@spfn/auth 0.3.0-beta.4 → 0.3.0-beta.6

package/dist/server.js

@@ -897,8 +897,8 @@ var init_array2 = __esm({
 });
 
 // ../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/argument/argument.mjs
-function Argument(index12) {
-  return CreateType({ [Kind]: "Argument", index: index12 });
+function Argument(index13) {
+  return CreateType({ [Kind]: "Argument", index: index13 });
 }
 var init_argument = __esm({
   "../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/argument/argument.mjs"() {
@@ -1136,28 +1136,28 @@ var init_union2 = __esm({
 function Unescape(pattern) {
   return pattern.replace(/\\\$/g, "$").replace(/\\\*/g, "*").replace(/\\\^/g, "^").replace(/\\\|/g, "|").replace(/\\\(/g, "(").replace(/\\\)/g, ")");
 }
-function IsNonEscaped(pattern, index12, char) {
-  return pattern[index12] === char && pattern.charCodeAt(index12 - 1) !== 92;
+function IsNonEscaped(pattern, index13, char) {
+  return pattern[index13] === char && pattern.charCodeAt(index13 - 1) !== 92;
 }
-function IsOpenParen(pattern, index12) {
-  return IsNonEscaped(pattern, index12, "(");
+function IsOpenParen(pattern, index13) {
+  return IsNonEscaped(pattern, index13, "(");
 }
-function IsCloseParen(pattern, index12) {
-  return IsNonEscaped(pattern, index12, ")");
+function IsCloseParen(pattern, index13) {
+  return IsNonEscaped(pattern, index13, ")");
 }
-function IsSeparator(pattern, index12) {
-  return IsNonEscaped(pattern, index12, "|");
+function IsSeparator(pattern, index13) {
+  return IsNonEscaped(pattern, index13, "|");
 }
 function IsGroup(pattern) {
   if (!(IsOpenParen(pattern, 0) && IsCloseParen(pattern, pattern.length - 1)))
     return false;
   let count = 0;
-  for (let index12 = 0; index12 < pattern.length; index12++) {
-    if (IsOpenParen(pattern, index12))
+  for (let index13 = 0; index13 < pattern.length; index13++) {
+    if (IsOpenParen(pattern, index13))
       count += 1;
-    if (IsCloseParen(pattern, index12))
+    if (IsCloseParen(pattern, index13))
       count -= 1;
-    if (count === 0 && index12 !== pattern.length - 1)
+    if (count === 0 && index13 !== pattern.length - 1)
       return false;
   }
   return true;
@@ -1167,19 +1167,19 @@ function InGroup(pattern) {
 }
 function IsPrecedenceOr(pattern) {
   let count = 0;
-  for (let index12 = 0; index12 < pattern.length; index12++) {
-    if (IsOpenParen(pattern, index12))
+  for (let index13 = 0; index13 < pattern.length; index13++) {
+    if (IsOpenParen(pattern, index13))
       count += 1;
-    if (IsCloseParen(pattern, index12))
+    if (IsCloseParen(pattern, index13))
       count -= 1;
-    if (IsSeparator(pattern, index12) && count === 0)
+    if (IsSeparator(pattern, index13) && count === 0)
       return true;
   }
   return false;
 }
 function IsPrecedenceAnd(pattern) {
-  for (let index12 = 0; index12 < pattern.length; index12++) {
-    if (IsOpenParen(pattern, index12))
+  for (let index13 = 0; index13 < pattern.length; index13++) {
+    if (IsOpenParen(pattern, index13))
       return true;
   }
   return false;
@@ -1187,16 +1187,16 @@ function IsPrecedenceAnd(pattern) {
 function Or(pattern) {
   let [count, start] = [0, 0];
   const expressions = [];
-  for (let index12 = 0; index12 < pattern.length; index12++) {
-    if (IsOpenParen(pattern, index12))
+  for (let index13 = 0; index13 < pattern.length; index13++) {
+    if (IsOpenParen(pattern, index13))
       count += 1;
-    if (IsCloseParen(pattern, index12))
+    if (IsCloseParen(pattern, index13))
       count -= 1;
-    if (IsSeparator(pattern, index12) && count === 0) {
-      const range2 = pattern.slice(start, index12);
+    if (IsSeparator(pattern, index13) && count === 0) {
+      const range2 = pattern.slice(start, index13);
       if (range2.length > 0)
         expressions.push(TemplateLiteralParse(range2));
-      start = index12 + 1;
+      start = index13 + 1;
     }
   }
   const range = pattern.slice(start);
@@ -1209,40 +1209,40 @@ function Or(pattern) {
   return { type: "or", expr: expressions };
 }
 function And(pattern) {
-  function Group(value, index12) {
-    if (!IsOpenParen(value, index12))
+  function Group(value, index13) {
+    if (!IsOpenParen(value, index13))
       throw new TemplateLiteralParserError(`TemplateLiteralParser: Index must point to open parens`);
     let count = 0;
-    for (let scan = index12; scan < value.length; scan++) {
+    for (let scan = index13; scan < value.length; scan++) {
       if (IsOpenParen(value, scan))
         count += 1;
       if (IsCloseParen(value, scan))
         count -= 1;
       if (count === 0)
-        return [index12, scan];
+        return [index13, scan];
     }
     throw new TemplateLiteralParserError(`TemplateLiteralParser: Unclosed group parens in expression`);
   }
-  function Range(pattern2, index12) {
-    for (let scan = index12; scan < pattern2.length; scan++) {
+  function Range(pattern2, index13) {
+    for (let scan = index13; scan < pattern2.length; scan++) {
       if (IsOpenParen(pattern2, scan))
-        return [index12, scan];
+        return [index13, scan];
     }
-    return [index12, pattern2.length];
+    return [index13, pattern2.length];
   }
   const expressions = [];
-  for (let index12 = 0; index12 < pattern.length; index12++) {
-    if (IsOpenParen(pattern, index12)) {
-      const [start, end] = Group(pattern, index12);
+  for (let index13 = 0; index13 < pattern.length; index13++) {
+    if (IsOpenParen(pattern, index13)) {
+      const [start, end] = Group(pattern, index13);
       const range = pattern.slice(start, end + 1);
       expressions.push(TemplateLiteralParse(range));
-      index12 = end;
+      index13 = end;
     } else {
-      const [start, end] = Range(pattern, index12);
+      const [start, end] = Range(pattern, index13);
       const range = pattern.slice(start, end);
       if (range.length > 0)
         expressions.push(TemplateLiteralParse(range));
-      index12 = end - 1;
+      index13 = end - 1;
     }
   }
   return expressions.length === 0 ? { type: "const", const: "" } : expressions.length === 1 ? expressions[0] : { type: "and", expr: expressions };
@@ -2577,13 +2577,13 @@ function FromBoolean(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsBoolean(right) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromConstructor(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsConstructor(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index12) => IntoBooleanResult(Visit3(right.parameters[index12], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsConstructor(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index13) => IntoBooleanResult(Visit3(right.parameters[index13], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
 }
 function FromDate(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsDate(right) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromFunction(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsFunction(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index12) => IntoBooleanResult(Visit3(right.parameters[index12], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : !type_exports.IsFunction(right) ? ExtendsResult.False : left.parameters.length > right.parameters.length ? ExtendsResult.False : !left.parameters.every((schema, index13) => IntoBooleanResult(Visit3(right.parameters[index13], schema)) === ExtendsResult.True) ? ExtendsResult.False : IntoBooleanResult(Visit3(left.returns, right.returns));
 }
 function FromIntegerRight(left, right) {
   return type_exports.IsLiteral(left) && value_exports.IsNumber(left.const) ? ExtendsResult.True : type_exports.IsNumber(left) || type_exports.IsInteger(left) ? ExtendsResult.True : ExtendsResult.False;
@@ -2743,7 +2743,7 @@ function FromTupleRight(left, right) {
   return type_exports.IsNever(left) ? ExtendsResult.True : type_exports.IsUnknown(left) ? ExtendsResult.False : type_exports.IsAny(left) ? ExtendsResult.Union : ExtendsResult.False;
 }
 function FromTuple3(left, right) {
-  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) && IsObjectArrayLike(right) ? ExtendsResult.True : type_exports.IsArray(right) && IsArrayOfTuple(left, right) ? ExtendsResult.True : !type_exports.IsTuple(right) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) || !value_exports.IsUndefined(left.items) && value_exports.IsUndefined(right.items) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) ? ExtendsResult.True : left.items.every((schema, index12) => Visit3(schema, right.items[index12]) === ExtendsResult.True) ? ExtendsResult.True : ExtendsResult.False;
+  return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) && IsObjectArrayLike(right) ? ExtendsResult.True : type_exports.IsArray(right) && IsArrayOfTuple(left, right) ? ExtendsResult.True : !type_exports.IsTuple(right) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) || !value_exports.IsUndefined(left.items) && value_exports.IsUndefined(right.items) ? ExtendsResult.False : value_exports.IsUndefined(left.items) && !value_exports.IsUndefined(right.items) ? ExtendsResult.True : left.items.every((schema, index13) => Visit3(schema, right.items[index13]) === ExtendsResult.True) ? ExtendsResult.True : ExtendsResult.False;
 }
 function FromUint8Array(left, right) {
   return IsStructuralRight(right) ? StructuralRight(left, right) : type_exports.IsObject(right) ? FromObjectRight(left, right) : type_exports.IsRecord(right) ? FromRecordRight(left, right) : type_exports.IsUint8Array(right) ? ExtendsResult.True : ExtendsResult.False;
@@ -4521,6 +4521,19 @@ var init_schema3 = __esm({
   }
 });
 
+// src/server/helpers/email.ts
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+function normalizeOptionalEmail(email) {
+  return typeof email === "string" ? normalizeEmail(email) : email;
+}
+var init_email = __esm({
+  "src/server/helpers/email.ts"() {
+    "use strict";
+  }
+});
+
 // src/server/entities/schema.ts
 import { createSchema } from "@spfn/core/db";
 var authSchema;
@@ -4965,9 +4978,59 @@ var init_verification_codes = __esm({
   }
 });
 
+// src/server/entities/signup-link-tokens.ts
+import { text as text7, index as index7, uniqueIndex as uniqueIndex2 } from "drizzle-orm/pg-core";
+import { id as id7, timestamps as timestamps6, utcTimestamp as utcTimestamp5 } from "@spfn/core/db";
+var signupLinkTokens;
+var init_signup_link_tokens = __esm({
+  "src/server/entities/signup-link-tokens.ts"() {
+    "use strict";
+    init_schema4();
+    signupLinkTokens = authSchema.table(
+      "signup_link_tokens",
+      {
+        id: id7(),
+        // Normalized email address the link was issued for
+        email: text7("email").notNull(),
+        // SHA-256 of the emailed token, base64url
+        // The token itself (32 random bytes) is never stored
+        tokenHash: text7("token_hash").notNull(),
+        // Relative path to return the user to after signup completes
+        // Validated as a relative path on the way in; never an absolute URL
+        returnPath: text7("return_path"),
+        // Link expiry — SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES from creation
+        expiresAt: utcTimestamp5("expires_at").notNull(),
+        // Set when the link is exchanged for a setup session
+        // Non-null means the link is spent; it is one-time regardless of expiry
+        consumedAt: utcTimestamp5("consumed_at"),
+        // Set when a newer link for the same email replaced this one
+        // A superseded row is refused even if it has not expired or been consumed
+        supersededAt: utcTimestamp5("superseded_at"),
+        // SHA-256 of the setup session secret, written at consume time
+        // The secret lives only in the caller's HttpOnly cookie
+        setupSecretHash: text7("setup_secret_hash"),
+        // Setup session expiry — SPFN_AUTH_SIGNUP_SETUP_TTL_MINUTES from consume
+        setupExpiresAt: utcTimestamp5("setup_expires_at"),
+        // Terminal: the password was set and the account created
+        completedAt: utcTimestamp5("completed_at"),
+        ...timestamps6()
+      },
+      (table) => [
+        // Lookup path for confirming a link
+        uniqueIndex2("signup_link_token_hash_idx").on(table.tokenHash),
+        // Lookup path for setting a password
+        // Unique so a setup secret can never address two rows
+        uniqueIndex2("signup_link_setup_secret_hash_idx").on(table.setupSecretHash),
+        // Supersede-on-resend scans the live rows for one address
+        index7("signup_link_email_idx").on(table.email, table.expiresAt)
+      ]
+    );
+  }
+});
+
 // src/server/entities/user-invitations.ts
-import { text as text7, index as index7 } from "drizzle-orm/pg-core";
-import { id as id7, timestamps as timestamps6, enumText as enumText5, utcTimestamp as utcTimestamp5, typedJsonb as typedJsonb2, foreignKey as foreignKey5 } from "@spfn/core/db";
+import { text as text8, index as index8 } from "drizzle-orm/pg-core";
+import { id as id8, timestamps as timestamps7, enumText as enumText5, utcTimestamp as utcTimestamp6, typedJsonb as typedJsonb2, foreignKey as foreignKey5 } from "@spfn/core/db";
 var userInvitations;
 var init_user_invitations = __esm({
   "src/server/entities/user-invitations.ts"() {
@@ -4980,14 +5043,14 @@ var init_user_invitations = __esm({
       "user_invitations",
       {
         // Primary key
-        id: id7(),
+        id: id8(),
         // Target email address for the invitation
         // Will become the user's email upon acceptance
-        email: text7("email").notNull(),
+        email: text8("email").notNull(),
         // Unique invitation token (UUID v4)
         // Used in invitation URL: /auth/invite/{token}
         // Single-use token that expires after acceptance
-        token: text7("token").notNull().unique(),
+        token: text8("token").notNull().unique(),
         // Role to be assigned when invitation is accepted
         // Foreign key to roles table
         roleId: foreignKey5("role", () => roles.id),
@@ -5004,15 +5067,15 @@ var init_user_invitations = __esm({
         // Expiration timestamp (default: 7 days from creation)
         // Invitation cannot be accepted after this time
         // Background job should update status to 'expired'
-        expiresAt: utcTimestamp5("expires_at").notNull(),
+        expiresAt: utcTimestamp6("expires_at").notNull(),
         // Timestamp when invitation was accepted
         // null = not yet accepted
         // Used for: audit trail, analytics
-        acceptedAt: utcTimestamp5("accepted_at"),
+        acceptedAt: utcTimestamp6("accepted_at"),
         // Timestamp when invitation was cancelled
         // null = not cancelled
         // Used for: audit trail
-        cancelledAt: utcTimestamp5("cancelled_at"),
+        cancelledAt: utcTimestamp6("cancelled_at"),
         // Additional metadata (JSONB)
         // Use cases:
         // - Custom welcome message
@@ -5021,26 +5084,26 @@ var init_user_invitations = __esm({
         // - Custom fields for app-specific data
         // Example: { message: "Welcome!", department: "Engineering" }
         metadata: typedJsonb2("metadata"),
-        ...timestamps6()
+        ...timestamps7()
       },
       (table) => [
         // Indexes for query optimization
-        index7("invitations_token_idx").on(table.token),
-        index7("invitations_email_idx").on(table.email),
-        index7("invitations_status_idx").on(table.status),
-        index7("invitations_invited_by_idx").on(table.invitedBy),
-        index7("invitations_expires_at_idx").on(table.expiresAt),
+        index8("invitations_token_idx").on(table.token),
+        index8("invitations_email_idx").on(table.email),
+        index8("invitations_status_idx").on(table.status),
+        index8("invitations_invited_by_idx").on(table.invitedBy),
+        index8("invitations_expires_at_idx").on(table.expiresAt),
         // For cleanup jobs
-        index7("invitations_role_id_idx").on(table.roleId)
+        index8("invitations_role_id_idx").on(table.roleId)
       ]
     );
   }
 });
 
