@syncello/auth 3.6.0 → 4.0.0

package/dist/index.cjs

@@ -9,11 +9,11 @@ var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
+var __copyProps = (to, from, except, desc2) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
       if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc2 = __getOwnPropDesc(from, key)) || desc2.enumerable });
   }
   return to;
 };
@@ -35,6 +35,8 @@ __export(src_exports, {
   CloudflareEmailAdapter: () => CloudflareEmailAdapter,
   EmailService: () => EmailService,
   MAX_CHALLENGE_ATTEMPTS: () => MAX_CHALLENGE_ATTEMPTS,
+  PASSWORDLESS_MAX_ATTEMPTS: () => PASSWORDLESS_MAX_ATTEMPTS,
+  PASSWORDLESS_TTL_MS: () => PASSWORDLESS_TTL_MS,
   ProblemTypes: () => ProblemTypes,
   ResendAdapter: () => ResendAdapter,
   SCHEMA_VERSION: () => SCHEMA_VERSION,
@@ -46,6 +48,7 @@ __export(src_exports, {
   cancelEmailChange: () => cancelEmailChange,
   checkAccountLocked: () => checkAccountLocked,
   checkBreachedPassword: () => checkBreachedPassword,
+  cleanupExpiredPasswordlessChallenges: () => cleanupExpiredPasswordlessChallenges,
   clearAccountLockout: () => clearAccountLockout,
   clearChallengeCookie: () => clearChallengeCookie,
   clearSessionCookie: () => clearSessionCookie,
@@ -56,6 +59,7 @@ __export(src_exports, {
   createChallengeToken: () => createChallengeToken,
   createDeviceToken: () => createDeviceToken,
   createEmailAdapter: () => createEmailAdapter,
+  createPasswordlessChallenge: () => createPasswordlessChallenge,
   createProblemDetails: () => createProblemDetails,
   createSession: () => createSession,
   csrf: () => csrf,
@@ -72,6 +76,7 @@ __export(src_exports, {
   generate2faEnabledEmail: () => generate2faEnabledEmail,
   generateApiKey: () => generateApiKey,
   generateBackupCodes: () => generateBackupCodes,
+  generateCode: () => generateCode,
   generateCodeChallenge: () => generateCodeChallenge,
   generateCodeVerifier: () => generateCodeVerifier,
   generateEmailChangeConfirmation: () => generateEmailChangeConfirmation,
@@ -110,14 +115,17 @@ __export(src_exports, {
   optionalAuth: () => optionalAuth,
   parseDeviceName: () => parseDeviceName,
   parseDeviceType: () => parseDeviceType,
+  passwordlessEmail: () => passwordlessEmail,
   problemJson: () => problemJson,
   problems: () => problems,
   rateLimit: () => rateLimit,
+  recentPasswordlessFailures: () => recentPasswordlessFailures,
   refreshSession: () => refreshSession,
   requestEmailChange: () => requestEmailChange,
   requireAuth: () => requireAuth,
   requireVerifiedEmail: () => requireVerifiedEmail,
   retrieveChallengeToken: () => retrieveChallengeToken,
+  sessionRefreshDue: () => sessionRefreshDue,
   setChallengeCookie: () => setChallengeCookie,
   setSessionCookie: () => setSessionCookie,
   setTrustedDeviceCookie: () => setTrustedDeviceCookie,
@@ -135,6 +143,8 @@ __export(src_exports, {
   verifyCodeChallenge: () => verifyCodeChallenge,
   verifyPassword: () => verifyPassword,
   verifyPasswordWithRotation: () => verifyPasswordWithRotation,
+  verifyPasswordlessCode: () => verifyPasswordlessCode,
+  verifyPasswordlessLink: () => verifyPasswordlessLink,
   verifyTotpCode: () => verifyTotpCode,
   verifyTurnstileToken: () => verifyTurnstileToken,
   verifyWebhookSignature: () => verifyWebhookSignature
@@ -142,7 +152,7 @@ __export(src_exports, {
 module.exports = __toCommonJS(src_exports);
 
 // src/schema/definitions.ts
-var SCHEMA_VERSION = "2026.05.1";
+var SCHEMA_VERSION = "2026.10.1";
 var enums = {
   identifierType: {
     name: "identifier_type_enum",
@@ -380,6 +390,23 @@ var tables = {
       { name: "oauth_accounts_user_provider_idx", columns: ["userId", "provider"], unique: true },
       { name: "oauth_accounts_provider_user_idx", columns: ["provider", "providerUserId"], unique: true }
     ]
+  },
+  passwordlessChallenges: {
+    columns: {
+      id: { type: "uuid", primaryKey: true, default: "gen_random_uuid()" },
+      email: { type: "varchar", length: 255, notNull: true },
+      // The id of whatever account signs in, so no foreign key; null for a sign-up.
+      subjectId: { type: "uuid" },
+      linkTokenHash: { type: "varchar", length: 128, notNull: true, unique: true },
+      codeHash: { type: "varchar", length: 128, notNull: true },
+      browserHash: { type: "varchar", length: 128, notNull: true },
+      attempts: { type: "integer", notNull: true, default: 0 },
+      payload: { type: "jsonb" },
+      expiresAt: { type: "bigint", mode: "number", notNull: true },
+      consumedAt: { type: "bigint", mode: "number" },
+      createdAt: { type: "bigint", mode: "number", notNull: true }
+    },
+    indexes: [{ name: "idx_passwordless_email_created", columns: ["email", "createdAt"] }]
   }
 };
 var tableNames = {
@@ -394,7 +421,8 @@ var tableNames = {
   emailEvents: "email_events",
   failedLoginAttempts: "failed_login_attempts",
   securityAuditLog: "security_audit_log",
-  oauthAccounts: "oauth_accounts"
+  oauthAccounts: "oauth_accounts",
+  passwordlessChallenges: "passwordless_challenges"
 };
 
 // src/core/password.ts
@@ -647,6 +675,8 @@ var AUTH_DEFAULTS = {
   // Absolute cap: a session dies this long after creation regardless of
   // sliding-window activity (limits the value of a stolen session token).
   SESSION_MAX_LIFETIME_DAYS: 30,
+  // The sliding window moves at most this often, so a busy session is not a write per request.
+  SESSION_REFRESH_INTERVAL_MINUTES: 15,
   LOCKOUT_DURATION_MINUTES: 30,
   LOCKOUT_MAX_ATTEMPTS: 5,
   PASSWORD_RESET_TTL_MINUTES: 15,
@@ -727,7 +757,7 @@ async function validateSession(db, tables2, sessionId, currentFingerprint, sessi
       note: "SSR requests have different User-Agent, causing expected mismatch"
     });
   }
-  await refreshSession(db, { sessions }, sessionId);
+  if (sessionRefreshDue(row.sessionLastActiveAt)) await refreshSession(db, { sessions }, sessionId);
   return {
     user: {
       id: row.userId,
@@ -746,6 +776,10 @@ async function validateSession(db, tables2, sessionId, currentFingerprint, sessi
     }
   };
 }
+function sessionRefreshDue(lastActiveAt, now = Date.now()) {
+  const interval = AUTH_DEFAULTS.SESSION_REFRESH_INTERVAL_MINUTES * 60 * 1e3;
+  return lastActiveAt === null || now - lastActiveAt >= interval;
+}
 async function refreshSession(db, tables2, sessionId, sessionTtlMs = AUTH_DEFAULTS.SESSION_TTL_DAYS * 24 * 60 * 60 * 1e3) {
   const { sessions } = tables2;
   const newExpiration = Date.now() + sessionTtlMs;
@@ -913,16 +947,16 @@ function createDeviceToken() {
   };
 }
 async function validateTrustedDevice(db, userTrustedDevicesTable, userId, tokenHash) {
-  const { eq: eq33, and: and14, gt: gt6 } = await import("drizzle-orm");
+  const { eq: eq34, and: and15, gt: gt7 } = await import("drizzle-orm");
   const [device] = await db.select().from(userTrustedDevicesTable).where(
-    and14(
-      eq33(userTrustedDevicesTable.userId, userId),
-      eq33(userTrustedDevicesTable.tokenHash, tokenHash),
-      gt6(userTrustedDevicesTable.expiresAt, Date.now())
+    and15(
+      eq34(userTrustedDevicesTable.userId, userId),
+      eq34(userTrustedDevicesTable.tokenHash, tokenHash),
+      gt7(userTrustedDevicesTable.expiresAt, Date.now())
     )
   ).limit(1);
   if (device) {
-    await db.update(userTrustedDevicesTable).set({ lastUsedAt: Date.now() }).where(eq33(userTrustedDevicesTable.id, device.id));
+    await db.update(userTrustedDevicesTable).set({ lastUsedAt: Date.now() }).where(eq34(userTrustedDevicesTable.id, device.id));
     return true;
   }
   return false;
@@ -1335,582 +1369,48 @@ function base64UrlEncode(data) {
   return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
-// src/middleware/auth.ts
-var import_factory = require("hono/factory");
+// src/core/passwordless.ts
 var import_drizzle_orm4 = require("drizzle-orm");
 
