@madauth/server 0.3.0-beta.1 → 0.4.0-beta.1

package/dist/standalone/main.mjs

@@ -38,7 +38,7 @@ var init_schema = __esm({
   "src/store/schema.ts"() {
     "use strict";
     madauthSchema = {
-      version: 4,
+      version: 5,
       models: {
         /** Someone who signed in, whichever way: the e-mail address is the identity shared by the sign-in methods. */
         user: {
@@ -57,7 +57,10 @@ var init_schema = __esm({
             createdAt: { type: "number" }
           }
         },
-        /** How a user signs in. `key` is `password:<userId>` or `google:<sub>`; later e.g. `totp:<userId>`. */
+        /**
+         * How a user signs in. `key` is `password:<userId>`, `google:<sub>` or `totp:<userId>` (the authenticator
+         * app, whose `secret` is encrypted).
+         */
         account: {
           fields: {
             id: { type: "string", primaryKey: true },
@@ -68,6 +71,25 @@ var init_schema = __esm({
             lockedUntil: { type: "number" },
             /** The address the provider reported at the last sign-in, e.g. Google's current primary address (since version 4). */
             email: { type: "string", nullable: true },
+            /** The time step of the last authenticator code that was accepted, so a code works once; 0 before (since version 5). */
+            lastUsedStep: { type: "number" },
+            /**
+             * The setup an authenticator secret came from; its recovery codes carry the same id, so the app and
+             * its codes always belong together. Empty for other accounts (since version 5).
+             */
+            setupId: { type: "string", nullable: true },
+            createdAt: { type: "number" }
+          }
+        },
+        /**
+         * A recovery code of a user's authenticator app (since version 5). `id` is the code's keyed hash; the
+         * record goes when the code is used. It works only while the account's `setupId` is its own.
+         */
+        recoveryCode: {
+          fields: {
+            id: { type: "string", primaryKey: true },
+            userId: { type: "string", index: true },
+            setupId: { type: "string" },
             createdAt: { type: "number" }
           }
         },
@@ -99,7 +121,7 @@ var init_schema = __esm({
 
 // src/store/sql.ts
 function tableName(model) {
-  return `madauth_${model}`;
+  return `madauth_${columnName(model)}`;
 }
 function columnName(field) {
   return field.replace(/[A-Z]/g, (c6) => `_${c6.toLowerCase()}`);
@@ -167,6 +189,15 @@ var init_sql = __esm({
           `DROP TABLE ${tableName("role")};`,
           createTablesSql(dialect, { version: 4, models: { setting: madauthSchema.models.setting } })
         ].join("\n")
+      },
+      {
+        // The authenticator app: which code was used last, and the recovery codes.
+        version: 5,
+        sql: (dialect) => [
+          `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("lastUsedStep")} ${columnTypes[dialect].number} NOT NULL DEFAULT 0;`,
+          `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("setupId")} ${columnTypes[dialect].string};`,
+          createTablesSql(dialect, { version: 5, models: { recoveryCode: madauthSchema.models.recoveryCode } })
+        ].join("\n")
       }
     ];
   }
@@ -1210,17 +1241,17 @@ var init_schemaDeserializationMiddleware = __esm({
           response,
           output: parsed
         };
-      } catch (error) {
-        Object.defineProperty(error, "$response", {
+      } catch (error2) {
+        Object.defineProperty(error2, "$response", {
           value: response,
           enumerable: false,
           writable: false,
           configurable: false
         });
-        if (!("$metadata" in error)) {
+        if (!("$metadata" in error2)) {
           const hint = `Deserialization error: to see the raw response, inspect the hidden field {error}.$response on this object.`;
           try {
-            error.message += "\n  " + hint;
+            error2.message += "\n  " + hint;
           } catch (ignored) {
             if (!context.logger || context.logger?.constructor?.name === "NoOpLogger") {
               console.warn(hint);
@@ -1228,16 +1259,16 @@ var init_schemaDeserializationMiddleware = __esm({
               context.logger?.warn?.(hint);
             }
           }
-          if (typeof error.$responseBodyText !== "undefined") {
-            if (error.$response) {
-              error.$response.body = error.$responseBodyText;
+          if (typeof error2.$responseBodyText !== "undefined") {
+            if (error2.$response) {
+              error2.$response.body = error2.$responseBodyText;
             }
           }
           try {
             if (HttpResponse.isInstance(response)) {
               const { headers = {}, statusCode } = response;
               const headerEntries = Object.entries(headers);
-              error.$metadata = {
+              error2.$metadata = {
                 httpStatusCode: statusCode,
                 requestId: findHeader(/^x-[\w-]+-request-?id$/, headerEntries),
                 extendedRequestId: findHeader(/^x-[\w-]+-id-2$/, headerEntries),
@@ -1247,7 +1278,7 @@ var init_schemaDeserializationMiddleware = __esm({
           } catch (ignored) {
           }
         }
-        throw error;
+        throw error2;
       }
     };
     findHeader = (pattern, headers) => {
@@ -3203,26 +3234,26 @@ var calculateBodyLength;
 var init_calculateBodyLength = __esm({
   "../../node_modules/@smithy/core/dist-es/submodules/serde/util-body-length/calculateBodyLength.js"() {
     "use strict";
-    calculateBodyLength = (body) => {
-      if (!body) {
+    calculateBodyLength = (body2) => {
+      if (!body2) {
         return 0;
       }
-      if (typeof body === "string") {
-        return Buffer.byteLength(body);
-      } else if (typeof body.byteLength === "number") {
-        return body.byteLength;
-      } else if (typeof body.size === "number") {
-        return body.size;
-      } else if (typeof body.start === "number" && typeof body.end === "number") {
-        return body.end + 1 - body.start;
-      } else if (body instanceof ReadStream) {
-        if (body.path != null) {
-          return lstatSync(body.path).size;
-        } else if (typeof body.fd === "number") {
-          return fstatSync(body.fd).size;
+      if (typeof body2 === "string") {
+        return Buffer.byteLength(body2);
+      } else if (typeof body2.byteLength === "number") {
+        return body2.byteLength;
+      } else if (typeof body2.size === "number") {
+        return body2.size;
+      } else if (typeof body2.start === "number" && typeof body2.end === "number") {
+        return body2.end + 1 - body2.start;
+      } else if (body2 instanceof ReadStream) {
+        if (body2.path != null) {
+          return lstatSync(body2.path).size;
+        } else if (typeof body2.fd === "number") {
+          return fstatSync(body2.fd).size;
         }
       }
-      throw new Error(`Body Length computation failed for ${body}`);
+      throw new Error(`Body Length computation failed for ${body2}`);
     };
   }
 });
@@ -3293,8 +3324,8 @@ var init_ProviderError = __esm({
         Object.setPrototypeOf(this, _ProviderError.prototype);
         logger2?.debug?.(`@smithy/property-provider ${tryNextLink ? "->" : "(!)"} ${message2}`);
       }
-      static from(error, options = true) {
-        return Object.assign(new this(error.message, options), error);
+      static from(error2, options = true) {
+        return Object.assign(new this(error2.message, options), error2);
       }
     };
   }
@@ -5221,9 +5252,9 @@ var init_getEndpointUrl = __esm({
       if (typeof expression === "string") {
         try {
           return new URL(expression);
-        } catch (error) {
-          console.error(`Failed to construct URL with ${expression}`, error);
-          throw error;
+        } catch (error2) {
+          console.error(`Failed to construct URL with ${expression}`, error2);
+          throw error2;
         }
       }
       throw new EndpointError(`Endpoint URL must be a string, got ${typeof expression}`);
@@ -6391,9 +6422,9 @@ var init_EventStreamCodec = __esm({
           }
         };
       }
-      encode({ headers: rawHeaders, body }) {
+      encode({ headers: rawHeaders, body: body2 }) {
         const headers = this.headerMarshaller.format(rawHeaders);
-        const length = headers.byteLength + body.byteLength + 16;
+        const length = headers.byteLength + body2.byteLength + 16;
         const out = new Uint8Array(length);
         const view = new DataView(out.buffer, out.byteOffset, out.byteLength);
         const checksum = new Crc32Node();
@@ -6402,14 +6433,14 @@ var init_EventStreamCodec = __esm({
         checksum.update(out.subarray(0, 8));
         view.setUint32(8, checksum.digestSync(), false);
         out.set(headers, 12);
-        out.set(body, headers.byteLength + 12);
+        out.set(body2, headers.byteLength + 12);
         checksum.update(out.subarray(8, length - 4));
         view.setUint32(length - 4, checksum.digestSync(), false);
         return out;
       }
       decode(message2) {
-        const { headers, body } = splitMessage(message2);
-        return { headers: this.headerMarshaller.parse(headers), body };
+        const { headers, body: body2 } = splitMessage(message2);
+        return { headers: this.headerMarshaller.parse(headers), body: body2 };
       }
       formatHeaders(rawHeaders) {
         return this.headerMarshaller.format(rawHeaders);
@@ -6613,9 +6644,9 @@ function getMessageUnmarshaller(deserializer, toUtf83) {
       const exception = { [code]: message2 };
       const deserializedException = await deserializer(exception);
       if (deserializedException.$unknown) {
-        const error = new Error(toUtf83(message2.body));
-        error.name = code;
-        throw error;
+        const error2 = new Error(toUtf83(message2.body));
+        error2.name = code;
+        throw error2;
       }
       throw deserializedException[code];
     } else if (messageType === "event") {
@@ -6656,8 +6687,8 @@ var init_EventStreamMarshaller = __esm({
         this.eventStreamCodec = new EventStreamCodec(utf8Encoder, utf8Decoder);
         this.utfEncoder = utf8Encoder;
       }
-      deserialize(body, deserializer) {
-        const inputStream = getChunkedStream(body);
+      deserialize(body2, deserializer) {
+        const inputStream = getChunkedStream(body2);
         return new SmithyMessageDecoderStream({
           messageStream: new MessageDecoderStream({ inputStream, decoder: this.eventStreamCodec }),
           deserializer: getMessageUnmarshaller(deserializer, this.utfEncoder)
@@ -6716,8 +6747,8 @@ var init_EventStreamMarshaller2 = __esm({
           utf8Encoder
         });
       }
-      deserialize(body, deserializer) {
-        const bodyIterable = typeof body[Symbol.asyncIterator] === "function" ? body : readableToIterable(body);
+      deserialize(body2, deserializer) {
+        const bodyIterable = typeof body2[Symbol.asyncIterator] === "function" ? body2 : readableToIterable(body2);
         return this.universalMarshaller.deserialize(bodyIterable, deserializer);
       }
       serialize(input, serializer) {
@@ -6813,11 +6844,11 @@ var init_EventStreamSerde = __esm({
                 ":content-type": { type: "string", value: defaultContentType2 }
               };
               serializer.write(requestSchema, initialRequest);
-              const body = serializer.flush();
+              const body2 = serializer.flush();
               yield {
                 [initialRequestMarker]: true,
                 headers,
-                body
+                body: body2
               };
             }
             for await (const page of eventStream) {
@@ -6841,7 +6872,7 @@ var init_EventStreamSerde = __esm({
               break;
             }
           }
-          const { additionalHeaders, body, eventType, explicitPayloadContentType } = this.writeEventBody(unionMember, unionSchema, event);
+          const { additionalHeaders, body: body2, eventType, explicitPayloadContentType } = this.writeEventBody(unionMember, unionSchema, event);
           const headers = {
             ":event-type": { type: "string", value: eventType },
             ":message-type": { type: "string", value: "event" },
@@ -6850,7 +6881,7 @@ var init_EventStreamSerde = __esm({
           };
           return {
             headers,
-            body
+            body: body2
           };
         });
       }
@@ -6870,9 +6901,9 @@ var init_EventStreamSerde = __esm({
               break;
             }
           }
-          const body = event[unionMember].body;
+          const body2 = event[unionMember].body;
           if (unionMember === (initialMessageType ?? "initial-response")) {
-            const dataObject = await this.deserializer.read(responseSchema, body);
+            const dataObject = await this.deserializer.read(responseSchema, body2);
             delete dataObject[eventStreamMember];
             return {
               [initialResponseMarker]: true,
@@ -6888,11 +6919,11 @@ var init_EventStreamSerde = __esm({
                 hasBindings = hasBindings || Boolean(eventHeader || eventPayload);
                 if (eventPayload) {
                   if (member2.isBlobSchema()) {
-                    out[name] = body;
+                    out[name] = body2;
                   } else if (member2.isStringSchema()) {
-                    out[name] = (this.serdeContext?.utf8Encoder ?? toUtf8)(body);
+                    out[name] = (this.serdeContext?.utf8Encoder ?? toUtf8)(body2);
                   } else if (member2.isStructSchema()) {
-                    out[name] = await this.deserializer.read(member2, body);
+                    out[name] = await this.deserializer.read(member2, body2);
                   }
                 } else if (eventHeader) {
                   const value = event[unionMember].headers[name]?.value;
@@ -6910,11 +6941,11 @@ var init_EventStreamSerde = __esm({
                 }
               }
               return {
-                [unionMember]: await this.readEventMember(eventStreamSchema, body, hasBindings, out)
+                [unionMember]: await this.readEventMember(eventStreamSchema, body2, hasBindings, out)
               };
             }
             return {
-              [unionMember]: await this.deserializer.read(eventStreamSchema, body)
+              [unionMember]: await this.deserializer.read(eventStreamSchema, body2)
             };
           } else {
             return {
@@ -6952,7 +6983,7 @@ var init_EventStreamSerde = __esm({
           }
         };
       }
-      async readEventMember(eventStreamSchema, body, hasBindings, out) {
+      async readEventMember(eventStreamSchema, body2, hasBindings, out) {
         let ErrCtor;
         const staticStructuralSchema = eventStreamSchema.getSchema();
         if (Array.isArray(staticStructuralSchema) && staticStructuralSchema[0] === -3) {
@@ -6961,7 +6992,7 @@ var init_EventStreamSerde = __esm({
           this.compositeErrorRegistry?.copyFrom(nsRegistry);
           ErrCtor = (this.compositeErrorRegistry ?? nsRegistry)?.getErrorCtor(staticStructuralSchema);
         }
-        const dataObject = hasBindings ? out : body.byteLength === 0 ? {} : await this.deserializer.read(eventStreamSchema, body);
+        const dataObject = hasBindings ? out : body2.byteLength === 0 ? {} : await this.deserializer.read(eventStreamSchema, body2);
         if (ErrCtor) {
           const message2 = dataObject.message ?? dataObject.Message ?? "Unknown";
           const metadata = {};
@@ -7039,9 +7070,9 @@ var init_EventStreamSerde = __esm({
           }
         }
         const messageSerialization = serializer.flush() ?? new Uint8Array();
-        const body = typeof messageSerialization === "string" ? (this.serdeContext?.utf8Decoder ?? fromUtf8)(messageSerialization) : messageSerialization;
+        const body2 = typeof messageSerialization === "string" ? (this.serdeContext?.utf8Decoder ?? fromUtf8)(messageSerialization) : messageSerialization;
         return {
-          body,
+          body: body2,
           eventType,
           explicitPayloadContentType,
           additionalHeaders
@@ -7995,10 +8026,10 @@ function contentLengthMiddleware(bodyLengthChecker) {
   return (next) => async (args) => {
     const request = args.request;
     if (HttpRequest.isInstance(request)) {
-      const { body, headers } = request;
-      if (body && Object.keys(headers).map((str) => str.toLowerCase()).indexOf(CONTENT_LENGTH_HEADER) === -1) {
+      const { body: body2, headers } = request;
+      if (body2 && Object.keys(headers).map((str) => str.toLowerCase()).indexOf(CONTENT_LENGTH_HEADER) === -1) {
         try {
-          const length = bodyLengthChecker(body);
+          const length = bodyLengthChecker(body2);
           if (length != null) {
             request.headers = {
               ...request.headers,
@@ -8123,17 +8154,17 @@ var init_constants3 = __esm({
 });
 