 // src/server/entities/account-deletion-requests.ts
-import { text as text8, index as index8, uniqueIndex as uniqueIndex2 } from "drizzle-orm/pg-core";
+import { text as text9, index as index9, uniqueIndex as uniqueIndex3 } from "drizzle-orm/pg-core";
 import { sql as sql2 } from "drizzle-orm";
-import { id as id8, timestamps as timestamps7, enumText as enumText6, utcTimestamp as utcTimestamp6, optionalForeignKey } from "@spfn/core/db";
+import { id as id9, timestamps as timestamps8, enumText as enumText6, utcTimestamp as utcTimestamp7, optionalForeignKey } from "@spfn/core/db";
 var accountDeletionRequests;
 var init_account_deletion_requests = __esm({
   "src/server/entities/account-deletion-requests.ts"() {
@@ -5051,18 +5114,18 @@ var init_account_deletion_requests = __esm({
     accountDeletionRequests = authSchema.table(
       "account_deletion_requests",
       {
-        id: id8(),
+        id: id9(),
         // Foreign key to users table. `set null` (optionalForeignKey default) so this
         // row survives a hard-delete purge of the user it refers to.
         userId: optionalForeignKey("user", () => users.id),
         // Snapshot of the user's public UUID at request time — stays readable even
         // after userId is nulled out or the account is anonymized.
-        userPublicId: text8("user_public_id").notNull(),
+        userPublicId: text9("user_public_id").notNull(),
         // When the deletion was requested
-        requestedAt: utcTimestamp6("requested_at").notNull().defaultNow(),
+        requestedAt: utcTimestamp7("requested_at").notNull().defaultNow(),
         // When the purge job is allowed to run (requestedAt + grace period; equals
         // requestedAt itself for immediate/zero-grace deletions)
-        purgeScheduledAt: utcTimestamp6("purge_scheduled_at").notNull(),
+        purgeScheduledAt: utcTimestamp7("purge_scheduled_at").notNull(),
         // Request lifecycle status
         // - pending: awaiting purgeScheduledAt (or immediate purge)
         // - cancelled: recovered before purge
@@ -5071,20 +5134,20 @@ var init_account_deletion_requests = __esm({
         // Who initiated the request
         requestedBy: enumText6("requested_by", ACCOUNT_DELETION_REQUESTED_BY).default("self").notNull(),
         // Optional free-text reason (self-service UI, admin note, DSR reference, ...)
-        reason: text8("reason"),
-        cancelledAt: utcTimestamp6("cancelled_at"),
-        completedAt: utcTimestamp6("completed_at"),
+        reason: text9("reason"),
+        cancelledAt: utcTimestamp7("cancelled_at"),
+        completedAt: utcTimestamp7("completed_at"),
         // Purge strategy actually executed (set on completion; null while pending)
         purgeStrategy: enumText6("purge_strategy", PURGE_STRATEGIES),
-        ...timestamps7()
+        ...timestamps8()
       },
       (table) => [
-        index8("account_deletion_requests_user_id_idx").on(table.userId),
-        index8("account_deletion_requests_status_idx").on(table.status),
-        index8("account_deletion_requests_purge_scheduled_at_idx").on(table.purgeScheduledAt),
-        index8("account_deletion_requests_user_public_id_idx").on(table.userPublicId),
+        index9("account_deletion_requests_user_id_idx").on(table.userId),
+        index9("account_deletion_requests_status_idx").on(table.status),
+        index9("account_deletion_requests_purge_scheduled_at_idx").on(table.purgeScheduledAt),
+        index9("account_deletion_requests_user_public_id_idx").on(table.userPublicId),
         // Partial unique index: at most one pending request per user at a time.
-        uniqueIndex2("account_deletion_requests_user_pending_unique_idx").on(table.userId).where(sql2`${table.status} = 'pending'`)
+        uniqueIndex3("account_deletion_requests_user_pending_unique_idx").on(table.userId).where(sql2`${table.status} = 'pending'`)
       ]
     );
   }
@@ -5236,8 +5299,8 @@ var init_rbac = __esm({
 });
 
 // src/server/entities/permissions.ts
-import { text as text9, boolean as boolean4, index as index9 } from "drizzle-orm/pg-core";
-import { id as id9, timestamps as timestamps8, enumText as enumText7, typedJsonb as typedJsonb3 } from "@spfn/core/db";
+import { text as text10, boolean as boolean4, index as index10 } from "drizzle-orm/pg-core";
+import { id as id10, timestamps as timestamps9, enumText as enumText7, typedJsonb as typedJsonb3 } from "@spfn/core/db";
 var permissions;
 var init_permissions = __esm({
   "src/server/entities/permissions.ts"() {
@@ -5248,7 +5311,7 @@ var init_permissions = __esm({
       "permissions",
       {
         // Primary key
-        id: id9(),
+        id: id10(),
         // Permission identifier
         // Format: resource:action or namespace:resource:action
         // Examples:
@@ -5256,15 +5319,15 @@ var init_permissions = __esm({
         // - Namespaced: 'auth:user:delete', 'cms:post:publish'
         // Must be unique across all permissions
         // Used in: permission checks, role assignments, API guards
-        name: text9("name").notNull().unique(),
+        name: text10("name").notNull().unique(),
         // Display name for UI
         // Human-readable name shown in admin panels
         // Example: "Delete Users", "Publish Posts"
-        displayName: text9("display_name").notNull(),
+        displayName: text10("display_name").notNull(),
         // Permission description
         // Detailed explanation of what this permission allows
         // Example: "Allows deletion of user accounts from the system"
-        description: text9("description"),
+        description: text10("description"),
         // Category for grouping
         // Used for: organizing permissions in UI, filtering
         // Built-in categories: auth, user, rbac, system
@@ -5300,22 +5363,22 @@ var init_permissions = __esm({
         // - Audit: { createdBy: 123, source: 'migration', version: '1.0.0' }
         // Example: { icon: 'trash', color: 'red', requiresMfa: true }
         metadata: typedJsonb3("metadata"),
-        ...timestamps8()
+        ...timestamps9()
       },
       (table) => [
-        index9("permissions_name_idx").on(table.name),
-        index9("permissions_category_idx").on(table.category),
-        index9("permissions_is_system_idx").on(table.isSystem),
-        index9("permissions_is_active_idx").on(table.isActive),
-        index9("permissions_is_builtin_idx").on(table.isBuiltin)
+        index10("permissions_name_idx").on(table.name),
+        index10("permissions_category_idx").on(table.category),
+        index10("permissions_is_system_idx").on(table.isSystem),
+        index10("permissions_is_active_idx").on(table.isActive),
+        index10("permissions_is_builtin_idx").on(table.isBuiltin)
       ]
     );
   }
 });
 
 // src/server/entities/role-permissions.ts
-import { index as index10, unique } from "drizzle-orm/pg-core";
-import { id as id10, timestamps as timestamps9, foreignKey as foreignKey6 } from "@spfn/core/db";
+import { index as index11, unique } from "drizzle-orm/pg-core";
+import { id as id11, timestamps as timestamps10, foreignKey as foreignKey6 } from "@spfn/core/db";
 var rolePermissions;
 var init_role_permissions = __esm({
   "src/server/entities/role-permissions.ts"() {
@@ -5327,7 +5390,7 @@ var init_role_permissions = __esm({
       "role_permissions",
       {
         // Primary key
-        id: id10(),
+        id: id11(),
         // Role reference
         // Foreign key to roles table
         // Cascade delete: when role is deleted, all role-permission mappings are removed
@@ -5340,12 +5403,12 @@ var init_role_permissions = __esm({
         // Used for: granting permissions to roles
         // Example: user:delete permission → [Admin, Superadmin]
         permissionId: foreignKey6("permission", () => permissions.id, { onDelete: "cascade" }),
-        ...timestamps9()
+        ...timestamps10()
       },
       (table) => [
         // Indexes for query performance
-        index10("role_permissions_role_id_idx").on(table.roleId),
-        index10("role_permissions_permission_id_idx").on(table.permissionId),
+        index11("role_permissions_role_id_idx").on(table.roleId),
+        index11("role_permissions_permission_id_idx").on(table.permissionId),
         // Unique constraint: one role-permission pair only
         unique("role_permissions_unique").on(table.roleId, table.permissionId)
       ]
@@ -5354,8 +5417,8 @@ var init_role_permissions = __esm({
 });
 
 // src/server/entities/user-permissions.ts
-import { boolean as boolean5, text as text10, index as index11, unique as unique2 } from "drizzle-orm/pg-core";
-import { id as id11, timestamps as timestamps10, utcTimestamp as utcTimestamp7, foreignKey as foreignKey7 } from "@spfn/core/db";
+import { boolean as boolean5, text as text11, index as index12, unique as unique2 } from "drizzle-orm/pg-core";
+import { id as id12, timestamps as timestamps11, utcTimestamp as utcTimestamp8, foreignKey as foreignKey7 } from "@spfn/core/db";
 var userPermissions;
 var init_user_permissions = __esm({
   "src/server/entities/user-permissions.ts"() {
@@ -5367,7 +5430,7 @@ var init_user_permissions = __esm({
       "user_permissions",
       {
         // Primary key
-        id: id11(),
+        id: id12(),
         // User reference
         // Foreign key to users table
         // Cascade delete: when user is deleted, all overrides are removed
@@ -5390,19 +5453,19 @@ var init_user_permissions = __esm({
         // Reason for grant/revocation
         // Used for: audit trail, compliance documentation
         // Example: "Temporary access for project X", "Security incident - restricted"
-        reason: text10("reason"),
+        reason: text11("reason"),
         // Expiration timestamp (optional)
         // null: Permanent override (remains until manually removed)
         // timestamp: Permission expires at this time (auto-revoked by background job)
         // Use case: Time-limited elevated access, temporary restrictions
-        expiresAt: utcTimestamp7("expires_at"),
-        ...timestamps10()
+        expiresAt: utcTimestamp8("expires_at"),
+        ...timestamps11()
       },
       (table) => [
         // Indexes for query performance
-        index11("user_permissions_user_id_idx").on(table.userId),
-        index11("user_permissions_permission_id_idx").on(table.permissionId),
-        index11("user_permissions_expires_at_idx").on(table.expiresAt),
+        index12("user_permissions_user_id_idx").on(table.userId),
+        index12("user_permissions_permission_id_idx").on(table.permissionId),
+        index12("user_permissions_expires_at_idx").on(table.expiresAt),
         // Unique constraint: one user-permission pair only
         unique2("user_permissions_unique").on(table.userId, table.permissionId)
       ]
@@ -5412,7 +5475,7 @@ var init_user_permissions = __esm({
 
 // src/server/entities/auth-metadata.ts
 import { sql as sql3 } from "drizzle-orm";
-import { text as text11, timestamp } from "drizzle-orm/pg-core";
+import { text as text12, timestamp } from "drizzle-orm/pg-core";
 var authMetadata;
 var init_auth_metadata = __esm({
   "src/server/entities/auth-metadata.ts"() {
@@ -5422,9 +5485,9 @@ var init_auth_metadata = __esm({
       "auth_metadata",
       {
         // Metadata key (primary key)
-        key: text11("key").primaryKey(),
+        key: text12("key").primaryKey(),
         // Metadata value
-        value: text11("value").notNull(),
+        value: text12("value").notNull(),
         // Last updated timestamp — stamped by the database on insert and on update
         updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow().$onUpdate(() => sql3`now()`)
       }
@@ -5433,8 +5496,8 @@ var init_auth_metadata = __esm({
 });
 
 // src/server/entities/ops-tokens.ts
-import { text as text12 } from "drizzle-orm/pg-core";
-import { id as id12, timestamps as timestamps11, utcTimestamp as utcTimestamp8 } from "@spfn/core/db";
+import { text as text13 } from "drizzle-orm/pg-core";
+import { id as id13, timestamps as timestamps12, utcTimestamp as utcTimestamp9 } from "@spfn/core/db";
 var opsTokens;
 var init_ops_tokens = __esm({
   "src/server/entities/ops-tokens.ts"() {
@@ -5443,22 +5506,22 @@ var init_ops_tokens = __esm({
     opsTokens = authSchema.table(
       "ops_tokens",
       {
-        id: id12(),
+        id: id13(),
         // Operator-facing label ("ci-deploy", "rayim-laptop")
-        name: text12("name").notNull(),
+        name: text13("name").notNull(),
         // SHA-256 hex of the token secret. Lookup key — the secret never lands
         // here, and the unique constraint doubles as the lookup index.
-        tokenHash: text12("token_hash").notNull().unique(),
+        tokenHash: text13("token_hash").notNull().unique(),
         // Granted scopes as permission strings ('waitlist:read', ...).
         // '*' grants every scope.
-        scopes: text12("scopes").array().notNull(),
+        scopes: text13("scopes").array().notNull(),
         // null = the token does not expire
-        expiresAt: utcTimestamp8("expires_at"),
+        expiresAt: utcTimestamp9("expires_at"),
         // null = active; a timestamp revokes the token permanently
-        revokedAt: utcTimestamp8("revoked_at"),
+        revokedAt: utcTimestamp9("revoked_at"),
         // Last successful verification, updated fire-and-forget
-        lastUsedAt: utcTimestamp8("last_used_at"),
-        ...timestamps11()
+        lastUsedAt: utcTimestamp9("last_used_at"),
+        ...timestamps12()
       }
     );
   }
@@ -5474,6 +5537,7 @@ var init_entities = __esm({
     init_user_public_keys();
     init_user_social_accounts();
     init_verification_codes();
+    init_signup_link_tokens();
     init_user_invitations();
     init_account_deletion_requests();
     init_roles();
@@ -5486,7 +5550,7 @@ var init_entities = __esm({
 });
 
