(event);
       requestContext = getRequestContext(event);
-    } catch (error) {
-      console.error("Error processing request:", error);
-      const errorResponse = error instanceof TypeError ? new Response("Invalid request", { status: 400 }) : new Response("Internal Server Error", { status: 500 });
+    } catch (error2) {
+      console.error("Error processing request:", error2);
+      const errorResponse = error2 instanceof TypeError ? new Response("Invalid request", { status: 400 }) : new Response("Internal Server Error", { status: 500 });
       return processor.createResult(event, errorResponse, { isContentTypeBinary });
     }
     const res = await app.fetch(req, {
@@ -568,9 +599,9 @@ var EventProcessor = class {
       method: this.getMethod(event)
     };
     if (event.body) {
-      const body = event.isBase64Encoded ? decodeBase64(event.body) : new TextEncoder().encode(event.body);
-      requestInit.body = body;
-      headers.set("content-length", body.length.toString());
+      const body2 = event.isBase64Encoded ? decodeBase64(event.body) : new TextEncoder().encode(event.body);
+      requestInit.body = body2;
+      headers.set("content-length", body2.length.toString());
     }
     return new Request(url, requestInit);
   }
@@ -1070,10 +1101,10 @@ var HonoRequest = class {
     const { bodyCache, raw: raw2 } = this;
     const cachedBody = bodyCache[key];
     if (cachedBody) return cachedBody;
-    for (const anyCachedKey in bodyCache) return bodyCache[anyCachedKey].then((body) => {
-      if (anyCachedKey === "json") body = JSON.stringify(body);
+    for (const anyCachedKey in bodyCache) return bodyCache[anyCachedKey].then((body2) => {
+      if (anyCachedKey === "json") body2 = JSON.stringify(body2);
       const contentType = anyCachedKey === "formData" ? void 0 : raw2.headers.get("content-type");
-      return new Response(body, { headers: contentType ? { "Content-Type": contentType } : void 0 })[key]();
+      return new Response(body2, { headers: contentType ? { "Content-Type": contentType } : void 0 })[key]();
     });
     return bodyCache[key] = raw2[key]();
   };
@@ -1298,7 +1329,7 @@ var setDefaultContentType = (contentType, headers) => {
     ...headers
   };
 };
-var createResponseInstance = (body, init) => new Response(body, init);
+var createResponseInstance = (body2, init) => new Response(body2, init);
 var Context = class {
   #rawRequest;
   #req;
@@ -3674,8 +3705,8 @@ async function importWithAlgCache(cache2, jwk, entry) {
       if (key.type !== "public")
         throw new JWKSInvalid("JSON Web Key Set members must be public keys");
       return cached[alg] = key, key;
-    }).catch((error) => {
-      throw cached[alg] === pending && delete cached[alg], error;
+    }).catch((error2) => {
+      throw cached[alg] === pending && delete cached[alg], error2;
     });
     cached[alg] = pending;
   }
@@ -3701,14 +3732,14 @@ function createLocalJWKSet(jwks) {
     if (!length)
       throw new JWKSNoMatchingKey();
     if (length !== 1) {
-      const error = new JWKSMultipleMatchingKeys();
-      throw error[Symbol.asyncIterator] = async function* () {
+      const error2 = new JWKSMultipleMatchingKeys();
+      throw error2[Symbol.asyncIterator] = async function* () {
         for (const jwk2 of candidates)
           try {
             yield await importWithAlgCache(cached, jwk2, entry);
           } catch {
           }
-      }, error;
+      }, error2;
     }
     return importWithAlgCache(cached, jwk, entry);
   }, "jwks", {
@@ -3895,182 +3926,500 @@ async function importSigningKeys(jwk) {
   };
 }
 
-// src/password.ts
-import { createHash, createHmac, hkdfSync, randomBytes, randomInt, scrypt, timingSafeEqual } from "crypto";
-var HASH_PARAMS = { logN: 15, r: 8, p: 3 };
-var KEY_LENGTH = 64;
-var SALT_LENGTH = 16;
-var MAX_PASSWORD_LENGTH = 256;
-var MAX_EMAIL_LENGTH = 254;
-function derive2(password, salt, { logN, r, p }) {
-  const N = 2 ** logN;
-  return new Promise(
-    (resolve, reject) => scrypt(
-      password.normalize("NFC"),
-      salt,
-      KEY_LENGTH,
-      { N, r, p, maxmem: 256 * N * r + 1024 * 1024 },
-      (err, key) => err ? reject(err) : resolve(key)
-    )
-  );
-}
-async function hashPassword(password, params = HASH_PARAMS) {
-  const salt = randomBytes(SALT_LENGTH);
-  const key = await derive2(password, salt, params);
-  return ["scrypt", params.logN, params.r, params.p, salt.toString("base64url"), key.toString("base64url")].join("$");
-}
-async function verifyPassword(password, stored) {
-  const [scheme, logN, r, p, salt, hash] = stored.split("$");
-  const params = { logN: Number(logN), r: Number(r), p: Number(p) };
-  if (scheme !== "scrypt" || !salt || !hash || !Object.values(params).every((n) => Number.isInteger(n) && n > 0)) {
-    return { ok: false, needsRehash: false };
-  }
-  const expected = Buffer.from(hash, "base64url");
-  const key = await derive2(password, Buffer.from(salt, "base64url"), params);
-  const ok = key.length === expected.length && timingSafeEqual(key, expected);
-  const needsRehash = params.logN !== HASH_PARAMS.logN || params.r !== HASH_PARAMS.r || params.p !== HASH_PARAMS.p;
-  return { ok, needsRehash };
+// src/webhooks.ts
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "crypto";
+var WEBHOOK_TYPES = [
+  "email.verify",
+  "email.reset",
+  "email.already_registered",
+  "email.no_password",
+  "signup.before",
+  "user.created",
+  "email.verified",
+  "email.password_reset",
+  "user.signed_in",
+  "user.deleted",
+  "user.claims_changed",
+  "totp.enabled",
+  "totp.disabled",
+  "totp.recovery_code_used"
+];
+var WEBHOOK_TIMEOUT_MS = 1e4;
+var MAX_LOCALE_LENGTH = 35;
+function localeOf(value) {
+  return typeof value === "string" && value.length <= MAX_LOCALE_LENGTH ? value : void 0;
 }
-var dummyHash;
-async function verifyAgainstDummy(password) {
-  dummyHash ??= hashPassword(randomBytes(16).toString("hex"));
-  await verifyPassword(password, await dummyHash);
+var REQUIRED_EMAIL_TYPES = ["email.verify", "email.reset"];
+var SECRET_PREFIX = "whsec_";
+var DEV_WEBHOOK_RECEIVER_URL = "https://github.com/inouiw/madAuth-webhooks/tree/main/dev-receiver";
+var WEBHOOK_TOLERANCE_SECONDS = 5 * 60;
+function generateWebhookSecret() {
+  return `${SECRET_PREFIX}${randomBytes(32).toString("base64")}`;
 }
-function checkPasswordPolicy(password, minLength) {
-  if (typeof password !== "string") return "password is missing";
-  const length = [...password].length;
-  if (length < minLength) return `The password must have at least ${minLength} characters.`;
-  if (length > MAX_PASSWORD_LENGTH) return `The password must have at most ${MAX_PASSWORD_LENGTH} characters.`;
+function checkWebhookSecret(secret) {
+  if (!secret.startsWith(SECRET_PREFIX)) return `must start with "${SECRET_PREFIX}"`;
+  const key = Buffer.from(secret.slice(SECRET_PREFIX.length), "base64");
+  if (key.length < 24 || key.length > 64) return "must contain 24 to 64 bytes in base64";
   return null;
 }
-function normalizeEmail(email) {
-  return email.trim().toLowerCase();
+function hmac2(secret, content) {
+  const key = Buffer.from(secret.slice(SECRET_PREFIX.length), "base64");
+  return createHmac("sha256", key).update(content).digest("base64");
 }
-function isValidEmail(email) {
-  return typeof email === "string" && email.trim().length <= MAX_EMAIL_LENGTH && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email.trim());
+function signWebhook(secret, id, timestamp, body2) {
+  return `v1,${hmac2(secret, `${id}.${timestamp}.${body2}`)}`;
 }
-function generateLinkToken() {
-  return randomBytes(32).toString("base64url");
+function createWebhookClient(settings, fetchImpl = fetch) {
+  const wants = (type) => settings.events.has(type);
+  return {
+    wants,
+    async call(type, data, timeoutMs) {
+      if (!wants(type)) return { ok: true, body: void 0 };
+      const id = `msg_${randomUUID()}`;
+      const timestamp = Math.floor(Date.now() / 1e3);
+      const body2 = JSON.stringify({ type, data });
+      let response;
+      try {
+        response = await fetchImpl(settings.url, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "webhook-id": id,
+            "webhook-timestamp": String(timestamp),
+            "webhook-signature": signWebhook(settings.secret, id, timestamp, body2)
+          },
+          body: body2,
+          signal: AbortSignal.timeout(timeoutMs)
+        });
+      } catch (e) {
+        const reason = e.name === "TimeoutError" ? `no answer within ${timeoutMs} ms` : e.message;
+        return { ok: false, reason };
+      }
+      const text = await response.text().catch(() => "");
+      if (!response.ok) return { ok: false, reason: `HTTP ${response.status}` };
+      let parsed;
+      try {
+        parsed = text ? JSON.parse(text) : void 0;
+      } catch {
+        parsed = void 0;
+      }
+      return { ok: true, body: parsed };
+    }
+  };
 }
-function hashLinkToken(token) {
-  return createHash("sha256").update(token).digest("base64url");
+
+// src/config.ts
+function sendsVerificationEmails(config) {
+  return !!config.webhook?.events.has("email.verify");
 }
-function generateCode() {
-  return randomInt(0, 1e6).toString().padStart(6, "0");
+function methodConfig(config) {
+  return { google: config.google, password: config.password, emailVerification: sendsVerificationEmails(config) };
 }
-function deriveCodeKey(signingKeyD) {
-  return Buffer.from(hkdfSync("sha256", Buffer.from(signingKeyD, "base64url"), "", "madauth e-mail code", 32));
+async function resolveEnv(source = process.env) {
+  return typeof source === "function" ? source() : source;
 }
-function hashCode(key, code) {
-  return createHmac("sha256", key).update(code).digest("base64url");
+var DEFAULT_SESSION_TTL = 8 * 60 * 60;
+var DEFAULT_RENEWAL_TTL = 30 * 24 * 60 * 60;
+var DEFAULT_PASSWORD_MIN_LENGTH = 8;
+var ConfigError = class extends Error {
+  constructor() {
+    super(...arguments);
+    this.name = "ConfigError";
+  }
+};
+function parseOrigin(name, value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new ConfigError(`${name}: "${value}" is not a URL.`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new ConfigError(`${name}: "${value}" must be an http(s) URL.`);
+  }
+  return url.origin;
 }
-function safeEqual(a, b) {
-  const x = Buffer.from(a);
-  const y = Buffer.from(b);
-  return x.length === y.length && timingSafeEqual(x, y);
+function readEnv(env, name) {
+  return env[name]?.trim().replace(/^(['"])(.*)\1$/s, "$2").trim() || void 0;
 }
+async function loadConfig(env, overrides = {}) {
+  const read = (name) => readEnv(env, name);
+  const require2 = (name) => {
+    const value = read(name);
+    if (!value) throw new ConfigError(`${name} is not set. See docs/server.md.`);
+    return value;
+  };
+  const issuerValue = require2("MADAUTH_ISSUER");
+  parseOrigin("MADAUTH_ISSUER", issuerValue);
+  const issuer = issuerValue.replace(/\/+$/, "");
+  const keyValue = read("MADAUTH_SIGNING_KEY");
+  if (!keyValue) {
+    const key = await generateSigningKey();
+    throw new ConfigError(
+      `MADAUTH_SIGNING_KEY is not set. Here is a newly generated key you can use (keep it secret and use the same key on every instance):
 
-// src/google.ts
-var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
-var googleJwks;
-function googleKeys() {
-  googleJwks ??= createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
-  return googleJwks;
-}
-async function verifyGoogleIdToken(idToken, opts) {
-  let payload;
+MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
+`
+    );
+  }
+  let signingKey;
   try {
-    ({ payload } = await jwtVerify(idToken, opts.keys ?? googleKeys(), {
-      issuer: GOOGLE_ISSUERS,
-      audience: opts.clientId,
-      algorithms: ["RS256", "ES256"]
-    }));
+    signingKey = JSON.parse(keyValue);
+    assertPrivateSigningJwk(signingKey);
   } catch (e) {
-    return { ok: false, error: "verification_failed", reason: e.message };
+    const reason = e instanceof SyntaxError ? "is not valid JSON" : e.message;
+    throw new ConfigError(`MADAUTH_SIGNING_KEY ${reason}. Generate one with: npx @madauth/server generate-key`);
   }
-  if (typeof payload.sub !== "string" || !payload.sub) {
-    return { ok: false, error: "verification_failed", reason: "missing sub" };
+  const allowedOrigins = require2("ALLOWED_ORIGINS").split(",").map((o) => o.trim()).filter(Boolean).map((o) => parseOrigin("ALLOWED_ORIGINS", o));
+  const clientId = read("GOOGLE_CLIENT_ID");
+  if (clientId && !clientId.endsWith(".apps.googleusercontent.com")) {
+    throw new ConfigError(`GOOGLE_CLIENT_ID must end with ".apps.googleusercontent.com" but is "${clientId}".`);
   }
-  if (payload.nonce !== opts.nonce) {
-    return { ok: false, error: "verification_failed", reason: "nonce mismatch" };
+  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
+  const sendsEmails = !!webhook && REQUIRED_EMAIL_TYPES.every((type) => webhook.events.has(type));
+  const password = sendsEmails ? { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")) } : void 0;
+  const emailVerification = !!webhook && webhook.events.has("email.verify");
+  if (!clientId && !password && !emailVerification) {
+    throw new ConfigError(
+      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails: e-mail & password sign-in needs email.verify and email.reset, sign-up with the authenticator app needs email.verify. For development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered,email.no_password. See docs/server.md.`
+    );
   }
-  if (typeof payload.email !== "string" || !payload.email || payload.email_verified !== true) {
-    return { ok: false, error: "email_unverified", reason: "e-mail address not verified" };
+  const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
+  if (!store) {
+    throw new ConfigError(
+      "DATABASE_URL is not set. madAuth stores every user, whichever way they sign in: set e.g. DATABASE_URL=sqlite:./madauth.db or DATABASE_URL=dynamodb:<table>. See docs/server.md."
