@syncello/auth 3.5.0 → 3.6.1

package/dist/index.d.cts

@@ -318,6 +318,46 @@ interface AuthDatabase {
     delete: (...args: any[]) => any;
     query: Record<string, any>;
 }
+/** A newly-created user, passed to invitation hooks. */
+interface InvitationHookUser {
+    id: string;
+    email: string;
+    name: string | null;
+}
+/**
+ * App-owned invitation hooks. The library stays agnostic of any specific
+ * invitation model — the consuming app validates the token and links the user.
+ *
+ * When `/signup` (or OAuth signup) is called with an `invitationToken`, the
+ * library calls `verify`. If it returns a matching email, the account is created
+ * with `emailVerified: true` and NO verification email is sent — the token, which
+ * was delivered to that address, is itself the proof of ownership (the same trust
+ * model as OAuth-provider signup). `onAccepted` then runs so the app can link the
+ * user (e.g. create a team membership) atomically with signup.
+ */
+interface InvitationHooks<TEnv = Record<string, unknown>> {
+    /**
+     * Validate that `token` is a live invitation for `email`. Return the invited
+     * email (normalized) to auto-verify the new account, or `null` to reject the
+     * token. MUST confirm the token matches this email — returning a non-matching
+     * email is treated as a rejection by the caller.
+     */
+    verify(args: {
+        token: string;
+        email: string;
+        db: AuthDatabase;
+        env: TEnv;
+    }): Promise<{
+        email: string;
+    } | null>;
+    /** Link the just-created, verified user (create membership, mark the invite accepted). */
+    onAccepted?(args: {
+        token: string;
+        user: InvitationHookUser;
+        db: AuthDatabase;
+        env: TEnv;
+    }): Promise<void>;
+}
 /**
  * Configuration for createAuth
  */
@@ -330,6 +370,8 @@ interface AuthConfig<TEnv = Record<string, unknown>> {
     getEnv: (c: Context) => TEnv;
     /** Optional email branding tokens */
     emailBranding?: EmailBranding;
+    /** Optional app-owned invitation hooks for token-verified signup. */
+    invitations?: InvitationHooks<TEnv>;
 }
 /**
  * Auth context available in all auth operations.
@@ -340,6 +382,7 @@ interface AuthContext<TEnv = Record<string, unknown>> {
     schema: AuthSchema;
     env: TEnv;
     emailBranding?: EmailBranding;
+    invitations?: InvitationHooks<TEnv>;
 }
 /**
  * Creates an auth instance with injected database and schema.
@@ -1662,6 +1705,7 @@ declare const authRoutes: OpenAPIHono<{
                     name?: string | undefined;
                     turnstileToken?: string | undefined;
                     oauthToken?: string | undefined;
+                    invitationToken?: string | undefined;
                 };
             };
             output: {
@@ -1683,6 +1727,7 @@ declare const authRoutes: OpenAPIHono<{
                     name?: string | undefined;
                     turnstileToken?: string | undefined;
                     oauthToken?: string | undefined;
+                    invitationToken?: string | undefined;
                 };
             };
             output: {
@@ -1704,6 +1749,7 @@ declare const authRoutes: OpenAPIHono<{
                     name?: string | undefined;
                     turnstileToken?: string | undefined;
                     oauthToken?: string | undefined;
+                    invitationToken?: string | undefined;
                 };
             };
             output: {
@@ -2700,4 +2746,4 @@ declare function calculateBounceRate(db: PostgresJsDatabase<Record<string, unkno
  */
 declare function calculateComplaintRate(db: PostgresJsDatabase<Record<string, unknown>>, emailEventsTable: EmailEventsTable, hoursAgo?: number): Promise<number>;
 