 // src/server/repositories/users.repository.ts
-import { eq, and } from "drizzle-orm";
+import { eq, and, sql as sql4 } from "drizzle-orm";
 import { BaseRepository } from "@spfn/core/db";
 import { EntityNotFoundError, NotFoundError } from "@spfn/core/errors";
 var UsersRepository, usersRepository;
@@ -5494,13 +5558,14 @@ var init_users_repository = __esm({
   "src/server/repositories/users.repository.ts"() {
     "use strict";
     init_entities();
+    init_email();
     UsersRepository = class extends BaseRepository {
       /**
        * ID로 사용자 조회
        * Read replica 사용
        */
-      async findById(id13) {
-        const result = await this.readDb.select().from(users).where(eq(users.id, id13)).limit(1);
+      async findById(id14) {
+        const result = await this.readDb.select().from(users).where(eq(users.id, id14)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5510,8 +5575,8 @@ var init_users_repository = __esm({
        * 안 되는 게이트(OAuth 세션 발급 등)가 사용한다. 일반 조회는 `findById`(replica)를
        * 계속 사용할 것.
        */
-      async findByIdOnPrimary(id13) {
-        const result = await this.db.select().from(users).where(eq(users.id, id13)).limit(1);
+      async findByIdOnPrimary(id14) {
+        const result = await this.db.select().from(users).where(eq(users.id, id14)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5519,7 +5584,25 @@ var init_users_repository = __esm({
        * Read replica 사용
        */
       async findByEmail(email) {
-        const result = await this.readDb.select().from(users).where(eq(users.email, email)).limit(1);
+        const result = await this.readDb.select().from(users).where(eq(users.email, normalizeEmail(email))).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * 이메일로 사용자 조회 — 저장된 형태와 무관하게 찾는다.
+       *
+       * `findByEmail` asks whether a row holds this exact address; this asks
+       * whether any row *is* this address, whatever form it was written in. The
+       * difference matters to a caller that answers "no" by creating an account:
+       * a lookup that misses a row stored in another form would make a second
+       * account for a person who already has one, and the unique constraint
+       * cannot object because the two stored strings differ.
+       *
+       * Folding in the predicate means no index on `email` applies, so this is for
+       * the few addresses a caller decides about — admin seeding — not for a
+       * request path. Write primary: the answer decides whether to insert.
+       */
+      async findByEmailInAnyStoredForm(email) {
+        const result = await this.db.select().from(users).where(sql4`lower(btrim(${users.email})) = ${normalizeEmail(email)}`).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -5564,13 +5647,13 @@ var init_users_repository = __esm({
        *
        * roleId가 null인 유저는 role: null 반환
        */
-      async findByIdWithRole(id13) {
+      async findByIdWithRole(id14) {
         const result = await this.readDb.select({
           user: users,
           roleName: roles.name,
           roleDisplayName: roles.displayName,
           rolePriority: roles.priority
-        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id13)).limit(1);
+        }).from(users).leftJoin(roles, eq(users.roleId, roles.id)).where(eq(users.id, id14)).limit(1);
         const row = result[0];
         if (!row) {
           return null;
@@ -5585,14 +5668,69 @@ var init_users_repository = __esm({
        * Write primary 사용
        */
       async create(data) {
-        return await this._create(users, data);
+        return await this._create(users, { ...data, email: normalizeOptionalEmail(data.email) });
+      }
+      /**
+       * User ids grouped by an address two or more rows share once folded.
+       *
+       * The whole comparison happens in the database and only the colliding groups
+       * come back, so the size of the answer is the size of the problem rather
+       * than the size of the table. `users.email` is unique, so a group of more
+       * than one can only be rows that differ by capitalization or padding —
+       * exactly the ones a rewrite cannot decide between.
+       *
+       * Every member id is returned, including a row already holding the
+       * canonical form, because the operator has to compare the accounts against
+       * each other to settle which is real.
+       *
+       * Write primary: the caller is about to rewrite rows and a replica could
+       * still be showing the pre-fix state.
+       */
+      async findEmailConflictGroups() {
+        const rows = await this.db.select({ ids: sql4`array_agg(${users.id} ORDER BY ${users.id})` }).from(users).where(sql4`${users.email} IS NOT NULL`).groupBy(sql4`lower(btrim(${users.email}))`).having(sql4`count(*) > 1`);
+        return rows.map((row) => row.ids.map(Number));
+      }
+      /**
+       * Fold every stored address to canonical form, leaving the given ids alone.
+       *
+       * One statement rather than a row at a time: the rewrite is the same
+       * expression the detection uses, so the database can do it in place. A
+       * legacy install with a large users table therefore pays one update instead
+       * of a round trip per row on the boot path, and no list of addresses is ever
+       * carried through the application.
+       *
+       * The excluded ids travel as a single array parameter, so the count of
+       * conflicts cannot run into the protocol's limit on bind parameters.
+       *
+       * One statement also means all or nothing. `users.email` is unique, so if an
+       * instance still running the old code registers a canonical address in the
+       * moment between the conflict query and this update, the update aborts and
+       * nothing is folded on this boot. The next boot sees that pair as a conflict
+       * and folds everything else, so the repair is deferred rather than lost.
+       *
+       * `lower(btrim(...))` is the SQL spelling of `normalizeEmail`. The two agree
+       * on every address this package's validation accepts (ASCII, no interior
+       * whitespace); an address outside that set — reachable only by an app
+       * writing to the repository directly — may fold differently in a database
+       * whose collation lower-cases non-ASCII letters.
+       *
+       * @param excludedIds - Rows to leave untouched, normally the conflict groups
+       * @returns How many rows were rewritten
+       */
+      async normalizeEmailsExcept(excludedIds) {
+        const keepConflicts = excludedIds.length > 0 ? sql4` AND NOT (${users.id} = ANY(string_to_array(${excludedIds.join(",")}, ',')::bigint[]))` : sql4``;
+        const pending = sql4`${users.email} IS NOT NULL AND ${users.email} <> lower(btrim(${users.email}))${keepConflicts}`;
+        const [counted] = await this.db.select({ rows: sql4`count(*)` }).from(users).where(pending);
+        await this.db.update(users).set({ email: sql4`lower(btrim(${users.email}))` }).where(pending);
+        return Number(counted?.rows ?? 0);
       }
       /**
        * 사용자 정보 업데이트
        * Write primary 사용
        */
-      async updateById(id13, data) {
-        const result = await this.db.update(users).set(data).where(eq(users.id, id13)).returning();
+      async updateById(id14, data) {
+        const patch = "email" in data ? { ...data, email: normalizeOptionalEmail(data.email) } : data;
+        const result = await this.db.update(users).set(patch).where(eq(users.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
@@ -5604,10 +5742,10 @@ var init_users_repository = __esm({
        * status가 바뀐 상태) 시 null을 반환하며 예외를 던지지 않는다.
        * Write primary 사용
        */
-      async reactivateFromPendingDeletion(id13) {
+      async reactivateFromPendingDeletion(id14) {
         const result = await this.db.update(users).set({ status: "active" }).where(
           and(
-            eq(users.id, id13),
+            eq(users.id, id14),
             eq(users.status, "pending_deletion")
           )
         ).returning();
@@ -5617,32 +5755,32 @@ var init_users_repository = __esm({
        * 비밀번호 업데이트
        * Write primary 사용
        */
-      async updatePassword(id13, passwordHash, clearPasswordChangeRequired = true) {
+      async updatePassword(id14, passwordHash, clearPasswordChangeRequired = true) {
         const updateData = {
           passwordHash
         };
         if (clearPasswordChangeRequired) {
           updateData.passwordChangeRequired = false;
         }
-        const result = await this.db.update(users).set(updateData).where(eq(users.id, id13)).returning();
+        const result = await this.db.update(users).set(updateData).where(eq(users.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
        * 마지막 로그인 시간 업데이트
        * Write primary 사용
        */
-      async updateLastLogin(id13) {
+      async updateLastLogin(id14) {
         const result = await this.db.update(users).set({
           lastLoginAt: /* @__PURE__ */ new Date()
-        }).where(eq(users.id, id13)).returning();
+        }).where(eq(users.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
        * 사용자 삭제
        * Write primary 사용
        */
-      async deleteById(id13) {
-        const result = await this.db.delete(users).where(eq(users.id, id13)).returning();
+      async deleteById(id14) {
+        const result = await this.db.delete(users).where(eq(users.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
@@ -5759,7 +5897,7 @@ var init_users_repository = __esm({
 
 // src/server/repositories/keys.repository.ts
 import { BaseRepository as BaseRepository2 } from "@spfn/core/db";
-import { eq as eq2, and as and2, or, isNull, lt, ne, desc, sql as sql4 } from "drizzle-orm";
+import { eq as eq2, and as and2, or, isNull, lt, ne, desc, sql as sql5 } from "drizzle-orm";
 var LAST_USED_THROTTLE_MS, KeysRepository, keysRepository;
 var init_keys_repository = __esm({
   "src/server/repositories/keys.repository.ts"() {
@@ -5990,31 +6128,31 @@ var init_keys_repository = __esm({
        * stored, so it answers "since when has this device been on this release"
        * rather than "when was it last seen", which lastUsedAt already answers.
        */
-      async updateLastUsedById(id13, identity) {
+      async updateLastUsedById(id14, identity) {
         const staleBefore = new Date(Date.now() - LAST_USED_THROTTLE_MS);
         const lastUsedIsStale = or(
           isNull(userPublicKeys.lastUsedAt),
           lt(userPublicKeys.lastUsedAt, staleBefore)
         );
         if (!identity) {
-          await this.db.update(userPublicKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(and2(eq2(userPublicKeys.id, id13), lastUsedIsStale));
+          await this.db.update(userPublicKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(and2(eq2(userPublicKeys.id, id14), lastUsedIsStale));
           return;
         }
-        const identityChanged = sql4`(
+        const identityChanged = sql5`(
             ${userPublicKeys.clientKind} IS DISTINCT FROM ${identity.kind}
             OR ${userPublicKeys.clientVersion} IS DISTINCT FROM ${identity.version}
             OR ${userPublicKeys.clientContractVersion} IS DISTINCT FROM ${identity.contractVersion}
         )`;
         const now = /* @__PURE__ */ new Date();
-        const nowParam = sql4`${now.toISOString()}::timestamptz`;
+        const nowParam = sql5`${now.toISOString()}::timestamptz`;
         await this.db.update(userPublicKeys).set({
           lastUsedAt: now,
           clientKind: identity.kind,
           clientVersion: identity.version,
           clientContractVersion: identity.contractVersion,
-          clientSeenAt: sql4`CASE WHEN ${identityChanged} THEN ${nowParam} ELSE ${userPublicKeys.clientSeenAt} END`
+          clientSeenAt: sql5`CASE WHEN ${identityChanged} THEN ${nowParam} ELSE ${userPublicKeys.clientSeenAt} END`
         }).where(and2(
-          eq2(userPublicKeys.id, id13),
+          eq2(userPublicKeys.id, id14),
           or(lastUsedIsStale, identityChanged)
         ));
       }
@@ -6053,8 +6191,8 @@ var init_verification_codes_repository = __esm({
        * ID로 인증 코드 조회
        * Read replica 사용
        */
-      async findById(id13) {
-        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id13)).limit(1);
+      async findById(id14) {
+        const result = await this.readDb.select().from(verificationCodes).where(eq3(verificationCodes.id, id14)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6068,22 +6206,22 @@ var init_verification_codes_repository = __esm({
        * 인증 코드 사용 처리
        * Write primary 사용
        */
-      async markAsUsed(id13) {
+      async markAsUsed(id14) {
         const result = await this.db.update(verificationCodes).set({
           usedAt: /* @__PURE__ */ new Date()
-        }).where(eq3(verificationCodes.id, id13)).returning();
+        }).where(eq3(verificationCodes.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
        * 시도 횟수 증가
        * Write primary 사용
        */
-      async incrementAttempts(id13) {
-        const code = await this.findById(id13);
+      async incrementAttempts(id14) {
+        const code = await this.findById(id14);
         if (!code) return null;
         const result = await this.db.update(verificationCodes).set({
           attempts: code.attempts + 1
-        }).where(eq3(verificationCodes.id, id13)).returning();
+        }).where(eq3(verificationCodes.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6127,27 +6265,136 @@ var init_verification_codes_repository = __esm({
   }
 });
 
-// src/server/repositories/roles.repository.ts
+// src/server/repositories/signup-link-tokens.repository.ts
 import { BaseRepository as BaseRepository4 } from "@spfn/core/db";
-import { eq as eq4, asc } from "drizzle-orm";
+import { eq as eq4, and as and4, isNull as isNull3 } from "drizzle-orm";
+var SignupLinkTokensRepository, signupLinkTokensRepository;
+var init_signup_link_tokens_repository = __esm({
+  "src/server/repositories/signup-link-tokens.repository.ts"() {
+    "use strict";
+    init_signup_link_tokens();
+    SignupLinkTokensRepository = class extends BaseRepository4 {
+      /**
+       * Create a signup link row.
+       * Write primary.
+       */
+      async create(data) {
+        const result = await this.db.insert(signupLinkTokens).values(data).returning();
+        return result[0];
+      }
+      /**
+       * Find a row by the hash of an emailed token, in any state.
+       *
+       * Deliberately unfiltered: the caller decides why a link is refused, and a
+       * row filtered out here would be indistinguishable from an unknown token in
+       * the logs.
+       *
+       * Read replica.
+       */
+      async findByTokenHash(tokenHash) {
+        const result = await this.readDb.select().from(signupLinkTokens).where(eq4(signupLinkTokens.tokenHash, tokenHash)).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * Find a row by the hash of a setup session secret, in any state.
+       * Read replica.
+       */
+      async findBySetupSecretHash(setupSecretHash) {
+        const result = await this.readDb.select().from(signupLinkTokens).where(eq4(signupLinkTokens.setupSecretHash, setupSecretHash)).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * Consume a link and open a setup session on it, but only if it is still
+       * unconsumed and not superseded.
+       *
+       * @returns the updated row, or null if another request claimed it first
+       */
+      async claimLink(id14, setupSecretHash, setupExpiresAt) {
+        const result = await this.db.update(signupLinkTokens).set({
+          consumedAt: /* @__PURE__ */ new Date(),
+          setupSecretHash,
+          setupExpiresAt
+        }).where(
+          and4(
+            eq4(signupLinkTokens.id, id14),
+            isNull3(signupLinkTokens.consumedAt),
+            isNull3(signupLinkTokens.supersededAt)
+          )
+        ).returning();
+        return result[0] ?? null;
+      }
+      /**
+       * Mark a setup session as completed, but only if it has not completed
+       * already.
+       *
+       * @returns the updated row, or null if another request completed it first
+       */
+      async claimSetupSession(id14) {
+        const result = await this.db.update(signupLinkTokens).set({ completedAt: /* @__PURE__ */ new Date() }).where(
+          and4(
+            eq4(signupLinkTokens.id, id14),
+            isNull3(signupLinkTokens.completedAt),
+            isNull3(signupLinkTokens.supersededAt)
+          )
+        ).returning();
+        return result[0] ?? null;
+      }
+      /**
+       * Supersede every live link for an address, so requesting a new one
+       * invalidates the previous one and any setup session opened from it.
+       *
+       * Write primary.
+       *
+       * @returns number of rows superseded
+       */
+      async supersedeLiveForEmail(email) {
+        const result = await this.db.update(signupLinkTokens).set({ supersededAt: /* @__PURE__ */ new Date() }).where(
+          and4(
+            eq4(signupLinkTokens.email, email),
+            isNull3(signupLinkTokens.supersededAt),
+            isNull3(signupLinkTokens.completedAt)
+          )
+        ).returning();
+        return result.length;
+      }
+      /**
+       * Delete every signup link row for an address (account destruction).
+       *
+       * Rows key on the email text and carry no user FK, so destruction has to
+       * clean them up by address the way verification codes are cleaned up.
+       *
+       * Write primary.
+       */
+      async deleteByEmail(email) {
+        const result = await this.db.delete(signupLinkTokens).where(eq4(signupLinkTokens.email, email)).returning();
+        return result.length;
+      }
+    };
+    signupLinkTokensRepository = new SignupLinkTokensRepository();
+  }
+});
+
+// src/server/repositories/roles.repository.ts
+import { BaseRepository as BaseRepository5 } from "@spfn/core/db";
+import { eq as eq5, asc } from "drizzle-orm";
 var RolesRepository, rolesRepository;
 var init_roles_repository = __esm({
   "src/server/repositories/roles.repository.ts"() {
     "use strict";
     init_roles();
-    RolesRepository = class extends BaseRepository4 {
+    RolesRepository = class extends BaseRepository5 {
       /**
        * ID로 역할 조회
        */
-      async findById(id13) {
-        const result = await this.readDb.select().from(roles).where(eq4(roles.id, id13)).limit(1);
+      async findById(id14) {
+        const result = await this.readDb.select().from(roles).where(eq5(roles.id, id14)).limit(1);
         return result[0] ?? null;
       }
       /**
        * Name으로 역할 조회
        */
       async findByName(name) {
-        const result = await this.readDb.select().from(roles).where(eq4(roles.name, name)).limit(1);
+        const result = await this.readDb.select().from(roles).where(eq5(roles.name, name)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6160,7 +6407,7 @@ var init_roles_repository = __esm({
        * 활성 역할만 조회
        */
       async findActive() {
-        return this.readDb.select().from(roles).where(eq4(roles.isActive, true)).orderBy(asc(roles.priority));
+        return this.readDb.select().from(roles).where(eq5(roles.isActive, true)).orderBy(asc(roles.priority));
       }
       /**
        * 역할 생성
@@ -6171,15 +6418,15 @@ var init_roles_repository = __esm({
       /**
        * 역할 업데이트
        */
-      async updateById(id13, data) {
-        const result = await this.db.update(roles).set(data).where(eq4(roles.id, id13)).returning();
+      async updateById(id14, data) {
+        const result = await this.db.update(roles).set(data).where(eq5(roles.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
        * 역할 삭제
        */
-      async deleteById(id13) {
-        const result = await this.db.delete(roles).where(eq4(roles.id, id13)).returning();
+      async deleteById(id14) {
+        const result = await this.db.delete(roles).where(eq5(roles.id, id14)).returning();
         return result[0] ?? null;
       }
     };
@@ -6188,26 +6435,26 @@ var init_roles_repository = __esm({
 });
 
