@supacloud/lite 0.31.3 → 0.33.0

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.31.3",
+  version: "0.33.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -67,16 +67,16 @@ var package_default = {
     "@electric-sql/pglite-pgmq": "0.0.8",
     "@electric-sql/pglite-pgvector": "0.0.11",
     "@electric-sql/pglite-postgis": "0.2.10",
-    "@supacloud/db": "0.18.4",
+    "@supacloud/db": "0.20.0",
     "exact-mirror": "1.2.6",
     tar: "^7.5.22",
     typebox: "1.3.37"
   },
   devDependencies: {
-    "@supacloud/app": "0.28.3",
-    "@supacloud/contracts": "0.11.5",
-    "@supacloud/compiler": "0.47.3",
-    "@supacloud/elysia": "0.33.5",
+    "@supacloud/app": "0.30.0",
+    "@supacloud/contracts": "0.13.0",
+    "@supacloud/compiler": "0.49.0",
+    "@supacloud/elysia": "0.35.0",
     "@supabase/supabase-js": "^2.117.3",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
@@ -85,13 +85,13 @@ var package_default = {
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/db": "0.18.4",
-    "@supacloud/app": "0.28.3",
-    "@supacloud/compiler": "0.47.3",
-    "@supacloud/elysia": "0.33.5",
-    "@supacloud/contracts": "0.11.5",
-    "@supacloud/commands": "0.9.7",
-    "@supacloud/delivery": "0.19.4",
+    "@supacloud/db": "0.20.0",
+    "@supacloud/app": "0.30.0",
+    "@supacloud/compiler": "0.49.0",
+    "@supacloud/elysia": "0.35.0",
+    "@supacloud/contracts": "0.13.0",
+    "@supacloud/commands": "0.11.0",
+    "@supacloud/delivery": "0.21.0",
     "@graphql-tools/utils": "^12.0.4"
   },
   engines: {
@@ -241,6 +241,727 @@ function isAllowedRedirect(requested, siteUrl, allowList = []) {
   return allowList.some((entry) => globToRegExp(entry).test(requested));
 }
 
+// node_modules/jose/dist/webapi/lib/buffer_utils.js
+var encoder2 = new TextEncoder;
+var decoder2 = new TextDecoder;
+var strictDecoder = new TextDecoder("utf-8", { fatal: true });
+var MAX_INT32 = 2 ** 32;
+function concat(...buffers) {
+  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
+  let i = 0;
+  for (const buffer of buffers)
+    buf.set(buffer, i), i += buffer.length;
+  return buf;
+}
+var NON_ASCII = /[^\x00-\x7f]/;
+function encode(string) {
+  if (typeof string == "string" && string.length >= 128) {
+    if (NON_ASCII.test(string))
+      throw new TypeError("non-ASCII string encountered in encode()");
+    return encoder2.encode(string);
+  }
+  const bytes = new Uint8Array(string.length);
+  for (let i = 0;i < string.length; i++) {
+    const code = string.charCodeAt(i);
+    if (code > 127)
+      throw new TypeError("non-ASCII string encountered in encode()");
+    bytes[i] = code;
+  }
+  return bytes;
+}
+function decodeBase64(encoded, url = false) {
+  if (Uint8Array.fromBase64)
+    return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
+  if (url) {
+    if (encoded.includes("+") || encoded.includes("/"))
+      throw new TypeError("Invalid base64url");
+    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  }
+  const binary = atob(encoded), bytes = new Uint8Array(binary.length);
+  for (let i = 0;i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+
+// node_modules/jose/dist/webapi/util/errors.js
+class JOSEError extends Error {
+  static code = "ERR_JOSE_GENERIC";
+  code = "ERR_JOSE_GENERIC";
+  constructor(message, options) {
+    super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+
+class JWTClaimValidationFailed extends JOSEError {
+  static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  claim;
+  reason;
+  payload;
+  constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
+  }
+}
+
+class JWTExpired extends JOSEError {
+  static code = "ERR_JWT_EXPIRED";
+  code = "ERR_JWT_EXPIRED";
+  claim;
+  reason;
+  payload;
+  constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
+  }
+}
+
+class JOSEAlgNotAllowed extends JOSEError {
+  static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+  code = "ERR_JOSE_ALG_NOT_ALLOWED";
+}
+
+class JOSENotSupported extends JOSEError {
+  static code = "ERR_JOSE_NOT_SUPPORTED";
+  code = "ERR_JOSE_NOT_SUPPORTED";
+}
+class JWSInvalid extends JOSEError {
+  static code = "ERR_JWS_INVALID";
+  code = "ERR_JWS_INVALID";
+}
+
+class JWTInvalid extends JOSEError {
+  static code = "ERR_JWT_INVALID";
+  code = "ERR_JWT_INVALID";
+}
+class JWKSInvalid extends JOSEError {
+  static code = "ERR_JWKS_INVALID";
+  code = "ERR_JWKS_INVALID";
+}
+
+class JWKSNoMatchingKey extends JOSEError {
+  static code = "ERR_JWKS_NO_MATCHING_KEY";
+  code = "ERR_JWKS_NO_MATCHING_KEY";
+  constructor(message = "no applicable key found in the JSON Web Key Set", options) {
+    super(message, options);
+  }
+}
+
+class JWKSMultipleMatchingKeys extends JOSEError {
+  [Symbol.asyncIterator] = async function* () {};
+  static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  constructor(message = "multiple matching keys found in the JSON Web Key Set", options) {
+    super(message, options);
+  }
+}
+
+class JWKSTimeout extends JOSEError {
+  static code = "ERR_JWKS_TIMEOUT";
+  code = "ERR_JWKS_TIMEOUT";
+  constructor(message = "request timed out", options) {
+    super(message, options);
+  }
+}
+
+class JWSSignatureVerificationFailed extends JOSEError {
+  static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  constructor(message = "signature verification failed", options) {
+    super(message, options);
+  }
+}
+
+// node_modules/jose/dist/webapi/util/base64url.js
+var invalid = "The input to be decoded is not correctly encoded.";
+function decode(input) {
+  try {
+    return decodeBase64(typeof input == "string" ? input : decoder2.decode(input), true);
+  } catch (cause) {
+    throw new TypeError(invalid, { cause });
+  }
+}
+
+// node_modules/jose/dist/webapi/lib/validate.js
+function isObject(input) {
+  if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]")
+    return false;
+  const prototype = Object.getPrototypeOf(input);
+  return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+function isJwkSet(input) {
+  return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);
+}
+function isDisjoint(...headers) {
+  const parameters = /* @__PURE__ */ new Set;
+  for (const header of headers)
+    if (header)
+      for (const parameter of Object.keys(header)) {
+        if (parameters.has(parameter))
+          return false;
+        parameters.add(parameter);
+      }
+  return true;
+}
+function decodeBase64url(value, label, ErrorClass) {
+  try {
+    return decode(value);
+  } catch {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  }
+}
+function encodeBase64url(value, label, ErrorClass) {
+  try {
+    return encode(value);
+  } catch {
+    throw new ErrorClass(`The ${label} is not a valid base64url string`);
+  }
+}
+function parseJoseHeader(b64, ErrorClass, message) {
+  let parsed;
+  try {
+    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
+  } catch {
+    throw new ErrorClass(message);
+  }
+  if (!isObject(parsed))
+    throw new ErrorClass(message);
+  return parsed;
+}
+var JWS_RECOGNIZED = { __proto__: null, b64: true };
+function validateAlgorithms(option, algorithms) {
+  if (algorithms !== undefined && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string")))
+    throw new TypeError(`"${option}" option must be an array of strings`);
+  return algorithms === undefined ? undefined : new Set(algorithms);
+}
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+  if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined)
+    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+  if (!protectedHeader || protectedHeader.crit === undefined)
+    return [];
+  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0))
+    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  const recognized = recognizedOption === undefined ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
+  for (const parameter of protectedHeader.crit) {
+    if (!(parameter in recognized))
+      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === undefined)
+      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === undefined))
+      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+  }
+  return protectedHeader.crit;
+}
+function validateB64(protectedHeader, extensions) {
+  if (extensions.includes("b64")) {
+    const b64 = protectedHeader.b64;
+    if (typeof b64 != "boolean")
+      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+    return b64;
+  }
+  return true;
+}
+
+// node_modules/jose/dist/webapi/lib/key.js
+var tag = (key) => key[Symbol.toStringTag];
+var jwkMatchesOp = (entry, key, usage) => {
+  const { alg } = entry;
+  if (key.use !== undefined) {
+    const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
+    if (key.use !== expected)
+      throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+  }
+  if (key.alg !== undefined && key.alg !== alg)
+    throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+  if (Array.isArray(key.key_ops)) {
+    const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
+    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))
+      throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+  }
+};
+async function prepareKey(entry, key, usage) {
+  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+  if (secret && key instanceof Uint8Array)
+    return key;
+  let normalized, keyObject;
+  if (isObject(key)) {
+    if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
+      throw invalidKeyType(alg, key, secret);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === undefined && normalized.priv === undefined)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
+      return decode(normalized.k);
+    if (!Object.isFrozen(key)) {
+      const { key_ops } = key;
+      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
+    }
+  } else {
+    if (!isKeyLike(key))
+      throw invalidKeyType(alg, key, secret);
+    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
+      throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+    if (isCryptoKey(key))
+      return key;
+    if (keyObject = key, keyObject.type === "secret")
+      return keyObject.export();
+  }
+  cache ||= /* @__PURE__ */ new WeakMap;
+  const cacheKey = key;
+  let cached = cache.get(cacheKey);
+  if (cached?.[alg])
+    return cached[alg];
+  if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+    const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;
+    return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
+  }
+  return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
+}
+var cache;
+var nist = {
+  __proto__: null,
+  prime256v1: "P-256",
+  secp384r1: "P-384",
+  secp521r1: "P-521"
+};
+var isCryptoKey = (key) => {
+  if (key?.[Symbol.toStringTag] === "CryptoKey")
+    return true;
+  try {
+    return key instanceof CryptoKey;
+  } catch {
+    return false;
+  }
+};
+var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+  if (types.length > 2) {
+    const last = types.pop();
+    msg += `one of type ${types.join(", ")}, or ${last}.`;
+  } else
+    types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+  return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+}
+function invalidKeyType(alg, actual, secret) {
+  const types = ["CryptoKey", "KeyObject", "JSON Web Key"];
+  return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
+}
+var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+  if (usage && !key.usages.includes(usage))
+    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkModulusLength(alg, key) {
+  const { modulusLength } = key.algorithm;
+  if (typeof modulusLength != "number" || modulusLength < 2048)
+    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+}
+function checkCryptoKey(key, expected, usage) {
+  const algorithm = key.algorithm;
+  if (algorithm.name !== expected.name)
+    throw unusable(expected.name);
+  if (expected.hash && algorithm.hash?.name !== expected.hash)
+    throw unusable(expected.hash, "algorithm.hash");
+  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)
+    throw unusable(expected.namedCurve, "algorithm.namedCurve");
+  if (expected.length !== undefined && algorithm.length !== expected.length)
+    throw unusable(expected.length, "algorithm.length");
+  checkUsage(key, usage);
+}
+function snapshotJwk(jwk) {
+  return { __proto__: null, ...jwk };
+}
+function normalizeJwk(jwk) {
+  const normalized = snapshotJwk(jwk);
+  if (normalized.ext !== undefined && typeof normalized.ext != "boolean")
+    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+  if (normalized.key_ops !== undefined) {
+    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : undefined;
+    if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length)
+      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+    normalized.key_ops = keyOps;
+  }
+  return normalized;
+}
+async function jwkToKey(entry, jwk, extractable) {
+  if (!entry.kty.includes(jwk.kty))
+    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };
+  return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+async function rawKey(key, expected, usage, extractable = false) {
+  return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
+}
+
+// node_modules/jose/dist/webapi/lib/key_descriptor.js
+function table(entries) {
+  const out = { __proto__: null };
+  for (const alg in entries)
+    out[alg] = { ...entries[alg], alg };
+  return out;
+}
+
+// node_modules/jose/dist/webapi/lib/jws_algorithms.js
+var sig = [["verify"], ["sign"]];
+function hmac(bits) {
+  const subtle = { name: "HMAC", hash: `SHA-${bits}` };
+  return { kty: ["oct"], secret: true, subtle, signing: subtle, usages: sig };
+}
+function rsa(bits, saltLength) {
+  const subtle = { name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5", hash: `SHA-${bits}` };
+  return {
+    kty: ["RSA"],
+    subtle,
+    signing: saltLength ? { ...subtle, saltLength } : subtle,
+    usages: sig,
+    minRsaBits: 2048
+  };
+}
+function ecdsa(crv, bits) {
+  return {
+    kty: ["EC"],
+    crv,
+    subtle: { name: "ECDSA", namedCurve: crv },
+    signing: { name: "ECDSA", hash: `SHA-${bits}` },
+    usages: sig
+  };
+}
+function eddsa() {
+  const subtle = { name: "Ed25519" };
+  return {
+    kty: ["OKP"],
+    crv: "Ed25519",
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+function mldsa(bits) {
+  const subtle = { name: `ML-DSA-${bits}` };
+  return {
+    kty: ["AKP"],
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+var JWS = table({
+  HS256: hmac(256),
+  HS384: hmac(384),
+  HS512: hmac(512),
+  RS256: rsa(256),
+  RS384: rsa(384),
+  RS512: rsa(512),
+  PS256: rsa(256, 32),
+  PS384: rsa(384, 48),
+  PS512: rsa(512, 64),
+  ES256: ecdsa("P-256", 256),
+  ES384: ecdsa("P-384", 384),
+  ES512: ecdsa("P-521", 512),
+  EdDSA: eddsa(),
+  Ed25519: eddsa(),
+  "ML-DSA-44": mldsa(44),
+  "ML-DSA-65": mldsa(65),
+  "ML-DSA-87": mldsa(87)
+});
+function jwsAlgorithm(alg) {
+  const entry = typeof alg == "string" ? JWS[alg] : undefined;
+  if (!entry)
+    throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+  return entry;
+}
+
+// node_modules/jose/dist/webapi/lib/jws_verify.js
+function prepareVerify(options) {
+  return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
+}
+function parseProtectedHeader(encodedProtected) {
+  return encodedProtected === undefined ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+}
+function encodeCompactUnencodedPayload(payload) {
+  try {
+    return encode(payload);
+  } catch {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+  }
+}
+async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
+  if (!isDisjoint(parsedProt, header))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  if (shared[0] && !shared[0].has(alg))
+    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+  if (b64) {
+    if (typeof inputPayload != "string")
+      throw new JWSInvalid("JWS Payload must be a string");
+  } else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array))
+    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+  const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
+  let resolvedKey = false;
+  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = true);
+  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== undefined ? encode(encodedProtected) : new Uint8Array, encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
+  let verified = false;
+  try {
+    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+  } catch {}
+  if (!verified)
+    throw new JWSSignatureVerificationFailed;
+  const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
+  return encodedProtected !== undefined && (result.protectedHeader = parsedProt), header !== undefined && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
+}
+async function verifyCompact(jws, shared, key) {
+  if (jws instanceof Uint8Array && (jws = decoder2.decode(jws)), typeof jws != "string")
+    throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+  const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
+  if (length !== 3)
+    throw new JWSInvalid("Invalid Compact JWS");
+  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);
+}
+
+// node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+var epoch = (date) => Math.floor(date.getTime() / 1000);
+var multipliers = {
+  s: 1,
+  m: 60,
+  h: 3600,
+  d: 86400,
+  w: 604800,
+  y: 31557600
+};
+var REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+var checkFailed = "check_failed";
+function invalidDuration() {
+  throw new TypeError("Invalid time period format");
+}
+function secs(str) {
+  typeof str != "string" && invalidDuration();
+  const matched = REGEX.exec(str);
+  (!matched || matched[4] && matched[1]) && invalidDuration();
+  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+}
+function validateInput(label, input) {
+  if (!Number.isFinite(input))
+    throw new TypeError(`Invalid ${label} input`);
+  return input;
+}
+var normalizeTyp = (value) => {
+  const normalized = value.toLowerCase();
+  return value.includes("/") ? normalized : `application/${normalized}`;
+};
+var checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;
+function validateNumericDate(payload, claim, required = false) {
+  const value = payload[claim];
+  if (!(value === undefined && !required)) {
+    if (typeof value != "number")
+      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+    return value;
+  }
+}
+function unexpectedClaim(payload, claim) {
+  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+}
+function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+  let payload;
+  try {
+    payload = JSON.parse(strictDecoder.decode(encodedPayload));
+  } catch {}
+  if (!isObject(payload))
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+  const { typ } = options;
+  if (typ !== undefined && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
+  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+  maxTokenAge !== undefined && presenceCheck.push("iat"), audience !== undefined && presenceCheck.push("aud"), subject !== undefined && presenceCheck.push("sub"), issuer !== undefined && presenceCheck.push("iss");
+  for (const claim of new Set(presenceCheck.reverse()))
+    if (!Object.hasOwn(payload, claim))
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+  issuer !== undefined && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== undefined && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== undefined && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+  const { clockTolerance } = options;
+  let tolerance = 0;
+  if (typeof clockTolerance == "string")
+    tolerance = secs(clockTolerance);
+  else if (clockTolerance !== undefined) {
+    if (typeof clockTolerance != "number")
+      throw new TypeError("Invalid clockTolerance option type");
+    tolerance = clockTolerance;
+  }
+  validateInput("clockTolerance option", tolerance);
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === undefined ? /* @__PURE__ */ new Date : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== undefined), nbf = validateNumericDate(payload, "nbf");
+  if (nbf !== undefined && nbf > now + tolerance)
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
+  const exp = validateNumericDate(payload, "exp");
+  if (exp !== undefined && exp <= now - tolerance)
+    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
+  if (maxTokenAge !== undefined) {
+    const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+    if (age - tolerance > max)
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
+    if (age < -tolerance)
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
+  }
+  return payload;
+}
+
+// node_modules/jose/dist/webapi/jwt/verify.js
+async function jwtVerify(jwt, key, options) {
+  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+  if (!b64)
+    throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+  return { ...verified, payload };
+}
+
+// node_modules/jose/dist/webapi/jwks/local.js
+function isUsableJWK(jwk, entry, alg, kid) {
+  const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;
+  return (ext === undefined || typeof ext == "boolean") && (keyOps === undefined || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === undefined || typeof kid == "string" && kid === jwkKid) && (jwkAlg === undefined ? kty !== "AKP" : alg === jwkAlg) && (use === undefined || use === "sig") && (!entry.crv || crv === entry.crv);
+}
+async function importWithAlgCache(cache, jwk, entry) {
+  const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;
+  if (cached[alg] === undefined) {
+    const pending = jwkToKey(entry, jwk, true).then((key) => {
+      if (key.type !== "public")
+        throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+      return cached[alg] = key, key;
+    }).catch((error) => {
+      throw cached[alg] === pending && delete cached[alg], error;
+    });
+    cached[alg] = pending;
+  }
+  return cached[alg];
+}
+function createLocalJWKSet(jwks) {
+  let snapshot;
+  try {
+    snapshot = structuredClone(jwks);
+  } catch {}
+  if (!isJwkSet(snapshot))
+    throw new JWKSInvalid("JSON Web Key Set malformed");
+  const metadata = snapshot.keys.map((jwk) => {
+    const normalized = snapshotJwk(jwk);
+    return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;
+  }), cached = /* @__PURE__ */ new WeakMap;
+  return Object.defineProperty(async (protectedHeader, token) => {
+    const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == "string" ? JWS[alg] : undefined;
+    if (!entry || entry.secret)
+      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;
+    if (!length)
+      throw new JWKSNoMatchingKey;
+    if (length !== 1) {
+      const error = new JWKSMultipleMatchingKeys;
+      throw error[Symbol.asyncIterator] = async function* () {
+        for (const jwk2 of candidates)
+          try {
+            yield await importWithAlgCache(cached, jwk2, entry);
+          } catch {}
+      }, error;
+    }