 // ../../node_modules/@smithy/core/dist-es/submodules/retry/service-error-classification/service-error-classification.js
-function isNodeJsHttp2TransientError(error) {
-  return error.code === "ERR_HTTP2_STREAM_ERROR" && error.message.includes("NGHTTP2_REFUSED_STREAM");
+function isNodeJsHttp2TransientError(error2) {
+  return error2.code === "ERR_HTTP2_STREAM_ERROR" && error2.message.includes("NGHTTP2_REFUSED_STREAM");
 }
 var isRetryableByTrait, isClockSkewCorrectedError, isBrowserNetworkError, isThrottlingError, isTransientError, isServerError;
 var init_service_error_classification = __esm({
   "../../node_modules/@smithy/core/dist-es/submodules/retry/service-error-classification/service-error-classification.js"() {
     "use strict";
     init_constants3();
-    isRetryableByTrait = (error) => error?.$retryable !== void 0;
-    isClockSkewCorrectedError = (error) => error.$metadata?.clockSkewCorrected;
-    isBrowserNetworkError = (error) => {
+    isRetryableByTrait = (error2) => error2?.$retryable !== void 0;
+    isClockSkewCorrectedError = (error2) => error2.$metadata?.clockSkewCorrected;
+    isBrowserNetworkError = (error2) => {
       const errorMessages = /* @__PURE__ */ new Set([
         "Failed to fetch",
         "NetworkError when attempting to fetch resource",
@@ -8141,18 +8172,18 @@ var init_service_error_classification = __esm({
         "Load failed",
         "Network request failed"
       ]);
-      const isValid = error && error instanceof TypeError;
+      const isValid = error2 && error2 instanceof TypeError;
       if (!isValid) {
         return false;
       }
-      return errorMessages.has(error.message);
+      return errorMessages.has(error2.message);
     };
-    isThrottlingError = (error) => error.$metadata?.httpStatusCode === 429 || THROTTLING_ERROR_CODES.includes(error.name) || error.$retryable?.throttling == true;
-    isTransientError = (error, depth = 0) => error?.name !== "AbortError" && (isRetryableByTrait(error) || isClockSkewCorrectedError(error) || error.name === "InvalidSignatureException" && error.message?.includes("Signature expired") || TRANSIENT_ERROR_CODES.includes(error.name) || NODEJS_TIMEOUT_ERROR_CODES.includes(error?.code || "") || NODEJS_NETWORK_ERROR_CODES.includes(error?.code || "") || TRANSIENT_ERROR_STATUS_CODES.includes(error.$metadata?.httpStatusCode || 0) || isBrowserNetworkError(error) || isNodeJsHttp2TransientError(error) || error.cause !== void 0 && depth <= 10 && isTransientError(error.cause, depth + 1));
-    isServerError = (error) => {
-      if (error.$metadata?.httpStatusCode !== void 0) {
-        const statusCode = error.$metadata.httpStatusCode;
-        if (500 <= statusCode && statusCode <= 599 && !isTransientError(error)) {
+    isThrottlingError = (error2) => error2.$metadata?.httpStatusCode === 429 || THROTTLING_ERROR_CODES.includes(error2.name) || error2.$retryable?.throttling == true;
+    isTransientError = (error2, depth = 0) => error2?.name !== "AbortError" && (isRetryableByTrait(error2) || isClockSkewCorrectedError(error2) || error2.name === "InvalidSignatureException" && error2.message?.includes("Signature expired") || TRANSIENT_ERROR_CODES.includes(error2.name) || NODEJS_TIMEOUT_ERROR_CODES.includes(error2?.code || "") || NODEJS_NETWORK_ERROR_CODES.includes(error2?.code || "") || TRANSIENT_ERROR_STATUS_CODES.includes(error2.$metadata?.httpStatusCode || 0) || isBrowserNetworkError(error2) || isNodeJsHttp2TransientError(error2) || error2.cause !== void 0 && depth <= 10 && isTransientError(error2.cause, depth + 1));
+    isServerError = (error2) => {
+      if (error2.$metadata?.httpStatusCode !== void 0) {
+        const statusCode = error2.$metadata.httpStatusCode;
+        if (500 <= statusCode && statusCode <= 599 && !isTransientError(error2)) {
           return true;
         }
         return false;
@@ -8231,14 +8262,14 @@ var asSdkError;
 var init_util = __esm({
   "../../node_modules/@smithy/core/dist-es/submodules/retry/middleware-retry/util.js"() {
     "use strict";
-    asSdkError = (error) => {
-      if (error instanceof Error)
-        return error;
-      if (error instanceof Object)
-        return Object.assign(new Error(), error);
-      if (typeof error === "string")
-        return new Error(error);
-      return new Error(`AWS SDK error wrapper for ${error}`);
+    asSdkError = (error2) => {
+      if (error2 instanceof Error)
+        return error2;
+      if (error2 instanceof Object)
+        return Object.assign(new Error(), error2);
+      if (typeof error2 === "string")
+        return new Error(error2);
+      return new Error(`AWS SDK error wrapper for ${error2}`);
     };
   }
 });
@@ -8324,23 +8355,23 @@ var init_retryMiddleware = __esm({
     init_util();
     cooldown = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
     isRetryStrategyV2 = (retryStrategy) => typeof retryStrategy.acquireInitialRetryToken !== "undefined" && typeof retryStrategy.refreshRetryTokenForRetry !== "undefined" && typeof retryStrategy.recordSuccess !== "undefined";
-    getRetryErrorInfo = (error, logger2) => {
+    getRetryErrorInfo = (error2, logger2) => {
       const errorInfo = {
-        error,
-        errorType: getRetryErrorType(error)
+        error: error2,
+        errorType: getRetryErrorType(error2)
       };
-      const retryAfterHint = parseRetryAfterHeader(error.$response, logger2);
+      const retryAfterHint = parseRetryAfterHeader(error2.$response, logger2);
       if (retryAfterHint) {
         errorInfo.retryAfterHint = retryAfterHint;
       }
       return errorInfo;
     };
-    getRetryErrorType = (error) => {
-      if (isThrottlingError(error))
+    getRetryErrorType = (error2) => {
+      if (isThrottlingError(error2))
         return "THROTTLING";
-      if (isTransientError(error))
+      if (isTransientError(error2))
         return "TRANSIENT";
-      if (isServerError(error))
+      if (isServerError(error2))
         return "SERVER_ERROR";
       return "CLIENT_ERROR";
     };
@@ -8877,7 +8908,7 @@ var init_loggerMiddleware = __esm({
           metadata: $metadata
         });
         return response;
-      } catch (error) {
+      } catch (error2) {
         const { clientName, commandName, logger: logger2, dynamoDbDocumentClientOptions = {} } = context;
         const { overrideInputFilterSensitiveLog } = dynamoDbDocumentClientOptions;
         const inputFilterSensitiveLog = overrideInputFilterSensitiveLog ?? context.inputFilterSensitiveLog;
@@ -8885,10 +8916,10 @@ var init_loggerMiddleware = __esm({
           clientName,
           commandName,
           input: inputFilterSensitiveLog(args.input),
-          error,
-          metadata: error.$metadata
+          error: error2,
+          metadata: error2.$metadata
         });
-        throw error;
+        throw error2;
       }
     };
     loggerMiddlewareOptions = {
@@ -9246,8 +9277,8 @@ var init_httpSigningMiddleware = __esm({
     "use strict";
     init_protocols();
     init_transport();
-    defaultErrorHandler = (signingProperties) => (error) => {
-      throw error;
+    defaultErrorHandler = (signingProperties) => (error2) => {
+      throw error2;
     };
     defaultSuccessHandler = (httpResponse, signingProperties) => {
     };
@@ -11000,8 +11031,8 @@ var init_AwsSdkSigV4Signer = __esm({
         return signedRequest;
       }
       errorHandler(signingProperties) {
-        return (error) => {
-          const errorException = error;
+        return (error2) => {
+          const errorException = error2;
           if (!signingProperties._disableClockSkewCorrection) {
             const serverTime = errorException.ServerTime ?? getDateHeader(errorException.$response);
             if (serverTime) {
@@ -11019,7 +11050,7 @@ var init_AwsSdkSigV4Signer = __esm({
               }
             }
           }
-          throw error;
+          throw error2;
         };
       }
       successHandler(httpResponse, signingProperties) {
@@ -11536,7 +11567,7 @@ var init_getPayloadHash = __esm({
     init_serde();
     init_serde();
     init_constants6();
-    getPayloadHash = async ({ headers, body }, hashConstructor) => {
+    getPayloadHash = async ({ headers, body: body2 }, hashConstructor) => {
       for (const headerName in headers) {
         if (!hasOwn(headers, headerName))
           continue;
@@ -11544,11 +11575,11 @@ var init_getPayloadHash = __esm({
           return headers[headerName];
         }
       }
-      if (body == void 0) {
+      if (body2 == void 0) {
         return "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
-      } else if (typeof body === "string" || ArrayBuffer.isView(body) || isArrayBuffer(body)) {
+      } else if (typeof body2 === "string" || ArrayBuffer.isView(body2) || isArrayBuffer(body2)) {
         const hashCtor = new hashConstructor();
-        hashCtor.update(toUint8Array(body));
+        hashCtor.update(toUint8Array(body2));
         return toHex(await hashCtor.digest());
       }
       return UNSIGNED_PAYLOAD;
@@ -17182,12 +17213,12 @@ var init_fromInstanceMetadata = __esm({
           let token;
           try {
             token = (await getMetadataToken({ ...endpoint, timeout })).toString();
-          } catch (error) {
-            if (error?.statusCode === 400) {
-              throw Object.assign(error, {
+          } catch (error2) {
+            if (error2?.statusCode === 400) {
+              throw Object.assign(error2, {
                 message: "EC2 Metadata token request returned error"
               });
-            } else if (error.message === "TimeoutError" || [403, 404, 405].includes(error.statusCode)) {
+            } else if (error2.message === "TimeoutError" || [403, 404, 405].includes(error2.statusCode)) {
               disableFetchToken = true;
             }
             logger2?.debug("AWS SDK Instance Metadata", "using v1 fallback (initial)");
@@ -17379,12 +17410,12 @@ var init_set_request_timeout = __esm({
         return timing.setTimeout(() => {
           let msg = `@smithy/node-http-handler - [${throwOnRequestTimeout ? "ERROR" : "WARN"}] a request has exceeded the configured ${timeoutInMs} ms requestTimeout.`;
           if (throwOnRequestTimeout) {
-            const error = Object.assign(new Error(msg), {
+            const error2 = Object.assign(new Error(msg), {
               name: "TimeoutError",
               code: "ETIMEDOUT"
             });
-            req.destroy(error);
-            reject(error);
+            req.destroy(error2);
+            reject(error2);
           } else {
             msg += ` Init client requestHandler with throwOnRequestTimeout=true to turn this into an error.`;
             logger2?.warn?.(msg);
@@ -17487,28 +17518,28 @@ async function writeRequestBody(httpRequest2, request, maxContinueTimeoutMs = MI
     writeBody(httpRequest2, request.body);
   }
 }
-function writeBody(httpRequest2, body) {
-  if (body instanceof Readable4) {
-    body.pipe(httpRequest2);
+function writeBody(httpRequest2, body2) {
+  if (body2 instanceof Readable4) {
+    body2.pipe(httpRequest2);
     return;
   }
-  if (body) {
-    const isBuffer = Buffer.isBuffer(body);
-    const isString = typeof body === "string";
+  if (body2) {
+    const isBuffer = Buffer.isBuffer(body2);
+    const isString = typeof body2 === "string";
     if (isBuffer || isString) {
-      if (isBuffer && body.byteLength === 0) {
+      if (isBuffer && body2.byteLength === 0) {
         httpRequest2.end();
       } else {
-        httpRequest2.end(body);
+        httpRequest2.end(body2);
       }
       return;
     }
-    const uint8 = body;
+    const uint8 = body2;
     if (typeof uint8 === "object" && uint8.buffer && typeof uint8.byteOffset === "number" && typeof uint8.byteLength === "number") {
       httpRequest2.end(Buffer.from(uint8.buffer, uint8.byteOffset, uint8.byteLength));
       return;
     }
-    httpRequest2.end(Buffer.from(body));
+    httpRequest2.end(Buffer.from(body2));
     return;
   }
   httpRequest2.end();
@@ -18391,20 +18422,20 @@ var init_ProtocolLib = __esm({
       decorateServiceException(exception, additions = {}) {
         if (this.queryCompat) {
           const msg = exception.Message ?? additions.Message;
-          const error = decorateServiceException(exception, additions);
+          const error2 = decorateServiceException(exception, additions);
           if (msg) {
-            error.message = msg;
-          }
-          const errorObj = error.Error ?? {};
-          errorObj.Type = error.Error?.Type;
-          errorObj.Code = error.Error?.Code;
-          errorObj.Message = error.Error?.message ?? error.Error?.Message ?? msg;
-          error.Error = errorObj;
-          const reqId = error.$metadata.requestId;
+            error2.message = msg;
+          }
+          const errorObj = error2.Error ?? {};
+          errorObj.Type = error2.Error?.Type;
+          errorObj.Code = error2.Error?.Code;
+          errorObj.Message = error2.Error?.message ?? error2.Error?.Message ?? msg;
+          error2.Error = errorObj;
+          const reqId = error2.$metadata.requestId;
           if (reqId) {
-            error.RequestId = reqId;
+            error2.RequestId = reqId;
           }
-          return error;
+          return error2;
         }
         return decorateServiceException(exception, additions);
       }
@@ -18695,7 +18726,7 @@ var init_common = __esm({
     "use strict";
     init_protocols();
     init_serde();
-    collectBodyString = (streamBody, context) => collectBody(streamBody, context).then((body) => (context?.utf8Encoder ?? toUtf8)(body));
+    collectBodyString = (streamBody, context) => collectBody(streamBody, context).then((body2) => (context?.utf8Encoder ?? toUtf8)(body2));
   }
 });
 
