pinomad 0.12.0 → 0.14.0

package/dist/{chunk-mnmqyq7d.js → chunk-5j7ybhjj.js}

@@ -9,14 +9,14 @@ import {
   relayWsBase,
   verifyRelayChallenge,
   verifyRelayChallengeV2
-} from "./chunk-g3ahp7b9.js";
+} from "./chunk-9trbbz4r.js";
 import {
   normalizeHostName
-} from "./chunk-pqe7q1s7.js";
+} from "./chunk-6vbp1vva.js";
 import {
   commandHint,
   webRoot
-} from "./chunk-7wj0jh3t.js";
+} from "./chunk-1rdbnvy6.js";
 import"./chunk-df32avw6.js";
 
 // apps/server/src/main.ts
@@ -58,7 +58,7 @@ async function lockDataDir(dir, options) {
 
 // apps/server/src/accounts.ts
 var DB_FILE = "server.sqlite";
-var SCHEMA_VERSION = 8;
+var SCHEMA_VERSION = 10;
 var SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 var JOIN_TOKEN_TTL_MS = 10 * 60 * 1000;
 var USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
@@ -79,8 +79,20 @@ function normalizeUserCode(input) {
   return code;
 }
 var formatUserCode = (code) => `${code.slice(0, 4)}-${code.slice(4)}`;
-var INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
-var SIGN_UP_USERNAME = /^[a-z0-9][a-z0-9._-]{1,31}$/;
+var EMAIL_CODE_TTL_MS = 10 * 60000;
+var EMAIL_CODE_MAX_ATTEMPTS = 5;
+var OAUTH_FLOW_TTL_MS = 10 * 60000;
+var OAUTH_PENDING_TTL_MS = 10 * 60000;
+var OAUTH_CODE_TTL_MS = 2 * 60000;
+var REAUTH_TTL_MS = 5 * 60000;
+var PROVIDER_NAMES = { google: "Google", github: "GitHub", apple: "Apple" };
+var MAX_EMAIL_LENGTH = 254;
+var MAX_LOCAL_PART_LENGTH = 64;
+var EMAIL_PATTERN = /^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
+function normalizeEmail(raw) {
+  const email = raw.trim().toLowerCase();
+  return email.length <= MAX_EMAIL_LENGTH && EMAIL_PATTERN.test(email) && email.indexOf("@") <= MAX_LOCAL_PART_LENGTH ? email : undefined;
+}
 var PUSH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1000;
 var MAX_PUSH_TOKENS_PER_USER = 32;
 var APNS_TOKEN_PATTERN = /^(?:[0-9a-f]{2})+$/;
@@ -115,6 +127,17 @@ var MAX_USERNAME_CODEPOINTS = 254;
 var scryptAsync = promisify(scrypt);
 var DUMMY_HASH = `scrypt$${SCRYPT.N}$${SCRYPT.r}$${SCRYPT.p}$${"A".repeat(22)}$${"A".repeat(43)}`;
 var sha256Hex = (input) => createHash("sha256").update(input, "utf8").digest("hex");
+var DAY_MS = 24 * 60 * 60 * 1000;
+var codeHash = (purpose, email, code) => sha256Hex(`${purpose}:${email}:${code}`);
+var USER_SELECT = "SELECT id, username, email, password_hash AS passwordHash FROM users";
+var accountUser = (row) => row.email === null ? { username: row.username ?? "" } : { username: row.email, email: row.email };
+var accountLockKey = (userId) => `user:${userId}`;
+function requireEmail(raw) {
+  const email = normalizeEmail(raw);
+  if (email === undefined)
+    throw new Error(`not a valid email: ${raw}`);
+  return email;
+}
 var safeEqual = (a, b) => {
   const left = Buffer.from(a);
   const right = Buffer.from(b);
@@ -271,6 +294,135 @@ function migrate(db) {
       COMMIT;
     `);
   }
+  if (version < 9)
+    migrateTo9(db);
+  if (version < 10) {
+    db.exec(`
+      BEGIN;
+      -- Apple sends a name only the first time; its refresh token is revoked
+      -- when the account goes or Apple is unlinked, with the client_id that
+      -- received it (the web Services ID or the app's bundle id).
+      ALTER TABLE user_identities ADD COLUMN name TEXT;
+      ALTER TABLE user_identities ADD COLUMN refresh_token TEXT;
+      ALTER TABLE user_identities ADD COLUMN refresh_client_id TEXT;
+      CREATE TABLE oauth_flows (
+        state_hash TEXT PRIMARY KEY,
+        provider TEXT NOT NULL,
+        kind TEXT NOT NULL CHECK (kind IN ('web', 'native', 'link')),
+        verifier TEXT NOT NULL,
+        nonce TEXT NOT NULL,
+        -- web and link: the hash of the browser's binding cookie.
+        binding_hash TEXT,
+        -- native: where the code goes, its PKCE challenge and the client's state.
+        redirect_uri TEXT,
+        code_challenge TEXT,
+        client_state TEXT,
+        link_user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
+        -- link: the session that started it, which must still be live when
+        -- the identity is written.
