@syncello/auth 3.6.0 → 4.0.0

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   enums,
   tableNames,
   tables
-} from "./chunk-OZ26T3ZA.js";
+} from "./chunk-W35EDOHW.js";
 
 // src/core/password.ts
 import bcrypt from "bcryptjs";
@@ -255,6 +255,8 @@ var AUTH_DEFAULTS = {
   // Absolute cap: a session dies this long after creation regardless of
   // sliding-window activity (limits the value of a stolen session token).
   SESSION_MAX_LIFETIME_DAYS: 30,
+  // The sliding window moves at most this often, so a busy session is not a write per request.
+  SESSION_REFRESH_INTERVAL_MINUTES: 15,
   LOCKOUT_DURATION_MINUTES: 30,
   LOCKOUT_MAX_ATTEMPTS: 5,
   PASSWORD_RESET_TTL_MINUTES: 15,
@@ -335,7 +337,7 @@ async function validateSession(db, tables2, sessionId, currentFingerprint, sessi
       note: "SSR requests have different User-Agent, causing expected mismatch"
     });
   }
-  await refreshSession(db, { sessions }, sessionId);
+  if (sessionRefreshDue(row.sessionLastActiveAt)) await refreshSession(db, { sessions }, sessionId);
   return {
     user: {
       id: row.userId,
@@ -354,6 +356,10 @@ async function validateSession(db, tables2, sessionId, currentFingerprint, sessi
     }
   };
 }
+function sessionRefreshDue(lastActiveAt, now = Date.now()) {
+  const interval = AUTH_DEFAULTS.SESSION_REFRESH_INTERVAL_MINUTES * 60 * 1e3;
+  return lastActiveAt === null || now - lastActiveAt >= interval;
+}
 async function refreshSession(db, tables2, sessionId, sessionTtlMs = AUTH_DEFAULTS.SESSION_TTL_DAYS * 24 * 60 * 60 * 1e3) {
   const { sessions } = tables2;
   const newExpiration = Date.now() + sessionTtlMs;
@@ -521,16 +527,16 @@ function createDeviceToken() {
   };
 }
 async function validateTrustedDevice(db, userTrustedDevicesTable, userId, tokenHash) {
-  const { eq: eq33, and: and14, gt: gt6 } = await import("drizzle-orm");
+  const { eq: eq34, and: and15, gt: gt7 } = await import("drizzle-orm");
   const [device] = await db.select().from(userTrustedDevicesTable).where(
-    and14(
-      eq33(userTrustedDevicesTable.userId, userId),
-      eq33(userTrustedDevicesTable.tokenHash, tokenHash),
-      gt6(userTrustedDevicesTable.expiresAt, Date.now())
+    and15(
+      eq34(userTrustedDevicesTable.userId, userId),
+      eq34(userTrustedDevicesTable.tokenHash, tokenHash),
+      gt7(userTrustedDevicesTable.expiresAt, Date.now())
     )
   ).limit(1);
   if (device) {
-    await db.update(userTrustedDevicesTable).set({ lastUsedAt: Date.now() }).where(eq33(userTrustedDevicesTable.id, device.id));
+    await db.update(userTrustedDevicesTable).set({ lastUsedAt: Date.now() }).where(eq34(userTrustedDevicesTable.id, device.id));
     return true;
   }
   return false;
@@ -943,582 +949,48 @@ function base64UrlEncode(data) {
   return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
-// src/middleware/auth.ts
-import { createMiddleware } from "hono/factory";
-import { eq as eq4, and as and2, gt as gt2 } from "drizzle-orm";
+// src/core/passwordless.ts
+import { and as and2, desc, eq as eq4, gt as gt2, isNull, lt, sql as sql2 } from "drizzle-orm";
 
-// src/factory.ts
-function createAuth(config) {
-  const { db, schema, getEnv, emailBranding, invitations } = config;
-  const getContext = (c) => ({
-    db,
-    schema,
-    env: getEnv(c),
-    emailBranding,
-    invitations
-  });
-  return {
-    db,
-    schema,
-    getContext
-  };
-}
-function createAuthMiddleware(auth2) {
-  return async (c, next) => {
-    const ctx = auth2.getContext(c);
-    c.set("authContext", ctx);
-    c.set("db", auth2.db);
-    await next();
-  };
-}
-function getAuthContext(c) {
-  const ctx = c.get("authContext");
-  if (!ctx) {
-    throw new Error(
-      "AuthContext not found. Did you apply createAuthMiddleware before the auth routes?"
-    );
+// src/lib/email/security.ts
+function getAllowedDomains(appUrl) {
+  const base = ["localhost", "127.0.0.1"];
+  try {
+    const url = new URL(appUrl);
+    return [...base, url.hostname];
+  } catch {
+    return base;
   }
-  return ctx;
-}
-
-// src/lib/problem-json.ts
-var ProblemTypes = {
-  // 4xx Client Errors
-  BAD_REQUEST: "/errors/bad-request",
-  UNAUTHORIZED: "/errors/unauthorized",
-  FORBIDDEN: "/errors/forbidden",
-  NOT_FOUND: "/errors/not-found",
-  CONFLICT: "/errors/conflict",
-  GONE: "/errors/gone",
-  VALIDATION_ERROR: "/errors/validation-error",
-  RATE_LIMIT_EXCEEDED: "/errors/rate-limit-exceeded",
-  // 5xx Server Errors
-  INTERNAL_ERROR: "/errors/internal-error",
-  SERVICE_UNAVAILABLE: "/errors/service-unavailable"
-};
-function generateTraceId() {
-  const bytes = crypto.getRandomValues(new Uint8Array(16));
-  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
-function createProblemDetails(type, title, status, options) {
-  const problem = {
-    type,
-    title,
-    status
-  };
-  if (options?.detail) {
-    problem.detail = options.detail;
-  }
-  if (options?.instance) {
-    problem.instance = options.instance;
+function sanitizeEmailUrl(url, appUrl = "") {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error("Invalid URL format");
   }
-  problem.traceId = options?.traceId || generateTraceId();
-  if (options?.requestId) {
-    problem.requestId = options.requestId;
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`Disallowed protocol: ${parsed.protocol}`);
   }
-  if (options?.extensions) {
-    Object.assign(problem, options.extensions);
+  const allowedDomains = getAllowedDomains(appUrl);
+  const hostname = parsed.hostname.toLowerCase();
+  const isAllowed = allowedDomains.some((domain) => {
+    return hostname === domain || hostname.endsWith(`.${domain}`);
+  });
+  if (!isAllowed) {
+    throw new Error(`Disallowed domain: ${hostname}`);
   }
-  return problem;
+  return parsed.toString();
 }
-function problemJson(c, problem) {
-  logger_default.warn("API error response", {
-    type: problem.type,
-    status: problem.status,
-    traceId: problem.traceId,
-    requestId: problem.requestId,
-    path: c.req.path,
-    method: c.req.method
-  });
-  return c.json(problem, problem.status, {
-    "Content-Type": "application/problem+json"
-  });
-}
-var problems = {
-  /**
-   * 400 Bad Request - Generic client error
-   */
-  badRequest(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.BAD_REQUEST, "Bad Request", 400, {
-        detail: detail || "The request could not be understood by the server",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  },
-  /**
-   * 400 Bad Request - Validation errors with field-specific details
-   */
-  validationError(c, detail, errors) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.VALIDATION_ERROR, "Validation Error", 400, {
-        detail,
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId"),
-        extensions: errors ? { errors } : void 0
-      })
-    );
-  },
-  /**
-   * 401 Unauthorized - Authentication required
-   */
-  unauthorized(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.UNAUTHORIZED, "Unauthorized", 401, {
-        detail: detail || "Authentication is required to access this resource",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  },
-  /**
-   * 403 Forbidden - Insufficient permissions
-   */
-  forbidden(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.FORBIDDEN, "Forbidden", 403, {
-        detail: detail || "You do not have permission to access this resource",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  },
-  /**
-   * 404 Not Found
-   */
-  notFound(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.NOT_FOUND, "Not Found", 404, {
-        detail: detail || "The requested resource was not found",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  },
-  /**
-   * 409 Conflict - Resource conflict (e.g., duplicate email)
-   */
-  conflict(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.CONFLICT, "Conflict", 409, {
-        detail,
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  },
-  /**
-   * 410 Gone - Resource is no longer available
-   */
-  gone(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.GONE, "Gone", 410, {
-        detail: detail || "The requested resource is no longer available",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  },
-  /**
-   * 429 Too Many Requests - Rate limit exceeded
-   */
-  rateLimitExceeded(c, retryAfter) {
-    const extensions = retryAfter ? { retryAfter } : void 0;
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.RATE_LIMIT_EXCEEDED, "Rate Limit Exceeded", 429, {
-        detail: retryAfter ? `Too many requests. Please retry after ${retryAfter} seconds` : "Too many requests. Please slow down",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId"),
-        extensions
-      })
-    );
-  },
-  /**
-   * 500 Internal Server Error - Generic server error
-   * SECURITY: Never include error details or stack traces
-   */
-  internalError(c, error) {
-    const traceId = c.get("traceId") || generateTraceId();
-    if (error) {
-      logError(error, {
-        context: "internal_error",
-        path: c.req.path,
-        method: c.req.method,
-        traceId,
-        requestId: c.get("requestId")
-      });
-    }
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.INTERNAL_ERROR, "Internal Server Error", 500, {
-        detail: "An unexpected error occurred. Please try again later",
-        instance: `${c.req.method} ${c.req.path}`,
-        traceId,
-        requestId: c.get("requestId")
-      })
-    );
-  },
-  /**
-   * 503 Service Unavailable - Service is temporarily unavailable
-   */
-  serviceUnavailable(c, detail) {
-    return problemJson(
-      c,
-      createProblemDetails(ProblemTypes.SERVICE_UNAVAILABLE, "Service Unavailable", 503, {
-        detail: detail || "The service is temporarily unavailable. Please try again later",
-        instance: `${c.req.method} ${c.req.path}`,
-        requestId: c.get("requestId"),
-        traceId: c.get("traceId")
-      })
-    );
-  }
-};
-
-// src/middleware/auth.ts
-var SESSION_MAX_LIFETIME_MS = AUTH_DEFAULTS.SESSION_MAX_LIFETIME_DAYS * 24 * 60 * 60 * 1e3;
-async function revokeIfPastMaxLifetime(db, sessions, sessionId, session) {
-  if (Date.now() - session.createdAt <= SESSION_MAX_LIFETIME_MS) return false;
-  logger_default.info("Session exceeded absolute lifetime - revoked", {
-    type: "security",
-    event: "session_max_lifetime_exceeded",
-    severity: "low",
-    sessionId: sessionId.slice(0, 8),
-    userId: session.userId
-  });
-  await deleteSession(db, { sessions }, sessionId);
-  return true;
-}
-async function getSessionFromCookie(db, sessions, cookieHeader, request, env) {
-  const cookieName = getSessionCookieName(env);
-  const cookiePattern = new RegExp(`${cookieName}=([^;]+)`);
-  const sessionIdMatch = cookieHeader.match(cookiePattern);
-  if (!sessionIdMatch) return null;
-  const sessionId = sessionIdMatch[1];
-  const foundSessions = await db.select({
-    userId: sessions.userId,
-    expiresAt: sessions.expiresAt,
-    createdAt: sessions.createdAt,
-    fingerprint: sessions.fingerprint
-  }).from(sessions).where(and2(eq4(sessions.id, sessionId), gt2(sessions.expiresAt, Date.now()))).limit(1);
-  if (foundSessions.length === 0) return null;
-  const session = foundSessions[0];
-  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
-  await refreshSession(db, { sessions }, sessionId);
-  const userAgent = request.headers.get("user-agent") || "";
-  const cfWorker = request.headers.get("cf-worker") || "";
-  const clientIp = request.headers.get("cf-connecting-ip") || request.headers.get("x-real-ip") || "";
-  const isLocalSSR = userAgent.toLowerCase().includes("node");
-  const isSvelteKitSSR = userAgent.toLowerCase().includes("sveltekit");
-  const isCloudflareSSR = !userAgent && cfWorker.includes(".pages.dev");
-  const isSSR = isLocalSSR || isSvelteKitSSR || isCloudflareSSR;
-  if (isSSR) {
-    logger_default.info("SSR request detected, using IP validation", {
-      type: "security",
-      event: "ssr_session_validation",
-      sessionId: sessionId.slice(0, 8),
-      userId: session.userId,
-      clientIp,
-      cfWorker,
-      isLocalSSR,
-      isSvelteKitSSR,
-      isCloudflareSSR
-    });
-  } else {
-    if (session.fingerprint) {
-      const currentFingerprint = await generateFingerprint(request);
-      if (session.fingerprint !== currentFingerprint) {
-        logger_default.info("Session fingerprint changed (not enforced)", {
-          type: "security",
-          event: "fingerprint_changed",
-          sessionId: sessionId.slice(0, 8),
-          userId: session.userId,
-          clientIp
-        });
-      }
-    }
-  }
-  return {
-    userId: session.userId,
-    expiresAt: session.expiresAt
-  };
-}
-async function getSessionFromBearerToken(db, sessions, authHeader) {
-  if (!authHeader.startsWith("Bearer ")) return null;
-  const sessionId = authHeader.slice(7);
-  const foundSessions = await db.select({
-    userId: sessions.userId,
-    expiresAt: sessions.expiresAt,
-    createdAt: sessions.createdAt
-  }).from(sessions).where(and2(eq4(sessions.id, sessionId), gt2(sessions.expiresAt, Date.now()))).limit(1);
-  if (foundSessions.length === 0) return null;
-  const session = foundSessions[0];
-  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
-  await refreshSession(db, { sessions }, sessionId);
-  return {
-    userId: session.userId,
-    expiresAt: session.expiresAt
-  };
-}
-var requireAuth = createMiddleware(
-  async (c, next) => {
-    const { db, schema } = getAuthContext(c);
-    const authHeader = c.req.header("Authorization");
-    if (authHeader) {
-      const session2 = await getSessionFromBearerToken(db, schema.sessions, authHeader);
-      if (session2) {
-        c.set("userId", session2.userId);
-        await next();
-        return;
-      }
-    }
-    const cookieHeader = c.req.header("cookie");
-    if (!cookieHeader) {
-      return problems.unauthorized(c, "Please log in to continue");
-    }
-    const session = await getSessionFromCookie(db, schema.sessions, cookieHeader, c.req.raw, c.env);
-    if (!session) {
-      c.header("Set-Cookie", clearSessionCookie(c.env));
-      return problems.unauthorized(c, "Your session has expired. Please log in again.");
-    }
-    c.set("userId", session.userId);
-    await next();
-  }
-);
-var optionalAuth = createMiddleware(
-  async (c, next) => {
-    const { db, schema } = getAuthContext(c);
-    const authHeader = c.req.header("Authorization");
-    if (authHeader) {
-      const session = await getSessionFromBearerToken(db, schema.sessions, authHeader);
-      if (session) {
-        c.set("userId", session.userId);
-        await next();
-        return;
-      }
-    }
-    const cookieHeader = c.req.header("cookie");
-    if (cookieHeader) {
-      const session = await getSessionFromCookie(db, schema.sessions, cookieHeader, c.req.raw, c.env);
-      if (session) {
-        c.set("userId", session.userId);
-      }
-    }
-    await next();
-  }
-);
-
-// src/middleware/csrf.ts
-import { createMiddleware as createMiddleware2 } from "hono/factory";
-var csrf = createMiddleware2(async (c, next) => {
-  const method = c.req.method;
-  const path = c.req.path;
-  const isWebhook = path.startsWith("/v1/webhooks/");
-  if (isWebhook) {
-    await next();
-    return;
-  }
-  const isMcpEndpoint = path === "/v1/mcp";
-  if (isMcpEndpoint) {
-    await next();
-    return;
-  }
-  const isOAuthMcpEndpoint = path.startsWith("/v1/oauth/");
-  if (isOAuthMcpEndpoint) {
-    await next();
-    return;
-  }
-  const isToolsApi = path.startsWith("/v1/tools/") && !path.startsWith("/v1/tools/catalog");
-  if (isToolsApi) {
-    await next();
-    return;
-  }
-  const isAdminApi = path.startsWith("/v1/admin/");
-  if (isAdminApi) {
-    await next();
-    return;
-  }
-  const isMobileAuthEndpoint = path === "/v1/auth/login" || path === "/v1/auth/signup" || path === "/v1/auth/refresh";
-  const authHeader = c.req.header("Authorization");
-  const hasBearerToken = authHeader?.startsWith("Bearer ");
-  const hasNoOrigin = !c.req.header("origin") && !c.req.header("referer");
-  if (isMobileAuthEndpoint && hasNoOrigin || hasBearerToken) {
-    await next();
-    return;
-  }
-  const isInternalSync = path.startsWith("/v1/internal/sync/");
-  if (isInternalSync) {
-    await next();
-    return;
-  }
-  if (["POST", "PUT", "DELETE", "PATCH"].includes(method)) {
-    const appUrl = c.env.APP_URL || "http://localhost:5173";
-    const allowedOrigins = getAllowedOrigins(appUrl);
-    const request = c.req.raw;
-    const isTestEndpoint = c.req.path.startsWith("/test");
-    if (isTestEndpoint) {
-      const origin = request.headers.get("origin");
-      const referer = request.headers.get("referer");
-      logger_default.debug("CSRF validation for test endpoint", {
-        path: c.req.path,
-        method,
-        origin,
-        referer,
-        appUrl,
-        allowedOrigins
-      });
-    }
-    const pagesPattern = c.env.CORS_PAGES_PATTERN;
-    if (!validateOrigin(request, allowedOrigins, pagesPattern)) {
-      return problems.forbidden(c, "Request blocked for security reasons. Please try again.");
-    }
-  }
-  await next();
-});
-
-// src/middleware/rateLimit.ts
-import { createMiddleware as createMiddleware3 } from "hono/factory";
-
-// src/lib/rate-limit-kv.ts
-async function checkRateLimitKV(kv, key, maxAttempts, windowSeconds) {
-  try {
-    const rateLimitKey = `rate_limit:${key}`;
-    const currentAttemptsStr = await kv.get(rateLimitKey);
-    const currentAttempts = currentAttemptsStr ? parseInt(currentAttemptsStr, 10) : 0;
-    if (currentAttempts >= maxAttempts) {
-      return {
-        allowed: false,
-        remaining: 0
-      };
-    }
-    const newAttempts = currentAttempts + 1;
-    await kv.put(rateLimitKey, newAttempts.toString(), {
-      expirationTtl: windowSeconds
-    });
-    return {
-      allowed: true,
-      remaining: maxAttempts - newAttempts
-    };
-  } catch (error) {
-    logger_default.error("Rate limit KV error, failing open", {
-      key,
-      error: error instanceof Error ? error.message : "Unknown error"
-    });
-    return {
-      allowed: true,
-      remaining: maxAttempts
-    };
-  }
-}
-
-// src/middleware/rateLimit.ts
-var rateLimit = (config) => createMiddleware3(async (c, next) => {
-  const kv = c.env.RATE_LIMIT_KV;
-  const identifier = await config.identifier(c);
-  const key = `${config.action}:${identifier}`;
-  const windowSeconds = Math.ceil(config.windowMs / 1e3);
-  const { allowed, remaining } = await checkRateLimitKV(
-    kv,
-    key,
-    config.maxAttempts,
-    windowSeconds
-  );
-  const resetTimestamp = Math.ceil(Date.now() / 1e3) + windowSeconds;
-  c.header("X-RateLimit-Limit", config.maxAttempts.toString());
-  c.header("X-RateLimit-Remaining", Math.max(0, remaining).toString());
-  c.header("X-RateLimit-Reset", resetTimestamp.toString());
-  if (!allowed) {
-    c.header("Retry-After", windowSeconds.toString());
-    return problems.rateLimitExceeded(c, windowSeconds);
-  }
-  await next();
-});
-
-// src/middleware/require-verified-email.ts
-import { createMiddleware as createMiddleware4 } from "hono/factory";
-import { eq as eq5 } from "drizzle-orm";
-var requireVerifiedEmail = createMiddleware4(
-  async (c, next) => {
-    const userId = c.get("userId");
-    if (!userId) {
-      return problems.unauthorized(c, "Not authenticated");
-    }
-    const { db, schema } = getAuthContext(c);
-    const database = db;
-    const users = schema.users;
-    const [user] = await database.select({ emailVerified: users.emailVerified }).from(users).where(eq5(users.id, userId)).limit(1);
-    if (!user || !user.emailVerified) {
-      return problems.forbidden(c, "Please verify your email address to continue");
-    }
-    await next();
-  }
-);
-
-// src/routes/index.ts
-import { OpenAPIHono as OpenAPIHono3 } from "@hono/zod-openapi";
-
-// src/routes/signup.ts
-import { createRoute } from "@hono/zod-openapi";
-import { eq as eq8 } from "drizzle-orm";
-
-// src/lib/email/email-service.ts
-import { eq as eq6 } from "drizzle-orm";
-
-// src/lib/email/security.ts
-function getAllowedDomains(appUrl) {
-  const base = ["localhost", "127.0.0.1"];
-  try {
-    const url = new URL(appUrl);
-    return [...base, url.hostname];
-  } catch {
-    return base;
-  }
-}
-function sanitizeEmailUrl(url, appUrl = "") {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error("Invalid URL format");
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`Disallowed protocol: ${parsed.protocol}`);
-  }
-  const allowedDomains = getAllowedDomains(appUrl);
-  const hostname = parsed.hostname.toLowerCase();
-  const isAllowed = allowedDomains.some((domain) => {
-    return hostname === domain || hostname.endsWith(`.${domain}`);
-  });
-  if (!isAllowed) {
-    throw new Error(`Disallowed domain: ${hostname}`);
-  }
-  return parsed.toString();
-}
-function escapeHtml(text) {
-  const htmlEscapeMap = {
-    "&": "&amp;",
-    "<": "&lt;",
-    ">": "&gt;",
-    '"': "&quot;",
-    "'": "&#39;"
-  };
-  return text.replace(/[&<>"']/g, (char) => htmlEscapeMap[char]);
+function escapeHtml(text) {
+  const htmlEscapeMap = {
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#39;"
+  };
+  return text.replace(/[&<>"']/g, (char) => htmlEscapeMap[char]);
 }
 