@@ -21614,13 +21645,13 @@ var init_fromSso = __esm({
             expiresAt: newTokenExpiration.toISOString(),
             refreshToken: newSsoOidcToken.refreshToken
           });
-        } catch (error) {
+        } catch (error2) {
         }
         return {
           token: newSsoOidcToken.accessToken,
           expiration: newTokenExpiration
         };
-      } catch (error) {
+      } catch (error2) {
         validateTokenExpiry(existingToken);
         return existingToken;
       }
@@ -25091,9 +25122,9 @@ var init_LoginCredentialsFetcher = __esm({
           };
           await this.saveToken(updatedToken);
           return this.toCredentials(updatedToken.accessToken);
-        } catch (error) {
-          if (error.name === "AccessDeniedException") {
-            const errorType = error.error;
+        } catch (error2) {
+          if (error2.name === "AccessDeniedException") {
+            const errorType = error2.error;
             let message2;
             switch (errorType) {
               case "TOKEN_EXPIRED":
@@ -25106,7 +25137,7 @@ var init_LoginCredentialsFetcher = __esm({
                 message2 = "Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";
                 break;
               default:
-                message2 = `Failed to refresh token: ${String(error)}. Please re-authenticate using \`aws login\``;
+                message2 = `Failed to refresh token: ${String(error2)}. Please re-authenticate using \`aws login\``;
             }
             throw new CredentialsProviderError(message2, {
               logger: this.logger,
@@ -25115,10 +25146,10 @@ var init_LoginCredentialsFetcher = __esm({
           }
           const tokenExpiry2 = new Date(freshToken.accessToken.expiresAt).getTime();
           if (tokenExpiry2 > Date.now()) {
-            this.logger?.warn?.(`Failed to refresh token: ${String(error)}. Using existing token until expiry.`);
+            this.logger?.warn?.(`Failed to refresh token: ${String(error2)}. Using existing token until expiry.`);
             return this.toCredentials(freshToken.accessToken);
           }
-          throw new CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
+          throw new CredentialsProviderError(`Failed to refresh token: ${String(error2)}. Please re-authenticate using aws login`, { logger: this.logger });
         }
       }
       async loadToken() {
@@ -25137,8 +25168,8 @@ var init_LoginCredentialsFetcher = __esm({
             });
           }
           return token;
-        } catch (error) {
-          throw new CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {
+        } catch (error2) {
+          throw new CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error2)}`, {
             logger: this.logger,
             tryNextLink: false
           });
@@ -25149,7 +25180,7 @@ var init_LoginCredentialsFetcher = __esm({
         const directory = dirname(tokenFilePath);
         try {
           await fs2.mkdir(directory, { recursive: true });
-        } catch (error) {
+        } catch (error2) {
         }
         await fs2.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
       }
@@ -25240,8 +25271,8 @@ var init_LoginCredentialsFetcher = __esm({
           const rawSignature = this.derToRawSignature(asn1Signature);
           const signatureB64 = rawSignature.toString("base64url");
           return `${message2}.${signatureB64}`;
-        } catch (error) {
-          throw new CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });
+        } catch (error2) {
+          throw new CredentialsProviderError(`Failed to generate Dpop proof: ${error2 instanceof Error ? error2.message : String(error2)}`, { logger: this.logger, tryNextLink: false });
         }
       }
     };
@@ -25370,8 +25401,8 @@ var init_resolveProcessCredentials = __esm({
               throw Error(`Profile ${profileName} credential_process returned invalid JSON.`);
             }
             return getValidatedProcessCredentials(profileName, data, profiles);
-          } catch (error) {
-            throw new CredentialsProviderError(error.message, { logger: logger2 });
+          } catch (error2) {
+            throw new CredentialsProviderError(error2.message, { logger: logger2 });
           }
         } else {
           throw new CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger: logger2 });
@@ -28679,16 +28710,16 @@ function stillMatches(where) {
   });
   return { text: parts.join(" AND "), names, values };
 }
-function failedWrite(error) {
-  const { name, CancellationReasons } = error;
+function failedWrite(error2) {
+  const { name, CancellationReasons } = error2;
   if (name === "ConditionalCheckFailedException") return "refused";
-  if (name && RETRYABLE_ERRORS.includes(name)) return { retry: error };
+  if (name && RETRYABLE_ERRORS.includes(name)) return { retry: error2 };
   if (name === "TransactionCanceledException") {
     const reasons = (CancellationReasons ?? []).map((r6) => r6.Code ?? "None").filter((code) => code !== "None");
     if (reasons.includes("ConditionalCheckFailed")) return "refused";
-    if (reasons.length && reasons.every((code) => RETRYABLE_REASONS.includes(code))) return { retry: error };
+    if (reasons.length && reasons.every((code) => RETRYABLE_REASONS.includes(code))) return { retry: error2 };
   }
-  throw error;
+  throw error2;
 }
 function createDynamoDbAdapter(options) {
   const { tableName: tableName2 } = options;
@@ -29793,8 +29824,8 @@ async function importWithAlgCache(cache7, jwk, entry) {
       if (key.type !== "public")
         throw new JWKSInvalid("JSON Web Key Set members must be public keys");
       return cached[alg] = key, key;
-    }).catch((error) => {
-      throw cached[alg] === pending && delete cached[alg], error;
+    }).catch((error2) => {
+      throw cached[alg] === pending && delete cached[alg], error2;
     });
     cached[alg] = pending;
   }
@@ -29820,14 +29851,14 @@ function createLocalJWKSet(jwks) {
     if (!length)
       throw new JWKSNoMatchingKey();
     if (length !== 1) {
-      const error = new JWKSMultipleMatchingKeys();
-      throw error[Symbol.asyncIterator] = async function* () {
+      const error2 = new JWKSMultipleMatchingKeys();
+      throw error2[Symbol.asyncIterator] = async function* () {
         for (const jwk2 of candidates)
           try {
             yield await importWithAlgCache(cached, jwk2, entry);
           } catch {
           }
-      }, error;
+      }, error2;
     }
     return importWithAlgCache(cached, jwk, entry);
   }, "jwks", {
@@ -30020,13 +30051,17 @@ var WEBHOOK_TYPES = [
   "email.verify",
   "email.reset",
   "email.already_registered",
+  "email.no_password",
   "signup.before",
   "user.created",
   "email.verified",
   "email.password_reset",
   "user.signed_in",
   "user.deleted",
-  "user.claims_changed"
+  "user.claims_changed",
+  "totp.enabled",
+  "totp.disabled",
+  "totp.recovery_code_used"
 ];
 var WEBHOOK_TIMEOUT_MS = 1e4;
 var MAX_LOCALE_LENGTH = 35;
@@ -30050,8 +30085,8 @@ function hmac2(secret, content) {
   const key = Buffer.from(secret.slice(SECRET_PREFIX.length), "base64");
   return createHmac("sha256", key).update(content).digest("base64");
 }
-function signWebhook(secret, id, timestamp, body) {
-  return `v1,${hmac2(secret, `${id}.${timestamp}.${body}`)}`;
+function signWebhook(secret, id, timestamp, body2) {
+  return `v1,${hmac2(secret, `${id}.${timestamp}.${body2}`)}`;
 }
 function createWebhookClient(settings, fetchImpl = fetch) {
   const wants = (type) => settings.events.has(type);
@@ -30061,7 +30096,7 @@ function createWebhookClient(settings, fetchImpl = fetch) {
       if (!wants(type)) return { ok: true, body: void 0 };
       const id = `msg_${randomUUID()}`;
       const timestamp = Math.floor(Date.now() / 1e3);
-      const body = JSON.stringify({ type, data });
+      const body2 = JSON.stringify({ type, data });
       let response;
       try {
         response = await fetchImpl(settings.url, {
@@ -30070,9 +30105,9 @@ function createWebhookClient(settings, fetchImpl = fetch) {
             "Content-Type": "application/json",
             "webhook-id": id,
             "webhook-timestamp": String(timestamp),
-            "webhook-signature": signWebhook(settings.secret, id, timestamp, body)
+            "webhook-signature": signWebhook(settings.secret, id, timestamp, body2)
           },
-          body,
+          body: body2,
           signal: AbortSignal.timeout(timeoutMs)
         });
       } catch (e6) {
@@ -30093,6 +30128,12 @@ function createWebhookClient(settings, fetchImpl = fetch) {
 }
 
 // src/config.ts
+function sendsVerificationEmails(config) {
+  return !!config.webhook?.events.has("email.verify");
+}
+function methodConfig(config) {
+  return { google: config.google, password: config.password, emailVerification: sendsVerificationEmails(config) };
+}
 async function resolveEnv(source = process.env) {
   return typeof source === "function" ? source() : source;
 }
@@ -30156,9 +30197,10 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
   const sendsEmails = !!webhook && REQUIRED_EMAIL_TYPES.every((type) => webhook.events.has(type));
   const password = sendsEmails ? { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")) } : void 0;
-  if (!clientId && !password) {
+  const emailVerification = !!webhook && webhook.events.has("email.verify");
+  if (!clientId && !password && !emailVerification) {
     throw new ConfigError(
-      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See docs/server.md.`
+      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails: e-mail & password sign-in needs email.verify and email.reset, sign-up with the authenticator app needs email.verify. For development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered,email.no_password. See docs/server.md.`
     );
   }
   const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
@@ -30186,6 +30228,7 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
     sessionTtlSeconds,
     renewalTtlSeconds,
     cookieDomain: read("COOKIE_DOMAIN"),
+    totpIssuer: read("TOTP_ISSUER"),
     google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
     store,
     password,
@@ -30267,7 +30310,7 @@ WEBHOOK_SECRET=${generateWebhookSecret()}
     throw new ConfigError(
       `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
 
-WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered
+WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered,email.no_password
 
 For one that only wants to know who signed in:
 
@@ -30584,8 +30627,8 @@ var newRequestFromIncoming = (method, url, headers, incoming, abortController) =
         const { done, value } = await reader.read();
         if (done) controller.close();
         else controller.enqueue(value);
-      } catch (error) {
-        controller.error(error);
+      } catch (error2) {
+        controller.error(error2);
       }
     } });
   } else {
@@ -30713,13 +30756,13 @@ var readBodyDirect = (request) => {
       cleanup();
       callback();
     };
-    const recoverCompleteBodyAfterDisconnect = (error) => {
-      const streamError = incoming.errored ?? error;
+    const recoverCompleteBodyAfterDisconnect = (error2) => {
+      const streamError = incoming.errored ?? error2;
       if (!isRecoverableDisconnectedIncoming(incoming) || streamError && streamError.code !== "ECONNRESET") return false;
       finish(() => {
         const recovered = readBodyBufferedBeforeDisconnect(incoming, chunks);
         if (recovered instanceof Error) reject(recovered);
-        else if (recovered === void 0) reject(error ?? normalizeAbortError(request, incoming));
+        else if (recovered === void 0) reject(error2 ?? normalizeAbortError(request, incoming));
         else {
           request[bodyBufferKey] = recovered;
           resolve(recovered);
@@ -30737,10 +30780,10 @@ var readBodyDirect = (request) => {
         resolve(buffer);
       });
     };
-    const onError = (error) => {
-      if (recoverCompleteBodyAfterDisconnect(error)) return;
+    const onError = (error2) => {
+      if (recoverCompleteBodyAfterDisconnect(error2)) return;
       finish(() => {
-        reject(error);
+        reject(error2);
       });
     };
     const onClose = () => {
@@ -30934,9 +30977,9 @@ var Response$1 = class Response$12 {
       headers: liveHeaders
     } : this.#init);
   }
-  constructor(body, init) {
+  constructor(body2, init) {
     let headers;
-    this.#body = body;
+    this.#body = body2;
     if (init instanceof GlobalResponse) {
       const cachedGlobalResponse = init[responseCache];
       if (cachedGlobalResponse) {
@@ -30947,9 +30990,9 @@ var Response$1 = class Response$12 {
       this.#init = init instanceof Response$12 ? init.#init : init;
       headers = new Headers(init.headers);
     } else this.#init = init;
-    if (body == null || typeof body === "string" || typeof body?.getReader !== "undefined" || body instanceof Blob || body instanceof Uint8Array) this[cacheKey] = [
+    if (body2 == null || typeof body2 === "string" || typeof body2?.getReader !== "undefined" || body2 instanceof Blob || body2 instanceof Uint8Array) this[cacheKey] = [
       init?.status || 200,
-      body ?? null,
+      body2 ?? null,
       headers || init?.headers
     ];
   }
@@ -31033,15 +31076,15 @@ Object.defineProperty(Response$1, "redirect", {
 });
 Object.defineProperty(Response$1, "json", {
   value: function json(data, init) {
-    const body = JSON.stringify(data);
-    if (body === void 0) throw new TypeError("The data is not JSON serializable");
+    const body2 = JSON.stringify(data);
+    if (body2 === void 0) throw new TypeError("The data is not JSON serializable");
     const initHeaders = init?.headers;
     let headers;
     if (initHeaders) {
       headers = new Headers(initHeaders);
       if (!headers.has("content-type")) headers.set("content-type", "application/json");
     } else headers = { "content-type": "application/json" };
-    return new Response$1(body, {
+    return new Response$1(body2, {
       status: init?.status ?? 200,
       statusText: init?.statusText,
       headers
@@ -31054,8 +31097,8 @@ async function readWithoutBlocking(readPromise) {
   return Promise.race([readPromise, Promise.resolve().then(() => Promise.resolve(void 0))]);
 }
 function writeFromReadableStreamDefaultReader(reader, writable, currentReadPromise) {
-  const cancel = (error) => {
-    reader.cancel(error).catch(() => {
+  const cancel = (error2) => {
+    reader.cancel(error2).catch(() => {
     });
   };
   writable.on("close", cancel);
@@ -31065,8 +31108,8 @@ function writeFromReadableStreamDefaultReader(reader, writable, currentReadPromi
     writable.off("close", cancel);
     writable.off("error", cancel);
   });
-  function handleStreamError(error) {
-    if (error) writable.destroy(error);
+  function handleStreamError(error2) {
+    if (error2) writable.destroy(error2);
   }
   function onDrain() {
     reader.read().then(flow, handleStreamError);
@@ -31155,8 +31198,8 @@ var makeCloseHandler = (req, incoming, outgoing, needsBodyCleanup) => () => {
 };
 var isImmediateCacheableResponse = (res) => {
   if (!(cacheKey in res)) return false;
-  const body = res[cacheKey][1];
-  return body === null || typeof body === "string" || body instanceof Uint8Array;
+  const body2 = res[cacheKey][1];
+  return body2 === null || typeof body2 === "string" || body2 instanceof Uint8Array;
 };
 var handleRequestError = () => new Response(null, { status: 400 });
 var handleFetchError = (e6) => new Response(null, { status: e6 instanceof Error && (e6.name === "TimeoutError" || e6.constructor.name === "TimeoutError") ? 504 : 500 });
@@ -31192,24 +31235,24 @@ var writeDefaultHeaders = (outgoing, status, length) => {
   });
 };
 var responseViaCache = async (res, outgoing) => {
-  let [status, body, header] = res[cacheKey];
+  let [status, body2, header] = res[cacheKey];
   if (!header) {
-    if (body === null) {
+    if (body2 === null) {
       outgoing.writeHead(status);
       outgoing.end();
-    } else if (typeof body === "string") {
-      writeDefaultHeaders(outgoing, status, Buffer.byteLength(body));
-      outgoing.end(body);
-    } else if (body instanceof Uint8Array) {
-      writeDefaultHeaders(outgoing, status, body.byteLength);
-      outgoing.end(body);
-    } else if (body instanceof Blob) {
-      writeDefaultHeaders(outgoing, status, body.size);
-      outgoing.end(new Uint8Array(await body.arrayBuffer()));
+    } else if (typeof body2 === "string") {
+      writeDefaultHeaders(outgoing, status, Buffer.byteLength(body2));
+      outgoing.end(body2);
+    } else if (body2 instanceof Uint8Array) {
+      writeDefaultHeaders(outgoing, status, body2.byteLength);
+      outgoing.end(body2);
+    } else if (body2 instanceof Blob) {
+      writeDefaultHeaders(outgoing, status, body2.size);
+      outgoing.end(new Uint8Array(await body2.arrayBuffer()));
     } else {
       outgoing.writeHead(status, { "Content-Type": defaultContentType });
       flushHeaders(outgoing);
-      await writeFromReadableStream(body, outgoing)?.catch((e6) => handleResponseError(e6, outgoing));
+      await writeFromReadableStream(body2, outgoing)?.catch((e6) => handleResponseError(e6, outgoing));
     }
     outgoing[outgoingEnded]?.();
     return;
@@ -31219,11 +31262,11 @@ var responseViaCache = async (res, outgoing) => {
   let canAutoLength = true;
   if (header instanceof Headers) {
     hasContentLength = header.has("content-length");
-    header = buildOutgoingHttpHeaders(header, body === null ? void 0 : defaultContentType);
+    header = buildOutgoingHttpHeaders(header, body2 === null ? void 0 : defaultContentType);
   } else if (Array.isArray(header)) {
     const headerObj = new Headers(header);
     hasContentLength = headerObj.has("content-length");
-    header = buildOutgoingHttpHeaders(headerObj, body === null ? void 0 : defaultContentType);
+    header = buildOutgoingHttpHeaders(headerObj, body2 === null ? void 0 : defaultContentType);
   } else {
     plainHeaders = true;
     for (const key in header) {
@@ -31236,21 +31279,21 @@ var responseViaCache = async (res, outgoing) => {
   }
   if (!hasContentLength) {
     let length;
-    if (typeof body === "string") length = Buffer.byteLength(body);
-    else if (body instanceof Uint8Array) length = body.byteLength;
-    else if (body instanceof Blob) length = body.size;
+    if (typeof body2 === "string") length = Buffer.byteLength(body2);
+    else if (body2 instanceof Uint8Array) length = body2.byteLength;
+    else if (body2 instanceof Blob) length = body2.size;
     if (length !== void 0 && (!plainHeaders || !canAutoLength || !trySetContentLength(outgoing, status, length))) {
       if (plainHeaders) header = { ...header };
       header["Content-Length"] = length;
     }
   }
   outgoing.writeHead(status, header);
-  if (body == null) outgoing.end();
-  else if (typeof body === "string" || body instanceof Uint8Array) outgoing.end(body);
-  else if (body instanceof Blob) outgoing.end(new Uint8Array(await body.arrayBuffer()));
+  if (body2 == null) outgoing.end();
+  else if (typeof body2 === "string" || body2 instanceof Uint8Array) outgoing.end(body2);
+  else if (body2 instanceof Blob) outgoing.end(new Uint8Array(await body2.arrayBuffer()));
   else {
     flushHeaders(outgoing);
-    await writeFromReadableStream(body, outgoing)?.catch((e6) => handleResponseError(e6, outgoing));
+    await writeFromReadableStream(body2, outgoing)?.catch((e6) => handleResponseError(e6, outgoing));
   }
   outgoing[outgoingEnded]?.();
 };
@@ -31582,9 +31625,9 @@ var upgradeWebSocket = defineWebSocketHelper(async (c6, events, options) => {
         (options?.onError ?? console.error)(e6);
       }
     });
-    ws.on("error", (error) => {
+    ws.on("error", (error2) => {
       try {
-        events?.onError?.(new ErrorEvent("error", { error }), ctx);
+        events?.onError?.(new ErrorEvent("error", { error: error2 }), ctx);
       } catch (e6) {
         (options?.onError ?? console.error)(e6);
       }
@@ -31942,10 +31985,10 @@ var HonoRequest = class {
     const { bodyCache, raw: raw2 } = this;
     const cachedBody = bodyCache[key];
     if (cachedBody) return cachedBody;
-    for (const anyCachedKey in bodyCache) return bodyCache[anyCachedKey].then((body) => {
-      if (anyCachedKey === "json") body = JSON.stringify(body);
+    for (const anyCachedKey in bodyCache) return bodyCache[anyCachedKey].then((body2) => {
+      if (anyCachedKey === "json") body2 = JSON.stringify(body2);
       const contentType2 = anyCachedKey === "formData" ? void 0 : raw2.headers.get("content-type");
-      return new Response(body, { headers: contentType2 ? { "Content-Type": contentType2 } : void 0 })[key]();
+      return new Response(body2, { headers: contentType2 ? { "Content-Type": contentType2 } : void 0 })[key]();
     });
     return bodyCache[key] = raw2[key]();
   };
@@ -32170,7 +32213,7 @@ var setDefaultContentType = (contentType2, headers) => {
     ...headers
   };
 };
-var createResponseInstance = (body, init) => new Response(body, init);
+var createResponseInstance = (body2, init) => new Response(body2, init);
 var Context = class {
   #rawRequest;
   #req;
@@ -33711,98 +33754,129 @@ function safeEqual(a6, b6) {
   return x2.length === y2.length && timingSafeEqual2(x2, y2);
 }
 