 // src/server/repositories/permissions.repository.ts
-import { BaseRepository as BaseRepository5 } from "@spfn/core/db";
-import { asc as asc2, eq as eq5, inArray } from "drizzle-orm";
+import { BaseRepository as BaseRepository6 } from "@spfn/core/db";
+import { asc as asc2, eq as eq6, inArray } from "drizzle-orm";
 var PermissionsRepository, permissionsRepository;
 var init_permissions_repository = __esm({
   "src/server/repositories/permissions.repository.ts"() {
     "use strict";
     init_permissions();
-    PermissionsRepository = class extends BaseRepository5 {
+    PermissionsRepository = class extends BaseRepository6 {
       /**
        * ID로 권한 조회
        */
-      async findById(id13) {
-        const result = await this.readDb.select().from(permissions).where(eq5(permissions.id, id13)).limit(1);
+      async findById(id14) {
+        const result = await this.readDb.select().from(permissions).where(eq6(permissions.id, id14)).limit(1);
         return result[0] ?? null;
       }
       /**
        * Name으로 권한 조회
        */
       async findByName(name) {
-        const result = await this.readDb.select().from(permissions).where(eq5(permissions.name, name)).limit(1);
+        const result = await this.readDb.select().from(permissions).where(eq6(permissions.name, name)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6227,13 +6474,13 @@ var init_permissions_repository = __esm({
        * 활성 권한만 조회
        */
       async findActive() {
-        return this.readDb.select().from(permissions).where(eq5(permissions.isActive, true)).orderBy(asc2(permissions.name));
+        return this.readDb.select().from(permissions).where(eq6(permissions.isActive, true)).orderBy(asc2(permissions.name));
       }
       /**
        * 카테고리별 권한 조회
        */
       async findByCategory(category) {
-        return this.readDb.select().from(permissions).where(eq5(permissions.category, category)).orderBy(asc2(permissions.name));
+        return this.readDb.select().from(permissions).where(eq6(permissions.category, category)).orderBy(asc2(permissions.name));
       }
       /**
        * 권한 생성
@@ -6251,15 +6498,15 @@ var init_permissions_repository = __esm({
       /**
        * 권한 업데이트
        */
-      async updateById(id13, data) {
-        const result = await this.db.update(permissions).set(data).where(eq5(permissions.id, id13)).returning();
+      async updateById(id14, data) {
+        const result = await this.db.update(permissions).set(data).where(eq6(permissions.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
        * 권한 삭제
        */
-      async deleteById(id13) {
-        const result = await this.db.delete(permissions).where(eq5(permissions.id, id13)).returning();
+      async deleteById(id14) {
+        const result = await this.db.delete(permissions).where(eq6(permissions.id, id14)).returning();
         return result[0] ?? null;
       }
     };
@@ -6268,25 +6515,25 @@ var init_permissions_repository = __esm({
 });
 
 // src/server/repositories/role-permissions.repository.ts
-import { BaseRepository as BaseRepository6 } from "@spfn/core/db";
-import { and as and4, eq as eq6 } from "drizzle-orm";
+import { BaseRepository as BaseRepository7 } from "@spfn/core/db";
+import { and as and5, eq as eq7 } from "drizzle-orm";
 var RolePermissionsRepository, rolePermissionsRepository;
 var init_role_permissions_repository = __esm({
   "src/server/repositories/role-permissions.repository.ts"() {
     "use strict";
     init_role_permissions();
-    RolePermissionsRepository = class extends BaseRepository6 {
+    RolePermissionsRepository = class extends BaseRepository7 {
       /**
        * 역할 ID로 모든 권한 조회
        */
       async findByRoleId(roleId) {
-        return this.readDb.select().from(rolePermissions).where(eq6(rolePermissions.roleId, roleId));
+        return this.readDb.select().from(rolePermissions).where(eq7(rolePermissions.roleId, roleId));
       }
       /**
        * 권한 ID로 모든 역할 조회
        */
       async findByPermissionId(permissionId) {
-        return this.readDb.select().from(rolePermissions).where(eq6(rolePermissions.permissionId, permissionId));
+        return this.readDb.select().from(rolePermissions).where(eq7(rolePermissions.permissionId, permissionId));
       }
       /**
        * 역할-권한 매핑 생성
@@ -6306,9 +6553,9 @@ var init_role_permissions_repository = __esm({
        */
       async deleteByRoleIdAndPermissionId(roleId, permissionId) {
         const result = await this.db.delete(rolePermissions).where(
-          and4(
-            eq6(rolePermissions.roleId, roleId),
-            eq6(rolePermissions.permissionId, permissionId)
+          and5(
+            eq7(rolePermissions.roleId, roleId),
+            eq7(rolePermissions.permissionId, permissionId)
           )
         ).returning();
         return result[0] ?? null;
@@ -6317,7 +6564,7 @@ var init_role_permissions_repository = __esm({
        * 역할의 모든 권한 매핑 삭제
        */
       async deleteByRoleId(roleId) {
-        const result = await this.db.delete(rolePermissions).where(eq6(rolePermissions.roleId, roleId)).returning();
+        const result = await this.db.delete(rolePermissions).where(eq7(rolePermissions.roleId, roleId)).returning();
         return result.length;
       }
       /**
@@ -6338,19 +6585,19 @@ var init_role_permissions_repository = __esm({
 });
 
 // src/server/repositories/user-permissions.repository.ts
-import { BaseRepository as BaseRepository7 } from "@spfn/core/db";
-import { eq as eq7, and as and5, or as or2, isNull as isNull3, isNotNull, lt as lt3, gt as gt2 } from "drizzle-orm";
+import { BaseRepository as BaseRepository8 } from "@spfn/core/db";
+import { eq as eq8, and as and6, or as or2, isNull as isNull4, isNotNull, lt as lt3, gt as gt2 } from "drizzle-orm";
 var UserPermissionsRepository, userPermissionsRepository;
 var init_user_permissions_repository = __esm({
   "src/server/repositories/user-permissions.repository.ts"() {
     "use strict";
     init_user_permissions();
-    UserPermissionsRepository = class extends BaseRepository7 {
+    UserPermissionsRepository = class extends BaseRepository8 {
       /**
        * 사용자 ID로 모든 권한 오버라이드 조회
        */
       async findByUserId(userId) {
-        return this.readDb.select().from(userPermissions).where(eq7(userPermissions.userId, userId));
+        return this.readDb.select().from(userPermissions).where(eq8(userPermissions.userId, userId));
       }
       /**
        * 사용자 ID로 유효한 권한 오버라이드만 조회
@@ -6359,10 +6606,10 @@ var init_user_permissions_repository = __esm({
       async findValidByUserId(userId) {
         const now = /* @__PURE__ */ new Date();
         return this.readDb.select().from(userPermissions).where(
-          and5(
-            eq7(userPermissions.userId, userId),
+          and6(
+            eq8(userPermissions.userId, userId),
             or2(
-              isNull3(userPermissions.expiresAt),
+              isNull4(userPermissions.expiresAt),
               gt2(userPermissions.expiresAt, now)
             )
           )
@@ -6373,9 +6620,9 @@ var init_user_permissions_repository = __esm({
        */
       async findByUserIdAndPermissionId(userId, permissionId) {
         const result = await this.readDb.select().from(userPermissions).where(
-          and5(
-            eq7(userPermissions.userId, userId),
-            eq7(userPermissions.permissionId, permissionId)
+          and6(
+            eq8(userPermissions.userId, userId),
+            eq8(userPermissions.permissionId, permissionId)
           )
         ).limit(1);
         return result[0] ?? null;
@@ -6389,8 +6636,8 @@ var init_user_permissions_repository = __esm({
       /**
        * 사용자 권한 오버라이드 업데이트
        */
-      async updateById(id13, data) {
-        const result = await this.db.update(userPermissions).set(data).where(eq7(userPermissions.id, id13)).returning();
+      async updateById(id14, data) {
+        const result = await this.db.update(userPermissions).set(data).where(eq8(userPermissions.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6398,9 +6645,9 @@ var init_user_permissions_repository = __esm({
        */
       async deleteByUserIdAndPermissionId(userId, permissionId) {
         const result = await this.db.delete(userPermissions).where(
-          and5(
-            eq7(userPermissions.userId, userId),
-            eq7(userPermissions.permissionId, permissionId)
+          and6(
+            eq8(userPermissions.userId, userId),
+            eq8(userPermissions.permissionId, permissionId)
           )
         ).returning();
         return result[0] ?? null;
@@ -6409,7 +6656,7 @@ var init_user_permissions_repository = __esm({
        * 사용자의 모든 권한 오버라이드 삭제
        */
       async deleteByUserId(userId) {
-        const result = await this.db.delete(userPermissions).where(eq7(userPermissions.userId, userId)).returning();
+        const result = await this.db.delete(userPermissions).where(eq8(userPermissions.userId, userId)).returning();
         return result.length;
       }
       /**
@@ -6418,7 +6665,7 @@ var init_user_permissions_repository = __esm({
       async deleteExpired() {
         const now = /* @__PURE__ */ new Date();
         const result = await this.db.delete(userPermissions).where(
-          and5(
+          and6(
             isNotNull(userPermissions.expiresAt),
             lt3(userPermissions.expiresAt, now)
           )
@@ -6431,33 +6678,33 @@ var init_user_permissions_repository = __esm({
 });
 
 // src/server/repositories/user-profiles.repository.ts
-import { BaseRepository as BaseRepository8 } from "@spfn/core/db";
-import { eq as eq8 } from "drizzle-orm";
+import { BaseRepository as BaseRepository9 } from "@spfn/core/db";
+import { eq as eq9 } from "drizzle-orm";
 var UserProfilesRepository, userProfilesRepository;
 var init_user_profiles_repository = __esm({
   "src/server/repositories/user-profiles.repository.ts"() {
     "use strict";
     init_user_profiles();
-    UserProfilesRepository = class extends BaseRepository8 {
+    UserProfilesRepository = class extends BaseRepository9 {
       /**
        * ID로 프로필 조회
        */
-      async findById(id13) {
-        const result = await this.readDb.select().from(userProfiles).where(eq8(userProfiles.id, id13)).limit(1);
+      async findById(id14) {
+        const result = await this.readDb.select().from(userProfiles).where(eq9(userProfiles.id, id14)).limit(1);
         return result[0] ?? null;
       }
       /**
        * User ID로 locale만 조회 (경량)
        */
       async findLocaleByUserId(userId) {
-        const result = await this.readDb.select({ locale: userProfiles.locale }).from(userProfiles).where(eq8(userProfiles.userId, userId)).limit(1);
+        const result = await this.readDb.select({ locale: userProfiles.locale }).from(userProfiles).where(eq9(userProfiles.userId, userId)).limit(1);
         return result[0]?.locale || "en";
       }
       /**
        * User ID로 프로필 조회
        */
       async findByUserId(userId) {
-        const result = await this.readDb.select().from(userProfiles).where(eq8(userProfiles.userId, userId)).limit(1);
+        const result = await this.readDb.select().from(userProfiles).where(eq9(userProfiles.userId, userId)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6469,29 +6716,29 @@ var init_user_profiles_repository = __esm({
       /**
        * 프로필 업데이트 (by ID)
        */
-      async updateById(id13, data) {
-        const result = await this.db.update(userProfiles).set(data).where(eq8(userProfiles.id, id13)).returning();
+      async updateById(id14, data) {
+        const result = await this.db.update(userProfiles).set(data).where(eq9(userProfiles.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
        * 프로필 업데이트 (by User ID)
        */
       async updateByUserId(userId, data) {
-        const result = await this.db.update(userProfiles).set(data).where(eq8(userProfiles.userId, userId)).returning();
+        const result = await this.db.update(userProfiles).set(data).where(eq9(userProfiles.userId, userId)).returning();
         return result[0] ?? null;
       }
       /**
        * 프로필 삭제 (by ID)
        */
-      async deleteById(id13) {
-        const result = await this.db.delete(userProfiles).where(eq8(userProfiles.id, id13)).returning();
+      async deleteById(id14) {
+        const result = await this.db.delete(userProfiles).where(eq9(userProfiles.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
        * 프로필 삭제 (by User ID)
        */
       async deleteByUserId(userId) {
-        const result = await this.db.delete(userProfiles).where(eq8(userProfiles.userId, userId)).returning();
+        const result = await this.db.delete(userProfiles).where(eq9(userProfiles.userId, userId)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6533,7 +6780,7 @@ var init_user_profiles_repository = __esm({
           metadata: userProfiles.metadata,
           createdAt: userProfiles.createdAt,
           updatedAt: userProfiles.updatedAt
-        }).from(userProfiles).where(eq8(userProfiles.userId, userId)).limit(1).then((rows) => rows[0] ?? null);
+        }).from(userProfiles).where(eq9(userProfiles.userId, userId)).limit(1).then((rows) => rows[0] ?? null);
         if (!profile) {
           return null;
         }
@@ -6561,8 +6808,8 @@ var init_user_profiles_repository = __esm({
 });
 