-// src/factory.ts
-function createAuth(config) {
-  const { db, schema, getEnv, emailBranding, invitations } = config;
-  const getContext = (c) => ({
-    db,
-    schema,
-    env: getEnv(c),
-    emailBranding,
-    invitations
-  });
-  return {
-    db,
-    schema,
-    getContext
-  };
-}
-function createAuthMiddleware(auth2) {
-  return async (c, next) => {
-    const ctx = auth2.getContext(c);
-    c.set("authContext", ctx);
-    c.set("db", auth2.db);
-    await next();
-  };
-}
-function getAuthContext(c) {
-  const ctx = c.get("authContext");
-  if (!ctx) {
-    throw new Error(
-      "AuthContext not found. Did you apply createAuthMiddleware before the auth routes?"
-    );
+// src/lib/email/security.ts
+function getAllowedDomains(appUrl) {
+  const base = ["localhost", "127.0.0.1"];
+  try {
+    const url = new URL(appUrl);
+    return [...base, url.hostname];
+  } catch {
+    return base;
   }
-  return ctx;
-}
-
-// src/lib/problem-json.ts
-var ProblemTypes = {
-  // 4xx Client Errors
-  BAD_REQUEST: "/errors/bad-request",
-  UNAUTHORIZED: "/errors/unauthorized",
-  FORBIDDEN: "/errors/forbidden",
-  NOT_FOUND: "/errors/not-found",
-  CONFLICT: "/errors/conflict",
-  GONE: "/errors/gone",
-  VALIDATION_ERROR: "/errors/validation-error",
-  RATE_LIMIT_EXCEEDED: "/errors/rate-limit-exceeded",
-  // 5xx Server Errors
-  INTERNAL_ERROR: "/errors/internal-error",
-  SERVICE_UNAVAILABLE: "/errors/service-unavailable"
-};
-function generateTraceId() {
-  const bytes = crypto.getRandomValues(new Uint8Array(16));
-  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
-function createProblemDetails(type, title, status, options) {
-  const problem = {
-    type,
-    title,
-    status
-  };
-  if (options?.detail) {
-    problem.detail = options.detail;
-  }
-  if (options?.instance) {
-    problem.instance = options.instance;
+function sanitizeEmailUrl(url, appUrl = "") {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error("Invalid URL format");
   }
-  problem.traceId = options?.traceId || generateTraceId();
-  if (options?.requestId) {
-    problem.requestId = options.requestId;
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`Disallowed protocol: ${parsed.protocol}`);
   }
-  if (options?.extensions) {
-    Object.assign(problem, options.extensions);
+  const allowedDomains = getAllowedDomains(appUrl);
+  const hostname = parsed.hostname.toLowerCase();
+  const isAllowed = allowedDomains.some((domain) => {
+    return hostname === domain || hostname.endsWith(`.${domain}`);
+  });
+  if (!isAllowed) {
+    throw new Error(`Disallowed domain: ${hostname}`);
   }
-  return problem;
+  return parsed.toString();
 }
-function problemJson(c, problem) {
-  logger_default.warn("API error response", {
-    type: problem.type,
-    status: problem.status,
-    traceId: problem.traceId,
-    requestId: problem.requestId,
-    path: c.req.path,
-    method: c.req.method
-  });
-  return c.json(problem, problem.status, {
-    "Content-Type": "application/problem+json"
-  });
-}
-var problems = {
-  /**
-   * 400 Bad Request - Generic client error
-   */
-  badRequest(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.BAD_REQUEST, "Bad Request", 400, {
-        detail: detail || "The request could not be understood by the server",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  },
-  /**
-   * 400 Bad Request - Validation errors with field-specific details
-   */
-  validationError(c, detail, errors) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.VALIDATION_ERROR, "Validation Error", 400, {
-        detail,
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId"),
-        extensions: errors ? { errors } : void 0
-      })
-    );
-  },
-  /**
-   * 401 Unauthorized - Authentication required
-   */
-  unauthorized(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.UNAUTHORIZED, "Unauthorized", 401, {
-        detail: detail || "Authentication is required to access this resource",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  },
-  /**
-   * 403 Forbidden - Insufficient permissions
-   */
-  forbidden(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.FORBIDDEN, "Forbidden", 403, {
-        detail: detail || "You do not have permission to access this resource",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  },
-  /**
-   * 404 Not Found
-   */
-  notFound(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.NOT_FOUND, "Not Found", 404, {
-        detail: detail || "The requested resource was not found",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  },
-  /**
-   * 409 Conflict - Resource conflict (e.g., duplicate email)
-   */
-  conflict(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.CONFLICT, "Conflict", 409, {
-        detail,
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  },
-  /**
-   * 410 Gone - Resource is no longer available
-   */
-  gone(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.GONE, "Gone", 410, {
-        detail: detail || "The requested resource is no longer available",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  },
-  /**
-   * 429 Too Many Requests - Rate limit exceeded
-   */
-  rateLimitExceeded(c, retryAfter) {
-    const extensions = retryAfter ? { retryAfter } : void 0;
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.RATE_LIMIT_EXCEEDED, "Rate Limit Exceeded", 429, {
-        detail: retryAfter ? `Too many requests. Please retry after ${retryAfter} seconds` : "Too many requests. Please slow down",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId"),
-        extensions
-      })
-    );
-  },
-  /**
-   * 500 Internal Server Error - Generic server error
-   * SECURITY: Never include error details or stack traces
-   */
-  internalError(c, error) {
-    const traceId = c.get("traceId") || generateTraceId();
-    if (error) {
-      logError(error, {
-        context: "internal_error",
-        path: c.req.path,
-        method: c.req.method,
-        traceId,
-        requestId: c.get("requestId")
-      });
-    }
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.INTERNAL_ERROR, "Internal Server Error", 500, {
-        detail: "An unexpected error occurred. Please try again later",
-        instance: `${c.req.method} ${c.req.path}`,
-        traceId,
-        requestId: c.get("requestId")
-      })
-    );
-  },
-  /**
-   * 503 Service Unavailable - Service is temporarily unavailable
-   */
-  serviceUnavailable(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.SERVICE_UNAVAILABLE, "Service Unavailable", 503, {
-        detail: detail || "The service is temporarily unavailable. Please try again later",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  }
-};
-
-// src/middleware/auth.ts
-var SESSION_MAX_LIFETIME_MS = AUTH_DEFAULTS.SESSION_MAX_LIFETIME_DAYS * 24 * 60 * 60 * 1e3;
-async function revokeIfPastMaxLifetime(db, sessions, sessionId, session) {
-  if (Date.now() - session.createdAt <= SESSION_MAX_LIFETIME_MS) return false;
-  logger_default.info("Session exceeded absolute lifetime - revoked", {
-    type: "security",
-    event: "session_max_lifetime_exceeded",
-    severity: "low",
-    sessionId: sessionId.slice(0, 8),
-    userId: session.userId
-  });
-  await deleteSession(db, { sessions }, sessionId);
-  return true;
-}
-async function getSessionFromCookie(db, sessions, cookieHeader, request, env) {
-  const cookieName = getSessionCookieName(env);
-  const cookiePattern = new RegExp(`${cookieName}=([^;]+)`);
-  const sessionIdMatch = cookieHeader.match(cookiePattern);
-  if (!sessionIdMatch) return null;
-  const sessionId = sessionIdMatch[1];
-  const foundSessions = await db.select({
-    userId: sessions.userId,
-    expiresAt: sessions.expiresAt,
-    createdAt: sessions.createdAt,
-    fingerprint: sessions.fingerprint
-  }).from(sessions).where((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(sessions.id, sessionId), (0, import_drizzle_orm4.gt)(sessions.expiresAt, Date.now()))).limit(1);
-  if (foundSessions.length === 0) return null;
-  const session = foundSessions[0];
-  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
-  await refreshSession(db, { sessions }, sessionId);
-  const userAgent = request.headers.get("user-agent") || "";
-  const cfWorker = request.headers.get("cf-worker") || "";
-  const clientIp = request.headers.get("cf-connecting-ip") || request.headers.get("x-real-ip") || "";
-  const isLocalSSR = userAgent.toLowerCase().includes("node");
-  const isSvelteKitSSR = userAgent.toLowerCase().includes("sveltekit");
-  const isCloudflareSSR = !userAgent && cfWorker.includes(".pages.dev");
-  const isSSR = isLocalSSR || isSvelteKitSSR || isCloudflareSSR;
-  if (isSSR) {
-    logger_default.info("SSR request detected, using IP validation", {
-      type: "security",
-      event: "ssr_session_validation",
-      sessionId: sessionId.slice(0, 8),
-      userId: session.userId,
-      clientIp,
-      cfWorker,
-      isLocalSSR,
-      isSvelteKitSSR,
-      isCloudflareSSR
-    });
-  } else {
-    if (session.fingerprint) {
-      const currentFingerprint = await generateFingerprint(request);
-      if (session.fingerprint !== currentFingerprint) {
-        logger_default.info("Session fingerprint changed (not enforced)", {
-          type: "security",
-          event: "fingerprint_changed",
-          sessionId: sessionId.slice(0, 8),
-          userId: session.userId,
-          clientIp
-        });
-      }
-    }
-  }
-  return {
-    userId: session.userId,
-    expiresAt: session.expiresAt
-  };
-}
-async function getSessionFromBearerToken(db, sessions, authHeader) {
-  if (!authHeader.startsWith("Bearer ")) return null;
-  const sessionId = authHeader.slice(7);
-  const foundSessions = await db.select({
-    userId: sessions.userId,
-    expiresAt: sessions.expiresAt,
-    createdAt: sessions.createdAt
-  }).from(sessions).where((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(sessions.id, sessionId), (0, import_drizzle_orm4.gt)(sessions.expiresAt, Date.now()))).limit(1);
-  if (foundSessions.length === 0) return null;
-  const session = foundSessions[0];
-  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
-  await refreshSession(db, { sessions }, sessionId);
-  return {
-    userId: session.userId,
-    expiresAt: session.expiresAt
-  };
-}
-var requireAuth = (0, import_factory.createMiddleware)(
-  async (c, next) => {
-    const { db, schema } = getAuthContext(c);
-    const authHeader = c.req.header("Authorization");
-    if (authHeader) {
-      const session2 = await getSessionFromBearerToken(db, schema.sessions, authHeader);
-      if (session2) {
-        c.set("userId", session2.userId);
-        await next();
-        return;
-      }
-    }
-    const cookieHeader = c.req.header("cookie");
-    if (!cookieHeader) {
-      return problems.unauthorized(c, "Please log in to continue");
-    }
-    const session = await getSessionFromCookie(db, schema.sessions, cookieHeader, c.req.raw, c.env);
-    if (!session) {
-      c.header("Set-Cookie", clearSessionCookie(c.env));
-      return problems.unauthorized(c, "Your session has expired. Please log in again.");
-    }
-    c.set("userId", session.userId);
-    await next();
-  }
-);
-var optionalAuth = (0, import_factory.createMiddleware)(
-  async (c, next) => {
-    const { db, schema } = getAuthContext(c);
-    const authHeader = c.req.header("Authorization");
-    if (authHeader) {
-      const session = await getSessionFromBearerToken(db, schema.sessions, authHeader);
-      if (session) {
-        c.set("userId", session.userId);
-        await next();
-        return;
-      }
-    }
-    const cookieHeader = c.req.header("cookie");
-    if (cookieHeader) {
-      const session = await getSessionFromCookie(db, schema.sessions, cookieHeader, c.req.raw, c.env);
-      if (session) {
-        c.set("userId", session.userId);
-      }
-    }
-    await next();
-  }
-);
-
-// src/middleware/csrf.ts
-var import_factory3 = require("hono/factory");
-var csrf = (0, import_factory3.createMiddleware)(async (c, next) => {
-  const method = c.req.method;
-  const path = c.req.path;
-  const isWebhook = path.startsWith("/v1/webhooks/");
-  if (isWebhook) {
-    await next();
-    return;
-  }
-  const isMcpEndpoint = path === "/v1/mcp";
-  if (isMcpEndpoint) {
-    await next();
-    return;
-  }
-  const isOAuthMcpEndpoint = path.startsWith("/v1/oauth/");
-  if (isOAuthMcpEndpoint) {
-    await next();
-    return;
-  }
-  const isToolsApi = path.startsWith("/v1/tools/") && !path.startsWith("/v1/tools/catalog");
-  if (isToolsApi) {
-    await next();
-    return;
-  }
-  const isAdminApi = path.startsWith("/v1/admin/");
-  if (isAdminApi) {
-    await next();
-    return;
-  }
-  const isMobileAuthEndpoint = path === "/v1/auth/login" || path === "/v1/auth/signup" || path === "/v1/auth/refresh";
-  const authHeader = c.req.header("Authorization");
-  const hasBearerToken = authHeader?.startsWith("Bearer ");
-  const hasNoOrigin = !c.req.header("origin") && !c.req.header("referer");
-  if (isMobileAuthEndpoint && hasNoOrigin || hasBearerToken) {
-    await next();
-    return;
-  }
-  const isInternalSync = path.startsWith("/v1/internal/sync/");
-  if (isInternalSync) {
-    await next();
-    return;
-  }
-  if (["POST", "PUT", "DELETE", "PATCH"].includes(method)) {
-    const appUrl = c.env.APP_URL || "http://localhost:5173";
-    const allowedOrigins = getAllowedOrigins(appUrl);
-    const request = c.req.raw;
-    const isTestEndpoint = c.req.path.startsWith("/test");
-    if (isTestEndpoint) {
-      const origin = request.headers.get("origin");
-      const referer = request.headers.get("referer");
-      logger_default.debug("CSRF validation for test endpoint", {
-        path: c.req.path,
-        method,
-        origin,
-        referer,
-        appUrl,
-        allowedOrigins
-      });
-    }
-    const pagesPattern = c.env.CORS_PAGES_PATTERN;
-    if (!validateOrigin(request, allowedOrigins, pagesPattern)) {
-      return problems.forbidden(c, "Request blocked for security reasons. Please try again.");
-    }
-  }
-  await next();
-});
-
-// src/middleware/rateLimit.ts
-var import_factory4 = require("hono/factory");
-
-// src/lib/rate-limit-kv.ts
-async function checkRateLimitKV(kv, key, maxAttempts, windowSeconds) {
-  try {
-    const rateLimitKey = `rate_limit:${key}`;
-    const currentAttemptsStr = await kv.get(rateLimitKey);
-    const currentAttempts = currentAttemptsStr ? parseInt(currentAttemptsStr, 10) : 0;
-    if (currentAttempts >= maxAttempts) {
-      return {
-        allowed: false,
-        remaining: 0
-      };
-    }
-    const newAttempts = currentAttempts + 1;
-    await kv.put(rateLimitKey, newAttempts.toString(), {
-      expirationTtl: windowSeconds
-    });
-    return {
-      allowed: true,
-      remaining: maxAttempts - newAttempts
-    };
-  } catch (error) {
-    logger_default.error("Rate limit KV error, failing open", {
-      key,
-      error: error instanceof Error ? error.message : "Unknown error"
-    });
-    return {
-      allowed: true,
-      remaining: maxAttempts
-    };
-  }
-}
-
-// src/middleware/rateLimit.ts
-var rateLimit = (config) => (0, import_factory4.createMiddleware)(async (c, next) => {
-  const kv = c.env.RATE_LIMIT_KV;
-  const identifier = await config.identifier(c);
-  const key = `${config.action}:${identifier}`;
-  const windowSeconds = Math.ceil(config.windowMs / 1e3);
-  const { allowed, remaining } = await checkRateLimitKV(
-    kv,
-    key,
-    config.maxAttempts,
-    windowSeconds
-  );
-  const resetTimestamp = Math.ceil(Date.now() / 1e3) + windowSeconds;
-  c.header("X-RateLimit-Limit", config.maxAttempts.toString());
-  c.header("X-RateLimit-Remaining", Math.max(0, remaining).toString());
-  c.header("X-RateLimit-Reset", resetTimestamp.toString());
-  if (!allowed) {
-    c.header("Retry-After", windowSeconds.toString());
-    return problems.rateLimitExceeded(c, windowSeconds);
-  }
-  await next();
-});
-
-// src/middleware/require-verified-email.ts
-var import_factory5 = require("hono/factory");
-var import_drizzle_orm5 = require("drizzle-orm");
-var requireVerifiedEmail = (0, import_factory5.createMiddleware)(
-  async (c, next) => {
-    const userId = c.get("userId");
-    if (!userId) {
-      return problems.unauthorized(c, "Not authenticated");
-    }
-    const { db, schema } = getAuthContext(c);
-    const database = db;
-    const users = schema.users;
-    const [user] = await database.select({ emailVerified: users.emailVerified }).from(users).where((0, import_drizzle_orm5.eq)(users.id, userId)).limit(1);
-    if (!user || !user.emailVerified) {
-      return problems.forbidden(c, "Please verify your email address to continue");
-    }
-    await next();
-  }
-);
-
-// src/routes/index.ts
-var import_zod_openapi42 = require("@hono/zod-openapi");
-
-// src/routes/signup.ts
-var import_zod_openapi2 = require("@hono/zod-openapi");
-var import_drizzle_orm9 = require("drizzle-orm");
-
-// src/lib/email/email-service.ts
-var import_drizzle_orm6 = require("drizzle-orm");
-
-// src/lib/email/security.ts
-function getAllowedDomains(appUrl) {
-  const base = ["localhost", "127.0.0.1"];
-  try {
-    const url = new URL(appUrl);
-    return [...base, url.hostname];
-  } catch {
-    return base;
-  }
-}
-function sanitizeEmailUrl(url, appUrl = "") {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error("Invalid URL format");
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`Disallowed protocol: ${parsed.protocol}`);
-  }
-  const allowedDomains = getAllowedDomains(appUrl);
-  const hostname = parsed.hostname.toLowerCase();
-  const isAllowed = allowedDomains.some((domain) => {
-    return hostname === domain || hostname.endsWith(`.${domain}`);
-  });
-  if (!isAllowed) {
-    throw new Error(`Disallowed domain: ${hostname}`);
-  }
-  return parsed.toString();
-}
-function escapeHtml(text) {
-  const htmlEscapeMap = {
-    "&": "&amp;",
-    "<": "&lt;",
-    ">": "&gt;",
-    '"': "&quot;",
-    "'": "&#39;"
-  };
-  return text.replace(/[&<>"']/g, (char) => htmlEscapeMap[char]);
+function escapeHtml(text) {
+  const htmlEscapeMap = {
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#39;"
+  };
+  return text.replace(/[&<>"']/g, (char) => htmlEscapeMap[char]);
 }
 
 // src/core/email-template.ts
@@ -1932,8 +1432,10 @@ function generateEmailTemplate(options) {
     buttonFontWeight = 500,
     buttonRadius = "6px",
     logoUrl,
-    footerColor = "#1e1b4b"
+    footerColor = "#1e1b4b",
+    headingColor = "#1e1b4b"
   } = options;
+  const safeAppName = escapeHtml(appName);
   const safeButtonUrl = buttonUrl ? sanitizeEmailUrl(buttonUrl, appUrl) : "";
   const safeAppUrl = appUrl ? sanitizeEmailUrl(appUrl, appUrl) : "";
   const safeMarketingUrl = marketingUrl ? sanitizeEmailUrl(marketingUrl, appUrl) : "";
@@ -2077,7 +1579,7 @@ function generateEmailTemplate(options) {
                                   <td class="pad" style="padding-left:40px;padding-right:40px;width:100%;">
                                     <div class="alignment" align="center">
                                       <div class="fullWidth" style="max-width: 50%;">
-                                        <img src="${safeLogoUrl}" style="display: block; height: auto; border: 0; width: 100%;" alt="${appName}" title="${appName}" height="auto">
+                                        <img src="${safeLogoUrl}" style="display: block; height: auto; border: 0; width: 100%;" alt="${safeAppName}" title="${safeAppName}" height="auto">
                                       </div>
                                     </div>
                                   </td>
@@ -2089,7 +1591,7 @@ function generateEmailTemplate(options) {
                               <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
                                 <tr>
                                   <td class="pad" style="padding-top:30px;padding-left:40px;padding-right:40px;">
-                                    <div style="color:#1e1b4b;font-family:'Montserrat',Arial,sans-serif;font-size:22px;font-weight:600;line-height:1.4;text-align:center;mso-line-height-alt:31px;">
+                                    <div style="color:${headingColor};font-family:'Montserrat',Arial,sans-serif;font-size:22px;font-weight:600;line-height:1.4;text-align:center;mso-line-height-alt:31px;">
                                       <p style="margin: 0; word-break: break-word;">${welcomeMessage}</p>
                                     </div>
                                   </td>
@@ -2102,7 +1604,7 @@ function generateEmailTemplate(options) {
                               <table class="paragraph_block block-4" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
                                 <tr>
                                   <td class="pad" style="padding-bottom:10px;padding-left:40px;padding-right:40px;padding-top:10px;">
-                                    <div style="color:#1e1b4b;font-family:'Montserrat',Arial,sans-serif;font-size:30px;font-weight:700;line-height:1.2;text-align:center;mso-line-height-alt:36px;">
+                                    <div style="color:${headingColor};font-family:'Montserrat',Arial,sans-serif;font-size:30px;font-weight:700;line-height:1.2;text-align:center;mso-line-height-alt:36px;">
                                       <p style="margin: 0; word-break: break-word;">${heading}</p>
                                     </div>
                                   </td>
@@ -2147,133 +1649,796 @@ function generateEmailTemplate(options) {
                                 </tr>
                               </table>
 