-// src/google.ts
-var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
-var googleJwks;
-function googleKeys() {
-  googleJwks ??= createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
-  return googleJwks;
+// src/users.ts
+import { randomBytes as randomBytes3 } from "crypto";
+
+// src/settings.ts
+var SIGN_IN_METHODS = ["google", "password", "totp"];
+var METHODS_WITH_SECOND_FACTOR = ["google", "password"];
+var SECOND_FACTOR_POLICIES = ["none", "optional", "required"];
+var METHODS_SETTING = "methods";
+var isSignInMethod = (value) => SIGN_IN_METHODS.includes(value);
+var isPolicy = (value) => SECOND_FACTOR_POLICIES.includes(value);
+function parseMethodSettings(input, options = {}) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const settings = {};
+  for (const [method, value] of Object.entries(input)) {
+    if (!isSignInMethod(method)) return null;
+    if (typeof value === "boolean") {
+      if (!options.booleans) return null;
+      if (value) settings[method] = {};
+      continue;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+    const setting = {};
+    for (const [field, fieldValue] of Object.entries(value)) {
+      if (field !== "secondFactor" || method === "totp" || !isPolicy(fieldValue)) return null;
+      setting.secondFactor = fieldValue;
+    }
+    settings[method] = setting;
+  }
+  return settings;
 }
-async function verifyGoogleIdToken(idToken, opts) {
-  let payload;
-  try {
-    ({ payload } = await jwtVerify(idToken, opts.keys ?? googleKeys(), {
-      issuer: GOOGLE_ISSUERS,
-      audience: opts.clientId,
-      algorithms: ["RS256", "ES256"]
-    }));
-  } catch (e6) {
-    return { ok: false, error: "verification_failed", reason: e6.message };
+function isConfigured(config, method) {
+  if (method === "google") return !!config.google;
+  if (method === "password") return !!config.password;
+  return true;
+}
+function canSignUp(config, method) {
+  return method === "totp" ? !!config.emailVerification : isConfigured(config, method);
+}
+function initialMethods(config) {
+  const methods = {};
+  if (config.google) methods.google = { secondFactor: "none" };
+  if (config.password) methods.password = { secondFactor: "none" };
+  if (!config.google && !config.password && config.emailVerification) methods.totp = {};
+  return methods;
+}
+var MAX_TRIES = 3;
+var Settings = class {
+  /** `initial` is what counts until the methods are set, see {@link initialMethods}. */
+  constructor(store, initial = {}) {
+    this.store = store;
+    this.initial = initial;
+    this.warned = false;
   }
-  if (typeof payload.sub !== "string" || !payload.sub) {
-    return { ok: false, error: "verification_failed", reason: "missing sub" };
+  /** The setting's value, or undefined if it was never set. */
+  async get(id) {
+    return (await this.read(id)).value;
   }
-  if (payload.nonce !== opts.nonce) {
-    return { ok: false, error: "verification_failed", reason: "nonce mismatch" };
+  /** The stored JSON and what it holds; both undefined if the setting was never set. */
+  async read(id) {
+    const record = await this.store.findOne("setting", { id });
+    if (typeof record?.value !== "string") return {};
+    try {
+      return { json: record.value, value: JSON.parse(record.value) };
+    } catch {
+      return { json: record.value };
+    }
   }
-  if (typeof payload.email !== "string" || !payload.email || payload.email_verified !== true) {
-    return { ok: false, error: "email_unverified", reason: "e-mail address not verified" };
+  /**
+   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
+   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
+   * again with the newer value. Resolves to the new value, or null if `apply` refused.
+   * `updatedBy` is the address of the admin, or null for the command line.
+   */
+  async change(id, apply, updatedBy) {
+    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
+      const { json: json2, value } = await this.read(id);
+      const next = apply(value);
+      if (next === null) return null;
+      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
+      const written = json2 === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json2 }, patch) === 1;
+      if (written) return next;
+    }
+    throw new Error(`Setting "${id}" kept changing; try again.`);
   }
-  const profile = { sub: payload.sub, email: payload.email };
-  if (typeof payload.name === "string") profile.name = payload.name;
-  if (typeof payload.picture === "string") profile.picture = payload.picture;
-  return { ok: true, profile };
-}
-
-// src/user.ts
-var SESSION_COOKIE = "madauth_session";
-var SESSION_TYP = "madauth-session+jwt";
-var RENEWAL_COOKIE = "madauth_renewal";
-var RENEWAL_TYP = "madauth-renewal+jwt";
-var EXPIRY_COOKIE = "madauth_session_expires";
-
-// src/tokens.ts
-function randomString(bytes = 32) {
-  return base64url_exports.encode(crypto.getRandomValues(new Uint8Array(bytes)));
-}
-async function signToken(keys, issuer, typ, claims, ttlSeconds) {
-  return new SignJWT(claims).setProtectedHeader({ alg: SIGNING_ALG, kid: keys.kid, typ }).setIssuer(issuer).setIssuedAt().setExpirationTime(`${ttlSeconds}s`).sign(keys.privateKey);
-}
-async function readToken(keys, issuer, typ, token) {
-  if (!token) return null;
-  try {
-    const { payload } = await jwtVerify(token, keys.publicKey, { issuer, typ, algorithms: [SIGNING_ALG] });
-    return payload;
-  } catch {
-    return null;
+  /** Replaces the setting. */
+  async set(id, value, updatedBy) {
+    await this.change(id, () => value, updatedBy);
+  }
+  /** Which sign-in methods are on, with their settings; the initial ones until an admin set them. */
+  async methods() {
+    return this.current(await this.get(METHODS_SETTING));
   }
+  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
+  async changeMethods(apply, updatedBy) {
+    return this.change(METHODS_SETTING, (current) => apply(this.current(current)), updatedBy);
+  }
+  /** The stored methods, or the initial ones if nothing (usable) is stored. */
+  current(stored) {
+    if (stored === void 0) return this.initial;
+    const parsed = parseMethodSettings(stored);
+    if (parsed) return parsed;
+    if (!this.warned) {
+      this.warned = true;
+      console.warn("[madauth] The stored sign-in methods are not in the form this version expects (they were set by an older one?). Set them again with set-methods; until then the initial methods count.");
+    }
+    return this.initial;
+  }
+};
+function isOn(method, configured, methods) {
+  return configured(method) && methods[method] !== void 0;
 }
-function signSession(keys, issuer, ttlSeconds, user, amr, extra = {}) {
-  const claims = {
-    ...extra,
-    sub: user.id,
-    email: user.email,
-    email_verified: user.email ? true : void 0,
-    name: user.name,
-    picture: user.picture,
-    claims: user.claims && Object.keys(user.claims).length ? user.claims : void 0,
-    amr
-  };
-  return signToken(keys, issuer, SESSION_TYP, claims, ttlSeconds);
+function policyOf(method, methods) {
+  return methods[method]?.secondFactor ?? "none";
 }
-function signRenewal(keys, issuer, ttlSeconds, user, amr, extra = {}) {
-  const claims = {
-    ...extra,
-    sub: user.id,
-    email: user.email,
-    email_verified: user.email ? true : void 0,
-    name: user.name,
-    picture: user.picture,
-    amr
-  };
-  return signToken(keys, issuer, RENEWAL_TYP, claims, ttlSeconds);
+function anyOn(signsUp, methods) {
+  return SIGN_IN_METHODS.some((method) => signsUp(method) && methods[method] !== void 0);
 }
-function userFromClaims(claims) {
-  const user = { id: claims.sub };
-  if (claims.email) user.email = claims.email;
-  if (claims.name) user.name = claims.name;
-  if (claims.picture) user.picture = claims.picture;
-  if (claims.claims && typeof claims.claims === "object" && Object.keys(claims.claims).length) user.claims = claims.claims;
-  return user;
+function authenticatorOn(configured, methods) {
+  if (isOn("totp", configured, methods)) return true;
+  return METHODS_WITH_SECOND_FACTOR.some((method) => isOn(method, configured, methods) && policyOf(method, methods) !== "none");
 }
 
 // src/users.ts
-import { randomBytes as randomBytes3 } from "crypto";
 var MAX_CODE_ATTEMPTS = 5;
 var MAX_WRONG_CODES = 10;
 var newId = (prefix) => `${prefix}_${randomBytes3(16).toString("base64url")}`;
@@ -33812,6 +33886,9 @@ function passwordAccountKey(userId) {
 function googleAccountKey(sub) {
   return `google:${sub}`;
 }
+function totpAccountKey(userId) {
+  return `totp:${userId}`;
+}
 function toMadauthUser(user, profile = {}) {
   const result = { id: user.id, email: user.email };
   const name = user.name ?? profile.name;
@@ -33840,12 +33917,32 @@ var Users = class {
   async passwordAccount(userId) {
     return this.findAccountByKey(passwordAccountKey(userId));
   }
+  /** The user's authenticator app, if they set one up. */
+  async totpAccount(userId) {
+    return this.findAccountByKey(totpAccountKey(userId));
+  }
+  /** Whether the user has any way to sign in; a sign-up with the authenticator app has none until it is set up. */
+  async hasAccounts(userId) {
+    return (await this.store.findMany("account", { userId }, { limit: 1 })).length > 0;
+  }
+  /**
+   * The ways the user can sign in, from their accounts: e.g. `['google']` for a user without a password.
+   * The authenticator app counts only when it signs in on its own (`methods` lists it); as a second
+   * factor it is a step of another method, not a way in.
+   */
+  async signInMethods(userId, methods) {
+    const accounts = await this.store.findMany("account", { userId });
+    const keys = accounts.map((account) => String(account.key).split(":")[0]);
+    return SIGN_IN_METHODS.filter((method) => keys.includes(method) && (method !== "totp" || methods.totp !== void 0));
+  }
   async findAccountByKey(key) {
     return await this.store.findOne("account", { key });
   }
   /**
-   * Creates a user with their first account. Resolves to null if the e-mail address or the account key is
-   * taken. `account.key` is `password:<userId>` for a password (its hash as `secret`), or e.g. `google:<sub>`.
+   * Creates a user, with their first account if given. Resolves to null if the e-mail address or the
+   * account key is taken. `account.key` is `password:<userId>` for a password (its hash as `secret`), or
+   * e.g. `google:<sub>`. A sign-up with the authenticator app creates the user without an account: the app
+   * is set up once the address is confirmed.
    */
   async createUser(data) {
     const user = {
@@ -33861,6 +33958,7 @@ var Users = class {
       createdAt: Date.now()
     };
     if (!await this.store.create("user", user)) return null;
+    if (!data.account) return user;
     const account = typeof data.account === "function" ? data.account(user.id) : data.account;
     if (!await this.linkAccount(user.id, account)) {
       await this.store.delete("user", { id: user.id });
@@ -33882,6 +33980,16 @@ var Users = class {
   async deleteAccount(id) {
     await this.store.delete("account", { id });
   }
+  /** Removes a sign-in method by its key. Resolves to false if there was none. */
+  async unlinkAccount(key) {
+    return await this.store.delete("account", { key }) === 1;
+  }
+  /** Removes the user's authenticator app and recovery codes. Resolves to false if they had no app. */
+  async removeTotp(userId) {
+    const removed = await this.unlinkAccount(totpAccountKey(userId));
+    await this.clearRecoveryCodes(userId);
+    return removed;
+  }
   /** Adds a sign-in method to a user. Resolves to null if the account key is taken. */
   async linkAccount(userId, account) {
     const record = {
@@ -33892,10 +34000,70 @@ var Users = class {
       failedAttempts: 0,
       lockedUntil: 0,
       email: account.email ?? null,
+      lastUsedStep: account.lastUsedStep ?? 0,
+      setupId: account.setupId ?? null,
       createdAt: Date.now()
     };
     return await this.store.create("account", record) ? record : null;
   }
+  /**
+   * Writes the secret of a confirmed setup over the authenticator account, only if the account still has the
+   * setup it had when this setup started (`replaces`): the write count decides, so of two setups confirmed
+   * at once exactly one wins, and the other is told to start again.
+   */
+  async confirmTotpSetup(accountId, replaces, patch) {
+    return await this.store.update("account", { id: accountId, setupId: replaces }, patch) === 1;
+  }
+  /**
+   * Marks the time step of an accepted authenticator code as used and resets the failed attempts, only if
+   * no other request accepted a code meanwhile: the write count decides, so the same code sent twice signs
+   * in once.
+   */
+  async useTotpStep(account, step) {
+    const changed = await this.store.update(
+      "account",
+      { id: account.id, lastUsedStep: account.lastUsedStep ?? null },
+      { lastUsedStep: step, failedAttempts: 0, lockedUntil: 0 }
+    );
+    return changed === 1;
+  }
+  /** Replaces the user's recovery codes with new ones, given as their hashes. */
+  /** Stores the recovery codes of a setup (their hashes), next to whatever codes the user has. */
+  async addRecoveryCodes(userId, setupId, hashes) {
+    const createdAt = Date.now();
+    for (const id of hashes) await this.store.create("recoveryCode", { id, userId, setupId, createdAt });
+  }
+  /** New recovery codes for the user's current app: the codes they had before stop working. */
+  async replaceRecoveryCodes(account, hashes) {
+    const before = await this.store.findMany("recoveryCode", { userId: account.userId });
+    await this.addRecoveryCodes(account.userId, account.setupId ?? "", hashes);
+    for (const old of before) await this.store.delete("recoveryCode", { id: old.id });
+  }
+  /**
+   * Uses up the recovery code with this hash for the user's authenticator account. Resolves to false if it
+   * is not theirs, belongs to another setup than the account's, or was used already.
+   */
+  async consumeRecoveryCode(account, hash) {
+    const record = await this.store.findOne("recoveryCode", { id: hash });
+    if (!record || record.userId !== account.userId || record.setupId !== (account.setupId ?? "")) return false;
+    return await this.store.delete("recoveryCode", { id: hash }) === 1;
+  }
+  /** How many recovery codes of the account's setup are left. */
+  async countRecoveryCodes(account) {
+    const codes = await this.store.findMany("recoveryCode", { userId: account.userId });
+    return codes.filter((code) => code.setupId === (account.setupId ?? "")).length;
+  }
+  /** Deletes the user's recovery codes: all of them, or only those of one setup, or all but one setup's. */
+  async clearRecoveryCodes(userId, which = {}) {
+    if (which.only === void 0 && which.except === void 0) {
+      await this.store.delete("recoveryCode", { userId });
+      return;
+    }
+    for (const code of await this.store.findMany("recoveryCode", { userId })) {
+      const match2 = which.only !== void 0 ? code.setupId === which.only : code.setupId !== which.except;
+      if (match2) await this.store.delete("recoveryCode", { id: code.id });
+    }
+  }
   /**
    * Deletes the user and everything stored for them. Resolves to false if there is no such user (any more).
    */
@@ -33906,6 +34074,7 @@ var Users = class {
     try {
       await this.store.delete("account", { userId: user.id });
       await this.store.delete("verification", { userId: user.id });
+      await this.store.delete("recoveryCode", { userId: user.id });
     } catch (e6) {
       console.error(`[madauth] Deleted user ${user.id}, but not all of their records: ${e6.message}`);
     }
@@ -33914,8 +34083,9 @@ var Users = class {
   async updateUser(id, patch) {
     await this.store.update("user", { id }, patch);
   }
+  /** Changes an account. Resolves to false if it is gone meanwhile. */
   async updateAccount(id, patch) {
-    await this.store.update("account", { id }, patch);
+    return await this.store.update("account", { id }, patch) === 1;
   }
   /**
    * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
@@ -33948,6 +34118,11 @@ var Users = class {
     await this.store.create("verification", record);
     return { token, code };
   }
+  /** The user ID a link token belongs to, without using the verification up; null if invalid, expired or used. */
+  async peekLinkToken(token, purpose) {
+    const record = await this.store.findOne("verification", { id: hashLinkToken(token), purpose });
+    return record && record.expiresAt > Date.now() ? record.userId : null;
+  }
   /** Uses up the verification a link token belongs to. Resolves to its user ID, or null if invalid, expired or used. */
   async consumeLinkToken(token, purpose) {
     const id = hashLinkToken(token);
@@ -33994,6 +34169,215 @@ var Users = class {
   }
 };
 