+        link_session_hash TEXT,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      );
+      CREATE INDEX oauth_flows_expiry ON oauth_flows (expires_at);
+      -- A provider sign-in that found no account, waiting for the person to
+      -- create one or link it to an account they sign in to.
+      CREATE TABLE oauth_pending (
+        id_hash TEXT PRIMARY KEY,
+        provider TEXT NOT NULL,
+        subject TEXT NOT NULL,
+        email TEXT,
+        email_verified INTEGER NOT NULL DEFAULT 0,
+        name TEXT,
+        refresh_token TEXT,
+        refresh_client_id TEXT,
+        kind TEXT NOT NULL CHECK (kind IN ('web', 'native', 'direct')),
+        binding_hash TEXT,
+        redirect_uri TEXT,
+        code_challenge TEXT,
+        client_state TEXT,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      );
+      CREATE INDEX oauth_pending_expiry ON oauth_pending (expires_at);
+      CREATE TABLE oauth_codes (
+        code_hash TEXT PRIMARY KEY,
+        user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        code_challenge TEXT NOT NULL,
+        expires_at INTEGER NOT NULL
+      );
+      -- A grant dies with the session it was issued to.
+      CREATE TABLE reauth_grants (
+        grant_hash TEXT PRIMARY KEY,
+        session_hash TEXT NOT NULL REFERENCES sessions(token_hash) ON DELETE CASCADE,
+        expires_at INTEGER NOT NULL
+      );
+      CREATE INDEX reauth_grants_session ON reauth_grants (session_hash);
+      PRAGMA user_version = 10;
+      COMMIT;
+    `);
+  }
+}
+function migrateTo9(db) {
+  db.exec("PRAGMA foreign_keys = OFF");
+  try {
+    db.exec("BEGIN");
+    try {
+      db.exec(`
+        DROP TABLE invites;
+        CREATE TABLE users_v9 (
+          id INTEGER PRIMARY KEY,
+          -- Legacy accounts only (ADR-0044 §8); NULL for email accounts.
+          username TEXT UNIQUE,
+          -- Lowercased; set only once verified, so email_verified_at goes with it.
+          email TEXT UNIQUE,
+          email_verified_at INTEGER,
+          -- NULL for an account that only signs in through a provider (#620).
+          password_hash TEXT,
+          created_at INTEGER NOT NULL,
+          CHECK (username IS NOT NULL OR email IS NOT NULL)
+        );
+        INSERT INTO users_v9 (id, username, password_hash, created_at) SELECT id, username, password_hash, created_at FROM users;
+        DROP TABLE users;
+        ALTER TABLE users_v9 RENAME TO users;
+        -- Sign-in providers bound to an account (#620): subject is the
+        -- provider's stable id for the person, never an email.
+        CREATE TABLE user_identities (
+          provider TEXT NOT NULL,
+          subject TEXT NOT NULL,
+          user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          email TEXT,
+          created_at INTEGER NOT NULL,
+          PRIMARY KEY (provider, subject)
+        );
+        CREATE INDEX user_identities_user ON user_identities (user_id);
+        -- Mailed codes: only the hash. A sign-up code has no account yet.
+        -- AUTOINCREMENT, like every id here that could be reused.
+        CREATE TABLE email_codes (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          purpose TEXT NOT NULL CHECK (purpose IN ('signup', 'reset', 'add_email', 'reauth')),
+          email TEXT NOT NULL,
+          user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
+          code_hash TEXT NOT NULL,
+          attempts INTEGER NOT NULL DEFAULT 0,
+          created_at INTEGER NOT NULL,
+          expires_at INTEGER NOT NULL
+        );
+        CREATE INDEX email_codes_email ON email_codes (purpose, email);
+        CREATE INDEX email_codes_user ON email_codes (user_id);
+        CREATE INDEX email_codes_expiry ON email_codes (expires_at);
+      `);
+      const dangling = db.prepare("PRAGMA foreign_key_check").all();
+      if (dangling.length > 0)
+        throw new Error(`schema 9 migration left ${dangling.length} dangling references`);
+      db.exec("PRAGMA user_version = 9; COMMIT");
+    } catch (error) {
+      db.exec("ROLLBACK");
+      throw error;
+    }
+  } finally {
+    db.exec("PRAGMA foreign_keys = ON");
+  }
 }
 function migrateTo4(db) {
   db.exec("BEGIN");
@@ -451,10 +603,12 @@ async function openAccounts(options) {
       if (options.bootstrapUser === undefined || options.bootstrapPassword === undefined) {
         throw new Error("PINOMAD_SERVER_USER and PINOMAD_SERVER_PASSWORD are required to create the first account");
       }
-      assertUsernamePolicy(options.bootstrapUser);
+      const email = options.bootstrapUser.includes("@") ? requireEmail(options.bootstrapUser) : undefined;
+      if (email === undefined)
+        assertUsernamePolicy(options.bootstrapUser);
       assertPasswordPolicy(options.bootstrapPassword);
       const hash = await hashPassword(options.bootstrapPassword);
-      db.prepare("INSERT INTO users (username, password_hash, created_at, admin) VALUES (?, ?, ?, 1)").run(options.bootstrapUser, hash, now());