-                              <!-- Copy Link -->
-                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
-                                <tr>
-                                  <td class="pad" style="padding-bottom:30px;padding-left:40px;padding-right:40px;">
-                                    <div style="color:#737373;font-family:'Montserrat',Arial,sans-serif;font-size:12px;line-height:1.5;text-align:center;mso-line-height-alt:18px;">
-                                      <p style="margin: 0 0 5px 0; word-break: break-word;">or copy and paste this link into your browser:</p>
-                                      <a href="${safeButtonUrl}" style="color:#4a90d9;text-decoration:underline;word-break:break-all;">${safeButtonUrl}</a>
-                                    </div>
-                                  </td>
-                                </tr>
-                              </table>
-                              ` : ""}
+                              <!-- Copy Link -->
+                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
+                                <tr>
+                                  <td class="pad" style="padding-bottom:30px;padding-left:40px;padding-right:40px;">
+                                    <div style="color:#737373;font-family:'Montserrat',Arial,sans-serif;font-size:12px;line-height:1.5;text-align:center;mso-line-height-alt:18px;">
+                                      <p style="margin: 0 0 5px 0; word-break: break-word;">or copy and paste this link into your browser:</p>
+                                      <a href="${safeButtonUrl}" style="color:#4a90d9;text-decoration:underline;word-break:break-all;">${safeButtonUrl}</a>
+                                    </div>
+                                  </td>
+                                </tr>
+                              </table>
+                              ` : ""}
+
+                              ${securityWarning ? `
+                              <!-- Security Warning -->
+                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
+                                <tr>
+                                  <td class="pad" style="padding-left:40px;padding-right:40px;padding-bottom:20px;">
+                                    <div style="background-color: #a1f1ff; border-radius: 8px; padding: 16px; display: flex; align-items: center; justify-content: center;">
+                                      <p style="margin: 0; color: #01001b; font-family: 'Montserrat', Arial, sans-serif; font-size: 13px; line-height: 1.5; text-align: center;">
+                                        ${securityWarning}
+                                      </p>
+                                    </div>
+                                  </td>
+                                </tr>
+                              </table>
+                              ` : ""}
+
+                              <!-- Footer Note -->
+                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
+                                <tr>
+                                  <td class="pad" style="padding-bottom:30px;padding-left:40px;padding-right:40px;">
+                                    <div style="color:#737373;font-family:'Montserrat',Arial,sans-serif;font-size:13px;line-height:1.5;text-align:center;mso-line-height-alt:20px;">
+                                      <p style="margin: 0; word-break: break-word;">${footerNote}</p>
+                                    </div>
+                                  </td>
+                                </tr>
+                              </table>
+
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </tbody>
+              </table>
+
+              <!-- Spacer Row -->
+              <table class="row row-2" align="center" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt;">
+                <tbody>
+                  <tr>
+                    <td>
+                      <table class="row-content stack" align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f8f9fa; color: #000000; max-width: 640px; width: 100%; margin: 0 auto;">
+                        <tbody>
+                          <tr>
+                            <td class="column column-1" width="100%" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; padding-bottom: 5px; vertical-align: top;">
+                              <table class="empty_block block-1" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt;">
+                                <tr>
+                                  <td class="pad">
+                                    <div></div>
+                                  </td>
+                                </tr>
+                              </table>
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </tbody>
+              </table>
+
+              <!-- Footer Row -->
+              <table class="row row-3" align="center" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt;">
+                <tbody>
+                  <tr>
+                    <td>
+                      <table class="row-content stack" align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: ${footerColor}; color: #000000; max-width: 640px; width: 100%; margin: 0 auto;">
+                        <tbody>
+                          <tr>
+                            <td class="column column-1" width="100%" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; vertical-align: top; padding: 20px;">
+
+                              <!-- Policy Links -->
+                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
+                                <tr>
+                                  <td class="pad" style="padding-bottom:20px;padding-left:40px;padding-right:40px;padding-top:20px;">
+                                    <div style="color:#ffffff;font-family:'Montserrat',Arial,sans-serif;font-size:13px;line-height:1.5;text-align:center;mso-line-height-alt:20px;">
+                                      <p style="margin: 0; word-break: break-word;">
+                                        <a href="${safeMarketingUrl}/privacy" style="color: #ffffff; text-decoration: underline;">Privacy Policy</a> | <a href="${safeMarketingUrl}/contact" style="color: #ffffff; text-decoration: underline;">Get in Touch</a>
+                                      </p>
+                                    </div>
+                                  </td>
+                                </tr>
+                              </table>
+
+                              <!-- Copyright & Disclaimer -->
+                              <table class="paragraph_block block-1" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
+                                <tr>
+                                  <td class="pad" style="padding-bottom:15px;padding-left:40px;padding-right:40px;">
+                                    <div style="color:#a3a3a3;font-family:'Montserrat',Arial,sans-serif;font-size:12px;line-height:1.5;text-align:center;mso-line-height-alt:18px;">
+                                      <p style="margin: 0 0 12px 0; word-break: break-word;">\xA9 ${(/* @__PURE__ */ new Date()).getFullYear()} ${safeAppName}. All rights reserved.</p>
+                                      <p style="margin: 0; font-size: 11px; line-height: 1.5; word-break: break-word;">
+                                        Please do not reply to this email as this address does not accept incoming messages. This service email contains essential information relating to your ${safeAppName} account.
+                                      </p>
+                                    </div>
+                                  </td>
+                                </tr>
+                              </table>
+
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </tbody>
+              </table>
+
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </body>
+    </html>
+  `;
+}
+
+// src/core/passwordless.ts
+var PASSWORDLESS_TTL_MS = 10 * 60 * 1e3;
+var PASSWORDLESS_MAX_ATTEMPTS = 5;
+var CODE_SPACE = 1e6;
+var CODE_LIMIT = Math.floor(4294967296 / CODE_SPACE) * CODE_SPACE;
+var CLEANUP_GRACE_MS = 24 * 60 * 60 * 1e3;
+var normalizeEmail = (email) => email.trim().toLowerCase();
+function generateCode() {
+  const buffer = new Uint32Array(1);
+  for (; ; ) {
+    crypto.getRandomValues(buffer);
+    if (buffer[0] < CODE_LIMIT) return String(buffer[0] % CODE_SPACE).padStart(6, "0");
+  }
+}
+var codeHash = (challengeId, code) => hashToken(`${challengeId}:${code}`);
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+async function consumeOpen(db, t, email, now) {
+  await db.update(t).set({ consumedAt: now }).where((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(t.email, email), (0, import_drizzle_orm4.isNull)(t.consumedAt)));
+}
+async function createPasswordlessChallenge(db, tables2, input) {
+  const t = tables2.passwordlessChallenges;
+  const email = normalizeEmail(input.email);
+  const now = Date.now();
+  const challengeId = crypto.randomUUID();
+  const linkToken = generateSecureToken(32);
+  const browserSecret = generateSecureToken(32);
+  const code = generateCode();
+  await consumeOpen(db, t, email, now);
+  await db.insert(t).values({
+    id: challengeId,
+    email,
+    subjectId: input.subjectId ?? null,
+    linkTokenHash: await hashToken(linkToken),
+    codeHash: await codeHash(challengeId, code),
+    browserHash: await hashToken(browserSecret),
+    attempts: 0,
+    payload: input.payload ?? null,
+    expiresAt: now + (input.ttlMs ?? PASSWORDLESS_TTL_MS),
+    createdAt: now
+  });
+  return { challengeId, linkToken, code, browserSecret };
+}
+async function verifyPasswordlessLink(db, tables2, input) {
+  const t = tables2.passwordlessChallenges;
+  const now = Date.now();
+  const hash = await hashToken(input.linkToken);
+  const [row] = await db.update(t).set({ consumedAt: now }).where((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(t.linkTokenHash, hash), (0, import_drizzle_orm4.isNull)(t.consumedAt), (0, import_drizzle_orm4.gt)(t.expiresAt, now))).returning();
+  if (!row) {
+    const [stale] = await db.select({ expiresAt: t.expiresAt, consumedAt: t.consumedAt }).from(t).where((0, import_drizzle_orm4.eq)(t.linkTokenHash, hash)).limit(1);
+    const expired = stale && stale.consumedAt === null && stale.expiresAt <= now;
+    return { ok: false, reason: expired ? "expired" : "invalid" };
+  }
+  await consumeOpen(db, t, row.email, now);
+  return { ok: true, email: row.email, subjectId: row.subjectId, payload: row.payload };
+}
+async function verifyPasswordlessCode(db, tables2, input) {
+  const t = tables2.passwordlessChallenges;
+  const max = input.maxAttempts ?? PASSWORDLESS_MAX_ATTEMPTS;
+  const email = normalizeEmail(input.email);
+  const now = Date.now();
+  const [row] = await db.select().from(t).where((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(t.email, email), (0, import_drizzle_orm4.isNull)(t.consumedAt))).orderBy((0, import_drizzle_orm4.desc)(t.createdAt)).limit(1);
+  if (!row) return { ok: false, reason: "invalid" };
+  if (!constantTimeEqual(row.browserHash, await hashToken(input.browserSecret))) {
+    return { ok: false, reason: "invalid" };
+  }
+  if (row.expiresAt <= now) return { ok: false, reason: "expired" };
+  if (row.attempts >= max) return { ok: false, reason: "locked" };
+  if (!constantTimeEqual(row.codeHash, await codeHash(row.id, input.code.trim()))) {
+    const [counted] = await db.update(t).set({ attempts: import_drizzle_orm4.sql`${t.attempts} + 1` }).where((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(t.id, row.id), (0, import_drizzle_orm4.lt)(t.attempts, max))).returning({ attempts: t.attempts });
+    return { ok: false, reason: counted && counted.attempts < max ? "invalid" : "locked" };
+  }
+  const [won] = await db.update(t).set({ consumedAt: now }).where((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(t.id, row.id), (0, import_drizzle_orm4.isNull)(t.consumedAt), (0, import_drizzle_orm4.lt)(t.attempts, max))).returning();
+  if (!won) return { ok: false, reason: "invalid" };
+  await consumeOpen(db, t, email, now);
+  return { ok: true, email, subjectId: won.subjectId, payload: won.payload };
+}
+async function recentPasswordlessFailures(db, tables2, input) {
+  const t = tables2.passwordlessChallenges;
+  const [row] = await db.select({ total: import_drizzle_orm4.sql`coalesce(sum(${t.attempts}), 0)::int` }).from(t).where((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(t.email, normalizeEmail(input.email)), (0, import_drizzle_orm4.gt)(t.createdAt, Date.now() - input.windowMs)));
+  return Number(row?.total ?? 0);
+}
+async function cleanupExpiredPasswordlessChallenges(db, tables2) {
+  const t = tables2.passwordlessChallenges;
+  await db.delete(t).where((0, import_drizzle_orm4.lt)(t.expiresAt, Date.now() - CLEANUP_GRACE_MS));
+}
+function passwordlessEmail(input) {
+  const { appName, appUrl, linkUrl, code } = input;
+  const minutes = Math.max(1, Math.round((input.ttlMs ?? PASSWORDLESS_TTL_MS) / 6e4));
+  const lifetime = `${minutes} ${minutes === 1 ? "minute" : "minutes"}`;
+  const safeLink = sanitizeEmailUrl(linkUrl, appUrl);
+  const html = generateEmailTemplate({
+    heading: `Sign in to ${escapeHtml(appName)}`,
+    body: `<p>Use this code, or the button below, to sign in:</p>
+			<p style="font-size: 32px; font-weight: bold; letter-spacing: 4px; text-align: center; margin: 24px 0; font-family: monospace;">${escapeHtml(code)}</p>
+			<p>The code and the link expire in ${lifetime}.</p>`,
+    buttonText: "Sign in",
+    buttonUrl: safeLink,
+    footerNote: "If you didn't ask to sign in, you can ignore this email.",
+    appUrl,
+    appName
+  });
+  return {
+    subject: `${code} is your sign-in code`,
+    html,
+    text: `Your ${appName} sign-in code is ${code}.
+
+Or sign in with this link:
+${safeLink}
 
-                              ${securityWarning ? `
-                              <!-- Security Warning -->
-                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
-                                <tr>
-                                  <td class="pad" style="padding-left:40px;padding-right:40px;padding-bottom:20px;">
-                                    <div style="background-color: #a1f1ff; border-radius: 8px; padding: 16px; display: flex; align-items: center; justify-content: center;">
-                                      <p style="margin: 0; color: #01001b; font-family: 'Montserrat', Arial, sans-serif; font-size: 13px; line-height: 1.5; text-align: center;">
-                                        ${securityWarning}
-                                      </p>
-                                    </div>
-                                  </td>
-                                </tr>
-                              </table>
-                              ` : ""}
+The code and the link expire in ${lifetime}.
 
-                              <!-- Footer Note -->
-                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
-                                <tr>
-                                  <td class="pad" style="padding-bottom:30px;padding-left:40px;padding-right:40px;">
-                                    <div style="color:#737373;font-family:'Montserrat',Arial,sans-serif;font-size:13px;line-height:1.5;text-align:center;mso-line-height-alt:20px;">
-                                      <p style="margin: 0; word-break: break-word;">${footerNote}</p>
-                                    </div>
-                                  </td>
-                                </tr>
-                              </table>
+If you didn't ask to sign in, you can ignore this email.`
+  };
+}
+
+// src/middleware/auth.ts
+var import_factory = require("hono/factory");
+var import_drizzle_orm5 = require("drizzle-orm");
+
+// src/factory.ts
+function createAuth(config) {
+  const { db, schema, getEnv, emailBranding, invitations, signup = "open" } = config;
+  if (signup === "invitation" && !invitations) {
+    throw new Error("createAuth: signup: 'invitation' requires the invitations hooks");
+  }
+  const getContext = (c) => ({
+    db,
+    schema,
+    env: getEnv(c),
+    emailBranding,
+    invitations,
+    signup
+  });
+  return {
+    db,
+    schema,
+    getContext
+  };
+}
+function createAuthMiddleware(auth2) {
+  return async (c, next) => {
+    const ctx = auth2.getContext(c);
+    c.set("authContext", ctx);
+    c.set("db", auth2.db);
+    await next();
+  };
+}
+function getAuthContext(c) {
+  const ctx = c.get("authContext");
+  if (!ctx) {
+    throw new Error(
+      "AuthContext not found. Did you apply createAuthMiddleware before the auth routes?"
+    );
+  }
+  return ctx;
+}
+
+// src/lib/problem-json.ts
+var ProblemTypes = {
+  // 4xx Client Errors
+  BAD_REQUEST: "/errors/bad-request",
+  UNAUTHORIZED: "/errors/unauthorized",
+  FORBIDDEN: "/errors/forbidden",
+  NOT_FOUND: "/errors/not-found",
+  CONFLICT: "/errors/conflict",
+  GONE: "/errors/gone",
+  VALIDATION_ERROR: "/errors/validation-error",
+  RATE_LIMIT_EXCEEDED: "/errors/rate-limit-exceeded",
+  // 5xx Server Errors
+  INTERNAL_ERROR: "/errors/internal-error",
+  SERVICE_UNAVAILABLE: "/errors/service-unavailable"
+};
+function generateTraceId() {
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function createProblemDetails(type, title, status, options) {
+  const problem = {
+    type,
+    title,
+    status
+  };
+  if (options?.detail) {
+    problem.detail = options.detail;
+  }
+  if (options?.instance) {
+    problem.instance = options.instance;
+  }
+  problem.traceId = options?.traceId || generateTraceId();
+  if (options?.requestId) {
+    problem.requestId = options.requestId;
+  }
+  if (options?.extensions) {
+    Object.assign(problem, options.extensions);
+  }
+  return problem;
+}
+function problemJson(c, problem) {
+  logger_default.warn("API error response", {
+    type: problem.type,
+    status: problem.status,
+    traceId: problem.traceId,
+    requestId: problem.requestId,
+    path: c.req.path,
+    method: c.req.method
+  });
+  return c.json(problem, problem.status, {
+    "Content-Type": "application/problem+json"
+  });
+}
+var problems = {
+  /**
+   * 400 Bad Request - Generic client error
+   */
+  badRequest(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.BAD_REQUEST, "Bad Request", 400, {
+        detail: detail || "The request could not be understood by the server",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  },
+  /**
+   * 400 Bad Request - Validation errors with field-specific details
+   */
+  validationError(c, detail, errors) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.VALIDATION_ERROR, "Validation Error", 400, {
+        detail,
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId"),
+        extensions: errors ? { errors } : void 0
+      })
+    );
+  },
+  /**
+   * 401 Unauthorized - Authentication required
+   */
+  unauthorized(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.UNAUTHORIZED, "Unauthorized", 401, {
+        detail: detail || "Authentication is required to access this resource",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  },
+  /**
+   * 403 Forbidden - Insufficient permissions
+   */
+  forbidden(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.FORBIDDEN, "Forbidden", 403, {
+        detail: detail || "You do not have permission to access this resource",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  },
+  /**
+   * 404 Not Found
+   */
+  notFound(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.NOT_FOUND, "Not Found", 404, {
+        detail: detail || "The requested resource was not found",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  },
+  /**
+   * 409 Conflict - Resource conflict (e.g., duplicate email)
+   */
+  conflict(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.CONFLICT, "Conflict", 409, {
+        detail,
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  },
+  /**
+   * 410 Gone - Resource is no longer available
+   */
+  gone(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.GONE, "Gone", 410, {
+        detail: detail || "The requested resource is no longer available",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  },
+  /**
+   * 429 Too Many Requests - Rate limit exceeded
+   */
+  rateLimitExceeded(c, retryAfter) {
+    const extensions = retryAfter ? { retryAfter } : void 0;
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.RATE_LIMIT_EXCEEDED, "Rate Limit Exceeded", 429, {
+        detail: retryAfter ? `Too many requests. Please retry after ${retryAfter} seconds` : "Too many requests. Please slow down",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId"),
+        extensions
+      })
+    );
+  },
+  /**
+   * 500 Internal Server Error - Generic server error
+   * SECURITY: Never include error details or stack traces
+   */
+  internalError(c, error) {
+    const traceId = c.get("traceId") || generateTraceId();
+    if (error) {
+      logError(error, {
+        context: "internal_error",
+        path: c.req.path,
+        method: c.req.method,
+        traceId,
+        requestId: c.get("requestId")
+      });
+    }
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.INTERNAL_ERROR, "Internal Server Error", 500, {
+        detail: "An unexpected error occurred. Please try again later",
+        instance: `${c.req.method} ${c.req.path}`,
+        traceId,
+        requestId: c.get("requestId")
+      })
+    );
+  },
+  /**
+   * 503 Service Unavailable - Service is temporarily unavailable
+   */
+  serviceUnavailable(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.SERVICE_UNAVAILABLE, "Service Unavailable", 503, {
+        detail: detail || "The service is temporarily unavailable. Please try again later",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  }
+};
 