+// src/routes/helpers.ts
+async function body(c6) {
+  const data = await c6.req.json().catch(() => null);
+  return data && typeof data === "object" ? data : {};
+}
+function error(c6, status, code, message2) {
+  return c6.json({ error: code, message: message2 }, status);
+}
+var unavailable = (c6) => error(c6, 503, "temporarily_unavailable", "E-mails can not be sent right now. Please try again later.");
+var accepted = (c6) => c6.json({}, 202);
+var noSession = (c6) => error(c6, 401, "no_session", "Please sign in first.");
+function redirectTarget(ctx, c6, value) {
+  const url = ctx.allowedUrl(value);
+  return url ?? error(c6, 400, "invalid_options", "redirectTo must be an absolute URL whose origin is in ALLOWED_ORIGINS.");
+}
+var MAX_NAME_LENGTH = 100;
+function nameOf(value) {
+  return typeof value === "string" && value.trim() ? value.trim().slice(0, MAX_NAME_LENGTH) : null;
+}
+function signInAnswer(c6, step) {
+  if ("disabled" in step) return error(c6, 403, "method_disabled", "This way of signing in is switched off.");
+  if ("next" in step) {
+    return step.next === "totp" ? c6.json({ error: "totp_required", message: "Enter the code from your authenticator app to finish signing in.", method: step.method }, 401) : c6.json({ error: "totp_setup_required", message: "Set up an authenticator app to finish signing in.", method: step.method }, 401);
+  }
+  return c6.json({ user: step.user });
+}
+
+// src/routes/emails.ts
+var MAIL_INTERVAL_MS = 60 * 1e3;
+var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
+var RESET_TTL_MS = 30 * 60 * 1e3;
+var VERIFY_LINK_PARAM = "madauth_verify";
+var RESET_LINK_PARAM = "madauth_reset";
+function createEmails(ctx, users, webhook) {
+  const sendEmail = async (user, type, data) => {
+    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+    const result = await webhook.call(type, { to: user.email, user: { id: user.id, name: user.name ?? void 0 }, ...data }, WEBHOOK_TIMEOUT_MS);
+    if (!result.ok) {
+      console.error(`[madauth] Webhook "${type}" for ${user.email} failed: ${result.reason}`);
+      return false;
+    }
+    await users.updateUser(user.id, { lastMailAt: Date.now() });
+    return true;
+  };
+  return {
+    sendEmail,
+    async sendLinkEmail(user, purpose, target, locale) {
+      if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+      const ttl = purpose === "verify" ? VERIFY_TTL_MS : RESET_TTL_MS;
+      const { token, code } = await users.issueVerification(user.id, purpose, ttl);
+      const link = new URL(target);
+      link.hash = `${purpose === "verify" ? VERIFY_LINK_PARAM : RESET_LINK_PARAM}=${token}`;
+      return sendEmail(user, purpose === "verify" ? "email.verify" : "email.reset", {
+        link: link.href,
+        code,
+        expiresAt: Date.now() + ttl,
+        site: target.host,
+        locale
+      });
+    },
+    async sendAccountEmail(user, type, target, locale) {
+      if (!webhook.wants(type)) return true;
+      const methods = await users.signInMethods(user.id, await ctx.settings.methods());
+      return sendEmail(user, type, { link: target.href, site: target.host, locale, methods });
+    },
+    async consume(data, purpose) {
+      if (typeof data.token === "string" && data.token) {
+        return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
+      }
+      if (isValidEmail(data.email) && typeof data.code === "string") {
+        const user = await users.findByEmail(normalizeEmail(data.email));
+        if (!user) return { userId: null, via: "code" };
+        return { ...await users.consumeCode(user, purpose, data.code.replace(/\s/g, "")), via: "code" };
+      }
+      return { userId: null, via: "code" };
+    },
+    invalidVerification(c6, { via, locked }) {
+      if (locked) {
+        return error(c6, 429, "codes_locked", "Too many wrong codes. Please ask for a new e-mail and use the link in it.");
+      }
+      return via === "link" ? error(c6, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c6, 400, "code_invalid", "The code is wrong or expired.");
+    }
+  };
+}
+
+// src/routes/email.ts
+function emailRoutes(app, ctx, users, webhook) {
+  const emails = createEmails(ctx, users, webhook);
+  const signUpMethod = async (userId) => await users.passwordAccount(userId) ? "password" : "totp";
+  app.post("/auth/email/send-verification", async (c6) => {
+    const data = await body(c6);
+    const target = redirectTarget(ctx, c6, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c6, 400, "invalid_email", "This is not a valid e-mail address.");
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (user && !user.emailVerified && await ctx.enabled(c6, await signUpMethod(user.id))) {
+      if (!await emails.sendLinkEmail(user, "verify", target, localeOf(data.locale))) return unavailable(c6);
+    }
+    return accepted(c6);
+  });
+  const disabled = (c6) => error(c6, 403, "method_disabled", "This way of signing in is switched off.");
+  app.post("/auth/email/verify", async (c6) => {
+    const data = await body(c6);
+    const waiting = typeof data.token === "string" && data.token ? await users.peekLinkToken(data.token, "verify") : isValidEmail(data.email) ? (await users.findByEmail(normalizeEmail(data.email)))?.id ?? null : null;
+    if (waiting && !await ctx.enabled(c6, await signUpMethod(waiting))) return disabled(c6);
+    const consumed = await emails.consume(data, "verify");
+    const { userId, via } = consumed;
+    const user = userId ? await users.findById(userId) : null;
+    if (!user) return emails.invalidVerification(c6, consumed);
+    const method = await signUpMethod(user.id);
+    if (!await ctx.enabled(c6, method)) return disabled(c6);
+    await users.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
+    const verified = { ...user, emailVerified: true, wrongCodes: 0 };
+    await ctx.emit("email.verified", { user: toMadauthUser(verified), via });
+    return signInAnswer(c6, await ctx.secondStep(c6, verified, method === "password" ? ["pwd"] : [], method));
+  });
+}
+
+// src/google.ts
+var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
+var googleJwks;
+function googleKeys() {
+  googleJwks ??= createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
+  return googleJwks;
+}
+async function verifyGoogleIdToken(idToken, opts) {
+  let payload;
+  try {
+    ({ payload } = await jwtVerify(idToken, opts.keys ?? googleKeys(), {
+      issuer: GOOGLE_ISSUERS,
+      audience: opts.clientId,
+      algorithms: ["RS256", "ES256"]
+    }));
+  } catch (e6) {
+    return { ok: false, error: "verification_failed", reason: e6.message };
+  }
+  if (typeof payload.sub !== "string" || !payload.sub) {
+    return { ok: false, error: "verification_failed", reason: "missing sub" };
+  }
+  if (payload.nonce !== opts.nonce) {
+    return { ok: false, error: "verification_failed", reason: "nonce mismatch" };
+  }
+  if (typeof payload.email !== "string" || !payload.email || payload.email_verified !== true) {
+    return { ok: false, error: "email_unverified", reason: "e-mail address not verified" };
+  }
+  const profile = { sub: payload.sub, email: payload.email };
+  if (typeof payload.name === "string") profile.name = payload.name;
+  if (typeof payload.picture === "string") profile.picture = payload.picture;
+  return { ok: true, profile };
+}
+
+// src/user.ts
+var SESSION_COOKIE = "madauth_session";
+var SESSION_TYP = "madauth-session+jwt";
+var RENEWAL_COOKIE = "madauth_renewal";
+var RENEWAL_TYP = "madauth-renewal+jwt";
+var EXPIRY_COOKIE = "madauth_session_expires";
+
+// src/tokens.ts
+function randomString(bytes = 32) {
+  return base64url_exports.encode(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+async function signToken(keys, issuer, typ, claims, ttlSeconds) {
+  return new SignJWT(claims).setProtectedHeader({ alg: SIGNING_ALG, kid: keys.kid, typ }).setIssuer(issuer).setIssuedAt().setExpirationTime(`${ttlSeconds}s`).sign(keys.privateKey);
+}
+async function readToken(keys, issuer, typ, token) {
+  if (!token) return null;
+  try {
+    const { payload } = await jwtVerify(token, keys.publicKey, { issuer, typ, algorithms: [SIGNING_ALG] });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function signSession(keys, issuer, ttlSeconds, user, amr, extra = {}) {
+  const claims = {
+    ...extra,
+    sub: user.id,
+    email: user.email,
+    email_verified: user.email ? true : void 0,
+    name: user.name,
+    picture: user.picture,
+    claims: user.claims && Object.keys(user.claims).length ? user.claims : void 0,
+    amr
+  };
+  return signToken(keys, issuer, SESSION_TYP, claims, ttlSeconds);
+}
+function signRenewal(keys, issuer, ttlSeconds, user, amr, extra = {}) {
+  const claims = {
+    ...extra,
+    sub: user.id,
+    email: user.email,
+    email_verified: user.email ? true : void 0,
+    name: user.name,
+    picture: user.picture,
+    amr
+  };
+  return signToken(keys, issuer, RENEWAL_TYP, claims, ttlSeconds);
+}
+function userFromClaims(claims) {
+  const user = { id: claims.sub };
+  if (claims.email) user.email = claims.email;
+  if (claims.name) user.name = claims.name;
+  if (claims.picture) user.picture = claims.picture;
+  if (claims.claims && typeof claims.claims === "object" && Object.keys(claims.claims).length) user.claims = claims.claims;
+  if (Array.isArray(claims.amr)) user.amr = claims.amr.filter((value) => typeof value === "string");
+  return user;
+}
+
 // src/routes/google.ts
 var NONCE_COOKIE = "madauth_nonce";
 var NONCE_TYP = "madauth-nonce+jwt";
@@ -34004,6 +34388,7 @@ var OAUTH_TTL = 10 * 60;
 var GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
 var GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
 var REDIRECT_ERROR_PARAM = "madauth_error";
+var REDIRECT_NEXT_PARAM = "madauth_next";
 async function pkceChallenge(verifier) {
   const digest2 = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
   return base64url_exports.encode(new Uint8Array(digest2));
@@ -34015,7 +34400,7 @@ function googleRoutes(app, ctx, google) {
   const resolveUser = async (profile, locale) => {
     const key = googleAccountKey(profile.sub);
     const emailNormalized = normalizeEmail(profile.email);
-    const signedIn = (user) => ({ ok: true, user: toMadauthUser(user, profile), sv: user.sessionVersion });
+    const signedIn = (user) => ({ ok: true, user });
     const account = await users.findAccountByKey(key);
     if (account) {
       const user = await users.findById(account.userId);
@@ -34028,6 +34413,11 @@ function googleRoutes(app, ctx, google) {
     for (let attempt = 0; attempt < 2; attempt++) {
       const existing = await users.findByEmail(emailNormalized);
       if (existing) {
+        if (existing.emailVerified && await users.hasAccounts(existing.id)) {
+          const methods = await users.signInMethods(existing.id, await ctx.settings.methods());
+          const how = methods.map((method) => ({ password: "a password", totp: "an authenticator app", google: "Google" })[method]).join(" or ");
+          return { ok: false, error: "other_method", message: `This e-mail address signs in with ${how || "another method"}. Use that instead of Google.`, methods };
+        }
         await users.verifyByProvider(existing);
         if (!await users.linkAccount(existing.id, { key, email: profile.email })) {
           const linked = await users.findAccountByKey(key);
@@ -34059,7 +34449,7 @@ function googleRoutes(app, ctx, google) {
   };
   const disabled = (c6) => c6.json({ error: "method_disabled", message: "Google sign-in is switched off." }, 403);
   app.post("/auth/google/nonce", async (c6) => {
-    if (!await ctx.enabled("google")) return disabled(c6);
+    if (!await ctx.enabled(c6, "google")) return disabled(c6);
     const nonce = randomString();
     const token = await signToken(await keys, issuer, NONCE_TYP, { nonce }, NONCE_TTL);
     setCookie(c6, NONCE_COOKIE, token, {
@@ -34072,16 +34462,16 @@ function googleRoutes(app, ctx, google) {
     return c6.json({ nonce });
   });
   app.post("/auth/google/verify", async (c6) => {
-    if (!await ctx.enabled("google")) return disabled(c6);
-    const body = await c6.req.json().catch(() => ({}));
-    if (typeof body.credential !== "string" || !body.credential) {
+    if (!await ctx.enabled(c6, "google")) return disabled(c6);
+    const body2 = await c6.req.json().catch(() => ({}));
+    if (typeof body2.credential !== "string" || !body2.credential) {
       return c6.json({ error: "verification_failed", message: "credential is missing" }, 400);
     }
     const nonceClaims = await readToken(await keys, issuer, NONCE_TYP, getCookie(c6, NONCE_COOKIE));
     if (!nonceClaims) {
       return c6.json({ error: "verification_failed", message: "nonce cookie missing or expired" }, 401);
     }
-    const result = await verifyGoogleIdToken(body.credential, {
+    const result = await verifyGoogleIdToken(body2.credential, {
       clientId: google.clientId,
       nonce: nonceClaims.nonce,
       keys: config.jwksResolver
@@ -34090,17 +34480,16 @@ function googleRoutes(app, ctx, google) {
       return c6.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
     }
     deleteCookie(c6, NONCE_COOKIE, { path: "/auth/google", secure });
-    const resolved = await resolveUser(result.profile, localeOf(body.locale));
+    const resolved = await resolveUser(result.profile, localeOf(body2.locale));
     if (!resolved.ok) {
+      if (resolved.error === "other_method") return c6.json({ error: resolved.error, message: resolved.message, methods: resolved.methods }, 403);
       return c6.json({ error: resolved.error, message: resolved.message }, resolved.error === "signup_rejected" ? 403 : 503);
     }
-    const user = await ctx.startSession(c6, resolved.user, ["google"], { sv: resolved.sv });
-    await ctx.emit("user.signed_in", { user, method: "google" });
-    return c6.json({ user });
+    return signInAnswer(c6, await ctx.secondStep(c6, resolved.user, ["google"], "google", result.profile));
   });
   const requireCodeFlow = async (c6, next) => {
     if (!google.clientSecret) return c6.json({ error: "not_found" }, 404);
-    if (!await ctx.enabled("google")) return disabled(c6);
+    if (!await ctx.enabled(c6, "google")) return disabled(c6);
     await next();
   };
   app.get("/auth/google/start", requireCodeFlow, async (c6) => {
@@ -34138,9 +34527,10 @@ function googleRoutes(app, ctx, google) {
     const oauth = await readToken(await keys, issuer, OAUTH_TYP, getCookie(c6, OAUTH_COOKIE));
     if (!oauth) return c6.text("Sign-in expired or was started in another browser. Please try again.", 400);
     deleteCookie(c6, OAUTH_COOKIE, { path: "/auth/google", secure });
-    const back = (error) => {
+    const back = (error2, next) => {
       const url = new URL(oauth.returnTo);
-      if (error) url.hash = `${REDIRECT_ERROR_PARAM}=${error}`;
+      if (error2) url.hash = `${REDIRECT_ERROR_PARAM}=${error2}`;
+      if (next) url.hash = `${REDIRECT_NEXT_PARAM}=${next}`;
       return c6.redirect(url.href, 302);
     };
     if (c6.req.query("error")) return back(c6.req.query("error") === "access_denied" ? "cancelled" : "verification_failed");
@@ -34174,80 +34564,38 @@ function googleRoutes(app, ctx, google) {
     if (!result.ok) return back(result.error);
     const resolved = await resolveUser(result.profile, typeof oauth.locale === "string" ? oauth.locale : void 0);
     if (!resolved.ok) return back(resolved.error);
-    const user = await ctx.startSession(c6, resolved.user, ["google"], { sv: resolved.sv });
-    await ctx.emit("user.signed_in", { user, method: "google" });
+    const step = await ctx.secondStep(c6, resolved.user, ["google"], "google", result.profile);
+    if ("disabled" in step) return back("method_disabled");
+    if ("next" in step) return back(void 0, step.next);
     return back();
   });
 }
 