+      db.prepare("INSERT INTO users (username, email, email_verified_at, password_hash, created_at) VALUES (?, ?, ?, ?, ?)").run(email === undefined ? options.bootstrapUser : null, email ?? null, email === undefined ? null : now(), hash, now());
     }
   } catch (error) {
     db?.close();
@@ -485,12 +639,91 @@ async function openAccounts(options) {
   const linkStarts = new WindowedCounter(linkLimits.counterMaxEntries, now);
   const linkUserFailures = new WindowedCounter(linkLimits.counterMaxEntries, now);
   const linkIpFailures = new WindowedCounter(linkLimits.counterMaxEntries, now);
+  const codeLimits = {
+    ipMax: options.codeLimits?.ipMax ?? 10,
+    ipWindowMs: options.codeLimits?.ipWindowMs ?? 60 * 60000,
+    emailMax: options.codeLimits?.emailMax ?? 5,
+    emailWindowMs: options.codeLimits?.emailWindowMs ?? 60 * 60000,
+    dailyMax: options.codeLimits?.dailyMax ?? 1000,
+    counterMaxEntries: options.codeLimits?.counterMaxEntries ?? 4096
+  };
+  const codeIps = new WindowedCounter(codeLimits.counterMaxEntries, now);
+  const codeEmails = new WindowedCounter(codeLimits.counterMaxEntries, now);
+  const codesToday = new WindowedCounter(1, now);
+  const oauthLimits = {
+    startMaxPerIp: options.oauthLimits?.startMaxPerIp ?? 30,
+    startWindowMs: options.oauthLimits?.startWindowMs ?? 10 * 60000,
+    maxPending: options.oauthLimits?.maxPending ?? 1e4
+  };
+  const oauthStarts = new WindowedCounter(limits.counterMaxEntries, now);
+  const linkCodes = new Map;
+  const mailer = options.mailer;
+  const registrationOpen = options.registration === "open";
+  const emailSignup = registrationOpen && mailer !== undefined;
+  const codeAllowed = (ip, email) => {
+    if (codeIps.hit(ip, codeLimits.ipMax, codeLimits.ipWindowMs))
+      return false;
+    if (codeEmails.isOver(email, codeLimits.emailMax) || codesToday.isOver("all", codeLimits.dailyMax))
+      return false;
+    codeEmails.bump(email, codeLimits.emailWindowMs);
+    codesToday.bump("all", DAY_MS);
+    return true;
+  };
+  const deliver = (purpose, to, subject, text) => {
+    mailer?.send(to, subject, text).catch(() => {
+      console.error(JSON.stringify({ event: "mail_failed", purpose }));
+    });
+  };
+  const issueCode = (purpose, email, userId) => {
+    const at = now();
+    db.prepare("DELETE FROM email_codes WHERE expires_at <= ?").run(at);
+    if (purpose === "add_email")
+      db.prepare("DELETE FROM email_codes WHERE purpose = ? AND user_id = ?").run(purpose, userId);
+    else
+      db.prepare("DELETE FROM email_codes WHERE purpose = ? AND email = ?").run(purpose, email);
+    const code = String(randomInt(1e6)).padStart(6, "0");
+    db.prepare("INSERT INTO email_codes (purpose, email, user_id, code_hash, created_at, expires_at) VALUES (?, ?, ?, ?, ?, ?)").run(purpose, email, userId, codeHash(purpose, email, code), at, at + EMAIL_CODE_TTL_MS);
+    return code;
+  };
+  const spendCode = (purpose, email, code, lockKey, userId) => {
+    const row = db.prepare(`SELECT id, code_hash AS codeHash, attempts FROM email_codes
+         WHERE purpose = ? AND email = ? AND user_id IS ? AND expires_at > ?`).get(purpose, email, userId ?? null, now());
+    if (row !== undefined && safeEqual(codeHash(purpose, email, code.replace(/\s/g, "")), row.codeHash)) {
+      db.prepare("DELETE FROM email_codes WHERE id = ?").run(row.id);
+      return true;
+    }
+    userFailures.bump(lockKey, limits.userWindowMs);
+    if (row !== undefined) {
+      if (row.attempts + 1 >= EMAIL_CODE_MAX_ATTEMPTS)
+        db.prepare("DELETE FROM email_codes WHERE id = ?").run(row.id);
+      else
+        db.prepare("UPDATE email_codes SET attempts = attempts + 1 WHERE id = ?").run(row.id);
+    }
+    return false;
+  };
+  const findUser = (identifier) => {
+    const email = normalizeEmail(identifier);
+    return db.prepare(`${USER_SELECT} WHERE email = ? OR username = ? ORDER BY email IS ? DESC LIMIT 1`).get(email ?? null, identifier, email ?? null);
+  };
+  const userById = (userId) => db.prepare(`${USER_SELECT} WHERE id = ?`).get(userId);
+  const lockKeyFor = (identifier, user) => user === undefined ? `name:${normalizeEmail(identifier) ?? identifier}` : accountLockKey(user.id);
   const PENDING_SELECT = `SELECT host_id AS hostId, host_name AS name, host_os AS os, source_ip AS sourceIp, expires_at AS expiresAt,
       redirect_uri AS redirectUri, client_state AS clientState FROM host_link_requests`;
+  const linkIdentity = ({ linkUserId: userId, linkSessionHash }, identity) => transaction(() => {
+    const live = db.prepare("SELECT 1 AS x FROM sessions WHERE token_hash = ? AND user_id = ? AND expires_at > ?").get(linkSessionHash, userId, now());
+    if (live === undefined)
+      return "session_ended";
+    const bound = identityOwner(identity.provider, identity.subject);
+    if (bound !== undefined && bound !== userId)
+      return "identity_taken";
+    bindIdentity(userId, identity);
+    return "linked";
+  });
   const sweepExpired = () => {
     const at = now();
-    db.prepare("DELETE FROM join_tokens WHERE expires_at <= ?").run(at);