-export { AUTH_DEFAULTS, type AccountLockoutTables, type Auth, type AuthConfig, type AuthContext, type AuthDatabase, type AuthSchema, CHALLENGE_TTL_MS, type ChallengePayload, CloudflareEmailAdapter, type DeviceType, type EmailAdapter, type EmailBranding, type EmailChangeConfirmationData, type EmailChangeNotificationData, type EmailChangeTables, type EmailSendOptions, type EmailSendResult, EmailService, type EmailTemplate, type EmailType, type Env, type InferNewSession, type InferNewUser, type InferSession, type InferUser, MAX_CHALLENGE_ATTEMPTS, type PasswordResetEmailData, type ProblemDetails, ProblemTypes, ResendAdapter, type ResendEventType, type ResendWebhookPayload, type SendEmailBinding, type SendEmailResult, type SessionData, type SessionTables, TRUSTED_DEVICE_COOKIE_BASE, TRUSTED_DEVICE_TTL_MS, type TotpVerifyResult, type TwoFactorCodeEmailData, type TwoFactorDisabledEmailData, type TwoFactorEnabledEmailData, type ValidationResult, type Variables, type VerificationEmailData, authRoutes, calculateBounceRate, calculateComplaintRate, cancelEmailChange, checkAccountLocked, checkBreachedPassword, clearAccountLockout, clearChallengeCookie, clearSessionCookie, clearTrustedDeviceCookie, confirmEmailChange, createAuth, createAuthMiddleware, createChallengeToken, createDeviceToken, createEmailAdapter, createProblemDetails, createSession, csrf, decryptTotpSecret, deleteAllUserSessions, deleteChallengeToken, deleteSession, encryptTotpSecret, extractAppUrl, formatBackupCode, generate2faCodeEmail, generate2faDisabledEmail, generate2faEnabledEmail, generateApiKey, generateBackupCodes, generateCodeChallenge, generateCodeVerifier, generateEmailChangeConfirmation, generateEmailChangeNotification, generateFingerprint, generatePasswordResetEmail, generateQrCodeUri, generateSecureToken, generateTotpSecret, generateTraceId, generateVerificationEmail, getAllowedOrigins, getAuthContext, getChallengeCookieName, getClientIp, getKeyPrefix, getMinutesUntilUnlock, getSessionCookieName, getTotpCounter, getTrustedDeviceCookieName, handleWebhookEvent, hashApiKey, hashBackupCode, hashPassword, hashToken, incrementFailedAttempts, invalidateAllUserSessions, isCapacitorApp, isCloudflarePreviewUrl, isDeepLinkUri, isValidApiKeyFormat, logError, logSecurityEvent, logger, normalizeBackupCode, optionalAuth, parseDeviceName, parseDeviceType, problemJson, problems, rateLimit, refreshSession, requestEmailChange, requireAuth, requireVerifiedEmail, retrieveChallengeToken, setChallengeCookie, setSessionCookie, setTrustedDeviceCookie, storeChallengeToken, updateChallengeAttempts, validateChallengePayload, validateOrigin, validatePassword, validatePasswordWithBreachCheck, validateSession, validateTrustedDevice, verifyBackupCode, verifyCodeChallenge, verifyPassword, verifyPasswordWithRotation, verifyTotpCode, verifyTurnstileToken, verifyWebhookSignature };
+export { AUTH_DEFAULTS, type AccountLockoutTables, type Auth, type AuthConfig, type AuthContext, type AuthDatabase, type AuthSchema, CHALLENGE_TTL_MS, type ChallengePayload, CloudflareEmailAdapter, type DeviceType, type EmailAdapter, type EmailBranding, type EmailChangeConfirmationData, type EmailChangeNotificationData, type EmailChangeTables, type EmailSendOptions, type EmailSendResult, EmailService, type EmailTemplate, type EmailType, type Env, type InferNewSession, type InferNewUser, type InferSession, type InferUser, type InvitationHookUser, type InvitationHooks, MAX_CHALLENGE_ATTEMPTS, type PasswordResetEmailData, type ProblemDetails, ProblemTypes, ResendAdapter, type ResendEventType, type ResendWebhookPayload, type SendEmailBinding, type SendEmailResult, type SessionData, type SessionTables, TRUSTED_DEVICE_COOKIE_BASE, TRUSTED_DEVICE_TTL_MS, type TotpVerifyResult, type TwoFactorCodeEmailData, type TwoFactorDisabledEmailData, type TwoFactorEnabledEmailData, type ValidationResult, type Variables, type