-// src/routes/password.ts
+// src/routes/lockout.ts
 var FREE_ATTEMPTS = 5;
 var MAX_LOCK_MS = 15 * 60 * 1e3;
-var MAIL_INTERVAL_MS = 60 * 1e3;
-var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
-var RESET_TTL_MS = 30 * 60 * 1e3;
-var VERIFY_LINK_PARAM = "madauth_verify";
-var RESET_LINK_PARAM = "madauth_reset";
-var MAX_NAME_LENGTH = 100;
+async function countSignInAttempt(c6, users, account, now = Date.now()) {
+  const tooMany = (message2) => c6.json({ error: "too_many_attempts", message: message2 }, 429);
+  if (account.lockedUntil > now) {
+    const seconds = Math.ceil((account.lockedUntil - now) / 1e3);
+    return tooMany(`Too many failed attempts. Try again in ${seconds} seconds.`);
+  }
+  const failed = account.failedAttempts + 1;
+  const lockedUntil = failed >= FREE_ATTEMPTS ? now + Math.min(2 ** (failed - FREE_ATTEMPTS) * 1e3, MAX_LOCK_MS) : 0;
+  if (!await users.countAttempt(account, { failedAttempts: failed, lockedUntil })) {
+    return tooMany("Too many attempts at once. Please try again.");
+  }
+  return null;
+}
+
+// src/routes/password.ts
 function passwordRoutes(app, ctx, password, users, webhook) {
   const { minLength } = password;
-  const disabled = (c6) => c6.json({ error: "method_disabled", message: "E-mail & password sign-in is switched off." }, 403);
+  const emails = createEmails(ctx, users, webhook);
   app.use("/auth/password/*", async (c6, next) => {
-    if (!await ctx.enabled("password")) return disabled(c6);
+    if (!await ctx.enabled(c6, "password")) return error(c6, 403, "method_disabled", "E-mail & password sign-in is switched off.");
     await next();
   });
-  const body = async (c6) => {
-    const data = await c6.req.json().catch(() => null);
-    return data && typeof data === "object" ? data : {};
-  };
-  const error = (c6, status, code, message2) => c6.json({ error: code, message: message2 }, status);
-  const unavailable = (c6) => error(c6, 503, "temporarily_unavailable", "E-mails can not be sent right now. Please try again later.");
-  const accepted = (c6) => c6.json({}, 202);
-  const redirectTarget = (c6, value) => {
-    const url = ctx.allowedUrl(value);
-    return url ?? error(c6, 400, "invalid_options", "redirectTo must be an absolute URL whose origin is in ALLOWED_ORIGINS.");
-  };
-  const sendEmail = async (user, type, data) => {
-    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
-    const result = await webhook.call(type, { to: user.email, user: { id: user.id, name: user.name ?? void 0 }, ...data }, WEBHOOK_TIMEOUT_MS);
-    if (!result.ok) {
-      console.error(`[madauth] Webhook "${type}" for ${user.email} failed: ${result.reason}`);
-      return false;
-    }
-    await users.updateUser(user.id, { lastMailAt: Date.now() });
-    return true;
-  };
-  const sendLinkEmail = async (user, purpose, target, locale) => {
-    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
-    const ttl = purpose === "verify" ? VERIFY_TTL_MS : RESET_TTL_MS;
-    const { token, code } = await users.issueVerification(user.id, purpose, ttl);
-    const link = new URL(target);
-    link.hash = `${purpose === "verify" ? VERIFY_LINK_PARAM : RESET_LINK_PARAM}=${token}`;
-    return sendEmail(user, purpose === "verify" ? "email.verify" : "email.reset", {
-      link: link.href,
-      code,
-      expiresAt: Date.now() + ttl,
-      site: target.host,
-      locale
-    });
-  };
-  const consume = async (data, purpose) => {
-    if (typeof data.token === "string" && data.token) {
-      return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
-    }
-    if (isValidEmail(data.email) && typeof data.code === "string") {
-      const user = await users.findByEmail(normalizeEmail(data.email));
-      if (!user) return { userId: null, via: "code" };
-      return { ...await users.consumeCode(user, purpose, data.code.replace(/\s/g, "")), via: "code" };
-    }
-    return { userId: null, via: "code" };
-  };
-  const invalidVerification = (c6, { via, locked }) => {
-    if (locked) {
-      return error(c6, 429, "codes_locked", "Too many wrong codes. Please ask for a new e-mail and use the link in it.");
-    }
-    return via === "link" ? error(c6, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c6, 400, "code_invalid", "The code is wrong or expired.");
-  };
   app.post("/auth/password/signin", async (c6) => {
     const data = await body(c6);
     const wrong = () => error(c6, 401, "invalid_credentials", "E-mail or password is wrong.");
@@ -34259,16 +34607,8 @@ function passwordRoutes(app, ctx, password, users, webhook) {
       await verifyAgainstDummy(pw);
       return wrong();
     }
-    const now = Date.now();
-    if (account.lockedUntil > now) {
-      const seconds = Math.ceil((account.lockedUntil - now) / 1e3);
-      return error(c6, 429, "too_many_attempts", `Too many failed attempts. Try again in ${seconds} seconds.`);
-    }
-    const failed = account.failedAttempts + 1;
-    const lockedUntil = failed >= FREE_ATTEMPTS ? now + Math.min(2 ** (failed - FREE_ATTEMPTS) * 1e3, MAX_LOCK_MS) : 0;
-    if (!await users.countAttempt(account, { failedAttempts: failed, lockedUntil })) {
-      return error(c6, 429, "too_many_attempts", "Too many attempts at once. Please try again.");
-    }
+    const refused = await countSignInAttempt(c6, users, account);
+    if (refused) return refused;
     const { ok, needsRehash } = await verifyPassword(pw, account.secret);
     if (!ok) return wrong();
     await users.updateAccount(account.id, {
@@ -34279,28 +34619,24 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (!user.emailVerified) {
       return error(c6, 403, "email_unverified", "Please confirm your e-mail address first. We can send the e-mail again.");
     }
-    const result = await ctx.startSession(c6, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
-    await ctx.emit("user.signed_in", { user: result, method: "password" });
-    return c6.json({ user: result });
+    return signInAnswer(c6, await ctx.secondStep(c6, user, ["pwd"], "password"));
   });
   app.post("/auth/password/signup", async (c6) => {
     const data = await body(c6);
-    const target = redirectTarget(c6, data.redirectTo);
+    const target = redirectTarget(ctx, c6, data.redirectTo);
     if (target instanceof Response) return target;
     if (!isValidEmail(data.email)) return error(c6, 400, "invalid_email", "This is not a valid e-mail address.");
     const policy = checkPasswordPolicy(data.password, minLength);
     if (policy) return error(c6, 400, "weak_password", policy);
-    const name = typeof data.name === "string" && data.name.trim() ? data.name.trim().slice(0, MAX_NAME_LENGTH) : null;
+    const name = nameOf(data.name);
     const email = data.email.trim();
     const locale = localeOf(data.locale);
     const check2 = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "password" });
     if (!check2.ok) return check2.reason === "rejected" ? error(c6, 403, "signup_rejected", check2.message) : unavailable(c6);
     const passwordHash = await hashPassword(data.password);
     const existing = await users.findByEmail(normalizeEmail(email));
-    if (existing?.emailVerified) {
-      if (!webhook.wants("email.already_registered")) return accepted(c6);
-      const sent = await sendEmail(existing, "email.already_registered", { link: target.href, site: target.host, locale });
-      return sent ? accepted(c6) : unavailable(c6);
+    if (existing?.emailVerified && await users.hasAccounts(existing.id)) {
+      return await emails.sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c6) : unavailable(c6);
     }
     if (existing) {
       if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c6);
@@ -34308,7 +34644,7 @@ function passwordRoutes(app, ctx, password, users, webhook) {
       if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
       else await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash });
       await users.updateUser(existing.id, { name });
-      return await sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c6) : unavailable(c6);
+      return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c6) : unavailable(c6);
     }
     const user = await users.createUser({
       email,
@@ -34319,38 +34655,19 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     });
     if (!user) return accepted(c6);
     await ctx.emit("user.created", { user: toMadauthUser(user), method: "password" });
-    return await sendLinkEmail(user, "verify", target, locale) ? accepted(c6) : unavailable(c6);
-  });
-  app.post("/auth/password/send-verification", async (c6) => {
-    const data = await body(c6);
-    const target = redirectTarget(c6, data.redirectTo);
-    if (target instanceof Response) return target;
-    if (!isValidEmail(data.email)) return error(c6, 400, "invalid_email", "This is not a valid e-mail address.");
-    const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && !user.emailVerified && await users.passwordAccount(user.id)) {
-      if (!await sendLinkEmail(user, "verify", target, localeOf(data.locale))) return unavailable(c6);
-    }
-    return accepted(c6);
-  });
-  app.post("/auth/password/verify-email", async (c6) => {
-    const consumed = await consume(await body(c6), "verify");
-    const { userId, via } = consumed;
-    const user = userId ? await users.findById(userId) : null;
-    if (!user) return invalidVerification(c6, consumed);
-    await users.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
-    const result = await ctx.startSession(c6, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
-    await ctx.emit("email.verified", { user: result, via });
-    await ctx.emit("user.signed_in", { user: result, method: "password" });
-    return c6.json({ user: result });
+    return await emails.sendLinkEmail(user, "verify", target, locale) ? accepted(c6) : unavailable(c6);
   });
   app.post("/auth/password/send-reset", async (c6) => {
     const data = await body(c6);
-    const target = redirectTarget(c6, data.redirectTo);
+    const target = redirectTarget(ctx, c6, data.redirectTo);
     if (target instanceof Response) return target;
     if (!isValidEmail(data.email)) return error(c6, 400, "invalid_email", "This is not a valid e-mail address.");
     const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && (user.emailVerified || await users.passwordAccount(user.id))) {
-      if (!await sendLinkEmail(user, "reset", target, localeOf(data.locale))) return unavailable(c6);
+    const locale = localeOf(data.locale);
+    if (user && await users.passwordAccount(user.id)) {
+      if (!await emails.sendLinkEmail(user, "reset", target, locale)) return unavailable(c6);
+    } else if (user) {
+      if (!await emails.sendAccountEmail(user, "email.no_password", target, locale)) return unavailable(c6);
     }
     return accepted(c6);
   });
@@ -34358,89 +34675,359 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     const data = await body(c6);
     const policy = checkPasswordPolicy(data.password, minLength);
     if (policy) return error(c6, 400, "weak_password", policy);
-    const consumed = await consume(data, "reset");
+    const consumed = await emails.consume(data, "reset");
     const user = consumed.userId ? await users.findById(consumed.userId) : null;
-    if (!user) return invalidVerification(c6, consumed);
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account) return emails.invalidVerification(c6, consumed);
     const secret = await hashPassword(data.password);
-    const account = await users.passwordAccount(user.id);
-    if (account) await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 });
-    else await users.linkAccount(user.id, { key: passwordAccountKey(user.id), secret });
+    if (!await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 })) return emails.invalidVerification(c6, consumed);
     const sessionVersion = user.sessionVersion + 1;
     await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
     await users.clearVerifications(user.id);
-    const result = await ctx.startSession(c6, toMadauthUser(user), ["pwd"], { sv: sessionVersion });
-    await ctx.emit("email.password_reset", { user: result });
-    await ctx.emit("user.signed_in", { user: result, method: "password" });
-    return c6.json({ user: result });
+    const reset = { ...user, emailVerified: true, sessionVersion, wrongCodes: 0 };
+    await ctx.emit("email.password_reset", { user: toMadauthUser(reset) });
+    return signInAnswer(c6, await ctx.secondStep(c6, reset, ["pwd"], "password"));
   });
 }
 