+    );
   }
-  const profile = { sub: payload.sub, email: payload.email };
-  if (typeof payload.name === "string") profile.name = payload.name;
-  if (typeof payload.picture === "string") profile.picture = payload.picture;
-  return { ok: true, profile };
+  const ttlValue = read("SESSION_TTL");
+  const sessionTtlSeconds = ttlValue ? Number(ttlValue) : DEFAULT_SESSION_TTL;
+  if (!Number.isInteger(sessionTtlSeconds) || sessionTtlSeconds < 60) {
+    throw new ConfigError(`SESSION_TTL must be a whole number of seconds (at least 60) but is "${ttlValue}".`);
+  }
+  const renewalValue = read("SESSION_RENEWAL_TTL");
+  const renewalTtlSeconds = renewalValue ? Number(renewalValue) : Math.max(DEFAULT_RENEWAL_TTL, sessionTtlSeconds);
+  if (!Number.isInteger(renewalTtlSeconds) || renewalTtlSeconds < sessionTtlSeconds) {
+    throw new ConfigError(
+      `SESSION_RENEWAL_TTL must be a whole number of seconds, not less than SESSION_TTL (${sessionTtlSeconds}), but is "${renewalValue}".`
+    );
+  }
+  return {
+    issuer,
+    signingKey,
+    allowedOrigins,
+    sessionTtlSeconds,
+    renewalTtlSeconds,
+    cookieDomain: read("COOKIE_DOMAIN"),
+    totpIssuer: read("TOTP_ISSUER"),
+    google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
+    store,
+    password,
+    webhook
+  };
 }
-
-// src/user.ts
-var SESSION_COOKIE = "madauth_session";
-var SESSION_TYP = "madauth-session+jwt";
-var RENEWAL_COOKIE = "madauth_renewal";
-var RENEWAL_TYP = "madauth-renewal+jwt";
-var EXPIRY_COOKIE = "madauth_session_expires";
-
-// src/tokens.ts
-function randomString(bytes = 32) {
-  return base64url_exports.encode(crypto.getRandomValues(new Uint8Array(bytes)));
+function passwordMinLength(value) {
+  const minLength = value ? Number(value) : DEFAULT_PASSWORD_MIN_LENGTH;
+  if (!Number.isInteger(minLength) || minLength < 1 || minLength > 128) {
+    throw new ConfigError(`PASSWORD_MIN_LENGTH must be a whole number from 1 to 128 but is "${value}".`);
+  }
+  return minLength;
 }
-async function signToken(keys, issuer, typ, claims, ttlSeconds) {
-  return new SignJWT(claims).setProtectedHeader({ alg: SIGNING_ALG, kid: keys.kid, typ }).setIssuer(issuer).setIssuedAt().setExpirationTime(`${ttlSeconds}s`).sign(keys.privateKey);
+async function storeFromDatabaseUrl(url) {
+  if (!url) return void 0;
+  if (url.startsWith("dynamodb:")) return dynamoDbStore(url.slice("dynamodb:".length));
+  if (!url.startsWith("sqlite:")) {
+    throw new ConfigError(
+      `DATABASE_URL must start with "sqlite:" (e.g. sqlite:/data/madauth.db) or "dynamodb:" (e.g. dynamodb:madauth) but is "${url}". For other databases, pass your own store adapter (see "Custom store adapter" in docs/server.md).`
+    );
+  }
+  const path = url.slice("sqlite:".length);
+  if (!path) throw new ConfigError("DATABASE_URL needs a file path, e.g. sqlite:/data/madauth.db");
+  const { createSqliteAdapter: createSqliteAdapter2 } = await Promise.resolve().then(() => (init_sqlite(), sqlite_exports));
+  try {
+    return createSqliteAdapter2(path);
+  } catch (e) {
+    throw new ConfigError(`DATABASE_URL: could not open "${path}": ${e.message}`);
+  }
 }
-async function readToken(keys, issuer, typ, token) {
-  if (!token) return null;
+async function dynamoDbStore(tableName2) {
+  if (!tableName2) throw new ConfigError("DATABASE_URL needs a table name, e.g. dynamodb:madauth");
+  if (!/^[\w.-]{3,255}$/.test(tableName2)) {
+    throw new ConfigError(
+      `DATABASE_URL=dynamodb: needs a DynamoDB table name (3 to 255 letters, digits, _ . -) but has "${tableName2}"`
+    );
+  }
   try {
-    const { payload } = await jwtVerify(token, keys.publicKey, { issuer, typ, algorithms: [SIGNING_ALG] });
-    return payload;
+    await import("@aws-sdk/client-dynamodb");
+  } catch (e) {
+    throw new ConfigError(
+      `DATABASE_URL=dynamodb: needs the AWS SDK. Install it next to madAuth: npm install @aws-sdk/client-dynamodb (${e.message})`
+    );
+  }
+  const { createDynamoDbAdapter: createDynamoDbAdapter2 } = await Promise.resolve().then(() => (init_dynamodb(), dynamodb_exports));
+  return createDynamoDbAdapter2({ tableName: tableName2 });
+}
+var RENAMED_TYPES = { "password.reset": "email.password_reset", "roles.changed": "user.claims_changed" };
+var LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]", "host.docker.internal"];
+function webhookFromEnv(url, secret, events) {
+  if (!url) {
+    if (secret || events) throw new ConfigError("WEBHOOK_SECRET and WEBHOOK_EVENTS need WEBHOOK_URL.");
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
   } catch {
-    return null;
+    throw new ConfigError(`WEBHOOK_URL: "${url}" is not a URL.`);
+  }
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && LOCAL_HOSTS.includes(parsed.hostname))) {
+    throw new ConfigError(`WEBHOOK_URL must be an https URL (http only for localhost) but is "${url}".`);
+  }
+  if (!secret) {
+    throw new ConfigError(
+      `WEBHOOK_SECRET is not set. Here is a newly generated secret you can use (keep it secret; your webhook receiver needs the same one):
+
+WEBHOOK_SECRET=${generateWebhookSecret()}
+`
+    );
+  }
+  const problem = checkWebhookSecret(secret);
+  if (problem) {
+    throw new ConfigError(`WEBHOOK_SECRET ${problem}. Generate one with: npx @madauth/server generate-webhook-secret`);
+  }
+  const selected = new Set((events ?? "").split(",").map((e) => e.trim()).filter(Boolean));
+  const allTypes = `All types: ${WEBHOOK_TYPES.join(", ")}. See "Webhooks" in docs/server.md.`;
+  if (!selected.size) {
+    throw new ConfigError(
+      `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
+
+WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered,email.no_password
+
+For one that only wants to know who signed in:
+
+WEBHOOK_EVENTS=user.signed_in
+
+` + allTypes
+    );
   }
+  const unknown = [...selected].filter((e) => !WEBHOOK_TYPES.includes(e));
+  if (unknown.length) {
+    const renamed = unknown.filter((e) => e in RENAMED_TYPES).map((e) => `${e} is now ${RENAMED_TYPES[e]}`);
+    throw new ConfigError(
+      `WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. ${renamed.length ? `${renamed.join("; ")}. ` : ""}Known types: ${WEBHOOK_TYPES.join(", ")}.`
+    );
+  }
+  return { url: parsed.href, secret, events: selected };
 }
-function signSession(keys, issuer, ttlSeconds, user, amr, extra = {}) {
-  const claims = {
-    ...extra,
-    sub: user.id,
-    email: user.email,
-    email_verified: user.email ? true : void 0,
-    name: user.name,
-    picture: user.picture,
-    claims: user.claims && Object.keys(user.claims).length ? user.claims : void 0,
-    amr
-  };
-  return signToken(keys, issuer, SESSION_TYP, claims, ttlSeconds);
+
+// src/password.ts
+import { createHash, createHmac as createHmac2, hkdfSync, randomBytes as randomBytes2, randomInt, scrypt, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var HASH_PARAMS = { logN: 15, r: 8, p: 3 };
+var KEY_LENGTH = 64;
+var SALT_LENGTH = 16;
+var MAX_PASSWORD_LENGTH = 256;
+var MAX_EMAIL_LENGTH = 254;
+function derive2(password, salt, { logN, r, p }) {
+  const N = 2 ** logN;
+  return new Promise(
+    (resolve, reject) => scrypt(
+      password.normalize("NFC"),
+      salt,
+      KEY_LENGTH,
+      { N, r, p, maxmem: 256 * N * r + 1024 * 1024 },
+      (err, key) => err ? reject(err) : resolve(key)
+    )
+  );
 }
-function signRenewal(keys, issuer, ttlSeconds, user, amr, extra = {}) {
-  const claims = {
-    ...extra,
-    sub: user.id,
-    email: user.email,
-    email_verified: user.email ? true : void 0,
-    name: user.name,
-    picture: user.picture,
-    amr
-  };
-  return signToken(keys, issuer, RENEWAL_TYP, claims, ttlSeconds);
+async function hashPassword(password, params = HASH_PARAMS) {
+  const salt = randomBytes2(SALT_LENGTH);
+  const key = await derive2(password, salt, params);
+  return ["scrypt", params.logN, params.r, params.p, salt.toString("base64url"), key.toString("base64url")].join("$");
 }
-function userFromClaims(claims) {
-  const user = { id: claims.sub };
-  if (claims.email) user.email = claims.email;
-  if (claims.name) user.name = claims.name;
-  if (claims.picture) user.picture = claims.picture;
-  if (claims.claims && typeof claims.claims === "object" && Object.keys(claims.claims).length) user.claims = claims.claims;
-  return user;
+async function verifyPassword(password, stored) {
+  const [scheme, logN, r, p, salt, hash] = stored.split("$");
+  const params = { logN: Number(logN), r: Number(r), p: Number(p) };
+  if (scheme !== "scrypt" || !salt || !hash || !Object.values(params).every((n) => Number.isInteger(n) && n > 0)) {
+    return { ok: false, needsRehash: false };
+  }
+  const expected = Buffer.from(hash, "base64url");
+  const key = await derive2(password, Buffer.from(salt, "base64url"), params);
+  const ok = key.length === expected.length && timingSafeEqual2(key, expected);
+  const needsRehash = params.logN !== HASH_PARAMS.logN || params.r !== HASH_PARAMS.r || params.p !== HASH_PARAMS.p;
+  return { ok, needsRehash };
+}
+var dummyHash;
+async function verifyAgainstDummy(password) {
+  dummyHash ??= hashPassword(randomBytes2(16).toString("hex"));
+  await verifyPassword(password, await dummyHash);
+}
+function checkPasswordPolicy(password, minLength) {
+  if (typeof password !== "string") return "password is missing";
+  const length = [...password].length;
+  if (length < minLength) return `The password must have at least ${minLength} characters.`;
+  if (length > MAX_PASSWORD_LENGTH) return `The password must have at most ${MAX_PASSWORD_LENGTH} characters.`;
+  return null;
+}
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+function isValidEmail(email) {
+  return typeof email === "string" && email.trim().length <= MAX_EMAIL_LENGTH && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email.trim());
+}
+function generateLinkToken() {
+  return randomBytes2(32).toString("base64url");
+}
+function hashLinkToken(token) {
+  return createHash("sha256").update(token).digest("base64url");
+}
+function generateCode() {
+  return randomInt(0, 1e6).toString().padStart(6, "0");
+}
+function deriveCodeKey(signingKeyD) {
+  return Buffer.from(hkdfSync("sha256", Buffer.from(signingKeyD, "base64url"), "", "madauth e-mail code", 32));
+}
+function hashCode(key, code) {
+  return createHmac2("sha256", key).update(code).digest("base64url");
+}
+function safeEqual(a, b) {
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual2(x, y);
+}
+
+// src/users.ts
+import { randomBytes as randomBytes3 } from "crypto";
+
+// src/settings.ts
+var SIGN_IN_METHODS = ["google", "password", "totp"];
+var METHODS_WITH_SECOND_FACTOR = ["google", "password"];
+var SECOND_FACTOR_POLICIES = ["none", "optional", "required"];
+var METHODS_SETTING = "methods";
+var isSignInMethod = (value) => SIGN_IN_METHODS.includes(value);
+var isPolicy = (value) => SECOND_FACTOR_POLICIES.includes(value);
+function parseMethodSettings(input, options = {}) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const settings = {};
+  for (const [method, value] of Object.entries(input)) {
+    if (!isSignInMethod(method)) return null;
+    if (typeof value === "boolean") {
+      if (!options.booleans) return null;
+      if (value) settings[method] = {};
+      continue;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+    const setting = {};
+    for (const [field, fieldValue] of Object.entries(value)) {
+      if (field !== "secondFactor" || method === "totp" || !isPolicy(fieldValue)) return null;
+      setting.secondFactor = fieldValue;
+    }
+    settings[method] = setting;
+  }
+  return settings;
+}
+function isConfigured(config, method) {
+  if (method === "google") return !!config.google;
+  if (method === "password") return !!config.password;
+  return true;
+}
+function canSignUp(config, method) {
+  return method === "totp" ? !!config.emailVerification : isConfigured(config, method);
+}
+function initialMethods(config) {
+  const methods = {};
+  if (config.google) methods.google = { secondFactor: "none" };
+  if (config.password) methods.password = { secondFactor: "none" };
+  if (!config.google && !config.password && config.emailVerification) methods.totp = {};
+  return methods;
+}
+var MAX_TRIES = 3;
+var Settings = class {
+  /** `initial` is what counts until the methods are set, see {@link initialMethods}. */
+  constructor(store, initial = {}) {
+    this.store = store;
+    this.initial = initial;
+    this.warned = false;
+  }
+  /** The setting's value, or undefined if it was never set. */
+  async get(id) {
+    return (await this.read(id)).value;
+  }
+  /** The stored JSON and what it holds; both undefined if the setting was never set. */
+  async read(id) {
+    const record = await this.store.findOne("setting", { id });
+    if (typeof record?.value !== "string") return {};
+    try {
+      return { json: record.value, value: JSON.parse(record.value) };
+    } catch {
+      return { json: record.value };
+    }
+  }
+  /**
+   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
+   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
+   * again with the newer value. Resolves to the new value, or null if `apply` refused.