 // src/core/email-template.ts
@@ -1540,8 +1012,10 @@ function generateEmailTemplate(options) {
     buttonFontWeight = 500,
     buttonRadius = "6px",
     logoUrl,
-    footerColor = "#1e1b4b"
+    footerColor = "#1e1b4b",
+    headingColor = "#1e1b4b"
   } = options;
+  const safeAppName = escapeHtml(appName);
   const safeButtonUrl = buttonUrl ? sanitizeEmailUrl(buttonUrl, appUrl) : "";
   const safeAppUrl = appUrl ? sanitizeEmailUrl(appUrl, appUrl) : "";
   const safeMarketingUrl = marketingUrl ? sanitizeEmailUrl(marketingUrl, appUrl) : "";
@@ -1685,7 +1159,7 @@ function generateEmailTemplate(options) {
                                   <td class="pad" style="padding-left:40px;padding-right:40px;width:100%;">
                                     <div class="alignment" align="center">
                                       <div class="fullWidth" style="max-width: 50%;">
-                                        <img src="${safeLogoUrl}" style="display: block; height: auto; border: 0; width: 100%;" alt="${appName}" title="${appName}" height="auto">
+                                        <img src="${safeLogoUrl}" style="display: block; height: auto; border: 0; width: 100%;" alt="${safeAppName}" title="${safeAppName}" height="auto">
                                       </div>
                                     </div>
                                   </td>
@@ -1697,7 +1171,7 @@ function generateEmailTemplate(options) {
                               <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
                                 <tr>
                                   <td class="pad" style="padding-top:30px;padding-left:40px;padding-right:40px;">
-                                    <div style="color:#1e1b4b;font-family:'Montserrat',Arial,sans-serif;font-size:22px;font-weight:600;line-height:1.4;text-align:center;mso-line-height-alt:31px;">
+                                    <div style="color:${headingColor};font-family:'Montserrat',Arial,sans-serif;font-size:22px;font-weight:600;line-height:1.4;text-align:center;mso-line-height-alt:31px;">
                                       <p style="margin: 0; word-break: break-word;">${welcomeMessage}</p>
                                     </div>
                                   </td>
@@ -1710,7 +1184,7 @@ function generateEmailTemplate(options) {
                               <table class="paragraph_block block-4" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
                                 <tr>
                                   <td class="pad" style="padding-bottom:10px;padding-left:40px;padding-right:40px;padding-top:10px;">
-                                    <div style="color:#1e1b4b;font-family:'Montserrat',Arial,sans-serif;font-size:30px;font-weight:700;line-height:1.2;text-align:center;mso-line-height-alt:36px;">
+                                    <div style="color:${headingColor};font-family:'Montserrat',Arial,sans-serif;font-size:30px;font-weight:700;line-height:1.2;text-align:center;mso-line-height-alt:36px;">
                                       <p style="margin: 0; word-break: break-word;">${heading}</p>
                                     </div>
                                   </td>
@@ -1766,122 +1240,785 @@ function generateEmailTemplate(options) {
                                   </td>
                                 </tr>
                               </table>
-                              ` : ""}
+                              ` : ""}
+
+                              ${securityWarning ? `
+                              <!-- Security Warning -->
+                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
+                                <tr>
+                                  <td class="pad" style="padding-left:40px;padding-right:40px;padding-bottom:20px;">
+                                    <div style="background-color: #a1f1ff; border-radius: 8px; padding: 16px; display: flex; align-items: center; justify-content: center;">
+                                      <p style="margin: 0; color: #01001b; font-family: 'Montserrat', Arial, sans-serif; font-size: 13px; line-height: 1.5; text-align: center;">
+                                        ${securityWarning}
+                                      </p>
+                                    </div>
+                                  </td>
+                                </tr>
+                              </table>
+                              ` : ""}
+
+                              <!-- Footer Note -->
+                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
+                                <tr>
+                                  <td class="pad" style="padding-bottom:30px;padding-left:40px;padding-right:40px;">
+                                    <div style="color:#737373;font-family:'Montserrat',Arial,sans-serif;font-size:13px;line-height:1.5;text-align:center;mso-line-height-alt:20px;">
+                                      <p style="margin: 0; word-break: break-word;">${footerNote}</p>
+                                    </div>
+                                  </td>
+                                </tr>
+                              </table>
+
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </tbody>
+              </table>
+
+              <!-- Spacer Row -->
+              <table class="row row-2" align="center" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt;">
+                <tbody>
+                  <tr>
+                    <td>
+                      <table class="row-content stack" align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f8f9fa; color: #000000; max-width: 640px; width: 100%; margin: 0 auto;">
+                        <tbody>
+                          <tr>
+                            <td class="column column-1" width="100%" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; padding-bottom: 5px; vertical-align: top;">
+                              <table class="empty_block block-1" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt;">
+                                <tr>
+                                  <td class="pad">
+                                    <div></div>
+                                  </td>
+                                </tr>
+                              </table>
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </tbody>
+              </table>
+
+              <!-- Footer Row -->
+              <table class="row row-3" align="center" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt;">
+                <tbody>
+                  <tr>
+                    <td>
+                      <table class="row-content stack" align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: ${footerColor}; color: #000000; max-width: 640px; width: 100%; margin: 0 auto;">
+                        <tbody>
+                          <tr>
+                            <td class="column column-1" width="100%" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; vertical-align: top; padding: 20px;">
+
+                              <!-- Policy Links -->
+                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
+                                <tr>
+                                  <td class="pad" style="padding-bottom:20px;padding-left:40px;padding-right:40px;padding-top:20px;">
+                                    <div style="color:#ffffff;font-family:'Montserrat',Arial,sans-serif;font-size:13px;line-height:1.5;text-align:center;mso-line-height-alt:20px;">
+                                      <p style="margin: 0; word-break: break-word;">
+                                        <a href="${safeMarketingUrl}/privacy" style="color: #ffffff; text-decoration: underline;">Privacy Policy</a> | <a href="${safeMarketingUrl}/contact" style="color: #ffffff; text-decoration: underline;">Get in Touch</a>
+                                      </p>
+                                    </div>
+                                  </td>
+                                </tr>
+                              </table>
+
+                              <!-- Copyright & Disclaimer -->
+                              <table class="paragraph_block block-1" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
+                                <tr>
+                                  <td class="pad" style="padding-bottom:15px;padding-left:40px;padding-right:40px;">
+                                    <div style="color:#a3a3a3;font-family:'Montserrat',Arial,sans-serif;font-size:12px;line-height:1.5;text-align:center;mso-line-height-alt:18px;">
+                                      <p style="margin: 0 0 12px 0; word-break: break-word;">\xA9 ${(/* @__PURE__ */ new Date()).getFullYear()} ${safeAppName}. All rights reserved.</p>
+                                      <p style="margin: 0; font-size: 11px; line-height: 1.5; word-break: break-word;">
+                                        Please do not reply to this email as this address does not accept incoming messages. This service email contains essential information relating to your ${safeAppName} account.
+                                      </p>
+                                    </div>
+                                  </td>
+                                </tr>
+                              </table>
+
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </tbody>
+              </table>
+
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </body>
+    </html>
+  `;
+}
+
+// src/core/passwordless.ts
+var PASSWORDLESS_TTL_MS = 10 * 60 * 1e3;
+var PASSWORDLESS_MAX_ATTEMPTS = 5;
+var CODE_SPACE = 1e6;
+var CODE_LIMIT = Math.floor(4294967296 / CODE_SPACE) * CODE_SPACE;
+var CLEANUP_GRACE_MS = 24 * 60 * 60 * 1e3;
+var normalizeEmail = (email) => email.trim().toLowerCase();
+function generateCode() {
+  const buffer = new Uint32Array(1);
+  for (; ; ) {
+    crypto.getRandomValues(buffer);
+    if (buffer[0] < CODE_LIMIT) return String(buffer[0] % CODE_SPACE).padStart(6, "0");
+  }
+}
+var codeHash = (challengeId, code) => hashToken(`${challengeId}:${code}`);
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+async function consumeOpen(db, t, email, now) {
+  await db.update(t).set({ consumedAt: now }).where(and2(eq4(t.email, email), isNull(t.consumedAt)));
+}
+async function createPasswordlessChallenge(db, tables2, input) {
+  const t = tables2.passwordlessChallenges;
+  const email = normalizeEmail(input.email);
+  const now = Date.now();
+  const challengeId = crypto.randomUUID();
+  const linkToken = generateSecureToken(32);
+  const browserSecret = generateSecureToken(32);
+  const code = generateCode();
+  await consumeOpen(db, t, email, now);
+  await db.insert(t).values({
+    id: challengeId,
+    email,
+    subjectId: input.subjectId ?? null,
+    linkTokenHash: await hashToken(linkToken),
+    codeHash: await codeHash(challengeId, code),
+    browserHash: await hashToken(browserSecret),
+    attempts: 0,
+    payload: input.payload ?? null,
+    expiresAt: now + (input.ttlMs ?? PASSWORDLESS_TTL_MS),
+    createdAt: now
+  });
+  return { challengeId, linkToken, code, browserSecret };
+}
+async function verifyPasswordlessLink(db, tables2, input) {
+  const t = tables2.passwordlessChallenges;
+  const now = Date.now();
+  const hash = await hashToken(input.linkToken);
+  const [row] = await db.update(t).set({ consumedAt: now }).where(and2(eq4(t.linkTokenHash, hash), isNull(t.consumedAt), gt2(t.expiresAt, now))).returning();
+  if (!row) {
+    const [stale] = await db.select({ expiresAt: t.expiresAt, consumedAt: t.consumedAt }).from(t).where(eq4(t.linkTokenHash, hash)).limit(1);
+    const expired = stale && stale.consumedAt === null && stale.expiresAt <= now;
+    return { ok: false, reason: expired ? "expired" : "invalid" };
+  }
+  await consumeOpen(db, t, row.email, now);
+  return { ok: true, email: row.email, subjectId: row.subjectId, payload: row.payload };
+}
+async function verifyPasswordlessCode(db, tables2, input) {
+  const t = tables2.passwordlessChallenges;
+  const max = input.maxAttempts ?? PASSWORDLESS_MAX_ATTEMPTS;
+  const email = normalizeEmail(input.email);
+  const now = Date.now();
+  const [row] = await db.select().from(t).where(and2(eq4(t.email, email), isNull(t.consumedAt))).orderBy(desc(t.createdAt)).limit(1);
+  if (!row) return { ok: false, reason: "invalid" };
+  if (!constantTimeEqual(row.browserHash, await hashToken(input.browserSecret))) {
+    return { ok: false, reason: "invalid" };
+  }
+  if (row.expiresAt <= now) return { ok: false, reason: "expired" };
+  if (row.attempts >= max) return { ok: false, reason: "locked" };
+  if (!constantTimeEqual(row.codeHash, await codeHash(row.id, input.code.trim()))) {
+    const [counted] = await db.update(t).set({ attempts: sql2`${t.attempts} + 1` }).where(and2(eq4(t.id, row.id), lt(t.attempts, max))).returning({ attempts: t.attempts });
+    return { ok: false, reason: counted && counted.attempts < max ? "invalid" : "locked" };
+  }
+  const [won] = await db.update(t).set({ consumedAt: now }).where(and2(eq4(t.id, row.id), isNull(t.consumedAt), lt(t.attempts, max))).returning();
+  if (!won) return { ok: false, reason: "invalid" };
+  await consumeOpen(db, t, email, now);
+  return { ok: true, email, subjectId: won.subjectId, payload: won.payload };
+}
+async function recentPasswordlessFailures(db, tables2, input) {
+  const t = tables2.passwordlessChallenges;
+  const [row] = await db.select({ total: sql2`coalesce(sum(${t.attempts}), 0)::int` }).from(t).where(and2(eq4(t.email, normalizeEmail(input.email)), gt2(t.createdAt, Date.now() - input.windowMs)));
+  return Number(row?.total ?? 0);
+}
+async function cleanupExpiredPasswordlessChallenges(db, tables2) {
+  const t = tables2.passwordlessChallenges;
+  await db.delete(t).where(lt(t.expiresAt, Date.now() - CLEANUP_GRACE_MS));
+}
+function passwordlessEmail(input) {
+  const { appName, appUrl, linkUrl, code } = input;
+  const minutes = Math.max(1, Math.round((input.ttlMs ?? PASSWORDLESS_TTL_MS) / 6e4));
+  const lifetime = `${minutes} ${minutes === 1 ? "minute" : "minutes"}`;
+  const safeLink = sanitizeEmailUrl(linkUrl, appUrl);
+  const html = generateEmailTemplate({
+    heading: `Sign in to ${escapeHtml(appName)}`,
+    body: `<p>Use this code, or the button below, to sign in:</p>
+			<p style="font-size: 32px; font-weight: bold; letter-spacing: 4px; text-align: center; margin: 24px 0; font-family: monospace;">${escapeHtml(code)}</p>
+			<p>The code and the link expire in ${lifetime}.</p>`,
+    buttonText: "Sign in",
+    buttonUrl: safeLink,
+    footerNote: "If you didn't ask to sign in, you can ignore this email.",
+    appUrl,
+    appName
+  });
+  return {
+    subject: `${code} is your sign-in code`,
+    html,
+    text: `Your ${appName} sign-in code is ${code}.
+
+Or sign in with this link:
+${safeLink}
+
+The code and the link expire in ${lifetime}.
+
+If you didn't ask to sign in, you can ignore this email.`
+  };
+}
+
+// src/middleware/auth.ts
+import { createMiddleware } from "hono/factory";
+import { eq as eq5, and as and3, gt as gt3 } from "drizzle-orm";
+
+// src/factory.ts
+function createAuth(config) {
+  const { db, schema, getEnv, emailBranding, invitations, signup = "open" } = config;
+  if (signup === "invitation" && !invitations) {
+    throw new Error("createAuth: signup: 'invitation' requires the invitations hooks");
+  }
+  const getContext = (c) => ({
+    db,
+    schema,
+    env: getEnv(c),
+    emailBranding,
+    invitations,
+    signup
+  });
+  return {
+    db,
+    schema,
+    getContext
+  };
+}
+function createAuthMiddleware(auth2) {
+  return async (c, next) => {
+    const ctx = auth2.getContext(c);
+    c.set("authContext", ctx);
+    c.set("db", auth2.db);
+    await next();
+  };
+}
+function getAuthContext(c) {
+  const ctx = c.get("authContext");
+  if (!ctx) {
+    throw new Error(
+      "AuthContext not found. Did you apply createAuthMiddleware before the auth routes?"
+    );
+  }
+  return ctx;
+}
+
+// src/lib/problem-json.ts
+var ProblemTypes = {
+  // 4xx Client Errors
+  BAD_REQUEST: "/errors/bad-request",
+  UNAUTHORIZED: "/errors/unauthorized",
+  FORBIDDEN: "/errors/forbidden",
+  NOT_FOUND: "/errors/not-found",
+  CONFLICT: "/errors/conflict",
+  GONE: "/errors/gone",
+  VALIDATION_ERROR: "/errors/validation-error",
+  RATE_LIMIT_EXCEEDED: "/errors/rate-limit-exceeded",
+  // 5xx Server Errors
+  INTERNAL_ERROR: "/errors/internal-error",
+  SERVICE_UNAVAILABLE: "/errors/service-unavailable"
+};
+function generateTraceId() {
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function createProblemDetails(type, title, status, options) {
+  const problem = {
+    type,
+    title,
+    status
+  };
+  if (options?.detail) {
+    problem.detail = options.detail;
+  }
+  if (options?.instance) {
+    problem.instance = options.instance;
+  }
+  problem.traceId = options?.traceId || generateTraceId();
+  if (options?.requestId) {
+    problem.requestId = options.requestId;
+  }
+  if (options?.extensions) {
+    Object.assign(problem, options.extensions);
+  }
+  return problem;
+}
+function problemJson(c, problem) {
+  logger_default.warn("API error response", {
+    type: problem.type,
+    status: problem.status,
+    traceId: problem.traceId,
+    requestId: problem.requestId,
+    path: c.req.path,
+    method: c.req.method
+  });
+  return c.json(problem, problem.status, {
+    "Content-Type": "application/problem+json"
+  });
+}
+var problems = {
+  /**
+   * 400 Bad Request - Generic client error
+   */
+  badRequest(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.BAD_REQUEST, "Bad Request", 400, {
+        detail: detail || "The request could not be understood by the server",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  },
+  /**
+   * 400 Bad Request - Validation errors with field-specific details
+   */
+  validationError(c, detail, errors) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.VALIDATION_ERROR, "Validation Error", 400, {
+        detail,
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId"),
+        extensions: errors ? { errors } : void 0
+      })
+    );
+  },
+  /**
+   * 401 Unauthorized - Authentication required
+   */
+  unauthorized(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.UNAUTHORIZED, "Unauthorized", 401, {
+        detail: detail || "Authentication is required to access this resource",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  },
+  /**
+   * 403 Forbidden - Insufficient permissions
+   */
+  forbidden(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.FORBIDDEN, "Forbidden", 403, {
+        detail: detail || "You do not have permission to access this resource",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  },
+  /**
+   * 404 Not Found
+   */
+  notFound(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.NOT_FOUND, "Not Found", 404, {
+        detail: detail || "The requested resource was not found",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  },
+  /**
+   * 409 Conflict - Resource conflict (e.g., duplicate email)
+   */
+  conflict(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.CONFLICT, "Conflict", 409, {
+        detail,
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  },
+  /**
+   * 410 Gone - Resource is no longer available
+   */
+  gone(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.GONE, "Gone", 410, {
+        detail: detail || "The requested resource is no longer available",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  },
+  /**
+   * 429 Too Many Requests - Rate limit exceeded
+   */
+  rateLimitExceeded(c, retryAfter) {
+    const extensions = retryAfter ? { retryAfter } : void 0;
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.RATE_LIMIT_EXCEEDED, "Rate Limit Exceeded", 429, {
+        detail: retryAfter ? `Too many requests. Please retry after ${retryAfter} seconds` : "Too many requests. Please slow down",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId"),
+        extensions
+      })
+    );
+  },
+  /**
+   * 500 Internal Server Error - Generic server error
+   * SECURITY: Never include error details or stack traces
+   */
+  internalError(c, error) {
+    const traceId = c.get("traceId") || generateTraceId();
+    if (error) {
+      logError(error, {
+        context: "internal_error",
+        path: c.req.path,
+        method: c.req.method,
+        traceId,
+        requestId: c.get("requestId")
+      });
+    }
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.INTERNAL_ERROR, "Internal Server Error", 500, {
+        detail: "An unexpected error occurred. Please try again later",
+        instance: `${c.req.method} ${c.req.path}`,
+        traceId,
+        requestId: c.get("requestId")
+      })
+    );
+  },
+  /**
+   * 503 Service Unavailable - Service is temporarily unavailable
+   */
+  serviceUnavailable(c, detail) {
+    return problemJson(
+      c,
+      createProblemDetails(ProblemTypes.SERVICE_UNAVAILABLE, "Service Unavailable", 503, {
+        detail: detail || "The service is temporarily unavailable. Please try again later",
+        instance: `${c.req.method} ${c.req.path}`,
+        requestId: c.get("requestId"),
+        traceId: c.get("traceId")
+      })
+    );
+  }
+};
 