-// src/settings.ts
-var SIGN_IN_METHODS = ["google", "password"];
-var METHODS_SETTING = "methods";
-function parseMethodSettings(input) {
-  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
-  const settings = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (!SIGN_IN_METHODS.includes(key) || typeof value !== "boolean") return null;
-    settings[key] = value;
+// src/totp.ts
+import { createCipheriv, createDecipheriv, createHmac as createHmac4, hkdfSync as hkdfSync2, randomBytes as randomBytes4, randomInt as randomInt2 } from "crypto";
+var TOTP_STEP_SECONDS = 30;
+var TOTP_DIGITS = 6;
+var TOTP_WINDOW = 1;
+var RECOVERY_CODES = 10;
+var SECRET_BYTES = 20;
+var BASE32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+var RECOVERY_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+var RECOVERY_CODE_LENGTH = 10;
+var ENCRYPTION_VERSION = "v1";
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+function base32Encode(bytes) {
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (const byte of bytes) {
+    value = (value << 8 | byte) & 65535;
+    bits += 8;
+    while (bits >= 5) {
+      out += BASE32[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
   }
-  return settings;
+  if (bits > 0) out += BASE32[value << 5 - bits & 31];
+  return out;
 }
-var MAX_TRIES = 3;
-var Settings = class {
-  constructor(store) {
-    this.store = store;
+function hotp(secret, counter, digits = TOTP_DIGITS) {
+  const message2 = Buffer.alloc(8);
+  message2.writeBigUInt64BE(BigInt(counter));
+  const digest2 = createHmac4("sha1", secret).update(message2).digest();
+  const offset = digest2[digest2.length - 1] & 15;
+  const binary = (digest2[offset] & 127) << 24 | digest2[offset + 1] << 16 | digest2[offset + 2] << 8 | digest2[offset + 3];
+  return (binary % 10 ** digits).toString().padStart(digits, "0");
+}
+function stepOf(nowMs) {
+  return Math.floor(nowMs / 1e3 / TOTP_STEP_SECONDS);
+}
+function totp(secret, step, digits = TOTP_DIGITS) {
+  return hotp(secret, step, digits);
+}
+function verifyTotp(secret, code, nowMs, window = TOTP_WINDOW) {
+  const given = code.replace(/\s/g, "");
+  if (!new RegExp(`^\\d{${TOTP_DIGITS}}$`).test(given)) return null;
+  const now = stepOf(nowMs);
+  let found = null;
+  for (let step = now - window; step <= now + window; step++) {
+    if (safeEqual(totp(secret, step), given) && found === null) found = step;
+  }
+  return found;
+}
+function generateTotpSecret() {
+  return randomBytes4(SECRET_BYTES);
+}
+function otpauthUri(options) {
+  const issuer = encodeURIComponent(options.issuer);
+  const account = encodeURIComponent(options.account);
+  const secret = base32Encode(options.secret);
+  return `otpauth://totp/${issuer}:${account}?secret=${secret}&issuer=${issuer}&algorithm=SHA1&digits=${TOTP_DIGITS}&period=${TOTP_STEP_SECONDS}`;
+}
+function deriveTotpKey(signingKeyD) {
+  return Buffer.from(hkdfSync2("sha256", Buffer.from(signingKeyD, "base64url"), "", "madauth totp secret", 32));
+}
+function encryptSecret(key, secret) {
+  const iv = randomBytes4(IV_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(secret), cipher.final()]);
+  const parts = [iv, encrypted, cipher.getAuthTag()].map((part) => part.toString("base64url"));
+  return [ENCRYPTION_VERSION, ...parts].join(".");
+}
+function decryptSecret(key, stored) {
+  const [version, iv, encrypted, tag2, ...rest] = stored.split(".");
+  if (version !== ENCRYPTION_VERSION || !iv || !encrypted || !tag2 || rest.length) return null;
+  const ivBytes = Buffer.from(iv, "base64url");
+  const tagBytes = Buffer.from(tag2, "base64url");
+  if (ivBytes.length !== IV_BYTES || tagBytes.length !== TAG_BYTES) return null;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, ivBytes);
+    decipher.setAuthTag(tagBytes);
+    return Buffer.concat([decipher.update(Buffer.from(encrypted, "base64url")), decipher.final()]);
+  } catch {
+    return null;
   }
-  /** The setting's value, or undefined if it was never set. */
-  async get(id) {
-    return (await this.read(id)).value;
+}
+function generateRecoveryCodes() {
+  const codes = /* @__PURE__ */ new Set();
+  while (codes.size < RECOVERY_CODES) {
+    let code = "";
+    for (let i6 = 0; i6 < RECOVERY_CODE_LENGTH; i6++) code += RECOVERY_ALPHABET[randomInt2(RECOVERY_ALPHABET.length)];
+    codes.add(`${code.slice(0, 5)}-${code.slice(5)}`);
+  }
+  return [...codes];
+}
+function normalizeRecoveryCode(text) {
+  if (typeof text !== "string") return null;
+  const code = text.toLowerCase().replace(/[\s-]/g, "");
+  return code.length === RECOVERY_CODE_LENGTH && [...code].every((char) => RECOVERY_ALPHABET.includes(char)) ? code : null;
+}
+function hashRecoveryCode(codeKey, code) {
+  return hashCode(codeKey, `recovery:${code}`);
+}
+
+// src/routes/totp.ts
+var CHALLENGE_COOKIE = "madauth_challenge";
+var CHALLENGE_TYP = "madauth-challenge+jwt";
+var CHALLENGE_TTL = 10 * 60;
+var SETUP_COOKIE = "madauth_totp_setup";
+var SETUP_TYP = "madauth-totp-setup+jwt";
+var SETUP_TTL = 10 * 60;
+var COOKIE_PATH = "/auth/totp";
+var cookieOptions = (secure) => ({ path: COOKIE_PATH, httpOnly: true, secure, sameSite: "Strict" });
+async function setChallenge(c6, ctx, challenge) {
+  const token = await signToken(await ctx.keys, ctx.config.issuer, CHALLENGE_TYP, { ...challenge }, CHALLENGE_TTL);
+  setCookie(c6, CHALLENGE_COOKIE, token, { ...cookieOptions(ctx.secure), maxAge: CHALLENGE_TTL });
+}
+function clearChallenge(c6, secure) {
+  deleteCookie(c6, CHALLENGE_COOKIE, cookieOptions(secure));
+}
+async function readChallenge(c6, ctx, next) {
+  const claims = await readToken(await ctx.keys, ctx.config.issuer, CHALLENGE_TYP, getCookie(c6, CHALLENGE_COOKIE));
+  return claims && claims.next === next && typeof claims.sub === "string" && Array.isArray(claims.amr) ? claims : null;
+}
+async function checkCode(c6, ctx, keys, user, account, data, wrong = () => error(c6, 401, "code_invalid", "The code is wrong or was already used.")) {
+  const { users } = ctx;
+  const refused = await countSignInAttempt(c6, users, account);
+  if (refused) return refused;
+  if (typeof data.recoveryCode === "string") {
+    const code = normalizeRecoveryCode(data.recoveryCode);
+    if (!code || !await users.consumeRecoveryCode(account, hashRecoveryCode(keys.codeKey, code))) return wrong();
+    await users.updateAccount(account.id, { failedAttempts: 0, lockedUntil: 0 });
+    const remaining = await users.countRecoveryCodes(account);
+    await ctx.emit("totp.recovery_code_used", { user: toMadauthUser(user), remaining });
+    return "recovery_code";
+  }
+  if (typeof data.code !== "string" || !account.secret) return wrong();
+  const secret = decryptSecret(keys.totpKey, account.secret);
+  if (!secret) {
+    console.error(`[madauth] The authenticator secret of user ${user.id} can't be read: was MADAUTH_SIGNING_KEY changed?`);
+    return wrong();
   }
-  /** The stored JSON and what it holds; both undefined if the setting was never set. */
-  async read(id) {
-    const record = await this.store.findOne("setting", { id });
-    if (typeof record?.value !== "string") return {};
-    try {
-      return { json: record.value, value: JSON.parse(record.value) };
-    } catch {
-      return { json: record.value };
+  const step = verifyTotp(secret, data.code, Date.now(), TOTP_WINDOW);
+  if (step === null || step <= (account.lastUsedStep ?? 0) || !await users.useTotpStep(account, step)) return wrong();
+  return "totp";
+}
+function totpRoutes(app, ctx, keys) {
+  const { config, secure, users } = ctx;
+  const { issuer } = config;
+  const cookie = cookieOptions(secure);
+  const methodsNow = (c6) => ctx.methods(c6);
+  app.use(`${COOKIE_PATH}/*`, async (c6, next) => {
+    if (!authenticatorOn(ctx.configured, await methodsNow(c6))) {
+      return error(c6, 403, "method_disabled", "The authenticator app is switched off.");
     }
-  }
-  /**
-   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
-   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
-   * again with the newer value. Resolves to the new value, or null if `apply` refused.
-   * `updatedBy` is the address of the admin, or null for the command line.
-   */
-  async change(id, apply, updatedBy) {
-    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
-      const { json: json2, value } = await this.read(id);
-      const next = apply(value);
-      if (next === null) return null;
-      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
-      const written = json2 === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json2 }, patch) === 1;
-      if (written) return next;
+    await next();
+  });
+  const standalone = async (c6) => isOn("totp", ctx.configured, await methodsNow(c6));
+  const notStandalone = (c6) => error(c6, 403, "method_disabled", "Signing in with the authenticator app alone is switched off.");
+  const methodStillOn = async (c6, challenge) => isOn(challenge.method, ctx.configured, await methodsNow(c6));
+  const methodOff = (c6) => error(c6, 403, "method_disabled", "This way of signing in is switched off.");
+  const signedIn = async (c6) => {
+    const user = await ctx.currentUser(c6);
+    return user ? users.findById(user.id) : null;
+  };
+  const whoSetsUp = async (c6) => {
+    const challenge = await readChallenge(c6, ctx, "totp-setup");
+    const waiting = challenge ? await users.findById(challenge.sub) : null;
+    if (challenge && waiting && waiting.sessionVersion === challenge.sv) return { user: waiting, challenge };
+    const user = await signedIn(c6);
+    return user ? { user, challenge: null } : null;
+  };
+  const newRecoveryCodes = () => {
+    const recoveryCodes = generateRecoveryCodes();
+    return { recoveryCodes, hashes: recoveryCodes.map((code) => hashRecoveryCode(keys.codeKey, normalizeRecoveryCode(code))) };
+  };
+  const issuerLabel = (c6) => {
+    if (config.totpIssuer) return config.totpIssuer;
+    const origin = c6.req.header("origin");
+    return URL.canParse(origin ?? "") ? new URL(origin).hostname : new URL(issuer).hostname;
+  };
+  const finishSignIn = async (c6, user, challenge, via) => {
+    const result = await ctx.startSession(c6, toMadauthUser(user, challenge.profile), [...challenge.amr, "otp"], { sv: user.sessionVersion });
+    await ctx.emit("user.signed_in", { user: result, method: challenge.method, ...challenge.amr.length ? { secondFactor: via } : {} });
+    return result;
+  };
+  app.post(`${COOKIE_PATH}/setup`, async (c6) => {
+    const who = await whoSetsUp(c6);
+    if (!who) return noSession(c6);
+    if (who.challenge && !await methodStillOn(c6, who.challenge)) return methodOff(c6);
+    const existing = await users.totpAccount(who.user.id);
+    let approved;
+    if (existing) {
+      const previous = await readToken(await ctx.keys, issuer, SETUP_TYP, getCookie(c6, SETUP_COOKIE));
+      const holds = previous?.sub === who.user.id && typeof previous.approved === "number" && Date.now() - previous.approved < SETUP_TTL * 1e3;
+      if (holds) {
+        approved = previous.approved;
+      } else {
+        const data = await body(c6);
+        if (data.code === void 0 && data.recoveryCode === void 0) {
+          return error(c6, 401, "code_required", "Enter a code from your current authenticator app (or a recovery code) to replace it.");
+        }
+        const via = await checkCode(c6, ctx, keys, who.user, existing, data);
+        if (via instanceof Response) return via;
+        approved = Date.now();
+      }
     }
-    throw new Error(`Setting "${id}" kept changing; try again.`);
-  }
-  /** Replaces the setting. */
-  async set(id, value, updatedBy) {
-    await this.change(id, () => value, updatedBy);
-  }
-  /** Which sign-in methods are on; a method that was never switched off is on. */
-  async methods() {
-    return parseMethodSettings(await this.get(METHODS_SETTING)) ?? {};
-  }
-  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
-  async changeMethods(apply, updatedBy) {
-    return this.change(METHODS_SETTING, (current) => apply(parseMethodSettings(current) ?? {}), updatedBy);
+    const secret = generateTotpSecret();
+    const claims = {
+      sub: who.user.id,
+      setup: newId("tsu"),
+      secret: encryptSecret(keys.totpKey, secret),
+      ...existing ? { replaces: existing.setupId } : {},
+      ...approved ? { approved } : {}
+    };
+    const token = await signToken(await ctx.keys, issuer, SETUP_TYP, claims, SETUP_TTL);
+    setCookie(c6, SETUP_COOKIE, token, { ...cookie, maxAge: SETUP_TTL });
+    return c6.json({ secret: base32Encode(secret), uri: otpauthUri({ issuer: issuerLabel(c6), account: who.user.email, secret }) });
+  });
+  app.post(`${COOKIE_PATH}/confirm`, async (c6) => {
+    const who = await whoSetsUp(c6);
+    if (!who) return noSession(c6);
+    const { user, challenge } = who;
+    if (challenge && !await methodStillOn(c6, challenge)) return methodOff(c6);
+    const data = await body(c6);
+    const setup = await readToken(await ctx.keys, issuer, SETUP_TYP, getCookie(c6, SETUP_COOKIE));
+    const secret = setup && setup.sub === user.id && typeof setup.secret === "string" && typeof setup.setup === "string" ? decryptSecret(keys.totpKey, setup.secret) : null;
+    if (!setup || !secret) return error(c6, 400, "setup_expired", "The setup has expired or was started in another browser. Please start again.");
+    const step = typeof data.code === "string" ? verifyTotp(secret, data.code, Date.now(), TOTP_WINDOW) : null;
+    if (step === null) return error(c6, 400, "code_invalid", "The code is wrong. Enter the current code from the app.");
+    const { recoveryCodes, hashes } = newRecoveryCodes();
+    await users.addRecoveryCodes(user.id, setup.setup, hashes);
+    const patch = { secret: setup.secret, setupId: setup.setup, failedAttempts: 0, lockedUntil: 0, lastUsedStep: step };
+    const current = setup.replaces === void 0 ? null : await users.totpAccount(user.id);
+    const written = setup.replaces === void 0 ? !!await users.linkAccount(user.id, { key: totpAccountKey(user.id), ...patch }) : !!current && await users.confirmTotpSetup(current.id, setup.replaces, patch);
+    if (!written) {
+      await users.clearRecoveryCodes(user.id, { only: setup.setup });
+      deleteCookie(c6, SETUP_COOKIE, cookie);
+      return error(c6, 400, "setup_expired", "Your authenticator app was set up or removed elsewhere meanwhile. Please start again.");
+    }
+    await users.clearRecoveryCodes(user.id, { except: setup.setup });
+    deleteCookie(c6, SETUP_COOKIE, cookie);
+    await ctx.emit("totp.enabled", { user: toMadauthUser(user) });
+    if (!challenge) return c6.json({ recoveryCodes });
+    const result = await finishSignIn(c6, user, challenge, "totp");
+    return c6.json({ user: result, recoveryCodes });
+  });
+  app.post(`${COOKIE_PATH}/verify`, async (c6) => {
+    const expired = () => error(c6, 401, "challenge_expired", "The sign-in has expired. Please sign in again.");
+    const challenge = await readChallenge(c6, ctx, "totp");
+    if (!challenge) return expired();
+    if (!await methodStillOn(c6, challenge)) return methodOff(c6);
+    const user = await users.findById(challenge.sub);
+    const account = user && user.sessionVersion === challenge.sv ? await users.totpAccount(user.id) : null;
+    if (!user || !account) return expired();
+    const via = await checkCode(c6, ctx, keys, user, account, await body(c6));
+    if (via instanceof Response) return via;
+    return c6.json({ user: await finishSignIn(c6, user, challenge, via) });
+  });
+  app.post(`${COOKIE_PATH}/signin`, async (c6) => {
+    if (!await standalone(c6)) return notStandalone(c6);
+    const data = await body(c6);
+    const wrong = () => error(c6, 401, "invalid_credentials", "E-mail or code is wrong.");
+    if (!isValidEmail(data.email)) return wrong();
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    const account = user ? await users.totpAccount(user.id) : null;
+    if (!user || !user.emailVerified || !account?.secret) return wrong();
+    const via = await checkCode(c6, ctx, keys, user, account, data, wrong);
+    if (via instanceof Response) return via;
+    const result = await ctx.startSession(c6, toMadauthUser(user), ["otp"], { sv: user.sessionVersion });
+    await ctx.emit("user.signed_in", { user: result, method: "totp" });
+    return c6.json({ user: result });
+  });
+  app.post(`${COOKIE_PATH}/remove`, async (c6) => {
+    const user = await signedIn(c6);
+    if (!user) return noSession(c6);
+    const methods = await methodsNow(c6);
+    const required = METHODS_WITH_SECOND_FACTOR.filter((method) => isOn(method, ctx.configured, methods) && policyOf(method, methods) === "required");
+    if (required.length) {
+      const names = required.map((method) => method === "google" ? "Google" : "e-mail & password");
+      return error(c6, 403, "required_by_policy", `Signing in with ${names.join(" and ")} requires the authenticator app, so it can't be removed.`);
+    }
+    const account = await users.totpAccount(user.id);
+    if (!account) return c6.json({});
+    if (!(await users.signInMethods(user.id, methods)).some((method) => method !== "totp" && isOn(method, ctx.configured, methods))) {
+      return error(c6, 403, "only_method", "The authenticator app is the only way you sign in, so it can't be removed. Delete your account instead.");
+    }
+    const via = await checkCode(c6, ctx, keys, user, account, await body(c6));
+    if (via instanceof Response) return via;
+    await users.removeTotp(user.id);
+    await ctx.emit("totp.disabled", { user: toMadauthUser(user) });
+    return c6.json({});
+  });
+  app.post(`${COOKIE_PATH}/recovery-codes`, async (c6) => {
+    const user = await signedIn(c6);
+    if (!user) return noSession(c6);
+    const account = await users.totpAccount(user.id);
+    if (!account) return error(c6, 400, "no_authenticator", "No authenticator app is set up.");
+    const via = await checkCode(c6, ctx, keys, user, account, await body(c6));
+    if (via instanceof Response) return via;
+    const { recoveryCodes, hashes } = newRecoveryCodes();
+    await users.replaceRecoveryCodes(account, hashes);
+    return c6.json({ recoveryCodes });
+  });
+  app.get(`${COOKIE_PATH}/status`, async (c6) => {
+    const user = await signedIn(c6);
+    if (!user) return noSession(c6);
+    const account = await users.totpAccount(user.id);
+    return c6.json({ enabled: !!account, recoveryCodesLeft: account ? await users.countRecoveryCodes(account) : 0 });
+  });
+  if (ctx.webhook && ctx.emailVerification) {
+    const emails = createEmails(ctx, users, ctx.webhook);
+    app.post(`${COOKIE_PATH}/signup`, async (c6) => {
+      if (!await standalone(c6)) return notStandalone(c6);
+      const data = await body(c6);
+      const target = redirectTarget(ctx, c6, data.redirectTo);
+      if (target instanceof Response) return target;
+      if (!isValidEmail(data.email)) return error(c6, 400, "invalid_email", "This is not a valid e-mail address.");
+      const name = nameOf(data.name);
+      const email = data.email.trim();
+      const locale = localeOf(data.locale);
+      const check2 = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "totp" });
+      if (!check2.ok) return check2.reason === "rejected" ? error(c6, 403, "signup_rejected", check2.message) : unavailable(c6);
+      const existing = await users.findByEmail(normalizeEmail(email));
+      if (existing?.emailVerified && await users.hasAccounts(existing.id)) {
+        return await emails.sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c6) : unavailable(c6);
+      }
+      if (existing) {
+        if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c6);
+        if (!existing.emailVerified) await users.unlinkAccount(passwordAccountKey(existing.id));
+        await users.updateUser(existing.id, { name });
+        return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c6) : unavailable(c6);
+      }
+      const user = await users.createUser({ email, emailNormalized: normalizeEmail(email), name, emailVerified: false });
+      if (!user) return accepted(c6);
+      await ctx.emit("user.created", { user: toMadauthUser(user), method: "totp" });
+      return await emails.sendLinkEmail(user, "verify", target, locale) ? accepted(c6) : unavailable(c6);
+    });
   }
-};
-function isOn(method, available, methods) {
-  return available(method) && methods[method] !== false;
-}
-function anyOn(available, methods) {
-  return SIGN_IN_METHODS.some((method) => isOn(method, available, methods));
 }
 