-    db.prepare("DELETE FROM host_link_requests WHERE expires_at <= ?").run(at);
+    for (const table of ["join_tokens", "host_link_requests", "email_codes", "oauth_flows", "oauth_pending", "oauth_codes", "reauth_grants"]) {
+      db.prepare(`DELETE FROM ${table} WHERE expires_at <= ?`).run(at);
+    }
   };
   const mintJoinToken = (userId, hostId) => {
     const token = randomBytes(32).toString("base64url");
@@ -510,14 +743,14 @@ async function openAccounts(options) {
       return "limited";
     }
     const code = normalizeUserCode(userCode);
-    const codeHash = code === undefined ? undefined : sha256Hex(code);
-    const row = codeHash === undefined ? undefined : db.prepare(`${PENDING_SELECT} WHERE user_code_hash = ? AND state = 'pending' AND expires_at > ?`).get(codeHash, now());
-    if (codeHash === undefined || row === undefined) {
+    const codeHash2 = code === undefined ? undefined : sha256Hex(code);
+    const row = codeHash2 === undefined ? undefined : db.prepare(`${PENDING_SELECT} WHERE user_code_hash = ? AND state = 'pending' AND expires_at > ?`).get(codeHash2, now());
+    if (codeHash2 === undefined || row === undefined) {
       linkUserFailures.bump(userKey, linkLimits.failureWindowMs);
       linkIpFailures.bump(ip, linkLimits.failureWindowMs);
       return "not_found";
     }
-    return { column: "user_code_hash", hash: codeHash, row };
+    return { column: "user_code_hash", hash: codeHash2, row };
   };
   const settleHostLink = (args, state) => {
     const found = pendingByRef(args.userId, args, args.ip);
@@ -578,16 +811,17 @@ async function openAccounts(options) {
     db.prepare("UPDATE vouchings SET revoked_at = ? WHERE device_id = ? AND revoked_at IS NULL").run(at, deviceId);
     return hostIds;
   };
-  const currentHash = (userId) => db.prepare("SELECT password_hash AS passwordHash FROM users WHERE id = ?").get(userId)?.passwordHash;
-  const checkPassword = async (userId, username, password) => {
-    if (userFailures.isOver(username, limits.userMaxFailures))
+  const currentHash = (userId) => userById(userId)?.passwordHash;
+  const checkPassword = async (userId, password) => {
+    const lockKey = accountLockKey(userId);
+    if (userFailures.isOver(lockKey, limits.userMaxFailures))
       return "limited";
-    const stored = currentHash(userId);
+    const stored = currentHash(userId) ?? undefined;
     const outcome = await gate.run(async () => {
-      if (userFailures.isOver(username, limits.userMaxFailures))
+      if (userFailures.isOver(lockKey, limits.userMaxFailures))
         return "limited";
       if (!await verifyPassword(password, stored ?? DUMMY_HASH) || stored === undefined) {
-        userFailures.bump(username, limits.userWindowMs);
+        userFailures.bump(lockKey, limits.userWindowMs);
         return "wrong_password";
       }
       return "ok";
@@ -596,30 +830,85 @@ async function openAccounts(options) {
       return "limited";
     if (outcome === "wrong_password")
       return "wrong_password";
-    userFailures.reset(username);
+    userFailures.reset(lockKey);
     return { verifiedHash: stored };
   };
-  const inviteState = (codeHash) => {
-    const row = db.prepare("SELECT expires_at AS expiresAt, used_at AS usedAt FROM invites WHERE code_hash = ?").get(codeHash);
-    if (row === undefined || row.usedAt !== null)
-      return "invalid_invite";
-    return row.expiresAt <= now() ? "invite_expired" : "ok";
+  const reauthValid = (userId, token, grant) => {
+    const at = now();
+    return db.prepare(`SELECT 1 AS x FROM reauth_grants g JOIN sessions s ON s.token_hash = g.session_hash
+           WHERE g.grant_hash = ? AND g.session_hash = ? AND g.expires_at > ? AND s.user_id = ? AND s.expires_at > ?`).get(sha256Hex(grant), sha256Hex(token), at, userId, at) !== undefined;
+  };
+  const sessionLive = (userId, token) => db.prepare("SELECT 1 AS x FROM sessions WHERE token_hash = ? AND user_id = ? AND expires_at > ?").get(sha256Hex(token), userId, now()) !== undefined;
+  const confirmAccount = async (userId, confirmation) => {
+    if ("reauth" in confirmation) {
+      return reauthValid(userId, confirmation.token, confirmation.reauth) ? { reauth: confirmation.reauth, token: confirmation.token } : "invalid_reauth";
+    }
+    return checkPassword(userId, confirmation.password);
+  };
+  const stillConfirmed = (userId, confirmed) => {
+    if ("verifiedHash" in confirmed)
+      return currentHash(userId) === confirmed.verifiedHash ? undefined : "wrong_password";
+    return reauthValid(userId, confirmed.token, confirmed.reauth) ? undefined : "invalid_reauth";
+  };
+  const appleGrants = (userId) => db.prepare(`SELECT refresh_token AS refreshToken, refresh_client_id AS clientId FROM user_identities
+         WHERE user_id = ? AND provider = 'apple' AND refresh_token IS NOT NULL AND refresh_client_id IS NOT NULL`).all(userId);
+  const identityOwner = (provider, subject) => db.prepare("SELECT user_id AS userId FROM user_identities WHERE provider = ? AND subject = ?").get(provider, subject)?.userId;