-                              ${securityWarning ? `
-                              <!-- Security Warning -->
-                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
-                                <tr>
-                                  <td class="pad" style="padding-left:40px;padding-right:40px;padding-bottom:20px;">
-                                    <div style="background-color: #a1f1ff; border-radius: 8px; padding: 16px; display: flex; align-items: center; justify-content: center;">
-                                      <p style="margin: 0; color: #01001b; font-family: 'Montserrat', Arial, sans-serif; font-size: 13px; line-height: 1.5; text-align: center;">
-                                        ${securityWarning}
-                                      </p>
-                                    </div>
-                                  </td>
-                                </tr>
-                              </table>
-                              ` : ""}
+// src/middleware/auth.ts
+var SESSION_MAX_LIFETIME_MS = AUTH_DEFAULTS.SESSION_MAX_LIFETIME_DAYS * 24 * 60 * 60 * 1e3;
+async function revokeIfPastMaxLifetime(db, sessions, sessionId, session) {
+  if (Date.now() - session.createdAt <= SESSION_MAX_LIFETIME_MS) return false;
+  logger_default.info("Session exceeded absolute lifetime - revoked", {
+    type: "security",
+    event: "session_max_lifetime_exceeded",
+    severity: "low",
+    sessionId: sessionId.slice(0, 8),
+    userId: session.userId
+  });
+  await deleteSession(db, { sessions }, sessionId);
+  return true;
+}
+async function getSessionFromCookie(db, sessions, cookieHeader, request, env) {
+  const cookieName = getSessionCookieName(env);
+  const cookiePattern = new RegExp(`${cookieName}=([^;]+)`);
+  const sessionIdMatch = cookieHeader.match(cookiePattern);
+  if (!sessionIdMatch) return null;
+  const sessionId = sessionIdMatch[1];
+  const foundSessions = await db.select({
+    userId: sessions.userId,
+    expiresAt: sessions.expiresAt,
+    createdAt: sessions.createdAt,
+    lastActiveAt: sessions.lastActiveAt,
+    fingerprint: sessions.fingerprint
+  }).from(sessions).where(and3(eq5(sessions.id, sessionId), gt3(sessions.expiresAt, Date.now()))).limit(1);
+  if (foundSessions.length === 0) return null;
+  const session = foundSessions[0];
+  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
+  if (sessionRefreshDue(session.lastActiveAt)) await refreshSession(db, { sessions }, sessionId);
+  const userAgent = request.headers.get("user-agent") || "";
+  const cfWorker = request.headers.get("cf-worker") || "";
+  const clientIp = request.headers.get("cf-connecting-ip") || request.headers.get("x-real-ip") || "";
+  const isLocalSSR = userAgent.toLowerCase().includes("node");
+  const isSvelteKitSSR = userAgent.toLowerCase().includes("sveltekit");
+  const isCloudflareSSR = !userAgent && cfWorker.includes(".pages.dev");
+  const isSSR = isLocalSSR || isSvelteKitSSR || isCloudflareSSR;
+  if (isSSR) {
+    logger_default.info("SSR request detected, using IP validation", {
+      type: "security",
+      event: "ssr_session_validation",
+      sessionId: sessionId.slice(0, 8),
+      userId: session.userId,
+      clientIp,
+      cfWorker,
+      isLocalSSR,
+      isSvelteKitSSR,
+      isCloudflareSSR
+    });
+  } else {
+    if (session.fingerprint) {
+      const currentFingerprint = await generateFingerprint(request);
+      if (session.fingerprint !== currentFingerprint) {
+        logger_default.info("Session fingerprint changed (not enforced)", {
+          type: "security",
+          event: "fingerprint_changed",
+          sessionId: sessionId.slice(0, 8),
+          userId: session.userId,
+          clientIp
+        });
+      }
+    }
+  }
+  return {
+    userId: session.userId,
+    expiresAt: session.expiresAt
+  };
+}
+async function getSessionFromBearerToken(db, sessions, authHeader) {
+  if (!authHeader.startsWith("Bearer ")) return null;
+  const sessionId = authHeader.slice(7);
+  const foundSessions = await db.select({
+    userId: sessions.userId,
+    expiresAt: sessions.expiresAt,
+    createdAt: sessions.createdAt,
+    lastActiveAt: sessions.lastActiveAt
+  }).from(sessions).where(and3(eq5(sessions.id, sessionId), gt3(sessions.expiresAt, Date.now()))).limit(1);
+  if (foundSessions.length === 0) return null;
+  const session = foundSessions[0];
+  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
+  if (sessionRefreshDue(session.lastActiveAt)) await refreshSession(db, { sessions }, sessionId);
+  return {
+    userId: session.userId,
+    expiresAt: session.expiresAt
+  };
+}
+var requireAuth = createMiddleware(
+  async (c, next) => {
+    const { db, schema } = getAuthContext(c);
+    const authHeader = c.req.header("Authorization");
+    if (authHeader) {
+      const session2 = await getSessionFromBearerToken(db, schema.sessions, authHeader);
+      if (session2) {
+        c.set("userId", session2.userId);
+        await next();
+        return;
+      }
+    }
+    const cookieHeader = c.req.header("cookie");
+    if (!cookieHeader) {
+      return problems.unauthorized(c, "Please log in to continue");
+    }
+    const session = await getSessionFromCookie(db, schema.sessions, cookieHeader, c.req.raw, c.env);
+    if (!session) {
+      c.header("Set-Cookie", clearSessionCookie(c.env));
+      return problems.unauthorized(c, "Your session has expired. Please log in again.");
+    }
+    c.set("userId", session.userId);
+    await next();
+  }
+);
+var optionalAuth = createMiddleware(
+  async (c, next) => {
+    const { db, schema } = getAuthContext(c);
+    const authHeader = c.req.header("Authorization");
+    if (authHeader) {
+      const session = await getSessionFromBearerToken(db, schema.sessions, authHeader);
+      if (session) {
+        c.set("userId", session.userId);
+        await next();
+        return;
+      }
+    }
+    const cookieHeader = c.req.header("cookie");
+    if (cookieHeader) {
+      const session = await getSessionFromCookie(db, schema.sessions, cookieHeader, c.req.raw, c.env);
+      if (session) {
+        c.set("userId", session.userId);
+      }
+    }
+    await next();
+  }
+);
 