+   * `updatedBy` is the address of the admin, or null for the command line.
+   */
+  async change(id, apply, updatedBy) {
+    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
+      const { json, value } = await this.read(id);
+      const next = apply(value);
+      if (next === null) return null;
+      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
+      const written = json === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json }, patch) === 1;
+      if (written) return next;
+    }
+    throw new Error(`Setting "${id}" kept changing; try again.`);
+  }
+  /** Replaces the setting. */
+  async set(id, value, updatedBy) {
+    await this.change(id, () => value, updatedBy);
+  }
+  /** Which sign-in methods are on, with their settings; the initial ones until an admin set them. */
+  async methods() {
+    return this.current(await this.get(METHODS_SETTING));
+  }
+  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
+  async changeMethods(apply, updatedBy) {
+    return this.change(METHODS_SETTING, (current) => apply(this.current(current)), updatedBy);
+  }
+  /** The stored methods, or the initial ones if nothing (usable) is stored. */
+  current(stored) {
+    if (stored === void 0) return this.initial;
+    const parsed = parseMethodSettings(stored);
+    if (parsed) return parsed;
+    if (!this.warned) {
+      this.warned = true;
+      console.warn("[madauth] The stored sign-in methods are not in the form this version expects (they were set by an older one?). Set them again with set-methods; until then the initial methods count.");
+    }
+    return this.initial;
+  }
+};
+function isOn(method, configured, methods) {
+  return configured(method) && methods[method] !== void 0;
+}
+function policyOf(method, methods) {
+  return methods[method]?.secondFactor ?? "none";
+}
+function anyOn(signsUp, methods) {
+  return SIGN_IN_METHODS.some((method) => signsUp(method) && methods[method] !== void 0);
+}
+function authenticatorOn(configured, methods) {
+  if (isOn("totp", configured, methods)) return true;
+  return METHODS_WITH_SECOND_FACTOR.some((method) => isOn(method, configured, methods) && policyOf(method, methods) !== "none");
 }
 
 // src/users.ts
-import { randomBytes as randomBytes2 } from "crypto";
 var MAX_CODE_ATTEMPTS = 5;
 var MAX_WRONG_CODES = 10;
-var newId = (prefix) => `${prefix}_${randomBytes2(16).toString("base64url")}`;
+var newId = (prefix) => `${prefix}_${randomBytes3(16).toString("base64url")}`;
 function passwordAccountKey(userId) {
   return `password:${userId}`;
 }
 function googleAccountKey(sub) {
   return `google:${sub}`;
 }
+function totpAccountKey(userId) {
+  return `totp:${userId}`;
+}
 function toMadauthUser(user, profile = {}) {
   const result = { id: user.id, email: user.email };
   const name = user.name ?? profile.name;
@@ -4099,12 +4448,32 @@ var Users = class {
   async passwordAccount(userId) {
     return this.findAccountByKey(passwordAccountKey(userId));
   }
+  /** The user's authenticator app, if they set one up. */
+  async totpAccount(userId) {
+    return this.findAccountByKey(totpAccountKey(userId));
+  }
+  /** Whether the user has any way to sign in; a sign-up with the authenticator app has none until it is set up. */
+  async hasAccounts(userId) {
+    return (await this.store.findMany("account", { userId }, { limit: 1 })).length > 0;
+  }
+  /**
+   * The ways the user can sign in, from their accounts: e.g. `['google']` for a user without a password.
+   * The authenticator app counts only when it signs in on its own (`methods` lists it); as a second
+   * factor it is a step of another method, not a way in.
+   */
+  async signInMethods(userId, methods) {
+    const accounts = await this.store.findMany("account", { userId });
+    const keys = accounts.map((account) => String(account.key).split(":")[0]);
+    return SIGN_IN_METHODS.filter((method) => keys.includes(method) && (method !== "totp" || methods.totp !== void 0));
+  }
   async findAccountByKey(key) {
     return await this.store.findOne("account", { key });
   }
   /**
-   * Creates a user with their first account. Resolves to null if the e-mail address or the account key is
-   * taken. `account.key` is `password:<userId>` for a password (its hash as `secret`), or e.g. `google:<sub>`.
+   * Creates a user, with their first account if given. Resolves to null if the e-mail address or the
+   * account key is taken. `account.key` is `password:<userId>` for a password (its hash as `secret`), or
+   * e.g. `google:<sub>`. A sign-up with the authenticator app creates the user without an account: the app
+   * is set up once the address is confirmed.
    */
   async createUser(data) {
     const user = {
@@ -4120,6 +4489,7 @@ var Users = class {
       createdAt: Date.now()
     };
     if (!await this.store.create("user", user)) return null;
+    if (!data.account) return user;
     const account = typeof data.account === "function" ? data.account(user.id) : data.account;
     if (!await this.linkAccount(user.id, account)) {
       await this.store.delete("user", { id: user.id });
@@ -4141,6 +4511,16 @@ var Users = class {
   async deleteAccount(id) {
     await this.store.delete("account", { id });
   }
+  /** Removes a sign-in method by its key. Resolves to false if there was none. */
+  async unlinkAccount(key) {
+    return await this.store.delete("account", { key }) === 1;
+  }
+  /** Removes the user's authenticator app and recovery codes. Resolves to false if they had no app. */
+  async removeTotp(userId) {
+    const removed = await this.unlinkAccount(totpAccountKey(userId));
+    await this.clearRecoveryCodes(userId);
+    return removed;
+  }
   /** Adds a sign-in method to a user. Resolves to null if the account key is taken. */
   async linkAccount(userId, account) {
     const record = {
@@ -4151,10 +4531,70 @@ var Users = class {
       failedAttempts: 0,
       lockedUntil: 0,
       email: account.email ?? null,
+      lastUsedStep: account.lastUsedStep ?? 0,
+      setupId: account.setupId ?? null,
       createdAt: Date.now()
     };
     return await this.store.create("account", record) ? record : null;
   }
+  /**
+   * Writes the secret of a confirmed setup over the authenticator account, only if the account still has the
+   * setup it had when this setup started (`replaces`): the write count decides, so of two setups confirmed
+   * at once exactly one wins, and the other is told to start again.
+   */
+  async confirmTotpSetup(accountId, replaces, patch) {
+    return await this.store.update("account", { id: accountId, setupId: replaces }, patch) === 1;
+  }
+  /**
+   * Marks the time step of an accepted authenticator code as used and resets the failed attempts, only if
+   * no other request accepted a code meanwhile: the write count decides, so the same code sent twice signs
+   * in once.
+   */
+  async useTotpStep(account, step) {
+    const changed = await this.store.update(
+      "account",
+      { id: account.id, lastUsedStep: account.lastUsedStep ?? null },
+      { lastUsedStep: step, failedAttempts: 0, lockedUntil: 0 }
+    );
+    return changed === 1;
+  }
+  /** Replaces the user's recovery codes with new ones, given as their hashes. */
+  /** Stores the recovery codes of a setup (their hashes), next to whatever codes the user has. */
+  async addRecoveryCodes(userId, setupId, hashes) {
+    const createdAt = Date.now();
+    for (const id of hashes) await this.store.create("recoveryCode", { id, userId, setupId, createdAt });
+  }
+  /** New recovery codes for the user's current app: the codes they had before stop working. */
+  async replaceRecoveryCodes(account, hashes) {
+    const before = await this.store.findMany("recoveryCode", { userId: account.userId });
+    await this.addRecoveryCodes(account.userId, account.setupId ?? "", hashes);
+    for (const old of before) await this.store.delete("recoveryCode", { id: old.id });
+  }
+  /**
+   * Uses up the recovery code with this hash for the user's authenticator account. Resolves to false if it
+   * is not theirs, belongs to another setup than the account's, or was used already.
+   */
+  async consumeRecoveryCode(account, hash) {
+    const record = await this.store.findOne("recoveryCode", { id: hash });
+    if (!record || record.userId !== account.userId || record.setupId !== (account.setupId ?? "")) return false;
+    return await this.store.delete("recoveryCode", { id: hash }) === 1;
+  }
+  /** How many recovery codes of the account's setup are left. */
+  async countRecoveryCodes(account) {
+    const codes = await this.store.findMany("recoveryCode", { userId: account.userId });
+    return codes.filter((code) => code.setupId === (account.setupId ?? "")).length;
+  }
+  /** Deletes the user's recovery codes: all of them, or only those of one setup, or all but one setup's. */
+  async clearRecoveryCodes(userId, which = {}) {
+    if (which.only === void 0 && which.except === void 0) {
+      await this.store.delete("recoveryCode", { userId });
+      return;
+    }
+    for (const code of await this.store.findMany("recoveryCode", { userId })) {
+      const match2 = which.only !== void 0 ? code.setupId === which.only : code.setupId !== which.except;
+      if (match2) await this.store.delete("recoveryCode", { id: code.id });
+    }
+  }
   /**
    * Deletes the user and everything stored for them. Resolves to false if there is no such user (any more).