+    return importWithAlgCache(cached, jwk, entry);
+  }, "jwks", {
+    value: () => structuredClone(snapshot)
+  });
+}
+
+// node_modules/jose/dist/webapi/jwks/remote.js
+function isCloudflareWorkers() {
+  return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
+}
+var USER_AGENT;
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
+var customFetch = /* @__PURE__ */ Symbol();
+async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
+  const response = await fetchImpl(url, {
+    method: "GET",
+    signal,
+    redirect: "manual",
+    headers
+  }).catch((err) => {
+    throw err.name === "TimeoutError" ? new JWKSTimeout : err;
+  });
+  if (response.status !== 200)
+    throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
+  try {
+    return await response.json();
+  } catch {
+    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+  }
+}
+var jwksCache = /* @__PURE__ */ Symbol();
+function isFreshFor(timestamp, duration) {
+  return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
+}
+function validateDuration(value, fallback, option) {
+  if (Number.isNaN(value))
+    throw new TypeError(`"${option}" option must not be NaN`);
+  return typeof value == "number" ? value : fallback;
+}
+function createRemoteJWKSet(url, options) {
+  if (!(url instanceof URL))
+    throw new TypeError("url must be an instance of URL");
+  const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;
+  if (typeof timeoutOption == "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))
+    throw new TypeError('"timeoutDuration" option must be a non-negative integer');
+  const timeoutDuration = typeof timeoutOption == "number" ? timeoutOption : 5000, cooldownDuration = validateDuration(opts.cooldownDuration, 30000, "cooldownDuration"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 600000, "cacheMaxAge"), headers = new Headers(opts.headers);
+  USER_AGENT && !headers.has("User-Agent") && headers.set("User-Agent", USER_AGENT), headers.has("accept") || headers.set("accept", "application/json, application/jwk-set+json");
+  const fetchImpl = opts[customFetch], cache = opts[jwksCache];
+  let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;
+  if (cache && typeof cache == "object") {
+    const { uat, jwks } = cache;
+    isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));
+  }
+  const reload = async () => {
+    if (pendingFetch && isCloudflareWorkers() && (pendingFetch = undefined), !pendingFetch) {
+      const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+        const next = createLocalJWKSet(json);
+        if (sequence <= appliedSequence)
+          return;
+        local = next;
+        const updatedAt = Date.now();
+        cache && (cache.uat = updatedAt, cache.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;
+      }).finally(() => {
+        pendingFetch === current && (pendingFetch = undefined);
+      });
+    }
+    await pendingFetch;
+  };
+  return Object.defineProperties(async (protectedHeader, token) => {
+    (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();
+    try {
+      return await local(protectedHeader, token);
+    } catch (err) {
+      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))
+        return await reload(), local(protectedHeader, token);
+      throw err;
+    }
+  }, {
+    coolingDown: {
+      get: () => isFreshFor(jwksTimestamp, cooldownDuration),
+      enumerable: true
+    },
+    fresh: {
+      get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
+      enumerable: true
+    },
+    reload: {
+      value: reload,
+      enumerable: true
+    },
+    reloading: {
+      get: () => !!pendingFetch,
+      enumerable: true
+    },
+    jwks: {
+      value: () => local?.jwks(),
+      enumerable: true
+    }
+  });
+}
+
 // src/runtime/auth/oauth.ts
 class OAuthAccountIneligibleError extends Error {
   code;
@@ -249,12 +970,22 @@ class OAuthAccountIneligibleError extends Error {
     this.code = code;
   }
 }
+
+class OAuthIdentityLinkError extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+}
 var PRESETS = {
   google: {
     authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
     tokenUrl: "https://oauth2.googleapis.com/token",
     userInfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
     scopes: "openid email profile",
+    idTokenIssuer: "https://accounts.google.com",
+    idTokenJwksUrl: "https://www.googleapis.com/oauth2/v3/certs",
     profileMap: (r) => ({
       id: typeof r["sub"] === "string" ? r["sub"] : "",
       ...typeof r["email"] === "string" ? { email: r["email"] } : {},
@@ -263,6 +994,20 @@ var PRESETS = {
       metadata: { avatar_url: r["picture"], full_name: r["name"] }
     })
   },
+  apple: {
+    authorizeUrl: "https://appleid.apple.com/auth/authorize",
+    tokenUrl: "https://appleid.apple.com/auth/token",
+    userInfoUrl: "https://appleid.apple.com/auth/userinfo",
+    scopes: "name email",
+    idTokenIssuer: "https://appleid.apple.com",
+    idTokenJwksUrl: "https://appleid.apple.com/auth/keys",
+    profileMap: (r) => ({
+      id: typeof r["sub"] === "string" ? r["sub"] : "",
+      ...typeof r["email"] === "string" ? { email: r["email"] } : {},
+      emailVerified: r["email_verified"] === true || r["email_verified"] === "true",
+      ...typeof r["name"] === "string" ? { name: r["name"] } : {}
+    })
+  },
   github: {
     authorizeUrl: "https://github.com/login/oauth/authorize",
     tokenUrl: "https://github.com/login/oauth/access_token",
@@ -296,7 +1041,10 @@ function resolveProvider(name, cfg) {
       id: String(r["id"] ?? r["sub"]),
       ...typeof r["email"] === "string" ? { email: r["email"] } : {},
       ...typeof r["name"] === "string" ? { name: r["name"] } : {}
-    }))
+    })),
+    ...(cfg.idTokenIssuer ?? preset.idTokenIssuer) === undefined ? {} : { idTokenIssuer: cfg.idTokenIssuer ?? preset.idTokenIssuer },
+    ...(cfg.idTokenJwksUrl ?? preset.idTokenJwksUrl) === undefined ? {} : { idTokenJwksUrl: cfg.idTokenJwksUrl ?? preset.idTokenJwksUrl },
+    ...(cfg.idTokenAudience ?? preset.idTokenAudience) === undefined ? {} : { idTokenAudience: cfg.idTokenAudience ?? preset.idTokenAudience }
   };
 }
 
@@ -308,6 +1056,7 @@ class OAuthService {
   uriAllowList;
   enforceRedirectAllowList;
   providers = new Map;
+  idTokenKeySets = new Map;
   constructor(db, apiUrl, siteUrl, configs, fetchImpl = fetch, uriAllowList = [], enforceRedirectAllowList = false) {
     this.db = db;
     this.apiUrl = apiUrl;
@@ -316,31 +1065,99 @@ class OAuthService {
     this.uriAllowList = uriAllowList;
     this.enforceRedirectAllowList = enforceRedirectAllowList;
     for (const [name, cfg] of Object.entries(configs)) {
-      this.providers.set(name, resolveProvider(name, cfg));
+      const provider = resolveProvider(name, cfg);
+      this.providers.set(name, provider);
+      if (provider.idTokenJwksUrl) {
+        this.idTokenKeySets.set(name, createRemoteJWKSet(new URL(provider.idTokenJwksUrl), {
+          timeoutDuration: 5000,
+          cooldownDuration: 30000,
+          cacheMaxAge: 10 * 60000,
+          [customFetch]: async (url, options) => this.fetchImpl(url, options)
+        }));
+      }
     }
   }
   has(name) {
     return this.providers.has(name);
   }
+  async signInWithIdToken(providerName, token, accessToken, nonce) {
+    const profile = await this.verifyIdToken(providerName, token, accessToken, nonce);
+    if (!profile)
+      return null;
+    return this.upsertUser(providerName, profile);
+  }
+  async linkIdentityWithIdToken(providerName, token, userId, accessToken, nonce) {
+    const profile = await this.verifyIdToken(providerName, token, accessToken, nonce);
+    if (!profile)
+      return false;
+    await this.linkIdentityToUser(providerName, profile, userId);
+    return true;
+  }
+  async signInWithProfile(provider, profile) {
+    return this.upsertUser(provider, profile);
+  }
+  async verifyIdToken(providerName, token, accessToken, nonce) {
+    const provider = this.providers.get(providerName);
+    const keySet = this.idTokenKeySets.get(providerName);
+    if (!provider?.idTokenIssuer || !keySet || !token)
+      return null;
+    let payload;
+    let algorithm;
+    try {
+      const verified = await jwtVerify(token, keySet, {
+        issuer: provider.idTokenIssuer,
+        audience: provider.idTokenAudience ?? provider.clientId,
+        algorithms: ["RS256", "ES256"]
+      });
+      payload = verified.payload;
+      algorithm = verified.protectedHeader.alg ?? "";
+    } catch {
+      return null;
+    }
+    if (typeof payload.sub !== "string" || payload.sub.length === 0)
+      return null;
+    if (payload["nonce"] !== undefined && (typeof payload["nonce"] !== "string" || payload["nonce"] !== nonce))
+      return null;
+    const acceptedAudiences = provider.idTokenAudience ?? provider.clientId;
+    if (Array.isArray(payload.aud) && payload.aud.length > 1 && (typeof payload["azp"] !== "string" || (Array.isArray(acceptedAudiences) ? !acceptedAudiences.includes(payload["azp"]) : payload["azp"] !== acceptedAudiences)))
+      return null;
+    if (typeof payload["at_hash"] === "string") {
+      if (!accessToken || await oidcAtHash(accessToken, algorithm) !== payload["at_hash"])
+        return null;
+    }
+    let profile;
+    try {
+      profile = provider.profileMap(payload);
+    } catch {
+      return null;
+    }
+    if (!profile.id)
+      return null;
+    return profile;
+  }
   callbackUrl() {
     return `${this.apiUrl}/auth/v1/callback`;
   }
-  async authorize(url) {
+  async authorize(url, linkUserId) {
     const providerName = url.searchParams.get("provider") ?? "";
     const provider = this.providers.get(providerName);
     if (!provider) {
-      return redirect(`${this.siteUrl}#error=provider_not_enabled&error_description=${encodeURIComponent(`provider ${providerName} is not configured`)}`);
+      return redirectWithFragment(this.siteUrl, {
+        error: "provider_not_enabled",
+        error_description: `provider ${providerName} is not configured`
+      });
     }
     const providerState = randomToken(16);
     const scopes = url.searchParams.get("scopes") || provider.scopes;
     const redirectTo = resolveRedirect(url.searchParams.get("redirect_to"), this.siteUrl, this.uriAllowList, this.enforceRedirectAllowList);
-    await this.db.query(`insert into auth.flow_state (provider, provider_state, redirect_to, code_challenge, code_challenge_method, expires_at)
-       values ($1, $2, $3, $4, $5, now() + interval '10 minutes')`, [
+    await this.db.query(`insert into auth.flow_state (provider, provider_state, redirect_to, code_challenge, code_challenge_method, link_user_id, expires_at)
+       values ($1, $2, $3, $4, $5, $6, now() + interval '10 minutes')`, [
       providerName,
       providerState,
       redirectTo,
       url.searchParams.get("code_challenge"),
-      url.searchParams.get("code_challenge_method")
+      url.searchParams.get("code_challenge_method"),
+      linkUserId ?? null
     ]);
     const p = new URLSearchParams({
       client_id: provider.clientId,
@@ -349,57 +1166,99 @@ class OAuthService {
       scope: scopes,
       state: providerState
     });
-    return redirect(`${provider.authorizeUrl}?${p}`);
+    const reserved = new Set([
+      "provider",
+      "redirect_to",
+      "scopes",
+      "code_challenge",
+      "code_challenge_method",
+      "skip_http_redirect",
+      "client_id",
+      "redirect_uri",
+      "response_type",
+      "scope",
+      "state"
+    ]);
+    for (const [key, value] of url.searchParams) {
+      if (!reserved.has(key))
+        p.append(key, value);
+    }
+    const providerUrl = `${provider.authorizeUrl}?${p}`;
+    if (url.searchParams.get("skip_http_redirect") === "true") {
+      return Response.json({ url: providerUrl });
+    }
+    return redirect(providerUrl);
   }
   async callback(url, createSession) {
     const code = url.searchParams.get("code");
     const state = url.searchParams.get("state");
     if (!code || !state)
-      return redirect(`${this.siteUrl}#error=invalid_request`);
+      return redirectWithFragment(this.siteUrl, { error: "invalid_request" });
     const res = await this.db.query(`delete from auth.flow_state where provider_state = $1 and expires_at > now() returning *`, [state]);
     const flow = res.rows[0];
     if (!flow)
-      return redirect(`${this.siteUrl}#error=invalid_state`);
+      return redirectWithFragment(this.siteUrl, { error: "invalid_state" });
     const provider = this.providers.get(flow.provider);
     if (!provider)
-      return redirect(`${flow.redirect_to}#error=provider_not_enabled`);
+      return redirectWithFragment(flow.redirect_to, { error: "provider_not_enabled" });
     let profile;
     try {
       const token = await this.exchangeCode(provider, code);
       profile = await this.fetchProfile(provider, token);
-    } catch (e) {
-      const msg = encodeURIComponent(e instanceof Error ? e.message : "oauth_error");
-      return redirect(`${flow.redirect_to}#error=server_error&error_description=${msg}`);
+    } catch {
+      return redirectWithFragment(flow.redirect_to, {
+        error: "server_error",
+        error_description: "OAuth provider request failed"
+      });
     }
     let userId;
     try {
-      userId = await this.upsertUser(provider.name, profile);
+      if (flow.link_user_id) {
+        await this.linkIdentityToUser(provider.name, profile, flow.link_user_id);
+        userId = flow.link_user_id;
+      } else {
+        userId = await this.upsertUser(provider.name, profile);
+      }
     } catch (e) {
       if (e instanceof OAuthAccountIneligibleError) {
-        return redirect(`${flow.redirect_to}#error=access_denied&error_code=${e.code}`);
+        return redirectWithFragment(flow.redirect_to, { error: "access_denied", error_code: e.code });
       }
-      throw e;
+      if (e instanceof OAuthIdentityLinkError) {
+        return redirectWithFragment(flow.redirect_to, { error: "access_denied", error_code: e.code });
+      }
+      return redirectWithFragment(flow.redirect_to, {
+        error: "server_error",
+        error_description: "OAuth callback failed"
+      });
     }
     if (flow.code_challenge) {
       const authCode = randomToken(24);
       await this.db.query(`insert into auth.flow_state (provider, provider_state, redirect_to, code_challenge, code_challenge_method, auth_code, user_id, expires_at)
          values ($1, $2, $3, $4, $5, $6, $7, now() + interval '5 minutes')`, [flow.provider, randomToken(16), flow.redirect_to, flow.code_challenge, flow.code_challenge_method, authCode, userId]);
-      return redirect(`${flow.redirect_to}?code=${authCode}`);
+      return redirectWithQuery(flow.redirect_to, { code: authCode });
     }
     let session;
     try {
       session = await createSession(userId);
     } catch (e) {
       if (e instanceof OAuthAccountIneligibleError) {
-        return redirect(`${flow.redirect_to}#error=access_denied&error_code=${e.code}`);
+        return redirectWithFragment(flow.redirect_to, { error: "access_denied", error_code: e.code });
       }
-      throw e;
+      return redirectWithFragment(flow.redirect_to, {
+        error: "server_error",
+        error_description: "OAuth callback failed"
+      });
     }
-    const hash = `#access_token=${session.access_token}&refresh_token=${session.refresh_token}&expires_in=${session.expires_in}&token_type=bearer&provider_token=`;
-    return redirect(`${flow.redirect_to}${hash}`);
+    return redirectWithFragment(flow.redirect_to, {
+      access_token: session.access_token,
+      refresh_token: session.refresh_token,
+      expires_in: String(session.expires_in),
+      token_type: "bearer",
+      provider_token: ""
+    });
   }
   async exchangePkce(authCode, verifier) {
-    const res = await this.db.query(`delete from auth.flow_state where auth_code = $1 and expires_at > now() returning *`, [authCode]);
+    const res = await this.db.query(`select * from auth.flow_state where auth_code = $1 and expires_at > now()`, [authCode]);
     const flow = res.rows[0];
     if (!flow || !flow.user_id)
       return null;
@@ -411,7 +1270,11 @@ class OAuthService {
     } else if (flow.code_challenge && flow.code_challenge !== verifier) {
       return null;
     }
-    return flow.user_id;
+    const claimed = await this.db.transaction(async (query) => {
+      const consumed = await query(`delete from auth.flow_state where auth_code = $1 and expires_at > now() returning *`, [authCode]);
+      return consumed.rows[0] ?? null;
+    });
+    return claimed?.user_id ?? null;
   }
   async exchangeCode(provider, code) {
     const body = new URLSearchParams({
@@ -447,6 +1310,20 @@ class OAuthService {
   async upsertUser(provider, profile) {
     return this.db.transaction((query) => this.upsertUserInTransaction(query, provider, profile));
   }
+  async linkIdentityToUser(provider, profile, userId) {
+    await this.db.transaction(async (query) => {
+      await this.assertUserEligible(query, userId);
+      const identityData = JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata });
+      const inserted = await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+         values ($1, $2, $3, $4::jsonb)
+         on conflict (provider, provider_id) do nothing
+         returning user_id`, [userId, provider, profile.id, identityData]);
+      if (inserted.rows.length === 0) {
+        throw new OAuthIdentityLinkError("identity_already_exists");
+      }
+      await this.syncUserProviders(query, userId);
+    });
+  }
   async upsertUserInTransaction(query, provider, profile) {
     const existing = await query(`select user_id from auth.identities where provider = $1 and provider_id = $2`, [provider, profile.id]);
     if (existing.rows[0]) {
@@ -457,42 +1334,90 @@ class OAuthService {
         JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata })
       ]);
       await query(`update auth.users set last_sign_in_at = now() where id = $1`, [existing.rows[0].user_id]);
+      await this.syncUserProviders(query, existing.rows[0].user_id);
       return existing.rows[0].user_id;
     }
     let userId;
-    const email = profile.email?.toLowerCase() ?? null;
-    const verified = !!profile.email && profile.emailVerified === true;
+    const email = typeof profile.email === "string" ? profile.email.toLowerCase().trim() || null : null;
+    const verified = email !== null && profile.emailVerified === true;
     if (email && verified) {
-      const byEmail = await query(`select id from auth.users where email = $1`, [email]);
+      const byEmail = await query(`select id from auth.users where lower(email) = $1`, [email]);
       userId = byEmail.rows[0]?.id;
       if (userId)
         await this.assertUserEligible(query, userId);
     }
+    let createdUserId;
     if (!userId) {
       let userEmail = verified ? email : null;
       if (userEmail) {
-        const taken = await query(`select 1 from auth.users where email = $1`, [userEmail]);
+        const taken = await query(`select 1 from auth.users where lower(email) = $1`, [userEmail]);
         if (taken.rows.length > 0)
           userEmail = null;
       }
       const created = await query(`insert into auth.users (aud, role, email, email_confirmed_at, last_sign_in_at, raw_app_meta_data, raw_user_meta_data)
          values ('authenticated','authenticated',$1, $2, now(),
-                 $3::jsonb, $4::jsonb) returning id`, [
+                 $3::jsonb, $4::jsonb)
+         on conflict (email) do nothing
+         returning id`, [
         userEmail,
         userEmail ? new Date().toISOString() : null,
         JSON.stringify({ provider, providers: [provider] }),
         JSON.stringify({ sub: profile.id, email: profile.email, full_name: profile.name, ...profile.metadata })
       ]);
       const user = created.rows[0];
-      if (!user)
+      if (user) {
+        userId = user.id;
+        createdUserId = user.id;
+      } else if (userEmail) {
+        const existingEmail = await query(`select id from auth.users where lower(email) = $1 for update`, [userEmail]);
+        userId = existingEmail.rows[0]?.id;
+        if (!userId)
+          throw new Error("OAuth email conflict has no winner");
+        await this.assertUserEligible(query, userId);
+      } else {
         throw new Error("OAuth user creation returned no row");
-      userId = user.id;
+      }
     }
-    await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
-       values ($1, $2, $3, $4::jsonb)`, [userId, provider, profile.id, JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata })]);
-    if (!userId)
-      throw new Error("OAuth identity has no user ID");
-    return userId;
+    const identityData = JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata });
+    const linked = await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+       values ($1, $2, $3, $4::jsonb)
+       on conflict (provider, provider_id) do nothing
+       returning user_id`, [userId, provider, profile.id, identityData]);
+    if (linked.rows[0]) {
+      await this.syncUserProviders(query, linked.rows[0].user_id);
+      return linked.rows[0].user_id;
+    }
+    const raced = await query(`select user_id from auth.identities where provider = $1 and provider_id = $2`, [provider, profile.id]);
+    const racedUserId = raced.rows[0]?.user_id;
+    if (!racedUserId)
+      throw new Error("OAuth identity conflict has no winner");
+    if (createdUserId && createdUserId !== racedUserId) {
+      await query(`delete from auth.users where id = $1`, [createdUserId]);
+    }
+    await this.assertUserEligible(query, racedUserId);
+    await query(`update auth.identities set last_sign_in_at = now(), identity_data = $3
+       where provider = $1 and provider_id = $2`, [provider, profile.id, identityData]);
+    await query(`update auth.users set last_sign_in_at = now() where id = $1`, [racedUserId]);
+    await this.syncUserProviders(query, racedUserId);
+    return racedUserId;
+  }
+  async syncUserProviders(query, userId) {
+    await query(`update auth.users
+       set raw_app_meta_data = jsonb_set(
+         coalesce(raw_app_meta_data, '{}'::jsonb),
+         '{providers}',
+         (
+           select jsonb_agg(provider order by provider)
+           from (
+             select distinct provider
+             from auth.identities
+             where user_id = $1
+           ) as providers
+         ),
+         true
+       ),
+       updated_at = now()
+       where id = $1`, [userId]);
   }
   async assertUserEligible(query, userId) {
     const users = await query(`select deleted_at is not null as is_deleted,
@@ -505,9 +1430,27 @@ class OAuthService {
       throw new OAuthAccountIneligibleError("user_banned");
   }
 }
+async function oidcAtHash(accessToken, algorithm) {
+  const hash = algorithm === "RS256" || algorithm === "ES256" ? "SHA-256" : null;