VerificationEmailData, authRoutes, calculateBounceRate, calculateComplaintRate, cancelEmailChange, checkAccountLocked, checkBreachedPassword, clearAccountLockout, clearChallengeCookie, clearSessionCookie, clearTrustedDeviceCookie, confirmEmailChange, createAuth, createAuthMiddleware, createChallengeToken, createDeviceToken, createEmailAdapter, createProblemDetails, createSession, csrf, decryptTotpSecret, deleteAllUserSessions, deleteChallengeToken, deleteSession, encryptTotpSecret, extractAppUrl, formatBackupCode, generate2faCodeEmail, generate2faDisabledEmail, generate2faEnabledEmail, generateApiKey, generateBackupCodes, generateCodeChallenge, generateCodeVerifier, generateEmailChangeConfirmation, generateEmailChangeNotification, generateFingerprint, generatePasswordResetEmail, generateQrCodeUri, generateSecureToken, generateTotpSecret, generateTraceId, generateVerificationEmail, getAllowedOrigins, getAuthContext, getChallengeCookieName, getClientIp, getKeyPrefix, getMinutesUntilUnlock, getSessionCookieName, getTotpCounter, getTrustedDeviceCookieName, handleWebhookEvent, hashApiKey, hashBackupCode, hashPassword, hashToken, incrementFailedAttempts, invalidateAllUserSessions, isCapacitorApp, isCloudflarePreviewUrl, isDeepLinkUri, isValidApiKeyFormat, logError, logSecurityEvent, logger, normalizeBackupCode, optionalAuth, parseDeviceName, parseDeviceType, problemJson, problems, rateLimit, refreshSession, requestEmailChange, requireAuth, requireVerifiedEmail, retrieveChallengeToken, setChallengeCookie, setSessionCookie, setTrustedDeviceCookie, storeChallengeToken, updateChallengeAttempts, validateChallengePayload, validateOrigin, validatePassword, validatePasswordWithBreachCheck, validateSession, validateTrustedDevice, verifyBackupCode, verifyCodeChallenge, verifyPassword, verifyPasswordWithRotation, verifyTotpCode, verifyTurnstileToken, verifyWebhookSignature };

package/dist/index.d.ts

@@ -318,6 +318,46 @@ interface AuthDatabase {
     delete: (...args: any[]) => any;
     query: Record<string, any>;
 }
+/** A newly-created user, passed to invitation hooks. */
+interface InvitationHookUser {
+    id: string;
+    email: string;
+    name: string | null;
+}
+/**
+ * App-owned invitation hooks. The library stays agnostic of any specific
+ * invitation model — the consuming app validates the token and links the user.
+ *
+ * When `/signup` (or OAuth signup) is called with an `invitationToken`, the
+ * library calls `verify`. If it returns a matching email, the account is created
+ * with `emailVerified: true` and NO verification email is sent — the token, which
+ * was delivered to that address, is itself the proof of ownership (the same trust
+ * model as OAuth-provider signup). `onAccepted` then runs so the app can link the
+ * user (e.g. create a team membership) atomically with signup.
+ */
+interface InvitationHooks<TEnv = Record<string, unknown>> {
+    /**
+     * Validate that `token` is a live invitation for `email`. Return the invited
+     * email (normalized) to auto-verify the new account, or `null` to reject the
+     * token. MUST confirm the token matches this email — returning a non-matching
+     * email is treated as a rejection by the caller.
+     */
+    verify(args: {
+        token: string;
+        email: string;
+        db: AuthDatabase;
+        env: TEnv;
+    }): Promise<{
+        email: string;
+    } | null>;
+    /** Link the just-created, verified user (create membership, mark the invite accepted). */
+    onAccepted?(args: {
+        token: string;
+        user: InvitationHookUser;
+        db: AuthDatabase;
+        env: TEnv;
+    }): Promise<void>;
+}
 /**
  * Configuration for createAuth
  */
@@ -330,6 +370,8 @@ interface AuthConfig<TEnv = Record<string, unknown>> {
     getEnv: (c: Context) => TEnv;
     /** Optional email branding tokens */
     emailBranding?: EmailBranding;
+    /** Optional app-owned invitation hooks for token-verified signup. */
+    invitations?: InvitationHooks<TEnv>;
 }
 /**
  * Auth context available in all auth operations.