    */
@@ -4165,6 +4605,7 @@ var Users = class {
     try {
       await this.store.delete("account", { userId: user.id });
       await this.store.delete("verification", { userId: user.id });
+      await this.store.delete("recoveryCode", { userId: user.id });
     } catch (e) {
       console.error(`[madauth] Deleted user ${user.id}, but not all of their records: ${e.message}`);
     }
@@ -4173,8 +4614,9 @@ var Users = class {
   async updateUser(id, patch) {
     await this.store.update("user", { id }, patch);
   }
+  /** Changes an account. Resolves to false if it is gone meanwhile. */
   async updateAccount(id, patch) {
-    await this.store.update("account", { id }, patch);
+    return await this.store.update("account", { id }, patch) === 1;
   }
   /**
    * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
@@ -4207,6 +4649,11 @@ var Users = class {
     await this.store.create("verification", record);
     return { token, code };
   }
+  /** The user ID a link token belongs to, without using the verification up; null if invalid, expired or used. */
+  async peekLinkToken(token, purpose) {
+    const record = await this.store.findOne("verification", { id: hashLinkToken(token), purpose });
+    return record && record.expiresAt > Date.now() ? record.userId : null;
+  }
   /** Uses up the verification a link token belongs to. Resolves to its user ID, or null if invalid, expired or used. */
   async consumeLinkToken(token, purpose) {
     const id = hashLinkToken(token);
@@ -4253,82 +4700,213 @@ var Users = class {
   }
 };
 
-// src/webhooks.ts
-import { createHmac as createHmac2, randomBytes as randomBytes3, randomUUID, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var WEBHOOK_TYPES = [
-  "email.verify",
-  "email.reset",
-  "email.already_registered",
-  "signup.before",
-  "user.created",
-  "email.verified",
-  "email.password_reset",
-  "user.signed_in",
-  "user.deleted",
-  "user.claims_changed"
-];
-var WEBHOOK_TIMEOUT_MS = 1e4;
-var MAX_LOCALE_LENGTH = 35;
-function localeOf(value) {
-  return typeof value === "string" && value.length <= MAX_LOCALE_LENGTH ? value : void 0;
+// src/routes/helpers.ts
+async function body(c) {
+  const data = await c.req.json().catch(() => null);
+  return data && typeof data === "object" ? data : {};
+}
+function error(c, status, code, message2) {
+  return c.json({ error: code, message: message2 }, status);
+}
+var unavailable = (c) => error(c, 503, "temporarily_unavailable", "E-mails can not be sent right now. Please try again later.");
+var accepted = (c) => c.json({}, 202);
+var noSession = (c) => error(c, 401, "no_session", "Please sign in first.");
+function redirectTarget(ctx, c, value) {
+  const url = ctx.allowedUrl(value);
+  return url ?? error(c, 400, "invalid_options", "redirectTo must be an absolute URL whose origin is in ALLOWED_ORIGINS.");
+}
+var MAX_NAME_LENGTH = 100;
+function nameOf(value) {
+  return typeof value === "string" && value.trim() ? value.trim().slice(0, MAX_NAME_LENGTH) : null;
+}
+function signInAnswer(c, step) {
+  if ("disabled" in step) return error(c, 403, "method_disabled", "This way of signing in is switched off.");
+  if ("next" in step) {
+    return step.next === "totp" ? c.json({ error: "totp_required", message: "Enter the code from your authenticator app to finish signing in.", method: step.method }, 401) : c.json({ error: "totp_setup_required", message: "Set up an authenticator app to finish signing in.", method: step.method }, 401);
+  }
+  return c.json({ user: step.user });
+}
+
+// src/routes/emails.ts
+var MAIL_INTERVAL_MS = 60 * 1e3;
+var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
+var RESET_TTL_MS = 30 * 60 * 1e3;
+var VERIFY_LINK_PARAM = "madauth_verify";
+var RESET_LINK_PARAM = "madauth_reset";
+function createEmails(ctx, users, webhook) {
+  const sendEmail = async (user, type, data) => {
+    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+    const result = await webhook.call(type, { to: user.email, user: { id: user.id, name: user.name ?? void 0 }, ...data }, WEBHOOK_TIMEOUT_MS);
+    if (!result.ok) {
+      console.error(`[madauth] Webhook "${type}" for ${user.email} failed: ${result.reason}`);
+      return false;
+    }
+    await users.updateUser(user.id, { lastMailAt: Date.now() });
+    return true;
+  };
+  return {
+    sendEmail,
+    async sendLinkEmail(user, purpose, target, locale) {
+      if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+      const ttl = purpose === "verify" ? VERIFY_TTL_MS : RESET_TTL_MS;
+      const { token, code } = await users.issueVerification(user.id, purpose, ttl);
+      const link = new URL(target);
+      link.hash = `${purpose === "verify" ? VERIFY_LINK_PARAM : RESET_LINK_PARAM}=${token}`;
+      return sendEmail(user, purpose === "verify" ? "email.verify" : "email.reset", {
+        link: link.href,
+        code,
+        expiresAt: Date.now() + ttl,
+        site: target.host,
+        locale
+      });
+    },
+    async sendAccountEmail(user, type, target, locale) {
+      if (!webhook.wants(type)) return true;
+      const methods = await users.signInMethods(user.id, await ctx.settings.methods());
+      return sendEmail(user, type, { link: target.href, site: target.host, locale, methods });
+    },
+    async consume(data, purpose) {
+      if (typeof data.token === "string" && data.token) {
+        return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
+      }
+      if (isValidEmail(data.email) && typeof data.code === "string") {
+        const user = await users.findByEmail(normalizeEmail(data.email));
+        if (!user) return { userId: null, via: "code" };
+        return { ...await users.consumeCode(user, purpose, data.code.replace(/\s/g, "")), via: "code" };
+      }
+      return { userId: null, via: "code" };
+    },
+    invalidVerification(c, { via, locked }) {
+      if (locked) {
+        return error(c, 429, "codes_locked", "Too many wrong codes. Please ask for a new e-mail and use the link in it.");
+      }
+      return via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
+    }
+  };
+}
+
+// src/routes/email.ts
+function emailRoutes(app, ctx, users, webhook) {
+  const emails = createEmails(ctx, users, webhook);
+  const signUpMethod = async (userId) => await users.passwordAccount(userId) ? "password" : "totp";
+  app.post("/auth/email/send-verification", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(ctx, c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (user && !user.emailVerified && await ctx.enabled(c, await signUpMethod(user.id))) {
+      if (!await emails.sendLinkEmail(user, "verify", target, localeOf(data.locale))) return unavailable(c);
+    }
+    return accepted(c);
+  });
+  const disabled = (c) => error(c, 403, "method_disabled", "This way of signing in is switched off.");
+  app.post("/auth/email/verify", async (c) => {
+    const data = await body(c);
+    const waiting = typeof data.token === "string" && data.token ? await users.peekLinkToken(data.token, "verify") : isValidEmail(data.email) ? (await users.findByEmail(normalizeEmail(data.email)))?.id ?? null : null;
+    if (waiting && !await ctx.enabled(c, await signUpMethod(waiting))) return disabled(c);
+    const consumed = await emails.consume(data, "verify");
+    const { userId, via } = consumed;
+    const user = userId ? await users.findById(userId) : null;
+    if (!user) return emails.invalidVerification(c, consumed);
+    const method = await signUpMethod(user.id);
+    if (!await ctx.enabled(c, method)) return disabled(c);
+    await users.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
+    const verified = { ...user, emailVerified: true, wrongCodes: 0 };
+    await ctx.emit("email.verified", { user: toMadauthUser(verified), via });
+    return signInAnswer(c, await ctx.secondStep(c, verified, method === "password" ? ["pwd"] : [], method));
+  });
+}
+
+// src/google.ts
+var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
+var googleJwks;
+function googleKeys() {
+  googleJwks ??= createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
+  return googleJwks;
+}
+async function verifyGoogleIdToken(idToken, opts) {
+  let payload;
+  try {
+    ({ payload } = await jwtVerify(idToken, opts.keys ?? googleKeys(), {
+      issuer: GOOGLE_ISSUERS,
+      audience: opts.clientId,
+      algorithms: ["RS256", "ES256"]
+    }));
+  } catch (e) {
+    return { ok: false, error: "verification_failed", reason: e.message };
+  }
+  if (typeof payload.sub !== "string" || !payload.sub) {
+    return { ok: false, error: "verification_failed", reason: "missing sub" };
+  }
+  if (payload.nonce !== opts.nonce) {
+    return { ok: false, error: "verification_failed", reason: "nonce mismatch" };
+  }
+  if (typeof payload.email !== "string" || !payload.email || payload.email_verified !== true) {
+    return { ok: false, error: "email_unverified", reason: "e-mail address not verified" };
+  }
+  const profile = { sub: payload.sub, email: payload.email };
+  if (typeof payload.name === "string") profile.name = payload.name;
+  if (typeof payload.picture === "string") profile.picture = payload.picture;
+  return { ok: true, profile };
 }
-var REQUIRED_EMAIL_TYPES = ["email.verify", "email.reset"];
-var SECRET_PREFIX = "whsec_";
-var DEV_WEBHOOK_RECEIVER_URL = "https://github.com/inouiw/madAuth-webhooks/tree/main/dev-receiver";
-var WEBHOOK_TOLERANCE_SECONDS = 5 * 60;
-function generateWebhookSecret() {
-  return `${SECRET_PREFIX}${randomBytes3(32).toString("base64")}`;
+
+// src/user.ts
+var SESSION_COOKIE = "madauth_session";
+var SESSION_TYP = "madauth-session+jwt";
+var RENEWAL_COOKIE = "madauth_renewal";
+var RENEWAL_TYP = "madauth-renewal+jwt";
+var EXPIRY_COOKIE = "madauth_session_expires";
+
+// src/tokens.ts
+function randomString(bytes = 32) {
+  return base64url_exports.encode(crypto.getRandomValues(new Uint8Array(bytes)));
 }
-function checkWebhookSecret(secret) {
-  if (!secret.startsWith(SECRET_PREFIX)) return `must start with "${SECRET_PREFIX}"`;
-  const key = Buffer.from(secret.slice(SECRET_PREFIX.length), "base64");
-  if (key.length < 24 || key.length > 64) return "must contain 24 to 64 bytes in base64";
-  return null;
+async function signToken(keys, issuer, typ, claims, ttlSeconds) {
+  return new SignJWT(claims).setProtectedHeader({ alg: SIGNING_ALG, kid: keys.kid, typ }).setIssuer(issuer).setIssuedAt().setExpirationTime(`${ttlSeconds}s`).sign(keys.privateKey);
 }
-function hmac2(secret, content) {
-  const key = Buffer.from(secret.slice(SECRET_PREFIX.length), "base64");
-  return createHmac2("sha256", key).update(content).digest("base64");
+async function readToken(keys, issuer, typ, token) {
+  if (!token) return null;
+  try {
+    const { payload } = await jwtVerify(token, keys.publicKey, { issuer, typ, algorithms: [SIGNING_ALG] });
+    return payload;
+  } catch {
+    return null;
+  }
 }
-function signWebhook(secret, id, timestamp, body) {
-  return `v1,${hmac2(secret, `${id}.${timestamp}.${body}`)}`;
+function signSession(keys, issuer, ttlSeconds, user, amr, extra = {}) {
+  const claims = {
+    ...extra,
+    sub: user.id,
+    email: user.email,
+    email_verified: user.email ? true : void 0,
+    name: user.name,
+    picture: user.picture,
+    claims: user.claims && Object.keys(user.claims).length ? user.claims : void 0,
+    amr
+  };
+  return signToken(keys, issuer, SESSION_TYP, claims, ttlSeconds);
 }
-function createWebhookClient(settings, fetchImpl = fetch) {
-  const wants = (type) => settings.events.has(type);
-  return {
-    wants,
-    async call(type, data, timeoutMs) {
-      if (!wants(type)) return { ok: true, body: void 0 };
-      const id = `msg_${randomUUID()}`;
-      const timestamp = Math.floor(Date.now() / 1e3);
-      const body = JSON.stringify({ type, data });
-      let response;
-      try {
-        response = await fetchImpl(settings.url, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "webhook-id": id,
-            "webhook-timestamp": String(timestamp),
-            "webhook-signature": signWebhook(settings.secret, id, timestamp, body)
-          },
-          body,
-          signal: AbortSignal.timeout(timeoutMs)
-        });
-      } catch (e) {
-        const reason = e.name === "TimeoutError" ? `no answer within ${timeoutMs} ms` : e.message;
-        return { ok: false, reason };
-      }
-      const text = await response.text().catch(() => "");
-      if (!response.ok) return { ok: false, reason: `HTTP ${response.status}` };
-      let parsed;
-      try {
-        parsed = text ? JSON.parse(text) : void 0;
-      } catch {
-        parsed = void 0;
-      }
-      return { ok: true, body: parsed };
-    }
+function signRenewal(keys, issuer, ttlSeconds, user, amr, extra = {}) {
+  const claims = {
+    ...extra,
+    sub: user.id,
+    email: user.email,
+    email_verified: user.email ? true : void 0,
+    name: user.name,
+    picture: user.picture,
+    amr
   };
+  return signToken(keys, issuer, RENEWAL_TYP, claims, ttlSeconds);
+}
+function userFromClaims(claims) {
+  const user = { id: claims.sub };
+  if (claims.email) user.email = claims.email;
+  if (claims.name) user.name = claims.name;
+  if (claims.picture) user.picture = claims.picture;
+  if (claims.claims && typeof claims.claims === "object" && Object.keys(claims.claims).length) user.claims = claims.claims;
+  if (Array.isArray(claims.amr)) user.amr = claims.amr.filter((value) => typeof value === "string");
+  return user;
 }
 
 // src/routes/google.ts
@@ -4341,6 +4919,7 @@ var OAUTH_TTL = 10 * 60;
 var GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
 var GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
 var REDIRECT_ERROR_PARAM = "madauth_error";
+var REDIRECT_NEXT_PARAM = "madauth_next";
 async function pkceChallenge(verifier) {
   const digest2 = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
   return base64url_exports.encode(new Uint8Array(digest2));
@@ -4352,7 +4931,7 @@ function googleRoutes(app, ctx, google) {
   const resolveUser = async (profile, locale) => {
     const key = googleAccountKey(profile.sub);
     const emailNormalized = normalizeEmail(profile.email);
-    const signedIn = (user) => ({ ok: true, user: toMadauthUser(user, profile), sv: user.sessionVersion });
+    const signedIn = (user) => ({ ok: true, user });
     const account = await users.findAccountByKey(key);
     if (account) {
       const user = await users.findById(account.userId);
@@ -4365,6 +4944,11 @@ function googleRoutes(app, ctx, google) {
     for (let attempt = 0; attempt < 2; attempt++) {