+  if (!hash)
+    return null;
+  const digest = new Uint8Array(await crypto.subtle.digest(hash, new TextEncoder().encode(accessToken)));
+  return base64url(digest.subarray(0, digest.length / 2));
+}
 function redirect(location) {
   return new Response(null, { status: 303, headers: { location } });
 }
+function redirectWithQuery(location, params) {
+  const target = new URL(location);
+  for (const [key, value] of Object.entries(params))
+    target.searchParams.set(key, value);
+  return redirect(target.toString());
+}
+function redirectWithFragment(location, params) {
+  const target = new URL(location);
+  target.hash = new URLSearchParams(params).toString();
+  return redirect(target.toString());
+}
 function base64url(bytes) {
   let bin = "";
   for (const b of bytes)
@@ -1011,6 +1954,7 @@ var DEFAULT_AUTH_SETTINGS = {
   anonymousUsers: true,
   autoconfirm: true,
   minPasswordLength: 6,
+  requirePasswordReauthentication: false,
   disabledProviders: [],
   otpLength: 6,
   otpExpirySeconds: 3600,
@@ -1020,7 +1964,13 @@ var DEFAULT_AUTH_SETTINGS = {
   smsTemplate: "Your one-time code is {{ .Code }}",
   maxEnrolledFactors: 10,
   totpEnrollEnabled: true,
-  totpVerifyEnabled: true
+  totpVerifyEnabled: true,
+  recoveryCodesEnrollEnabled: true,
+  recoveryCodesVerifyEnabled: true,
+  recoveryCodesCount: 10,
+  recoveryCodeLength: 16,
+  recoveryCodesMaxVerifyAttempts: 5,
+  recoveryCodesLockoutSeconds: 300
 };
 function sanitize(raw) {
   const s = { ...DEFAULT_AUTH_SETTINGS };
@@ -1033,6 +1983,9 @@ function sanitize(raw) {
   if (typeof raw["minPasswordLength"] === "number" && Number.isFinite(raw["minPasswordLength"])) {
     s.minPasswordLength = Math.max(4, Math.min(72, Math.floor(raw["minPasswordLength"])));
   }
+  if (typeof raw["requirePasswordReauthentication"] === "boolean") {
+    s.requirePasswordReauthentication = raw["requirePasswordReauthentication"];
+  }
   if (Array.isArray(raw["disabledProviders"])) {
     s.disabledProviders = raw["disabledProviders"].filter((p) => typeof p === "string").slice(0, 50);
   }
@@ -1059,6 +2012,22 @@ function sanitize(raw) {
     s.totpEnrollEnabled = raw["totpEnrollEnabled"];
   if (typeof raw["totpVerifyEnabled"] === "boolean")
     s.totpVerifyEnabled = raw["totpVerifyEnabled"];
+  if (typeof raw["recoveryCodesEnrollEnabled"] === "boolean")
+    s.recoveryCodesEnrollEnabled = raw["recoveryCodesEnrollEnabled"];
+  if (typeof raw["recoveryCodesVerifyEnabled"] === "boolean")
+    s.recoveryCodesVerifyEnabled = raw["recoveryCodesVerifyEnabled"];
+  if (typeof raw["recoveryCodesCount"] === "number" && Number.isFinite(raw["recoveryCodesCount"])) {
+    s.recoveryCodesCount = Math.max(1, Math.min(50, Math.floor(raw["recoveryCodesCount"])));
+  }
+  if (typeof raw["recoveryCodeLength"] === "number" && Number.isFinite(raw["recoveryCodeLength"])) {
+    s.recoveryCodeLength = Math.max(8, Math.min(64, Math.floor(raw["recoveryCodeLength"])));
+  }
+  if (typeof raw["recoveryCodesMaxVerifyAttempts"] === "number" && Number.isFinite(raw["recoveryCodesMaxVerifyAttempts"])) {
+    s.recoveryCodesMaxVerifyAttempts = Math.max(1, Math.min(20, Math.floor(raw["recoveryCodesMaxVerifyAttempts"])));
+  }
+  if (typeof raw["recoveryCodesLockoutSeconds"] === "number" && Number.isFinite(raw["recoveryCodesLockoutSeconds"])) {
+    s.recoveryCodesLockoutSeconds = Math.max(1, Math.min(86400, Math.floor(raw["recoveryCodesLockoutSeconds"])));
+  }
   return s;
 }
 async function loadAuthSettings(db, defaults = {}) {
@@ -1197,10 +2166,156 @@ async function verifyTotp(secretBase32, code, window = 1, atMs = Date.now()) {
   return false;
 }
 
+// src/runtime/auth/web3.ts
+var BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var CLOCK_SKEW_SECONDS = 60;
+function decodeBase58(value) {
+  if (!value)
+    return null;
+  const bytes = [];
+  for (const character of value) {
+    const digit = BASE58_ALPHABET.indexOf(character);
+    if (digit < 0)
+      return null;
+    let carry = digit;
+    for (let index = 0;index < bytes.length; index += 1) {
+      carry += bytes[index] * 58;
+      bytes[index] = carry & 255;
+      carry >>= 8;
+    }
+    while (carry > 0) {
+      bytes.push(carry & 255);
+      carry >>= 8;
+    }
+  }
+  let leadingZeros = 0;
+  while (leadingZeros < value.length && value[leadingZeros] === "1")
+    leadingZeros += 1;
+  return new Uint8Array([...new Array(leadingZeros).fill(0), ...bytes.reverse()]);
+}
+function encodeBase58(value) {
+  if (value.length === 0)
+    return "";
+  const digits = [];
+  for (const byte of value) {
+    let carry = byte;
+    for (let index = 0;index < digits.length; index += 1) {
+      carry += digits[index] * 256;
+      digits[index] = carry % 58;
+      carry = Math.floor(carry / 58);
+    }
+    while (carry > 0) {
+      digits.push(carry % 58);
+      carry = Math.floor(carry / 58);
+    }
+  }
+  let leadingZeros = 0;
+  while (leadingZeros < value.length && value[leadingZeros] === 0)
+    leadingZeros += 1;
+  return `${"1".repeat(leadingZeros)}${digits.reverse().map((digit) => BASE58_ALPHABET[digit]).join("")}`;
+}
+function field(lines, name) {
+  const prefix = `${name}: `;
+  const line = lines.find((entry) => entry.startsWith(prefix));
+  return line?.slice(prefix.length);
+}
+function unixSeconds(value) {
+  if (!value)
+    return;
+  const time = Date.parse(value);
+  return Number.isFinite(time) ? Math.floor(time / 1000) : undefined;
+}
+function parseSolanaSignInMessage(message) {
+  if (!message || message.length > 16384)
+    return null;
+  const lines = message.split(`
+`);
+  const header = lines[0]?.match(/^(.+) wants you to sign in with your Solana account:$/);
+  const address = lines[1]?.trim();
+  const uri = field(lines, "URI");
+  const version = field(lines, "Version");
+  const issuedAt = unixSeconds(field(lines, "Issued At"));
+  if (!header || !address || !uri || version !== "1" || issuedAt === undefined)
+    return null;
+  const publicKey = decodeBase58(address);
+  if (!publicKey || publicKey.length !== 32 || encodeBase58(publicKey) !== address)
+    return null;
+  let parsedUri;
+  try {
+    parsedUri = new URL(uri);
+  } catch {
+    return null;
+  }
+  if (parsedUri.host !== header[1])
+    return null;
+  const expirationTime = unixSeconds(field(lines, "Expiration Time"));
+  const notBefore = unixSeconds(field(lines, "Not Before"));
+  if (field(lines, "Expiration Time") && expirationTime === undefined)
+    return null;
+  if (field(lines, "Not Before") && notBefore === undefined)
+    return null;
+  const now = Math.floor(Date.now() / 1000);
+  if (issuedAt > now + CLOCK_SKEW_SECONDS)
+    return null;
+  if (expirationTime !== undefined && expirationTime <= now)
+    return null;
+  if (notBefore !== undefined && notBefore > now + CLOCK_SKEW_SECONDS)
+    return null;
+  return {
+    address,
+    domain: header[1],
+    uri,
+    issuedAt,
+    ...expirationTime === undefined ? {} : { expirationTime },
+    ...notBefore === undefined ? {} : { notBefore },
+    ...field(lines, "Nonce") === undefined ? {} : { nonce: field(lines, "Nonce") }
+  };
+}
+async function verifySolanaSignIn(message, signature) {
+  const parsed = parseSolanaSignInMessage(message);
+  if (!parsed)
+    return null;
+  const publicKey = decodeBase58(parsed.address);
+  if (!publicKey)
+    return null;
+  let signatureBytes;
+  try {
+    const normalized = signature.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+    signatureBytes = Uint8Array.from(Buffer.from(padded, "base64"));
+  } catch {
+    return null;
+  }
+  if (signatureBytes.length !== 64)
+    return null;
+  try {
+    const publicKeyBuffer = Uint8Array.from(publicKey).buffer;
+    const signatureBuffer = Uint8Array.from(signatureBytes).buffer;
+    const messageBuffer = new TextEncoder().encode(message).buffer;
+    const key = await crypto.subtle.importKey("raw", publicKeyBuffer, "Ed25519", false, ["verify"]);
+    const valid = await crypto.subtle.verify("Ed25519", key, signatureBuffer, messageBuffer);
+    return valid ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
 // src/runtime/auth/handler.ts
 function authError(status, errorCode, msg) {
   return json(status, { code: status, error_code: errorCode, msg });
 }
+function normalizeEmailInput(value) {
+  if (typeof value !== "string")
+    return null;
+  const email = value.trim().toLowerCase();
+  return email || null;
+}
+function base64url2(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 function randomOtp(length) {
   const n = Math.max(6, Math.min(10, Math.floor(length)));
   let code = "";
@@ -1226,9 +2341,41 @@ function normalizePhone(value) {
   const phone = value.trim();
   return /^\+[1-9]\d{7,14}$/.test(phone) ? phone : null;
 }
+function banDurationSeconds(value) {
+  if (value === "none")
+    return null;
+  if (typeof value !== "string")
+    return;
+  const match = value.trim().match(/^(\d+(?:\.\d+)?)(ns|us|\u00B5s|ms|s|m|h)$/);
+  if (!match)
+    return;
+  const amount = Number(match[1]);
+  const multipliers = { ns: 0.000000001, us: 0.000001, "\xB5s": 0.000001, ms: 0.001, s: 1, m: 60, h: 3600 };
+  const multiplier = multipliers[match[2]];
+  const seconds = amount * multiplier;
+  return Number.isFinite(seconds) ? seconds : undefined;
+}
 function recordValue(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
 }
+var RECOVERY_CODE_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+function normalizeRecoveryCode(value) {
+  return typeof value === "string" ? value.replace(/[\s-]/g, "").toLowerCase() : "";
+}
+function randomRecoveryCode(length) {
+  let code = "";
+  while (code.length < length) {
+    const bytes = crypto.getRandomValues(new Uint8Array(Math.max(16, length - code.length)));
+    for (const byte of bytes) {
+      if (byte >= 224)
+        continue;
+      code += RECOVERY_CODE_ALPHABET[byte % RECOVERY_CODE_ALPHABET.length];
+      if (code.length === length)
+        break;
+    }
+  }
+  return code;
+}
 function databaseDiagnosticCode(error) {
   const candidate = typeof error === "object" && error !== null && "code" in error ? error.code : null;
   return typeof candidate === "string" && /^[0-9A-Z]{5}$/.test(candidate) ? candidate : "database_error";
@@ -1252,12 +2399,21 @@ async function sendSmsUntilAbort(sender, message, signal) {
     signal.removeEventListener("abort", rejectForAbort);
   }
 }
-function json(status, body) {
+function json(status, body, extraHeaders = {}) {
   return new Response(status === 204 ? null : JSON.stringify(body), {
     status,
-    headers: { "content-type": "application/json; charset=utf-8" }
+    headers: { "content-type": "application/json; charset=utf-8", ...extraHeaders }
   });
 }
+function redirect2(location) {
+  return new Response(null, { status: 303, headers: { location } });
+}
+function redirectWithQuery2(location, params) {
+  const target = new URL(location);
+  for (const [key, value] of Object.entries(params))
+    target.searchParams.set(key, value);
+  return redirect2(target.toString());
+}
 function iso(v) {
   if (v === null || v === undefined)
     return null;
@@ -1354,26 +2510,61 @@ class AuthHandler {
         return await this.getUser(req);
       if (path === "user" && method === "PUT")
         return await this.updateUser(req);
+      if (/^user\/identities\/[^/]+$/.test(path) && method === "DELETE") {
+        return await this.unlinkIdentity(req, decodeURIComponent(path.split("/")[2]));
+      }
+      if (path === "reauthenticate" && (method === "GET" || method === "POST"))
+        return await this.reauthenticate(req);
       if (path === "logout" && method === "POST")
         return await this.logout(req, url);
       if (path === "otp" && method === "POST")
         return await this.sendOtp(req);
       if (path === "recover" && method === "POST")
         return this.limit("recover", req) ?? await this.sendRecovery(req);
-      if (["magiclink", "resend"].includes(path) && method === "POST")
+      if (path === "magiclink" && method === "POST")
         return await this.sendOtp(req);
+      if (path === "resend" && method === "POST")
+        return await this.sendOtp(req, true);
       if (path === "verify" && method === "POST")
         return this.limit("verify", req) ?? await this.verifyToken(req);
       if (path === "verify" && method === "GET")
         return await this.verifyLink(url);
+      if (path === "sso" && method === "POST")
+        return await this.sso(req);
+      if (path === "invite" && method === "POST") {
+        if (ctx.role !== "service_role") {
+          return authError(403, "insufficient_permissions", "Admin endpoints require the service_role key");
+        }
+        return await this.generateAdminMagicLink(req, true, "invite");
+      }
       if (path === "factors" && method === "POST")
         return await this.enrollFactor(req);
+      if (path === "factors/recovery-codes" && method === "GET")
+        return await this.recoveryCodesStatus(req);
+      if (path === "factors/recovery-codes" && method === "POST")
+        return await this.generateRecoveryCodes(req);
+      if (path === "factors/recovery-codes" && method === "DELETE")
+        return await this.deleteRecoveryCodes(req);
+      if (path === "factors/recovery-codes/verify" && method === "POST")
+        return await this.verifyRecoveryCode(req);
+      if (path === "factors/recovery-codes/regenerate" && method === "POST")
+        return await this.regenerateRecoveryCodes(req);
       if (/^factors\/[^/]+\/challenge$/.test(path) && method === "POST")
         return await this.challengeFactor(req, path.split("/")[1]);
       if (/^factors\/[^/]+\/verify$/.test(path) && method === "POST")
         return await this.verifyFactor(req, path.split("/")[1]);
       if (/^factors\/[^/]+$/.test(path) && method === "DELETE")
         return await this.unenrollFactor(req, path.split("/")[1]);
+      if (path === "user/identities/authorize" && method === "GET") {
+        const user = await this.userFromBearer(req);
+        if (!user)
+          return authError(401, "no_authorization", "Invalid or expired token");
+        const provider = url.searchParams.get("provider") ?? "";
+        if (provider && this.settings.disabledProviders.includes(provider)) {
+          return authError(422, "provider_disabled", `Sign-ins with ${provider} are disabled`);
+        }
+        return await this.oauth.authorize(url, user.id);
+      }
       if (path === "authorize" && method === "GET") {
         const provider = url.searchParams.get("provider") ?? "";
         if (provider && this.settings.disabledProviders.includes(provider)) {
@@ -1391,8 +2582,10 @@ class AuthHandler {
     } catch (e) {
       if (e instanceof OAuthAccountIneligibleError)
         return authError(400, e.code, e.message);
-      const msg = e instanceof Error ? e.message : String(e);
-      return authError(500, "unexpected_failure", msg);
+      try {
+        this.config.log?.(`[auth] request_failed code=${databaseDiagnosticCode(e)}`);
+      } catch {}
+      return authError(500, "unexpected_failure", "Unable to complete authentication request");
     }
   }
   async oauthCallbackUrl(req, url) {
@@ -1406,69 +2599,118 @@ class AuthHandler {
     return callbackUrl;
   }
   async signup(req) {
-    const body = await req.json().catch(() => ({}));
-    if (!body.email && !body.password) {
+    let body;
+    try {
+      const parsed = await req.json();
+      if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return authError(400, "validation_failed", "Signup body must be a JSON object");
+      }
+      body = parsed;
+    } catch {
+      return authError(400, "validation_failed", "Signup body must be valid JSON");
+    }
+    if (!("email" in body) && !("password" in body)) {
       if (!this.settings.anonymousUsers) {
         return authError(422, "anonymous_provider_disabled", "Anonymous sign-ins are disabled");
       }
       const res = await this.db.query(`insert into auth.users (aud, role, raw_app_meta_data, raw_user_meta_data, is_anonymous, last_sign_in_at)
-         values ('authenticated', 'authenticated', '{}', $1, true, now())
+         values ('authenticated', 'authenticated', '{"provider":"anonymous","providers":["anonymous"]}', $1, true, now())
          returning *`, [JSON.stringify(body.data ?? {})]);
-      return json(200, await this.sessionFor(res.rows[0]));
+      return json(200, await this.sessionFor(res.rows[0], undefined, {
+        amr: [{ method: "anonymous", timestamp: Math.floor(Date.now() / 1000) }]
+      }));
     }
     if (this.settings.disableSignup) {
       return authError(422, "signup_disabled", "Signups not allowed for this instance");
     }
-    if (!body.email || !body.password) {
+    const email = normalizeEmailInput(body.email);
+    if (!email || !body.password) {
       return authError(400, "validation_failed", "Signup requires a valid email and password");
     }
     if (body.password.length < this.settings.minPasswordLength) {
       return authError(422, "weak_password", `Password should be at least ${this.settings.minPasswordLength} characters.`);
     }
-    const email = body.email.toLowerCase().trim();
-    const existing = await this.db.query(`select id from auth.users where email = $1`, [email]);
-    if (existing.rows.length > 0) {
-      return authError(422, "user_already_exists", "User already registered");
-    }
     const hashed = await hashPassword(body.password);
     const autoconfirm = this.settings.autoconfirm;
-    const res = await this.db.query(`insert into auth.users
-         (aud, role, email, encrypted_password, email_confirmed_at, last_sign_in_at,
-          raw_app_meta_data, raw_user_meta_data)
-       values ('authenticated', 'authenticated', $1, $2, case when $4 then now() else null end, now(),
-               '{"provider":"email","providers":["email"]}', $3)
-       returning *`, [email, hashed, JSON.stringify(body.data ?? {}), autoconfirm]);
-    const newUser = res.rows[0];
-    await this.db.query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
-       values ($1, 'email', $2, $3)
-       on conflict (provider, provider_id) do nothing`, [newUser.id, newUser.id, JSON.stringify({ sub: newUser.id, email: newUser.email })]);
+    const newUser = await this.db.transaction(async (query) => {
+      const res = await query(`insert into auth.users
+           (aud, role, email, encrypted_password, email_confirmed_at, last_sign_in_at,
+            raw_app_meta_data, raw_user_meta_data)
+         values ('authenticated', 'authenticated', $1, $2, case when $4 then now() else null end,
+                 case when $4 then now() else null end,
+                 '{"provider":"email","providers":["email"]}', $3)
+         on conflict (email) do nothing
+         returning *`, [email, hashed, JSON.stringify(body.data ?? {}), autoconfirm]);
+      const user = res.rows[0];
+      if (!user)
+        return null;
+      await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+         values ($1, 'email', $2, $3)
+         on conflict (provider, provider_id) do nothing`, [user.id, user.id, JSON.stringify({ sub: user.id, email: user.email })]);
+      return user;
+    });
+    if (!newUser)
+      return authError(422, "user_already_exists", "User already registered");
     await this.audit("user_signedup", { actorId: newUser.id, actorEmail: email });
     if (!autoconfirm) {
-      await this.issueToken(email, "otp", false, "confirm");
+      await this.issueToken(email, "otp", false, "confirm", {}, new URL(req.url).searchParams.get("redirect_to"), body.code_challenge, body.code_challenge_method);
       return json(200, this.userJson(newUser));
     }
     return json(200, await this.sessionFor(newUser));
   }
+  async sso(req) {
+    const body = await req.json().catch(() => ({}));
+    const providerId = typeof body.provider_id === "string" ? body.provider_id.trim().toLowerCase() : "";
+    const domain = typeof body.domain === "string" ? body.domain.trim().toLowerCase() : "";
+    const providers = this.config.oauthProviders ?? {};
+    const provider = providerId && providers[providerId] ? providerId : Object.entries(providers).find(([, config]) => domain && (config.ssoDomains ?? []).some((item) => item.toLowerCase() === domain))?.[0] ?? "";
+    if (!provider)
+      return authError(404, "sso_provider_not_found", "SSO provider not found");
+    const authorizeUrl = new URL(req.url);
+    authorizeUrl.pathname = authorizeUrl.pathname.replace(/\/sso$/, "/authorize");
+    authorizeUrl.search = "";
+    authorizeUrl.searchParams.set("provider", provider);
+    authorizeUrl.searchParams.set("skip_http_redirect", String(body.skip_http_redirect === true));
+    for (const [key, value] of [
+      ["redirect_to", body.redirect_to],
+      ["code_challenge", body.code_challenge],
+      ["code_challenge_method", body.code_challenge_method]
+    ]) {
+      if (value)
+        authorizeUrl.searchParams.set(key, value);
+    }
+    return this.oauth.authorize(authorizeUrl);
+  }
   async token(req, url) {
     const grantType = url.searchParams.get("grant_type");
     const body = await req.json().catch(() => ({}));
     if (grantType === "password") {
-      const email = (body.email ?? "").toLowerCase().trim();
+      const email = body.email === undefined ? null : normalizeEmailInput(body.email);
+      if (body.email !== undefined && !email)
+        return authError(400, "validation_failed", "email must not be empty");
+      const phone = body.phone === undefined ? null : normalizePhone(body.phone);
+      if (body.phone !== undefined && !phone)
+        return authError(400, "validation_failed", "phone must be a valid E.164 number");
+      if (!email && !phone)
+        return authError(400, "validation_failed", "email or phone is required");
       const res = await this.db.query(`select *, coalesce(banned_until > now(), false) as is_banned
-         from auth.users where email = $1 and deleted_at is null`, [email]);
+         from auth.users
+         where (($1::text is not null and lower(email) = $1)
+            or ($2::text is not null and phone = $2))
+           and deleted_at is null`, [email, phone]);
       const user = res.rows[0];
       if (user?.encrypted_password && user.is_banned) {
         return authError(400, "user_banned", "User is banned");
       }
       if (!user || !user.encrypted_password || !await verifyPassword(body.password ?? "", user.encrypted_password)) {
-        await this.audit("login_failed", { actorEmail: email, traits: { grant_type: "password" } });
+        await this.audit("login_failed", { actorEmail: email ?? phone, traits: { grant_type: "password" } });
         return authError(400, "invalid_credentials", "Invalid login credentials");
       }
       const response = await this.db.transaction(async (query) => {
         const currentResult = await query(`select *, coalesce(banned_until > now(), false) as is_banned