-                              <!-- Footer Note -->
-                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
-                                <tr>
-                                  <td class="pad" style="padding-bottom:30px;padding-left:40px;padding-right:40px;">
-                                    <div style="color:#737373;font-family:'Montserrat',Arial,sans-serif;font-size:13px;line-height:1.5;text-align:center;mso-line-height-alt:20px;">
-                                      <p style="margin: 0; word-break: break-word;">${footerNote}</p>
-                                    </div>
-                                  </td>
-                                </tr>
-                              </table>
+// src/middleware/csrf.ts
+import { createMiddleware as createMiddleware2 } from "hono/factory";
+var csrf = createMiddleware2(async (c, next) => {
+  const method = c.req.method;
+  const path = c.req.path;
+  const isWebhook = path.startsWith("/v1/webhooks/");
+  if (isWebhook) {
+    await next();
+    return;
+  }
+  const isMcpEndpoint = path === "/v1/mcp";
+  if (isMcpEndpoint) {
+    await next();
+    return;
+  }
+  const isOAuthMcpEndpoint = path.startsWith("/v1/oauth/");
+  if (isOAuthMcpEndpoint) {
+    await next();
+    return;
+  }
+  const isToolsApi = path.startsWith("/v1/tools/") && !path.startsWith("/v1/tools/catalog");
+  if (isToolsApi) {
+    await next();
+    return;
+  }
+  const isAdminApi = path.startsWith("/v1/admin/");
+  if (isAdminApi) {
+    await next();
+    return;
+  }
+  const isMobileAuthEndpoint = path === "/v1/auth/login" || path === "/v1/auth/signup" || path === "/v1/auth/refresh";
+  const authHeader = c.req.header("Authorization");
+  const hasBearerToken = authHeader?.startsWith("Bearer ");
+  const hasNoOrigin = !c.req.header("origin") && !c.req.header("referer");
+  if (isMobileAuthEndpoint && hasNoOrigin || hasBearerToken) {
+    await next();
+    return;
+  }
+  const isInternalSync = path.startsWith("/v1/internal/sync/");
+  if (isInternalSync) {
+    await next();
+    return;
+  }
+  if (["POST", "PUT", "DELETE", "PATCH"].includes(method)) {
+    const appUrl = c.env.APP_URL || "http://localhost:5173";
+    const allowedOrigins = getAllowedOrigins(appUrl);
+    const request = c.req.raw;
+    const isTestEndpoint = c.req.path.startsWith("/test");
+    if (isTestEndpoint) {
+      const origin = request.headers.get("origin");
+      const referer = request.headers.get("referer");
+      logger_default.debug("CSRF validation for test endpoint", {
+        path: c.req.path,
+        method,
+        origin,
+        referer,
+        appUrl,
+        allowedOrigins
+      });
+    }
+    const pagesPattern = c.env.CORS_PAGES_PATTERN;
+    if (!validateOrigin(request, allowedOrigins, pagesPattern)) {
+      return problems.forbidden(c, "Request blocked for security reasons. Please try again.");
+    }
+  }
+  await next();
+});
 
-                            </td>
-                          </tr>
-                        </tbody>
-                      </table>
-                    </td>
-                  </tr>
-                </tbody>
-              </table>
+// src/middleware/rateLimit.ts
+import { createMiddleware as createMiddleware3 } from "hono/factory";
 
-              <!-- Spacer Row -->
-              <table class="row row-2" align="center" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt;">
-                <tbody>
-                  <tr>
-                    <td>
-                      <table class="row-content stack" align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f8f9fa; color: #000000; max-width: 640px; width: 100%; margin: 0 auto;">
-                        <tbody>
-                          <tr>
-                            <td class="column column-1" width="100%" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; padding-bottom: 5px; vertical-align: top;">
-                              <table class="empty_block block-1" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt;">
-                                <tr>
-                                  <td class="pad">
-                                    <div></div>
-                                  </td>
-                                </tr>
-                              </table>
-                            </td>
-                          </tr>
-                        </tbody>
-                      </table>
-                    </td>
-                  </tr>
-                </tbody>
-              </table>
+// src/lib/rate-limit-kv.ts
+async function checkRateLimitKV(kv, key, maxAttempts, windowSeconds) {
+  try {
+    const rateLimitKey = `rate_limit:${key}`;
+    const currentAttemptsStr = await kv.get(rateLimitKey);
+    const currentAttempts = currentAttemptsStr ? parseInt(currentAttemptsStr, 10) : 0;
+    if (currentAttempts >= maxAttempts) {
+      return {
+        allowed: false,
+        remaining: 0
+      };
+    }
+    const newAttempts = currentAttempts + 1;
+    await kv.put(rateLimitKey, newAttempts.toString(), {
+      expirationTtl: windowSeconds
+    });
+    return {
+      allowed: true,
+      remaining: maxAttempts - newAttempts
+    };
+  } catch (error) {
+    logger_default.error("Rate limit KV error, failing open", {
+      key,
+      error: error instanceof Error ? error.message : "Unknown error"
+    });
+    return {
+      allowed: true,
+      remaining: maxAttempts
+    };
+  }
+}
 
-              <!-- Footer Row -->
-              <table class="row row-3" align="center" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt;">
-                <tbody>
-                  <tr>
-                    <td>
-                      <table class="row-content stack" align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: ${footerColor}; color: #000000; max-width: 640px; width: 100%; margin: 0 auto;">
-                        <tbody>
-                          <tr>
-                            <td class="column column-1" width="100%" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; vertical-align: top; padding: 20px;">
+// src/middleware/rateLimit.ts
+var rateLimit = (config) => createMiddleware3(async (c, next) => {
+  const kv = c.env.RATE_LIMIT_KV;
+  const identifier = await config.identifier(c);
+  const key = `${config.action}:${identifier}`;
+  const windowSeconds = Math.ceil(config.windowMs / 1e3);
+  const { allowed, remaining } = await checkRateLimitKV(
+    kv,
+    key,
+    config.maxAttempts,
+    windowSeconds
+  );
+  const resetTimestamp = Math.ceil(Date.now() / 1e3) + windowSeconds;
+  c.header("X-RateLimit-Limit", config.maxAttempts.toString());
+  c.header("X-RateLimit-Remaining", Math.max(0, remaining).toString());
+  c.header("X-RateLimit-Reset", resetTimestamp.toString());
+  if (!allowed) {
+    c.header("Retry-After", windowSeconds.toString());
+    return problems.rateLimitExceeded(c, windowSeconds);
+  }
+  await next();
+});
 
-                              <!-- Policy Links -->
-                              <table class="paragraph_block" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
-                                <tr>
-                                  <td class="pad" style="padding-bottom:20px;padding-left:40px;padding-right:40px;padding-top:20px;">
-                                    <div style="color:#ffffff;font-family:'Montserrat',Arial,sans-serif;font-size:13px;line-height:1.5;text-align:center;mso-line-height-alt:20px;">
-                                      <p style="margin: 0; word-break: break-word;">
-                                        <a href="${safeMarketingUrl}/privacy" style="color: #ffffff; text-decoration: underline;">Privacy Policy</a> | <a href="${safeMarketingUrl}/contact" style="color: #ffffff; text-decoration: underline;">Get in Touch</a>
-                                      </p>
-                                    </div>
-                                  </td>
-                                </tr>
-                              </table>
+// src/middleware/require-verified-email.ts
+import { createMiddleware as createMiddleware4 } from "hono/factory";
+import { eq as eq6 } from "drizzle-orm";
+var requireVerifiedEmail = createMiddleware4(
+  async (c, next) => {
+    const userId = c.get("userId");
+    if (!userId) {
+      return problems.unauthorized(c, "Not authenticated");
+    }
+    const { db, schema } = getAuthContext(c);
+    const database = db;
+    const users = schema.users;
+    const [user] = await database.select({ emailVerified: users.emailVerified }).from(users).where(eq6(users.id, userId)).limit(1);
+    if (!user || !user.emailVerified) {
+      return problems.forbidden(c, "Please verify your email address to continue");
+    }
+    await next();
+  }
+);
 
-                              <!-- Copyright & Disclaimer -->
-                              <table class="paragraph_block block-1" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">
-                                <tr>
-                                  <td class="pad" style="padding-bottom:15px;padding-left:40px;padding-right:40px;">
-                                    <div style="color:#a3a3a3;font-family:'Montserrat',Arial,sans-serif;font-size:12px;line-height:1.5;text-align:center;mso-line-height-alt:18px;">
-                                      <p style="margin: 0 0 12px 0; word-break: break-word;">\xA9 ${(/* @__PURE__ */ new Date()).getFullYear()} ${appName}. All rights reserved.</p>
-                                      <p style="margin: 0; font-size: 11px; line-height: 1.5; word-break: break-word;">
-                                        Please do not reply to this email as this address does not accept incoming messages. This service email contains essential information relating to your ${appName} account.
-                                      </p>
-                                    </div>
-                                  </td>
-                                </tr>
-                              </table>
+// src/routes/index.ts
+import { OpenAPIHono as OpenAPIHono3 } from "@hono/zod-openapi";
 