+  const bindIdentity = (userId, identity) => {
+    db.prepare(`INSERT INTO user_identities (provider, subject, user_id, email, name, refresh_token, refresh_client_id, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT (provider, subject) DO UPDATE SET
+         email = COALESCE(excluded.email, email), name = COALESCE(name, excluded.name),
+         refresh_token = COALESCE(excluded.refresh_token, refresh_token),
+         refresh_client_id = COALESCE(excluded.refresh_client_id, refresh_client_id)
+       WHERE user_id = excluded.user_id`).run(identity.provider, identity.subject, userId, identity.email ?? null, identity.name ?? null, identity.refreshToken ?? null, identity.refreshClientId ?? null, now());
+  };
+  const noticeNewMethod = (email, provider) => {
+    const name = PROVIDER_NAMES[provider];
+    deliver("new_sign_in_method", email, `A new sign-in method was added: ${name}`, `${name} can now sign in to your PiNomad account, because it confirmed this email address.
+
+` + `If this wasn't you, sign in, remove ${name} under Sign-in methods, and sign out everywhere.
+`);
+  };
+  const pendingRow = (id) => db.prepare(`SELECT provider, subject, email, email_verified AS emailVerified, name, refresh_token AS refreshToken,
+                refresh_client_id AS refreshClientId, kind, binding_hash AS bindingHash, redirect_uri AS redirectUri,
+                code_challenge AS codeChallenge, client_state AS clientState
+         FROM oauth_pending WHERE id_hash = ? AND expires_at > ?`).get(sha256Hex(id), now());
+  const completionOf = (row) => row.kind === "web" ? { kind: "web", bindingHash: row.bindingHash ?? "" } : row.kind === "native" ? {
+    kind: "native",
+    bindingHash: row.bindingHash ?? "",
+    native: { redirectUri: row.redirectUri ?? "", codeChallenge: row.codeChallenge ?? "", state: row.clientState ?? "" }
+  } : { kind: "direct" };
+  const identityOf = (row) => ({
+    provider: row.provider,
+    subject: row.subject,
+    ...row.email === null ? {} : { email: row.email },
+    emailVerified: row.emailVerified === 1,
+    ...row.name === null ? {} : { name: row.name },
+    ...row.refreshToken === null || row.refreshClientId === null ? {} : { refreshToken: row.refreshToken, refreshClientId: row.refreshClientId }
+  });
+  const transaction = (write) => inTransaction(db, write);
+  const emailOwner = (email) => db.prepare("SELECT id FROM users WHERE email = ?").get(email)?.id;
+  const weakPassword = (password) => {
+    const length = [...password].length;
+    return length < MIN_PASSWORD_CODEPOINTS || length > MAX_PASSWORD_CODEPOINTS;
   };
-  const usernameTaken = (username) => db.prepare("SELECT 1 AS x FROM users WHERE lower(username) = ?").get(username) !== undefined;
   return {
     dbPath: join(options.dataDir, DB_FILE),
-    async login(username, password, ip, device) {
+    emailEnabled: mailer !== undefined,
+    registrationOpen,
+    async login(identifier, password, ip, device) {
       if (ipAttempts.hit(ip, limits.ipMaxAttempts, limits.ipWindowMs))
         return { status: "limited" };
-      if (userFailures.isOver(username, limits.userMaxFailures))
+      const user = findUser(identifier);
+      const lockKey = lockKeyFor(identifier, user);
+      if (userFailures.isOver(lockKey, limits.userMaxFailures))
         return { status: "limited" };
-      const user = db.prepare("SELECT id, username, password_hash AS passwordHash, admin FROM users WHERE username = ?").get(username);
       const outcome = await gate.run(async () => {
-        if (userFailures.isOver(username, limits.userMaxFailures))
+        if (userFailures.isOver(lockKey, limits.userMaxFailures))
           return "limited";
         const ok = await verifyPassword(password, user?.passwordHash ?? DUMMY_HASH);
-        if (!ok || user === undefined) {
-          userFailures.bump(username, limits.userWindowMs);
+        if (!ok || user === undefined || user.passwordHash === null) {
+          userFailures.bump(lockKey, limits.userWindowMs);
           return "invalid";
         }
         return user.id;
@@ -630,89 +919,187 @@ async function openAccounts(options) {
         return { status: "invalid" };
       db.exec("BEGIN IMMEDIATE");
       let session;
+      let current;
       try {
-        if (currentHash(outcome) === user?.passwordHash)
+        current = userById(outcome);
+        if (current !== undefined && current.passwordHash === user?.passwordHash)
           session = issueSession(outcome, device);
         db.exec("COMMIT");
       } catch (error) {
         db.exec("ROLLBACK");
         throw error;
       }
-      if (session === undefined)
+      if (session === undefined || current === undefined)
         return { status: "invalid" };
-      userFailures.reset(username);
-      return { status: "ok", ...session, admin: user?.admin === 1 };
+      userFailures.reset(lockKey);
+      return { status: "ok", ...session, user: accountUser(current) };
     },
-    async register({ invite, username, password, ip, device }) {