-                            </td>
-                          </tr>
-                        </tbody>
-                      </table>
-                    </td>
-                  </tr>
-                </tbody>
-              </table>
+// src/middleware/auth.ts
+var SESSION_MAX_LIFETIME_MS = AUTH_DEFAULTS.SESSION_MAX_LIFETIME_DAYS * 24 * 60 * 60 * 1e3;
+async function revokeIfPastMaxLifetime(db, sessions, sessionId, session) {
+  if (Date.now() - session.createdAt <= SESSION_MAX_LIFETIME_MS) return false;
+  logger_default.info("Session exceeded absolute lifetime - revoked", {
+    type: "security",
+    event: "session_max_lifetime_exceeded",
+    severity: "low",
+    sessionId: sessionId.slice(0, 8),
+    userId: session.userId
+  });
+  await deleteSession(db, { sessions }, sessionId);
+  return true;
+}
+async function getSessionFromCookie(db, sessions, cookieHeader, request, env) {
+  const cookieName = getSessionCookieName(env);
+  const cookiePattern = new RegExp(`${cookieName}=([^;]+)`);
+  const sessionIdMatch = cookieHeader.match(cookiePattern);
+  if (!sessionIdMatch) return null;
+  const sessionId = sessionIdMatch[1];
+  const foundSessions = await db.select({
+    userId: sessions.userId,
+    expiresAt: sessions.expiresAt,
+    createdAt: sessions.createdAt,
+    lastActiveAt: sessions.lastActiveAt,
+    fingerprint: sessions.fingerprint
+  }).from(sessions).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.eq)(sessions.id, sessionId), (0, import_drizzle_orm5.gt)(sessions.expiresAt, Date.now()))).limit(1);
+  if (foundSessions.length === 0) return null;
+  const session = foundSessions[0];
+  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
+  if (sessionRefreshDue(session.lastActiveAt)) await refreshSession(db, { sessions }, sessionId);
+  const userAgent = request.headers.get("user-agent") || "";
+  const cfWorker = request.headers.get("cf-worker") || "";
+  const clientIp = request.headers.get("cf-connecting-ip") || request.headers.get("x-real-ip") || "";
+  const isLocalSSR = userAgent.toLowerCase().includes("node");
+  const isSvelteKitSSR = userAgent.toLowerCase().includes("sveltekit");
+  const isCloudflareSSR = !userAgent && cfWorker.includes(".pages.dev");
+  const isSSR = isLocalSSR || isSvelteKitSSR || isCloudflareSSR;
+  if (isSSR) {
+    logger_default.info("SSR request detected, using IP validation", {
+      type: "security",
+      event: "ssr_session_validation",
+      sessionId: sessionId.slice(0, 8),
+      userId: session.userId,
+      clientIp,
+      cfWorker,
+      isLocalSSR,
+      isSvelteKitSSR,
+      isCloudflareSSR
+    });
+  } else {
+    if (session.fingerprint) {
+      const currentFingerprint = await generateFingerprint(request);
+      if (session.fingerprint !== currentFingerprint) {
+        logger_default.info("Session fingerprint changed (not enforced)", {
+          type: "security",
+          event: "fingerprint_changed",
+          sessionId: sessionId.slice(0, 8),
+          userId: session.userId,
+          clientIp
+        });
+      }
+    }
+  }
+  return {
+    userId: session.userId,
+    expiresAt: session.expiresAt
+  };
+}
+async function getSessionFromBearerToken(db, sessions, authHeader) {
+  if (!authHeader.startsWith("Bearer ")) return null;
+  const sessionId = authHeader.slice(7);
+  const foundSessions = await db.select({
+    userId: sessions.userId,
+    expiresAt: sessions.expiresAt,
+    createdAt: sessions.createdAt,
+    lastActiveAt: sessions.lastActiveAt
+  }).from(sessions).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.eq)(sessions.id, sessionId), (0, import_drizzle_orm5.gt)(sessions.expiresAt, Date.now()))).limit(1);
+  if (foundSessions.length === 0) return null;
+  const session = foundSessions[0];
+  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
+  if (sessionRefreshDue(session.lastActiveAt)) await refreshSession(db, { sessions }, sessionId);
+  return {
+    userId: session.userId,
+    expiresAt: session.expiresAt
+  };
+}
+var requireAuth = (0, import_factory.createMiddleware)(
+  async (c, next) => {
+    const { db, schema } = getAuthContext(c);
+    const authHeader = c.req.header("Authorization");
+    if (authHeader) {
+      const session2 = await getSessionFromBearerToken(db, schema.sessions, authHeader);
+      if (session2) {
+        c.set("userId", session2.userId);
+        await next();
+        return;
+      }
+    }
+    const cookieHeader = c.req.header("cookie");
+    if (!cookieHeader) {
+      return problems.unauthorized(c, "Please log in to continue");
+    }
+    const session = await getSessionFromCookie(db, schema.sessions, cookieHeader, c.req.raw, c.env);
+    if (!session) {
+      c.header("Set-Cookie", clearSessionCookie(c.env));
+      return problems.unauthorized(c, "Your session has expired. Please log in again.");
+    }
+    c.set("userId", session.userId);
+    await next();
+  }
+);
+var optionalAuth = (0, import_factory.createMiddleware)(
+  async (c, next) => {
+    const { db, schema } = getAuthContext(c);
+    const authHeader = c.req.header("Authorization");
+    if (authHeader) {
+      const session = await getSessionFromBearerToken(db, schema.sessions, authHeader);
+      if (session) {
+        c.set("userId", session.userId);
+        await next();
+        return;
+      }
+    }
+    const cookieHeader = c.req.header("cookie");
+    if (cookieHeader) {
+      const session = await getSessionFromCookie(db, schema.sessions, cookieHeader, c.req.raw, c.env);
+      if (session) {
+        c.set("userId", session.userId);
+      }
+    }
+    await next();
+  }
+);
 
-              <!-- Spacer Row -->
-              <table class="row row-2" align="center" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt;">
-                <tbody>
-                  <tr>
-                    <td>
-                      <table class="row-content stack" align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f8f9fa; color: #000000; max-width: 640px; width: 100%; margin: 0 auto;">
-                        <tbody>
-                          <tr>
-                            <td class="column column-1" width="100%" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; padding-bottom: 5px; vertical-align: top;">
-                              <table class="empty_block block-1" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt;">
-                                <tr>
-                                  <td class="pad">
-                                    <div></div>
-                                  </td>
-                                </tr>
-                              </table>
-                            </td>
-                          </tr>
-                        </tbody>
-                      </table>
-                    </td>
-                  </tr>
-                </tbody>
-              </table>
+// src/middleware/csrf.ts
+var import_factory3 = require("hono/factory");
+var csrf = (0, import_factory3.createMiddleware)(async (c, next) => {
+  const method = c.req.method;
+  const path = c.req.path;
+  const isWebhook = path.startsWith("/v1/webhooks/");
+  if (isWebhook) {
+    await next();
+    return;
+  }
+  const isMcpEndpoint = path === "/v1/mcp";
+  if (isMcpEndpoint) {
+    await next();
+    return;
+  }
+  const isOAuthMcpEndpoint = path.startsWith("/v1/oauth/");
+  if (isOAuthMcpEndpoint) {
+    await next();
+    return;
+  }
+  const isToolsApi = path.startsWith("/v1/tools/") && !path.startsWith("/v1/tools/catalog");
+  if (isToolsApi) {
+    await next();
+    return;
+  }
+  const isAdminApi = path.startsWith("/v1/admin/");
+  if (isAdminApi) {
+    await next();
+    return;
+  }
+  const isMobileAuthEndpoint = path === "/v1/auth/login" || path === "/v1/auth/signup" || path === "/v1/auth/refresh";
+  const authHeader = c.req.header("Authorization");
+  const hasBearerToken = authHeader?.startsWith("Bearer ");
+  const hasNoOrigin = !c.req.header("origin") && !c.req.header("referer");
+  if (isMobileAuthEndpoint && hasNoOrigin || hasBearerToken) {
+    await next();
+    return;
+  }
+  const isInternalSync = path.startsWith("/v1/internal/sync/");
+  if (isInternalSync) {
+    await next();
+    return;
+  }
+  if (["POST", "PUT", "DELETE", "PATCH"].includes(method)) {
+    const appUrl = c.env.APP_URL || "http://localhost:5173";
+    const allowedOrigins = getAllowedOrigins(appUrl);
+    const request = c.req.raw;
+    const isTestEndpoint = c.req.path.startsWith("/test");
+    if (isTestEndpoint) {
+      const origin = request.headers.get("origin");
+      const referer = request.headers.get("referer");
+      logger_default.debug("CSRF validation for test endpoint", {
+        path: c.req.path,
+        method,
+        origin,
+        referer,
+        appUrl,
+        allowedOrigins
+      });
+    }
+    const pagesPattern = c.env.CORS_PAGES_PATTERN;
+    if (!validateOrigin(request, allowedOrigins, pagesPattern)) {
+      return problems.forbidden(c, "Request blocked for security reasons. Please try again.");
+    }
+  }
+  await next();
+});
 
-              <!-- Footer Row -->
-              <table class="row row-3" align="center" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt;">
-                <tbody>
-                  <tr>
-                    <td>
-                      <table class="row-content stack" align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: ${footerColor}; color: #000000; max-width: 640px; width: 100%; margin: 0 auto;">
-                        <tbody>
-                          <tr>
-                            <td class="column column-1" width="100%" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; vertical-align: top; padding: 20px;">
+// src/middleware/rateLimit.ts
+var import_factory4 = require("hono/factory");
 
-                              <!-- Policy Links -->
-                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
-                                <tr>
-                                  <td class="pad" style="padding-bottom:20px;padding-left:40px;padding-right:40px;padding-top:20px;">
-                                    <div style="color:#ffffff;font-family:'Montserrat',Arial,sans-serif;font-size:13px;line-height:1.5;text-align:center;mso-line-height-alt:20px;">
-                                      <p style="margin: 0; word-break: break-word;">
-                                        <a href="${safeMarketingUrl}/privacy" style="color: #ffffff; text-decoration: underline;">Privacy Policy</a> | <a href="${safeMarketingUrl}/contact" style="color: #ffffff; text-decoration: underline;">Get in Touch</a>
-                                      </p>
-                                    </div>
-                                  </td>
-                                </tr>
-                              </table>
+// src/lib/rate-limit-kv.ts
+async function checkRateLimitKV(kv, key, maxAttempts, windowSeconds) {
+  try {
+    const rateLimitKey = `rate_limit:${key}`;
+    const currentAttemptsStr = await kv.get(rateLimitKey);
+    const currentAttempts = currentAttemptsStr ? parseInt(currentAttemptsStr, 10) : 0;
+    if (currentAttempts >= maxAttempts) {
+      return {
+        allowed: false,
+        remaining: 0
+      };
+    }
+    const newAttempts = currentAttempts + 1;
+    await kv.put(rateLimitKey, newAttempts.toString(), {
+      expirationTtl: windowSeconds
+    });
+    return {
+      allowed: true,
+      remaining: maxAttempts - newAttempts
+    };
+  } catch (error) {
+    logger_default.error("Rate limit KV error, failing open", {
+      key,
+      error: error instanceof Error ? error.message : "Unknown error"
+    });
+    return {
+      allowed: true,
+      remaining: maxAttempts
+    };
+  }
+}
 
-                              <!-- Copyright & Disclaimer -->
-                              <table class="paragraph_block block-1" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
-                                <tr>
-                                  <td class="pad" style="padding-bottom:15px;padding-left:40px;padding-right:40px;">
-                                    <div style="color:#a3a3a3;font-family:'Montserrat',Arial,sans-serif;font-size:12px;line-height:1.5;text-align:center;mso-line-height-alt:18px;">
-                                      <p style="margin: 0 0 12px 0; word-break: break-word;">\xA9 ${(/* @__PURE__ */ new Date()).getFullYear()} ${appName}. All rights reserved.</p>
-                                      <p style="margin: 0; font-size: 11px; line-height: 1.5; word-break: break-word;">
-                                        Please do not reply to this email as this address does not accept incoming messages. This service email contains essential information relating to your ${appName} account.
-                                      </p>
-                                    </div>
-                                  </td>
-                                </tr>
-                              </table>
+// src/middleware/rateLimit.ts
+var rateLimit = (config) => (0, import_factory4.createMiddleware)(async (c, next) => {
+  const kv = c.env.RATE_LIMIT_KV;
+  const identifier = await config.identifier(c);
+  const key = `${config.action}:${identifier}`;
+  const windowSeconds = Math.ceil(config.windowMs / 1e3);
+  const { allowed, remaining } = await checkRateLimitKV(
+    kv,
+    key,
+    config.maxAttempts,
+    windowSeconds
+  );
+  const resetTimestamp = Math.ceil(Date.now() / 1e3) + windowSeconds;
+  c.header("X-RateLimit-Limit", config.maxAttempts.toString());
+  c.header("X-RateLimit-Remaining", Math.max(0, remaining).toString());
+  c.header("X-RateLimit-Reset", resetTimestamp.toString());
+  if (!allowed) {
+    c.header("Retry-After", windowSeconds.toString());
+    return problems.rateLimitExceeded(c, windowSeconds);
+  }
+  await next();
+});
 