-                            </td>
-                          </tr>
-                        </tbody>
-                      </table>
-                    </td>
-                  </tr>
-                </tbody>
-              </table>
+// src/routes/signup.ts
+import { createRoute } from "@hono/zod-openapi";
+import { eq as eq9 } from "drizzle-orm";
 
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </body>
-    </html>
-  `;
-}
+// src/lib/email/email-service.ts
+import { eq as eq7 } from "drizzle-orm";
 
 // src/lib/email/templates.ts
 function extractAppUrl(url) {
@@ -1905,6 +2042,7 @@ function generateVerificationEmail(data, appName = "Your App", configuredAppUrl
     welcomeMessage: safeFirstName ? `Hi ${safeFirstName}, Welcome to ${escapeHtml(appName)}!` : void 0,
     footerNote: "",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -1940,6 +2078,7 @@ function generatePasswordResetEmail(data, appName = "Your App", configuredAppUrl
 		`,
     footerNote: "If you didn't request this change, no action is needed. Your password will remain unchanged.",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -1975,6 +2114,7 @@ function generateEmailChangeConfirmation(data, appName = "Your App", configuredA
 		`,
     footerNote: "If you didn't request this change, you can safely ignore this email.",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -2013,6 +2153,7 @@ function generateEmailChangeNotification(data, appName = "Your App", configuredA
 		`,
     footerNote: "If you didn't request this change, click the button above to cancel it.",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -2049,6 +2190,7 @@ function generate2faCodeEmail(data, appName = "Your App", appUrl = "", branding)
     buttonUrl: "",
     footerNote: "",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -2084,6 +2226,7 @@ function generate2faEnabledEmail(data, appName = "Your App", appUrl = "", brandi
     buttonUrl: "",
     footerNote: "",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -2114,6 +2257,7 @@ function generate2faDisabledEmail(data, appName = "Your App", appUrl = "", brand
     buttonUrl: appUrl ? `${appUrl}/forgot-password` : "",
     footerNote: "",
     appUrl,
+    appName,
     ...branding
   });
   return {
@@ -2330,7 +2474,7 @@ var EmailService = class {
     const [user] = await db.select({
       emailBounced: usersTable.emailBounced,
       emailComplained: usersTable.emailComplained
-    }).from(usersTable).where(eq6(usersTable.email, emailAddress.toLowerCase())).limit(1);
+    }).from(usersTable).where(eq7(usersTable.email, emailAddress.toLowerCase())).limit(1);
     if (!user) {
       return { blocked: false };
     }
@@ -2779,7 +2923,7 @@ var EmailService = class {
 import { Resend as Resend2 } from "resend";
 
 // src/lib/email/webhook-handler.ts
-import { eq as eq7 } from "drizzle-orm";
+import { eq as eq8 } from "drizzle-orm";
 async function handleWebhookEvent(payload, db, tables2) {
   const { type, data } = payload;
   const emailAddress = data.to[0];
@@ -2838,7 +2982,7 @@ async function handleBounce(emailAddress, emailId, bounce, db, usersTable) {
   await db.update(usersTable).set({
     emailBounced: true,
     emailBouncedAt: /* @__PURE__ */ new Date()
-  }).where(eq7(usersTable.email, emailAddress.toLowerCase()));
+  }).where(eq8(usersTable.email, emailAddress.toLowerCase()));
   logError(new Error("Email bounced"), {
     context: "email_webhook",
     emailAddress,
@@ -2854,7 +2998,7 @@ async function handleComplaint(emailAddress, emailId, db, usersTable) {
   await db.update(usersTable).set({
     emailComplained: true,
     emailComplainedAt: /* @__PURE__ */ new Date()
-  }).where(eq7(usersTable.email, emailAddress.toLowerCase()));
+  }).where(eq8(usersTable.email, emailAddress.toLowerCase()));
   logError(new Error("Email spam complaint received"), {
     context: "email_webhook",
     emailAddress,
@@ -2876,15 +3020,15 @@ async function handleFailure(emailAddress, emailId, failed) {
 }
 
 // src/lib/email/monitoring.ts
-import { sql as sql2 } from "drizzle-orm";
+import { sql as sql3 } from "drizzle-orm";
 async function calculateBounceRate(db, emailEventsTable, hoursAgo = 24) {
   const cutoff = new Date(Date.now() - hoursAgo * 60 * 60 * 1e3);
   const [stats] = await db.select({
-    totalSent: sql2`count(*) filter (where event_type = 'email.sent')`.as("total_sent"),
-    totalBounced: sql2`count(*) filter (where event_type = 'email.bounced')`.as(
+    totalSent: sql3`count(*) filter (where event_type = 'email.sent')`.as("total_sent"),
+    totalBounced: sql3`count(*) filter (where event_type = 'email.bounced')`.as(
       "total_bounced"
     )
-  }).from(emailEventsTable).where(sql2`created_at > ${cutoff}`);
+  }).from(emailEventsTable).where(sql3`created_at > ${cutoff}`);
   if (!stats || stats.totalSent === 0) {
     return 0;
   }
@@ -2903,11 +3047,11 @@ async function calculateBounceRate(db, emailEventsTable, hoursAgo = 24) {
 async function calculateComplaintRate(db, emailEventsTable, hoursAgo = 24) {
   const cutoff = new Date(Date.now() - hoursAgo * 60 * 60 * 1e3);
   const [stats] = await db.select({
-    totalSent: sql2`count(*) filter (where event_type = 'email.sent')`.as("total_sent"),
-    totalComplained: sql2`count(*) filter (where event_type = 'email.complained')`.as(
+    totalSent: sql3`count(*) filter (where event_type = 'email.sent')`.as("total_sent"),
+    totalComplained: sql3`count(*) filter (where event_type = 'email.complained')`.as(
       "total_complained"
     )
-  }).from(emailEventsTable).where(sql2`created_at > ${cutoff}`);
+  }).from(emailEventsTable).where(sql3`created_at > ${cutoff}`);
   if (!stats || stats.totalSent === 0) {
     return 0;
   }
@@ -2924,16 +3068,34 @@ async function calculateComplaintRate(db, emailEventsTable, hoursAgo = 24) {
   return complaintRate;
 }
 
+// src/core/invitations.ts
+async function verifyInvitation(invitations, args) {
+  if (!invitations || !args.token) return null;
+  const email = args.email.toLowerCase();
+  try {
+    const match = await invitations.verify({ token: args.token, email, db: args.db, env: args.env });
+    return match && match.email.toLowerCase() === email ? args.token : null;
+  } catch (err) {
+    logError(err, { context: "invitation_verify_failed", email });
+    return null;
+  }
+}
+async function acceptInvitation(invitations, args) {
+  if (!invitations?.onAccepted) return;
+  try {
+    await invitations.onAccepted({ token: args.token, user: args.user, db: args.db, env: args.env });
+  } catch (err) {
+    logError(err, { context: args.context, userId: args.user.id });
+  }
+}
+
 // src/routes/schemas.ts
 import { z } from "@hono/zod-openapi";
 var signupRequestSchema = z.object({
   email: z.string().email().openapi({ example: "user@example.com" }),
-  // Password and turnstileToken are required for standard signup; optional when oauthToken is provided
-  password: z.string().min(8).optional().openapi({ example: "SecurePass123!" }),
+  password: z.string().min(8).openapi({ example: "SecurePass123!" }),
   name: z.string().min(1).optional().openapi({ example: "John Doe" }),
-  turnstileToken: z.string().optional().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" }),
-  // OAuth signup completion token (from /signup?oauth_token=...)
-  oauthToken: z.string().optional().openapi({ example: "a1b2c3d4-..." }),
+  turnstileToken: z.string().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" }),
   // App invitation token (from /signup?token=...). When it validates for this
   // email, the account is created already-verified with no verification email.
   invitationToken: z.string().optional().openapi({ example: "iIB8tDJJ..." })
@@ -3059,76 +3221,22 @@ var signupRoute = createRoute({
       description: "Invalid input",
       content: { "application/json": { schema: errorResponseSchema } }
     },
+    403: {
+      description: "Sign-up is by invitation only and no valid invitation was given",
+      content: { "application/json": { schema: errorResponseSchema } }
+    },
     409: {
       description: "Email already registered",
       content: { "application/json": { schema: errorResponseSchema } }
     }
   }
 });
+var INVITATION_ONLY = "Sign-up is by invitation only";
+var INVITATION_INVALID = "This invitation is invalid, expired, or for a different email address";
 var signupHandler = async (c) => {
-  const { email, password, name, turnstileToken, oauthToken, invitationToken } = c.req.valid("json");
-  const { db: database, schema, emailBranding, invitations } = getAuthContext(c);
+  const { email, password, name, turnstileToken, invitationToken } = c.req.valid("json");
+  const { db: database, schema, env: authEnv, emailBranding, invitations, signup } = getAuthContext(c);
   const env = c.env;
-  if (oauthToken) {
-    const stored = await env.OAUTH_STATES.get(`oauth:signup:${oauthToken}`);
-    if (!stored) {
-      return problems.badRequest(c, "Invalid or expired OAuth token");
-    }
-    const {
-      email: tokenEmail,
-      provider,
-      providerUserId
-    } = JSON.parse(stored);
-    if (email.toLowerCase() !== tokenEmail.toLowerCase()) {
-      return problems.badRequest(c, "Email does not match OAuth token");
-    }
-    await env.OAUTH_STATES.delete(`oauth:signup:${oauthToken}`);
-    const existingUser2 = await database.query.users.findFirst({
-      where: eq8(schema.users.email, tokenEmail.toLowerCase())
-    });
-    if (existingUser2) {
-      return problems.conflict(c, "Email already registered");
-    }
-    let hashedPassword2 = null;
-    if (password) {
-      const passwordValidation2 = await validatePasswordWithBreachCheck(password);
-      if (!passwordValidation2.valid) {
-        return problems.badRequest(c, passwordValidation2.error || "Invalid password");
-      }
-      hashedPassword2 = await hashPassword(password, env.PASSWORD_PEPPER_V1);
-    }
-    const [newUser2] = await database.insert(schema.users).values({
-      email: tokenEmail.toLowerCase(),
-      name: name || null,
-      hashedPassword: hashedPassword2,
-      pepperKid: hashedPassword2 ? "v1" : null,
-      emailVerified: true,
-      // Provider verified the email
-      activatedAt: /* @__PURE__ */ new Date()
-    }).returning();
-    await database.insert(schema.oauthAccounts).values({ userId: newUser2.id, provider, providerUserId, email: tokenEmail.toLowerCase() }).onConflictDoNothing();
-    const fingerprint2 = await generateFingerprint(c.req.raw);
-    const ipAddress2 = getClientIp(c.req.raw);
-    const sessionId2 = await createSession(database, { sessions: schema.sessions }, newUser2.id, fingerprint2, ipAddress2);
-    logSecurityEvent("user_signup_oauth", "low", {
-      userId: newUser2.id,
-      email: newUser2.email,
-      provider
-    });
-    c.header("Set-Cookie", setSessionCookie(sessionId2, env), { append: true });
-    return c.json({
-      user: {
-        id: newUser2.id,
-        email: newUser2.email,
-        name: newUser2.name,
-        emailVerified: true
-      },
-      redirect: "/"
-    });
-  }
-  if (!password || !turnstileToken) {
-    return problems.badRequest(c, "Password and captcha are required");
-  }
   const turnstileValid = await verifyTurnstileToken(
     turnstileToken,
     env.TURNSTILE_SECRET_KEY,
@@ -3138,8 +3246,22 @@ var signupHandler = async (c) => {
   if (!turnstileValid) {
     return problems.badRequest(c, "Invalid captcha");
   }
+  const invited = await verifyInvitation(invitations, {
+    token: invitationToken,
+    email,
+    db: database,
+    env: authEnv
+  });
+  if (invitationToken && invitations && !invited && signup !== "invitation") {
+    return problems.badRequest(c, INVITATION_INVALID);
+  }
+  if (signup === "invitation" && !invited) {
+    logSecurityEvent("signup_refused_no_invitation", "medium", { email: email.toLowerCase() });
+    return problems.forbidden(c, invitationToken ? INVITATION_INVALID : INVITATION_ONLY);
+  }
+  const invitedVerified = invited !== null;
   const existingUser = await database.query.users.findFirst({
-    where: eq8(schema.users.email, email.toLowerCase())
+    where: eq9(schema.users.email, email.toLowerCase())
   });
   if (existingUser) {
     return problems.conflict(c, "Email already registered");
@@ -3149,22 +3271,6 @@ var signupHandler = async (c) => {
     return problems.badRequest(c, passwordValidation.error || "Invalid password");
   }
   const hashedPassword = await hashPassword(password, env.PASSWORD_PEPPER_V1);
-  let invitedVerified = false;
-  if (invitationToken && invitations) {
-    const match = await invitations.verify({
-      token: invitationToken,
-      email: email.toLowerCase(),
-      db: database,
-      env
-    });
-    if (!match || match.email.toLowerCase() !== email.toLowerCase()) {
-      return problems.badRequest(
-        c,
-        "This invitation is invalid, expired, or for a different email address"
-      );
-    }
-    invitedVerified = true;
-  }
   const [newUser] = await database.insert(schema.users).values({
     email: email.toLowerCase(),
     name: name || null,
@@ -3197,17 +3303,14 @@ var signupHandler = async (c) => {
       schema.users
     );
   }
-  if (invitedVerified && invitationToken && invitations?.onAccepted) {
-    try {
-      await invitations.onAccepted({
-        token: invitationToken,
-        user: { id: newUser.id, email: newUser.email, name: newUser.name },
-        db: database,
-        env
-      });
-    } catch (err) {
-      logError(err, { context: "signup_invitation_onAccepted_failed", userId: newUser.id });
-    }
+  if (invited) {
+    await acceptInvitation(invitations, {
+      token: invited,
+      user: { id: newUser.id, email: newUser.email, name: newUser.name },
+      db: database,
+      env: authEnv,
+      context: "signup_invitation_onAccepted_failed"
+    });
   }
   const fingerprint = await generateFingerprint(c.req.raw);
   const ipAddress = getClientIp(c.req.raw);
@@ -3240,24 +3343,34 @@ var signupMiddleware = [
 