       const existing = await users.findByEmail(emailNormalized);
       if (existing) {
+        if (existing.emailVerified && await users.hasAccounts(existing.id)) {
+          const methods = await users.signInMethods(existing.id, await ctx.settings.methods());
+          const how = methods.map((method) => ({ password: "a password", totp: "an authenticator app", google: "Google" })[method]).join(" or ");
+          return { ok: false, error: "other_method", message: `This e-mail address signs in with ${how || "another method"}. Use that instead of Google.`, methods };
+        }
         await users.verifyByProvider(existing);
         if (!await users.linkAccount(existing.id, { key, email: profile.email })) {
           const linked = await users.findAccountByKey(key);
@@ -4396,7 +4980,7 @@ function googleRoutes(app, ctx, google) {
   };
   const disabled = (c) => c.json({ error: "method_disabled", message: "Google sign-in is switched off." }, 403);
   app.post("/auth/google/nonce", async (c) => {
-    if (!await ctx.enabled("google")) return disabled(c);
+    if (!await ctx.enabled(c, "google")) return disabled(c);
     const nonce = randomString();
     const token = await signToken(await keys, issuer, NONCE_TYP, { nonce }, NONCE_TTL);
     setCookie(c, NONCE_COOKIE, token, {
@@ -4409,16 +4993,16 @@ function googleRoutes(app, ctx, google) {
     return c.json({ nonce });
   });
   app.post("/auth/google/verify", async (c) => {
-    if (!await ctx.enabled("google")) return disabled(c);
-    const body = await c.req.json().catch(() => ({}));
-    if (typeof body.credential !== "string" || !body.credential) {
+    if (!await ctx.enabled(c, "google")) return disabled(c);
+    const body2 = await c.req.json().catch(() => ({}));
+    if (typeof body2.credential !== "string" || !body2.credential) {
       return c.json({ error: "verification_failed", message: "credential is missing" }, 400);
     }
     const nonceClaims = await readToken(await keys, issuer, NONCE_TYP, getCookie(c, NONCE_COOKIE));
     if (!nonceClaims) {
       return c.json({ error: "verification_failed", message: "nonce cookie missing or expired" }, 401);
     }
-    const result = await verifyGoogleIdToken(body.credential, {
+    const result = await verifyGoogleIdToken(body2.credential, {
       clientId: google.clientId,
       nonce: nonceClaims.nonce,
       keys: config.jwksResolver
@@ -4427,17 +5011,16 @@ function googleRoutes(app, ctx, google) {
       return c.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
     }
     deleteCookie(c, NONCE_COOKIE, { path: "/auth/google", secure });
-    const resolved = await resolveUser(result.profile, localeOf(body.locale));
+    const resolved = await resolveUser(result.profile, localeOf(body2.locale));
     if (!resolved.ok) {
+      if (resolved.error === "other_method") return c.json({ error: resolved.error, message: resolved.message, methods: resolved.methods }, 403);
       return c.json({ error: resolved.error, message: resolved.message }, resolved.error === "signup_rejected" ? 403 : 503);
     }
-    const user = await ctx.startSession(c, resolved.user, ["google"], { sv: resolved.sv });
-    await ctx.emit("user.signed_in", { user, method: "google" });
-    return c.json({ user });
+    return signInAnswer(c, await ctx.secondStep(c, resolved.user, ["google"], "google", result.profile));
   });
   const requireCodeFlow = async (c, next) => {
     if (!google.clientSecret) return c.json({ error: "not_found" }, 404);
-    if (!await ctx.enabled("google")) return disabled(c);
+    if (!await ctx.enabled(c, "google")) return disabled(c);
     await next();
   };
   app.get("/auth/google/start", requireCodeFlow, async (c) => {
@@ -4475,9 +5058,10 @@ function googleRoutes(app, ctx, google) {
     const oauth = await readToken(await keys, issuer, OAUTH_TYP, getCookie(c, OAUTH_COOKIE));
     if (!oauth) return c.text("Sign-in expired or was started in another browser. Please try again.", 400);
     deleteCookie(c, OAUTH_COOKIE, { path: "/auth/google", secure });
-    const back = (error) => {
+    const back = (error2, next) => {
       const url = new URL(oauth.returnTo);
-      if (error) url.hash = `${REDIRECT_ERROR_PARAM}=${error}`;
+      if (error2) url.hash = `${REDIRECT_ERROR_PARAM}=${error2}`;
+      if (next) url.hash = `${REDIRECT_NEXT_PARAM}=${next}`;
       return c.redirect(url.href, 302);
     };
     if (c.req.query("error")) return back(c.req.query("error") === "access_denied" ? "cancelled" : "verification_failed");
@@ -4511,80 +5095,38 @@ function googleRoutes(app, ctx, google) {
     if (!result.ok) return back(result.error);
     const resolved = await resolveUser(result.profile, typeof oauth.locale === "string" ? oauth.locale : void 0);
     if (!resolved.ok) return back(resolved.error);
-    const user = await ctx.startSession(c, resolved.user, ["google"], { sv: resolved.sv });
-    await ctx.emit("user.signed_in", { user, method: "google" });
+    const step = await ctx.secondStep(c, resolved.user, ["google"], "google", result.profile);
+    if ("disabled" in step) return back("method_disabled");
+    if ("next" in step) return back(void 0, step.next);
     return back();
   });
 }
 
-// src/routes/password.ts
+// src/routes/lockout.ts
 var FREE_ATTEMPTS = 5;
 var MAX_LOCK_MS = 15 * 60 * 1e3;
-var MAIL_INTERVAL_MS = 60 * 1e3;
-var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
-var RESET_TTL_MS = 30 * 60 * 1e3;
-var VERIFY_LINK_PARAM = "madauth_verify";
-var RESET_LINK_PARAM = "madauth_reset";
-var MAX_NAME_LENGTH = 100;
+async function countSignInAttempt(c, users, account, now = Date.now()) {
+  const tooMany = (message2) => c.json({ error: "too_many_attempts", message: message2 }, 429);
+  if (account.lockedUntil > now) {
+    const seconds = Math.ceil((account.lockedUntil - now) / 1e3);
+    return tooMany(`Too many failed attempts. Try again in ${seconds} seconds.`);
+  }
+  const failed = account.failedAttempts + 1;
+  const lockedUntil = failed >= FREE_ATTEMPTS ? now + Math.min(2 ** (failed - FREE_ATTEMPTS) * 1e3, MAX_LOCK_MS) : 0;
+  if (!await users.countAttempt(account, { failedAttempts: failed, lockedUntil })) {
+    return tooMany("Too many attempts at once. Please try again.");
+  }
+  return null;
+}
+
+// src/routes/password.ts
 function passwordRoutes(app, ctx, password, users, webhook) {
   const { minLength } = password;
-  const disabled = (c) => c.json({ error: "method_disabled", message: "E-mail & password sign-in is switched off." }, 403);
+  const emails = createEmails(ctx, users, webhook);
   app.use("/auth/password/*", async (c, next) => {
-    if (!await ctx.enabled("password")) return disabled(c);
+    if (!await ctx.enabled(c, "password")) return error(c, 403, "method_disabled", "E-mail & password sign-in is switched off.");
     await next();
   });
-  const body = async (c) => {
-    const data = await c.req.json().catch(() => null);
-    return data && typeof data === "object" ? data : {};
-  };
-  const error = (c, status, code, message2) => c.json({ error: code, message: message2 }, status);
-  const unavailable = (c) => error(c, 503, "temporarily_unavailable", "E-mails can not be sent right now. Please try again later.");
-  const accepted = (c) => c.json({}, 202);
-  const redirectTarget = (c, value) => {
-    const url = ctx.allowedUrl(value);
-    return url ?? error(c, 400, "invalid_options", "redirectTo must be an absolute URL whose origin is in ALLOWED_ORIGINS.");
-  };
-  const sendEmail = async (user, type, data) => {
-    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
-    const result = await webhook.call(type, { to: user.email, user: { id: user.id, name: user.name ?? void 0 }, ...data }, WEBHOOK_TIMEOUT_MS);
-    if (!result.ok) {
-      console.error(`[madauth] Webhook "${type}" for ${user.email} failed: ${result.reason}`);
-      return false;
-    }
-    await users.updateUser(user.id, { lastMailAt: Date.now() });
-    return true;
-  };
-  const sendLinkEmail = async (user, purpose, target, locale) => {
-    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
-    const ttl = purpose === "verify" ? VERIFY_TTL_MS : RESET_TTL_MS;
-    const { token, code } = await users.issueVerification(user.id, purpose, ttl);
-    const link = new URL(target);
-    link.hash = `${purpose === "verify" ? VERIFY_LINK_PARAM : RESET_LINK_PARAM}=${token}`;
-    return sendEmail(user, purpose === "verify" ? "email.verify" : "email.reset", {
-      link: link.href,
-      code,
-      expiresAt: Date.now() + ttl,
-      site: target.host,
-      locale
-    });
-  };
-  const consume = async (data, purpose) => {
-    if (typeof data.token === "string" && data.token) {
-      return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
-    }
-    if (isValidEmail(data.email) && typeof data.code === "string") {
-      const user = await users.findByEmail(normalizeEmail(data.email));
-      if (!user) return { userId: null, via: "code" };
-      return { ...await users.consumeCode(user, purpose, data.code.replace(/\s/g, "")), via: "code" };
-    }
-    return { userId: null, via: "code" };
-  };
-  const invalidVerification = (c, { via, locked }) => {
-    if (locked) {
-      return error(c, 429, "codes_locked", "Too many wrong codes. Please ask for a new e-mail and use the link in it.");
-    }
-    return via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
-  };
   app.post("/auth/password/signin", async (c) => {
     const data = await body(c);
     const wrong = () => error(c, 401, "invalid_credentials", "E-mail or password is wrong.");
@@ -4596,16 +5138,8 @@ function passwordRoutes(app, ctx, password, users, webhook) {
       await verifyAgainstDummy(pw);
       return wrong();
     }
-    const now = Date.now();
-    if (account.lockedUntil > now) {
-      const seconds = Math.ceil((account.lockedUntil - now) / 1e3);
-      return error(c, 429, "too_many_attempts", `Too many failed attempts. Try again in ${seconds} seconds.`);
-    }
-    const failed = account.failedAttempts + 1;
-    const lockedUntil = failed >= FREE_ATTEMPTS ? now + Math.min(2 ** (failed - FREE_ATTEMPTS) * 1e3, MAX_LOCK_MS) : 0;
-    if (!await users.countAttempt(account, { failedAttempts: failed, lockedUntil })) {
-      return error(c, 429, "too_many_attempts", "Too many attempts at once. Please try again.");
-    }
+    const refused = await countSignInAttempt(c, users, account);
+    if (refused) return refused;
     const { ok, needsRehash } = await verifyPassword(pw, account.secret);
     if (!ok) return wrong();
     await users.updateAccount(account.id, {
@@ -4616,28 +5150,24 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (!user.emailVerified) {
       return error(c, 403, "email_unverified", "Please confirm your e-mail address first. We can send the e-mail again.");
     }
-    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
-    await ctx.emit("user.signed_in", { user: result, method: "password" });
-    return c.json({ user: result });
+    return signInAnswer(c, await ctx.secondStep(c, user, ["pwd"], "password"));
   });
   app.post("/auth/password/signup", async (c) => {
     const data = await body(c);
-    const target = redirectTarget(c, data.redirectTo);
+    const target = redirectTarget(ctx, c, data.redirectTo);
     if (target instanceof Response) return target;
     if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
     const policy = checkPasswordPolicy(data.password, minLength);
     if (policy) return error(c, 400, "weak_password", policy);
-    const name = typeof data.name === "string" && data.name.trim() ? data.name.trim().slice(0, MAX_NAME_LENGTH) : null;
+    const name = nameOf(data.name);
     const email = data.email.trim();
     const locale = localeOf(data.locale);
     const check2 = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "password" });
     if (!check2.ok) return check2.reason === "rejected" ? error(c, 403, "signup_rejected", check2.message) : unavailable(c);
     const passwordHash = await hashPassword(data.password);
     const existing = await users.findByEmail(normalizeEmail(email));
-    if (existing?.emailVerified) {
-      if (!webhook.wants("email.already_registered")) return accepted(c);
-      const sent = await sendEmail(existing, "email.already_registered", { link: target.href, site: target.host, locale });
-      return sent ? accepted(c) : unavailable(c);
+    if (existing?.emailVerified && await users.hasAccounts(existing.id)) {
+      return await emails.sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c) : unavailable(c);
     }
     if (existing) {
       if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
@@ -4645,7 +5175,7 @@ function passwordRoutes(app, ctx, password, users, webhook) {
       if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
       else await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash });
       await users.updateUser(existing.id, { name });
-      return await sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
+      return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
     }
     const user = await users.createUser({
       email,
@@ -4656,38 +5186,19 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     });
     if (!user) return accepted(c);
     await ctx.emit("user.created", { user: toMadauthUser(user), method: "password" });
-    return await sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
-  });
-  app.post("/auth/password/send-verification", async (c) => {
-    const data = await body(c);
-    const target = redirectTarget(c, data.redirectTo);
-    if (target instanceof Response) return target;
-    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
-    const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && !user.emailVerified && await users.passwordAccount(user.id)) {
-      if (!await sendLinkEmail(user, "verify", target, localeOf(data.locale))) return unavailable(c);
-    }
-    return accepted(c);
-  });
-  app.post("/auth/password/verify-email", async (c) => {
-    const consumed = await consume(await body(c), "verify");
-    const { userId, via } = consumed;
-    const user = userId ? await users.findById(userId) : null;
-    if (!user) return invalidVerification(c, consumed);
-    await users.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
-    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
-    await ctx.emit("email.verified", { user: result, via });
-    await ctx.emit("user.signed_in", { user: result, method: "password" });
-    return c.json({ user: result });