            from auth.users where id = $1 for update`, [user.id]);
         const current = currentResult.rows[0];
-        if (!current || current.deleted_at !== null || !current.encrypted_password || current.email !== email) {
+        if (!current || current.deleted_at !== null || !current.encrypted_password || (email ? current.email?.toLowerCase().trim() !== email : current.phone !== phone)) {
           return authError(400, "invalid_credentials", "Invalid login credentials");
         }
         if (current.is_banned) {
@@ -1477,7 +2719,10 @@ class AuthHandler {
         if (current.encrypted_password !== user.encrypted_password) {
           return authError(400, "invalid_credentials", "Invalid login credentials");
         }
-        if (!this.settings.autoconfirm && !current.email_confirmed_at) {
+        if (phone && !current.phone_confirmed_at) {
+          return authError(400, "phone_not_confirmed", "Phone not confirmed");
+        }
+        if (email && !this.settings.autoconfirm && !current.email_confirmed_at) {
           return authError(400, "email_not_confirmed", "Email not confirmed");
         }
         const signedIn = await query(`update auth.users set last_sign_in_at = now() where id = $1 returning *`, [current.id]);
@@ -1488,7 +2733,7 @@ class AuthHandler {
         return json(200, await this.sessionFor(updated, undefined, undefined, query));
       });
       if (response.ok) {
-        await this.audit("login", { actorId: user.id, actorEmail: email, traits: { grant_type: "password" } });
+        await this.audit("login", { actorId: user.id, actorEmail: user.email ?? user.phone, traits: { grant_type: "password" } });
       }
       return response;
     }
@@ -1503,11 +2748,72 @@ class AuthHandler {
       const verifier = body.code_verifier;
       if (!authCode || !verifier)
         return authError(400, "validation_failed", "auth_code and code_verifier required");
+      const emailClaim = await this.exchangeEmailPkce(authCode, verifier);
+      if (emailClaim) {
+        return json(200, await this.sessionForEmailPkce(emailClaim.userId, emailClaim.provider));
+      }
       const userId = await this.oauth.exchangePkce(authCode, verifier);
       if (!userId)
         return authError(403, "flow_state_not_found", "invalid or expired auth code");
       return json(200, await this.sessionForOAuth(userId));
     }
+    if (grantType === "id_token") {
+      const provider = typeof body.provider === "string" ? body.provider.toLowerCase() : "";
+      const idToken = body.id_token;
+      if (!provider || !idToken)
+        return authError(400, "validation_failed", "provider and id_token required");
+      if (String(body.link_identity) === "true" || body.link_identity === "1") {
+        const current = await this.userFromBearer(req);
+        if (!current)
+          return authError(401, "no_authorization", "This endpoint requires a Bearer token");
+        try {
+          const linked = await this.oauth.linkIdentityWithIdToken(provider, idToken, current.id, body.access_token, body.nonce);
+          if (!linked)
+            return authError(400, "invalid_credentials", "Invalid ID token");
+        } catch (error) {
+          if (error instanceof OAuthIdentityLinkError) {
+            return authError(422, error.code, "Identity is already linked");
+          }
+          throw error;
+        }
+        return this.sessionForOAuth(current.id).then((session) => json(200, session));
+      }
+      const userId = await this.oauth.signInWithIdToken(provider, idToken, body.access_token, body.nonce);
+      if (!userId)
+        return authError(400, "invalid_credentials", "Invalid ID token");
+      return this.db.transaction(async (query) => {
+        const result = await query(`select * from auth.users where id = $1 and deleted_at is null
+             and (banned_until is null or banned_until <= now()) for update`, [userId]);
+        const user = result.rows[0];
+        if (!user)
+          return authError(400, "invalid_credentials", "Invalid ID token");
+        return json(200, await this.sessionFor(user, undefined, {
+          amr: [{ method: "oauth", timestamp: Math.floor(Date.now() / 1000) }]
+        }, query));
+      });
+    }
+    if (grantType === "web3") {
+      if (body.chain !== "solana" || !body.message || !body.signature) {
+        return authError(400, "validation_failed", "chain, message and signature are required");
+      }
+      const wallet = await verifySolanaSignIn(body.message, body.signature);
+      if (!wallet)
+        return authError(400, "invalid_credentials", "Invalid Web3 credentials");
+      const userId = await this.oauth.signInWithProfile("solana", {
+        id: wallet.address,
+        metadata: { address: wallet.address, chain: "solana" }
+      });
+      return this.db.transaction(async (query) => {
+        const result = await query(`select * from auth.users where id = $1 and deleted_at is null
+             and (banned_until is null or banned_until <= now()) for update`, [userId]);
+        const user = result.rows[0];
+        if (!user)
+          return authError(400, "invalid_credentials", "Invalid Web3 credentials");
+        return json(200, await this.sessionFor(user, undefined, {
+          amr: [{ method: "web3", timestamp: Math.floor(Date.now() / 1000) }]
+        }, query));
+      });
+    }
     return authError(400, "invalid_grant", `unsupported grant_type: ${grantType}`);
   }
   async getUser(req) {
@@ -1516,15 +2822,65 @@ class AuthHandler {
       return authError(401, "no_authorization", "Invalid or expired token");
     return json(200, this.userJson(user, await this.getUserFactors(user.id), await this.getUserIdentities(user.id)));
   }
+  async unlinkIdentity(req, identityId) {
+    const user = await this.userFromBearer(req);
+    if (!user)
+      return authError(401, "no_authorization", "Invalid or expired token");
+    return this.db.transaction(async (query) => {
+      const current = (await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id])).rows[0];
+      if (!current)
+        return authError(401, "no_authorization", "Invalid or expired token");
+      const identity = (await query(`select id from auth.identities where id = $1 and user_id = $2`, [identityId, user.id])).rows[0];
+      if (!identity)
+        return authError(404, "identity_not_found", "Identity not found");
+      const count = await query(`select count(*)::int as count from auth.identities where user_id = $1`, [user.id]);
+      if ((count.rows[0]?.count ?? 0) <= 1) {
+        return authError(422, "cannot_unlink_identity", "Cannot unlink the only identity");
+      }
+      await query(`delete from auth.identities where id = $1 and user_id = $2`, [identity.id, user.id]);
+      await query(`update auth.users
+         set raw_app_meta_data = jsonb_set(
+           coalesce(raw_app_meta_data, '{}'::jsonb),
+           '{providers}',
+           (
+             select jsonb_agg(provider order by provider)
+             from (
+               select distinct provider
+               from auth.identities
+               where user_id = $1
+             ) as providers
+           ),
+           true
+         ),
+         updated_at = now()
+         where id = $1`, [user.id]);
+      return json(200, {});
+    });
+  }
   async updateUser(req) {
+    const claims = await this.claimsFromBearer(req);
     const user = await this.userFromBearer(req);
     if (!user)
       return authError(401, "no_authorization", "Invalid or expired token");
     const body = await req.json().catch(() => ({}));
     const sets = [];
     const params = [];
-    if (body.email && !this.settings.autoconfirm) {
-      return authError(501, "email_change_confirmation_not_supported", "Email changes that require confirmation are not supported by SupaCloud Lite V1");
+    const requestedEmail = body.email === undefined ? undefined : normalizeEmailInput(body.email);
+    if (body.email !== undefined && !requestedEmail) {
+      return authError(400, "validation_failed", "email must not be empty");
+    }
+    if (body.phone !== undefined) {
+      if (requestedEmail !== undefined)
+        return authError(400, "validation_failed", "email and phone cannot be updated together");
+      const phone = normalizePhone(body.phone);
+      if (!phone)
+        return authError(400, "validation_failed", "phone must be a valid E.164 number");
+      return this.requestPhoneChange(req, user, phone);
+    }
+    const requiresReauthentication = Boolean(body.password) && this.settings.requirePasswordReauthentication && await this.sessionRequiresReauthentication(claims);
+    if (requestedEmail && !this.settings.autoconfirm) {
+      return this.requestEmailChange(req, user, requestedEmail, body);
     }
     if (body.password) {
       if (body.password.length < this.settings.minPasswordLength) {
@@ -1537,41 +2893,212 @@ class AuthHandler {
       params.push(JSON.stringify(body.data));
       sets.push(`raw_user_meta_data = coalesce(raw_user_meta_data, '{}'::jsonb) || $${params.length}::jsonb`);
     }
-    const response = await this.db.transaction(async (query) => {
+    let response;
+    try {
+      response = await this.db.transaction(async (query) => {
+        const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
+             and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+        const current = currentResult.rows[0];
+        if (!current)
+          return authError(401, "no_authorization", "Invalid or expired token");
+        const transactionSets = [...sets];
+        const transactionParams = [...params];
+        if (requiresReauthentication) {
+          if (!body.nonce) {
+            return authError(400, "reauthentication_needed", "Password update requires reauthentication");
+          }
+          if (!await this.consumeReauthentication(query, current, body.nonce)) {
+            return authError(422, "reauthentication_not_valid", "Nonce has expired or is invalid");
+          }
+        }
+        const upgradingAnon = (current.is_anonymous ?? false) && requestedEmail !== undefined;
+        if (requestedEmail) {
+          const email = requestedEmail;
+          const clash = await query(`select id from auth.users where lower(email) = $1 and id <> $2`, [email, current.id]);
+          if (clash.rows.length > 0) {
+            return authError(422, "email_exists", "A user with this email address has already been registered");
+          }
+          transactionParams.push(email);
+          transactionSets.push(`email = $${transactionParams.length}, email_confirmed_at = now()`);
+        }
+        if (upgradingAnon) {
+          transactionSets.push(`is_anonymous = false`);
+          transactionSets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || '{"provider":"email","providers":["email"]}'::jsonb`);
+        }
+        if (transactionSets.length === 0) {
+          return json(200, await this.userJsonWithRelations(current, query));
+        }
+        transactionParams.push(current.id);
+        const updatedResult = await query(`update auth.users set ${transactionSets.join(", ")}, updated_at = now() where id = $${transactionParams.length} returning *`, transactionParams);
+        const updated = updatedResult.rows[0];
+        if (!updated)
+          return authError(401, "no_authorization", "Invalid or expired token");
+        if (requestedEmail)
+          await this.ensureEmailIdentity(updated, query, upgradingAnon);
+        return json(200, await this.userJsonWithRelations(updated, query));
+      });
+    } catch (error) {
+      if (databaseDiagnosticCode(error) === "23505" && requestedEmail) {
+        return authError(422, "email_exists", "A user with this email address has already been registered");
+      }
+      throw error;
+    }
+    return response;
+  }
+  async reauthenticate(req) {
+    const user = await this.userFromBearer(req);
+    if (!user)
+      return authError(401, "no_authorization", "Invalid or expired token");
+    const prepared = await this.db.transaction(async (query) => {
       const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
            and (banned_until is null or banned_until <= now()) for update`, [user.id]);
       const current = currentResult.rows[0];
       if (!current)
         return authError(401, "no_authorization", "Invalid or expired token");
-      const transactionSets = [...sets];
-      const transactionParams = [...params];
-      const upgradingAnon = (current.is_anonymous ?? false) && !!body.email;
-      if (body.email) {
-        const email = body.email.toLowerCase().trim();
-        const clash = await query(`select id from auth.users where email = $1 and id <> $2`, [email, current.id]);
-        if (clash.rows.length > 0) {
-          return authError(422, "email_exists", "A user with this email address has already been registered");
+      const email = current.email_confirmed_at && current.email ? current.email : null;
+      const phone = !email && current.phone_confirmed_at && current.phone ? current.phone : null;
+      if (!email && !phone) {
+        if (current.email && !current.email_confirmed_at) {
+          return authError(422, "email_not_confirmed", "Please verify your email first.");
+        }
+        if (current.phone && !current.phone_confirmed_at) {
+          return authError(422, "phone_not_confirmed", "Please verify your phone first.");
         }
-        transactionParams.push(email);
-        transactionSets.push(`email = $${transactionParams.length}, email_confirmed_at = now()`);
+        return authError(400, "validation_failed", "Reauthentication requires the user to have an email or a phone number");
       }
-      if (upgradingAnon) {
-        transactionSets.push(`is_anonymous = false`);
-        transactionSets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || '{"provider":"email","providers":["email"]}'::jsonb`);
+      const contact = email ?? phone;
+      const sender = this.config.smsSender;
+      if (!email && !sender) {
+        return authError(422, "phone_provider_disabled", "Phone sign-ins are disabled");
       }
-      if (transactionSets.length === 0) {
+      const limited = email ? this.limit("otp", req) : this.limitKey("sms", `phone:${await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-fingerprint:v1", contact)}`) ?? this.limit("sms", req);
+      if (limited)
+        return limited;
+      const code = randomOtp(this.settings.otpLength);
+      const tokenDigest = `hmac-sha256:v1:${await keyedDigest(this.config.jwtSecret, "supacloud-lite:reauthentication-otp:v1", `${contact}\x00${code}`)}`;
+      const issuanceId = crypto.randomUUID();
+      await query(`delete from auth.one_time_tokens where user_id = $1 and token_type = 'reauthentication'`, [current.id]);
+      await query(`insert into auth.one_time_tokens (id, user_id, email, phone, token_type, token, expires_at)
+         values ($1, $2, $3, $4, 'reauthentication', $5, now() + $6::interval)`, [issuanceId, current.id, email, phone, tokenDigest, `${this.settings.otpExpirySeconds} seconds`]);
+      const updated = (await query(`update auth.users
+         set reauthentication_token = $1, reauthentication_sent_at = now(), updated_at = now()
+         where id = $2 returning *`, [tokenDigest, current.id])).rows[0];
+      return updated ? { user: updated, email, phone, code, issuanceId, tokenDigest } : null;
+    });
+    if (prepared instanceof Response)
+      return prepared;
+    if (!prepared)
+      return authError(401, "no_authorization", "Invalid or expired token");
+    try {
+      if (prepared.email) {
+        await this.config.mailer.send({
+          to: prepared.email,
+          subject: "Your reauthentication code",
+          text: `Your reauthentication code is ${prepared.code}`
+        });
+      } else {
+        const smsSender = this.config.smsSender;
+        if (!smsSender || !prepared.phone)
+          return authError(422, "phone_provider_disabled", "Phone sign-ins are disabled");
+        await this.sendPhoneOtp(smsSender, prepared.phone, this.settings.smsTemplate.replace(/\{\{\s*\.Code\s*\}\}/g, prepared.code));
+      }
+    } catch {
+      await this.db.query(`delete from auth.one_time_tokens where id = $1 and token = $2`, [prepared.issuanceId, prepared.tokenDigest]);
+      await this.db.query(`update auth.users
+         set reauthentication_token = '', reauthentication_sent_at = null
+         where id = $1 and reauthentication_token = $2`, [prepared.user.id, prepared.tokenDigest]);
+      return authError(502, prepared.email ? "email_provider_failed" : "sms_provider_failed", "Unable to send the verification code");
+    }
+    return json(200, {});
+  }
+  async sessionRequiresReauthentication(claims) {
+    if (!claims?.sub || typeof claims.session_id !== "string" || !claims.session_id)
+      return true;
+    const result = await this.db.query(`select min(created_at) as started_at
+       from auth.refresh_tokens where session_id = $1 and user_id = $2`, [claims.session_id, claims.sub]);
+    const startedAt = timestampMs(result.rows[0]?.started_at ?? null);
+    return startedAt === null || Date.now() - startedAt >= 24 * 60 * 60 * 1000;
+  }
+  async consumeReauthentication(query, user, nonce) {
+    const email = user.email_confirmed_at && user.email ? user.email : null;
+    const phone = !email && user.phone_confirmed_at && user.phone ? user.phone : null;
+    const contact = email ?? phone;
+    if (!contact || !nonce)
+      return false;
+    const tokenDigest = `hmac-sha256:v1:${await keyedDigest(this.config.jwtSecret, "supacloud-lite:reauthentication-otp:v1", `${contact}\x00${nonce}`)}`;
+    const candidate = await query(`select id from auth.one_time_tokens
+       where user_id = $1 and token_type = 'reauthentication'
+         and token = $2 and expires_at > now() and attempts < $3
+       limit 1`, [user.id, tokenDigest, AuthHandler.MAX_OTP_ATTEMPTS]);
+    if (candidate.rows.length === 0) {
+      await query(`update auth.one_time_tokens set attempts = attempts + 1
+         where user_id = $1 and token_type = 'reauthentication' and expires_at > now()`, [user.id]);
+      await query(`delete from auth.one_time_tokens
+         where user_id = $1 and token_type = 'reauthentication' and attempts >= $2`, [user.id, AuthHandler.MAX_OTP_ATTEMPTS]);
+      return false;
+    }
+    const claimed = await query(`delete from auth.one_time_tokens
+       where id = $1 and user_id = $2 and token = $3 and expires_at > now()
+       returning id`, [candidate.rows[0].id, user.id, tokenDigest]);
+    if (claimed.rows.length === 0)
+      return false;
+    const cleared = await query(`update auth.users
+       set reauthentication_token = '', reauthentication_sent_at = null
+       where id = $1 and reauthentication_token = $2
+       returning id`, [user.id, tokenDigest]);
+    return cleared.rows.length > 0;
+  }
+  async requestEmailChange(req, user, newEmail, body) {
+    const url = new URL(req.url);
+    const redirectTo = resolveRedirect(url.searchParams.get("redirect_to"), this.config.siteUrl, this.config.uriAllowList, this.config.enforceRedirectAllowList);
+    const challenge = typeof body.code_challenge === "string" && body.code_challenge ? body.code_challenge : null;
+    const challengeMethod = challenge ? body.code_challenge_method?.toLowerCase() || "s256" : null;
+    const prepared = await this.db.transaction(async (query) => {
+      const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+      const current = currentResult.rows[0];
+      if (!current)
+        return authError(401, "no_authorization", "Invalid or expired token");
+      if (current.email?.toLowerCase().trim() === newEmail)
         return json(200, await this.userJsonWithRelations(current, query));
+      const clash = await query(`select id from auth.users where lower(email) = $1 and id <> $2`, [newEmail, current.id]);
+      if (clash.rows.length > 0)
+        return authError(422, "email_exists", "A user with this email address has already been registered");
+      const code = randomOtp(this.settings.otpLength);
+      const linkToken = randomToken(24);
+      await query(`delete from auth.one_time_tokens where user_id = $1 and token_type = 'email_change'`, [current.id]);
+      await query(`insert into auth.one_time_tokens (user_id, email, token_type, token, expires_at)
+         values ($1, $2, 'email_change', $3, now() + $4::interval),
+                ($1, $2, 'email_change', $5, now() + $4::interval)`, [current.id, newEmail, code, `${this.settings.otpExpirySeconds} seconds`, linkToken]);
+      await query(`update auth.users
+         set email_change = $1, email_change_sent_at = now(), email_change_confirm_status = 0, updated_at = now()
+         where id = $2`, [newEmail, current.id]);
+      await query(`delete from auth.flow_state
+         where provider = 'email-change' and user_id = $1 and auth_code is null`, [current.id]);
+      if (challenge) {
+        await query(`insert into auth.flow_state
+             (provider, provider_state, redirect_to, code_challenge, code_challenge_method, user_id, expires_at)
+           values ('email-change', $1, $2, $3, $4, $5, now() + interval '10 minutes')`, [linkToken, redirectTo, challenge, challengeMethod, current.id]);
       }
-      transactionParams.push(current.id);
-      const updatedResult = await query(`update auth.users set ${transactionSets.join(", ")}, updated_at = now() where id = $${transactionParams.length} returning *`, transactionParams);
-      const updated = updatedResult.rows[0];
+      const updated = (await query(`select * from auth.users where id = $1`, [current.id])).rows[0];
       if (!updated)
         return authError(401, "no_authorization", "Invalid or expired token");
-      if (body.email)
-        await this.ensureEmailIdentity(updated, query);
-      return json(200, await this.userJsonWithRelations(updated, query));
+      return { user: updated, linkToken, code, redirectTo };
     });
-    return response;
+    if (prepared instanceof Response)
+      return prepared;
+    const actionUrl = new URL(`${this.config.apiUrl}/auth/v1/verify`);
+    actionUrl.searchParams.set("token", prepared.linkToken);
+    actionUrl.searchParams.set("type", "email_change");
+    actionUrl.searchParams.set("redirect_to", prepared.redirectTo);
+    await this.config.mailer.send({
+      to: newEmail,
+      subject: "Confirm your email change",
+      text: `Confirm your new email address with this link: ${actionUrl}
+
+Or use code ${prepared.code}`
+    });
+    return json(200, await this.userJsonWithRelations(prepared.user));
   }
   async logout(req, url) {
     const claims = await this.claimsFromBearer(req);
@@ -1595,28 +3122,66 @@ class AuthHandler {
     }
     return new Response(null, { status: 204 });
   }