 // src/routes/login.ts
 import { createRoute as createRoute2 } from "@hono/zod-openapi";
-import { eq as eq10 } from "drizzle-orm";
+import { eq as eq11 } from "drizzle-orm";
 import { getCookie } from "hono/cookie";
 
 // src/routes/2fa/helpers.ts
-import { eq as eq9, and as and3, isNull } from "drizzle-orm";
+import { eq as eq10, and as and4, isNull as isNull2 } from "drizzle-orm";
 async function getUserEnabled2faMethods(database, userId, user2faMethodsTable) {
   return database.select({
     method: user2faMethodsTable.method,
     isPrimary: user2faMethodsTable.isPrimary,
     totpSecret: user2faMethodsTable.totpSecret,
     lastTotpCounter: user2faMethodsTable.lastTotpCounter
-  }).from(user2faMethodsTable).where(eq9(user2faMethodsTable.userId, userId));
+  }).from(user2faMethodsTable).where(eq10(user2faMethodsTable.userId, userId));
 }
 function generateEmailOtp() {
   const bytes = crypto.getRandomValues(new Uint8Array(4));
   const num = (bytes[0] << 24 | bytes[1] << 16 | bytes[2] << 8 | bytes[3]) >>> 0;
   return String(num % 1e6).padStart(6, "0");
 }
+var EMAIL_CODE_TTL_SECONDS = 300;
+async function sendEmailChallengeCode(env, database, usersTable, user, emailBranding) {
+  const code = generateEmailOtp();
+  await env.OAUTH_STATES.put(`email_2fa_challenge:${user.id}`, await hashToken(code), {
+    expirationTtl: EMAIL_CODE_TTL_SECONDS
+  });
+  const emailService = new EmailService(env, void 0, emailBranding);
+  const firstName = user.name?.split(" ")[0] || null;
+  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, database, usersTable);
+}
 async function verifyAny2faCode(database, env, userId, code, method, tables2) {
   const { user2faMethods: user2faMethodsTable, userBackupCodes: userBackupCodesTable } = tables2;
   if (method === "totp") {
@@ -3275,7 +3388,7 @@ async function verifyAny2faCode(database, env, userId, code, method, tables2) {
       const secret = await decryptTotpSecret(totpMethod.totpSecret, env.TOTP_ENCRYPTION_KEY);
       const result = verifyTotpCode(secret, code, totpMethod.lastTotpCounter);
       if (result.valid) {
-        await database.update(user2faMethodsTable).set({ lastTotpCounter: result.counter }).where(and3(eq9(user2faMethodsTable.userId, userId), eq9(user2faMethodsTable.method, "totp")));
+        await database.update(user2faMethodsTable).set({ lastTotpCounter: result.counter }).where(and4(eq10(user2faMethodsTable.userId, userId), eq10(user2faMethodsTable.method, "totp")));
         return { valid: true };
       }
       return { valid: false };
@@ -3287,18 +3400,18 @@ async function verifyAny2faCode(database, env, userId, code, method, tables2) {
     const kvKey = `email_2fa_challenge:${userId}`;
     const storedHash = await env.OAUTH_STATES.get(kvKey);
     if (!storedHash) return { valid: false };
-    const codeHash = await hashToken(code);
-    if (codeHash === storedHash) {
+    const codeHash2 = await hashToken(code);
+    if (codeHash2 === storedHash) {
       await env.OAUTH_STATES.delete(kvKey);
       return { valid: true };
     }
     return { valid: false };
   }
   if (method === "backup") {
-    const backupCodes = await database.select({ id: userBackupCodesTable.id, codeHash: userBackupCodesTable.codeHash }).from(userBackupCodesTable).where(and3(eq9(userBackupCodesTable.userId, userId), isNull(userBackupCodesTable.usedAt)));
+    const backupCodes = await database.select({ id: userBackupCodesTable.id, codeHash: userBackupCodesTable.codeHash }).from(userBackupCodesTable).where(and4(eq10(userBackupCodesTable.userId, userId), isNull2(userBackupCodesTable.usedAt)));
     for (const bc of backupCodes) {
       if (await verifyBackupCode(code, bc.codeHash)) {
-        await database.update(userBackupCodesTable).set({ usedAt: Date.now() }).where(eq9(userBackupCodesTable.id, bc.id));
+        await database.update(userBackupCodesTable).set({ usedAt: Date.now() }).where(eq10(userBackupCodesTable.id, bc.id));
         logSecurityEvent("2fa_backup_code_used", "medium", { userId, codeId: bc.id });
         return { valid: true };
       }
@@ -3342,7 +3455,7 @@ var loginRoute = createRoute2({
 });
 var loginHandler = async (c) => {
   const { email, password, turnstileToken } = c.req.valid("json");
-  const { db: database, schema } = getAuthContext(c);
+  const { db: database, schema, emailBranding } = getAuthContext(c);
   const env = c.env;
   const turnstileValid = await verifyTurnstileToken(
     turnstileToken,
@@ -3354,7 +3467,7 @@ var loginHandler = async (c) => {
     return problems.badRequest(c, "Invalid captcha");
   }
   const user = await database.query.users.findFirst({
-    where: eq10(schema.users.email, email.toLowerCase())
+    where: eq11(schema.users.email, email.toLowerCase())
   });
   if (!user) {
     return problems.unauthorized(c, "Invalid email or password");
@@ -3427,6 +3540,10 @@ var loginHandler = async (c) => {
     };
     await storeChallengeToken(env.OAUTH_STATES, challengeToken, challengePayload);
     setChallengeCookie(c, env, challengeToken);
+    const emailMethod = enabled2faMethods.find((m) => m.method === "email");
+    if (emailMethod && (emailMethod.isPrimary || enabled2faMethods.length === 1)) {
+      await sendEmailChallengeCode(env, database, schema.users, user, emailBranding);
+    }
     return c.json({
       requires2fa: true,
       methods: enabled2faMethods.map((m) => m.method)
@@ -3459,7 +3576,7 @@ var loginMiddleware = [
 
 // src/routes/logout.ts
 import { createRoute as createRoute3 } from "@hono/zod-openapi";
-import { eq as eq11 } from "drizzle-orm";
+import { eq as eq12 } from "drizzle-orm";
 var logoutRoute = createRoute3({
   method: "post",
   path: "/logout",
@@ -3482,7 +3599,7 @@ var logoutHandler = async (c) => {
     const sessionIdMatch = cookieHeader.match(cookiePattern);
     if (sessionIdMatch) {
       const sessionId = sessionIdMatch[1];
-      await database.delete(schema.sessions).where(eq11(schema.sessions.id, sessionId));
+      await database.delete(schema.sessions).where(eq12(schema.sessions.id, sessionId));
     }
   }
   c.header("Set-Cookie", clearSessionCookie(c.env), { append: true });
@@ -3491,7 +3608,7 @@ var logoutHandler = async (c) => {
 
 // src/routes/me.ts
 import { createRoute as createRoute4 } from "@hono/zod-openapi";
-import { eq as eq12 } from "drizzle-orm";
+import { eq as eq13 } from "drizzle-orm";
 var meRoute = createRoute4({
   method: "get",
   path: "/me",
@@ -3519,7 +3636,7 @@ var meHandler = async (c) => {
   if (!userId) return problems.unauthorized(c, "Not authenticated");
   const { db: database, schema } = getAuthContext(c);
   const user = await database.query.users.findFirst({
-    where: eq12(schema.users.id, userId)
+    where: eq13(schema.users.id, userId)
   });
   if (!user) {
     return problems.notFound(c, "User not found");
@@ -3545,7 +3662,7 @@ var meMiddleware = [requireAuth];
 
 // src/routes/verify-email.ts
 import { createRoute as createRoute5 } from "@hono/zod-openapi";
-import { eq as eq13 } from "drizzle-orm";
+import { eq as eq14 } from "drizzle-orm";
 var verifyEmailRoute = createRoute5({
   method: "post",
   path: "/verify-email",
@@ -3574,17 +3691,17 @@ var verifyEmailHandler = async (c) => {
   const { db: database, schema } = getAuthContext(c);
   const tokenHash = await hashToken(token);
   const verificationToken = await database.query.emailVerificationTokens.findFirst({
-    where: eq13(schema.emailVerificationTokens.tokenHash, tokenHash)
+    where: eq14(schema.emailVerificationTokens.tokenHash, tokenHash)
   });
   if (!verificationToken) {
     return problems.badRequest(c, "Invalid or expired verification token");
   }
   if (verificationToken.expiresAt < Date.now()) {
-    await database.delete(schema.emailVerificationTokens).where(eq13(schema.emailVerificationTokens.tokenHash, tokenHash));
+    await database.delete(schema.emailVerificationTokens).where(eq14(schema.emailVerificationTokens.tokenHash, tokenHash));
     return problems.badRequest(c, "Verification token has expired");
   }
-  await database.update(schema.users).set({ emailVerified: true }).where(eq13(schema.users.id, verificationToken.userId));
-  await database.delete(schema.emailVerificationTokens).where(eq13(schema.emailVerificationTokens.tokenHash, tokenHash));
+  await database.update(schema.users).set({ emailVerified: true }).where(eq14(schema.users.id, verificationToken.userId));
+  await database.delete(schema.emailVerificationTokens).where(eq14(schema.emailVerificationTokens.tokenHash, tokenHash));
   logSecurityEvent("email_verified", "low", { userId: verificationToken.userId });
   return c.json({ success: true, redirect: "/" });
 };
@@ -3593,18 +3710,18 @@ var verifyEmailHandler = async (c) => {
 import { createRoute as createRoute6 } from "@hono/zod-openapi";
 
 // src/core/password-reset.ts
-import { eq as eq14, and as and4, gt as gt3, lt, sql as sql3 } from "drizzle-orm";
+import { eq as eq15, and as and5, gt as gt4, lt as lt2, sql as sql4 } from "drizzle-orm";
 var TOKEN_EXPIRATION_MS = AUTH_DEFAULTS.PASSWORD_RESET_TTL_MINUTES * 60 * 1e3;
 async function createPasswordResetToken(db, tables2, email) {
   const { users, passwordResetTokens } = tables2;
-  const [user] = await db.select({ id: users.id, emailVerified: users.emailVerified }).from(users).where(eq14(users.email, email.toLowerCase())).limit(1);
+  const [user] = await db.select({ id: users.id, emailVerified: users.emailVerified }).from(users).where(eq15(users.email, email.toLowerCase())).limit(1);
   if (!user) {
     return null;
   }
   if (!user.emailVerified) {
     return null;
   }
-  await db.delete(passwordResetTokens).where(eq14(passwordResetTokens.userId, user.id));
+  await db.delete(passwordResetTokens).where(eq15(passwordResetTokens.userId, user.id));
   const token = generateSecureToken(64);
   const tokenHash = await hashToken(token);
   const expiresAt = Date.now() + TOKEN_EXPIRATION_MS;
@@ -3626,10 +3743,10 @@ async function validateResetToken(db, tables2, token) {
     used: passwordResetTokens.used,
     expiresAt: passwordResetTokens.expiresAt
   }).from(passwordResetTokens).where(
-    and4(
-      eq14(passwordResetTokens.tokenHash, tokenHash),
-      eq14(passwordResetTokens.used, false),
-      gt3(passwordResetTokens.expiresAt, Date.now())
+    and5(
+      eq15(passwordResetTokens.tokenHash, tokenHash),
+      eq15(passwordResetTokens.used, false),
+      gt4(passwordResetTokens.expiresAt, Date.now())
     )
   ).limit(1);
   if (!resetToken) {
@@ -3650,11 +3767,11 @@ async function resetPassword(db, tables2, token, newPassword, pepper, pepperKid
   await db.update(users).set({
     hashedPassword,
     pepperKid,
-    sessionVersion: sql3`${users.sessionVersion} + 1`
-  }).where(eq14(users.id, userId));
+    sessionVersion: sql4`${users.sessionVersion} + 1`
+  }).where(eq15(users.id, userId));
   const tokenHash = await hashToken(token);
-  await db.update(passwordResetTokens).set({ used: true }).where(eq14(passwordResetTokens.tokenHash, tokenHash));
-  await db.delete(sessions).where(eq14(sessions.userId, userId));
+  await db.update(passwordResetTokens).set({ used: true }).where(eq15(passwordResetTokens.tokenHash, tokenHash));
+  await db.delete(sessions).where(eq15(sessions.userId, userId));
   logger_default.info("Password reset successful", { userId });
   return { success: true };
 }
@@ -3802,14 +3919,14 @@ var resetPasswordMiddleware = [
 import { createRoute as createRoute8 } from "@hono/zod-openapi";
 