 // src/server/repositories/invitations.repository.ts
-import { eq as eq9, and as and6, lt as lt4, desc as desc2, sql as sql5 } from "drizzle-orm";
-import { BaseRepository as BaseRepository9 } from "@spfn/core/db";
+import { eq as eq10, and as and7, lt as lt4, desc as desc2, sql as sql6 } from "drizzle-orm";
+import { BaseRepository as BaseRepository10 } from "@spfn/core/db";
 var InvitationsRepository, invitationsRepository;
 var init_invitations_repository = __esm({
   "src/server/repositories/invitations.repository.ts"() {
@@ -6570,19 +6817,20 @@ var init_invitations_repository = __esm({
     init_users();
     init_roles();
     init_user_invitations();
-    InvitationsRepository = class extends BaseRepository9 {
+    init_email();
+    InvitationsRepository = class extends BaseRepository10 {
       /**
        * ID로 초대 조회
        */
-      async findById(id13) {
-        const result = await this.readDb.select().from(userInvitations).where(eq9(userInvitations.id, id13)).limit(1);
+      async findById(id14) {
+        const result = await this.readDb.select().from(userInvitations).where(eq10(userInvitations.id, id14)).limit(1);
         return result[0] ?? null;
       }
       /**
        * Token으로 초대 조회
        */
       async findByToken(token) {
-        const result = await this.readDb.select().from(userInvitations).where(eq9(userInvitations.token, token)).limit(1);
+        const result = await this.readDb.select().from(userInvitations).where(eq10(userInvitations.token, token)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6590,9 +6838,9 @@ var init_invitations_repository = __esm({
        */
       async findPendingByEmail(email) {
         const result = await this.readDb.select().from(userInvitations).where(
-          and6(
-            eq9(userInvitations.email, email),
-            eq9(userInvitations.status, "pending")
+          and7(
+            eq10(userInvitations.email, normalizeEmail(email)),
+            eq10(userInvitations.status, "pending")
           )
         ).limit(1);
         return result[0] ?? null;
@@ -6601,24 +6849,24 @@ var init_invitations_repository = __esm({
        * 초대자 ID로 모든 초대 조회
        */
       async findByInvitedBy(invitedBy) {
-        return this.readDb.select().from(userInvitations).where(eq9(userInvitations.invitedBy, invitedBy));
+        return this.readDb.select().from(userInvitations).where(eq10(userInvitations.invitedBy, invitedBy));
       }
       /**
        * 상태별 초대 조회
        */
       async findByStatus(status) {
-        return this.readDb.select().from(userInvitations).where(eq9(userInvitations.status, status));
+        return this.readDb.select().from(userInvitations).where(eq10(userInvitations.status, status));
       }
       /**
        * 초대 생성
        */
       async create(data) {
-        return await this._create(userInvitations, data);
+        return await this._create(userInvitations, { ...data, email: normalizeEmail(data.email) });
       }
       /**
        * 초대 상태 업데이트
        */
-      async updateStatus(id13, status, timestamp2) {
+      async updateStatus(id14, status, timestamp2) {
         const updates = {
           status
         };
@@ -6629,14 +6877,14 @@ var init_invitations_repository = __esm({
             updates.cancelledAt = timestamp2;
           }
         }
-        const result = await this.db.update(userInvitations).set(updates).where(eq9(userInvitations.id, id13)).returning();
+        const result = await this.db.update(userInvitations).set(updates).where(eq10(userInvitations.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 삭제
        */
-      async deleteById(id13) {
-        const result = await this.db.delete(userInvitations).where(eq9(userInvitations.id, id13)).returning();
+      async deleteById(id14) {
+        const result = await this.db.delete(userInvitations).where(eq10(userInvitations.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
@@ -6645,8 +6893,8 @@ var init_invitations_repository = __esm({
       async updateExpiredInvitations() {
         const now = /* @__PURE__ */ new Date();
         const result = await this.db.update(userInvitations).set({ status: "expired" }).where(
-          and6(
-            eq9(userInvitations.status, "pending"),
+          and7(
+            eq10(userInvitations.status, "pending"),
             lt4(userInvitations.expiresAt, now)
           )
         ).returning();
@@ -6678,7 +6926,7 @@ var init_invitations_repository = __esm({
             id: users.id,
             email: users.email
           }
-        }).from(userInvitations).innerJoin(roles, eq9(userInvitations.roleId, roles.id)).innerJoin(users, eq9(userInvitations.invitedBy, users.id)).where(eq9(userInvitations.token, token)).limit(1);
+        }).from(userInvitations).innerJoin(roles, eq10(userInvitations.roleId, roles.id)).innerJoin(users, eq10(userInvitations.invitedBy, users.id)).where(eq10(userInvitations.token, token)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -6689,13 +6937,13 @@ var init_invitations_repository = __esm({
         const offset = (page - 1) * limit;
         const conditions = [];
         if (status) {
-          conditions.push(eq9(userInvitations.status, status));
+          conditions.push(eq10(userInvitations.status, status));
         }
         if (invitedBy) {
-          conditions.push(eq9(userInvitations.invitedBy, invitedBy));
+          conditions.push(eq10(userInvitations.invitedBy, invitedBy));
         }
-        const whereClause = conditions.length > 0 ? and6(...conditions) : void 0;
-        const countResult = await this.readDb.select({ count: sql5`count(*)` }).from(userInvitations).where(whereClause);
+        const whereClause = conditions.length > 0 ? and7(...conditions) : void 0;
+        const countResult = await this.readDb.select({ count: sql6`count(*)` }).from(userInvitations).where(whereClause);
         const total = Number(countResult[0]?.count || 0);
         const results = await this.readDb.select({
           id: userInvitations.id,
@@ -6719,7 +6967,7 @@ var init_invitations_repository = __esm({
             id: users.id,
             email: users.email
           }
-        }).from(userInvitations).innerJoin(roles, eq9(userInvitations.roleId, roles.id)).innerJoin(users, eq9(userInvitations.invitedBy, users.id)).where(whereClause).orderBy(desc2(userInvitations.createdAt)).limit(limit).offset(offset);
+        }).from(userInvitations).innerJoin(roles, eq10(userInvitations.roleId, roles.id)).innerJoin(users, eq10(userInvitations.invitedBy, users.id)).where(whereClause).orderBy(desc2(userInvitations.createdAt)).limit(limit).offset(offset);
         return {
           invitations: results,
           total,
@@ -6731,30 +6979,31 @@ var init_invitations_repository = __esm({
       /**
        * 초대 업데이트 (일반 업데이트 - 모든 필드 가능)
        */
-      async updateById(id13, data) {
-        const result = await this.db.update(userInvitations).set(data).where(eq9(userInvitations.id, id13)).returning();
+      async updateById(id14, data) {
+        const patch = "email" in data && typeof data.email === "string" ? { ...data, email: normalizeEmail(data.email) } : data;
+        const result = await this.db.update(userInvitations).set(patch).where(eq10(userInvitations.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 재전송 (status와 expiresAt 동시 업데이트)
        */
-      async resend(id13, newExpiresAt) {
+      async resend(id14, newExpiresAt) {
         const result = await this.db.update(userInvitations).set({
           status: "pending",
           expiresAt: newExpiresAt
-        }).where(eq9(userInvitations.id, id13)).returning();
+        }).where(eq10(userInvitations.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
        * 초대 취소 (status, metadata 동시 업데이트)
        */
-      async cancel(id13, cancelledBy, reason, currentMetadata) {
+      async cancel(id14, cancelledBy, reason, currentMetadata) {
         const newMetadata = currentMetadata ? { ...currentMetadata, cancelReason: reason, cancelledBy } : { cancelReason: reason, cancelledBy };
         const result = await this.db.update(userInvitations).set({
           status: "cancelled",
           cancelledAt: /* @__PURE__ */ new Date(),
           metadata: newMetadata
-        }).where(eq9(userInvitations.id, id13)).returning();
+        }).where(eq10(userInvitations.id, id14)).returning();
         return result[0] ?? null;
       }
     };
@@ -6966,6 +7215,33 @@ var init_schema5 = __esm({
         })
       },
       // ============================================================================
+      // Verified-email signup
+      // ============================================================================
+      SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES: {
+        ...envNumber({
+          description: "How long an emailed signup confirmation link stays valid. Long enough to survive a mail delay, short enough that a link left in an inbox stops working.",
+          default: 30,
+          required: false,
+          examples: [15, 30, 60]
+        })
+      },
+      SPFN_AUTH_SIGNUP_SETUP_TTL_MINUTES: {
+        ...envNumber({
+          description: "How long the password-setup session opened by a confirmation link stays valid. Covers one sitting at the password form, not an abandoned tab.",
+          default: 15,
+          required: false,
+          examples: [10, 15, 30]
+        })
+      },
+      SPFN_AUTH_SIGNUP_CONFIRM_PATH: {
+        ...envString({
+          description: "App page the emailed confirmation link opens, as a path on {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}. The page reads the token from the query string and posts it to /_auth/signup/email/confirm; it is a page in your app, not an API route.",
+          default: "/signup/confirm",
+          required: false,
+          examples: ["/signup/confirm", "/auth/confirm", "/join/verify"]
+        })
+      },
+      // ============================================================================
       // API Configuration
       // ============================================================================
       SPFN_API_URL: {
@@ -7374,15 +7650,15 @@ var init_token_cipher = __esm({
 });
 
 // src/server/repositories/social-accounts.repository.ts
-import { eq as eq10, and as and7 } from "drizzle-orm";
-import { BaseRepository as BaseRepository10 } from "@spfn/core/db";
+import { eq as eq11, and as and8 } from "drizzle-orm";
+import { BaseRepository as BaseRepository11 } from "@spfn/core/db";
 var SocialAccountsRepository, socialAccountsRepository;
 var init_social_accounts_repository = __esm({
   "src/server/repositories/social-accounts.repository.ts"() {
     "use strict";
     init_entities();
     init_token_cipher();
-    SocialAccountsRepository = class extends BaseRepository10 {
+    SocialAccountsRepository = class extends BaseRepository11 {
       /**
        * 저장 row 의 토큰을 평문으로 복호화해 반환한다.
        *
@@ -7410,10 +7686,10 @@ var init_social_accounts_repository = __esm({
             if (refresh?.needsRotation) {
               heal.refreshToken = await encryptToken(refresh.value, context("refresh"));
             }
-            await this.db.update(userSocialAccounts).set(heal).where(and7(
-              eq10(userSocialAccounts.id, account.id),
-              access?.needsRotation && account.accessToken !== null ? eq10(userSocialAccounts.accessToken, account.accessToken) : void 0,
-              refresh?.needsRotation && account.refreshToken !== null ? eq10(userSocialAccounts.refreshToken, account.refreshToken) : void 0
+            await this.db.update(userSocialAccounts).set(heal).where(and8(
+              eq11(userSocialAccounts.id, account.id),
+              access?.needsRotation && account.accessToken !== null ? eq11(userSocialAccounts.accessToken, account.accessToken) : void 0,
+              refresh?.needsRotation && account.refreshToken !== null ? eq11(userSocialAccounts.refreshToken, account.refreshToken) : void 0
             ));
           } catch {
           }
@@ -7430,9 +7706,9 @@ var init_social_accounts_repository = __esm({
        */
       async findByProviderAndProviderId(provider, providerUserId) {
         const result = await this.readDb.select().from(userSocialAccounts).where(
-          and7(
-            eq10(userSocialAccounts.provider, provider),
-            eq10(userSocialAccounts.providerUserId, providerUserId)
+          and8(
+            eq11(userSocialAccounts.provider, provider),
+            eq11(userSocialAccounts.providerUserId, providerUserId)
           )
         ).limit(1);
         return this.decryptAccount(result[0] ?? null);
@@ -7442,7 +7718,7 @@ var init_social_accounts_repository = __esm({
        * Read replica 사용
        */
       async findByUserId(userId) {
-        const result = await this.readDb.select().from(userSocialAccounts).where(eq10(userSocialAccounts.userId, userId));
+        const result = await this.readDb.select().from(userSocialAccounts).where(eq11(userSocialAccounts.userId, userId));
         return Promise.all(result.map((account) => this.decryptAccount(account)));
       }
       /**
@@ -7451,9 +7727,9 @@ var init_social_accounts_repository = __esm({
        */
       async findByUserIdAndProvider(userId, provider) {
         const result = await this.readDb.select().from(userSocialAccounts).where(
-          and7(
-            eq10(userSocialAccounts.userId, userId),
-            eq10(userSocialAccounts.provider, provider)
+          and8(
+            eq11(userSocialAccounts.userId, userId),
+            eq11(userSocialAccounts.provider, provider)
           )
         ).limit(1);
         return this.decryptAccount(result[0] ?? null);
@@ -7479,11 +7755,11 @@ var init_social_accounts_repository = __esm({
        * 토큰 정보 업데이트
        * Write primary 사용
        */
-      async updateTokens(id13, data) {
+      async updateTokens(id14, data) {
         const accounts = await this.db.select({
           provider: userSocialAccounts.provider,
           providerUserId: userSocialAccounts.providerUserId
-        }).from(userSocialAccounts).where(eq10(userSocialAccounts.id, id13)).limit(1);
+        }).from(userSocialAccounts).where(eq11(userSocialAccounts.id, id14)).limit(1);
         const account = accounts[0];
         if (!account) {
           return null;
@@ -7497,15 +7773,15 @@ var init_social_accounts_repository = __esm({
           ...data,
           accessToken: data.accessToken ? await encryptToken(data.accessToken, context("access")) : data.accessToken,
           refreshToken: data.refreshToken ? await encryptToken(data.refreshToken, context("refresh")) : data.refreshToken
-        }).where(eq10(userSocialAccounts.id, id13)).returning();
+        }).where(eq11(userSocialAccounts.id, id14)).returning();
         return this.decryptAccount(result[0] ?? null);
       }
       /**
        * 소셜 계정 삭제
        * Write primary 사용
        */
-      async deleteById(id13) {
-        const result = await this.db.delete(userSocialAccounts).where(eq10(userSocialAccounts.id, id13)).returning();
+      async deleteById(id14) {
+        const result = await this.db.delete(userSocialAccounts).where(eq11(userSocialAccounts.id, id14)).returning();
         return result[0] ?? null;
       }
       /**
@@ -7514,9 +7790,9 @@ var init_social_accounts_repository = __esm({
        */
       async deleteByUserIdAndProvider(userId, provider) {
         const result = await this.db.delete(userSocialAccounts).where(
-          and7(
-            eq10(userSocialAccounts.userId, userId),
-            eq10(userSocialAccounts.provider, provider)
+          and8(
+            eq11(userSocialAccounts.userId, userId),
+            eq11(userSocialAccounts.provider, provider)
           )
         ).returning();
         return result[0] ?? null;
@@ -7529,7 +7805,7 @@ var init_social_accounts_repository = __esm({
        * Write primary 사용
        */
       async deleteAllByUserId(userId) {
-        const result = await this.db.delete(userSocialAccounts).where(eq10(userSocialAccounts.userId, userId)).returning();
+        const result = await this.db.delete(userSocialAccounts).where(eq11(userSocialAccounts.userId, userId)).returning();
         return result.length;
       }
     };
@@ -7538,19 +7814,19 @@ var init_social_accounts_repository = __esm({
 });
 
 // src/server/repositories/auth-metadata.repository.ts
-import { BaseRepository as BaseRepository11 } from "@spfn/core/db";
-import { eq as eq11 } from "drizzle-orm";
+import { BaseRepository as BaseRepository12 } from "@spfn/core/db";
+import { eq as eq12 } from "drizzle-orm";
 var AuthMetadataRepository, authMetadataRepository;
 var init_auth_metadata_repository = __esm({
   "src/server/repositories/auth-metadata.repository.ts"() {
     "use strict";
     init_auth_metadata();
-    AuthMetadataRepository = class extends BaseRepository11 {
+    AuthMetadataRepository = class extends BaseRepository12 {
       /**
        * 키로 값 조회
        */
       async get(key) {
-        const result = await this.readDb.select().from(authMetadata).where(eq11(authMetadata.key, key)).limit(1);
+        const result = await this.readDb.select().from(authMetadata).where(eq12(authMetadata.key, key)).limit(1);
         return result[0]?.value ?? null;
       }
       /**
@@ -7573,20 +7849,20 @@ var init_auth_metadata_repository = __esm({
 });
 