-                            </td>
-                          </tr>
-                        </tbody>
-                      </table>
-                    </td>
-                  </tr>
-                </tbody>
-              </table>
+// src/middleware/require-verified-email.ts
+var import_factory5 = require("hono/factory");
+var import_drizzle_orm6 = require("drizzle-orm");
+var requireVerifiedEmail = (0, import_factory5.createMiddleware)(
+  async (c, next) => {
+    const userId = c.get("userId");
+    if (!userId) {
+      return problems.unauthorized(c, "Not authenticated");
+    }
+    const { db, schema } = getAuthContext(c);
+    const database = db;
+    const users = schema.users;
+    const [user] = await database.select({ emailVerified: users.emailVerified }).from(users).where((0, import_drizzle_orm6.eq)(users.id, userId)).limit(1);
+    if (!user || !user.emailVerified) {
+      return problems.forbidden(c, "Please verify your email address to continue");
+    }
+    await next();
+  }
+);
 
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </body>
-    </html>
-  `;
-}
+// src/routes/index.ts
+var import_zod_openapi42 = require("@hono/zod-openapi");
+
+// src/routes/signup.ts
+var import_zod_openapi2 = require("@hono/zod-openapi");
+var import_drizzle_orm10 = require("drizzle-orm");
+
+// src/lib/email/email-service.ts
+var import_drizzle_orm7 = require("drizzle-orm");
 
 // src/lib/email/templates.ts
 function extractAppUrl(url) {
@@ -2297,6 +2462,7 @@ function generateVerificationEmail(data, appName = "Your App", configuredAppUrl
     welcomeMessage: safeFirstName ? `Hi ${safeFirstName}, Welcome to ${escapeHtml(appName)}!` : void 0,
     footerNote: "",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -2332,6 +2498,7 @@ function generatePasswordResetEmail(data, appName = "Your App", configuredAppUrl
 		`,
     footerNote: "If you didn't request this change, no action is needed. Your password will remain unchanged.",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -2367,6 +2534,7 @@ function generateEmailChangeConfirmation(data, appName = "Your App", configuredA
 		`,
     footerNote: "If you didn't request this change, you can safely ignore this email.",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -2405,6 +2573,7 @@ function generateEmailChangeNotification(data, appName = "Your App", configuredA
 		`,
     footerNote: "If you didn't request this change, click the button above to cancel it.",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -2441,6 +2610,7 @@ function generate2faCodeEmail(data, appName = "Your App", appUrl = "", branding)
     buttonUrl: "",
     footerNote: "",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -2476,6 +2646,7 @@ function generate2faEnabledEmail(data, appName = "Your App", appUrl = "", brandi
     buttonUrl: "",
     footerNote: "",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -2506,6 +2677,7 @@ function generate2faDisabledEmail(data, appName = "Your App", appUrl = "", brand
     buttonUrl: appUrl ? `${appUrl}/forgot-password` : "",
     footerNote: "",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -2722,7 +2894,7 @@ var EmailService = class {
     const [user] = await db.select({
       emailBounced: usersTable.emailBounced,
       emailComplained: usersTable.emailComplained
-    }).from(usersTable).where((0, import_drizzle_orm6.eq)(usersTable.email, emailAddress.toLowerCase())).limit(1);
+    }).from(usersTable).where((0, import_drizzle_orm7.eq)(usersTable.email, emailAddress.toLowerCase())).limit(1);
     if (!user) {
       return { blocked: false };
     }
@@ -3171,7 +3343,7 @@ var EmailService = class {
 var import_resend2 = require("resend");
 
 // src/lib/email/webhook-handler.ts
-var import_drizzle_orm7 = require("drizzle-orm");
+var import_drizzle_orm8 = require("drizzle-orm");
 async function handleWebhookEvent(payload, db, tables2) {
   const { type, data } = payload;
   const emailAddress = data.to[0];
@@ -3230,7 +3402,7 @@ async function handleBounce(emailAddress, emailId, bounce, db, usersTable) {
   await db.update(usersTable).set({
     emailBounced: true,
     emailBouncedAt: /* @__PURE__ */ new Date()
-  }).where((0, import_drizzle_orm7.eq)(usersTable.email, emailAddress.toLowerCase()));
+  }).where((0, import_drizzle_orm8.eq)(usersTable.email, emailAddress.toLowerCase()));
   logError(new Error("Email bounced"), {
     context: "email_webhook",
     emailAddress,
@@ -3246,7 +3418,7 @@ async function handleComplaint(emailAddress, emailId, db, usersTable) {
   await db.update(usersTable).set({
     emailComplained: true,
     emailComplainedAt: /* @__PURE__ */ new Date()
-  }).where((0, import_drizzle_orm7.eq)(usersTable.email, emailAddress.toLowerCase()));
+  }).where((0, import_drizzle_orm8.eq)(usersTable.email, emailAddress.toLowerCase()));
   logError(new Error("Email spam complaint received"), {
     context: "email_webhook",
     emailAddress,
@@ -3268,15 +3440,15 @@ async function handleFailure(emailAddress, emailId, failed) {
 }
 
 // src/lib/email/monitoring.ts
-var import_drizzle_orm8 = require("drizzle-orm");
+var import_drizzle_orm9 = require("drizzle-orm");
 async function calculateBounceRate(db, emailEventsTable, hoursAgo = 24) {
   const cutoff = new Date(Date.now() - hoursAgo * 60 * 60 * 1e3);
   const [stats] = await db.select({
-    totalSent: import_drizzle_orm8.sql`count(*) filter (where event_type = 'email.sent')`.as("total_sent"),
-    totalBounced: import_drizzle_orm8.sql`count(*) filter (where event_type = 'email.bounced')`.as(
+    totalSent: import_drizzle_orm9.sql`count(*) filter (where event_type = 'email.sent')`.as("total_sent"),
+    totalBounced: import_drizzle_orm9.sql`count(*) filter (where event_type = 'email.bounced')`.as(
       "total_bounced"
     )
-  }).from(emailEventsTable).where(import_drizzle_orm8.sql`created_at > ${cutoff}`);
+  }).from(emailEventsTable).where(import_drizzle_orm9.sql`created_at > ${cutoff}`);
   if (!stats || stats.totalSent === 0) {
     return 0;
   }
@@ -3295,11 +3467,11 @@ async function calculateBounceRate(db, emailEventsTable, hoursAgo = 24) {
 async function calculateComplaintRate(db, emailEventsTable, hoursAgo = 24) {
   const cutoff = new Date(Date.now() - hoursAgo * 60 * 60 * 1e3);
   const [stats] = await db.select({
-    totalSent: import_drizzle_orm8.sql`count(*) filter (where event_type = 'email.sent')`.as("total_sent"),
-    totalComplained: import_drizzle_orm8.sql`count(*) filter (where event_type = 'email.complained')`.as(
+    totalSent: import_drizzle_orm9.sql`count(*) filter (where event_type = 'email.sent')`.as("total_sent"),
+    totalComplained: import_drizzle_orm9.sql`count(*) filter (where event_type = 'email.complained')`.as(
       "total_complained"
     )
-  }).from(emailEventsTable).where(import_drizzle_orm8.sql`created_at > ${cutoff}`);
+  }).from(emailEventsTable).where(import_drizzle_orm9.sql`created_at > ${cutoff}`);
   if (!stats || stats.totalSent === 0) {
     return 0;
   }
@@ -3316,16 +3488,34 @@ async function calculateComplaintRate(db, emailEventsTable, hoursAgo = 24) {
   return complaintRate;
 }
 
+// src/core/invitations.ts
+async function verifyInvitation(invitations, args) {
+  if (!invitations || !args.token) return null;
+  const email = args.email.toLowerCase();
+  try {
+    const match = await invitations.verify({ token: args.token, email, db: args.db, env: args.env });
+    return match && match.email.toLowerCase() === email ? args.token : null;
+  } catch (err) {
+    logError(err, { context: "invitation_verify_failed", email });
+    return null;
+  }
+}
+async function acceptInvitation(invitations, args) {
+  if (!invitations?.onAccepted) return;
+  try {
+    await invitations.onAccepted({ token: args.token, user: args.user, db: args.db, env: args.env });
+  } catch (err) {
+    logError(err, { context: args.context, userId: args.user.id });
+  }
+}
+
 // src/routes/schemas.ts
 var import_zod_openapi = require("@hono/zod-openapi");
 var signupRequestSchema = import_zod_openapi.z.object({
   email: import_zod_openapi.z.string().email().openapi({ example: "user@example.com" }),
-  // Password and turnstileToken are required for standard signup; optional when oauthToken is provided
-  password: import_zod_openapi.z.string().min(8).optional().openapi({ example: "SecurePass123!" }),
+  password: import_zod_openapi.z.string().min(8).openapi({ example: "SecurePass123!" }),
   name: import_zod_openapi.z.string().min(1).optional().openapi({ example: "John Doe" }),
-  turnstileToken: import_zod_openapi.z.string().optional().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" }),
-  // OAuth signup completion token (from /signup?oauth_token=...)
-  oauthToken: import_zod_openapi.z.string().optional().openapi({ example: "a1b2c3d4-..." }),
+  turnstileToken: import_zod_openapi.z.string().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" }),
   // App invitation token (from /signup?token=...). When it validates for this
   // email, the account is created already-verified with no verification email.
   invitationToken: import_zod_openapi.z.string().optional().openapi({ example: "iIB8tDJJ..." })
@@ -3451,76 +3641,22 @@ var signupRoute = (0, import_zod_openapi2.createRoute)({
       description: "Invalid input",
       content: { "application/json": { schema: errorResponseSchema } }
     },
+    403: {
+      description: "Sign-up is by invitation only and no valid invitation was given",
+      content: { "application/json": { schema: errorResponseSchema } }
+    },
     409: {
       description: "Email already registered",
       content: { "application/json": { schema: errorResponseSchema } }
     }
   }
 });
+var INVITATION_ONLY = "Sign-up is by invitation only";
+var INVITATION_INVALID = "This invitation is invalid, expired, or for a different email address";
 var signupHandler = async (c) => {
-  const { email, password, name, turnstileToken, oauthToken, invitationToken } = c.req.valid("json");
-  const { db: database, schema, emailBranding, invitations } = getAuthContext(c);
+  const { email, password, name, turnstileToken, invitationToken } = c.req.valid("json");
+  const { db: database, schema, env: authEnv, emailBranding, invitations, signup } = getAuthContext(c);
   const env = c.env;
-  if (oauthToken) {
-    const stored = await env.OAUTH_STATES.get(`oauth:signup:${oauthToken}`);
-    if (!stored) {
-      return problems.badRequest(c, "Invalid or expired OAuth token");
-    }
-    const {
-      email: tokenEmail,
-      provider,
-      providerUserId
-    } = JSON.parse(stored);
-    if (email.toLowerCase() !== tokenEmail.toLowerCase()) {
-      return problems.badRequest(c, "Email does not match OAuth token");
-    }
-    await env.OAUTH_STATES.delete(`oauth:signup:${oauthToken}`);
-    const existingUser2 = await database.query.users.findFirst({
-      where: (0, import_drizzle_orm9.eq)(schema.users.email, tokenEmail.toLowerCase())
-    });
-    if (existingUser2) {
-      return problems.conflict(c, "Email already registered");
-    }
-    let hashedPassword2 = null;
-    if (password) {
-      const passwordValidation2 = await validatePasswordWithBreachCheck(password);
-      if (!passwordValidation2.valid) {
-        return problems.badRequest(c, passwordValidation2.error || "Invalid password");
-      }
-      hashedPassword2 = await hashPassword(password, env.PASSWORD_PEPPER_V1);
-    }
-    const [newUser2] = await database.insert(schema.users).values({
-      email: tokenEmail.toLowerCase(),
-      name: name || null,
-      hashedPassword: hashedPassword2,
-      pepperKid: hashedPassword2 ? "v1" : null,
-      emailVerified: true,
-      // Provider verified the email
-      activatedAt: /* @__PURE__ */ new Date()
-    }).returning();
-    await database.insert(schema.oauthAccounts).values({ userId: newUser2.id, provider, providerUserId, email: tokenEmail.toLowerCase() }).onConflictDoNothing();
-    const fingerprint2 = await generateFingerprint(c.req.raw);
-    const ipAddress2 = getClientIp(c.req.raw);
-    const sessionId2 = await createSession(database, { sessions: schema.sessions }, newUser2.id, fingerprint2, ipAddress2);
-    logSecurityEvent("user_signup_oauth", "low", {
-      userId: newUser2.id,
-      email: newUser2.email,
-      provider
-    });
-    c.header("Set-Cookie", setSessionCookie(sessionId2, env), { append: true });
-    return c.json({
-      user: {
-        id: newUser2.id,
-        email: newUser2.email,
-        name: newUser2.name,
-        emailVerified: true
-      },
-      redirect: "/"
-    });
-  }
-  if (!password || !turnstileToken) {
-    return problems.badRequest(c, "Password and captcha are required");
-  }
   const turnstileValid = await verifyTurnstileToken(
     turnstileToken,
     env.TURNSTILE_SECRET_KEY,
@@ -3530,8 +3666,22 @@ var signupHandler = async (c) => {
   if (!turnstileValid) {
     return problems.badRequest(c, "Invalid captcha");
   }
+  const invited = await verifyInvitation(invitations, {
+    token: invitationToken,
+    email,
+    db: database,
+    env: authEnv
+  });
+  if (invitationToken && invitations && !invited && signup !== "invitation") {
+    return problems.badRequest(c, INVITATION_INVALID);
+  }
+  if (signup === "invitation" && !invited) {
+    logSecurityEvent("signup_refused_no_invitation", "medium", { email: email.toLowerCase() });
+    return problems.forbidden(c, invitationToken ? INVITATION_INVALID : INVITATION_ONLY);
+  }
+  const invitedVerified = invited !== null;
   const existingUser = await database.query.users.findFirst({
-    where: (0, import_drizzle_orm9.eq)(schema.users.email, email.toLowerCase())
+    where: (0, import_drizzle_orm10.eq)(schema.users.email, email.toLowerCase())
   });
   if (existingUser) {
     return problems.conflict(c, "Email already registered");
@@ -3541,22 +3691,6 @@ var signupHandler = async (c) => {
     return problems.badRequest(c, passwordValidation.error || "Invalid password");
   }
   const hashedPassword = await hashPassword(password, env.PASSWORD_PEPPER_V1);
-  let invitedVerified = false;
-  if (invitationToken && invitations) {
-    const match = await invitations.verify({
-      token: invitationToken,
-      email: email.toLowerCase(),
-      db: database,
-      env
-    });
-    if (!match || match.email.toLowerCase() !== email.toLowerCase()) {
-      return problems.badRequest(
-        c,
-        "This invitation is invalid, expired, or for a different email address"
-      );
-    }
-    invitedVerified = true;
-  }
   const [newUser] = await database.insert(schema.users).values({
     email: email.toLowerCase(),
     name: name || null,
@@ -3589,17 +3723,14 @@ var signupHandler = async (c) => {
       schema.users
     );
   }
-  if (invitedVerified && invitationToken && invitations?.onAccepted) {
-    try {
-      await invitations.onAccepted({
-        token: invitationToken,
-        user: { id: newUser.id, email: newUser.email, name: newUser.name },
-        db: database,
-        env
-      });
-    } catch (err) {
-      logError(err, { context: "signup_invitation_onAccepted_failed", userId: newUser.id });
-    }
+  if (invited) {
+    await acceptInvitation(invitations, {
+      token: invited,
+      user: { id: newUser.id, email: newUser.email, name: newUser.name },
+      db: database,
+      env: authEnv,
+      context: "signup_invitation_onAccepted_failed"
+    });
   }
   const fingerprint = await generateFingerprint(c.req.raw);
   const ipAddress = getClientIp(c.req.raw);
@@ -3632,24 +3763,34 @@ var signupMiddleware = [
 