@@ -340,6 +382,7 @@ interface AuthContext<TEnv = Record<string, unknown>> {
     schema: AuthSchema;
     env: TEnv;
     emailBranding?: EmailBranding;
+    invitations?: InvitationHooks<TEnv>;
 }
 /**
  * Creates an auth instance with injected database and schema.
@@ -1662,6 +1705,7 @@ declare const authRoutes: OpenAPIHono<{
                     name?: string | undefined;
                     turnstileToken?: string | undefined;
                     oauthToken?: string | undefined;
+                    invitationToken?: string | undefined;
                 };
             };
             output: {
@@ -1683,6 +1727,7 @@ declare const authRoutes: OpenAPIHono<{
                     name?: string | undefined;
                     turnstileToken?: string | undefined;
                     oauthToken?: string | undefined;
+                    invitationToken?: string | undefined;
                 };
             };
             output: {
@@ -1704,6 +1749,7 @@ declare const authRoutes: OpenAPIHono<{
                     name?: string | undefined;
                     turnstileToken?: string | undefined;
                     oauthToken?: string | undefined;
+                    invitationToken?: string | undefined;
                 };
             };
             output: {
@@ -2700,4 +2746,4 @@ declare function calculateBounceRate(db: PostgresJsDatabase<Record<string, unkno
  */
 declare function calculateComplaintRate(db: PostgresJsDatabase<Record<string, unknown>>, emailEventsTable: EmailEventsTable, hoursAgo?: number): Promise<number>;
 
-export { AUTH_DEFAULTS, type AccountLockoutTables, type Auth, type AuthConfig, type AuthContext, type AuthDatabase, type AuthSchema, CHALLENGE_TTL_MS, type ChallengePayload, CloudflareEmailAdapter, type DeviceType, type EmailAdapter, type EmailBranding, type EmailChangeConfirmationData, type EmailChangeNotificationData, type EmailChangeTables, type EmailSendOptions, type EmailSendResult, EmailService, type EmailTemplate, type EmailType, type Env, type InferNewSession, type InferNewUser, type InferSession, type InferUser, MAX_CHALLENGE_ATTEMPTS, type PasswordResetEmailData, type ProblemDetails, ProblemTypes, ResendAdapter, type ResendEventType, type ResendWebhookPayload, type SendEmailBinding, type SendEmailResult, type SessionData, type SessionTables, TRUSTED_DEVICE_COOKIE_BASE, TRUSTED_DEVICE_TTL_MS, type TotpVerifyResult, type TwoFactorCodeEmailData, type TwoFactorDisabledEmailData, type TwoFactorEnabledEmailData, type ValidationResult, type Variables, type VerificationEmailData, authRoutes, calculateBounceRate, calculateComplaintRate, cancelEmailChange, checkAccountLocked, checkBreachedPassword, clearAccountLockout, clearChallengeCookie, clearSessionCookie, clearTrustedDeviceCookie, confirmEmailChange, createAuth, createAuthMiddleware, createChallengeToken, createDeviceToken, createEmailAdapter, createProblemDetails, createSession, csrf, decryptTotpSecret, deleteAllUserSessions, deleteChallengeToken, deleteSession, encryptTotpSecret, extractAppUrl, formatBackupCode, generate2faCodeEmail, generate2faDisabledEmail, generate2faEnabledEmail, generateApiKey, generateBackupCodes, generateCodeChallenge, generateCodeVerifier, generateEmailChangeConfirmation, generateEmailChangeNotification, generateFingerprint, generatePasswordResetEmail, generateQrCodeUri, generateSecureToken, generateTotpSecret, generateTraceId, generateVerificationEmail, getAllowedOrigins, getAuthContext, getChallengeCookieName, getClientIp, getKeyPrefix, getMinutesUntilUnlock, getSessionCookieName, getTotpCounter, getTrustedDeviceCookieName, handleWebhookEvent, hashApiKey, hashBackupCode, hashPassword, hashToken, incrementFailedAttempts, invalidateAllUserSessions, isCapacitorApp, isCloudflarePreviewUrl, isDeepLinkUri, isValidApiKeyFormat, logError, logSecurityEvent, logger, normalizeBackupCode, optionalAuth, parseDeviceName, parseDeviceType, problemJson, problems, rateLimit, refreshSession, requestEmailChange, requireAuth, requireVerifiedEmail, retrieveChallengeToken, setChallengeCookie, setSessionCookie, setTrustedDeviceCookie, storeChallengeToken, updateChallengeAttempts, validateChallengePayload, validateOrigin, validatePassword, validatePasswordWithBreachCheck, validateSession, validateTrustedDevice, verifyBackupCode, verifyCodeChallenge, verifyPassword, verifyPasswordWithRotation, verifyTotpCode, verifyTurnstileToken, verifyWebhookSignature };