+    return await emails.sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
   });
   app.post("/auth/password/send-reset", async (c) => {
     const data = await body(c);
-    const target = redirectTarget(c, data.redirectTo);
+    const target = redirectTarget(ctx, c, data.redirectTo);
     if (target instanceof Response) return target;
     if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
     const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && (user.emailVerified || await users.passwordAccount(user.id))) {
-      if (!await sendLinkEmail(user, "reset", target, localeOf(data.locale))) return unavailable(c);
+    const locale = localeOf(data.locale);
+    if (user && await users.passwordAccount(user.id)) {
+      if (!await emails.sendLinkEmail(user, "reset", target, locale)) return unavailable(c);
+    } else if (user) {
+      if (!await emails.sendAccountEmail(user, "email.no_password", target, locale)) return unavailable(c);
     }
     return accepted(c);
   });
@@ -4695,89 +5206,359 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     const data = await body(c);
     const policy = checkPasswordPolicy(data.password, minLength);
     if (policy) return error(c, 400, "weak_password", policy);
-    const consumed = await consume(data, "reset");
+    const consumed = await emails.consume(data, "reset");
     const user = consumed.userId ? await users.findById(consumed.userId) : null;
-    if (!user) return invalidVerification(c, consumed);
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account) return emails.invalidVerification(c, consumed);
     const secret = await hashPassword(data.password);
-    const account = await users.passwordAccount(user.id);
-    if (account) await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 });
-    else await users.linkAccount(user.id, { key: passwordAccountKey(user.id), secret });
+    if (!await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 })) return emails.invalidVerification(c, consumed);
     const sessionVersion = user.sessionVersion + 1;
     await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
     await users.clearVerifications(user.id);
-    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: sessionVersion });
-    await ctx.emit("email.password_reset", { user: result });
-    await ctx.emit("user.signed_in", { user: result, method: "password" });
-    return c.json({ user: result });
+    const reset = { ...user, emailVerified: true, sessionVersion, wrongCodes: 0 };
+    await ctx.emit("email.password_reset", { user: toMadauthUser(reset) });
+    return signInAnswer(c, await ctx.secondStep(c, reset, ["pwd"], "password"));
   });
 }
 
-// src/settings.ts
-var SIGN_IN_METHODS = ["google", "password"];
-var METHODS_SETTING = "methods";
-function parseMethodSettings(input) {
-  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
-  const settings = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (!SIGN_IN_METHODS.includes(key) || typeof value !== "boolean") return null;
-    settings[key] = value;
+// src/totp.ts
+import { createCipheriv, createDecipheriv, createHmac as createHmac3, hkdfSync as hkdfSync2, randomBytes as randomBytes4, randomInt as randomInt2 } from "crypto";
+var TOTP_STEP_SECONDS = 30;
+var TOTP_DIGITS = 6;
+var TOTP_WINDOW = 1;
+var RECOVERY_CODES = 10;
+var SECRET_BYTES = 20;
+var BASE32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+var RECOVERY_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+var RECOVERY_CODE_LENGTH = 10;
+var ENCRYPTION_VERSION = "v1";
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+function base32Encode(bytes) {
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (const byte of bytes) {
+    value = (value << 8 | byte) & 65535;
+    bits += 8;
+    while (bits >= 5) {
+      out += BASE32[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
   }
-  return settings;
+  if (bits > 0) out += BASE32[value << 5 - bits & 31];
+  return out;
 }
-var MAX_TRIES = 3;
-var Settings = class {
-  constructor(store) {
-    this.store = store;
+function hotp(secret, counter, digits = TOTP_DIGITS) {
+  const message2 = Buffer.alloc(8);
+  message2.writeBigUInt64BE(BigInt(counter));
+  const digest2 = createHmac3("sha1", secret).update(message2).digest();
+  const offset = digest2[digest2.length - 1] & 15;
+  const binary = (digest2[offset] & 127) << 24 | digest2[offset + 1] << 16 | digest2[offset + 2] << 8 | digest2[offset + 3];
+  return (binary % 10 ** digits).toString().padStart(digits, "0");
+}
+function stepOf(nowMs) {
+  return Math.floor(nowMs / 1e3 / TOTP_STEP_SECONDS);
+}
+function totp(secret, step, digits = TOTP_DIGITS) {
+  return hotp(secret, step, digits);
+}
+function verifyTotp(secret, code, nowMs, window = TOTP_WINDOW) {
+  const given = code.replace(/\s/g, "");
+  if (!new RegExp(`^\\d{${TOTP_DIGITS}}$`).test(given)) return null;
+  const now = stepOf(nowMs);
+  let found = null;
+  for (let step = now - window; step <= now + window; step++) {
+    if (safeEqual(totp(secret, step), given) && found === null) found = step;
+  }
+  return found;
+}
+function generateTotpSecret() {
+  return randomBytes4(SECRET_BYTES);
+}
+function otpauthUri(options) {
+  const issuer = encodeURIComponent(options.issuer);
+  const account = encodeURIComponent(options.account);
+  const secret = base32Encode(options.secret);
+  return `otpauth://totp/${issuer}:${account}?secret=${secret}&issuer=${issuer}&algorithm=SHA1&digits=${TOTP_DIGITS}&period=${TOTP_STEP_SECONDS}`;
+}
+function deriveTotpKey(signingKeyD) {
+  return Buffer.from(hkdfSync2("sha256", Buffer.from(signingKeyD, "base64url"), "", "madauth totp secret", 32));
+}
+function encryptSecret(key, secret) {
+  const iv = randomBytes4(IV_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(secret), cipher.final()]);
+  const parts = [iv, encrypted, cipher.getAuthTag()].map((part) => part.toString("base64url"));
+  return [ENCRYPTION_VERSION, ...parts].join(".");
+}
+function decryptSecret(key, stored) {
+  const [version, iv, encrypted, tag2, ...rest] = stored.split(".");
+  if (version !== ENCRYPTION_VERSION || !iv || !encrypted || !tag2 || rest.length) return null;
+  const ivBytes = Buffer.from(iv, "base64url");
+  const tagBytes = Buffer.from(tag2, "base64url");
+  if (ivBytes.length !== IV_BYTES || tagBytes.length !== TAG_BYTES) return null;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, ivBytes);
+    decipher.setAuthTag(tagBytes);
+    return Buffer.concat([decipher.update(Buffer.from(encrypted, "base64url")), decipher.final()]);
+  } catch {
+    return null;
   }
-  /** The setting's value, or undefined if it was never set. */
-  async get(id) {
-    return (await this.read(id)).value;
+}
+function generateRecoveryCodes() {
+  const codes = /* @__PURE__ */ new Set();
+  while (codes.size < RECOVERY_CODES) {
+    let code = "";
+    for (let i = 0; i < RECOVERY_CODE_LENGTH; i++) code += RECOVERY_ALPHABET[randomInt2(RECOVERY_ALPHABET.length)];
+    codes.add(`${code.slice(0, 5)}-${code.slice(5)}`);
   }
-  /** The stored JSON and what it holds; both undefined if the setting was never set. */
-  async read(id) {
-    const record = await this.store.findOne("setting", { id });
-    if (typeof record?.value !== "string") return {};
-    try {
-      return { json: record.value, value: JSON.parse(record.value) };
-    } catch {
-      return { json: record.value };
-    }
+  return [...codes];
+}
+function normalizeRecoveryCode(text) {
+  if (typeof text !== "string") return null;
+  const code = text.toLowerCase().replace(/[\s-]/g, "");
+  return code.length === RECOVERY_CODE_LENGTH && [...code].every((char) => RECOVERY_ALPHABET.includes(char)) ? code : null;
+}
+function hashRecoveryCode(codeKey, code) {
+  return hashCode(codeKey, `recovery:${code}`);
+}
+
+// src/routes/totp.ts
+var CHALLENGE_COOKIE = "madauth_challenge";
+var CHALLENGE_TYP = "madauth-challenge+jwt";
+var CHALLENGE_TTL = 10 * 60;
+var SETUP_COOKIE = "madauth_totp_setup";
+var SETUP_TYP = "madauth-totp-setup+jwt";
+var SETUP_TTL = 10 * 60;
+var COOKIE_PATH = "/auth/totp";
+var cookieOptions = (secure) => ({ path: COOKIE_PATH, httpOnly: true, secure, sameSite: "Strict" });
+async function setChallenge(c, ctx, challenge) {
+  const token = await signToken(await ctx.keys, ctx.config.issuer, CHALLENGE_TYP, { ...challenge }, CHALLENGE_TTL);
+  setCookie(c, CHALLENGE_COOKIE, token, { ...cookieOptions(ctx.secure), maxAge: CHALLENGE_TTL });
+}
+function clearChallenge(c, secure) {
+  deleteCookie(c, CHALLENGE_COOKIE, cookieOptions(secure));
+}
+async function readChallenge(c, ctx, next) {
+  const claims = await readToken(await ctx.keys, ctx.config.issuer, CHALLENGE_TYP, getCookie(c, CHALLENGE_COOKIE));
+  return claims && claims.next === next && typeof claims.sub === "string" && Array.isArray(claims.amr) ? claims : null;
+}
+async function checkCode(c, ctx, keys, user, account, data, wrong = () => error(c, 401, "code_invalid", "The code is wrong or was already used.")) {
+  const { users } = ctx;
+  const refused = await countSignInAttempt(c, users, account);
+  if (refused) return refused;
+  if (typeof data.recoveryCode === "string") {
+    const code = normalizeRecoveryCode(data.recoveryCode);
+    if (!code || !await users.consumeRecoveryCode(account, hashRecoveryCode(keys.codeKey, code))) return wrong();
+    await users.updateAccount(account.id, { failedAttempts: 0, lockedUntil: 0 });
+    const remaining = await users.countRecoveryCodes(account);
+    await ctx.emit("totp.recovery_code_used", { user: toMadauthUser(user), remaining });
+    return "recovery_code";
+  }
+  if (typeof data.code !== "string" || !account.secret) return wrong();
+  const secret = decryptSecret(keys.totpKey, account.secret);
+  if (!secret) {
+    console.error(`[madauth] The authenticator secret of user ${user.id} can't be read: was MADAUTH_SIGNING_KEY changed?`);
+    return wrong();
   }
-  /**
-   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
-   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
-   * again with the newer value. Resolves to the new value, or null if `apply` refused.
-   * `updatedBy` is the address of the admin, or null for the command line.
-   */
-  async change(id, apply, updatedBy) {
-    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
-      const { json, value } = await this.read(id);
-      const next = apply(value);
-      if (next === null) return null;
-      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
-      const written = json === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json }, patch) === 1;
-      if (written) return next;
+  const step = verifyTotp(secret, data.code, Date.now(), TOTP_WINDOW);
+  if (step === null || step <= (account.lastUsedStep ?? 0) || !await users.useTotpStep(account, step)) return wrong();
+  return "totp";
+}
+function totpRoutes(app, ctx, keys) {
+  const { config, secure, users } = ctx;
+  const { issuer } = config;
+  const cookie = cookieOptions(secure);
+  const methodsNow = (c) => ctx.methods(c);
+  app.use(`${COOKIE_PATH}/*`, async (c, next) => {
+    if (!authenticatorOn(ctx.configured, await methodsNow(c))) {
+      return error(c, 403, "method_disabled", "The authenticator app is switched off.");
     }
-    throw new Error(`Setting "${id}" kept changing; try again.`);
-  }
-  /** Replaces the setting. */
-  async set(id, value, updatedBy) {
-    await this.change(id, () => value, updatedBy);
-  }
-  /** Which sign-in methods are on; a method that was never switched off is on. */
-  async methods() {
-    return parseMethodSettings(await this.get(METHODS_SETTING)) ?? {};
-  }
-  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
-  async changeMethods(apply, updatedBy) {
-    return this.change(METHODS_SETTING, (current) => apply(parseMethodSettings(current) ?? {}), updatedBy);
+    await next();
+  });
+  const standalone = async (c) => isOn("totp", ctx.configured, await methodsNow(c));
+  const notStandalone = (c) => error(c, 403, "method_disabled", "Signing in with the authenticator app alone is switched off.");
+  const methodStillOn = async (c, challenge) => isOn(challenge.method, ctx.configured, await methodsNow(c));
+  const methodOff = (c) => error(c, 403, "method_disabled", "This way of signing in is switched off.");
+  const signedIn = async (c) => {
+    const user = await ctx.currentUser(c);
+    return user ? users.findById(user.id) : null;
+  };
+  const whoSetsUp = async (c) => {
+    const challenge = await readChallenge(c, ctx, "totp-setup");
+    const waiting = challenge ? await users.findById(challenge.sub) : null;
+    if (challenge && waiting && waiting.sessionVersion === challenge.sv) return { user: waiting, challenge };
+    const user = await signedIn(c);
+    return user ? { user, challenge: null } : null;
+  };
+  const newRecoveryCodes = () => {
+    const recoveryCodes = generateRecoveryCodes();
+    return { recoveryCodes, hashes: recoveryCodes.map((code) => hashRecoveryCode(keys.codeKey, normalizeRecoveryCode(code))) };
+  };
+  const issuerLabel = (c) => {
+    if (config.totpIssuer) return config.totpIssuer;
+    const origin = c.req.header("origin");
+    return URL.canParse(origin ?? "") ? new URL(origin).hostname : new URL(issuer).hostname;
+  };
+  const finishSignIn = async (c, user, challenge, via) => {
+    const result = await ctx.startSession(c, toMadauthUser(user, challenge.profile), [...challenge.amr, "otp"], { sv: user.sessionVersion });
+    await ctx.emit("user.signed_in", { user: result, method: challenge.method, ...challenge.amr.length ? { secondFactor: via } : {} });
+    return result;
+  };
+  app.post(`${COOKIE_PATH}/setup`, async (c) => {
+    const who = await whoSetsUp(c);
+    if (!who) return noSession(c);
+    if (who.challenge && !await methodStillOn(c, who.challenge)) return methodOff(c);
+    const existing = await users.totpAccount(who.user.id);
+    let approved;
+    if (existing) {
+      const previous = await readToken(await ctx.keys, issuer, SETUP_TYP, getCookie(c, SETUP_COOKIE));
+      const holds = previous?.sub === who.user.id && typeof previous.approved === "number" && Date.now() - previous.approved < SETUP_TTL * 1e3;
+      if (holds) {
+        approved = previous.approved;
+      } else {
+        const data = await body(c);
+        if (data.code === void 0 && data.recoveryCode === void 0) {
+          return error(c, 401, "code_required", "Enter a code from your current authenticator app (or a recovery code) to replace it.");
+        }
+        const via = await checkCode(c, ctx, keys, who.user, existing, data);