 // src/app.ts
@@ -34450,9 +35037,14 @@ function createApp(config) {
   const keys = importSigningKeys(config.signingKey);
   const secure = issuer.startsWith("https:");
   const isAllowedOrigin = (origin) => !!origin && allowedOrigins.includes(origin);
-  const users = new Users(config.store, deriveCodeKey(config.signingKey.d));
-  const settings = new Settings(config.store);
-  const available = (method) => method === "google" ? !!config.google : !!config.password;
+  const codeKey = deriveCodeKey(config.signingKey.d);
+  const users = new Users(config.store, codeKey);
+  const methods = methodConfig(config);
+  const settings = new Settings(config.store, initialMethods(methods));
+  const configured = (method) => isConfigured(methods, method);
+  const signsUp = (method) => canSignUp(methods, method);
+  const emailVerification = sendsVerificationEmails(config);
+  const totpKeys = { totpKey: deriveTotpKey(config.signingKey.d), codeKey };
   const issueSession = async (c6, user, amr, extra) => {
     const signingKeys = await keys;
     const [sessionToken, renewalToken] = await Promise.all([
@@ -34487,6 +35079,29 @@ function createApp(config) {
     deleteCookie(c6, RENEWAL_COOKIE, { path: "/auth", secure });
     deleteCookie(c6, EXPIRY_COOKIE, { path: "/", domain: cookieDomain, secure });
   };
+  const tokenClaims = async (c6, cookie, typ) => readToken(await keys, issuer, typ, getCookie(c6, cookie));
+  const checked = async (claims) => {
+    const stored = await users.findById(claims.sub);
+    if (!stored || stored.sessionVersion !== claims.sv) return null;
+    const { claims: _, ...user } = userFromClaims(claims);
+    const current = claimsFromJson(stored.claims);
+    return Object.keys(current).length ? { ...user, claims: current } : user;
+  };
+  const currentSession = async (c6) => {
+    const session = await tokenClaims(c6, SESSION_COOKIE, SESSION_TYP);
+    const user = session ? await checked(session) : null;
+    const upToDate = session && user && sameClaims(user.claims, session.claims) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
+    if (upToDate) return user;
+    const renewal = await tokenClaims(c6, RENEWAL_COOKIE, RENEWAL_TYP);
+    const sameSignIn = session && user && renewal && renewal.sub === session.sub && renewal.sv === session.sv && renewal.email === session.email;
+    const renewed = sameSignIn ? user : renewal ? await checked(renewal) : null;
+    if (renewal && renewed) {
+      await issueSession(c6, renewed, renewal.amr, { sv: renewal.sv });
+      return renewed;
+    }
+    return user;
+  };
+  const methodsOf = /* @__PURE__ */ new WeakMap();
   const ctx = {
     config,
     keys,
@@ -34504,14 +35119,42 @@ function createApp(config) {
       return url;
     },
     async startSession(c6, user, amr, extra) {
+      clearChallenge(c6, secure);
       await issueSession(c6, user, amr, extra);
-      return user;
+      return { ...user, amr };
+    },
+    async secondStep(c6, user, amr, method, profile) {
+      const methods2 = await this.methods(c6);
+      if (!isOn(method, configured, methods2)) return { disabled: true };
+      const enrolled = await users.totpAccount(user.id);
+      const policy = method === "totp" ? "required" : policyOf(method, methods2);
+      const next = policy === "none" ? null : enrolled ? "totp" : policy === "required" ? "totp-setup" : null;
+      if (next) {
+        clearSession(c6);
+        const known = { ...profile?.name ? { name: profile.name } : {}, ...profile?.picture ? { picture: profile.picture } : {} };
+        await setChallenge(c6, this, { sub: user.id, sv: user.sessionVersion, amr, method, next, ...Object.keys(known).length ? { profile: known } : {} });
+        return { next, method };
+      }
+      const result = await this.startSession(c6, toMadauthUser(user, profile), amr, { sv: user.sessionVersion });
+      await this.emit("user.signed_in", { user: result, method });
+      return { user: result };
     },
+    currentUser: currentSession,
     users,
     settings,
     webhook: config.webhook ? createWebhookClient(config.webhook, config.webhookFetch) : void 0,
-    async enabled(method) {
-      return isOn(method, available, await settings.methods());
+    configured,
+    emailVerification,
+    methods(c6) {
+      let reading = methodsOf.get(c6.req.raw);
+      if (!reading) {
+        reading = settings.methods();
+        methodsOf.set(c6.req.raw, reading);
+      }
+      return reading;
+    },
+    async enabled(c6, method) {
+      return isOn(method, configured, await this.methods(c6));
     },
     async checkSignup(data) {
       if (!this.webhook?.wants("signup.before")) return { ok: true };
@@ -34529,7 +35172,9 @@ function createApp(config) {
     },
     async emit(type, data) {
       if (!this.webhook?.wants(type)) return;
-      const result = await this.webhook.call(type, data, EVENT_TIMEOUT_MS);
+      const user = data.user;
+      const payload = user && typeof user === "object" && "amr" in user ? { ...data, user: { ...user, amr: void 0 } } : data;
+      const result = await this.webhook.call(type, payload, EVENT_TIMEOUT_MS);
       if (!result.ok) console.error(`[madauth] Webhook "${type}" failed: ${result.reason}`);
     }
   };
@@ -34557,37 +35202,20 @@ function createApp(config) {
     return c6.json({ keys: [publicJwk] });
   });
   app.get("/auth/config", async (c6) => {
-    const methods = await settings.methods();
-    const on = (method) => isOn(method, available, methods);
+    const current = await ctx.methods(c6);
+    const on = (method) => isOn(method, configured, current);
     return c6.json({
-      google: on("google") ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret } : null,
-      password: on("password") ? { minLength: config.password.minLength } : null
+      google: on("google") ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret, secondFactor: policyOf("google", current) } : null,
+      password: on("password") ? { minLength: config.password.minLength, secondFactor: policyOf("password", current) } : null,
+      // The app can be set up when it is in use at all; `signIn` says whether it signs in on its own.
+      totp: authenticatorOn(configured, current) ? { signIn: on("totp"), signUp: on("totp") && emailVerification } : null,
+      email: { verification: emailVerification }
     });
   });
+  if (emailVerification && ctx.webhook) emailRoutes(app, ctx, users, ctx.webhook);
   if (config.google) googleRoutes(app, ctx, config.google);
   if (config.password && ctx.webhook) passwordRoutes(app, ctx, config.password, users, ctx.webhook);
-  const tokenClaims = async (c6, cookie, typ) => readToken(await keys, issuer, typ, getCookie(c6, cookie));
-  const checked = async (claims) => {
-    const stored = await users.findById(claims.sub);
-    if (!stored || stored.sessionVersion !== claims.sv) return null;
-    const { claims: _, ...user } = userFromClaims(claims);
-    const current = claimsFromJson(stored.claims);
-    return Object.keys(current).length ? { ...user, claims: current } : user;
-  };
-  const currentSession = async (c6) => {
-    const session = await tokenClaims(c6, SESSION_COOKIE, SESSION_TYP);
-    const user = session ? await checked(session) : null;
-    const upToDate = session && user && sameClaims(user.claims, session.claims) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
-    if (upToDate) return user;
-    const renewal = await tokenClaims(c6, RENEWAL_COOKIE, RENEWAL_TYP);
-    const sameSignIn = session && user && renewal && renewal.sub === session.sub && renewal.sv === session.sv && renewal.email === session.email;
-    const renewed = sameSignIn ? user : renewal ? await checked(renewal) : null;
-    if (renewal && renewed) {
-      await issueSession(c6, renewed, renewal.amr, { sv: renewal.sv });
-      return renewed;
-    }
-    return user;
-  };
+  totpRoutes(app, ctx, totpKeys);
   app.get("/auth/session", async (c6) => {
     const user = await currentSession(c6);
     if (!user) {
@@ -34598,11 +35226,23 @@ function createApp(config) {
   });
   app.post("/auth/logout", (c6) => {
     clearSession(c6);
+    clearChallenge(c6, secure);
     return c6.body(null, 204);
   });
   app.post("/auth/account/delete", async (c6) => {
     const user = await currentSession(c6);
     if (!user) return c6.json({ error: "no_session" }, 401);
+    const stored = await users.findById(user.id);
+    const protects = stored && authenticatorOn(configured, await ctx.methods(c6));
+    const authenticator = protects ? await users.totpAccount(user.id) : null;
+    if (stored && authenticator) {
+      const data = await body(c6);
+      if (data.code === void 0 && data.recoveryCode === void 0) {
+        return error(c6, 401, "code_required", "Enter a code from your authenticator app (or a recovery code) to delete your account.");
+      }
+      const via = await checkCode(c6, ctx, totpKeys, stored, authenticator, data);
+      if (via instanceof Response) return via;
+    }
     await users.deleteById(user.id);
     clearSession(c6);
     await ctx.emit("user.deleted", { user });
@@ -34618,10 +35258,6 @@ function createApp(config) {
     }
     return { email };
   };
-  const body = async (c6) => {
-    const data = await c6.req.json().catch(() => null);
-    return data && typeof data === "object" ? data : {};
-  };
   const invalidEmail = (c6) => c6.json({ error: "invalid_email", message: "This is not a valid e-mail address." }, 400);
   const noUser = (c6) => c6.json({ error: "user_not_found", message: "No user has this e-mail address." }, 404);
   app.post("/auth/admin/claims/get", async (c6) => {
@@ -34655,9 +35291,16 @@ function createApp(config) {
     await ctx.emit("user.claims_changed", { userId: user.id, email, claims, by: caller.email });
     return c6.json({ email, userId: user.id, claims });
   });
-  const settingsAnswer = (methods) => ({
+  const settingsAnswer = (methods2) => ({
     methods: Object.fromEntries(
-      SIGN_IN_METHODS.map((method) => [method, { available: available(method), enabled: isOn(method, available, methods) }])
+      SIGN_IN_METHODS.map((method) => [
+        method,
+        {
+          configured: configured(method),
+          enabled: isOn(method, configured, methods2),
+          ...method === "totp" ? {} : { secondFactor: policyOf(method, methods2) }
+        }
+      ])
     )
   });
   app.post("/auth/admin/settings/get", async (c6) => {
@@ -34670,14 +35313,26 @@ function createApp(config) {
     if ("answer" in caller) return caller.answer;
     const data = await body(c6);
     const invalid2 = (message2) => c6.json({ error: "invalid_settings", message: message2 }, 400);
-    const changes = parseMethodSettings(data.methods);
-    if (!changes) return invalid2(`methods must be an object with true or false for ${SIGN_IN_METHODS.join(" and/or ")}.`);
-    const methods = await settings.changeMethods((current) => {
-      const next = { ...current, ...changes };
-      return anyOn(available, next) ? next : null;
-    }, caller.email);
-    if (!methods) return invalid2("At least one sign-in method must stay on.");
-    return c6.json(settingsAnswer(methods));
+    const next = parseMethodSettings(data.methods, { booleans: true });
+    if (!next) {
+      return invalid2(
+        `methods must list the sign-in methods that are on (${SIGN_IN_METHODS.join(", ")}), each as true, {} or { "secondFactor": "none" | "optional" | "required" } (google and password), e.g. { "google": {}, "password": { "secondFactor": "optional" } }. A method that is not listed is off.`
+      );
+    }
+    const methods2 = await settings.changeMethods(() => anyOn(signsUp, next) ? next : null, caller.email);
+    if (!methods2) return invalid2("At least one sign-in method that creates users must stay on: Google, e-mail & password, or the authenticator app with sign-up by e-mail.");
+    return c6.json(settingsAnswer(methods2));
+  });
+  app.post("/auth/admin/totp/remove", async (c6) => {
+    const caller = await admin(c6);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c6);
+    if (!isValidEmail(data.email)) return invalidEmail(c6);
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c6);
+    const removed = await users.removeTotp(user.id);
+    if (removed) await ctx.emit("totp.disabled", { user: toMadauthUser(user), by: caller.email });
+    return c6.json({ email: user.emailNormalized, userId: user.id, enabled: false });
   });
   return app;
 }