 // src/server/repositories/account-deletion-requests.repository.ts
-import { eq as eq12, and as and8, lte } from "drizzle-orm";
-import { BaseRepository as BaseRepository12 } from "@spfn/core/db";
+import { eq as eq13, and as and9, lte } from "drizzle-orm";
+import { BaseRepository as BaseRepository13 } from "@spfn/core/db";
 var AccountDeletionRequestsRepository, accountDeletionRequestsRepository;
 var init_account_deletion_requests_repository = __esm({
   "src/server/repositories/account-deletion-requests.repository.ts"() {
     "use strict";
     init_account_deletion_requests();
-    AccountDeletionRequestsRepository = class extends BaseRepository12 {
+    AccountDeletionRequestsRepository = class extends BaseRepository13 {
       /**
        * ID로 요청 조회
        * Read replica 사용
        */
-      async findById(id13) {
-        const result = await this.readDb.select().from(accountDeletionRequests).where(eq12(accountDeletionRequests.id, id13)).limit(1);
+      async findById(id14) {
+        const result = await this.readDb.select().from(accountDeletionRequests).where(eq13(accountDeletionRequests.id, id14)).limit(1);
         return result[0] ?? null;
       }
       /**
@@ -7595,9 +7871,9 @@ var init_account_deletion_requests_repository = __esm({
        */
       async findPendingByUserId(userId) {
         const result = await this.readDb.select().from(accountDeletionRequests).where(
-          and8(
-            eq12(accountDeletionRequests.userId, userId),
-            eq12(accountDeletionRequests.status, "pending")
+          and9(
+            eq13(accountDeletionRequests.userId, userId),
+            eq13(accountDeletionRequests.status, "pending")
           )
         ).limit(1);
         return result[0] ?? null;
@@ -7611,9 +7887,9 @@ var init_account_deletion_requests_repository = __esm({
        */
       async findPendingByUserIdOnPrimary(userId) {
         const result = await this.db.select().from(accountDeletionRequests).where(
-          and8(
-            eq12(accountDeletionRequests.userId, userId),
-            eq12(accountDeletionRequests.status, "pending")
+          and9(
+            eq13(accountDeletionRequests.userId, userId),
+            eq13(accountDeletionRequests.status, "pending")
           )
         ).limit(1);
         return result[0] ?? null;
@@ -7624,8 +7900,8 @@ var init_account_deletion_requests_repository = __esm({
        */
       async findDueForPurge(now) {
         return this.readDb.select().from(accountDeletionRequests).where(
-          and8(
-            eq12(accountDeletionRequests.status, "pending"),
+          and9(
+            eq13(accountDeletionRequests.status, "pending"),
             lte(accountDeletionRequests.purgeScheduledAt, now)
           )
         );
@@ -7645,14 +7921,14 @@ var init_account_deletion_requests_repository = __esm({
        * cancelled) 시 null을 반환하니 호출자가 그 결과를 확인해야 한다.
        * Write primary 사용
        */
-      async markCancelled(id13) {
+      async markCancelled(id14) {
         const result = await this.db.update(accountDeletionRequests).set({
           status: "cancelled",
           cancelledAt: /* @__PURE__ */ new Date()
         }).where(
-          and8(
-            eq12(accountDeletionRequests.id, id13),
-            eq12(accountDeletionRequests.status, "pending")
+          and9(
+            eq13(accountDeletionRequests.id, id14),
+            eq13(accountDeletionRequests.status, "pending")
           )
         ).returning();
         return result[0] ?? null;
@@ -7667,15 +7943,15 @@ var init_account_deletion_requests_repository = __esm({
        * destructive DML을 실행하기 **전에** 반드시 이 결과를 확인해야 한다.
        * Write primary 사용
        */
-      async markCompleted(id13, purgeStrategy) {
+      async markCompleted(id14, purgeStrategy) {
         const result = await this.db.update(accountDeletionRequests).set({
           status: "completed",
           completedAt: /* @__PURE__ */ new Date(),
           purgeStrategy
         }).where(
-          and8(
-            eq12(accountDeletionRequests.id, id13),
-            eq12(accountDeletionRequests.status, "pending")
+          and9(
+            eq13(accountDeletionRequests.id, id14),
+            eq13(accountDeletionRequests.status, "pending")
           )
         ).returning();
         return result[0] ?? null;
@@ -7686,14 +7962,14 @@ var init_account_deletion_requests_repository = __esm({
 });
 
 // src/server/repositories/ops-tokens.repository.ts
-import { and as and9, desc as desc3, eq as eq13, isNull as isNull4 } from "drizzle-orm";
-import { BaseRepository as BaseRepository13 } from "@spfn/core/db";
+import { and as and10, desc as desc3, eq as eq14, isNull as isNull5 } from "drizzle-orm";
+import { BaseRepository as BaseRepository14 } from "@spfn/core/db";
 var OpsTokensRepository, opsTokensRepository;
 var init_ops_tokens_repository = __esm({
   "src/server/repositories/ops-tokens.repository.ts"() {
     "use strict";
     init_ops_tokens();
-    OpsTokensRepository = class extends BaseRepository13 {
+    OpsTokensRepository = class extends BaseRepository14 {
       /**
        * Lookup by the secret's hash — the verification path.
        *
@@ -7703,7 +7979,7 @@ var init_ops_tokens_repository = __esm({
        * and revocation is documented as taking effect immediately.
        */
       async findByTokenHash(tokenHash) {
-        const result = await this.db.select().from(opsTokens).where(eq13(opsTokens.tokenHash, tokenHash)).limit(1);
+        const result = await this.db.select().from(opsTokens).where(eq14(opsTokens.tokenHash, tokenHash)).limit(1);
         return result[0] ?? null;
       }
       async create(data) {
@@ -7718,13 +7994,13 @@ var init_ops_tokens_repository = __esm({
        * token is already revoked — the first revocation's timestamp is never
        * overwritten.
        */
-      async revokeById(id13) {
-        const result = await this.db.update(opsTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and9(eq13(opsTokens.id, id13), isNull4(opsTokens.revokedAt))).returning();
+      async revokeById(id14) {
+        const result = await this.db.update(opsTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and10(eq14(opsTokens.id, id14), isNull5(opsTokens.revokedAt))).returning();
         return result[0] ?? null;
       }
       /** Fire-and-forget from the verification path. */
-      async updateLastUsedById(id13) {
-        await this.db.update(opsTokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq13(opsTokens.id, id13));
+      async updateLastUsedById(id14) {
+        await this.db.update(opsTokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq14(opsTokens.id, id14));
       }
     };
     opsTokensRepository = new OpsTokensRepository();
@@ -7738,6 +8014,7 @@ var init_repositories = __esm({
     init_users_repository();
     init_keys_repository();
     init_verification_codes_repository();
+    init_signup_link_tokens_repository();
     init_roles_repository();
     init_permissions_repository();
     init_role_permissions_repository();
@@ -7839,7 +8116,7 @@ async function removePermissionFromRole(roleId, permissionId) {
 }
 async function setRolePermissions(roleId, permissionIds) {
   const roleIdNum = Number(roleId);
-  const permissionIdNums = permissionIds.map((id13) => Number(id13));
+  const permissionIdNums = permissionIds.map((id14) => Number(id14));
   await rolePermissionsRepository.setPermissionsForRole(roleIdNum, permissionIdNums);
 }
 async function getAllRoles(includeInactive = false) {
@@ -7859,7 +8136,7 @@ async function getRolePermissions(roleId) {
   }
   const permissionIds = mappings.map((m) => m.permissionId);
   const perms = await Promise.all(
-    permissionIds.map((id13) => permissionsRepository.findById(id13))
+    permissionIds.map((id14) => permissionsRepository.findById(id14))
   );
   return perms.filter((p) => p !== null).map((p) => p.name);
 }
@@ -7879,6 +8156,9 @@ import { defineRouter as defineRouter6 } from "@spfn/core/route";
 // src/server/routes/auth/index.ts
 init_schema3();
 
+// src/server/helpers/index.ts
+init_email();
+
 // src/server/helpers/password.ts
 import * as bcrypt from "@node-rs/bcrypt";
 import { env } from "@spfn/auth/config";
@@ -8055,6 +8335,7 @@ function getKeyId(c) {
 // src/server/routes/auth/index.ts
 init_types();
 import { KeyNotFoundError } from "@spfn/auth/errors";
+import { ValidationError as ValidationError9 } from "@spfn/core/errors";
 
 // src/server/services/auth.service.ts
 init_repositories();
@@ -8070,6 +8351,7 @@ import {
 } from "@spfn/auth/errors";
 
 // src/server/lib/config.ts
+init_email();
 import { env as env4 } from "@spfn/auth/config";
 function getCookieSuffix() {
   const port = process.env.SPFN_PORT;
@@ -8091,6 +8373,10 @@ var COOKIE_NAMES = {
   /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
   get OAUTH_CSRF() {
     return `spfn_oauth_csrf${getCookieSuffix()}`;
+  },
+  /** Password-setup session for verified-email signup — temporary, single-purpose */
+  get SIGNUP_SETUP() {
+    return `spfn_signup_setup${getCookieSuffix()}`;
   }
 };
 function matchOAuthCsrfCookies(cookies) {
@@ -8135,7 +8421,7 @@ function getAuthConfig() {
 async function runBeforeRegister(context) {
   const { beforeRegister } = globalConfig;
   if (beforeRegister) {
-    await beforeRegister(context);
+    await beforeRegister({ ...context, email: normalizeOptionalEmail(context.email) });
   }
 }
 function getSessionTtl(override) {
@@ -8178,11 +8464,15 @@ var authLogger = {
 };
 
 // src/server/services/verification.service.ts
+init_email();
 init_repositories();
 var ACCOUNT_EXISTS_NOTICE_DEDUPE_MINUTES = 60;
 var VERIFICATION_TOKEN_EXPIRY = "15m";
 var VERIFICATION_CODE_EXPIRY_MINUTES = 5;
 var MAX_VERIFICATION_ATTEMPTS = 5;
+function normalizeVerificationTarget(target, targetType) {
+  return targetType === "email" ? normalizeEmail(target) : target.trim();
+}
 function generateVerificationCode() {
   return crypto4.randomInt(0, 1e6).toString().padStart(6, "0");
 }
@@ -8290,23 +8580,28 @@ async function sendAccountExistsNotice(target, targetType) {
     log.error("Failed to send account-exists notice", { target, error: result.error });
   }
 }
+async function noticeAccountExistsOnce(target, targetType) {
+  const recentNotice = await verificationCodesRepository.findValidByTargetAndPurpose(target, "registration");
+  if (recentNotice) {
+    return;
+  }
+  const dedupeExpiresAt = new Date(Date.now() + ACCOUNT_EXISTS_NOTICE_DEDUPE_MINUTES * 6e4);
+  await verificationCodesRepository.invalidatePreviousCodes(target, "registration");
+  await verificationCodesRepository.create({
+    target,
+    targetType,
+    code: generateVerificationCode(),
+    purpose: "registration",
+    expiresAt: dedupeExpiresAt,
+    attempts: 0
+  });
+  await sendAccountExistsNotice(target, targetType);
+}
 async function sendVerificationCodeService(params) {
-  const { target, targetType, purpose } = params;
+  const { targetType, purpose } = params;
+  const target = normalizeVerificationTarget(params.target, targetType);
   if (purpose === "registration" && await accountExistsForTarget(target, targetType)) {
-    const recentNotice = await verificationCodesRepository.findValidByTargetAndPurpose(target, purpose);
-    if (!recentNotice) {
-      const dedupeExpiresAt = new Date(Date.now() + ACCOUNT_EXISTS_NOTICE_DEDUPE_MINUTES * 6e4);
-      await verificationCodesRepository.invalidatePreviousCodes(target, purpose);
-      await verificationCodesRepository.create({
-        target,
-        targetType,
-        code: generateVerificationCode(),
-        purpose,
-        expiresAt: dedupeExpiresAt,
-        attempts: 0
-      });
-      await sendAccountExistsNotice(target, targetType);
-    }
+    await noticeAccountExistsOnce(target, targetType);
     return {
       success: true,
       expiresAt: new Date(Date.now() + VERIFICATION_CODE_EXPIRY_MINUTES * 6e4).toISOString()
@@ -8325,7 +8620,8 @@ async function sendVerificationCodeService(params) {
   };
 }
 async function verifyCodeService(params) {
-  const { target, targetType, code, purpose } = params;
+  const { targetType, code, purpose } = params;
+  const target = normalizeVerificationTarget(params.target, targetType);
   const validation = await validateVerificationCode(target, code, purpose);
   if (!validation.valid) {
     throw new InvalidVerificationCodeError({ message: validation.error || "Invalid verification code" });
@@ -8675,8 +8971,8 @@ async function verifyReauthCredential(user, params) {
     throw new VerificationTokenTargetMismatchError();
   }
 }
-async function sendDeletionEmail(to, subject, text13) {
-  const result = await sendEmail2({ to, subject, text: text13 });
+async function sendDeletionEmail(to, subject, text14) {
+  const result = await sendEmail2({ to, subject, text: text14 });
   if (!result.success) {
     authLogger.email.error("Failed to send account deletion email", { to, subject, error: result.error });
   }
@@ -8923,7 +9219,8 @@ async function sweepDuePurges(now = /* @__PURE__ */ new Date()) {
 
 // src/server/services/auth.service.ts
 async function registerService(params) {
-  const { email, phone, verificationToken, password, publicKey, keyId, fingerprint, algorithm, metadata } = params;
+  const { email, verificationToken } = params;
+  const phone = params.phone?.trim();
   const tokenPayload = validateVerificationToken(verificationToken);
   if (!tokenPayload) {
     throw new InvalidVerificationTokenError2();
@@ -8931,7 +9228,7 @@ async function registerService(params) {
   if (tokenPayload.purpose !== "registration") {
     throw new VerificationTokenPurposeMismatchError2({ expected: "registration", actual: tokenPayload.purpose });
   }
-  const providedTarget = email || phone;
+  const providedTarget = email ? normalizeEmail(email) : phone;
   if (tokenPayload.target !== providedTarget) {
     throw new VerificationTokenTargetMismatchError2();
   }
@@ -8939,6 +9236,13 @@ async function registerService(params) {
   if (tokenPayload.targetType !== providedTargetType) {
     throw new VerificationTokenTargetMismatchError2();
   }
+  return await createVerifiedAccount({ ...params, phone });
+}
+async function createVerifiedAccount(params) {
+  const { email, phone, password, publicKey, keyId, fingerprint, algorithm, metadata } = params;
+  if (!publicKey || !keyId || !fingerprint) {
+    throw new ValidationError3({ message: "Device key material is required to register" });
+  }
   const existingUser = await usersRepository.findByEmailOrPhone(email, phone);
   if (existingUser) {
     const identifierType = email ? "email" : "phone";
@@ -9070,6 +9374,158 @@ async function changePasswordService(params) {
   await keysRepository.revokeAllActiveByUserId(userId, "Revoked by password change");
 }
 