+export { AUTH_DEFAULTS, type AccountLockoutTables, type Auth, type AuthConfig, type AuthContext, type AuthDatabase, type AuthSchema, CHALLENGE_TTL_MS, type ChallengePayload, CloudflareEmailAdapter, type DeviceType, type EmailAdapter, type EmailBranding, type EmailChangeConfirmationData, type EmailChangeNotificationData, type EmailChangeTables, type EmailSendOptions, type EmailSendResult, EmailService, type EmailTemplate, type EmailType, type Env, type InferNewSession, type InferNewUser, type InferSession, type InferUser, type InvitationHookUser, type InvitationHooks, MAX_CHALLENGE_ATTEMPTS, type PasswordResetEmailData, type ProblemDetails, ProblemTypes, ResendAdapter, type ResendEventType, type ResendWebhookPayload, type SendEmailBinding, type SendEmailResult, type SessionData, type SessionTables, TRUSTED_DEVICE_COOKIE_BASE, TRUSTED_DEVICE_TTL_MS, type TotpVerifyResult, type TwoFactorCodeEmailData, type TwoFactorDisabledEmailData, type TwoFactorEnabledEmailData, type ValidationResult, type Variables, type VerificationEmailData, authRoutes, calculateBounceRate, calculateComplaintRate, cancelEmailChange, checkAccountLocked, checkBreachedPassword, clearAccountLockout, clearChallengeCookie, clearSessionCookie, clearTrustedDeviceCookie, confirmEmailChange, createAuth, createAuthMiddleware, createChallengeToken, createDeviceToken, createEmailAdapter, createProblemDetails, createSession, csrf, decryptTotpSecret, deleteAllUserSessions, deleteChallengeToken, deleteSession, encryptTotpSecret, extractAppUrl, formatBackupCode, generate2faCodeEmail, generate2faDisabledEmail, generate2faEnabledEmail, generateApiKey, generateBackupCodes, generateCodeChallenge, generateCodeVerifier, generateEmailChangeConfirmation, generateEmailChangeNotification, generateFingerprint, generatePasswordResetEmail, generateQrCodeUri, generateSecureToken, generateTotpSecret, generateTraceId, generateVerificationEmail, getAllowedOrigins, getAuthContext, getChallengeCookieName, getClientIp, getKeyPrefix, getMinutesUntilUnlock, getSessionCookieName, getTotpCounter, getTrustedDeviceCookieName, handleWebhookEvent, hashApiKey, hashBackupCode, hashPassword, hashToken, incrementFailedAttempts, invalidateAllUserSessions, isCapacitorApp, isCloudflarePreviewUrl, isDeepLinkUri, isValidApiKeyFormat, logError, logSecurityEvent, logger, normalizeBackupCode, optionalAuth, parseDeviceName, parseDeviceType, problemJson, problems, rateLimit, refreshSession, requestEmailChange, requireAuth, requireVerifiedEmail, retrieveChallengeToken, setChallengeCookie, setSessionCookie, setTrustedDeviceCookie, storeChallengeToken, updateChallengeAttempts, validateChallengePayload, validateOrigin, validatePassword, validatePasswordWithBreachCheck, validateSession, validateTrustedDevice, verifyBackupCode, verifyCodeChallenge, verifyPassword, verifyPasswordWithRotation, verifyTotpCode, verifyTurnstileToken, verifyWebhookSignature };

package/dist/index.js

@@ -949,12 +949,13 @@ import { eq as eq4, and as and2, gt as gt2 } from "drizzle-orm";
 
 // src/factory.ts
 function createAuth(config) {
-  const { db, schema, getEnv, emailBranding } = config;
+  const { db, schema, getEnv, emailBranding, invitations } = config;
   const getContext = (c) => ({
     db,
     schema,
     env: getEnv(c),
-    emailBranding
+    emailBranding,
+    invitations
   });
   return {
     db,
@@ -2932,7 +2933,10 @@ var signupRequestSchema = z.object({
   name: z.string().min(1).optional().openapi({ example: "John Doe" }),
   turnstileToken: z.string().optional().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" }),
   // OAuth signup completion token (from /signup?oauth_token=...)