 // src/core/change-password.ts
-import { eq as eq15, and as and5, ne } from "drizzle-orm";
+import { eq as eq16, and as and6, ne } from "drizzle-orm";
 async function changePassword(params) {
   const { userId, currentPassword, newPassword, currentSessionId, pepper, db, tables: tables2 } = params;
   const { users, sessions } = tables2;
   const [user] = await db.select({
     id: users.id,
     hashedPassword: users.hashedPassword
-  }).from(users).where(eq15(users.id, userId)).limit(1);
+  }).from(users).where(eq16(users.id, userId)).limit(1);
   if (!user || !user.hashedPassword) {
     return { success: false, error: "User not found" };
   }
@@ -3825,8 +3942,8 @@ async function changePassword(params) {
   await db.update(users).set({
     hashedPassword: newHashedPassword,
     updatedAt: /* @__PURE__ */ new Date()
-  }).where(eq15(users.id, userId));
-  await db.delete(sessions).where(and5(eq15(sessions.userId, userId), ne(sessions.id, currentSessionId)));
+  }).where(eq16(users.id, userId));
+  await db.delete(sessions).where(and6(eq16(sessions.userId, userId), ne(sessions.id, currentSessionId)));
   logSecurityEvent("password_changed", "low", {
     userId
   });
@@ -4099,7 +4216,7 @@ var cancelEmailChangeHandler = async (c) => {
 // src/routes/delete-account.ts
 import { createRoute as createRoute13 } from "@hono/zod-openapi";
 import { z as z5 } from "@hono/zod-openapi";
-import { eq as eq16 } from "drizzle-orm";
+import { eq as eq17 } from "drizzle-orm";
 var deleteAccountRequestSchema = z5.object({
   password: z5.string().min(1).openapi({ example: "CurrentPass123!" })
 }).openapi("DeleteAccountRequest");
@@ -4147,7 +4264,7 @@ var deleteAccountHandler = async (c) => {
     const [user] = await database.select({
       id: schema.users.id,
       hashedPassword: schema.users.hashedPassword
-    }).from(schema.users).where(eq16(schema.users.id, userId)).limit(1);
+    }).from(schema.users).where(eq17(schema.users.id, userId)).limit(1);
     if (!user || !user.hashedPassword) {
       return problems.unauthorized(c, "Invalid credentials");
     }
@@ -4162,8 +4279,8 @@ var deleteAccountHandler = async (c) => {
     }
     const now = /* @__PURE__ */ new Date();
     const purgeAt = new Date(now.getTime() + PURGE_WINDOW_DAYS * 24 * 60 * 60 * 1e3);
-    await database.update(schema.users).set({ deletedAt: now, scheduledPurgeAt: purgeAt, updatedAt: now }).where(eq16(schema.users.id, userId));
-    await database.delete(schema.sessions).where(eq16(schema.sessions.userId, userId));
+    await database.update(schema.users).set({ deletedAt: now, scheduledPurgeAt: purgeAt, updatedAt: now }).where(eq17(schema.users.id, userId));
+    await database.delete(schema.sessions).where(eq17(schema.sessions.userId, userId));
     logSecurityEvent("account_deletion_requested", "high", { userId });
     return c.json(
       {
@@ -4184,7 +4301,7 @@ var deleteAccountMiddleware = [requireAuth];
 // src/routes/refresh.ts
 import { createRoute as createRoute14 } from "@hono/zod-openapi";
 import { z as z6 } from "@hono/zod-openapi";
-import { eq as eq17, and as and6, gt as gt4 } from "drizzle-orm";
+import { eq as eq18, and as and7, gt as gt5 } from "drizzle-orm";
 var refreshRequestSchema = z6.object({
   refreshToken: z6.string().min(1).openapi({ example: "abc123..." })
 }).openapi("RefreshRequest");
@@ -4224,7 +4341,7 @@ var refreshHandler = async (c) => {
     expiresAt: schema.sessions.expiresAt,
     fingerprint: schema.sessions.fingerprint,
     ipAddress: schema.sessions.ipAddress
-  }).from(schema.sessions).where(and6(eq17(schema.sessions.id, refreshToken), gt4(schema.sessions.expiresAt, Date.now()))).limit(1);
+  }).from(schema.sessions).where(and7(eq18(schema.sessions.id, refreshToken), gt5(schema.sessions.expiresAt, Date.now()))).limit(1);
   if (!session) {
     return problems.unauthorized(c, "Invalid or expired refresh token");
   }
@@ -4247,7 +4364,7 @@ var refreshMiddleware = [];
 // src/routes/resend-verification.ts
 import { createRoute as createRoute15 } from "@hono/zod-openapi";
 import { z as z7 } from "@hono/zod-openapi";
-import { eq as eq18 } from "drizzle-orm";
+import { eq as eq19 } from "drizzle-orm";
 var resendVerificationResponseSchema = z7.object({
   success: z7.boolean().openapi({ example: true }),
   message: z7.string().openapi({ example: "Verification email sent" })
@@ -4292,14 +4409,14 @@ var resendVerificationHandler = async (c) => {
     email: schema.users.email,
     name: schema.users.name,
     emailVerified: schema.users.emailVerified
-  }).from(schema.users).where(eq18(schema.users.id, userId)).limit(1);
+  }).from(schema.users).where(eq19(schema.users.id, userId)).limit(1);
   if (!user) {
     return problems.unauthorized(c, "User not found");
   }
   if (user.emailVerified) {
     return problems.badRequest(c, "Email is already verified");
   }
-  await db.delete(schema.emailVerificationTokens).where(eq18(schema.emailVerificationTokens.userId, userId));
+  await db.delete(schema.emailVerificationTokens).where(eq19(schema.emailVerificationTokens.userId, userId));
   const emailToken = generateSecureToken(32);
   const tokenHash = await hashToken(emailToken);
   const expiresAt = Date.now() + 24 * 60 * 60 * 1e3;
@@ -4344,7 +4461,7 @@ import { OpenAPIHono } from "@hono/zod-openapi";
 
 // src/routes/2fa/status.ts
 import { createRoute as createRoute16 } from "@hono/zod-openapi";
-import { eq as eq19, and as and7, isNull as isNull2 } from "drizzle-orm";
+import { eq as eq20, and as and8, isNull as isNull3 } from "drizzle-orm";
 
 // src/routes/2fa/schemas.ts
 import { z as z8 } from "@hono/zod-openapi";
@@ -4505,7 +4622,7 @@ var statusHandler = async (c) => {
   if (!userId) return problems.unauthorized(c);
   const { db, schema } = getAuthContext(c);
   const methods = await getUserEnabled2faMethods(db, userId, schema.user2faMethods);
-  const backupCodes = await db.select({ id: schema.userBackupCodes.id }).from(schema.userBackupCodes).where(and7(eq19(schema.userBackupCodes.userId, userId), isNull2(schema.userBackupCodes.usedAt)));
+  const backupCodes = await db.select({ id: schema.userBackupCodes.id }).from(schema.userBackupCodes).where(and8(eq20(schema.userBackupCodes.userId, userId), isNull3(schema.userBackupCodes.usedAt)));
   c.header("Cache-Control", "private, max-age=60");
   c.header("Vary", "Cookie");
   return c.json({
@@ -4517,7 +4634,7 @@ var statusHandler = async (c) => {
 
 // src/routes/2fa/totp-setup.ts
 import { createRoute as createRoute17 } from "@hono/zod-openapi";
-import { eq as eq20, and as and8 } from "drizzle-orm";
+import { eq as eq21, and as and9 } from "drizzle-orm";
 var totpSetupRoute = createRoute17({
   method: "post",
   path: "/totp/setup",
@@ -4547,11 +4664,11 @@ var totpSetupHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c);
   const { db, schema, env } = getAuthContext(c);
-  const existing = await db.select({ id: schema.user2faMethods.id }).from(schema.user2faMethods).where(and8(eq20(schema.user2faMethods.userId, userId), eq20(schema.user2faMethods.method, "totp"))).limit(1);
+  const existing = await db.select({ id: schema.user2faMethods.id }).from(schema.user2faMethods).where(and9(eq21(schema.user2faMethods.userId, userId), eq21(schema.user2faMethods.method, "totp"))).limit(1);
   if (existing.length > 0) {
     return problems.badRequest(c, "TOTP already enabled");
   }
-  const [user] = await db.select({ email: schema.users.email }).from(schema.users).where(eq20(schema.users.id, userId)).limit(1);
+  const [user] = await db.select({ email: schema.users.email }).from(schema.users).where(eq21(schema.users.id, userId)).limit(1);
   if (!user) return problems.notFound(c, "User not found");
   const secret = generateTotpSecret();
   const qrCodeUri = generateQrCodeUri(secret, user.email);
@@ -4562,7 +4679,7 @@ var totpSetupHandler = async (c) => {
 
 // src/routes/2fa/totp-verify.ts
 import { createRoute as createRoute18 } from "@hono/zod-openapi";
-import { eq as eq21 } from "drizzle-orm";
+import { eq as eq22 } from "drizzle-orm";
 var totpVerifyRoute = createRoute18({
   method: "post",
   path: "/totp/verify",
@@ -4608,7 +4725,7 @@ var totpVerifyHandler = async (c) => {
     logSecurityEvent("2fa_totp_setup_failed", "medium", { userId });
     return problems.badRequest(c, "Invalid code");
   }
-  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq21(schema.users.id, userId)).limit(1);
+  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq22(schema.users.id, userId)).limit(1);
   const encryptionKey = env.TOTP_ENCRYPTION_KEY;
   if (!encryptionKey) {
     logger_default.error("TOTP_ENCRYPTION_KEY not configured");
@@ -4656,7 +4773,7 @@ var totpVerifyHandler = async (c) => {
 
 // src/routes/2fa/totp-disable.ts
 import { createRoute as createRoute19 } from "@hono/zod-openapi";
-import { eq as eq22, and as and9 } from "drizzle-orm";
+import { eq as eq23, and as and10 } from "drizzle-orm";
 var totpDisableRoute = createRoute19({
   method: "post",
   path: "/totp/disable",
@@ -4699,13 +4816,13 @@ var totpDisableHandler = async (c) => {
     logSecurityEvent("2fa_disable_failed", "medium", { userId, method: "totp" });
     return problems.badRequest(c, "Invalid verification code");
   }
-  await db.delete(schema.user2faMethods).where(and9(eq22(schema.user2faMethods.userId, userId), eq22(schema.user2faMethods.method, "totp")));
+  await db.delete(schema.user2faMethods).where(and10(eq23(schema.user2faMethods.userId, userId), eq23(schema.user2faMethods.method, "totp")));
   const remaining = await getUserEnabled2faMethods(db, userId, schema.user2faMethods);
   if (remaining.length === 0) {
-    await db.delete(schema.userBackupCodes).where(eq22(schema.userBackupCodes.userId, userId));
-    await db.delete(schema.userTrustedDevices).where(eq22(schema.userTrustedDevices.userId, userId));
+    await db.delete(schema.userBackupCodes).where(eq23(schema.userBackupCodes.userId, userId));
+    await db.delete(schema.userTrustedDevices).where(eq23(schema.userTrustedDevices.userId, userId));
     await invalidateAllUserSessions(db, { sessions: schema.sessions, users: schema.users }, userId);
-    const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq22(schema.users.id, userId)).limit(1);
+    const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq23(schema.users.id, userId)).limit(1);
     if (user) {
       const emailService = new EmailService(env, void 0, emailBranding);
       const firstName = user.name?.split(" ")[0] || null;
@@ -4724,7 +4841,7 @@ var totpDisableHandler = async (c) => {
 
 // src/routes/2fa/email-setup.ts
 import { createRoute as createRoute20 } from "@hono/zod-openapi";
-import { eq as eq23, and as and10 } from "drizzle-orm";
+import { eq as eq24, and as and11 } from "drizzle-orm";
 var emailSetupRoute = createRoute20({
   method: "post",
   path: "/email/setup",
@@ -4754,15 +4871,15 @@ var emailSetupHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c);
   const { db, schema, env, emailBranding } = getAuthContext(c);
-  const existing = await db.select({ id: schema.user2faMethods.id }).from(schema.user2faMethods).where(and10(eq23(schema.user2faMethods.userId, userId), eq23(schema.user2faMethods.method, "email"))).limit(1);
+  const existing = await db.select({ id: schema.user2faMethods.id }).from(schema.user2faMethods).where(and11(eq24(schema.user2faMethods.userId, userId), eq24(schema.user2faMethods.method, "email"))).limit(1);
   if (existing.length > 0) {
     return problems.badRequest(c, "Email 2FA already enabled");
   }
-  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq23(schema.users.id, userId)).limit(1);
+  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq24(schema.users.id, userId)).limit(1);
   if (!user) return problems.notFound(c, "User not found");
   const code = generateEmailOtp();
-  const codeHash = await hashToken(code);
-  await env.OAUTH_STATES.put(`email_2fa_setup:${userId}`, codeHash, { expirationTtl: 300 });
+  const codeHash2 = await hashToken(code);
+  await env.OAUTH_STATES.put(`email_2fa_setup:${userId}`, codeHash2, { expirationTtl: 300 });
   const emailService = new EmailService(env, void 0, emailBranding);
   const firstName = user.name?.split(" ")[0] || null;
   await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
@@ -4772,7 +4889,7 @@ var emailSetupHandler = async (c) => {
 
 // src/routes/2fa/email-verify.ts
 import { createRoute as createRoute21 } from "@hono/zod-openapi";
-import { eq as eq24 } from "drizzle-orm";
+import { eq as eq25 } from "drizzle-orm";
 var emailVerifyRoute = createRoute21({
   method: "post",
   path: "/email/verify",
@@ -4809,12 +4926,12 @@ var emailVerifyHandler = async (c) => {
   if (!storedHash) {
     return problems.badRequest(c, "Code expired. Please request a new one.");
   }
-  const codeHash = await hashToken(code);
-  if (codeHash !== storedHash) {
+  const codeHash2 = await hashToken(code);
+  if (codeHash2 !== storedHash) {
     logSecurityEvent("2fa_email_setup_failed", "medium", { userId });
     return problems.badRequest(c, "Invalid code");
   }
-  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq24(schema.users.id, userId)).limit(1);
+  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq25(schema.users.id, userId)).limit(1);
   const now = Date.now();
   const existingMethods = await getUserEnabled2faMethods(db, userId, schema.user2faMethods);
   const isFirstMethod = existingMethods.length === 0;
@@ -4856,7 +4973,7 @@ var emailVerifyHandler = async (c) => {
 