+// src/server/services/signup-link.service.ts
+import crypto5 from "crypto";
+import { env as env7 } from "@spfn/auth/config";
+import { InvalidSignupLinkError, InvalidSignupSetupSessionError } from "@spfn/auth/errors";
+import { sendEmail as sendEmail3 } from "@spfn/notification/server";
+init_repositories();
+var CREDENTIAL_BYTES = 32;
+function mintCredential() {
+  const secret = crypto5.randomBytes(CREDENTIAL_BYTES).toString("base64url");
+  return { secret, hash: hashCredential(secret) };
+}
+function hashCredential(secret) {
+  return crypto5.createHash("sha256").update(secret).digest("base64url");
+}
+function isSafeReturnPath(returnPath) {
+  if (!returnPath.startsWith("/")) {
+    return false;
+  }
+  if (returnPath.startsWith("//") || returnPath.includes("\\")) {
+    return false;
+  }
+  if (returnPath.includes("..")) {
+    return false;
+  }
+  return !/^\/[^/?#]*:/.test(returnPath);
+}
+function buildConfirmUrl(token) {
+  const appUrl = (env7.NEXT_PUBLIC_SPFN_APP_URL || env7.SPFN_APP_URL || "").replace(/\/$/, "");
+  const path = env7.SPFN_AUTH_SIGNUP_CONFIRM_PATH || "/signup/confirm";
+  return `${appUrl}${path}?token=${encodeURIComponent(token)}`;
+}
+async function sendSignupLinkEmail(email, confirmUrl, expiresInMinutes) {
+  const result = await sendEmail3({
+    to: email,
+    template: "signup-link",
+    data: { confirmUrl, expiresInMinutes }
+  });
+  if (!result.success) {
+    authLogger.email.error("Failed to send signup link email", {
+      email,
+      error: result.error
+    });
+  }
+}
+async function requestSignupLinkService(params) {
+  const email = params.email.trim();
+  const returnPath = params.returnPath;
+  const ttlMinutes = env7.SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES ?? 30;
+  const expiresAt = new Date(Date.now() + ttlMinutes * 6e4);
+  const existingUser = await usersRepository.findByEmail(email);
+  if (existingUser) {
+    await noticeAccountExistsOnce(email, "email");
+    return { success: true, expiresAt: expiresAt.toISOString() };
+  }
+  await signupLinkTokensRepository.supersedeLiveForEmail(email);
+  const { secret, hash: hash2 } = mintCredential();
+  await signupLinkTokensRepository.create({
+    email,
+    tokenHash: hash2,
+    returnPath: returnPath ?? null,
+    expiresAt
+  });
+  await sendSignupLinkEmail(email, buildConfirmUrl(secret), ttlMinutes);
+  return { success: true, expiresAt: expiresAt.toISOString() };
+}
+function linkRefusalReason(row) {
+  if (!row) {
+    return "unknown token";
+  }
+  if (row.completedAt) {
+    return "signup already completed";
+  }
+  if (row.supersededAt) {
+    return "superseded by a newer request";
+  }
+  if (row.consumedAt) {
+    return "link already used";
+  }
+  if (/* @__PURE__ */ new Date() > new Date(row.expiresAt)) {
+    return "link expired";
+  }
+  return null;
+}
+async function confirmSignupLinkService(params) {
+  const row = await signupLinkTokensRepository.findByTokenHash(hashCredential(params.token));
+  const refusal = linkRefusalReason(row);
+  if (refusal || !row) {
+    authLogger.service.warn("Signup link refused", { reason: refusal });
+    throw new InvalidSignupLinkError();
+  }
+  if (await usersRepository.findByEmail(row.email)) {
+    authLogger.service.warn("Signup link refused", { reason: "account created meanwhile" });
+    throw new InvalidSignupLinkError();
+  }
+  const setupTtlMinutes = env7.SPFN_AUTH_SIGNUP_SETUP_TTL_MINUTES ?? 15;
+  const setupExpiresAt = new Date(Date.now() + setupTtlMinutes * 6e4);
+  const setup = mintCredential();
+  const claimed = await signupLinkTokensRepository.claimLink(row.id, setup.hash, setupExpiresAt);
+  if (!claimed) {
+    authLogger.service.warn("Signup link refused", { reason: "lost the claim race" });
+    throw new InvalidSignupLinkError();
+  }
+  return {
+    email: claimed.email,
+    returnPath: claimed.returnPath,
+    setupSecret: setup.secret,
+    setupExpiresAt: setupExpiresAt.toISOString()
+  };
+}
+function setupRefusalReason(row) {
+  if (!row) {
+    return "unknown setup session";
+  }
+  if (row.completedAt) {
+    return "setup session already used";
+  }
+  if (row.supersededAt) {
+    return "superseded by a newer request";
+  }
+  if (!row.setupExpiresAt || /* @__PURE__ */ new Date() > new Date(row.setupExpiresAt)) {
+    return "setup session expired";
+  }
+  return null;
+}
+async function completeSignupService(params) {
+  if (!params.setupSecret) {
+    throw new InvalidSignupSetupSessionError();
+  }
+  const row = await signupLinkTokensRepository.findBySetupSecretHash(hashCredential(params.setupSecret));
+  const refusal = setupRefusalReason(row);
+  if (refusal || !row) {
+    authLogger.service.warn("Signup setup session refused", { reason: refusal });
+    throw new InvalidSignupSetupSessionError();
+  }
+  const claimed = await signupLinkTokensRepository.claimSetupSession(row.id);
+  if (!claimed) {
+    authLogger.service.warn("Signup setup session refused", { reason: "lost the claim race" });
+    throw new InvalidSignupSetupSessionError();
+  }
+  return await createVerifiedAccount({
+    email: claimed.email,
+    password: params.password,
+    publicKey: params.publicKey,
+    keyId: params.keyId,
+    fingerprint: params.fingerprint,
+    algorithm: params.algorithm,
+    deviceName: params.deviceName,
+    platform: params.platform,
+    metadata: params.metadata
+  });
+}
+
 // src/server/services/rbac.service.ts
 init_repositories();
 init_rbac();
@@ -9210,6 +9666,29 @@ async function syncMappings(allMappings, rolesByName, permsByName) {
   }
 }
 
+// src/server/services/email-normalization.service.ts
+init_repositories();
+var BACKFILL_KEY = "auth:email_normalization";
+async function normalizeStoredEmails() {
+  if (await authMetadataRepository.get(BACKFILL_KEY)) {
+    return { normalized: 0, conflicts: [] };
+  }
+  const conflicts = await usersRepository.findEmailConflictGroups();
+  const normalized = await usersRepository.normalizeEmailsExcept(conflicts.flat());
+  if (normalized > 0) {
+    authLogger.service.info(`\u2709\uFE0F  Normalized ${normalized} stored email address(es)`);
+  }
+  if (conflicts.length > 0) {
+    authLogger.service.error(
+      `${conflicts.length} email group(s) differ only by capitalization and cannot be normalized automatically. The accounts are untouched and the ones stored in mixed case cannot sign in until this is resolved.`,
+      { conflictingUserIds: conflicts }
+    );
+    return { normalized, conflicts };
+  }
+  await authMetadataRepository.set(BACKFILL_KEY, "done");
+  return { normalized, conflicts };
+}
+
 // src/server/services/permission.service.ts
 init_repositories();
 import { ForbiddenError } from "@spfn/core/errors";
@@ -9224,7 +9703,7 @@ async function getUserPermissions(userId) {
   const permIds = rolePermMappings.map((rp) => rp.permissionId);
   if (permIds.length > 0) {
     const rolePerms = await Promise.all(
-      permIds.map((id13) => permissionsRepository.findById(id13))
+      permIds.map((id14) => permissionsRepository.findById(id14))
     );
     for (const perm of rolePerms) {
       if (perm && perm.isActive) {
@@ -9299,10 +9778,10 @@ init_role_service();
 
 // src/server/services/invitation.service.ts
 init_repositories();
-import crypto5 from "crypto";
+import crypto6 from "crypto";
 import { BadRequestError, NotFoundError as NotFoundError3, ConflictError } from "@spfn/core/errors";
 function generateInvitationToken() {
-  return crypto5.randomUUID();
+  return crypto6.randomUUID();
 }
 function calculateExpiresAt(days = 7) {
   const expiresAt = /* @__PURE__ */ new Date();
@@ -9437,20 +9916,20 @@ async function acceptInvitation(params) {
 async function listInvitations(params) {
   return await invitationsRepository.list(params);
 }
-async function cancelInvitation(id13, cancelledBy, reason) {
-  const invitation = await invitationsRepository.findById(id13);
+async function cancelInvitation(id14, cancelledBy, reason) {
+  const invitation = await invitationsRepository.findById(id14);
   if (!invitation) {
     throw new NotFoundError3({ message: "Invitation not found", resource: "Invitation" });
   }
   if (invitation.status !== "pending") {
     throw new ConflictError({ message: `Cannot cancel ${invitation.status} invitation` });
   }
-  await invitationsRepository.cancel(id13, cancelledBy, reason, invitation.metadata);
+  await invitationsRepository.cancel(id14, cancelledBy, reason, invitation.metadata);
   console.log(`[Auth] \u26A0\uFE0F  Invitation cancelled: ${invitation.email} (reason: ${reason || "none"})`);
 }
-async function deleteInvitation(id13) {
-  await invitationsRepository.deleteById(id13);
-  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id13}`);
+async function deleteInvitation(id14) {
+  await invitationsRepository.deleteById(id14);
+  console.log(`[Auth] \u{1F5D1}\uFE0F  Invitation deleted: ${id14}`);
 }
 async function expireOldInvitations() {
   const count = await invitationsRepository.updateExpiredInvitations();
@@ -9459,8 +9938,8 @@ async function expireOldInvitations() {
   }
   return count;
 }
-async function resendInvitation(id13, expiresInDays = 7) {
-  const invitation = await invitationsRepository.findById(id13);
+async function resendInvitation(id14, expiresInDays = 7) {
+  const invitation = await invitationsRepository.findById(id14);
   if (!invitation) {
     throw new NotFoundError3({ message: "Invitation not found", resource: "Invitation" });
   }
@@ -9468,7 +9947,7 @@ async function resendInvitation(id13, expiresInDays = 7) {
     throw new ConflictError({ message: `Cannot resend ${invitation.status} invitation` });
   }
   const newExpiresAt = calculateExpiresAt(expiresInDays);
-  const updated = await invitationsRepository.resend(id13, newExpiresAt);
+  const updated = await invitationsRepository.resend(id14, newExpiresAt);
   if (!updated) {
     throw new Error("Failed to update invitation");
   }
@@ -9622,7 +10101,7 @@ async function updateUserProfileService(userId, params) {
 
 // src/server/services/oauth.service.ts
 init_repositories();
-import { env as env11 } from "@spfn/auth/config";
+import { env as env12 } from "@spfn/auth/config";
 import { ValidationError as ValidationError8 } from "@spfn/core/errors";
 import {
   AccountDisabledError as AccountDisabledError2,
@@ -9631,21 +10110,21 @@ import {
 } from "@spfn/auth/errors";
 
 // src/server/lib/oauth/google.ts
-import { env as env7 } from "@spfn/auth/config";
+import { env as env8 } from "@spfn/auth/config";
 var GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
 var GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
 var GOOGLE_USERINFO_URL = "https://www.googleapis.com/oauth2/v2/userinfo";
 function isGoogleOAuthEnabled() {
-  return !!(env7.SPFN_AUTH_GOOGLE_CLIENT_ID && env7.SPFN_AUTH_GOOGLE_CLIENT_SECRET);
+  return !!(env8.SPFN_AUTH_GOOGLE_CLIENT_ID && env8.SPFN_AUTH_GOOGLE_CLIENT_SECRET);
 }
 function getGoogleOAuthConfig() {
-  const clientId = env7.SPFN_AUTH_GOOGLE_CLIENT_ID;
-  const clientSecret = env7.SPFN_AUTH_GOOGLE_CLIENT_SECRET;
+  const clientId = env8.SPFN_AUTH_GOOGLE_CLIENT_ID;
+  const clientSecret = env8.SPFN_AUTH_GOOGLE_CLIENT_SECRET;
   if (!clientId || !clientSecret) {
     throw new Error("Google OAuth is not configured. Set SPFN_AUTH_GOOGLE_CLIENT_ID and SPFN_AUTH_GOOGLE_CLIENT_SECRET.");
   }
-  const baseUrl = env7.NEXT_PUBLIC_SPFN_APP_URL || env7.SPFN_APP_URL;
-  const redirectUri = env7.SPFN_AUTH_GOOGLE_REDIRECT_URI || `${baseUrl}/_auth/oauth/google/callback`;
+  const baseUrl = env8.NEXT_PUBLIC_SPFN_APP_URL || env8.SPFN_APP_URL;
+  const redirectUri = env8.SPFN_AUTH_GOOGLE_REDIRECT_URI || `${baseUrl}/_auth/oauth/google/callback`;
   return {
     clientId,
     clientSecret,
@@ -9653,7 +10132,7 @@ function getGoogleOAuthConfig() {
   };
 }
 function getDefaultScopes() {
-  const envScopes = env7.SPFN_AUTH_GOOGLE_SCOPES;
+  const envScopes = env8.SPFN_AUTH_GOOGLE_SCOPES;
   if (envScopes) {
     return envScopes.split(",").map((s) => s.trim()).filter(Boolean);
   }
@@ -9731,9 +10210,9 @@ async function refreshAccessToken(refreshToken) {
 
 // src/server/lib/oauth/state.ts
 import * as jose from "jose";
-import { env as env8 } from "@spfn/auth/config";
+import { env as env9 } from "@spfn/auth/config";
 async function getStateKey() {
-  const secret = env8.SPFN_AUTH_SESSION_SECRET;
+  const secret = env9.SPFN_AUTH_SESSION_SECRET;
   const encoder = new TextEncoder();
   const data = encoder.encode(`oauth-state:${secret}`);
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
@@ -9782,8 +10261,8 @@ var registry2 = /* @__PURE__ */ new Map();
 function registerOAuthProvider(provider) {
   registry2.set(provider.id, provider);
 }
-function getOAuthProvider(id13) {
-  return registry2.get(id13);
+function getOAuthProvider(id14) {
+  return registry2.get(id14);
 }
 function getRegisteredProviders() {
   return [...registry2.values()];
@@ -9836,14 +10315,14 @@ async function verifySignature(params) {
 init_token_cipher();
 
 // src/server/lib/oauth/google-provider.ts
-import { env as env9 } from "@spfn/auth/config";
+import { env as env10 } from "@spfn/auth/config";
 import { NativeSignInUnsupportedError } from "@spfn/auth/errors";
 var GOOGLE_JWKS_URI = "https://www.googleapis.com/oauth2/v3/certs";
 var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
 function getGoogleNativeAudiences() {
-  const ids = (env9.SPFN_AUTH_GOOGLE_NATIVE_CLIENT_IDS || "").split(",").map((s) => s.trim()).filter(Boolean);
-  if (env9.SPFN_AUTH_GOOGLE_CLIENT_ID) {
-    ids.push(env9.SPFN_AUTH_GOOGLE_CLIENT_ID);
+  const ids = (env10.SPFN_AUTH_GOOGLE_NATIVE_CLIENT_IDS || "").split(",").map((s) => s.trim()).filter(Boolean);
+  if (env10.SPFN_AUTH_GOOGLE_CLIENT_ID) {
+    ids.push(env10.SPFN_AUTH_GOOGLE_CLIENT_ID);
   }
   return ids;
 }
@@ -9905,13 +10384,13 @@ registerOAuthProvider(googleProvider);
 
 // src/server/lib/oauth/apple-provider.ts
 import { createHash as createHash2 } from "crypto";
-import { env as env10 } from "@spfn/auth/config";
+import { env as env11 } from "@spfn/auth/config";
 import { ValidationError as ValidationError4 } from "@spfn/core/errors";
 import { NativeSignInUnsupportedError as NativeSignInUnsupportedError2 } from "@spfn/auth/errors";
 var APPLE_JWKS_URI = "https://appleid.apple.com/auth/keys";
 var APPLE_ISSUER = "https://appleid.apple.com";
 function getAppleClientIds() {
-  return (env10.SPFN_AUTH_APPLE_CLIENT_IDS || "").split(",").map((s) => s.trim()).filter(Boolean);
+  return (env11.SPFN_AUTH_APPLE_CLIENT_IDS || "").split(",").map((s) => s.trim()).filter(Boolean);
 }
 function hashNonce(rawNonce) {
   return createHash2("sha256").update(rawNonce).digest("hex");
@@ -10624,8 +11103,8 @@ async function oauthCallbackService(params) {
     algorithm: stateData.algorithm
   });
   await updateLastLoginService(userId);
-  const appUrl = env11.NEXT_PUBLIC_SPFN_APP_URL || env11.SPFN_APP_URL;
-  const callbackPath = env11.SPFN_AUTH_OAUTH_SUCCESS_URL || "/auth/callback";
+  const appUrl = env12.NEXT_PUBLIC_SPFN_APP_URL || env12.SPFN_APP_URL;
+  const callbackPath = env12.SPFN_AUTH_OAUTH_SUCCESS_URL || "/auth/callback";
   const callbackUrl = callbackPath.startsWith("http") ? callbackPath : `${appUrl}${callbackPath}`;
   const redirectUrl = buildRedirectUrl(callbackUrl, {
     userId: String(userId),
@@ -10753,7 +11232,7 @@ function buildRedirectUrl(baseUrl, params) {
   return `${url.pathname}${url.search}`;
 }
 function buildOAuthErrorUrl(error) {
-  const errorUrl = env11.SPFN_AUTH_OAUTH_ERROR_URL || "/auth/error?error={error}";
+  const errorUrl = env12.SPFN_AUTH_OAUTH_ERROR_URL || "/auth/error?error={error}";
   return errorUrl.replace("{error}", encodeURIComponent(error));
 }
 function isOAuthProviderEnabled(provider) {
@@ -10919,8 +11398,8 @@ async function verifyOpsTokenService(token) {
     scopes: record.scopes
   };
 }
-async function revokeOpsTokenService(id13) {
-  return await opsTokensRepository.revokeById(id13);
+async function revokeOpsTokenService(id14) {
+  return await opsTokensRepository.revokeById(id14);
 }
 async function listOpsTokensService() {
   return await opsTokensRepository.list();
@@ -10932,6 +11411,7 @@ import { Transactional } from "@spfn/core/db";
 import { rateLimitPolicy } from "@spfn/core/middleware";
 