+    requestSignupCode({ email, ip }) {
+      if (!emailSignup)
+        return "closed";
+      if (!codeAllowed(ip, email))
+        return "limited";
+      if (emailOwner(email) !== undefined) {
+        deliver("signup_existing", email, "Your PiNomad account", `Someone asked to create a PiNomad account with this email, but you already have an account.
+
+` + `Sign in, or reset your password if you forgot it. If this wasn't you, ignore this email.
+`);
+        return "sent";
+      }
+      const code = issueCode("signup", email, null);
+      deliver("signup", email, `${code} is your PiNomad sign-up code`, `Your PiNomad sign-up code is ${code}. It expires in 10 minutes.
+
+If you didn't ask for it, ignore this email.
+`);
+      return "sent";
+    },
+    async register({ email, code, password, ip, device }) {
+      if (!emailSignup)
+        return { status: "refused", reason: "registration_closed" };
+      if (weakPassword(password))
+        return { status: "refused", reason: "weak_password" };
       if (ipAttempts.hit(ip, limits.ipMaxAttempts, limits.ipWindowMs))
         return { status: "limited" };
-      const codeHash = sha256Hex(invite);
-      const invited = inviteState(codeHash);
-      if (invited !== "ok")
-        return { status: "refused", reason: invited };
-      if (!SIGN_UP_USERNAME.test(username))
-        return { status: "refused", reason: "invalid_username" };
-      const length = [...password].length;
-      if (length < MIN_PASSWORD_CODEPOINTS || length > MAX_PASSWORD_CODEPOINTS) {
-        return { status: "refused", reason: "weak_password" };
-      }
-      if (usernameTaken(username))
-        return { status: "refused", reason: "username_taken" };
+      const lockKey = lockKeyFor(email, findUser(email));
+      if (userFailures.isOver(lockKey, limits.userMaxFailures))
+        return { status: "limited" };
       const hash = await gate.run(() => hashPassword(password));
       if (hash === undefined)
         return { status: "limited" };
-      db.exec("BEGIN");
+      db.exec("BEGIN IMMEDIATE");
       try {
-        const again = inviteState(codeHash);
-        const failure = again !== "ok" ? again : usernameTaken(username) ? "username_taken" : undefined;
-        if (failure !== undefined) {
-          db.exec("ROLLBACK");
-          return { status: "refused", reason: failure };
-        }
-        const userId = Number(db.prepare("INSERT INTO users (username, password_hash, created_at) VALUES (?, ?, ?)").run(username, hash, now()).lastInsertRowid);
-        const claimed = db.prepare("UPDATE invites SET used_at = ?, used_by = ? WHERE code_hash = ? AND used_at IS NULL").run(now(), userId, codeHash);
-        if (Number(claimed.changes) !== 1) {
-          db.exec("ROLLBACK");
-          return { status: "refused", reason: "invalid_invite" };
+        if (!spendCode("signup", email, code, lockKey) || emailOwner(email) !== undefined) {
+          db.exec("COMMIT");
+          return { status: "refused", reason: "invalid_code" };
         }
+        const at = now();
+        const userId = Number(db.prepare("INSERT INTO users (email, email_verified_at, password_hash, created_at) VALUES (?, ?, ?, ?)").run(email, at, hash, at).lastInsertRowid);
         const session = issueSession(userId, device);
         db.exec("COMMIT");
-        return { status: "ok", ...session };
+        userFailures.reset(lockKey);
+        return { status: "ok", ...session, user: { username: email, email } };
       } catch (error) {
         db.exec("ROLLBACK");
         throw error;
       }
     },
-    createInvite(userId) {
-      db.prepare("DELETE FROM invites WHERE used_at IS NULL AND expires_at <= ?").run(now());
-      const code = randomBytes(16).toString("base64url");
-      const expiresAt = now() + INVITE_TTL_MS;
-      db.prepare("INSERT INTO invites (code_hash, created_by, created_at, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(code), userId, now(), expiresAt);
-      return { code, expiresAt };
-    },
-    listInvites() {
-      const rows = db.prepare(`SELECT i.id AS id, i.created_at AS createdAt, i.expires_at AS expiresAt, i.used_at AS usedAt, u.username AS usedBy
-           FROM invites i LEFT JOIN users u ON u.id = i.used_by ORDER BY i.created_at DESC, i.id DESC`).all();
-      return rows.map((row) => ({
-        id: row.id,
-        createdAt: row.createdAt,
-        expiresAt: row.expiresAt,
-        ...row.usedAt === null ? {} : { usedAt: row.usedAt },
-        ...row.usedBy === null ? {} : { usedBy: row.usedBy }
-      }));
+    requestPasswordReset({ email, ip }) {
+      if (mailer === undefined)
+        return "closed";
+      if (!codeAllowed(ip, email))
+        return "limited";
+      const userId = emailOwner(email);
+      if (userId === undefined)
+        return "sent";
+      const code = issueCode("reset", email, userId);
+      deliver("reset", email, `${code} is your PiNomad password reset code`, `Your PiNomad password reset code is ${code}. It expires in 10 minutes.