+        if (via instanceof Response) return via;
+        approved = Date.now();
+      }
+    }
+    const secret = generateTotpSecret();
+    const claims = {
+      sub: who.user.id,
+      setup: newId("tsu"),
+      secret: encryptSecret(keys.totpKey, secret),
+      ...existing ? { replaces: existing.setupId } : {},
+      ...approved ? { approved } : {}
+    };
+    const token = await signToken(await ctx.keys, issuer, SETUP_TYP, claims, SETUP_TTL);
+    setCookie(c, SETUP_COOKIE, token, { ...cookie, maxAge: SETUP_TTL });
+    return c.json({ secret: base32Encode(secret), uri: otpauthUri({ issuer: issuerLabel(c), account: who.user.email, secret }) });
+  });
+  app.post(`${COOKIE_PATH}/confirm`, async (c) => {
+    const who = await whoSetsUp(c);
+    if (!who) return noSession(c);
+    const { user, challenge } = who;
+    if (challenge && !await methodStillOn(c, challenge)) return methodOff(c);
+    const data = await body(c);
+    const setup = await readToken(await ctx.keys, issuer, SETUP_TYP, getCookie(c, SETUP_COOKIE));
+    const secret = setup && setup.sub === user.id && typeof setup.secret === "string" && typeof setup.setup === "string" ? decryptSecret(keys.totpKey, setup.secret) : null;
+    if (!setup || !secret) return error(c, 400, "setup_expired", "The setup has expired or was started in another browser. Please start again.");
+    const step = typeof data.code === "string" ? verifyTotp(secret, data.code, Date.now(), TOTP_WINDOW) : null;
+    if (step === null) return error(c, 400, "code_invalid", "The code is wrong. Enter the current code from the app.");
+    const { recoveryCodes, hashes } = newRecoveryCodes();
+    await users.addRecoveryCodes(user.id, setup.setup, hashes);
+    const patch = { secret: setup.secret, setupId: setup.setup, failedAttempts: 0, lockedUntil: 0, lastUsedStep: step };
+    const current = setup.replaces === void 0 ? null : await users.totpAccount(user.id);
+    const written = setup.replaces === void 0 ? !!await users.linkAccount(user.id, { key: totpAccountKey(user.id), ...patch }) : !!current && await users.confirmTotpSetup(current.id, setup.replaces, patch);
+    if (!written) {
+      await users.clearRecoveryCodes(user.id, { only: setup.setup });
+      deleteCookie(c, SETUP_COOKIE, cookie);
+      return error(c, 400, "setup_expired", "Your authenticator app was set up or removed elsewhere meanwhile. Please start again.");
+    }
+    await users.clearRecoveryCodes(user.id, { except: setup.setup });
+    deleteCookie(c, SETUP_COOKIE, cookie);
+    await ctx.emit("totp.enabled", { user: toMadauthUser(user) });
+    if (!challenge) return c.json({ recoveryCodes });
+    const result = await finishSignIn(c, user, challenge, "totp");
+    return c.json({ user: result, recoveryCodes });
+  });
+  app.post(`${COOKIE_PATH}/verify`, async (c) => {
+    const expired = () => error(c, 401, "challenge_expired", "The sign-in has expired. Please sign in again.");
+    const challenge = await readChallenge(c, ctx, "totp");
+    if (!challenge) return expired();
+    if (!await methodStillOn(c, challenge)) return methodOff(c);
+    const user = await users.findById(challenge.sub);
+    const account = user && user.sessionVersion === challenge.sv ? await users.totpAccount(user.id) : null;
+    if (!user || !account) return expired();
+    const via = await checkCode(c, ctx, keys, user, account, await body(c));
+    if (via instanceof Response) return via;
+    return c.json({ user: await finishSignIn(c, user, challenge, via) });
+  });
+  app.post(`${COOKIE_PATH}/signin`, async (c) => {
+    if (!await standalone(c)) return notStandalone(c);
+    const data = await body(c);
+    const wrong = () => error(c, 401, "invalid_credentials", "E-mail or code is wrong.");
+    if (!isValidEmail(data.email)) return wrong();
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    const account = user ? await users.totpAccount(user.id) : null;
+    if (!user || !user.emailVerified || !account?.secret) return wrong();
+    const via = await checkCode(c, ctx, keys, user, account, data, wrong);
+    if (via instanceof Response) return via;
+    const result = await ctx.startSession(c, toMadauthUser(user), ["otp"], { sv: user.sessionVersion });
+    await ctx.emit("user.signed_in", { user: result, method: "totp" });
+    return c.json({ user: result });
+  });
+  app.post(`${COOKIE_PATH}/remove`, async (c) => {
+    const user = await signedIn(c);
+    if (!user) return noSession(c);
+    const methods = await methodsNow(c);
+    const required = METHODS_WITH_SECOND_FACTOR.filter((method) => isOn(method, ctx.configured, methods) && policyOf(method, methods) === "required");
+    if (required.length) {
+      const names = required.map((method) => method === "google" ? "Google" : "e-mail & password");
+      return error(c, 403, "required_by_policy", `Signing in with ${names.join(" and ")} requires the authenticator app, so it can't be removed.`);
+    }
+    const account = await users.totpAccount(user.id);
+    if (!account) return c.json({});
+    if (!(await users.signInMethods(user.id, methods)).some((method) => method !== "totp" && isOn(method, ctx.configured, methods))) {
+      return error(c, 403, "only_method", "The authenticator app is the only way you sign in, so it can't be removed. Delete your account instead.");
+    }
+    const via = await checkCode(c, ctx, keys, user, account, await body(c));
+    if (via instanceof Response) return via;
+    await users.removeTotp(user.id);
+    await ctx.emit("totp.disabled", { user: toMadauthUser(user) });
+    return c.json({});
+  });
+  app.post(`${COOKIE_PATH}/recovery-codes`, async (c) => {
+    const user = await signedIn(c);
+    if (!user) return noSession(c);
+    const account = await users.totpAccount(user.id);
+    if (!account) return error(c, 400, "no_authenticator", "No authenticator app is set up.");
+    const via = await checkCode(c, ctx, keys, user, account, await body(c));
+    if (via instanceof Response) return via;
+    const { recoveryCodes, hashes } = newRecoveryCodes();
+    await users.replaceRecoveryCodes(account, hashes);
+    return c.json({ recoveryCodes });
+  });
+  app.get(`${COOKIE_PATH}/status`, async (c) => {
+    const user = await signedIn(c);
+    if (!user) return noSession(c);
+    const account = await users.totpAccount(user.id);
+    return c.json({ enabled: !!account, recoveryCodesLeft: account ? await users.countRecoveryCodes(account) : 0 });
+  });
+  if (ctx.webhook && ctx.emailVerification) {
+    const emails = createEmails(ctx, users, ctx.webhook);
+    app.post(`${COOKIE_PATH}/signup`, async (c) => {
+      if (!await standalone(c)) return notStandalone(c);
+      const data = await body(c);
+      const target = redirectTarget(ctx, c, data.redirectTo);
+      if (target instanceof Response) return target;
+      if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+      const name = nameOf(data.name);
+      const email = data.email.trim();
+      const locale = localeOf(data.locale);
+      const check2 = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "totp" });
+      if (!check2.ok) return check2.reason === "rejected" ? error(c, 403, "signup_rejected", check2.message) : unavailable(c);
+      const existing = await users.findByEmail(normalizeEmail(email));
+      if (existing?.emailVerified && await users.hasAccounts(existing.id)) {
+        return await emails.sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c) : unavailable(c);
+      }
+      if (existing) {
+        if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
+        if (!existing.emailVerified) await users.unlinkAccount(passwordAccountKey(existing.id));
+        await users.updateUser(existing.id, { name });
+        return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
+      }
+      const user = await users.createUser({ email, emailNormalized: normalizeEmail(email), name, emailVerified: false });
+      if (!user) return accepted(c);
+      await ctx.emit("user.created", { user: toMadauthUser(user), method: "totp" });
+      return await emails.sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
+    });
   }
-};
-function isOn(method, available, methods) {
-  return available(method) && methods[method] !== false;
-}
-function anyOn(available, methods) {
-  return SIGN_IN_METHODS.some((method) => isOn(method, available, methods));
 }
 
 // src/app.ts
@@ -4787,9 +5568,14 @@ function createApp(config) {
   const keys = importSigningKeys(config.signingKey);
   const secure = issuer.startsWith("https:");
   const isAllowedOrigin = (origin) => !!origin && allowedOrigins.includes(origin);
-  const users = new Users(config.store, deriveCodeKey(config.signingKey.d));
-  const settings = new Settings(config.store);
-  const available = (method) => method === "google" ? !!config.google : !!config.password;
+  const codeKey = deriveCodeKey(config.signingKey.d);
+  const users = new Users(config.store, codeKey);
+  const methods = methodConfig(config);
+  const settings = new Settings(config.store, initialMethods(methods));
+  const configured = (method) => isConfigured(methods, method);
+  const signsUp = (method) => canSignUp(methods, method);
+  const emailVerification = sendsVerificationEmails(config);
+  const totpKeys = { totpKey: deriveTotpKey(config.signingKey.d), codeKey };
   const issueSession = async (c, user, amr, extra) => {
     const signingKeys = await keys;
     const [sessionToken, renewalToken] = await Promise.all([
@@ -4824,6 +5610,29 @@ function createApp(config) {
     deleteCookie(c, RENEWAL_COOKIE, { path: "/auth", secure });
     deleteCookie(c, EXPIRY_COOKIE, { path: "/", domain: cookieDomain, secure });
   };
+  const tokenClaims = async (c, cookie, typ) => readToken(await keys, issuer, typ, getCookie(c, cookie));
+  const checked = async (claims) => {
+    const stored = await users.findById(claims.sub);
+    if (!stored || stored.sessionVersion !== claims.sv) return null;
+    const { claims: _, ...user } = userFromClaims(claims);
+    const current = claimsFromJson(stored.claims);
+    return Object.keys(current).length ? { ...user, claims: current } : user;
+  };
+  const currentSession = async (c) => {
+    const session = await tokenClaims(c, SESSION_COOKIE, SESSION_TYP);
+    const user = session ? await checked(session) : null;
+    const upToDate = session && user && sameClaims(user.claims, session.claims) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
+    if (upToDate) return user;
+    const renewal = await tokenClaims(c, RENEWAL_COOKIE, RENEWAL_TYP);
+    const sameSignIn = session && user && renewal && renewal.sub === session.sub && renewal.sv === session.sv && renewal.email === session.email;
+    const renewed = sameSignIn ? user : renewal ? await checked(renewal) : null;
+    if (renewal && renewed) {
+      await issueSession(c, renewed, renewal.amr, { sv: renewal.sv });
+      return renewed;
+    }
+    return user;
+  };
+  const methodsOf = /* @__PURE__ */ new WeakMap();
   const ctx = {
     config,
     keys,
@@ -4841,14 +5650,42 @@ function createApp(config) {
       return url;
     },
     async startSession(c, user, amr, extra) {
+      clearChallenge(c, secure);
       await issueSession(c, user, amr, extra);
-      return user;
+      return { ...user, amr };
+    },
+    async secondStep(c, user, amr, method, profile) {
+      const methods2 = await this.methods(c);
+      if (!isOn(method, configured, methods2)) return { disabled: true };
+      const enrolled = await users.totpAccount(user.id);
+      const policy = method === "totp" ? "required" : policyOf(method, methods2);
+      const next = policy === "none" ? null : enrolled ? "totp" : policy === "required" ? "totp-setup" : null;
+      if (next) {
+        clearSession(c);
+        const known = { ...profile?.name ? { name: profile.name } : {}, ...profile?.picture ? { picture: profile.picture } : {} };
+        await setChallenge(c, this, { sub: user.id, sv: user.sessionVersion, amr, method, next, ...Object.keys(known).length ? { profile: known } : {} });
+        return { next, method };
+      }
+      const result = await this.startSession(c, toMadauthUser(user, profile), amr, { sv: user.sessionVersion });
+      await this.emit("user.signed_in", { user: result, method });
+      return { user: result };
     },
+    currentUser: currentSession,
     users,
     settings,
     webhook: config.webhook ? createWebhookClient(config.webhook, config.webhookFetch) : void 0,
-    async enabled(method) {
-      return isOn(method, available, await settings.methods());
+    configured,
+    emailVerification,
+    methods(c) {
+      let reading = methodsOf.get(c.req.raw);
+      if (!reading) {
+        reading = settings.methods();
+        methodsOf.set(c.req.raw, reading);
+      }
+      return reading;
+    },
+    async enabled(c, method) {
+      return isOn(method, configured, await this.methods(c));
     },
     async checkSignup(data) {
       if (!this.webhook?.wants("signup.before")) return { ok: true };
@@ -4866,7 +5703,9 @@ function createApp(config) {
     },
     async emit(type, data) {
       if (!this.webhook?.wants(type)) return;
-      const result = await this.webhook.call(type, data, EVENT_TIMEOUT_MS);
+      const user = data.user;
+      const payload = user && typeof user === "object" && "amr" in user ? { ...data, user: { ...user, amr: void 0 } } : data;
+      const result = await this.webhook.call(type, payload, EVENT_TIMEOUT_MS);
       if (!result.ok) console.error(`[madauth] Webhook "${type}" failed: ${result.reason}`);
     }
   };
@@ -4894,37 +5733,20 @@ function createApp(config) {
     return c.json({ keys: [publicJwk] });
   });
   app.get("/auth/config", async (c) => {
-    const methods = await settings.methods();
-    const on = (method) => isOn(method, available, methods);
+    const current = await ctx.methods(c);
+    const on = (method) => isOn(method, configured, current);
     return c.json({
-      google: on("google") ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret } : null,
-      password: on("password") ? { minLength: config.password.minLength } : null
+      google: on("google") ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret, secondFactor: policyOf("google", current) } : null,
+      password: on("password") ? { minLength: config.password.minLength, secondFactor: policyOf("password", current) } : null,
+      // The app can be set up when it is in use at all; `signIn` says whether it signs in on its own.