-  async issueToken(email, tokenType, createUser, flavor = "login") {
+  async issueToken(email, tokenType, createUser, flavor = "login", metadata = {}, requestedRedirect, codeChallenge, codeChallengeMethod) {
     const normalized = email.toLowerCase().trim();
-    let res = await this.db.query(`select * from auth.users where email = $1`, [normalized]);
-    let user = res.rows[0];
-    if (!user) {
-      if (!createUser)
-        return json(200, {});
-      if (this.settings.disableSignup)
-        return authError(422, "signup_disabled", "Signups not allowed for this instance");
-      res = await this.db.query(`insert into auth.users (aud, role, email, raw_app_meta_data, raw_user_meta_data)
-         values ('authenticated', 'authenticated', $1, '{"provider":"email","providers":["email"]}', '{}')
-         returning *`, [normalized]);
-      user = res.rows[0];
-    }
-    const code = randomOtp(this.settings.otpLength);
-    const linkToken = randomToken(24);
     const expiry = `${this.settings.otpExpirySeconds} seconds`;
-    await this.db.query(`delete from auth.one_time_tokens where email = $1 and token_type = $2`, [normalized, tokenType]);
-    await this.db.query(`insert into auth.one_time_tokens (user_id, email, token_type, token, expires_at)
-       values ($1, $2, $3, $4, now() + $7::interval), ($1, $2, $5, $6, now() + $7::interval)`, [user.id, normalized, tokenType, code, tokenType === "otp" ? "magiclink" : tokenType, linkToken, expiry]);
+    const normalizedChallenge = typeof codeChallenge === "string" && codeChallenge ? codeChallenge : null;
+    const normalizedChallengeMethod = normalizedChallenge ? codeChallengeMethod?.toLowerCase() || "s256" : null;
+    const resolvedRedirect = resolveRedirect(requestedRedirect, this.config.siteUrl, this.config.uriAllowList, this.config.enforceRedirectAllowList);
+    const prepared = await this.db.transaction(async (query) => {
+      let user = (await query(`select * from auth.users where lower(email) = $1 for update`, [normalized])).rows[0];
+      if (!user) {
+        if (!createUser)
+          return { kind: "unknown" };
+        if (this.settings.disableSignup)
+          return { kind: "signup_disabled" };
+        const inserted = await query(`insert into auth.users (aud, role, email, raw_app_meta_data, raw_user_meta_data)
+           values ('authenticated', 'authenticated', $1, '{"provider":"email","providers":["email"]}', $2::jsonb)
+           on conflict (email) do nothing
+           returning *`, [normalized, JSON.stringify(metadata)]);
+        user = inserted.rows[0];
+        if (!user) {
+          user = (await query(`select * from auth.users where lower(email) = $1 for update`, [normalized])).rows[0];
+        }
+      }
+      if (!user)
+        return { kind: "unknown" };
+      const code = randomOtp(this.settings.otpLength);
+      const linkToken = randomToken(24);
+      const tokenTypes = tokenType === "otp" ? ["otp", "magiclink"] : [tokenType];
+      await query(`delete from auth.one_time_tokens where lower(email) = $1 and token_type = any($2::text[])`, [normalized, tokenTypes]);
+      await query(`insert into auth.one_time_tokens (user_id, email, token_type, token, expires_at)
+         values ($1, $2, $3, $4, now() + $7::interval), ($1, $2, $5, $6, now() + $7::interval)`, [user.id, normalized, tokenType, code, tokenType === "otp" ? "magiclink" : tokenType, linkToken, expiry]);
+      if (normalizedChallenge) {
+        await query(`delete from auth.flow_state
+           where provider in ('email', 'email-recovery') and user_id = $1 and auth_code is null`, [user.id]);
+        await query(`insert into auth.flow_state
+             (provider, provider_state, redirect_to, code_challenge, code_challenge_method, user_id, expires_at)
+           values ($1, $2, $3, $4, $5, $6, now() + interval '10 minutes')`, [
+          tokenType === "recovery" ? "email-recovery" : "email",
+          linkToken,
+          resolvedRedirect,
+          normalizedChallenge,
+          normalizedChallengeMethod,
+          user.id
+        ]);
+      }
+      return { kind: "issued", user, code, linkToken };
+    });
+    if (prepared.kind === "unknown")
+      return json(200, {});
+    if (prepared.kind === "signup_disabled") {
+      return authError(422, "signup_disabled", "Signups not allowed for this instance");
+    }
+    const { user, code, linkToken } = prepared;
     const kind = tokenType === "otp" ? "magiclink" : tokenType;
-    const link = `${this.config.apiUrl}/auth/v1/verify?token=${linkToken}&type=${kind}`;
+    const linkUrl = new URL(`${this.config.apiUrl}/auth/v1/verify`);
+    linkUrl.searchParams.set("token", linkToken);
+    linkUrl.searchParams.set("type", kind);
+    if (requestedRedirect) {
+      linkUrl.searchParams.set("redirect_to", resolvedRedirect);
+    }
+    const link = linkUrl.toString();
     await this.config.mailer.send({
       to: normalized,
       subject: tokenType === "recovery" ? "Reset your password" : flavor === "confirm" ? "Confirm your email" : "Your login code",
@@ -1630,7 +3195,7 @@ Or sign in with this link: ${link}`
     });
     return json(200, {});
   }
-  async sendOtp(req) {
+  async sendOtp(req, resend = false) {
     const body = await req.json().catch(() => ({}));
     if (body.email && body.phone)
       return authError(400, "validation_failed", "email and phone are mutually exclusive");
@@ -1641,11 +3206,77 @@ Or sign in with this link: ${link}`
       const phone = normalizePhone(body.phone);
       if (!phone)
         return authError(400, "validation_failed", "phone must be a valid E.164 number");
+      if (resend && body.type === "phone_change") {
+        const user = await this.userFromBearer(req);
+        if (!user || user.phone_change !== phone)
+          return json(200, {});
+        return this.requestPhoneChange(req, user, phone);
+      }
       return this.limit("sms", req) ?? this.issuePhoneToken(phone, body.create_user !== false, recordValue(body.data));
     }
-    if (!body.email)
+    const email = normalizeEmailInput(body.email);
+    if (!email)
       return authError(400, "validation_failed", "email or phone is required");
-    return this.limit("otp", req) ?? this.issueToken(body.email, "otp", body.create_user !== false);
+    if (resend && body.type === "email_change") {
+      return this.resendEmailChange(req, email, body);
+    }
+    const signupResend = resend && body.type === "signup";
+    return this.limit("otp", req) ?? this.issueToken(email, "otp", signupResend ? false : body.create_user !== false, signupResend ? "confirm" : "login", recordValue(body.data), new URL(req.url).searchParams.get("redirect_to"), body.code_challenge, body.code_challenge_method);
+  }
+  async resendEmailChange(req, newEmail, body) {
+    const result = await this.db.query(`select * from auth.users
+       where lower(email_change) = $1 and deleted_at is null
+         and (banned_until is null or banned_until <= now())`, [newEmail]);
+    const user = result.rows[0];
+    if (!user)
+      return json(200, {});
+    return this.requestEmailChange(req, user, newEmail, body);
+  }
+  async requestPhoneChange(req, user, newPhone) {
+    const sender = this.config.smsSender;
+    if (!this.settings.smsEnabled || !sender) {
+      return authError(422, "phone_provider_disabled", "Phone sign-ins are disabled");
+    }
+    const fingerprint = await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-fingerprint:v1", newPhone);
+    const limited = this.limitKey("sms", `phone:${fingerprint}`) ?? this.limit("sms", req);
+    if (limited)
+      return limited;
+    const token = randomOtp(this.settings.otpLength);
+    const tokenDigest = `hmac-sha256:v1:${await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-otp:v1", `${newPhone}\x00${token}`)}`;
+    const issuanceId = crypto.randomUUID();
+    const prepared = await this.db.transaction(async (query) => {
+      const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+      const current = currentResult.rows[0];
+      if (!current)
+        return null;
+      if (current.phone === newPhone)
+        return { user: current, unchanged: true };
+      const clash = await query(`select id from auth.users where phone = $1 and id <> $2`, [newPhone, current.id]);
+      if (clash.rows.length > 0)
+        return { conflict: true };
+      await query(`delete from auth.one_time_tokens where user_id = $1 and token_type = 'phone_change'`, [current.id]);
+      await query(`insert into auth.one_time_tokens (id, user_id, phone, token_type, token, expires_at)
+         values ($1, $2, $3, 'phone_change', $4, now() + $5::interval)`, [issuanceId, current.id, newPhone, tokenDigest, `${this.settings.otpExpirySeconds} seconds`]);
+      const updated = (await query(`update auth.users
+         set phone_change = $1, phone_change_token = $2, phone_change_sent_at = now(), updated_at = now()
+         where id = $3 returning *`, [newPhone, tokenDigest, current.id])).rows[0];
+      return updated ? { user: updated, unchanged: false } : null;
+    });
+    if (!prepared)
+      return authError(401, "no_authorization", "Invalid or expired token");
+    if ("conflict" in prepared)
+      return authError(422, "phone_exists", "A user with this phone number has already been registered");
+    if (prepared.unchanged)
+      return json(200, await this.userJsonWithRelations(prepared.user));
+    try {
+      await this.sendPhoneOtp(sender, newPhone, this.settings.smsTemplate.replace(/\{\{\s*\.Code\s*\}\}/g, token));
+    } catch {
+      await this.db.query(`delete from auth.one_time_tokens where id = $1 and token = $2`, [issuanceId, tokenDigest]);
+      await this.db.query(`update auth.users set phone_change = null, phone_change_token = '', phone_change_sent_at = null where id = $1`, [user.id]);
+      return authError(502, "sms_provider_failed", "Unable to send the verification code");
+    }
+    return json(200, await this.userJsonWithRelations(prepared.user));
   }
   async issuePhoneToken(phone, createUser, metadata) {
     const sender = this.config.smsSender;
@@ -1699,7 +3330,7 @@ Or sign in with this link: ${link}`
         const resolved = await this.phoneUser(query, request);
         if (resolved === "unknown" || resolved === "signup_disabled")
           return { state: resolved };
-        await this.createPhoneIdentity(query, resolved);
+        await this.ensurePhoneIdentity(resolved, query);
         await query(`delete from auth.one_time_tokens where phone = $1 and token_type = 'sms'`, [request.phone]);
         await query(`insert into auth.one_time_tokens (id, user_id, phone, token_type, token, expires_at)
            values ($1, $2, $3, 'sms', $4, now() + $5::interval)`, [request.issuanceId, resolved.id, request.phone, request.tokenDigest, request.expiry]);
@@ -1743,11 +3374,6 @@ Or sign in with this link: ${link}`
        from auth.users where phone = $1 for update`, [phone]);
     return users.rows[0];
   }
-  createPhoneIdentity(query, user) {
-    return query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
-       values ($1, 'phone', $2, $3::jsonb)
-       on conflict (provider, provider_id) do nothing`, [user.id, user.phone, JSON.stringify({ sub: user.id, phone: user.phone, phone_verified: user.phone_confirmed_at != null })]);
-  }
   async deliverPhoneOtp(issuance, sender, phone, body) {
     try {
       await this.sendPhoneOtp(sender, phone, body);
@@ -1799,12 +3425,13 @@ Or sign in with this link: ${link}`
   }
   async sendRecovery(req) {
     const body = await req.json().catch(() => ({}));
-    if (!body.email)
+    const email = normalizeEmailInput(body.email);
+    if (!email)
       return authError(400, "validation_failed", "email is required");
-    return this.issueToken(body.email, "recovery", false);
+    return this.issueToken(email, "recovery", false, "login", {}, new URL(req.url).searchParams.get("redirect_to"), body.code_challenge, body.code_challenge_method);
   }
   static MAX_OTP_ATTEMPTS = 5;
-  async redeem(token, types, email) {
+  async redeem(token, types, email, sessionOptions) {
     const redemption = {
       token,
       tokenTypes: `{${types.join(",")}}`,
@@ -1812,7 +3439,18 @@ Or sign in with this link: ${link}`
     };
     return this.db.transaction(async (query) => {
       const user = await this.claimEmailToken(query, redemption);
-      return user ? this.sessionFor(user, undefined, undefined, query) : null;
+      return user ? this.sessionFor(user, undefined, sessionOptions, query) : null;
+    });
+  }
+  async redeemUser(token, types, email) {
+    const redemption = {
+      token,
+      tokenTypes: `{${types.join(",")}}`,
+      email: email?.toLowerCase().trim() ?? null
+    };
+    return this.db.transaction(async (query) => {
+      const user = await this.claimEmailToken(query, redemption);
+      return user;
     });
   }
   async claimEmailToken(query, redemption) {
@@ -1836,15 +3474,19 @@ Or sign in with this link: ${link}`
     return claimedTokens.rows[0] ?? null;
   }
   async confirmEmailTokenUser(query, claimedToken) {
-    await query(`delete from auth.one_time_tokens where email = $1`, [claimedToken.email]);
+    await query(`delete from auth.one_time_tokens where lower(email) = lower($1)`, [claimedToken.email]);
     const users = await query(`update auth.users set email_confirmed_at = coalesce(email_confirmed_at, now()), last_sign_in_at = now()
        where id = $1 returning *`, [claimedToken.user_id]);
-    return users.rows[0] ?? null;
+    const user = users.rows[0];
+    if (!user)
+      return null;
+    await this.ensureEmailIdentity(user, query);
+    return user;
   }
   async findEmailTokenCandidate(query, redemption) {
     const candidates = await query(`select id, user_id, email from auth.one_time_tokens
        where token = $1 and token_type = any($2::text[])
-         and ($3::text is null or email = $3) and expires_at > now()
+         and ($3::text is null or lower(email) = lower($3)) and expires_at > now()
          and attempts < $4`, [redemption.token, redemption.tokenTypes, redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
     return candidates.rows[0] ?? null;
   }
@@ -1852,14 +3494,28 @@ Or sign in with this link: ${link}`
     if (!redemption.email)
       return;
     await query(`update auth.one_time_tokens set attempts = attempts + 1
-       where email = $1 and token_type = any($2::text[]) and expires_at > now()`, [redemption.email, redemption.tokenTypes]);
-    await query(`delete from auth.one_time_tokens where email = $1 and attempts >= $2`, [redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
+       where lower(email) = lower($1) and token_type = any($2::text[]) and expires_at > now()`, [redemption.email, redemption.tokenTypes]);
+    await query(`delete from auth.one_time_tokens where lower(email) = lower($1) and attempts >= $2`, [redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
   }
   async verifyToken(req) {
     const body = await req.json().catch(() => ({}));
     const token = body.token ?? body.token_hash;
     if (!token)
       return authError(400, "validation_failed", "token or token_hash is required");
+    if (body.type === "phone_change") {
+      const phone = normalizePhone(body.phone);
+      if (!phone || !body.token || !/^\d{6,10}$/.test(body.token)) {
+        return authError(400, "validation_failed", "phone, token, and type=phone_change are required");
+      }
+      const fingerprint = await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-fingerprint:v1", phone);
+      const limited = this.limitKey("verify", `phone:${fingerprint}`);
+      if (limited)
+        return limited;
+      const session = await this.redeemPhoneChange(phone, body.token);
+      if (!session)
+        return authError(403, "otp_expired", "Token has expired or is invalid");
+      return json(200, session);
+    }
     if (body.type === "sms" || body.phone !== undefined) {
       const phone = normalizePhone(body.phone);
       if (body.type !== "sms" || !phone || !body.token || !/^\d{6,10}$/.test(body.token)) {
@@ -1880,8 +3536,22 @@ Or sign in with this link: ${link}`
         return authError(403, "otp_expired", "Token has expired or is invalid");
       return json(200, session);
     }
-    const types = body.type === "recovery" ? ["recovery"] : body.type === "magiclink" ? ["magiclink"] : ["otp", "magiclink"];
-    const session = await this.redeem(token, types, body.email);
+    if (body.type === "email_change") {
+      const result = await this.redeemEmailChange(token, body.email);
+      if (!result)
+        return authError(403, "otp_expired", "Token has expired or is invalid");
+      if ("pending" in result) {
+        return json(200, {
+          msg: "Confirmation link accepted. Please proceed to confirm link sent to the other email",
+          code: "200"
+        });
+      }
+      return json(200, result);
+    }
+    const types = body.type === "recovery" ? ["recovery"] : body.type === "magiclink" ? ["magiclink"] : body.type === "signup" || body.type === "invite" ? [body.type] : ["otp", "magiclink"];
+    const session = await this.redeem(token, types, body.email, {
+      amr: [{ method: body.type === "recovery" ? "recovery" : "otp", timestamp: Math.floor(Date.now() / 1000) }]
+    });
     if (!session)
       return authError(403, "otp_expired", "Token has expired or is invalid");
     return json(200, session);
@@ -1929,24 +3599,199 @@ Or sign in with this link: ${link}`
       const user = users.rows[0];
       if (!user)
         return null;
-      await query(`insert into auth.identities (user_id, provider, provider_id, identity_data, last_sign_in_at)
-         values ($1, 'phone', $2, $3::jsonb, now())
-         on conflict (provider, provider_id) do update
-         set identity_data = excluded.identity_data, last_sign_in_at = now(), updated_at = now()`, [user.id, phone, JSON.stringify({ sub: user.id, phone, phone_verified: true })]);
+      await this.ensurePhoneIdentity(user, query);
+      await query(`update auth.identities
+         set last_sign_in_at = now(), updated_at = now()
+         where user_id = $1 and provider = 'phone' and provider_id = $2`, [user.id, phone]);
       return this.sessionFor(user, undefined, { amr: [{ method: "otp", timestamp: Math.floor(Date.now() / 1000) }] }, query);
     });
   }
+  async redeemPhoneChange(phone, code) {
+    const tokenDigest = `hmac-sha256:v1:${await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-otp:v1", `${phone}\x00${code}`)}`;
+    return this.db.transaction(async (query) => {
+      const candidate = (await query(`select id, user_id from auth.one_time_tokens
+         where phone = $1 and token_type = 'phone_change' and token = $2 and expires_at > now()
+         limit 1`, [phone, tokenDigest])).rows[0];
+      if (!candidate)
+        return null;
+      const currentResult = await query(`select * from auth.users where id = $1 and phone_change = $2 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [candidate.user_id, phone]);
+      const current = currentResult.rows[0];
+      if (!current)
+        return null;
+      const clash = await query(`select id from auth.users where phone = $1 and id <> $2`, [phone, current.id]);
+      if (clash.rows.length > 0)
+        return null;
+      const claimed = await query(`delete from auth.one_time_tokens where id = $1 and token = $2 returning id`, [candidate.id, tokenDigest]);
+      if (claimed.rows.length === 0)
+        return null;
+      await query(`delete from auth.identities where user_id = $1 and provider = 'phone'`, [current.id]);
+      const updated = (await query(`update auth.users
+         set phone = $1, phone_confirmed_at = now(),
+             phone_change = null, phone_change_token = '', phone_change_sent_at = null,
+             updated_at = now()
+         where id = $2 and deleted_at is null
+           and (banned_until is null or banned_until <= now())
+         returning *`, [phone, current.id])).rows[0];
+      if (!updated)
+        return null;
+      await this.ensurePhoneIdentity(updated, query);
+      return this.sessionFor(updated, undefined, { amr: [{ method: "otp", timestamp: Math.floor(Date.now() / 1000) }] }, query);
+    });
+  }
   async verifyLink(url) {
     const token = url.searchParams.get("token") ?? "";
     const type = url.searchParams.get("type") ?? "magiclink";
     const redirectTo = resolveRedirect(url.searchParams.get("redirect_to"), this.config.siteUrl, this.config.uriAllowList, this.config.enforceRedirectAllowList);
-    const session = await this.redeem(token, [type]);
+    const flow = (await this.db.query(`select id, provider, redirect_to, code_challenge, code_challenge_method
+       from auth.flow_state
+       where provider in ('email', 'email-recovery', 'email-change')
+         and provider_state = $1 and auth_code is null and expires_at > now()`, [token])).rows[0];
+    const emailChange = type === "email_change" ? await this.redeemEmailChangeUser(token) : null;
+    if (emailChange === "pending") {
+      return redirectWithQuery2(redirectTo, {
+        message: "Confirmation link accepted. Please proceed to confirm link sent to the other email"
+      });
+    }
+    let user = null;
+    let session = null;
+    if (type === "email_change") {
+      user = emailChange;
+    } else if (flow) {
+      user = await this.redeemUser(token, [type]);
+    } else {
+      session = await this.redeem(token, [type], undefined, {
+        amr: [{ method: type === "recovery" ? "recovery" : "otp", timestamp: Math.floor(Date.now() / 1000) }]
+      });
+    }
+    if (type === "email_change" || flow) {
+      if (!user) {
+        return new Response(null, { status: 303, headers: { location: redirectTo + "#error=access_denied&error_code=otp_expired" } });
+      }
+      if (flow) {
+        const authCode = randomToken(24);
+        const claimed = await this.db.query(`update auth.flow_state
+           set auth_code = $1, user_id = $2, expires_at = now() + interval '5 minutes'
+           where id = $3 and auth_code is null and expires_at > now()
+           returning redirect_to`, [authCode, user.id, flow.id]);
+        const target = claimed.rows[0]?.redirect_to;
+        if (target)
+          return redirectWithQuery2(target, { code: authCode });
+      }
+      session = await this.sessionFor(user, undefined, {
+        amr: [{ method: type === "recovery" ? "recovery" : "otp", timestamp: Math.floor(Date.now() / 1000) }]
+      });
+    }
     if (!session) {
-      return new Response(null, { status: 303, headers: { location: `${redirectTo}#error=access_denied&error_code=otp_expired` } });
+      return new Response(null, { status: 303, headers: { location: redirectTo + "#error=access_denied&error_code=otp_expired" } });
     }
     const hash = `#access_token=${session.access_token}&refresh_token=${session.refresh_token}&expires_in=${session.expires_in}&token_type=bearer&type=${type}`;