 // src/routes/login.ts
 var import_zod_openapi3 = require("@hono/zod-openapi");
-var import_drizzle_orm11 = require("drizzle-orm");
+var import_drizzle_orm12 = require("drizzle-orm");
 var import_cookie2 = require("hono/cookie");
 
 // src/routes/2fa/helpers.ts
-var import_drizzle_orm10 = require("drizzle-orm");
+var import_drizzle_orm11 = require("drizzle-orm");
 async function getUserEnabled2faMethods(database, userId, user2faMethodsTable) {
   return database.select({
     method: user2faMethodsTable.method,
     isPrimary: user2faMethodsTable.isPrimary,
     totpSecret: user2faMethodsTable.totpSecret,
     lastTotpCounter: user2faMethodsTable.lastTotpCounter
-  }).from(user2faMethodsTable).where((0, import_drizzle_orm10.eq)(user2faMethodsTable.userId, userId));
+  }).from(user2faMethodsTable).where((0, import_drizzle_orm11.eq)(user2faMethodsTable.userId, userId));
 }
 function generateEmailOtp() {
   const bytes = crypto.getRandomValues(new Uint8Array(4));
   const num = (bytes[0] << 24 | bytes[1] << 16 | bytes[2] << 8 | bytes[3]) >>> 0;
   return String(num % 1e6).padStart(6, "0");
 }
+var EMAIL_CODE_TTL_SECONDS = 300;
+async function sendEmailChallengeCode(env, database, usersTable, user, emailBranding) {
+  const code = generateEmailOtp();
+  await env.OAUTH_STATES.put(`email_2fa_challenge:${user.id}`, await hashToken(code), {
+    expirationTtl: EMAIL_CODE_TTL_SECONDS
+  });
+  const emailService = new EmailService(env, void 0, emailBranding);
+  const firstName = user.name?.split(" ")[0] || null;
+  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, database, usersTable);
+}
 async function verifyAny2faCode(database, env, userId, code, method, tables2) {
   const { user2faMethods: user2faMethodsTable, userBackupCodes: userBackupCodesTable } = tables2;
   if (method === "totp") {
@@ -3667,7 +3808,7 @@ async function verifyAny2faCode(database, env, userId, code, method, tables2) {
       const secret = await decryptTotpSecret(totpMethod.totpSecret, env.TOTP_ENCRYPTION_KEY);
       const result = verifyTotpCode(secret, code, totpMethod.lastTotpCounter);
       if (result.valid) {
-        await database.update(user2faMethodsTable).set({ lastTotpCounter: result.counter }).where((0, import_drizzle_orm10.and)((0, import_drizzle_orm10.eq)(user2faMethodsTable.userId, userId), (0, import_drizzle_orm10.eq)(user2faMethodsTable.method, "totp")));
+        await database.update(user2faMethodsTable).set({ lastTotpCounter: result.counter }).where((0, import_drizzle_orm11.and)((0, import_drizzle_orm11.eq)(user2faMethodsTable.userId, userId), (0, import_drizzle_orm11.eq)(user2faMethodsTable.method, "totp")));
         return { valid: true };
       }
       return { valid: false };
@@ -3679,18 +3820,18 @@ async function verifyAny2faCode(database, env, userId, code, method, tables2) {
     const kvKey = `email_2fa_challenge:${userId}`;
     const storedHash = await env.OAUTH_STATES.get(kvKey);
     if (!storedHash) return { valid: false };
-    const codeHash = await hashToken(code);
-    if (codeHash === storedHash) {
+    const codeHash2 = await hashToken(code);
+    if (codeHash2 === storedHash) {
       await env.OAUTH_STATES.delete(kvKey);
       return { valid: true };
     }
     return { valid: false };
   }
   if (method === "backup") {
-    const backupCodes = await database.select({ id: userBackupCodesTable.id, codeHash: userBackupCodesTable.codeHash }).from(userBackupCodesTable).where((0, import_drizzle_orm10.and)((0, import_drizzle_orm10.eq)(userBackupCodesTable.userId, userId), (0, import_drizzle_orm10.isNull)(userBackupCodesTable.usedAt)));
+    const backupCodes = await database.select({ id: userBackupCodesTable.id, codeHash: userBackupCodesTable.codeHash }).from(userBackupCodesTable).where((0, import_drizzle_orm11.and)((0, import_drizzle_orm11.eq)(userBackupCodesTable.userId, userId), (0, import_drizzle_orm11.isNull)(userBackupCodesTable.usedAt)));
     for (const bc of backupCodes) {
       if (await verifyBackupCode(code, bc.codeHash)) {
-        await database.update(userBackupCodesTable).set({ usedAt: Date.now() }).where((0, import_drizzle_orm10.eq)(userBackupCodesTable.id, bc.id));
+        await database.update(userBackupCodesTable).set({ usedAt: Date.now() }).where((0, import_drizzle_orm11.eq)(userBackupCodesTable.id, bc.id));
         logSecurityEvent("2fa_backup_code_used", "medium", { userId, codeId: bc.id });
         return { valid: true };
       }
@@ -3734,7 +3875,7 @@ var loginRoute = (0, import_zod_openapi3.createRoute)({
 });
 var loginHandler = async (c) => {
   const { email, password, turnstileToken } = c.req.valid("json");
-  const { db: database, schema } = getAuthContext(c);
+  const { db: database, schema, emailBranding } = getAuthContext(c);
   const env = c.env;
   const turnstileValid = await verifyTurnstileToken(
     turnstileToken,
@@ -3746,7 +3887,7 @@ var loginHandler = async (c) => {
     return problems.badRequest(c, "Invalid captcha");
   }
   const user = await database.query.users.findFirst({
-    where: (0, import_drizzle_orm11.eq)(schema.users.email, email.toLowerCase())
+    where: (0, import_drizzle_orm12.eq)(schema.users.email, email.toLowerCase())
   });
   if (!user) {
     return problems.unauthorized(c, "Invalid email or password");
@@ -3819,6 +3960,10 @@ var loginHandler = async (c) => {
     };
     await storeChallengeToken(env.OAUTH_STATES, challengeToken, challengePayload);
     setChallengeCookie(c, env, challengeToken);
+    const emailMethod = enabled2faMethods.find((m) => m.method === "email");
+    if (emailMethod && (emailMethod.isPrimary || enabled2faMethods.length === 1)) {
+      await sendEmailChallengeCode(env, database, schema.users, user, emailBranding);
+    }
     return c.json({
       requires2fa: true,
       methods: enabled2faMethods.map((m) => m.method)
@@ -3851,7 +3996,7 @@ var loginMiddleware = [
 
 // src/routes/logout.ts
 var import_zod_openapi4 = require("@hono/zod-openapi");
-var import_drizzle_orm12 = require("drizzle-orm");
+var import_drizzle_orm13 = require("drizzle-orm");
 var logoutRoute = (0, import_zod_openapi4.createRoute)({
   method: "post",
   path: "/logout",
@@ -3874,7 +4019,7 @@ var logoutHandler = async (c) => {
     const sessionIdMatch = cookieHeader.match(cookiePattern);
     if (sessionIdMatch) {
       const sessionId = sessionIdMatch[1];
-      await database.delete(schema.sessions).where((0, import_drizzle_orm12.eq)(schema.sessions.id, sessionId));
+      await database.delete(schema.sessions).where((0, import_drizzle_orm13.eq)(schema.sessions.id, sessionId));
     }
   }
   c.header("Set-Cookie", clearSessionCookie(c.env), { append: true });
@@ -3883,7 +4028,7 @@ var logoutHandler = async (c) => {
 
 // src/routes/me.ts
 var import_zod_openapi5 = require("@hono/zod-openapi");
-var import_drizzle_orm13 = require("drizzle-orm");
+var import_drizzle_orm14 = require("drizzle-orm");
 var meRoute = (0, import_zod_openapi5.createRoute)({
   method: "get",
   path: "/me",
@@ -3911,7 +4056,7 @@ var meHandler = async (c) => {
   if (!userId) return problems.unauthorized(c, "Not authenticated");
   const { db: database, schema } = getAuthContext(c);
   const user = await database.query.users.findFirst({
-    where: (0, import_drizzle_orm13.eq)(schema.users.id, userId)
+    where: (0, import_drizzle_orm14.eq)(schema.users.id, userId)
   });
   if (!user) {
     return problems.notFound(c, "User not found");
@@ -3937,7 +4082,7 @@ var meMiddleware = [requireAuth];
 
 // src/routes/verify-email.ts
 var import_zod_openapi6 = require("@hono/zod-openapi");
-var import_drizzle_orm14 = require("drizzle-orm");
+var import_drizzle_orm15 = require("drizzle-orm");
 var verifyEmailRoute = (0, import_zod_openapi6.createRoute)({
   method: "post",
   path: "/verify-email",
@@ -3966,17 +4111,17 @@ var verifyEmailHandler = async (c) => {
   const { db: database, schema } = getAuthContext(c);
   const tokenHash = await hashToken(token);
   const verificationToken = await database.query.emailVerificationTokens.findFirst({
-    where: (0, import_drizzle_orm14.eq)(schema.emailVerificationTokens.tokenHash, tokenHash)
+    where: (0, import_drizzle_orm15.eq)(schema.emailVerificationTokens.tokenHash, tokenHash)
   });
   if (!verificationToken) {
     return problems.badRequest(c, "Invalid or expired verification token");
   }
   if (verificationToken.expiresAt < Date.now()) {
-    await database.delete(schema.emailVerificationTokens).where((0, import_drizzle_orm14.eq)(schema.emailVerificationTokens.tokenHash, tokenHash));
+    await database.delete(schema.emailVerificationTokens).where((0, import_drizzle_orm15.eq)(schema.emailVerificationTokens.tokenHash, tokenHash));
     return problems.badRequest(c, "Verification token has expired");
   }
-  await database.update(schema.users).set({ emailVerified: true }).where((0, import_drizzle_orm14.eq)(schema.users.id, verificationToken.userId));
-  await database.delete(schema.emailVerificationTokens).where((0, import_drizzle_orm14.eq)(schema.emailVerificationTokens.tokenHash, tokenHash));
+  await database.update(schema.users).set({ emailVerified: true }).where((0, import_drizzle_orm15.eq)(schema.users.id, verificationToken.userId));
+  await database.delete(schema.emailVerificationTokens).where((0, import_drizzle_orm15.eq)(schema.emailVerificationTokens.tokenHash, tokenHash));
   logSecurityEvent("email_verified", "low", { userId: verificationToken.userId });
   return c.json({ success: true, redirect: "/" });
 };
@@ -3985,18 +4130,18 @@ var verifyEmailHandler = async (c) => {
 var import_zod_openapi7 = require("@hono/zod-openapi");
 
 // src/core/password-reset.ts
-var import_drizzle_orm15 = require("drizzle-orm");
+var import_drizzle_orm16 = require("drizzle-orm");
 var TOKEN_EXPIRATION_MS = AUTH_DEFAULTS.PASSWORD_RESET_TTL_MINUTES * 60 * 1e3;
 async function createPasswordResetToken(db, tables2, email) {
   const { users, passwordResetTokens } = tables2;
-  const [user] = await db.select({ id: users.id, emailVerified: users.emailVerified }).from(users).where((0, import_drizzle_orm15.eq)(users.email, email.toLowerCase())).limit(1);
+  const [user] = await db.select({ id: users.id, emailVerified: users.emailVerified }).from(users).where((0, import_drizzle_orm16.eq)(users.email, email.toLowerCase())).limit(1);
   if (!user) {
     return null;
   }
   if (!user.emailVerified) {
     return null;
   }
-  await db.delete(passwordResetTokens).where((0, import_drizzle_orm15.eq)(passwordResetTokens.userId, user.id));
+  await db.delete(passwordResetTokens).where((0, import_drizzle_orm16.eq)(passwordResetTokens.userId, user.id));
   const token = generateSecureToken(64);
   const tokenHash = await hashToken(token);
   const expiresAt = Date.now() + TOKEN_EXPIRATION_MS;
@@ -4018,10 +4163,10 @@ async function validateResetToken(db, tables2, token) {
     used: passwordResetTokens.used,
     expiresAt: passwordResetTokens.expiresAt
   }).from(passwordResetTokens).where(
-    (0, import_drizzle_orm15.and)(
-      (0, import_drizzle_orm15.eq)(passwordResetTokens.tokenHash, tokenHash),
-      (0, import_drizzle_orm15.eq)(passwordResetTokens.used, false),
-      (0, import_drizzle_orm15.gt)(passwordResetTokens.expiresAt, Date.now())
+    (0, import_drizzle_orm16.and)(
+      (0, import_drizzle_orm16.eq)(passwordResetTokens.tokenHash, tokenHash),
+      (0, import_drizzle_orm16.eq)(passwordResetTokens.used, false),
+      (0, import_drizzle_orm16.gt)(passwordResetTokens.expiresAt, Date.now())
     )
   ).limit(1);
   if (!resetToken) {
@@ -4042,11 +4187,11 @@ async function resetPassword(db, tables2, token, newPassword, pepper, pepperKid
   await db.update(users).set({
     hashedPassword,
     pepperKid,
-    sessionVersion: import_drizzle_orm15.sql`${users.sessionVersion} + 1`
-  }).where((0, import_drizzle_orm15.eq)(users.id, userId));
+    sessionVersion: import_drizzle_orm16.sql`${users.sessionVersion} + 1`
+  }).where((0, import_drizzle_orm16.eq)(users.id, userId));
   const tokenHash = await hashToken(token);
-  await db.update(passwordResetTokens).set({ used: true }).where((0, import_drizzle_orm15.eq)(passwordResetTokens.tokenHash, tokenHash));
-  await db.delete(sessions).where((0, import_drizzle_orm15.eq)(sessions.userId, userId));
+  await db.update(passwordResetTokens).set({ used: true }).where((0, import_drizzle_orm16.eq)(passwordResetTokens.tokenHash, tokenHash));
+  await db.delete(sessions).where((0, import_drizzle_orm16.eq)(sessions.userId, userId));
   logger_default.info("Password reset successful", { userId });
   return { success: true };
 }
@@ -4194,14 +4339,14 @@ var resetPasswordMiddleware = [
 var import_zod_openapi9 = require("@hono/zod-openapi");
 