-  oauthToken: z.string().optional().openapi({ example: "a1b2c3d4-..." })
+  oauthToken: z.string().optional().openapi({ example: "a1b2c3d4-..." }),
+  // App invitation token (from /signup?token=...). When it validates for this
+  // email, the account is created already-verified with no verification email.
+  invitationToken: z.string().optional().openapi({ example: "iIB8tDJJ..." })
 }).openapi("SignupRequest");
 var loginRequestSchema = z.object({
   email: z.string().email().openapi({ example: "user@example.com" }),
@@ -3062,8 +3066,8 @@ var signupRoute = createRoute({
   }
 });
 var signupHandler = async (c) => {
-  const { email, password, name, turnstileToken, oauthToken } = c.req.valid("json");
-  const { db: database, schema, emailBranding } = getAuthContext(c);
+  const { email, password, name, turnstileToken, oauthToken, invitationToken } = c.req.valid("json");
+  const { db: database, schema, emailBranding, invitations } = getAuthContext(c);
   const env = c.env;
   if (oauthToken) {
     const stored = await env.OAUTH_STATES.get(`oauth:signup:${oauthToken}`);
@@ -3145,40 +3149,74 @@ var signupHandler = async (c) => {
     return problems.badRequest(c, passwordValidation.error || "Invalid password");
   }
   const hashedPassword = await hashPassword(password, env.PASSWORD_PEPPER_V1);
+  let invitedVerified = false;
+  if (invitationToken && invitations) {
+    const match = await invitations.verify({
+      token: invitationToken,
+      email: email.toLowerCase(),
+      db: database,
+      env
+    });
+    if (!match || match.email.toLowerCase() !== email.toLowerCase()) {
+      return problems.badRequest(
+        c,
+        "This invitation is invalid, expired, or for a different email address"
+      );
+    }
+    invitedVerified = true;
+  }
   const [newUser] = await database.insert(schema.users).values({
     email: email.toLowerCase(),
     name: name || null,
     hashedPassword,
     pepperKid: "v1",
-    emailVerified: false,
+    emailVerified: invitedVerified,
     activatedAt: /* @__PURE__ */ new Date()
   }).returning();
-  const emailToken = generateSecureToken(32);
-  const tokenHash = await hashToken(emailToken);
-  const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
-  await database.insert(schema.emailVerificationTokens).values({
-    tokenHash,
-    userId: newUser.id,
-    email: newUser.email,
-    expiresAt,
-    createdAt: Date.now()
-  });
-  const emailService = new EmailService(env, void 0, emailBranding);
-  const verificationUrl = `${env.APP_URL}/verify-email?token=${emailToken}`;
-  await emailService.sendVerificationEmail(
-    {
+  if (!invitedVerified) {
+    const emailToken = generateSecureToken(32);
+    const tokenHash = await hashToken(emailToken);
+    const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
+    await database.insert(schema.emailVerificationTokens).values({
+      tokenHash,
+      userId: newUser.id,
       email: newUser.email,
-      token: emailToken,
-      verificationUrl,
-      firstName: newUser.name || void 0
-    },
-    database,
-    schema.users
-  );
+      expiresAt,
+      createdAt: Date.now()
+    });
+    const emailService = new EmailService(env, void 0, emailBranding);
+    const verificationUrl = `${env.APP_URL}/verify-email?token=${emailToken}`;
+    await emailService.sendVerificationEmail(
+      {
+        email: newUser.email,
+        token: emailToken,
+        verificationUrl,
+        firstName: newUser.name || void 0
+      },
+      database,
+      schema.users
+    );
+  }