+
+` + `If you didn't ask to reset your password, ignore this email; your password stays as it is.
+`);
+      return "sent";
+    },
+    async resetPasswordWithCode({ email, code, password, ip }) {
+      if (mailer === undefined)
+        return { status: "refused", reason: "email_unavailable" };
+      if (weakPassword(password))
+        return { status: "refused", reason: "weak_password" };
+      if (ipAttempts.hit(ip, limits.ipMaxAttempts, limits.ipWindowMs))
+        return { status: "limited" };
+      const lockKey = lockKeyFor(email, findUser(email));
+      if (userFailures.isOver(lockKey, limits.userMaxFailures))
+        return { status: "limited" };
+      const hash = await gate.run(() => hashPassword(password));
+      if (hash === undefined)
+        return { status: "limited" };
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const userId = emailOwner(email);
+        if (userId === undefined || !spendCode("reset", email, code, lockKey, userId)) {
+          if (userId === undefined)
+            userFailures.bump(lockKey, limits.userWindowMs);
+          db.exec("COMMIT");
+          return { status: "refused", reason: "invalid_code" };
+        }
+        db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(hash, userId);
+        dropCredentials(db, userId);
+        db.exec("COMMIT");
+        userFailures.reset(lockKey);
+        return { status: "ok" };
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    },
+    async requestEmailCode(args) {
+      const { userId, email, ip } = args;
+      if (mailer === undefined)
+        return "closed";
+      const checked = await confirmAccount(userId, args);
+      if (typeof checked === "string")
+        return checked;
+      const owner = emailOwner(email);
+      if (owner !== undefined && owner !== userId)
+        return "taken";
+      if (!codeAllowed(ip, email))
+        return "limited";
+      const code = issueCode("add_email", email, userId);
+      deliver("add_email", email, `${code} is your PiNomad confirmation code`, `Your code to use this email for your PiNomad account is ${code}. It expires in 10 minutes.
+
+` + `If you didn't ask for it, ignore this email.
+`);
+      return "sent";
     },
-    revokeInvite(id) {
-      return Number(db.prepare("DELETE FROM invites WHERE id = ? AND used_at IS NULL").run(id).changes) > 0;
+    async setEmail(args) {
+      const { userId, email, code } = args;
+      if (mailer === undefined)
+        return { status: "refused", reason: "email_unavailable" };
+      const checked = await confirmAccount(userId, args);
+      if (checked === "limited")
+        return { status: "limited" };
+      if (typeof checked === "string")
+        return { status: "refused", reason: checked };
+      const lockKey = accountLockKey(userId);
+      let previous;
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const user = userById(userId);
+        const stale = user === undefined ? "wrong_password" : stillConfirmed(userId, checked);
+        if (user === undefined || stale !== undefined) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: stale ?? "wrong_password" };
+        }
+        const owner = emailOwner(email);
+        if (owner !== undefined && owner !== userId) {
+          db.exec("COMMIT");
+          return { status: "refused", reason: "email_taken" };
+        }
+        if (!spendCode("add_email", email, code, lockKey, userId)) {
+          db.exec("COMMIT");
+          return { status: "refused", reason: "invalid_code" };
+        }
+        db.prepare("UPDATE users SET email = ?, email_verified_at = ? WHERE id = ?").run(email, now(), userId);
+        previous = user.email;
+        db.exec("COMMIT");
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+      if (previous !== null && previous !== undefined && previous !== email) {
+        deliver("email_changed", previous, "Your PiNomad email was changed", `The email of your PiNomad account was changed to ${email}.
+
+` + "If this wasn't you, someone else has your password and now controls the account's email. " + `Contact your server's operator.