 // src/server/lib/rate-limit-keys.ts
+init_email();
 import { createHash as createHash5 } from "crypto";
 import { getClientIp } from "@spfn/core/middleware";
 async function readJsonBody(c) {
@@ -10943,7 +11423,7 @@ async function readJsonBody(c) {
 }
 function accountKey(body) {
   if (typeof body.email === "string" && body.email.trim()) {
-    return `email:${body.email.trim().toLowerCase()}`;
+    return `email:${normalizeEmail(body.email)}`;
   }
   if (typeof body.phone === "string" && body.phone.trim()) {
     return `phone:${body.phone.trim()}`;
@@ -10955,7 +11435,7 @@ function targetKey(body) {
     return void 0;
   }
   const type = typeof body.targetType === "string" ? body.targetType : "target";
-  const value = type === "email" ? body.target.trim().toLowerCase() : body.target.trim();
+  const value = type === "email" ? normalizeEmail(body.target) : body.target.trim();
   return `${type}:${value}`;
 }
 function byIpAndAccount(options = {}) {
@@ -11055,6 +11535,54 @@ var register = route.post("/_auth/register").input({
   const { body } = await c.data();
   return await registerService(body);
 });
+var requestSignupLink = route.post("/_auth/signup/email").input({
+  body: Type.Object({
+    email: EmailSchema,
+    returnPath: Type.Optional(Type.String({
+      maxLength: 512,
+      description: "Relative path within the app to return to after signup. Absolute URLs are rejected."
+    }))
+  })
+}).use([rateLimitPolicy("auth-signup-link", { limit: 5, windowMs: 6e4, by: byIpAndAccount({ ipLimit: 20 }) })]).skip(["auth"]).handler(async (c) => {
+  const { body } = await c.data();
+  if (body.returnPath !== void 0 && !isSafeReturnPath(body.returnPath)) {
+    throw new ValidationError9({ message: "returnPath must be a relative path within the app" });
+  }
+  return await requestSignupLinkService(body);
+});
+var confirmSignupLink = route.post("/_auth/signup/email/confirm").input({
+  body: Type.Object({
+    token: Type.String({
+      minLength: 16,
+      maxLength: 256,
+      description: "Token from the confirmation link"
+    })
+  })
+}).use([rateLimitPolicy("auth-signup-confirm", { limit: 10, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+  const { body } = await c.data();
+  return await confirmSignupLinkService(body);
+});
+var completeSignup = route.post("/_auth/signup/password").input({
+  body: Type.Object({
+    password: PasswordSchema,
+    metadata: Type.Optional(Type.Record(Type.String(), Type.Unknown(), {
+      description: "Custom metadata passed to authRegisterEvent (e.g. referral code, UTM params)"
+    }))
+  })
+}).interceptor({
+  body: Type.Object({
+    setupSecret: Type.String({ description: "Password-setup session secret, from the HttpOnly cookie" }),
+    publicKey: Type.String({ description: "Client public key" }),
+    keyId: Type.String({ description: "Key identifier" }),
+    fingerprint: Type.String({ description: "Key fingerprint" }),
+    algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" }),
+    deviceName: Type.Optional(DeviceNameSchema),
+    platform: Type.Optional(PlatformSchema)
+  })
+}).use([rateLimitPolicy("auth-signup-password", { limit: 10, windowMs: 6e4 }), Transactional()]).skip(["auth"]).handler(async (c) => {
+  const { body } = await c.data();
+  return await completeSignupService(body);
+});
 var login = route.post("/_auth/login").input({
   body: Type.Object({
     email: Type.Optional(EmailSchema),
@@ -11227,13 +11755,13 @@ var CanonicalJsonError = class extends Error {
 var INT64_MIN = -(2n ** 63n);
 var INT64_MAX = 2n ** 63n - 1n;
 function parseCanonicalJson(bytes) {
-  let text13;
+  let text14;
   try {
-    text13 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    text14 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
   } catch {
     throw new CanonicalJsonError("INVALID_UTF8");
   }
-  const parser = new Parser(text13);
+  const parser = new Parser(text14);
   const value = parser.parseValue();
   parser.skipWhitespace();
   if (!parser.atEnd()) {
@@ -11254,8 +11782,8 @@ function isCanonicalBytes(bytes, value) {
   return true;
 }
 var Parser = class {
-  constructor(text13) {
-    this.text = text13;
+  constructor(text14) {
+    this.text = text14;
   }
   pos = 0;
   atEnd() {
@@ -13168,7 +13696,7 @@ var deleteCookie = (c, name, opt) => {
 init_types();
 init_schema3();
 import { Transactional as Transactional3 } from "@spfn/core/db";
-import { ValidationError as ValidationError9 } from "@spfn/core/errors";
+import { ValidationError as ValidationError10 } from "@spfn/core/errors";
 import { rateLimitPolicy as rateLimitPolicy4 } from "@spfn/core/middleware";
 import { defineRouter as defineRouter4, route as route4 } from "@spfn/core/route";
 var providerParams = Type.Object({
@@ -13288,10 +13816,10 @@ var getGoogleOAuthUrl = route4.post("/_auth/oauth/google/url").input({
 }).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   if (!isGoogleOAuthEnabled()) {
-    throw new ValidationError9({ message: "Google OAuth is not configured" });
+    throw new ValidationError10({ message: "Google OAuth is not configured" });
   }
   if (!body.state) {
-    throw new ValidationError9({
+    throw new ValidationError10({
       message: "OAuth state is required. Ensure the OAuth interceptor is configured."
     });
   }
@@ -13386,7 +13914,7 @@ var getProviderOAuthUrl = route4.post("/_auth/oauth/:provider/url").input({
   const { params, body } = await c.data();
   const provider = requireEnabledProvider(params.provider);
   if (!body.state) {
-    throw new ValidationError9({
+    throw new ValidationError10({
       message: "OAuth state is required. Ensure the OAuth interceptor is configured."
     });
   }
@@ -13687,6 +14215,10 @@ var mainAuthRouter = defineRouter6({
   sendVerificationCode,
   verifyCode,
   register,
+  // Verified-email signup routes
+  requestSignupLink,
+  confirmSignupLink,
+  completeSignup,
   login,
   logout,
   rotateKey,
@@ -13746,11 +14278,11 @@ init_types();
 init_schema3();
 
 // src/server/lib/crypto.ts
-import crypto6 from "crypto";
+import crypto7 from "crypto";
 import jwt3 from "jsonwebtoken";
 function generateKeyPairES256() {
-  const keyId = crypto6.randomUUID();
-  const { privateKey, publicKey } = crypto6.generateKeyPairSync("ec", {
+  const keyId = crypto7.randomUUID();
+  const { privateKey, publicKey } = crypto7.generateKeyPairSync("ec", {
     namedCurve: "P-256",
     // ES256
     publicKeyEncoding: {
@@ -13764,7 +14296,7 @@ function generateKeyPairES256() {
   });
   const privateKeyB64 = privateKey.toString("base64");
   const publicKeyB64 = publicKey.toString("base64");
-  const fingerprint = crypto6.createHash("sha256").update(publicKey).digest("hex");
+  const fingerprint = crypto7.createHash("sha256").update(publicKey).digest("hex");
   return {
     privateKey: privateKeyB64,
     publicKey: publicKeyB64,
@@ -13774,8 +14306,8 @@ function generateKeyPairES256() {
   };
 }
 function generateKeyPairRS256() {
-  const keyId = crypto6.randomUUID();
-  const { privateKey, publicKey } = crypto6.generateKeyPairSync("rsa", {
+  const keyId = crypto7.randomUUID();
+  const { privateKey, publicKey } = crypto7.generateKeyPairSync("rsa", {
     modulusLength: 2048,
     publicKeyEncoding: {
       type: "spki",
@@ -13788,7 +14320,7 @@ function generateKeyPairRS256() {
   });
   const privateKeyB64 = privateKey.toString("base64");
   const publicKeyB64 = publicKey.toString("base64");
-  const fingerprint = crypto6.createHash("sha256").update(publicKey).digest("hex");
+  const fingerprint = crypto7.createHash("sha256").update(publicKey).digest("hex");
   return {
     privateKey: privateKeyB64,
     publicKey: publicKeyB64,
@@ -13803,7 +14335,7 @@ function generateKeyPair(algorithm = "ES256") {
 function generateClientToken(payload, privateKeyB64, algorithm, options) {
   try {
     const privateKeyDER = Buffer.from(privateKeyB64, "base64");
-    const privateKeyObject = crypto6.createPrivateKey({
+    const privateKeyObject = crypto7.createPrivateKey({
       key: privateKeyDER,
       format: "der",
       type: "pkcs8"
@@ -13847,10 +14379,10 @@ function shouldRotateKey(createdAt, rotationDays = 90) {
 
 // src/server/lib/session.ts
 import * as jose2 from "jose";
-import { env as env12 } from "@spfn/auth/config";
+import { env as env13 } from "@spfn/auth/config";
 import { env as coreEnv } from "@spfn/core/config";
 async function getSessionSecretKey() {
-  const secret = env12.SPFN_AUTH_SESSION_SECRET;
+  const secret = env13.SPFN_AUTH_SESSION_SECRET;
   const encoder = new TextEncoder();
   const data = encoder.encode(secret);
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
@@ -13932,14 +14464,14 @@ async function shouldRefreshSession(jwt4, thresholdHours = 24) {
 }
 
 // src/server/setup.ts
-import { env as env13 } from "@spfn/auth/config";
+import { env as env14 } from "@spfn/auth/config";
 import { getRoleByName as getRoleByName2 } from "@spfn/auth/server";
 init_repositories();
 function parseAdminAccounts() {
   const accounts = [];
-  if (env13.SPFN_AUTH_ADMIN_ACCOUNTS) {
+  if (env14.SPFN_AUTH_ADMIN_ACCOUNTS) {
     try {
-      const accountsJson = env13.SPFN_AUTH_ADMIN_ACCOUNTS;
+      const accountsJson = env14.SPFN_AUTH_ADMIN_ACCOUNTS;
       const parsed = JSON.parse(accountsJson);
       if (!Array.isArray(parsed)) {
         authLogger.setup.error("\u274C SPFN_AUTH_ADMIN_ACCOUNTS must be an array");
@@ -13966,11 +14498,11 @@ function parseAdminAccounts() {
       return accounts;
     }
   }
-  const adminEmails = env13.SPFN_AUTH_ADMIN_EMAILS;
+  const adminEmails = env14.SPFN_AUTH_ADMIN_EMAILS;
   if (adminEmails) {
     const emails = adminEmails.split(",").map((s) => s.trim());
-    const passwords = (env13.SPFN_AUTH_ADMIN_PASSWORDS || "").split(",").map((s) => s.trim());
-    const roles2 = (env13.SPFN_AUTH_ADMIN_ROLES || "").split(",").map((s) => s.trim());
+    const passwords = (env14.SPFN_AUTH_ADMIN_PASSWORDS || "").split(",").map((s) => s.trim());
+    const roles2 = (env14.SPFN_AUTH_ADMIN_ROLES || "").split(",").map((s) => s.trim());
     if (passwords.length !== emails.length) {
       authLogger.setup.error("\u274C SPFN_AUTH_ADMIN_EMAILS and SPFN_AUTH_ADMIN_PASSWORDS length mismatch");
       return accounts;
@@ -13992,8 +14524,8 @@ function parseAdminAccounts() {
     }
     return accounts;
   }
-  const adminEmail = env13.SPFN_AUTH_ADMIN_EMAIL;
-  const adminPassword = env13.SPFN_AUTH_ADMIN_PASSWORD;
+  const adminEmail = env14.SPFN_AUTH_ADMIN_EMAIL;
+  const adminPassword = env14.SPFN_AUTH_ADMIN_PASSWORD;
   if (adminEmail && adminPassword) {
     accounts.push({
       email: adminEmail,
@@ -14016,7 +14548,7 @@ async function ensureAdminExists() {
   for (const account of accounts) {
     authLogger.setup.info(`Creating ${account.email} admin account(s)...`);
     try {
-      const existing = await usersRepository.findByEmail(account.email);
+      const existing = await usersRepository.findByEmailInAnyStoredForm(account.email);
       if (existing) {
         authLogger.setup.info(`\u26A0\uFE0F  Account already exists: ${account.email} (skipped)`);
         skipped++;
@@ -14068,6 +14600,14 @@ function createAuthLifecycle(options = {}) {
      */
     afterInfrastructure: async () => {
       await initializeAuth(options);
+      try {
+        await normalizeStoredEmails();
+      } catch (error) {
+        authLogger.service.error(
+          "Stored email normalization did not complete. Addresses stay as they are, so an account stored in mixed case cannot sign in until a later boot succeeds.",
+          { error }
+        );
+      }
       await ensureAdminExists();
       initOneTimeTokenManager(options.oneTimeToken);
     }
@@ -14121,6 +14661,7 @@ export {
   RolePermissionsRepository,
   RolesRepository,
   SOCIAL_PROVIDERS,
+  SignupLinkTokensRepository,
   SocialAccountsRepository,
   TargetTypeSchema,
   USER_STATUSES,
@@ -14155,9 +14696,11 @@ export {
   cancelInvitation,
   changePasswordService,
   checkUsernameAvailableService,
+  completeSignupService,
   configureAuth,
   configureDeletion,
   configureOAuthTokenCipher,
+  confirmSignupLinkService,
   createAuthDeletionJobRouter,
   createAuthDeletionPurgeJob,
   createAuthLifecycle,
@@ -14228,6 +14771,7 @@ export {
   isEncrypted,
   isGoogleOAuthEnabled,
   isOAuthProviderEnabled,
+  isSafeReturnPath,
   issueOneTimeTokenService,
   issueOpsTokenService,
   kakaoProvider,
@@ -14239,6 +14783,9 @@ export {
   logoutService,
   matchOAuthCsrfCookies,
   naverProvider,
+  normalizeEmail,
+  normalizeOptionalEmail,
+  normalizeStoredEmails,
   oauthCallbackService,
   oauthNativeService,
   oauthStartService,
@@ -14259,6 +14806,7 @@ export {
   registerService,
   removePermissionFromRole,
   requestAccountDeletionService,
+  requestSignupLinkService,
   requireAnyPermission,
   requireEnabledProvider,
   requireOpsScope,
@@ -14283,6 +14831,8 @@ export {
   setRolePermissions,
   shouldRefreshSession,
   shouldRotateKey,
+  signupLinkTokens,
+  signupLinkTokensRepository,
   socialAccountsRepository,
   sweepDuePurges,
   unsealSession,