 // src/core/change-password.ts
-var import_drizzle_orm16 = require("drizzle-orm");
+var import_drizzle_orm17 = require("drizzle-orm");
 async function changePassword(params) {
   const { userId, currentPassword, newPassword, currentSessionId, pepper, db, tables: tables2 } = params;
   const { users, sessions } = tables2;
   const [user] = await db.select({
     id: users.id,
     hashedPassword: users.hashedPassword
-  }).from(users).where((0, import_drizzle_orm16.eq)(users.id, userId)).limit(1);
+  }).from(users).where((0, import_drizzle_orm17.eq)(users.id, userId)).limit(1);
   if (!user || !user.hashedPassword) {
     return { success: false, error: "User not found" };
   }
@@ -4217,8 +4362,8 @@ async function changePassword(params) {
   await db.update(users).set({
     hashedPassword: newHashedPassword,
     updatedAt: /* @__PURE__ */ new Date()
-  }).where((0, import_drizzle_orm16.eq)(users.id, userId));
-  await db.delete(sessions).where((0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(sessions.userId, userId), (0, import_drizzle_orm16.ne)(sessions.id, currentSessionId)));
+  }).where((0, import_drizzle_orm17.eq)(users.id, userId));
+  await db.delete(sessions).where((0, import_drizzle_orm17.and)((0, import_drizzle_orm17.eq)(sessions.userId, userId), (0, import_drizzle_orm17.ne)(sessions.id, currentSessionId)));
   logSecurityEvent("password_changed", "low", {
     userId
   });
@@ -4491,7 +4636,7 @@ var cancelEmailChangeHandler = async (c) => {
 // src/routes/delete-account.ts
 var import_zod_openapi17 = require("@hono/zod-openapi");
 var import_zod_openapi18 = require("@hono/zod-openapi");
-var import_drizzle_orm17 = require("drizzle-orm");
+var import_drizzle_orm18 = require("drizzle-orm");
 var deleteAccountRequestSchema = import_zod_openapi18.z.object({
   password: import_zod_openapi18.z.string().min(1).openapi({ example: "CurrentPass123!" })
 }).openapi("DeleteAccountRequest");
@@ -4539,7 +4684,7 @@ var deleteAccountHandler = async (c) => {
     const [user] = await database.select({
       id: schema.users.id,
       hashedPassword: schema.users.hashedPassword
-    }).from(schema.users).where((0, import_drizzle_orm17.eq)(schema.users.id, userId)).limit(1);
+    }).from(schema.users).where((0, import_drizzle_orm18.eq)(schema.users.id, userId)).limit(1);
     if (!user || !user.hashedPassword) {
       return problems.unauthorized(c, "Invalid credentials");
     }
@@ -4554,8 +4699,8 @@ var deleteAccountHandler = async (c) => {
     }
     const now = /* @__PURE__ */ new Date();
     const purgeAt = new Date(now.getTime() + PURGE_WINDOW_DAYS * 24 * 60 * 60 * 1e3);
-    await database.update(schema.users).set({ deletedAt: now, scheduledPurgeAt: purgeAt, updatedAt: now }).where((0, import_drizzle_orm17.eq)(schema.users.id, userId));
-    await database.delete(schema.sessions).where((0, import_drizzle_orm17.eq)(schema.sessions.userId, userId));
+    await database.update(schema.users).set({ deletedAt: now, scheduledPurgeAt: purgeAt, updatedAt: now }).where((0, import_drizzle_orm18.eq)(schema.users.id, userId));
+    await database.delete(schema.sessions).where((0, import_drizzle_orm18.eq)(schema.sessions.userId, userId));
     logSecurityEvent("account_deletion_requested", "high", { userId });
     return c.json(
       {
@@ -4576,7 +4721,7 @@ var deleteAccountMiddleware = [requireAuth];
 // src/routes/refresh.ts
 var import_zod_openapi19 = require("@hono/zod-openapi");
 var import_zod_openapi20 = require("@hono/zod-openapi");
-var import_drizzle_orm18 = require("drizzle-orm");
+var import_drizzle_orm19 = require("drizzle-orm");
 var refreshRequestSchema = import_zod_openapi20.z.object({
   refreshToken: import_zod_openapi20.z.string().min(1).openapi({ example: "abc123..." })
 }).openapi("RefreshRequest");
@@ -4616,7 +4761,7 @@ var refreshHandler = async (c) => {
     expiresAt: schema.sessions.expiresAt,
     fingerprint: schema.sessions.fingerprint,
     ipAddress: schema.sessions.ipAddress
-  }).from(schema.sessions).where((0, import_drizzle_orm18.and)((0, import_drizzle_orm18.eq)(schema.sessions.id, refreshToken), (0, import_drizzle_orm18.gt)(schema.sessions.expiresAt, Date.now()))).limit(1);
+  }).from(schema.sessions).where((0, import_drizzle_orm19.and)((0, import_drizzle_orm19.eq)(schema.sessions.id, refreshToken), (0, import_drizzle_orm19.gt)(schema.sessions.expiresAt, Date.now()))).limit(1);
   if (!session) {
     return problems.unauthorized(c, "Invalid or expired refresh token");
   }
@@ -4639,7 +4784,7 @@ var refreshMiddleware = [];
 // src/routes/resend-verification.ts
 var import_zod_openapi21 = require("@hono/zod-openapi");
 var import_zod_openapi22 = require("@hono/zod-openapi");
-var import_drizzle_orm19 = require("drizzle-orm");
+var import_drizzle_orm20 = require("drizzle-orm");
 var resendVerificationResponseSchema = import_zod_openapi22.z.object({
   success: import_zod_openapi22.z.boolean().openapi({ example: true }),
   message: import_zod_openapi22.z.string().openapi({ example: "Verification email sent" })
@@ -4684,14 +4829,14 @@ var resendVerificationHandler = async (c) => {
     email: schema.users.email,
     name: schema.users.name,
     emailVerified: schema.users.emailVerified
-  }).from(schema.users).where((0, import_drizzle_orm19.eq)(schema.users.id, userId)).limit(1);
+  }).from(schema.users).where((0, import_drizzle_orm20.eq)(schema.users.id, userId)).limit(1);
   if (!user) {
     return problems.unauthorized(c, "User not found");
   }
   if (user.emailVerified) {
     return problems.badRequest(c, "Email is already verified");
   }
-  await db.delete(schema.emailVerificationTokens).where((0, import_drizzle_orm19.eq)(schema.emailVerificationTokens.userId, userId));
+  await db.delete(schema.emailVerificationTokens).where((0, import_drizzle_orm20.eq)(schema.emailVerificationTokens.userId, userId));
   const emailToken = generateSecureToken(32);
   const tokenHash = await hashToken(emailToken);
   const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
@@ -4736,7 +4881,7 @@ var import_zod_openapi36 = require("@hono/zod-openapi");
 
 // src/routes/2fa/status.ts
 var import_zod_openapi24 = require("@hono/zod-openapi");
-var import_drizzle_orm20 = require("drizzle-orm");
+var import_drizzle_orm21 = require("drizzle-orm");
 
 // src/routes/2fa/schemas.ts
 var import_zod_openapi23 = require("@hono/zod-openapi");
@@ -4897,7 +5042,7 @@ var statusHandler = async (c) => {
   if (!userId) return problems.unauthorized(c);
   const { db, schema } = getAuthContext(c);
   const methods = await getUserEnabled2faMethods(db, userId, schema.user2faMethods);
-  const backupCodes = await db.select({ id: schema.userBackupCodes.id }).from(schema.userBackupCodes).where((0, import_drizzle_orm20.and)((0, import_drizzle_orm20.eq)(schema.userBackupCodes.userId, userId), (0, import_drizzle_orm20.isNull)(schema.userBackupCodes.usedAt)));
+  const backupCodes = await db.select({ id: schema.userBackupCodes.id }).from(schema.userBackupCodes).where((0, import_drizzle_orm21.and)((0, import_drizzle_orm21.eq)(schema.userBackupCodes.userId, userId), (0, import_drizzle_orm21.isNull)(schema.userBackupCodes.usedAt)));
   c.header("Cache-Control", "private, max-age=60");
   c.header("Vary", "Cookie");
   return c.json({
@@ -4909,7 +5054,7 @@ var statusHandler = async (c) => {
 
 // src/routes/2fa/totp-setup.ts
 var import_zod_openapi25 = require("@hono/zod-openapi");
-var import_drizzle_orm21 = require("drizzle-orm");
+var import_drizzle_orm22 = require("drizzle-orm");
 var totpSetupRoute = (0, import_zod_openapi25.createRoute)({
   method: "post",
   path: "/totp/setup",
@@ -4939,11 +5084,11 @@ var totpSetupHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c);
   const { db, schema, env } = getAuthContext(c);
-  const existing = await db.select({ id: schema.user2faMethods.id }).from(schema.user2faMethods).where((0, import_drizzle_orm21.and)((0, import_drizzle_orm21.eq)(schema.user2faMethods.userId, userId), (0, import_drizzle_orm21.eq)(schema.user2faMethods.method, "totp"))).limit(1);
+  const existing = await db.select({ id: schema.user2faMethods.id }).from(schema.user2faMethods).where((0, import_drizzle_orm22.and)((0, import_drizzle_orm22.eq)(schema.user2faMethods.userId, userId), (0, import_drizzle_orm22.eq)(schema.user2faMethods.method, "totp"))).limit(1);
   if (existing.length > 0) {
     return problems.badRequest(c, "TOTP already enabled");
   }
-  const [user] = await db.select({ email: schema.users.email }).from(schema.users).where((0, import_drizzle_orm21.eq)(schema.users.id, userId)).limit(1);
+  const [user] = await db.select({ email: schema.users.email }).from(schema.users).where((0, import_drizzle_orm22.eq)(schema.users.id, userId)).limit(1);
   if (!user) return problems.notFound(c, "User not found");
   const secret = generateTotpSecret();
   const qrCodeUri = generateQrCodeUri(secret, user.email);
@@ -4954,7 +5099,7 @@ var totpSetupHandler = async (c) => {
 
 // src/routes/2fa/totp-verify.ts
 var import_zod_openapi26 = require("@hono/zod-openapi");
-var import_drizzle_orm22 = require("drizzle-orm");
+var import_drizzle_orm23 = require("drizzle-orm");
 var totpVerifyRoute = (0, import_zod_openapi26.createRoute)({
   method: "post",
   path: "/totp/verify",
@@ -5000,7 +5145,7 @@ var totpVerifyHandler = async (c) => {
     logSecurityEvent("2fa_totp_setup_failed", "medium", { userId });
     return problems.badRequest(c, "Invalid code");
   }
-  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm22.eq)(schema.users.id, userId)).limit(1);
+  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm23.eq)(schema.users.id, userId)).limit(1);
   const encryptionKey = env.TOTP_ENCRYPTION_KEY;
   if (!encryptionKey) {
     logger_default.error("TOTP_ENCRYPTION_KEY not configured");
@@ -5048,7 +5193,7 @@ var totpVerifyHandler = async (c) => {
 
 // src/routes/2fa/totp-disable.ts
 var import_zod_openapi27 = require("@hono/zod-openapi");
-var import_drizzle_orm23 = require("drizzle-orm");
+var import_drizzle_orm24 = require("drizzle-orm");
 var totpDisableRoute = (0, import_zod_openapi27.createRoute)({
   method: "post",
   path: "/totp/disable",
@@ -5091,13 +5236,13 @@ var totpDisableHandler = async (c) => {
     logSecurityEvent("2fa_disable_failed", "medium", { userId, method: "totp" });
     return problems.badRequest(c, "Invalid verification code");
   }
-  await db.delete(schema.user2faMethods).where((0, import_drizzle_orm23.and)((0, import_drizzle_orm23.eq)(schema.user2faMethods.userId, userId), (0, import_drizzle_orm23.eq)(schema.user2faMethods.method, "totp")));
+  await db.delete(schema.user2faMethods).where((0, import_drizzle_orm24.and)((0, import_drizzle_orm24.eq)(schema.user2faMethods.userId, userId), (0, import_drizzle_orm24.eq)(schema.user2faMethods.method, "totp")));
   const remaining = await getUserEnabled2faMethods(db, userId, schema.user2faMethods);
   if (remaining.length === 0) {
-    await db.delete(schema.userBackupCodes).where((0, import_drizzle_orm23.eq)(schema.userBackupCodes.userId, userId));
-    await db.delete(schema.userTrustedDevices).where((0, import_drizzle_orm23.eq)(schema.userTrustedDevices.userId, userId));
+    await db.delete(schema.userBackupCodes).where((0, import_drizzle_orm24.eq)(schema.userBackupCodes.userId, userId));
+    await db.delete(schema.userTrustedDevices).where((0, import_drizzle_orm24.eq)(schema.userTrustedDevices.userId, userId));
     await invalidateAllUserSessions(db, { sessions: schema.sessions, users: schema.users }, userId);
-    const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm23.eq)(schema.users.id, userId)).limit(1);
+    const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm24.eq)(schema.users.id, userId)).limit(1);
     if (user) {
       const emailService = new EmailService(env, void 0, emailBranding);
       const firstName = user.name?.split(" ")[0] || null;
@@ -5116,7 +5261,7 @@ var totpDisableHandler = async (c) => {
 
 // src/routes/2fa/email-setup.ts
 var import_zod_openapi28 = require("@hono/zod-openapi");
-var import_drizzle_orm24 = require("drizzle-orm");
+var import_drizzle_orm25 = require("drizzle-orm");
 var emailSetupRoute = (0, import_zod_openapi28.createRoute)({
   method: "post",
   path: "/email/setup",
@@ -5146,15 +5291,15 @@ var emailSetupHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c);
   const { db, schema, env, emailBranding } = getAuthContext(c);
-  const existing = await db.select({ id: schema.user2faMethods.id }).from(schema.user2faMethods).where((0, import_drizzle_orm24.and)((0, import_drizzle_orm24.eq)(schema.user2faMethods.userId, userId), (0, import_drizzle_orm24.eq)(schema.user2faMethods.method, "email"))).limit(1);
+  const existing = await db.select({ id: schema.user2faMethods.id }).from(schema.user2faMethods).where((0, import_drizzle_orm25.and)((0, import_drizzle_orm25.eq)(schema.user2faMethods.userId, userId), (0, import_drizzle_orm25.eq)(schema.user2faMethods.method, "email"))).limit(1);
   if (existing.length > 0) {
     return problems.badRequest(c, "Email 2FA already enabled");
   }
-  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm24.eq)(schema.users.id, userId)).limit(1);
+  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm25.eq)(schema.users.id, userId)).limit(1);
   if (!user) return problems.notFound(c, "User not found");
   const code = generateEmailOtp();
-  const codeHash = await hashToken(code);
-  await env.OAUTH_STATES.put(`email_2fa_setup:${userId}`, codeHash, { expirationTtl: 300 });
+  const codeHash2 = await hashToken(code);
+  await env.OAUTH_STATES.put(`email_2fa_setup:${userId}`, codeHash2, { expirationTtl: 300 });
   const emailService = new EmailService(env, void 0, emailBranding);
   const firstName = user.name?.split(" ")[0] || null;
   await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
@@ -5164,7 +5309,7 @@ var emailSetupHandler = async (c) => {
 
 // src/routes/2fa/email-verify.ts
 var import_zod_openapi29 = require("@hono/zod-openapi");
-var import_drizzle_orm25 = require("drizzle-orm");
+var import_drizzle_orm26 = require("drizzle-orm");
 var emailVerifyRoute = (0, import_zod_openapi29.createRoute)({
   method: "post",
   path: "/email/verify",
@@ -5201,12 +5346,12 @@ var emailVerifyHandler = async (c) => {
   if (!storedHash) {
     return problems.badRequest(c, "Code expired. Please request a new one.");
   }
-  const codeHash = await hashToken(code);
-  if (codeHash !== storedHash) {
+  const codeHash2 = await hashToken(code);
+  if (codeHash2 !== storedHash) {
     logSecurityEvent("2fa_email_setup_failed", "medium", { userId });
     return problems.badRequest(c, "Invalid code");
   }
-  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm25.eq)(schema.users.id, userId)).limit(1);
+  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm26.eq)(schema.users.id, userId)).limit(1);
   const now = Date.now();
   const existingMethods = await getUserEnabled2faMethods(db, userId, schema.user2faMethods);
   const isFirstMethod = existingMethods.length === 0;
@@ -5248,7 +5393,7 @@ var emailVerifyHandler = async (c) => {
 