     return new Response(null, { status: 303, headers: { location: `${redirectTo}${hash}` } });
   }
+  async exchangeEmailPkce(authCode, verifier) {
+    return this.db.transaction(async (query) => {
+      const flow = (await query(`select id, provider, redirect_to, code_challenge, code_challenge_method
+         from auth.flow_state
+         where provider in ('email', 'email-recovery', 'email-change')
+           and auth_code = $1 and expires_at > now()`, [authCode])).rows[0];
+      if (!flow)
+        return null;
+      if (flow.code_challenge_method === "s256" || flow.code_challenge_method === "S256") {
+        const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+        const challenge = base64url2(new Uint8Array(digest));
+        if (challenge !== flow.code_challenge)
+          return null;
+      } else if (flow.code_challenge !== verifier) {
+        return null;
+      }
+      const claimed = await query(`delete from auth.flow_state where id = $1 and auth_code = $2 and expires_at > now()
+         returning user_id`, [flow.id, authCode]);
+      const userId = claimed.rows[0]?.user_id;
+      return userId ? { userId, provider: flow.provider } : null;
+    });
+  }
+  async redeemEmailChangeUser(token, email) {
+    return this.db.transaction((query) => this.claimEmailChange(query, token, email));
+  }
+  async redeemEmailChange(token, email) {
+    return this.db.transaction(async (query) => {
+      const user = await this.claimEmailChange(query, token, email);
+      if (user === "pending")
+        return { pending: true };
+      return user ? this.sessionFor(user, undefined, {
+        amr: [{ method: "otp", timestamp: Math.floor(Date.now() / 1000) }]
+      }, query) : null;
+    });
+  }
+  async claimEmailChange(query, token, email) {
+    const candidate = (await query(`select id, user_id, email, token_type from auth.one_time_tokens
+       where token = $1 and token_type in ('email_change', 'email_change_current', 'email_change_new')
+         and expires_at > now()
+         and ($2::text is null or lower(email) = lower($2))
+       limit 1`, [token, email?.toLowerCase().trim() ?? null])).rows[0];
+    if (!candidate)
+      return null;
+    const currentResult = await query(`select * from auth.users where id = $1 and email_change is not null and deleted_at is null
+         and (banned_until is null or banned_until <= now()) for update`, [candidate.user_id]);
+    const current = currentResult.rows[0];
+    if (!current)
+      return null;
+    if (candidate.token_type === "email_change" ? current.email_change?.toLowerCase() !== candidate.email.toLowerCase() : candidate.token_type === "email_change_current" ? current.email?.toLowerCase() !== candidate.email.toLowerCase() : current.email_change?.toLowerCase() !== candidate.email.toLowerCase())
+      return null;
+    const targetEmail = candidate.token_type === "email_change_current" ? current.email_change : candidate.email;
+    if (!targetEmail)
+      return null;
+    const clash = await query(`select id from auth.users where lower(email) = lower($1) and id <> $2`, [targetEmail, candidate.user_id]);
+    if (clash.rows.length > 0)
+      return null;
+    const needsSecondConfirmation = candidate.token_type !== "email_change";
+    if (needsSecondConfirmation && (current.email_change_confirm_status ?? 0) === 0) {
+      const deleted = await query(`delete from auth.one_time_tokens
+         where user_id = $1 and token_type = $2 returning id`, [candidate.user_id, candidate.token_type]);
+      if (deleted.rows.length === 0)
+        return null;
+      const updated = (await query(`update auth.users
+         set email_change_confirm_status = 1,
+             email_change_token_current = case when $1 = 'email_change_current' then '' else email_change_token_current end,
+             email_change_token_new = case when $1 = 'email_change_new' then '' else email_change_token_new end,
+             updated_at = now()
+         where id = $2
+         returning *`, [candidate.token_type, candidate.user_id])).rows[0];
+      return updated ? "pending" : null;
+    }
+    const deleted = await query(`delete from auth.one_time_tokens where user_id = $1
+       and token_type = $2 returning id`, [candidate.user_id, candidate.token_type]);
+    if (deleted.rows.length === 0)
+      return null;
+    const updated = (await query(`update auth.users
+         set email = $1, email_confirmed_at = now(),
+           email_change = null, email_change_sent_at = null,
+           email_change_token_current = '', email_change_token_new = '',
+           email_change_confirm_status = 0,
+             is_anonymous = false,
+             raw_app_meta_data = case when is_anonymous
+               then coalesce(raw_app_meta_data, '{}'::jsonb) || '{"provider":"email","providers":["email"]}'::jsonb
+               else raw_app_meta_data end,
+           updated_at = now()
+       where id = $2
+       returning *`, [targetEmail, candidate.user_id])).rows[0];
+    if (!updated)
+      return null;
+    await this.ensureEmailIdentity(updated, query);
+    return updated;
+  }
+  async sessionForEmailPkce(userId, provider) {
+    return this.db.transaction(async (query) => {
+      const result = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [userId]);
+      const user = result.rows[0];
+      if (!user)
+        throw new OAuthAccountIneligibleError("user_not_found");
+      return this.sessionFor(user, undefined, {
+        amr: [{ method: provider === "email-recovery" ? "recovery" : "otp", timestamp: Math.floor(Date.now() / 1000) }]
+      }, query);
+    });
+  }
   async admin(req, ctx, path, method) {
     if (ctx.role !== "service_role") {
       return authError(403, "insufficient_permissions", "Admin endpoints require the service_role key");
@@ -1979,30 +3824,96 @@ Or sign in with this link: ${link}`
       return json(200, { id: factorMatch[2] });
     }
     if (path === "admin/users" && method === "GET") {
-      const res = await this.db.query(`select * from auth.users order by created_at desc limit 1000`);
-      return json(200, { users: res.rows.map((user) => this.userJson(user)), aud: "authenticated" });
+      const requestUrl = new URL(req.url);
+      const pageValue = requestUrl.searchParams.get("page");
+      const perPageValue = requestUrl.searchParams.get("per_page");
+      const page = pageValue === null ? 1 : Number(pageValue);
+      const perPage = perPageValue === null ? 50 : Number(perPageValue);
+      if (!Number.isInteger(page) || page < 1 || !Number.isInteger(perPage) || perPage < 1 || perPage > 1000) {
+        return authError(400, "validation_failed", "page must be a positive integer and per_page must be between 1 and 1000");
+      }
+      const total = Number((await this.db.query(`select count(*)::int as count from auth.users`)).rows[0]?.count ?? 0);
+      const res = await this.db.query(`select * from auth.users order by created_at desc, id desc limit $1 offset $2`, [perPage, (page - 1) * perPage]);
+      const lastPage = Math.max(1, Math.ceil(total / perPage));
+      const linkUrl = (targetPage) => {
+        const target = new URL(requestUrl);
+        target.searchParams.set("page", String(targetPage));
+        target.searchParams.set("per_page", String(perPage));
+        return target.toString();
+      };
+      const links = [
+        `<${linkUrl(1)}>; rel="first"`,
+        `<${linkUrl(lastPage)}>; rel="last"`,
+        ...page > 1 ? [`<${linkUrl(page - 1)}>; rel="prev"`] : [],
+        ...page < lastPage ? [`<${linkUrl(page + 1)}>; rel="next"`] : []
+      ];
+      return json(200, { users: res.rows.map((user) => this.userJson(user)), aud: "authenticated" }, { "x-total-count": String(total), link: links.join(", ") });
     }
     if (path === "admin/users" && method === "POST") {
       const body = await req.json().catch(() => ({}));
-      if (!body.email)
-        return authError(400, "validation_failed", "email is required");
-      const email = body.email;
+      const email = normalizeEmailInput(body.email);
+      if (body.email !== undefined && !email)
+        return authError(400, "validation_failed", "email must not be empty");
+      const phone = body.phone === undefined ? null : normalizePhone(body.phone);
+      if (body.phone !== undefined && !phone) {
+        return authError(400, "validation_failed", "phone must be a valid E.164 number");
+      }
+      if (!email && !phone)
+        return authError(400, "validation_failed", "email or phone is required");
+      if (body.phone_confirm !== undefined && typeof body.phone_confirm !== "boolean") {
+        return authError(400, "validation_failed", "phone_confirm must be a boolean");
+      }
+      const banSeconds = body.ban_duration === undefined ? null : banDurationSeconds(body.ban_duration);
+      if (banSeconds === undefined)
+        return authError(400, "validation_failed", "ban_duration is invalid");
       const hashed = body.password ? await hashPassword(body.password) : null;
       const created = await this.db.transaction(async (query) => {
+        if (email) {
+          const existing = await query(`select id from auth.users where lower(email) = $1 for update`, [email]);
+          if (existing.rows.length > 0)
+            return { error: "email_exists" };
+        }
+        if (phone) {
+          const phoneExisting = await query(`select id from auth.users where phone = $1 for update`, [phone]);
+          if (phoneExisting.rows.length > 0)
+            return { error: "phone_exists" };
+        }
         const res = await query(`insert into auth.users
-             (aud, role, email, encrypted_password, email_confirmed_at, raw_app_meta_data, raw_user_meta_data)
-           values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end, $4, $5)
+             (aud, role, email, encrypted_password, email_confirmed_at, phone, phone_confirmed_at,
+              banned_until, raw_app_meta_data, raw_user_meta_data)
+           values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end,
+                   $4, case when $5 then now() else null end,
+                   case when $6::double precision is null then null
+                     else now() + ($6::double precision * interval '1 second') end, $7, $8)
+           on conflict do nothing
            returning *`, [
-          email.toLowerCase().trim(),
+          email,
           hashed,
-          body.email_confirm ?? true,
-          JSON.stringify({ provider: "email", providers: ["email"], ...body.app_metadata ?? {} }),
+          body.email_confirm ?? false,
+          phone,
+          body.phone_confirm === true,
+          banSeconds,
+          JSON.stringify({
+            provider: email ? "email" : "phone",
+            providers: email && phone ? ["email", "phone"] : [email ? "email" : "phone"],
+            ...body.app_metadata ?? {}
+          }),
           JSON.stringify(body.user_metadata ?? {})
         ]);
         const user = res.rows[0];
-        await this.ensureEmailIdentity(user, query);
+        if (!user)
+          return null;
+        if (email)
+          await this.ensureEmailIdentity(user, query);
+        if (phone)
+          await this.ensurePhoneIdentity(user, query);
         return this.userJsonWithRelations(user, query);
       });
+      if (!created)
+        return authError(422, "email_exists", "A user with this email address has already been registered");
+      if ("error" in created) {
+        return authError(422, created.error, created.error === "email_exists" ? "A user with this email address has already been registered" : "A user with this phone number has already been registered");
+      }
       return json(200, created);
     }
     if (idMatch && method === "GET") {
@@ -2015,14 +3926,43 @@ Or sign in with this link: ${link}`
       const body = await req.json().catch(() => ({}));
       const sets = [];
       const params = [];
-      if (typeof body.email === "string") {
-        params.push(body.email.toLowerCase().trim());
+      const requestedEmail = body.email === undefined ? undefined : normalizeEmailInput(body.email);
+      if (body.email !== undefined && !requestedEmail)
+        return authError(400, "validation_failed", "email must not be empty");
+      if (requestedEmail) {
+        params.push(requestedEmail);
         sets.push(`email = $${params.length}`);
       }
       if (typeof body.password === "string") {
         params.push(await hashPassword(body.password));
         sets.push(`encrypted_password = $${params.length}`);
       }
+      const requestedPhone = body.phone === undefined ? undefined : normalizePhone(body.phone);
+      if (body.phone !== undefined && !requestedPhone) {
+        return authError(400, "validation_failed", "phone must be a valid E.164 number");
+      }
+      if (body.phone_confirm !== undefined && typeof body.phone_confirm !== "boolean") {
+        return authError(400, "validation_failed", "phone_confirm must be a boolean");
+      }
+      if (body.ban_duration !== undefined) {
+        const seconds = banDurationSeconds(body.ban_duration);
+        if (seconds === undefined)
+          return authError(400, "validation_failed", "ban_duration is invalid");
+        if (seconds === null) {
+          sets.push("banned_until = null");
+        } else {
+          params.push(seconds);
+          sets.push(`banned_until = now() + ($${params.length} * interval '1 second')`);
+        }
+      }
+      if (requestedPhone) {
+        params.push(requestedPhone);
+        sets.push(`phone = $${params.length}`);
+      }
+      if (body.phone_confirm === true)
+        sets.push("phone_confirmed_at = now()");
+      if (body.phone_confirm === false)
+        sets.push("phone_confirmed_at = null");
       if (body.user_metadata) {
         params.push(JSON.stringify(body.user_metadata));
         sets.push(`raw_user_meta_data = $${params.length}::jsonb`);
@@ -2032,70 +3972,175 @@ Or sign in with this link: ${link}`
         sets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || $${params.length}::jsonb`);
       }
       if (body.email_confirm === true)
-        sets.push(`email_confirmed_at = now()`);
+        sets.push("email_confirmed_at = now()");
+      if (body.email_confirm === false)
+        sets.push("email_confirmed_at = null");
       if (sets.length === 0)
         return authError(400, "validation_failed", "nothing to update");
       params.push(idMatch[1]);
-      const updated = await this.db.transaction(async (query) => {
-        const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
-        const user = res.rows[0];
-        if (!user)
-          return null;
-        if (typeof body.email === "string")
-          await this.ensureEmailIdentity(user, query);
-        return this.userJsonWithRelations(user, query);
-      });
+      let updated;
+      let emailConflict = false;
+      let phoneConflict = false;
+      try {
+        updated = await this.db.transaction(async (query) => {
+          if (requestedEmail) {
+            const clash = await query(`select id from auth.users where lower(email) = $1 and id <> $2`, [requestedEmail, idMatch[1]]);
+            if (clash.rows.length > 0) {
+              emailConflict = true;
+              return null;
+            }
+          }
+          if (requestedPhone) {
+            const clash = await query(`select id from auth.users where phone = $1 and id <> $2`, [requestedPhone, idMatch[1]]);
+            if (clash.rows.length > 0) {
+              phoneConflict = true;
+              return null;
+            }
+          }
+          const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
+          const user = res.rows[0];
+          if (!user)
+            return null;
+          if (requestedEmail)
+            await this.ensureEmailIdentity(user, query);
+          if (requestedPhone || body.phone_confirm !== undefined) {
+            if (requestedPhone) {
+              await query(`delete from auth.identities
+                 where user_id = $1 and provider = 'phone' and provider_id <> $2`, [user.id, requestedPhone]);
+            }
+            await this.ensurePhoneIdentity(user, query);
+          }
+          return this.userJsonWithRelations(user, query);
+        });
+      } catch (error) {
+        if (databaseDiagnosticCode(error) === "23505" && requestedEmail) {
+          return authError(422, "email_exists", "A user with this email address has already been registered");
+        }
+        if (databaseDiagnosticCode(error) === "23505" && requestedPhone) {
+          return authError(422, "phone_exists", "A user with this phone number has already been registered");
+        }
+        throw error;
+      }
+      if (emailConflict)
+        return authError(422, "email_exists", "A user with this email address has already been registered");
+      if (phoneConflict)
+        return authError(422, "phone_exists", "A user with this phone number has already been registered");
       if (!updated)
         return authError(404, "user_not_found", "User not found");
       return json(200, updated);
     }
     if (idMatch && method === "DELETE") {
-      return await this.eraseUser(idMatch[1]);
+      return await this.eraseUser(idMatch[1], req);
     }
     return authError(404, "not_found", `unknown admin endpoint`);
   }
-  async generateAdminMagicLink(req) {
+  async generateAdminMagicLink(req, sendEmail = false, forcedType) {
     const body = await req.json().catch(() => ({}));
-    if (body.type !== "magiclink") {
-      return authError(422, "unsupported_link_type", "Only magiclink generation is supported");
+    if (forcedType)
+      body.type = forcedType;
+    if (!["signup", "invite", "magiclink", "recovery", "email_change_current", "email_change_new"].includes(body.type ?? "")) {
+      return authError(422, "unsupported_link_type", "Unsupported email action link type");
     }
-    if (!body.email)
+    const email = normalizeEmailInput(body.email);
+    if (!email)
       return authError(400, "validation_failed", "email is required");
-    const email = body.email.toLowerCase().trim();
+    const newEmail = body.new_email === undefined ? null : normalizeEmailInput(body.new_email);
+    if (body.type === "email_change_current" || body.type === "email_change_new") {
+      if (!newEmail)
+        return authError(400, "validation_failed", "new_email is required");
+      if (newEmail === email)
+        return authError(422, "validation_failed", "new_email must differ from email");
+    }
+    if (body.type === "signup") {
+      if (!body.password) {
+        return authError(400, "validation_failed", "password is required for signup links");
+      }
+      if (body.password.length < this.settings.minPasswordLength) {
+        return authError(422, "weak_password", `Password should be at least ${this.settings.minPasswordLength} characters.`);
+      }
+    }
     const emailOtp = randomOtp(this.settings.otpLength);
     const hashedToken = await sha256Hex(randomToken(32));
     const expiry = `${this.settings.otpExpirySeconds} seconds`;
+    const passwordHash = body.type === "signup" ? await hashPassword(body.password) : null;
     const requestUrl = new URL(req.url);
     const redirectTo = resolveRedirect(requestUrl.searchParams.get("redirect_to") ?? body.redirect_to, this.config.siteUrl, this.config.uriAllowList, this.config.enforceRedirectAllowList);
     const user = await this.db.transaction(async (query) => {
-      const result = await query(`insert into auth.users
-           (aud, role, email, raw_app_meta_data, raw_user_meta_data)
-         values ('authenticated', 'authenticated', $1, '{"provider":"email","providers":["email"]}', $2::jsonb)
-         on conflict (email) do update set email = excluded.email
-         returning *`, [email, JSON.stringify(body.data ?? {})]);
-      const linkedUser = result.rows[0];
-      await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
-         values ($1::uuid, 'email', $1::text, $2::jsonb)
-         on conflict (provider, provider_id) do nothing`, [linkedUser.id, JSON.stringify({ sub: linkedUser.id, email })]);
+      const existing = await query(`select * from auth.users where lower(email) = $1 for update`, [email]);
+      let linkedUser = existing.rows[0];
+      if (!linkedUser && (body.type === "recovery" || body.type === "email_change_current" || body.type === "email_change_new")) {
+        return null;
+      }
+      if (linkedUser && (body.type === "signup" || body.type === "invite")) {
+        return { error: "email_exists" };
+      }
+      if (linkedUser && (body.type === "email_change_current" || body.type === "email_change_new")) {
+        const duplicate = await query(`select id from auth.users where lower(email) = $1 and id <> $2`, [newEmail, linkedUser.id]);
+        if (duplicate.rows.length > 0)
+          return { error: "email_exists" };
+        const tokenType = body.type;
+        await query(`delete from auth.one_time_tokens where user_id = $1 and token_type = $2`, [linkedUser.id, tokenType]);
+        await query(`insert into auth.one_time_tokens (user_id, email, token_type, token, expires_at)
+           values ($1, $2, $3, $4, now() + $5::interval),
+                  ($1, $2, $3, $6, now() + $5::interval)`, [linkedUser.id, tokenType === "email_change_current" ? email : newEmail, tokenType, emailOtp, expiry, hashedToken]);
+        const tokenColumn = tokenType === "email_change_current" ? "email_change_token_current" : "email_change_token_new";
+        await query(`update auth.users
+           set email_change = $1, email_change_sent_at = now(), email_change_confirm_status = 0,
+               ${tokenColumn} = $2, updated_at = now()
+           where id = $3`, [newEmail, hashedToken, linkedUser.id]);
+        return (await query(`select * from auth.users where id = $1`, [linkedUser.id])).rows[0];
+      }
+      if (!linkedUser) {
+        const result = await query(`insert into auth.users
+             (aud, role, email, encrypted_password, invited_at, raw_app_meta_data, raw_user_meta_data)
+           values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end,
+                   '{"provider":"email","providers":["email"]}', $4::jsonb)
+           on conflict (email) do update set email = excluded.email
+           returning *`, [email, passwordHash, body.type === "invite", JSON.stringify(body.data ?? {})]);
+        linkedUser = result.rows[0];
+      }
+      await this.ensureEmailIdentity(linkedUser, query);
       await query(`delete from auth.one_time_tokens
-         where email = $1 and token_type = any($2::text[])`, [email, "{otp,magiclink}"]);
+         where lower(email) = $1 and token_type = any($2::text[])`, [email, body.type === "magiclink" ? "{otp,magiclink}" : `{${body.type}}`]);