 // src/routes/2fa/email-send-code.ts
 import { createRoute as createRoute22 } from "@hono/zod-openapi";
-import { eq as eq25, and as and11 } from "drizzle-orm";
+import { eq as eq26, and as and12 } from "drizzle-orm";
 var emailSendCodeRoute = createRoute22({
   method: "post",
   path: "/email/send-code",
@@ -4886,15 +5003,15 @@ var emailSendCodeHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c);
   const { db, schema, env, emailBranding } = getAuthContext(c);
-  const [emailMethod] = await db.select().from(schema.user2faMethods).where(and11(eq25(schema.user2faMethods.userId, userId), eq25(schema.user2faMethods.method, "email"))).limit(1);
+  const [emailMethod] = await db.select().from(schema.user2faMethods).where(and12(eq26(schema.user2faMethods.userId, userId), eq26(schema.user2faMethods.method, "email"))).limit(1);
   if (!emailMethod) {
     return problems.badRequest(c, "Email 2FA not enabled");
   }
-  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq25(schema.users.id, userId)).limit(1);
+  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq26(schema.users.id, userId)).limit(1);
   if (!user) return problems.notFound(c, "User not found");
   const code = generateEmailOtp();
-  const codeHash = await hashToken(code);
-  await env.OAUTH_STATES.put(`email_2fa_challenge:${userId}`, codeHash, {
+  const codeHash2 = await hashToken(code);
+  await env.OAUTH_STATES.put(`email_2fa_challenge:${userId}`, codeHash2, {
     expirationTtl: 300
   });
   const emailService = new EmailService(env, void 0, emailBranding);
@@ -4916,7 +5033,7 @@ var emailSendCodeHandler = async (c) => {
 
 // src/routes/2fa/email-disable.ts
 import { createRoute as createRoute23 } from "@hono/zod-openapi";
-import { eq as eq26, and as and12 } from "drizzle-orm";
+import { eq as eq27, and as and13 } from "drizzle-orm";
 var emailDisableRoute = createRoute23({
   method: "post",
   path: "/email/disable",
@@ -4959,13 +5076,13 @@ var emailDisableHandler = async (c) => {
     logSecurityEvent("2fa_disable_failed", "medium", { userId, method: "email" });
     return problems.badRequest(c, "Invalid verification code");
   }
-  await db.delete(schema.user2faMethods).where(and12(eq26(schema.user2faMethods.userId, userId), eq26(schema.user2faMethods.method, "email")));
+  await db.delete(schema.user2faMethods).where(and13(eq27(schema.user2faMethods.userId, userId), eq27(schema.user2faMethods.method, "email")));
   const remaining = await getUserEnabled2faMethods(db, userId, schema.user2faMethods);
   if (remaining.length === 0) {
-    await db.delete(schema.userBackupCodes).where(eq26(schema.userBackupCodes.userId, userId));
-    await db.delete(schema.userTrustedDevices).where(eq26(schema.userTrustedDevices.userId, userId));
+    await db.delete(schema.userBackupCodes).where(eq27(schema.userBackupCodes.userId, userId));
+    await db.delete(schema.userTrustedDevices).where(eq27(schema.userTrustedDevices.userId, userId));
     await invalidateAllUserSessions(db, { sessions: schema.sessions, users: schema.users }, userId);
-    const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq26(schema.users.id, userId)).limit(1);
+    const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq27(schema.users.id, userId)).limit(1);
     if (user) {
       const emailService = new EmailService(env, void 0, emailBranding);
       const firstName = user.name?.split(" ")[0] || null;
@@ -4984,7 +5101,7 @@ var emailDisableHandler = async (c) => {
 
 // src/routes/2fa/trusted-devices.ts
 import { createRoute as createRoute24, z as z9 } from "@hono/zod-openapi";
-import { eq as eq27, and as and13, gt as gt5 } from "drizzle-orm";
+import { eq as eq28, and as and14, gt as gt6 } from "drizzle-orm";
 var trustedDevicesGetRoute = createRoute24({
   method: "get",
   path: "/trusted-devices",
@@ -5023,7 +5140,7 @@ var trustedDevicesGetHandler = async (c) => {
     ipAddress: schema.userTrustedDevices.ipAddress,
     lastUsedAt: schema.userTrustedDevices.lastUsedAt,
     createdAt: schema.userTrustedDevices.createdAt
-  }).from(schema.userTrustedDevices).where(and13(eq27(schema.userTrustedDevices.userId, userId), gt5(schema.userTrustedDevices.expiresAt, now)));
+  }).from(schema.userTrustedDevices).where(and14(eq28(schema.userTrustedDevices.userId, userId), gt6(schema.userTrustedDevices.expiresAt, now)));
   c.header("Cache-Control", "private, max-age=60");
   c.header("Vary", "Cookie");
   return c.json({ devices });
@@ -5059,7 +5176,7 @@ var trustedDevicesDeleteHandler = async (c) => {
   if (!userId) return problems.unauthorized(c);
   const deviceId = c.req.param("id");
   const { db, schema } = getAuthContext(c);
-  const result = await db.delete(schema.userTrustedDevices).where(and13(eq27(schema.userTrustedDevices.id, deviceId), eq27(schema.userTrustedDevices.userId, userId))).returning({ id: schema.userTrustedDevices.id });
+  const result = await db.delete(schema.userTrustedDevices).where(and14(eq28(schema.userTrustedDevices.id, deviceId), eq28(schema.userTrustedDevices.userId, userId))).returning({ id: schema.userTrustedDevices.id });
   if (result.length === 0) {
     return problems.notFound(c, "Device not found");
   }
@@ -5069,7 +5186,7 @@ var trustedDevicesDeleteHandler = async (c) => {
 
 // src/routes/2fa/backup-codes.ts
 import { createRoute as createRoute25 } from "@hono/zod-openapi";
-import { eq as eq28 } from "drizzle-orm";
+import { eq as eq29 } from "drizzle-orm";
 var backupCodesRegenerateRoute = createRoute25({
   method: "post",
   path: "/backup-codes/regenerate",
@@ -5110,7 +5227,7 @@ var backupCodesRegenerateHandler = async (c) => {
     logSecurityEvent("2fa_backup_regenerate_failed", "medium", { userId });
     return problems.badRequest(c, "Invalid verification code");
   }
-  await db.delete(schema.userBackupCodes).where(eq28(schema.userBackupCodes.userId, userId));
+  await db.delete(schema.userBackupCodes).where(eq29(schema.userBackupCodes.userId, userId));
   const codes = generateBackupCodes();
   const now = Date.now();
   const hashedCodes = await Promise.all(
@@ -5127,7 +5244,7 @@ var backupCodesRegenerateHandler = async (c) => {
 
 // src/routes/2fa/challenge.ts
 import { createRoute as createRoute26 } from "@hono/zod-openapi";
-import { eq as eq29 } from "drizzle-orm";
+import { eq as eq30 } from "drizzle-orm";
 import { getCookie as getCookie2 } from "hono/cookie";
 var challengeRoute = createRoute26({
   method: "post",
@@ -5199,7 +5316,7 @@ var challengeHandler = async (c) => {
   }
   await deleteChallengeToken(c.env.OAUTH_STATES, challengeToken);
   clearChallengeCookie(c, c.env);
-  const [user] = await db.select().from(schema.users).where(eq29(schema.users.id, payload.userId)).limit(1);
+  const [user] = await db.select().from(schema.users).where(eq30(schema.users.id, payload.userId)).limit(1);
   if (!user) {
     logger_default.error("User not found during 2FA challenge", { userId: payload.userId });
     return problems.notFound(c, "User not found");
@@ -5240,7 +5357,7 @@ var challengeHandler = async (c) => {
 
 // src/routes/2fa/challenge-resend.ts
 import { createRoute as createRoute27 } from "@hono/zod-openapi";
-import { eq as eq30 } from "drizzle-orm";
+import { eq as eq31 } from "drizzle-orm";
 import { getCookie as getCookie3 } from "hono/cookie";
 var challengeResendRoute = createRoute27({
   method: "post",
@@ -5278,19 +5395,12 @@ var challengeResendHandler = async (c) => {
   if (!payload.methods.includes("email")) {
     return problems.badRequest(c, "Email verification not available");
   }
-  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq30(schema.users.id, payload.userId)).limit(1);
+  const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq31(schema.users.id, payload.userId)).limit(1);
   if (!user) {
     logger_default.error("User not found during 2FA resend", { userId: payload.userId });
     return problems.notFound(c, "User not found");
   }
-  const code = generateEmailOtp();
-  const codeHash = await hashToken(code);
-  await c.env.OAUTH_STATES.put(`email_2fa_challenge:${payload.userId}`, codeHash, {
-    expirationTtl: 300
-  });
-  const emailService = new EmailService(c.env, void 0, emailBranding);
-  const firstName = user.name?.split(" ")[0] || null;
-  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
+  await sendEmailChallengeCode(c.env, db, schema.users, { id: payload.userId, ...user }, emailBranding);
   logger_default.info("Email 2FA code resent", { userId: payload.userId });
   return c.json({ success: true });
 };
@@ -5516,7 +5626,7 @@ var authorizeHandler = async (c) => {
 
 // src/routes/oauth/callback.ts
 import { createRoute as createRoute29 } from "@hono/zod-openapi";
-import { eq as eq31 } from "drizzle-orm";
+import { eq as eq32 } from "drizzle-orm";
 var callbackRoute = createRoute29({
   method: "get",
   path: "/{provider}/callback",
@@ -5642,10 +5752,24 @@ var callbackHandler = async (c) => {
       logger_default.warn("No user ID returned from OAuth provider", { provider });
       return c.redirect(`${appUrl}/login?error=oauth_failed`);
     }
-    const { db, schema } = getAuthContext(c);
-    const [existingUser] = await db.select({ id: schema.users.id, email: schema.users.email }).from(schema.users).where(eq31(schema.users.email, email)).limit(1);
+    const { db, schema, env, invitations, signup } = getAuthContext(c);
+    const [existingUser] = await db.select({ id: schema.users.id, email: schema.users.email }).from(schema.users).where(eq32(schema.users.email, email)).limit(1);
     let authUser = existingUser;
     if (!authUser) {
+      const invited = await verifyInvitation(invitations, {
+        token: invitationToken,
+        email,
+        db,
+        env
+      });
+      if (signup === "invitation" && !invited) {
+        logSecurityEvent("oauth_signup_refused_no_invitation", "medium", {
+          email,
+          provider,
+          hadInvitation: !!invitationToken
+        });
+        return c.redirect(`${appUrl}/login?error=invitation_required`);
+      }
       const [createdUser] = await db.insert(schema.users).values({
         email,
         name: name || null,
@@ -5656,6 +5780,15 @@ var callbackHandler = async (c) => {
         activatedAt: /* @__PURE__ */ new Date()
       }).returning({ id: schema.users.id, email: schema.users.email });
       authUser = createdUser;
+      if (invited) {
+        await acceptInvitation(invitations, {
+          token: invited,
+          user: { id: createdUser.id, email: createdUser.email, name: name || null },
+          db,
+          env,
+          context: "oauth_invitation_onAccepted_failed"
+        });
+      }
       logSecurityEvent("user_signup_oauth", "low", {
         userId: createdUser.id,
         email: createdUser.email,
@@ -5695,7 +5828,7 @@ var callbackHandler = async (c) => {
 
 // src/routes/oauth/complete.ts
 import { createRoute as createRoute30 } from "@hono/zod-openapi";
-import { eq as eq32 } from "drizzle-orm";
+import { eq as eq33 } from "drizzle-orm";
 var completeRoute = createRoute30({
   method: "post",
   path: "/complete",
@@ -5743,7 +5876,7 @@ var completeHandler = async (c) => {
     redirect: storedRedirect
   } = JSON.parse(stored);
   const { db, schema } = getAuthContext(c);
-  await db.update(schema.users).set({ emailVerified: true }).where(eq32(schema.users.id, userId));
+  await db.update(schema.users).set({ emailVerified: true }).where(eq33(schema.users.id, userId));
   await db.insert(schema.oauthAccounts).values({ userId, provider, providerUserId, email }).onConflictDoNothing();
   const fingerprint = await generateFingerprint(c.req.raw);
   const ipAddress = getClientIp(c.req.raw);
@@ -5788,19 +5921,12 @@ var routes_default = authRoutes;
 
 // src/lib/email/webhook-verifier.ts
 import { Webhook } from "svix";
-function verifyWebhookSignature(payload, signature, secret) {
+function verifyWebhookSignature(payload, headers, secret) {
   if (!secret || secret.trim() === "") {
     throw new Error("Webhook secret is required");
   }
   try {
-    const wh = new Webhook(secret);
-    wh.verify(payload, {
-      "svix-id": "",
-      // Not used by Resend
-      "svix-timestamp": "",
-      // Not used by Resend
-      "svix-signature": signature
-    });
+    new Webhook(secret).verify(payload, { ...headers });
     return true;
   } catch (error) {
     logger_default.warn("Webhook signature verification failed", {
@@ -5815,6 +5941,8 @@ export {
   CloudflareEmailAdapter,
   EmailService,
   MAX_CHALLENGE_ATTEMPTS,
+  PASSWORDLESS_MAX_ATTEMPTS,
+  PASSWORDLESS_TTL_MS,
   ProblemTypes,
   ResendAdapter,
   SCHEMA_VERSION,
@@ -5826,6 +5954,7 @@ export {
   cancelEmailChange,
   checkAccountLocked,
   checkBreachedPassword,
+  cleanupExpiredPasswordlessChallenges,
   clearAccountLockout,
   clearChallengeCookie,
   clearSessionCookie,
@@ -5836,6 +5965,7 @@ export {
   createChallengeToken,
   createDeviceToken,
   createEmailAdapter,
+  createPasswordlessChallenge,
   createProblemDetails,
   createSession,
   csrf,
@@ -5852,6 +5982,7 @@ export {
   generate2faEnabledEmail,
   generateApiKey,
   generateBackupCodes,
+  generateCode,
   generateCodeChallenge,
   generateCodeVerifier,
   generateEmailChangeConfirmation,
@@ -5890,14 +6021,17 @@ export {
   optionalAuth,
   parseDeviceName,
   parseDeviceType,
+  passwordlessEmail,
   problemJson,
   problems,
   rateLimit,
+  recentPasswordlessFailures,
   refreshSession,
   requestEmailChange,
   requireAuth,
   requireVerifiedEmail,
   retrieveChallengeToken,
+  sessionRefreshDue,
   setChallengeCookie,
   setSessionCookie,
   setTrustedDeviceCookie,
@@ -5915,6 +6049,8 @@ export {
   verifyCodeChallenge,
   verifyPassword,
   verifyPasswordWithRotation,
+  verifyPasswordlessCode,
+  verifyPasswordlessLink,
   verifyTotpCode,
   verifyTurnstileToken,
   verifyWebhookSignature