 // src/routes/2fa/email-send-code.ts
 var import_zod_openapi30 = require("@hono/zod-openapi");
-var import_drizzle_orm26 = require("drizzle-orm");
+var import_drizzle_orm27 = require("drizzle-orm");
 var emailSendCodeRoute = (0, import_zod_openapi30.createRoute)({
   method: "post",
   path: "/email/send-code",
@@ -5278,15 +5423,15 @@ var emailSendCodeHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c);
   const { db, schema, env, emailBranding } = getAuthContext(c);
-  const [emailMethod] = await db.select().from(schema.user2faMethods).where((0, import_drizzle_orm26.and)((0, import_drizzle_orm26.eq)(schema.user2faMethods.userId, userId), (0, import_drizzle_orm26.eq)(schema.user2faMethods.method, "email"))).limit(1);
+  const [emailMethod] = await db.select().from(schema.user2faMethods).where((0, import_drizzle_orm27.and)((0, import_drizzle_orm27.eq)(schema.user2faMethods.userId, userId), (0, import_drizzle_orm27.eq)(schema.user2faMethods.method, "email"))).limit(1);
   if (!emailMethod) {
     return problems.badRequest(c, "Email 2FA not enabled");
   }
-  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm26.eq)(schema.users.id, userId)).limit(1);
+  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm27.eq)(schema.users.id, userId)).limit(1);
   if (!user) return problems.notFound(c, "User not found");
   const code = generateEmailOtp();
-  const codeHash = await hashToken(code);
-  await env.OAUTH_STATES.put(`email_2fa_challenge:${userId}`, codeHash, {
+  const codeHash2 = await hashToken(code);
+  await env.OAUTH_STATES.put(`email_2fa_challenge:${userId}`, codeHash2, {
     expirationTtl: 300
   });
   const emailService = new EmailService(env, void 0, emailBranding);
@@ -5308,7 +5453,7 @@ var emailSendCodeHandler = async (c) => {
 
 // src/routes/2fa/email-disable.ts
 var import_zod_openapi31 = require("@hono/zod-openapi");
-var import_drizzle_orm27 = require("drizzle-orm");
+var import_drizzle_orm28 = require("drizzle-orm");
 var emailDisableRoute = (0, import_zod_openapi31.createRoute)({
   method: "post",
   path: "/email/disable",
@@ -5351,13 +5496,13 @@ var emailDisableHandler = async (c) => {
     logSecurityEvent("2fa_disable_failed", "medium", { userId, method: "email" });
     return problems.badRequest(c, "Invalid verification code");
   }
-  await db.delete(schema.user2faMethods).where((0, import_drizzle_orm27.and)((0, import_drizzle_orm27.eq)(schema.user2faMethods.userId, userId), (0, import_drizzle_orm27.eq)(schema.user2faMethods.method, "email")));
+  await db.delete(schema.user2faMethods).where((0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(schema.user2faMethods.userId, userId), (0, import_drizzle_orm28.eq)(schema.user2faMethods.method, "email")));
   const remaining = await getUserEnabled2faMethods(db, userId, schema.user2faMethods);
   if (remaining.length === 0) {
-    await db.delete(schema.userBackupCodes).where((0, import_drizzle_orm27.eq)(schema.userBackupCodes.userId, userId));
-    await db.delete(schema.userTrustedDevices).where((0, import_drizzle_orm27.eq)(schema.userTrustedDevices.userId, userId));
+    await db.delete(schema.userBackupCodes).where((0, import_drizzle_orm28.eq)(schema.userBackupCodes.userId, userId));
+    await db.delete(schema.userTrustedDevices).where((0, import_drizzle_orm28.eq)(schema.userTrustedDevices.userId, userId));
     await invalidateAllUserSessions(db, { sessions: schema.sessions, users: schema.users }, userId);
-    const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm27.eq)(schema.users.id, userId)).limit(1);
+    const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm28.eq)(schema.users.id, userId)).limit(1);
     if (user) {
       const emailService = new EmailService(env, void 0, emailBranding);
       const firstName = user.name?.split(" ")[0] || null;
@@ -5376,7 +5521,7 @@ var emailDisableHandler = async (c) => {
 
 // src/routes/2fa/trusted-devices.ts
 var import_zod_openapi32 = require("@hono/zod-openapi");
-var import_drizzle_orm28 = require("drizzle-orm");
+var import_drizzle_orm29 = require("drizzle-orm");
 var trustedDevicesGetRoute = (0, import_zod_openapi32.createRoute)({
   method: "get",
   path: "/trusted-devices",
@@ -5415,7 +5560,7 @@ var trustedDevicesGetHandler = async (c) => {
     ipAddress: schema.userTrustedDevices.ipAddress,
     lastUsedAt: schema.userTrustedDevices.lastUsedAt,
     createdAt: schema.userTrustedDevices.createdAt
-  }).from(schema.userTrustedDevices).where((0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(schema.userTrustedDevices.userId, userId), (0, import_drizzle_orm28.gt)(schema.userTrustedDevices.expiresAt, now)));
+  }).from(schema.userTrustedDevices).where((0, import_drizzle_orm29.and)((0, import_drizzle_orm29.eq)(schema.userTrustedDevices.userId, userId), (0, import_drizzle_orm29.gt)(schema.userTrustedDevices.expiresAt, now)));
   c.header("Cache-Control", "private, max-age=60");
   c.header("Vary", "Cookie");
   return c.json({ devices });
@@ -5451,7 +5596,7 @@ var trustedDevicesDeleteHandler = async (c) => {
   if (!userId) return problems.unauthorized(c);
   const deviceId = c.req.param("id");
   const { db, schema } = getAuthContext(c);
-  const result = await db.delete(schema.userTrustedDevices).where((0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(schema.userTrustedDevices.id, deviceId), (0, import_drizzle_orm28.eq)(schema.userTrustedDevices.userId, userId))).returning({ id: schema.userTrustedDevices.id });
+  const result = await db.delete(schema.userTrustedDevices).where((0, import_drizzle_orm29.and)((0, import_drizzle_orm29.eq)(schema.userTrustedDevices.id, deviceId), (0, import_drizzle_orm29.eq)(schema.userTrustedDevices.userId, userId))).returning({ id: schema.userTrustedDevices.id });
   if (result.length === 0) {
     return problems.notFound(c, "Device not found");
   }
@@ -5461,7 +5606,7 @@ var trustedDevicesDeleteHandler = async (c) => {
 
 // src/routes/2fa/backup-codes.ts
 var import_zod_openapi33 = require("@hono/zod-openapi");
-var import_drizzle_orm29 = require("drizzle-orm");
+var import_drizzle_orm30 = require("drizzle-orm");
 var backupCodesRegenerateRoute = (0, import_zod_openapi33.createRoute)({
   method: "post",
   path: "/backup-codes/regenerate",
@@ -5502,7 +5647,7 @@ var backupCodesRegenerateHandler = async (c) => {
     logSecurityEvent("2fa_backup_regenerate_failed", "medium", { userId });
     return problems.badRequest(c, "Invalid verification code");
   }
-  await db.delete(schema.userBackupCodes).where((0, import_drizzle_orm29.eq)(schema.userBackupCodes.userId, userId));
+  await db.delete(schema.userBackupCodes).where((0, import_drizzle_orm30.eq)(schema.userBackupCodes.userId, userId));
   const codes = generateBackupCodes();
   const now = Date.now();
   const hashedCodes = await Promise.all(
@@ -5519,7 +5664,7 @@ var backupCodesRegenerateHandler = async (c) => {
 
 // src/routes/2fa/challenge.ts
 var import_zod_openapi34 = require("@hono/zod-openapi");
-var import_drizzle_orm30 = require("drizzle-orm");
+var import_drizzle_orm31 = require("drizzle-orm");
 var import_cookie3 = require("hono/cookie");
 var challengeRoute = (0, import_zod_openapi34.createRoute)({
   method: "post",
@@ -5591,7 +5736,7 @@ var challengeHandler = async (c) => {
   }
   await deleteChallengeToken(c.env.OAUTH_STATES, challengeToken);
   clearChallengeCookie(c, c.env);
-  const [user] = await db.select().from(schema.users).where((0, import_drizzle_orm30.eq)(schema.users.id, payload.userId)).limit(1);
+  const [user] = await db.select().from(schema.users).where((0, import_drizzle_orm31.eq)(schema.users.id, payload.userId)).limit(1);
   if (!user) {
     logger_default.error("User not found during 2FA challenge", { userId: payload.userId });
     return problems.notFound(c, "User not found");
@@ -5632,7 +5777,7 @@ var challengeHandler = async (c) => {
 
 // src/routes/2fa/challenge-resend.ts
 var import_zod_openapi35 = require("@hono/zod-openapi");
-var import_drizzle_orm31 = require("drizzle-orm");
+var import_drizzle_orm32 = require("drizzle-orm");
 var import_cookie4 = require("hono/cookie");
 var challengeResendRoute = (0, import_zod_openapi35.createRoute)({
   method: "post",
@@ -5670,19 +5815,12 @@ var challengeResendHandler = async (c) => {
   if (!payload.methods.includes("email")) {
     return problems.badRequest(c, "Email verification not available");
   }
-  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm31.eq)(schema.users.id, payload.userId)).limit(1);
+  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm32.eq)(schema.users.id, payload.userId)).limit(1);
   if (!user) {
     logger_default.error("User not found during 2FA resend", { userId: payload.userId });
     return problems.notFound(c, "User not found");
   }
-  const code = generateEmailOtp();
-  const codeHash = await hashToken(code);
-  await c.env.OAUTH_STATES.put(`email_2fa_challenge:${payload.userId}`, codeHash, {
-    expirationTtl: 300
-  });
-  const emailService = new EmailService(c.env, void 0, emailBranding);
-  const firstName = user.name?.split(" ")[0] || null;
-  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
+  await sendEmailChallengeCode(c.env, db, schema.users, { id: payload.userId, ...user }, emailBranding);
   logger_default.info("Email 2FA code resent", { userId: payload.userId });
   return c.json({ success: true });
 };
@@ -5908,7 +6046,7 @@ var authorizeHandler = async (c) => {
 
 // src/routes/oauth/callback.ts
 var import_zod_openapi39 = require("@hono/zod-openapi");
-var import_drizzle_orm32 = require("drizzle-orm");
+var import_drizzle_orm33 = require("drizzle-orm");
 var callbackRoute = (0, import_zod_openapi39.createRoute)({
   method: "get",
   path: "/{provider}/callback",
@@ -6034,10 +6172,24 @@ var callbackHandler = async (c) => {
       logger_default.warn("No user ID returned from OAuth provider", { provider });
       return c.redirect(`${appUrl}/login?error=oauth_failed`);
     }
-    const { db, schema } = getAuthContext(c);
-    const [existingUser] = await db.select({ id: schema.users.id, email: schema.users.email }).from(schema.users).where((0, import_drizzle_orm32.eq)(schema.users.email, email)).limit(1);
+    const { db, schema, env, invitations, signup } = getAuthContext(c);
+    const [existingUser] = await db.select({ id: schema.users.id, email: schema.users.email }).from(schema.users).where((0, import_drizzle_orm33.eq)(schema.users.email, email)).limit(1);
     let authUser = existingUser;
     if (!authUser) {
+      const invited = await verifyInvitation(invitations, {
+        token: invitationToken,
+        email,
+        db,
+        env
+      });
+      if (signup === "invitation" && !invited) {
+        logSecurityEvent("oauth_signup_refused_no_invitation", "medium", {
+          email,
+          provider,
+          hadInvitation: !!invitationToken
+        });
+        return c.redirect(`${appUrl}/login?error=invitation_required`);
+      }
       const [createdUser] = await db.insert(schema.users).values({
         email,
         name: name || null,
@@ -6048,6 +6200,15 @@ var callbackHandler = async (c) => {
         activatedAt: /* @__PURE__ */ new Date()
       }).returning({ id: schema.users.id, email: schema.users.email });
       authUser = createdUser;
+      if (invited) {
+        await acceptInvitation(invitations, {
+          token: invited,
+          user: { id: createdUser.id, email: createdUser.email, name: name || null },
+          db,
+          env,
+          context: "oauth_invitation_onAccepted_failed"
+        });
+      }
       logSecurityEvent("user_signup_oauth", "low", {
         userId: createdUser.id,
         email: createdUser.email,
@@ -6087,7 +6248,7 @@ var callbackHandler = async (c) => {
 
 // src/routes/oauth/complete.ts
 var import_zod_openapi40 = require("@hono/zod-openapi");
-var import_drizzle_orm33 = require("drizzle-orm");
+var import_drizzle_orm34 = require("drizzle-orm");
 var completeRoute = (0, import_zod_openapi40.createRoute)({
   method: "post",
   path: "/complete",
@@ -6135,7 +6296,7 @@ var completeHandler = async (c) => {
     redirect: storedRedirect
   } = JSON.parse(stored);
   const { db, schema } = getAuthContext(c);
-  await db.update(schema.users).set({ emailVerified: true }).where((0, import_drizzle_orm33.eq)(schema.users.id, userId));
+  await db.update(schema.users).set({ emailVerified: true }).where((0, import_drizzle_orm34.eq)(schema.users.id, userId));
   await db.insert(schema.oauthAccounts).values({ userId, provider, providerUserId, email }).onConflictDoNothing();
   const fingerprint = await generateFingerprint(c.req.raw);
   const ipAddress = getClientIp(c.req.raw);
@@ -6180,19 +6341,12 @@ var routes_default = authRoutes;
 
 // src/lib/email/webhook-verifier.ts
 var import_svix = require("svix");
-function verifyWebhookSignature(payload, signature, secret) {
+function verifyWebhookSignature(payload, headers, secret) {
   if (!secret || secret.trim() === "") {
     throw new Error("Webhook secret is required");
   }
   try {
-    const wh = new import_svix.Webhook(secret);
-    wh.verify(payload, {
-      "svix-id": "",
-      // Not used by Resend
-      "svix-timestamp": "",
-      // Not used by Resend
-      "svix-signature": signature
-    });
+    new import_svix.Webhook(secret).verify(payload, { ...headers });
     return true;
   } catch (error) {
     logger_default.warn("Webhook signature verification failed", {
@@ -6208,6 +6362,8 @@ function verifyWebhookSignature(payload, signature, secret) {
   CloudflareEmailAdapter,
   EmailService,
   MAX_CHALLENGE_ATTEMPTS,
+  PASSWORDLESS_MAX_ATTEMPTS,
+  PASSWORDLESS_TTL_MS,
   ProblemTypes,
   ResendAdapter,
   SCHEMA_VERSION,
@@ -6219,6 +6375,7 @@ function verifyWebhookSignature(payload, signature, secret) {
   cancelEmailChange,
   checkAccountLocked,
   checkBreachedPassword,
+  cleanupExpiredPasswordlessChallenges,
   clearAccountLockout,
   clearChallengeCookie,
   clearSessionCookie,
@@ -6229,6 +6386,7 @@ function verifyWebhookSignature(payload, signature, secret) {
   createChallengeToken,
   createDeviceToken,
   createEmailAdapter,
+  createPasswordlessChallenge,
   createProblemDetails,
   createSession,
   csrf,
@@ -6245,6 +6403,7 @@ function verifyWebhookSignature(payload, signature, secret) {
   generate2faEnabledEmail,
   generateApiKey,
   generateBackupCodes,
+  generateCode,
   generateCodeChallenge,
   generateCodeVerifier,
   generateEmailChangeConfirmation,
@@ -6283,14 +6442,17 @@ function verifyWebhookSignature(payload, signature, secret) {
   optionalAuth,
   parseDeviceName,
   parseDeviceType,
+  passwordlessEmail,
   problemJson,
   problems,
   rateLimit,
+  recentPasswordlessFailures,
   refreshSession,
   requestEmailChange,
   requireAuth,
   requireVerifiedEmail,
   retrieveChallengeToken,
+  sessionRefreshDue,
   setChallengeCookie,
   setSessionCookie,
   setTrustedDeviceCookie,
@@ -6308,6 +6470,8 @@ function verifyWebhookSignature(payload, signature, secret) {
   verifyCodeChallenge,
   verifyPassword,
   verifyPasswordWithRotation,
+  verifyPasswordlessCode,
+  verifyPasswordlessLink,
   verifyTotpCode,
   verifyTurnstileToken,
   verifyWebhookSignature