       await query(`insert into auth.one_time_tokens (user_id, email, token_type, token, expires_at)
-         values ($1, $2, 'otp', $3, now() + $5::interval),
-                ($1, $2, 'magiclink', $4, now() + $5::interval)`, [linkedUser.id, email, emailOtp, hashedToken, expiry]);
+         values ($1, $2, $3, $4, now() + $7::interval),
+                ($1, $2, $5, $6, now() + $7::interval)`, [
+        linkedUser.id,
+        email,
+        body.type === "magiclink" ? "otp" : body.type,
+        emailOtp,
+        body.type === "magiclink" ? "magiclink" : body.type,
+        hashedToken,
+        expiry
+      ]);
       return linkedUser;
     });
+    if (!user)
+      return authError(404, "user_not_found", "User not found");
+    if ("error" in user)
+      return authError(422, user.error, "A user with this email address has already been registered");
     const actionUrl = new URL(`${this.config.apiUrl}/auth/v1/verify`);
     actionUrl.searchParams.set("token", hashedToken);
-    actionUrl.searchParams.set("type", "magiclink");
+    actionUrl.searchParams.set("type", body.type === "email_change_current" || body.type === "email_change_new" ? "email_change" : body.type);
     actionUrl.searchParams.set("redirect_to", redirectTo);
-    await this.audit("user_magiclink_requested", { actorId: user.id, actorEmail: email, type: "admin" });
+    if (sendEmail) {
+      await this.audit("user_invited", { actorId: user.id, actorEmail: email, type: "admin" });
+      await this.config.mailer.send({
+        to: email,
+        subject: "You have been invited",
+        text: `Accept your invitation with this link: ${actionUrl}`
+      });
+      return json(200, { user: this.userJson(user, [], await this.getUserIdentities(user.id)) });
+    }
+    const auditAction = body.type === "invite" ? "user_invited" : body.type === "signup" ? "user_signedup" : body.type === "recovery" ? "user_recovery_requested" : body.type === "email_change_current" || body.type === "email_change_new" ? "user_email_change_requested" : "user_magiclink_requested";
+    await this.audit(auditAction, { actorId: user.id, actorEmail: email, type: "admin" });
     return json(200, {
       ...this.userJson(user, [], await this.getUserIdentities(user.id)),
       action_link: actionUrl.toString(),
       email_otp: emailOtp,
       hashed_token: hashedToken,
       redirect_to: redirectTo,
-      verification_type: "magiclink"
+      verification_type: body.type
     });
   }
   async audit(action, opts = {}) {
@@ -2142,17 +4187,46 @@ Or sign in with this link: ${link}`
       mfa_factors: factors.rows
     });
   }
-  async eraseUser(userId) {
+  async eraseUser(userId, req) {
+    const body = await req.json().catch(() => ({}));
+    const shouldSoftDelete = body.should_soft_delete === true;
+    const userResult = await this.db.query(`select * from auth.users where id = $1`, [userId]);
+    const user = userResult.rows[0];
+    if (!user)
+      return authError(404, "user_not_found", "User not found");
     const before = await this.db.query(`select
          (select count(*) from auth.identities where user_id = $1)::int as identities,
          (select count(*) from auth.refresh_tokens where user_id = $1)::int as sessions,
          (select count(*) from auth.mfa_factors where user_id = $1)::int as factors`, [userId]);
+    if (shouldSoftDelete) {
+      const deleted = await this.db.transaction(async (query) => {
+        const updated = await query(`update auth.users set deleted_at = coalesce(deleted_at, now()), updated_at = now()
+           where id = $1 returning *`, [userId]);
+        if (updated.rows.length === 0)
+          return null;
+        await query(`update auth.refresh_tokens set revoked = true, updated_at = now() where user_id = $1`, [userId]);
+        await query(`delete from auth.one_time_tokens where user_id = $1`, [userId]);
+        await query(`delete from auth.flow_state where user_id = $1`, [userId]);
+        return updated.rows[0];
+      });
+      if (!deleted)
+        return authError(404, "user_not_found", "User not found");
+      await this.audit("user_deleted", { actorId: userId, type: "admin", traits: { erased: false, soft_deleted: true } });
+      const c = before.rows[0];
+      return json(200, {
+        user: this.userJson(deleted),
+        erased: false,
+        user_id: userId,
+        cascaded: { identities: c.identities, sessions: c.sessions, mfa_factors: c.factors }
+      });
+    }
     const del = await this.db.query(`delete from auth.users where id = $1 returning id`, [userId]);
     if (del.rows.length === 0)
       return authError(404, "user_not_found", "User not found");
     const c = before.rows[0];
     await this.audit("user_deleted", { actorId: userId, type: "admin", traits: { erased: true } });
     return json(200, {
+      user: this.userJson(user),
       erased: true,
       user_id: userId,
       cascaded: { identities: c.identities, sessions: c.sessions, mfa_factors: c.factors }
@@ -2170,17 +4244,7 @@ Or sign in with this link: ${link}`
     if (!this.settings.totpEnrollEnabled) {
       return authError(422, "mfa_totp_enroll_disabled", "TOTP enrollment is disabled");
     }
-    const enrolled = await this.db.query(`select count(*)::int as n from auth.mfa_factors where user_id = $1`, [user.id]);
-    if (enrolled.rows[0].n >= this.settings.maxEnrolledFactors) {
-      return authError(422, "too_many_enrolled_mfa_factors", "Maximum number of enrolled MFA factors reached");
-    }
     const friendlyName = body.friendly_name ?? null;
-    if (friendlyName) {
-      const dup = await this.db.query(`select 1 from auth.mfa_factors where user_id = $1 and friendly_name = $2`, [user.id, friendlyName]);
-      if (dup.rows.length > 0) {
-        return authError(422, "mfa_factor_name_conflict", "A factor with this friendly name already exists");
-      }
-    }
     const secret = generateTotpSecret();
     let issuer = body.issuer;
     if (!issuer) {
@@ -2190,16 +4254,33 @@ Or sign in with this link: ${link}`
         issuer = "supacloud-lite";
       }
     }
-    const uri = otpauthUri({ secret, account: user.email || user.id, issuer });
-    const ins = await this.db.query(`insert into auth.mfa_factors (user_id, friendly_name, factor_type, status, secret)
-       values ($1, $2, 'totp', 'unverified', $3) returning id`, [user.id, friendlyName, secret]);
-    const id = ins.rows[0].id;
-    return json(200, {
-      id,
-      type: "totp",
-      friendly_name: friendlyName,
-      status: "unverified",
-      totp: { qr_code: qrSvgDataUri(uri), secret, uri }
+    return this.db.transaction(async (query) => {
+      const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+      const current = currentResult.rows[0];
+      if (!current)
+        return authError(401, "no_authorization", "Invalid or expired token");
+      const uri = otpauthUri({ secret, account: current.email || current.id, issuer });
+      const enrolled = await query(`select count(*)::int as n from auth.mfa_factors where user_id = $1`, [current.id]);
+      if (enrolled.rows[0].n >= this.settings.maxEnrolledFactors) {
+        return authError(422, "too_many_enrolled_mfa_factors", "Maximum number of enrolled MFA factors reached");
+      }
+      if (friendlyName) {
+        const dup = await query(`select 1 from auth.mfa_factors where user_id = $1 and friendly_name = $2`, [current.id, friendlyName]);
+        if (dup.rows.length > 0) {
+          return authError(422, "mfa_factor_name_conflict", "A factor with this friendly name already exists");
+        }
+      }
+      const ins = await query(`insert into auth.mfa_factors (user_id, friendly_name, factor_type, status, secret)
+         values ($1, $2, 'totp', 'unverified', $3) returning id`, [current.id, friendlyName, secret]);
+      const id = ins.rows[0].id;
+      return json(200, {
+        id,
+        type: "totp",
+        friendly_name: friendlyName,
+        status: "unverified",
+        totp: { qr_code: qrSvgDataUri(uri), secret, uri }
+      });
     });
   }
   async challengeFactor(req, factorId) {
@@ -2209,16 +4290,25 @@ Or sign in with this link: ${link}`
     if (!this.settings.totpVerifyEnabled) {
       return authError(422, "mfa_totp_verify_disabled", "TOTP verification is disabled");
     }
-    const fr = await this.db.query(`select id from auth.mfa_factors where id = $1 and user_id = $2`, [factorId, user.id]);
-    if (fr.rows.length === 0)
-      return authError(404, "mfa_factor_not_found", "MFA factor not found");
     const expiresAt = new Date(Date.now() + 300000).toISOString();
-    const ins = await this.db.query(`insert into auth.mfa_challenges (factor_id, expires_at) values ($1, $2) returning id, expires_at`, [factorId, expiresAt]);
-    const c = ins.rows[0];
-    return json(200, {
-      id: c.id,
-      type: "totp",
-      expires_at: Math.floor(new Date(c.expires_at).getTime() / 1000)
+    return this.db.transaction(async (query) => {
+      const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+      if (!currentResult.rows[0])
+        return authError(401, "no_authorization", "Invalid or expired token");
+      const fr = await query(`select id, factor_type from auth.mfa_factors where id = $1 and user_id = $2`, [factorId, user.id]);
+      if (fr.rows.length === 0)
+        return authError(404, "mfa_factor_not_found", "MFA factor not found");
+      if (fr.rows[0].factor_type === "recovery_code") {
+        return authError(422, "validation_failed", "Recovery code factors use the recovery-codes API");
+      }
+      const ins = await query(`insert into auth.mfa_challenges (factor_id, expires_at) values ($1, $2) returning id, expires_at`, [factorId, expiresAt]);
+      const c = ins.rows[0];
+      return json(200, {
+        id: c.id,
+        type: "totp",
+        expires_at: Math.floor(new Date(c.expires_at).getTime() / 1000)
+      });
     });
   }
   async verifyFactor(req, factorId) {
@@ -2229,10 +4319,13 @@ Or sign in with this link: ${link}`
       return authError(422, "mfa_totp_verify_disabled", "TOTP verification is disabled");
     }
     const body = await req.json().catch(() => ({}));
-    const fr = await this.db.query(`select id, secret, status from auth.mfa_factors where id = $1 and user_id = $2`, [factorId, user.id]);
+    const fr = await this.db.query(`select id, secret, status, factor_type from auth.mfa_factors where id = $1 and user_id = $2`, [factorId, user.id]);
     const factor = fr.rows[0];
     if (!factor)
       return authError(404, "mfa_factor_not_found", "MFA factor not found");
+    if (factor.factor_type === "recovery_code") {
+      return authError(422, "validation_failed", "Recovery code factors use the recovery-codes API");
+    }
     const cr = await this.db.query(`select id, expires_at, verified_at from auth.mfa_challenges where id = $1 and factor_id = $2`, [body.challenge_id ?? "", factorId]);
     const challenge = cr.rows[0];
     if (!challenge)
@@ -2252,12 +4345,17 @@ Or sign in with this link: ${link}`
       const currentUser = currentUsers.rows[0];
       if (!currentUser)
         return null;
+      const currentFactors = await query(`select id, secret, status, factor_type from auth.mfa_factors
+         where id = $1 and user_id = $2 for update`, [factorId, user.id]);
+      const currentFactor = currentFactors.rows[0];
+      if (!currentFactor || currentFactor.factor_type === "recovery_code" || !await verifyTotp(currentFactor.secret, body.code ?? ""))
+        return null;
       const claimed = await query(`update auth.mfa_challenges set verified_at = now()
          where id = $1 and factor_id = $2 and verified_at is null and expires_at >= now()
          returning id`, [challenge.id, factorId]);
       if (claimed.rows.length === 0)
         return null;
-      if (factor.status !== "verified") {
+      if (currentFactor.status !== "verified") {
         await query(`update auth.mfa_factors set status = 'verified', updated_at = now() where id = $1`, [factorId]);
       }
       return this.sessionFor(currentUser, undefined, {
@@ -2273,14 +4371,214 @@ Or sign in with this link: ${link}`
     }
     return json(200, session);
   }
+  async recoveryCodesStatus(req) {
+    const user = await this.userFromBearer(req);
+    if (!user)
+      return authError(401, "no_authorization", "This endpoint requires a Bearer token");
+    const result = await this.db.query(`select f.id, count(c.id)::int as total,
+              count(c.id) filter (where c.consumed_at is null)::int as remaining
+       from auth.mfa_recovery_code_sets s
+       join auth.mfa_factors f on f.id = s.mfa_factor_id
+       left join auth.mfa_recovery_codes c on c.mfa_recovery_code_set_id = s.id
+       where s.user_id = $1
+       group by f.id`, [user.id]);
+    const row = result.rows[0];
+    if (!row)
+      return authError(404, "mfa_factor_not_found", "The user has not enrolled recovery codes");
+    return json(200, { id: row.id, type: "recovery_code", total: row.total, remaining: row.remaining });
+  }
+  async generateRecoveryCodes(req) {
+    const user = await this.userFromBearer(req);
+    if (!user)
+      return authError(401, "no_authorization", "This endpoint requires a Bearer token");
+    if (!this.settings.recoveryCodesEnrollEnabled) {
+      return authError(422, "mfa_recovery_codes_enroll_not_enabled", "MFA enroll is disabled for recovery codes");
+    }
+    if (!await this.requireAal2(req))
+      return authError(403, "insufficient_aal", "AAL2 required to generate recovery codes");
+    const body = await req.json().catch(() => ({}));
+    const friendlyName = typeof body.friendly_name === "string" && body.friendly_name.trim() ? body.friendly_name.trim().slice(0, 255) : "Recovery codes";
+    const codes = Array.from({ length: this.settings.recoveryCodesCount }, () => randomRecoveryCode(this.settings.recoveryCodeLength));
+    const hashes = await Promise.all(codes.map((code) => hashPassword(code)));
+    return this.db.transaction(async (query) => {
+      const current = (await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id])).rows[0];
+      if (!current)
+        return authError(401, "no_authorization", "Invalid or expired token");
+      const existing = await query(`select 1 from auth.mfa_recovery_code_sets where user_id = $1`, [user.id]);
+      if (existing.rows.length > 0) {
+        return authError(422, "mfa_verified_factor_exists", "Recovery codes are already enrolled for this user, use regenerate to rotate them");
+      }
+      const verified = await query(`select count(*)::int as count from auth.mfa_factors
+         where user_id = $1 and status = 'verified' and factor_type <> 'recovery_code'`, [user.id]);
+      if ((verified.rows[0]?.count ?? 0) < 1) {
+        return authError(422, "mfa_recovery_codes_sole_factor", "At least one other verified factor is required to generate recovery codes");
+      }
+      const duplicate = await query(`select 1 from auth.mfa_factors where user_id = $1 and friendly_name = $2`, [user.id, friendlyName]);
+      if (duplicate.rows.length > 0) {
+        return authError(422, "mfa_factor_name_conflict", "A factor with this friendly name already exists");
+      }
+      const factors = await query(`select count(*)::int as count from auth.mfa_factors where user_id = $1`, [user.id]);
+      if ((factors.rows[0]?.count ?? 0) >= this.settings.maxEnrolledFactors) {
+        return authError(422, "too_many_enrolled_mfa_factors", "Maximum number of enrolled MFA factors reached");
+      }
+      const factor = (await query(`insert into auth.mfa_factors (user_id, friendly_name, factor_type, status)
+         values ($1, $2, 'recovery_code', 'verified') returning id`, [user.id, friendlyName])).rows[0];
+      const set = (await query(`insert into auth.mfa_recovery_code_sets (user_id, mfa_factor_id) values ($1, $2) returning id`, [user.id, factor.id])).rows[0];
+      for (const hash of hashes) {
+        await query(`insert into auth.mfa_recovery_codes (mfa_recovery_code_set_id, code_hash) values ($1, $2)`, [set.id, hash]);
+      }
+      return json(200, {
+        id: factor.id,
+        type: "recovery_code",
+        friendly_name: friendlyName,
+        total: codes.length,
+        codes
+      });
+    });
+  }
+  async regenerateRecoveryCodes(req) {
+    const user = await this.userFromBearer(req);
+    if (!user)
+      return authError(401, "no_authorization", "This endpoint requires a Bearer token");
+    if (!this.settings.recoveryCodesEnrollEnabled) {
+      return authError(422, "mfa_recovery_codes_enroll_not_enabled", "MFA enroll is disabled for recovery codes");
+    }
+    if (!await this.requireAal2(req))
+      return authError(403, "insufficient_aal", "AAL2 required to regenerate recovery codes");
+    const codes = Array.from({ length: this.settings.recoveryCodesCount }, () => randomRecoveryCode(this.settings.recoveryCodeLength));
+    const hashes = await Promise.all(codes.map((code) => hashPassword(code)));
+    return this.db.transaction(async (query) => {
+      const current = (await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id])).rows[0];
+      if (!current)
+        return authError(401, "no_authorization", "Invalid or expired token");
+      const set = (await query(`select id, mfa_factor_id from auth.mfa_recovery_code_sets where user_id = $1 for update`, [user.id])).rows[0];
+      if (!set)
+        return authError(404, "mfa_factor_not_found", "The user has not enrolled recovery codes");
+      const factor = (await query(`select id, friendly_name from auth.mfa_factors where id = $1 and user_id = $2`, [set.mfa_factor_id, user.id])).rows[0];
+      if (!factor)
+        return authError(404, "mfa_factor_not_found", "The user has not enrolled recovery codes");
+      await query(`delete from auth.mfa_recovery_codes where mfa_recovery_code_set_id = $1`, [set.id]);
+      for (const hash of hashes) {
+        await query(`insert into auth.mfa_recovery_codes (mfa_recovery_code_set_id, code_hash) values ($1, $2)`, [set.id, hash]);
+      }
+      await query(`update auth.mfa_recovery_code_sets
+         set failed_verification_count = 0, verification_locked_until = null, updated_at = now()
+         where id = $1`, [set.id]);
+      return json(200, {
+        id: factor.id,
+        type: "recovery_code",
+        friendly_name: factor.friendly_name ?? "Recovery codes",
+        total: codes.length,
+        codes
+      });
+    });
+  }
+  async deleteRecoveryCodes(req) {
+    const user = await this.userFromBearer(req);
+    if (!user)
+      return authError(401, "no_authorization", "This endpoint requires a Bearer token");
+    if (!await this.requireAal2(req))
+      return authError(403, "insufficient_aal", "AAL2 required to delete recovery codes");
+    return this.db.transaction(async (query) => {
+      const current = (await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id])).rows[0];
+      if (!current)
+        return authError(401, "no_authorization", "Invalid or expired token");
+      const factor = (await query(`select mfa_factor_id as id from auth.mfa_recovery_code_sets where user_id = $1 for update`, [user.id])).rows[0];
+      if (!factor)
+        return authError(404, "mfa_factor_not_found", "The user has not enrolled recovery codes");
+      await query(`delete from auth.mfa_recovery_codes
+         where mfa_recovery_code_set_id in (select id from auth.mfa_recovery_code_sets where user_id = $1)`, [user.id]);
+      await query(`delete from auth.mfa_recovery_code_sets where user_id = $1`, [user.id]);
+      await query(`delete from auth.mfa_factors where id = $1 and user_id = $2`, [factor.id, user.id]);
+      return json(200, { id: factor.id });
+    });
+  }
+  async verifyRecoveryCode(req) {
+    const user = await this.userFromBearer(req);
+    if (!user)
+      return authError(401, "no_authorization", "This endpoint requires a Bearer token");
+    if (!this.settings.recoveryCodesVerifyEnabled) {
+      return authError(422, "mfa_recovery_codes_verify_not_enabled", "MFA verification is disabled for recovery codes");
+    }
+    const body = await req.json().catch(() => ({}));
+    const code = normalizeRecoveryCode(body.code);
+    if (!code)
+      return authError(400, "validation_failed", "Code needs to be non-empty");
+    return this.db.transaction(async (query) => {
+      const current = (await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id])).rows[0];
+      if (!current)
+        return authError(401, "no_authorization", "Invalid or expired token");
+      const set = (await query(`select id, failed_verification_count, verification_locked_until
+         from auth.mfa_recovery_code_sets where user_id = $1 for update`, [user.id])).rows[0];
+      if (!set)
+        return authError(422, "mfa_verification_failed", "Invalid recovery code entered");
+      if (set.verification_locked_until && new Date(set.verification_locked_until).getTime() > Date.now()) {
+        return authError(429, "mfa_recovery_codes_locked", "Too many failed verification attempts, try again later");
+      }
+      const entries = await query(`select id, code_hash from auth.mfa_recovery_codes
+         where mfa_recovery_code_set_id = $1 and consumed_at is null`, [set.id]);
+      let matched = null;
+      for (const entry of entries.rows) {
+        if (await verifyPassword(code, entry.code_hash) && matched === null)
+          matched = entry.id;
+      }
+      if (!matched) {
+        const failures = set.failed_verification_count + 1;
+        await query(`update auth.mfa_recovery_code_sets
+           set failed_verification_count = $1::int,
+               verification_locked_until = case when $1::int >= $2::int
+                 then now() + $3::interval else verification_locked_until end,
+               updated_at = now()
+           where id = $4::uuid`, [failures, this.settings.recoveryCodesMaxVerifyAttempts, `${this.settings.recoveryCodesLockoutSeconds} seconds`, set.id]);
+        return authError(422, "mfa_verification_failed", "Invalid recovery code entered");
+      }
+      const consumed = await query(`update auth.mfa_recovery_codes set consumed_at = now()
+         where id = $1 and consumed_at is null returning id`, [matched]);
+      if (consumed.rows.length === 0)
+        return authError(422, "mfa_verification_failed", "Invalid recovery code entered");
+      await query(`update auth.mfa_recovery_code_sets
+         set failed_verification_count = 0, verification_locked_until = null, updated_at = now()
+         where id = $1`, [set.id]);
+      const session = await this.sessionFor(current, undefined, {
+        aal: "aal2",
+        amr: [
+          { method: "password", timestamp: Math.floor(Date.now() / 1000) },
+          { method: "mfa/recovery_code", timestamp: Math.floor(Date.now() / 1000) }
+        ]
+      }, query);
+      return json(200, session);
+    });
+  }