+  if (invitedVerified && invitationToken && invitations?.onAccepted) {
+    try {
+      await invitations.onAccepted({
+        token: invitationToken,
+        user: { id: newUser.id, email: newUser.email, name: newUser.name },
+        db: database,
+        env
+      });
+    } catch (err) {
+      logError(err, { context: "signup_invitation_onAccepted_failed", userId: newUser.id });
+    }
+  }
   const fingerprint = await generateFingerprint(c.req.raw);
   const ipAddress = getClientIp(c.req.raw);
   const sessionId = await createSession(database, { sessions: schema.sessions }, newUser.id, fingerprint, ipAddress);
-  logSecurityEvent("user_signup", "low", { userId: newUser.id, email: newUser.email });
+  logSecurityEvent("user_signup", "low", {
+    userId: newUser.id,
+    email: newUser.email,
+    invited: invitedVerified
+  });
   c.header("Set-Cookie", setSessionCookie(sessionId, c.env), { append: true });
   return c.json({
     user: {
@@ -3220,6 +3258,16 @@ function generateEmailOtp() {
   const num = (bytes[0] << 24 | bytes[1] << 16 | bytes[2] << 8 | bytes[3]) >>> 0;
   return String(num % 1e6).padStart(6, "0");
 }
+var EMAIL_CODE_TTL_SECONDS = 300;
+async function sendEmailChallengeCode(env, database, usersTable, user, emailBranding) {
+  const code = generateEmailOtp();
+  await env.OAUTH_STATES.put(`email_2fa_challenge:${user.id}`, await hashToken(code), {
+    expirationTtl: EMAIL_CODE_TTL_SECONDS
+  });
+  const emailService = new EmailService(env, void 0, emailBranding);
+  const firstName = user.name?.split(" ")[0] || null;
+  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, database, usersTable);
+}
 async function verifyAny2faCode(database, env, userId, code, method, tables2) {
   const { user2faMethods: user2faMethodsTable, userBackupCodes: userBackupCodesTable } = tables2;
   if (method === "totp") {
@@ -3304,7 +3352,7 @@ var loginRoute = createRoute2({
 });
 var loginHandler = async (c) => {
   const { email, password, turnstileToken } = c.req.valid("json");
-  const { db: database, schema } = getAuthContext(c);
+  const { db: database, schema, emailBranding } = getAuthContext(c);
   const env = c.env;
   const turnstileValid = await verifyTurnstileToken(
     turnstileToken,
@@ -3389,6 +3437,10 @@ var loginHandler = async (c) => {
     };
     await storeChallengeToken(env.OAUTH_STATES, challengeToken, challengePayload);
     setChallengeCookie(c, env, challengeToken);
+    const emailMethod = enabled2faMethods.find((m) => m.method === "email");
+    if (emailMethod && (emailMethod.isPrimary || enabled2faMethods.length === 1)) {
+      await sendEmailChallengeCode(env, database, schema.users, user, emailBranding);
+    }
     return c.json({
       requires2fa: true,
       methods: enabled2faMethods.map((m) => m.method)
@@ -5245,14 +5297,7 @@ var challengeResendHandler = async (c) => {
     logger_default.error("User not found during 2FA resend", { userId: payload.userId });
     return problems.notFound(c, "User not found");
   }
-  const code = generateEmailOtp();
-  const codeHash = await hashToken(code);
-  await c.env.OAUTH_STATES.put(`email_2fa_challenge:${payload.userId}`, codeHash, {
-    expirationTtl: 300
-  });
-  const emailService = new EmailService(c.env, void 0, emailBranding);
-  const firstName = user.name?.split(" ")[0] || null;
-  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
+  await sendEmailChallengeCode(c.env, db, schema.users, { id: payload.userId, ...user }, emailBranding);
   logger_default.info("Email 2FA code resent", { userId: payload.userId });
   return c.json({ success: true });
 };