+      totp: authenticatorOn(configured, current) ? { signIn: on("totp"), signUp: on("totp") && emailVerification } : null,
+      email: { verification: emailVerification }
     });
   });
+  if (emailVerification && ctx.webhook) emailRoutes(app, ctx, users, ctx.webhook);
   if (config.google) googleRoutes(app, ctx, config.google);
   if (config.password && ctx.webhook) passwordRoutes(app, ctx, config.password, users, ctx.webhook);
-  const tokenClaims = async (c, cookie, typ) => readToken(await keys, issuer, typ, getCookie(c, cookie));
-  const checked = async (claims) => {
-    const stored = await users.findById(claims.sub);
-    if (!stored || stored.sessionVersion !== claims.sv) return null;
-    const { claims: _, ...user } = userFromClaims(claims);
-    const current = claimsFromJson(stored.claims);
-    return Object.keys(current).length ? { ...user, claims: current } : user;
-  };
-  const currentSession = async (c) => {
-    const session = await tokenClaims(c, SESSION_COOKIE, SESSION_TYP);
-    const user = session ? await checked(session) : null;
-    const upToDate = session && user && sameClaims(user.claims, session.claims) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
-    if (upToDate) return user;
-    const renewal = await tokenClaims(c, RENEWAL_COOKIE, RENEWAL_TYP);
-    const sameSignIn = session && user && renewal && renewal.sub === session.sub && renewal.sv === session.sv && renewal.email === session.email;
-    const renewed = sameSignIn ? user : renewal ? await checked(renewal) : null;
-    if (renewal && renewed) {
-      await issueSession(c, renewed, renewal.amr, { sv: renewal.sv });
-      return renewed;
-    }
-    return user;
-  };
+  totpRoutes(app, ctx, totpKeys);
   app.get("/auth/session", async (c) => {
     const user = await currentSession(c);
     if (!user) {
@@ -4935,11 +5757,23 @@ function createApp(config) {
   });
   app.post("/auth/logout", (c) => {
     clearSession(c);
+    clearChallenge(c, secure);
     return c.body(null, 204);
   });
   app.post("/auth/account/delete", async (c) => {
     const user = await currentSession(c);
     if (!user) return c.json({ error: "no_session" }, 401);
+    const stored = await users.findById(user.id);
+    const protects = stored && authenticatorOn(configured, await ctx.methods(c));
+    const authenticator = protects ? await users.totpAccount(user.id) : null;
+    if (stored && authenticator) {
+      const data = await body(c);
+      if (data.code === void 0 && data.recoveryCode === void 0) {
+        return error(c, 401, "code_required", "Enter a code from your authenticator app (or a recovery code) to delete your account.");
+      }
+      const via = await checkCode(c, ctx, totpKeys, stored, authenticator, data);
+      if (via instanceof Response) return via;
+    }
     await users.deleteById(user.id);
     clearSession(c);
     await ctx.emit("user.deleted", { user });
@@ -4955,10 +5789,6 @@ function createApp(config) {
     }
     return { email };
   };
-  const body = async (c) => {
-    const data = await c.req.json().catch(() => null);
-    return data && typeof data === "object" ? data : {};
-  };
   const invalidEmail = (c) => c.json({ error: "invalid_email", message: "This is not a valid e-mail address." }, 400);
   const noUser = (c) => c.json({ error: "user_not_found", message: "No user has this e-mail address." }, 404);
   app.post("/auth/admin/claims/get", async (c) => {
@@ -4992,9 +5822,16 @@ function createApp(config) {
     await ctx.emit("user.claims_changed", { userId: user.id, email, claims, by: caller.email });
     return c.json({ email, userId: user.id, claims });
   });
-  const settingsAnswer = (methods) => ({
+  const settingsAnswer = (methods2) => ({
     methods: Object.fromEntries(
-      SIGN_IN_METHODS.map((method) => [method, { available: available(method), enabled: isOn(method, available, methods) }])
+      SIGN_IN_METHODS.map((method) => [
+        method,
+        {
+          configured: configured(method),
+          enabled: isOn(method, configured, methods2),
+          ...method === "totp" ? {} : { secondFactor: policyOf(method, methods2) }
+        }
+      ])
     )
   });
   app.post("/auth/admin/settings/get", async (c) => {
@@ -5007,212 +5844,30 @@ function createApp(config) {
     if ("answer" in caller) return caller.answer;
     const data = await body(c);
     const invalid2 = (message2) => c.json({ error: "invalid_settings", message: message2 }, 400);
-    const changes = parseMethodSettings(data.methods);
-    if (!changes) return invalid2(`methods must be an object with true or false for ${SIGN_IN_METHODS.join(" and/or ")}.`);
-    const methods = await settings.changeMethods((current) => {
-      const next = { ...current, ...changes };
-      return anyOn(available, next) ? next : null;
-    }, caller.email);
-    if (!methods) return invalid2("At least one sign-in method must stay on.");
-    return c.json(settingsAnswer(methods));
+    const next = parseMethodSettings(data.methods, { booleans: true });
+    if (!next) {
+      return invalid2(
+        `methods must list the sign-in methods that are on (${SIGN_IN_METHODS.join(", ")}), each as true, {} or { "secondFactor": "none" | "optional" | "required" } (google and password), e.g. { "google": {}, "password": { "secondFactor": "optional" } }. A method that is not listed is off.`
+      );
+    }
+    const methods2 = await settings.changeMethods(() => anyOn(signsUp, next) ? next : null, caller.email);
+    if (!methods2) return invalid2("At least one sign-in method that creates users must stay on: Google, e-mail & password, or the authenticator app with sign-up by e-mail.");
+    return c.json(settingsAnswer(methods2));
+  });
+  app.post("/auth/admin/totp/remove", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    if (!isValidEmail(data.email)) return invalidEmail(c);
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c);
+    const removed = await users.removeTotp(user.id);
+    if (removed) await ctx.emit("totp.disabled", { user: toMadauthUser(user), by: caller.email });
+    return c.json({ email: user.emailNormalized, userId: user.id, enabled: false });
   });
   return app;
 }
 
-// src/config.ts
-async function resolveEnv(source = process.env) {
-  return typeof source === "function" ? source() : source;
-}
-var DEFAULT_SESSION_TTL = 8 * 60 * 60;
-var DEFAULT_RENEWAL_TTL = 30 * 24 * 60 * 60;
-var DEFAULT_PASSWORD_MIN_LENGTH = 8;
-var ConfigError = class extends Error {
-  constructor() {
-    super(...arguments);
-    this.name = "ConfigError";
-  }
-};
-function parseOrigin(name, value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new ConfigError(`${name}: "${value}" is not a URL.`);
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:") {
-    throw new ConfigError(`${name}: "${value}" must be an http(s) URL.`);
-  }
-  return url.origin;
-}
-function readEnv(env, name) {
-  return env[name]?.trim().replace(/^(['"])(.*)\1$/s, "$2").trim() || void 0;
-}
-async function loadConfig(env, overrides = {}) {
-  const read = (name) => readEnv(env, name);
-  const require2 = (name) => {
-    const value = read(name);
-    if (!value) throw new ConfigError(`${name} is not set. See docs/server.md.`);
-    return value;
-  };
-  const issuerValue = require2("MADAUTH_ISSUER");
-  parseOrigin("MADAUTH_ISSUER", issuerValue);
-  const issuer = issuerValue.replace(/\/+$/, "");
-  const keyValue = read("MADAUTH_SIGNING_KEY");
-  if (!keyValue) {
-    const key = await generateSigningKey();
-    throw new ConfigError(
-      `MADAUTH_SIGNING_KEY is not set. Here is a newly generated key you can use (keep it secret and use the same key on every instance):
-
-MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
-`
-    );
-  }
-  let signingKey;
-  try {
-    signingKey = JSON.parse(keyValue);
-    assertPrivateSigningJwk(signingKey);
-  } catch (e) {
-    const reason = e instanceof SyntaxError ? "is not valid JSON" : e.message;
-    throw new ConfigError(`MADAUTH_SIGNING_KEY ${reason}. Generate one with: npx @madauth/server generate-key`);
-  }
-  const allowedOrigins = require2("ALLOWED_ORIGINS").split(",").map((o) => o.trim()).filter(Boolean).map((o) => parseOrigin("ALLOWED_ORIGINS", o));
-  const clientId = read("GOOGLE_CLIENT_ID");
-  if (clientId && !clientId.endsWith(".apps.googleusercontent.com")) {
-    throw new ConfigError(`GOOGLE_CLIENT_ID must end with ".apps.googleusercontent.com" but is "${clientId}".`);
-  }
-  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
-  const sendsEmails = !!webhook && REQUIRED_EMAIL_TYPES.every((type) => webhook.events.has(type));
-  const password = sendsEmails ? { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")) } : void 0;
-  if (!clientId && !password) {
-    throw new ConfigError(
-      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See docs/server.md.`
-    );
-  }
-  const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
-  if (!store) {
-    throw new ConfigError(
-      "DATABASE_URL is not set. madAuth stores every user, whichever way they sign in: set e.g. DATABASE_URL=sqlite:./madauth.db or DATABASE_URL=dynamodb:<table>. See docs/server.md."
-    );
-  }
-  const ttlValue = read("SESSION_TTL");
-  const sessionTtlSeconds = ttlValue ? Number(ttlValue) : DEFAULT_SESSION_TTL;
-  if (!Number.isInteger(sessionTtlSeconds) || sessionTtlSeconds < 60) {
-    throw new ConfigError(`SESSION_TTL must be a whole number of seconds (at least 60) but is "${ttlValue}".`);
-  }
-  const renewalValue = read("SESSION_RENEWAL_TTL");
-  const renewalTtlSeconds = renewalValue ? Number(renewalValue) : Math.max(DEFAULT_RENEWAL_TTL, sessionTtlSeconds);
-  if (!Number.isInteger(renewalTtlSeconds) || renewalTtlSeconds < sessionTtlSeconds) {
-    throw new ConfigError(
-      `SESSION_RENEWAL_TTL must be a whole number of seconds, not less than SESSION_TTL (${sessionTtlSeconds}), but is "${renewalValue}".`
-    );
-  }
-  return {
-    issuer,
-    signingKey,
-    allowedOrigins,
-    sessionTtlSeconds,
-    renewalTtlSeconds,
-    cookieDomain: read("COOKIE_DOMAIN"),
-    google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
-    store,
-    password,
-    webhook
-  };
-}
-function passwordMinLength(value) {
-  const minLength = value ? Number(value) : DEFAULT_PASSWORD_MIN_LENGTH;
-  if (!Number.isInteger(minLength) || minLength < 1 || minLength > 128) {
-    throw new ConfigError(`PASSWORD_MIN_LENGTH must be a whole number from 1 to 128 but is "${value}".`);
-  }
-  return minLength;
-}
-async function storeFromDatabaseUrl(url) {
-  if (!url) return void 0;
-  if (url.startsWith("dynamodb:")) return dynamoDbStore(url.slice("dynamodb:".length));
-  if (!url.startsWith("sqlite:")) {
-    throw new ConfigError(
-      `DATABASE_URL must start with "sqlite:" (e.g. sqlite:/data/madauth.db) or "dynamodb:" (e.g. dynamodb:madauth) but is "${url}". For other databases, pass your own store adapter (see "Custom store adapter" in docs/server.md).`
-    );
-  }
-  const path = url.slice("sqlite:".length);
-  if (!path) throw new ConfigError("DATABASE_URL needs a file path, e.g. sqlite:/data/madauth.db");
-  const { createSqliteAdapter: createSqliteAdapter2 } = await Promise.resolve().then(() => (init_sqlite(), sqlite_exports));
-  try {
-    return createSqliteAdapter2(path);
-  } catch (e) {
-    throw new ConfigError(`DATABASE_URL: could not open "${path}": ${e.message}`);
-  }
-}
-async function dynamoDbStore(tableName2) {
-  if (!tableName2) throw new ConfigError("DATABASE_URL needs a table name, e.g. dynamodb:madauth");
-  if (!/^[\w.-]{3,255}$/.test(tableName2)) {
-    throw new ConfigError(
-      `DATABASE_URL=dynamodb: needs a DynamoDB table name (3 to 255 letters, digits, _ . -) but has "${tableName2}"`
-    );
-  }
-  try {
-    await import("@aws-sdk/client-dynamodb");
-  } catch (e) {
-    throw new ConfigError(
-      `DATABASE_URL=dynamodb: needs the AWS SDK. Install it next to madAuth: npm install @aws-sdk/client-dynamodb (${e.message})`
-    );
-  }
-  const { createDynamoDbAdapter: createDynamoDbAdapter2 } = await Promise.resolve().then(() => (init_dynamodb(), dynamodb_exports));
-  return createDynamoDbAdapter2({ tableName: tableName2 });
-}
-var RENAMED_TYPES = { "password.reset": "email.password_reset", "roles.changed": "user.claims_changed" };
-var LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]", "host.docker.internal"];
-function webhookFromEnv(url, secret, events) {
-  if (!url) {
-    if (secret || events) throw new ConfigError("WEBHOOK_SECRET and WEBHOOK_EVENTS need WEBHOOK_URL.");
-    return void 0;
-  }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new ConfigError(`WEBHOOK_URL: "${url}" is not a URL.`);
-  }
-  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && LOCAL_HOSTS.includes(parsed.hostname))) {
-    throw new ConfigError(`WEBHOOK_URL must be an https URL (http only for localhost) but is "${url}".`);
-  }
-  if (!secret) {
-    throw new ConfigError(
-      `WEBHOOK_SECRET is not set. Here is a newly generated secret you can use (keep it secret; your webhook receiver needs the same one):
-
-WEBHOOK_SECRET=${generateWebhookSecret()}
-`
-    );
-  }
-  const problem = checkWebhookSecret(secret);
-  if (problem) {
-    throw new ConfigError(`WEBHOOK_SECRET ${problem}. Generate one with: npx @madauth/server generate-webhook-secret`);
-  }
-  const selected = new Set((events ?? "").split(",").map((e) => e.trim()).filter(Boolean));
-  const allTypes = `All types: ${WEBHOOK_TYPES.join(", ")}. See "Webhooks" in docs/server.md.`;
-  if (!selected.size) {
-    throw new ConfigError(
-      `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
-
-WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered
-
-For one that only wants to know who signed in:
-
-WEBHOOK_EVENTS=user.signed_in
-
-` + allTypes
-    );
-  }
-  const unknown = [...selected].filter((e) => !WEBHOOK_TYPES.includes(e));
-  if (unknown.length) {
-    const renamed = unknown.filter((e) => e in RENAMED_TYPES).map((e) => `${e} is now ${RENAMED_TYPES[e]}`);
-    throw new ConfigError(
-      `WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. ${renamed.length ? `${renamed.join("; ")}. ` : ""}Known types: ${WEBHOOK_TYPES.join(", ")}.`
-    );
-  }
-  return { url: parsed.href, secret, events: selected };
-}
-
 // src/entry/lambda.ts
 function createHandler(options = {}) {
   const { env, ...overrides } = options;