+  async requireAal2(req) {
+    const claims = await this.claimsFromBearer(req);
+    return claims?.aal === "aal2";
+  }
   async unenrollFactor(req, factorId) {
     const user = await this.userFromBearer(req);
     if (!user)
       return authError(401, "no_authorization", "This endpoint requires a Bearer token");
-    const del = await this.db.query(`delete from auth.mfa_factors where id = $1 and user_id = $2 returning id`, [factorId, user.id]);
-    if (del.rows.length === 0)
-      return authError(404, "mfa_factor_not_found", "MFA factor not found");
-    return json(200, { id: factorId });
+    const hasAal2 = await this.requireAal2(req);
+    return this.db.transaction(async (query) => {
+      const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+      if (!currentResult.rows[0])
+        return authError(401, "no_authorization", "Invalid or expired token");
+      const factor = await query(`select id, factor_type, status from auth.mfa_factors where id = $1 and user_id = $2 for update`, [factorId, user.id]);
+      if (factor.rows.length === 0)
+        return authError(404, "mfa_factor_not_found", "MFA factor not found");
+      if (factor.rows[0].factor_type === "recovery_code") {
+        return authError(422, "validation_failed", "Recovery code factors use the recovery-codes API");
+      }
+      if (factor.rows[0].status === "verified" && !hasAal2) {
+        return authError(403, "insufficient_aal", "AAL2 required to unenroll a verified MFA factor");
+      }
+      const del = await query(`delete from auth.mfa_factors where id = $1 and user_id = $2 returning id`, [factorId, user.id]);
+      return json(200, { id: factorId });
+    });
   }
   async getUserFactors(userId, query = (sql, params) => this.db.query(sql, params)) {
     const res = await query(`select id, friendly_name, factor_type, status, created_at, updated_at
@@ -2308,13 +4606,45 @@ Or sign in with this link: ${link}`
       updated_at: iso(r.updated_at)
     }));
   }
-  async ensureEmailIdentity(user, query = (sql, params) => this.db.query(sql, params)) {
+  async ensureEmailIdentity(user, query = (sql, params) => this.db.query(sql, params), syncProviders = true) {
     if (!user.email)
       return;
     await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
        values ($1::uuid, 'email', $1::text, $2::jsonb)
        on conflict (provider, provider_id) do update
        set identity_data = excluded.identity_data, updated_at = now()`, [user.id, JSON.stringify({ sub: user.id, email: user.email })]);
+    if (syncProviders)
+      await this.syncUserProviders(user, query);
+  }
+  async ensurePhoneIdentity(user, query = (sql, params) => this.db.query(sql, params)) {
+    if (!user.phone)
+      return;
+    await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+       values ($1::uuid, 'phone', $2, $3::jsonb)
+       on conflict (provider, provider_id) do update
+       set identity_data = excluded.identity_data, updated_at = now()`, [user.id, user.phone, JSON.stringify({ sub: user.id, phone: user.phone, phone_verified: Boolean(user.phone_confirmed_at) })]);
+    await this.syncUserProviders(user, query);
+  }
+  async syncUserProviders(user, query = (sql, params) => this.db.query(sql, params)) {
+    const updated = (await query(`update auth.users
+       set raw_app_meta_data = jsonb_set(
+         coalesce(raw_app_meta_data, '{}'::jsonb),
+         '{providers}',
+         (
+           select jsonb_agg(provider order by provider)
+           from (
+             select distinct provider
+             from auth.identities
+             where user_id = $1
+           ) as providers
+         ),
+         true
+       ),
+       updated_at = now()
+       where id = $1
+       returning *`, [user.id])).rows[0];
+    if (updated)
+      Object.assign(user, updated);
   }
   async userJsonWithRelations(user, query = (sql, params) => this.db.query(sql, params)) {
     return this.userJson(user, await this.getUserFactors(user.id, query), await this.getUserIdentities(user.id, query));
@@ -2400,6 +4730,14 @@ Or sign in with this link: ${link}`
       phone: u.phone ?? "",
       phone_confirmed_at: iso(u.phone_confirmed_at),
       confirmed_at: iso(u.email_confirmed_at ?? u.phone_confirmed_at),
+      ...u.email_change ? {
+        new_email: u.email_change,
+        email_change_sent_at: iso(u.email_change_sent_at)
+      } : {},
+      ...u.phone_change ? {
+        new_phone: u.phone_change,
+        phone_change_sent_at: iso(u.phone_change_sent_at)
+      } : {},
       last_sign_in_at: iso(u.last_sign_in_at),
       app_metadata: u.raw_app_meta_data ?? {},
       user_metadata: u.raw_user_meta_data ?? {},
@@ -3211,6 +5549,11 @@ create table if not exists auth.users (
   email text unique,
   encrypted_password text,
   email_confirmed_at timestamptz,
+  email_change_token_new text default '',
+  email_change text,
+  email_change_sent_at timestamptz,
+  email_change_token_current text default '',
+  email_change_confirm_status smallint default 0,
   last_sign_in_at timestamptz,
   raw_app_meta_data jsonb default '{}'::jsonb,
   raw_user_meta_data jsonb default '{}'::jsonb,
@@ -3219,11 +5562,23 @@ create table if not exists auth.users (
   updated_at timestamptz default now(),
   phone text unique,
   phone_confirmed_at timestamptz,
+  phone_change text default '',
+  phone_change_token text default '',
+  phone_change_sent_at timestamptz,
   banned_until timestamptz,
   deleted_at timestamptz,
   is_anonymous boolean default false
 );
 
+alter table auth.users add column if not exists email_change text;
+alter table auth.users add column if not exists email_change_sent_at timestamptz;
+alter table auth.users add column if not exists email_change_token_new text default '';
+alter table auth.users add column if not exists email_change_token_current text default '';
+alter table auth.users add column if not exists email_change_confirm_status smallint default 0;
+alter table auth.users add column if not exists phone_change text default '';
+alter table auth.users add column if not exists phone_change_token text default '';
+alter table auth.users add column if not exists phone_change_sent_at timestamptz;
+
 create table if not exists auth.refresh_tokens (
   id bigserial primary key,
   token text unique not null,
@@ -3292,6 +5647,7 @@ create table if not exists auth.flow_state (
   created_at timestamptz default now(),
   expires_at timestamptz not null
 );
+alter table auth.flow_state add column if not exists link_user_id uuid;
 
 create table if not exists auth.mfa_factors (
   id uuid primary key default gen_random_uuid(),
@@ -3312,6 +5668,25 @@ create table if not exists auth.mfa_challenges (
   expires_at timestamptz not null
 );
 
+create table if not exists auth.mfa_recovery_code_sets (
+  id uuid primary key default gen_random_uuid(),
+  user_id uuid not null,
+  mfa_factor_id uuid not null unique,
+  failed_verification_count int not null default 0,
+  verification_locked_until timestamptz,
+  created_at timestamptz default now(),
+  updated_at timestamptz default now(),
+  unique (user_id)
+);
+
+create table if not exists auth.mfa_recovery_codes (
+  id uuid primary key default gen_random_uuid(),
+  mfa_recovery_code_set_id uuid not null references auth.mfa_recovery_code_sets(id) on delete cascade,
+  code_hash text not null,
+  consumed_at timestamptz,
+  created_at timestamptz default now()
+);
+
 create table if not exists auth.audit_log_entries (
   id uuid primary key default gen_random_uuid(),
   payload jsonb,
@@ -3511,6 +5886,12 @@ create table if not exists auth.users (
   is_anonymous boolean default false
 );
 
+alter table auth.users add column if not exists email_change text;
+alter table auth.users add column if not exists email_change_sent_at timestamptz;
+alter table auth.users add column if not exists email_change_token_new text default '';
+alter table auth.users add column if not exists email_change_token_current text default '';
+alter table auth.users add column if not exists email_change_confirm_status smallint default 0;
+
 create table if not exists auth.refresh_tokens (
   id bigint generated by default as identity primary key,
   token text unique not null,
@@ -3591,6 +5972,7 @@ create table if not exists auth.flow_state (
   created_at timestamptz default now(),
   expires_at timestamptz not null
 );
+alter table auth.flow_state add column if not exists link_user_id uuid;
 
 create table if not exists auth.mfa_factors (
   id uuid primary key default gen_random_uuid(),
@@ -3611,6 +5993,25 @@ create table if not exists auth.mfa_challenges (
   expires_at timestamptz not null
 );
 
+create table if not exists auth.mfa_recovery_code_sets (
+  id uuid primary key default gen_random_uuid(),
+  user_id uuid not null references auth.users(id) on delete cascade,
+  mfa_factor_id uuid not null unique references auth.mfa_factors(id) on delete cascade,
+  failed_verification_count int not null default 0,
+  verification_locked_until timestamptz,
+  created_at timestamptz default now(),
+  updated_at timestamptz default now(),
+  unique (user_id)
+);
+
+create table if not exists auth.mfa_recovery_codes (
+  id uuid primary key default gen_random_uuid(),
+  mfa_recovery_code_set_id uuid not null references auth.mfa_recovery_code_sets(id) on delete cascade,
+  code_hash text not null,
+  consumed_at timestamptz,
+  created_at timestamptz default now()
+);
+
 -- append-only security audit trail (GoTrue-compatible shape)
 create table if not exists auth.audit_log_entries (
   instance_id uuid default '00000000-0000-0000-0000-000000000000',
@@ -9122,7 +11523,7 @@ function imageTransformInputTooLarge(maxInputBytes) {
     message: `The source image exceeds the transformation limit (${maxInputBytes} bytes)`
   };
 }
-function invalid(message) {
+function invalid2(message) {
   return { ok: false, status: 400, error: "InvalidTransformation", message };
 }
 function unsupported(message) {
@@ -9132,22 +11533,22 @@ function parsePositiveInteger(value, name) {
   if (value === null)
     return;
   if (!/^[1-9]\d*$/.test(value))
-    return invalid(`${name} must be a positive integer`);
+    return invalid2(`${name} must be a positive integer`);
   const parsed = Number(value);
   if (!Number.isSafeInteger(parsed))
-    return invalid(`${name} is too large`);
+    return invalid2(`${name} is too large`);
   if (parsed > MAX_TRANSFORM_DIMENSION)
-    return invalid(`${name} must be between 1 and ${MAX_TRANSFORM_DIMENSION}`);
+    return invalid2(`${name} must be between 1 and ${MAX_TRANSFORM_DIMENSION}`);
   return parsed;
 }
 function parseQuality(value) {
   if (value === null)
     return;
   if (!/^\d+$/.test(value))
-    return invalid("quality must be an integer between 20 and 100");
+    return invalid2("quality must be an integer between 20 and 100");
   const parsed = Number(value);
   if (!Number.isSafeInteger(parsed) || parsed < 20 || parsed > 100) {
-    return invalid("quality must be an integer between 20 and 100");
+    return invalid2("quality must be an integer between 20 and 100");
   }
   return parsed;
 }
@@ -9162,7 +11563,7 @@ function parseImageTransform(query) {
   if (resizeValue === "cover")
     return unsupported("resize=cover is not supported by Bun.Image in this runtime");
   if (resizeValue !== null && resizeValue !== "contain" && resizeValue !== "fill") {
-    return invalid("resize must be one of contain or fill");
+    return invalid2("resize must be one of contain or fill");
   }
   if (resizeValue === null && width !== undefined && height !== undefined) {
     return unsupported("resize defaults to cover when width and height are both set; specify contain or fill");
@@ -9171,13 +11572,13 @@ function parseImageTransform(query) {
   const formatValue = query.get("format");
   const format = formatValue === null ? "origin" : formatValue;
   if (format !== "origin" && format !== "jpeg" && format !== "png" && format !== "webp") {
-    return invalid("format must be one of origin, jpeg, png, or webp");
+    return invalid2("format must be one of origin, jpeg, png, or webp");
   }
   const quality = parseQuality(query.get("quality"));
   if (typeof quality !== "number" && quality !== undefined)
     return quality;
   if (quality !== undefined && format === "png") {
-    return invalid("quality is supported only for jpeg and webp output");
+    return invalid2("quality is supported only for jpeg and webp output");
   }
   return {
     ok: true,
@@ -9279,7 +11680,7 @@ async function transformImage(source, options, knownSourceSize, configuredLimits
   }
   const outputFormat = options.format === "origin" ? metadata.format : options.format;
   if (options.quality !== undefined && outputFormat !== "jpeg" && outputFormat !== "webp") {
-    return invalid("quality is supported only for jpeg and webp output");
+    return invalid2("quality is supported only for jpeg and webp output");
   }
   const contentType = IMAGE_FORMAT_CONTENT_TYPES[outputFormat];
   if (!contentType) {
@@ -11197,7 +13598,7 @@ class GraphqlHandler {
         throw new ApiError(415, { message: "GraphQL requests require application/json" });
       }
       const body = JSON.parse(await boundedBody(request, this.maxBytes));
-      if (!isObject(body) || typeof body["query"] !== "string" || !body["query"].trim() || body["variables"] != null && !isObject(body["variables"]) || body["extensions"] != null && !isObject(body["extensions"]) || body["operationName"] != null && typeof body["operationName"] !== "string") {
+      if (!isObject2(body) || typeof body["query"] !== "string" || !body["query"].trim() || body["variables"] != null && !isObject2(body["variables"]) || body["extensions"] != null && !isObject2(body["extensions"]) || body["operationName"] != null && typeof body["operationName"] !== "string") {
         throw new ApiError(400, { message: "Invalid GraphQL request" });
       }
       operationName = body["operationName"] ?? undefined;
@@ -11252,7 +13653,7 @@ async function boundedBody(request, limit) {
   }
   return Buffer.concat(chunks).toString("utf8");
 }
-function isObject(value) {
+function isObject2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function isGraphqlEnvelope(value) {
@@ -12508,14 +14909,14 @@ class PgWireClient {
             if (code === 0) {} else if (code === 3) {
               if (!needPassword())
                 return;
-              this.socket.write(message(112, cstring(opts.password ?? "")));
+              this.socket.write(message2(112, cstring(opts.password ?? "")));
             } else if (code === 5) {
               if (!needPassword())
                 return;
               const salt = payload.subarray(4, 8);
               const inner = md5Hex(Buffer.from((opts.password ?? "") + opts.user, "utf8"));
               const token = "md5" + md5Hex(Buffer.concat([Buffer.from(inner, "utf8"), salt]));
-              this.socket.write(message(112, cstring(token)));
+              this.socket.write(message2(112, cstring(token)));
             } else if (code === 10) {
               if (!needPassword())
                 return;
@@ -12527,7 +14928,7 @@ class PgWireClient {
               clientNonce = randomBytes(18).toString("base64");
               clientFirstBare = `n=,r=${clientNonce}`;
               const initial = Buffer.from(`n,,${clientFirstBare}`, "utf8");
-              this.socket.write(message(112, Buffer.concat([cstring("SCRAM-SHA-256"), int32(initial.length), initial])));
+              this.socket.write(message2(112, Buffer.concat([cstring("SCRAM-SHA-256"), int32(initial.length), initial])));
             } else if (code === 11) {
               const serverFirst = payload.subarray(4).toString("utf8");
               const attrs = scramAttrs(serverFirst);
@@ -12542,15 +14943,15 @@ class PgWireClient {
               const salt = Buffer.from(attrs.s, "base64");
               const iterations = parseInt(attrs.i, 10);
               const saltedPassword = pbkdf2Sync(opts.password, salt, iterations, 32, "sha256");
-              const clientKey = hmac(saltedPassword, "Client Key");
+              const clientKey = hmac2(saltedPassword, "Client Key");
               const storedKey = sha256(clientKey);
               const finalNoProof = `c=biws,r=${attrs.r}`;
               const authMessage = `${clientFirstBare},${serverFirst},${finalNoProof}`;
-              const clientSignature = hmac(storedKey, authMessage);
+              const clientSignature = hmac2(storedKey, authMessage);
               const proof = xorBuffers(clientKey, clientSignature);
-              serverSignature = hmac(hmac(saltedPassword, "Server Key"), authMessage).toString("base64");
+              serverSignature = hmac2(hmac2(saltedPassword, "Server Key"), authMessage).toString("base64");
               const clientFinal = `${finalNoProof},p=${proof.toString("base64")}`;
-              this.socket.write(message(112, Buffer.from(clientFinal, "utf8")));
+              this.socket.write(message2(112, Buffer.from(clientFinal, "utf8")));
             } else if (code === 12) {
               const v = scramAttrs(payload.subarray(4).toString("utf8")).v;
               if (v && serverSignature && v !== serverSignature) {
@@ -12591,11 +14992,11 @@ class PgWireClient {
     return op;
   }
   async exec(sql) {
-    return this.run(() => this.socket.write(message(81, cstring(sql))));
+    return this.run(() => this.socket.write(message2(81, cstring(sql))));
   }
   async query(sql, params = []) {
     const results = await this.run(() => {
-      const parse = message(80, Buffer.concat([cstring(""), cstring(sql), int16(0)]));
+      const parse = message2(80, Buffer.concat([cstring(""), cstring(sql), int16(0)]));
       const paramBufs = [int16(0), int16(params.length)];
       for (const p of params) {
         if (p === null || p === undefined) {
@@ -12606,10 +15007,10 @@ class PgWireClient {
         }
       }
       paramBufs.push(int16(0));
-      const bind = message(66, Buffer.concat([cstring(""), cstring(""), ...paramBufs]));
-      const describe = message(68, Buffer.concat([Buffer.from("P"), cstring("")]));
-      const execute = message(69, Buffer.concat([cstring(""), int32(0)]));
-      const sync = message(83, Buffer.alloc(0));
+      const bind = message2(66, Buffer.concat([cstring(""), cstring(""), ...paramBufs]));
+      const describe = message2(68, Buffer.concat([Buffer.from("P"), cstring("")]));
+      const execute = message2(69, Buffer.concat([cstring(""), int32(0)]));
+      const sync = message2(83, Buffer.alloc(0));
       this.socket.write(Buffer.concat([parse, bind, describe, execute, sync]));
     });
     return results[0] ?? { rows: [] };
@@ -12618,7 +15019,7 @@ class PgWireClient {
     return new Promise((resolve) => {
       if (this.closed)
         return resolve();
-      this.socket.write(message(88, Buffer.alloc(0)));
+      this.socket.write(message2(88, Buffer.alloc(0)));
       this.socket.end(() => resolve());
     });
   }
@@ -12722,7 +15123,7 @@ class PgWireClient {
     }
   }
 }
-var hmac = (key, data) => createHmac("sha256", key).update(data, "utf8").digest();
+var hmac2 = (key, data) => createHmac("sha256", key).update(data, "utf8").digest();
 var sha256 = (b) => createHash("sha256").update(b).digest();
 var md5Hex = (b) => createHash("md5").update(b).digest("hex");
 function xorBuffers(a, b) {
@@ -12740,7 +15141,7 @@ function scramAttrs(s) {
   }
   return out;
 }
-function message(type, body) {
+function message2(type, body) {
   const out = Buffer.alloc(5 + body.length);
   out[0] = type;
   out.writeInt32BE(4 + body.length, 1);
@@ -14714,6 +17115,7 @@ function readAuthSettings(root) {
   const sms = tableAt(root, "auth.sms");
   const mfa = tableAt(root, "auth.mfa");
   const mfaTotp = tableAt(root, "auth.mfa.totp");
+  const recoveryCodes = tableAt(root, "auth.mfa.recovery_codes");
   const out = {};
   const disableSignup = getBool(auth, "disable_signup");
   if (disableSignup !== undefined)
@@ -14730,6 +17132,9 @@ function readAuthSettings(root) {
   const minLen = getInt(auth, "minimum_password_length");
   if (minLen !== undefined)
     out.minPasswordLength = minLen;
+  const requireReauthentication = getBool(auth, "security_update_password_require_reauthentication") ?? getBool(auth, "password_require_reauthentication");
+  if (requireReauthentication !== undefined)
+    out.requirePasswordReauthentication = requireReauthentication;
   const otpLength = getInt(email, "otp_length");
   if (otpLength !== undefined)
     out.otpLength = otpLength;
@@ -14757,6 +17162,24 @@ function readAuthSettings(root) {
   const totpVerify = getBool(mfaTotp, "verify_enabled");
   if (totpVerify !== undefined)
     out.totpVerifyEnabled = totpVerify;
+  const recoveryEnroll = getBool(recoveryCodes, "enroll_enabled");
+  if (recoveryEnroll !== undefined)
+    out.recoveryCodesEnrollEnabled = recoveryEnroll;
+  const recoveryVerify = getBool(recoveryCodes, "verify_enabled");
+  if (recoveryVerify !== undefined)
+    out.recoveryCodesVerifyEnabled = recoveryVerify;
+  const recoveryCount = getInt(recoveryCodes, "count");
+  if (recoveryCount !== undefined)
+    out.recoveryCodesCount = recoveryCount;
+  const recoveryLength = getInt(recoveryCodes, "code_length");
+  if (recoveryLength !== undefined)
+    out.recoveryCodeLength = recoveryLength;
+  const recoveryAttempts = getInt(recoveryCodes, "max_verify_attempts");
+  if (recoveryAttempts !== undefined)
+    out.recoveryCodesMaxVerifyAttempts = recoveryAttempts;
+  const recoveryLockout = getDurationSeconds(recoveryCodes, "lockout_duration");
+  if (recoveryLockout !== undefined)
+    out.recoveryCodesLockoutSeconds = recoveryLockout;
   return out;
 }
 function readRateLimits(root) {
@@ -14801,7 +17224,11 @@ function readOAuthProviders(root, env) {
         authorizeUrl: getString(t, "authorize_url") ?? (url ? `${url}/authorize` : undefined),
         tokenUrl: getString(t, "token_url") ?? (url ? `${url}/token` : undefined),
         userInfoUrl: getString(t, "userinfo_url") ?? (url ? `${url}/userinfo` : undefined),
-        scopes: getString(t, "scopes")
+        scopes: getString(t, "scopes"),
+        idTokenIssuer: getString(t, "id_token_issuer") ?? getString(t, "issuer"),
+        idTokenJwksUrl: getString(t, "id_token_jwks_url") ?? getString(t, "jwks_url"),
+        idTokenAudience: getString(t, "id_token_audience") ?? clientId,
+        ssoDomains: getStringArray(t, "sso_domains")
       };
     }
   }
@@ -14833,7 +17260,10 @@ function collectEnvProviders(env, out, prefix, secretKey) {
       authorizeUrl: g("AUTHORIZE_URL"),
       tokenUrl: g("TOKEN_URL"),
       userInfoUrl: g("USERINFO_URL"),
-      scopes: g("SCOPES")
+      scopes: g("SCOPES"),
+      idTokenIssuer: g("ID_TOKEN_ISSUER") ?? g("ISSUER"),
+      idTokenJwksUrl: g("ID_TOKEN_JWKS_URL") ?? g("JWKS_URL"),
+      idTokenAudience: g("ID_TOKEN_AUDIENCE") ?? clientId
     };
   }
 }