+`);
+      }
+      return { status: "ok", user: { username: email, email } };
     },
     authenticate(token) {
-      const row = db.prepare(`SELECT s.user_id AS userId, u.username AS username, u.admin AS admin, s.expires_at AS expiresAt, s.device_id AS deviceId
+      const row = db.prepare(`SELECT s.user_id AS userId, u.username AS username, u.email AS email, s.expires_at AS expiresAt, s.device_id AS deviceId
            FROM sessions s JOIN users u ON u.id = s.user_id WHERE s.token_hash = ?`).get(sha256Hex(token));
       if (row === undefined || row.expiresAt <= now())
         return;
       return {
         userId: row.userId,
-        username: row.username,
-        admin: row.admin === 1,
+        user: accountUser(row),
         ...row.deviceId === null ? {} : { deviceId: row.deviceId }
       };
     },
@@ -734,26 +1121,26 @@ async function openAccounts(options) {
         throw error;
       }
     },
-    async changePassword({ userId, username, keepToken, currentPassword, newPassword }) {
-      const length = [...newPassword].length;
-      if (length < MIN_PASSWORD_CODEPOINTS || length > MAX_PASSWORD_CODEPOINTS) {
+    async changePassword(args) {
+      const { userId, keepToken, newPassword } = args;
+      if (weakPassword(newPassword))
         return { status: "refused", reason: "weak_password" };
-      }
-      const checked = await checkPassword(userId, username, currentPassword);
+      const checked = await confirmAccount(userId, "reauth" in args ? { reauth: args.reauth, token: keepToken } : { password: args.currentPassword });
       if (checked === "limited")
         return { status: "limited" };
-      if (checked === "wrong_password")
-        return { status: "refused", reason: "wrong_password" };
+      if (typeof checked === "string")
+        return { status: "refused", reason: checked };
       const hash = await gate.run(() => hashPassword(newPassword));
       if (hash === undefined)
         return { status: "limited" };
       db.exec("BEGIN IMMEDIATE");
       try {
-        const swapped = db.prepare("UPDATE users SET password_hash = ? WHERE id = ? AND password_hash = ?").run(hash, userId, checked.verifiedHash);
-        if (Number(swapped.changes) !== 1) {
+        const stale = "verifiedHash" in checked && !sessionLive(userId, keepToken) ? "unauthenticated" : stillConfirmed(userId, checked);
+        if (stale !== undefined) {
           db.exec("ROLLBACK");
-          return { status: "refused", reason: "wrong_password" };
+          return { status: "refused", reason: stale };
         }
+        db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(hash, userId);
         dropCredentials(db, userId, sha256Hex(keepToken));
         db.exec("COMMIT");
       } catch (error) {
@@ -762,30 +1149,283 @@ async function openAccounts(options) {
       }
       return { status: "ok" };
     },
-    async deleteAccount({ userId, username, password }) {
-      const user = db.prepare("SELECT admin FROM users WHERE id = ?").get(userId);
-      if (user?.admin === 1)
-        return { status: "refused", reason: "admin_account" };
-      const checked = await checkPassword(userId, username, password);
+    async deleteAccount(args) {
+      const { userId, keepToken } = args;
+      const checked = await confirmAccount(userId, args);
       if (checked === "limited")
         return { status: "limited" };
-      if (checked === "wrong_password")
-        return { status: "refused", reason: "wrong_password" };
+      if (typeof checked === "string")
+        return { status: "refused", reason: checked };
       db.exec("BEGIN IMMEDIATE");
       try {
-        const hostIds = db.prepare("SELECT host_id AS hostId FROM hosts WHERE user_id = ?").all(userId).map((row) => row.hostId);
-        const deleted = db.prepare("DELETE FROM users WHERE id = ? AND password_hash = ?").run(userId, checked.verifiedHash);
-        if (Number(deleted.changes) !== 1) {
+        const stale = "verifiedHash" in checked && !sessionLive(userId, keepToken) ? "unauthenticated" : stillConfirmed(userId, checked);
+        if (stale !== undefined) {
           db.exec("ROLLBACK");
-          return { status: "refused", reason: "wrong_password" };
+          return { status: "refused", reason: stale };
         }
+        const hostIds = db.prepare("SELECT host_id AS hostId FROM hosts WHERE user_id = ?").all(userId).map((row) => row.hostId);
+        const grants = appleGrants(userId);
+        db.prepare("DELETE FROM users WHERE id = ?").run(userId);
         db.exec("COMMIT");
-        return { status: "ok", hostIds };
+        return { status: "ok", hostIds, appleGrants: grants };
       } catch (error) {
         db.exec("ROLLBACK");
         throw error;
       }
     },
+    async confirm(userId, confirmation) {
+      const checked = await confirmAccount(userId, confirmation);
+      return typeof checked === "string" ? checked : "ok";
+    },
+    requestReauthCode({ userId, ip }) {
+      if (mailer === undefined)
+        return "closed";
+      const email = userById(userId)?.email ?? null;
+      if (email === null)
+        return "no_email";
+      if (!codeAllowed(ip, email))
+        return "limited";
+      const code = issueCode("reauth", email, userId);
+      deliver("reauth", email, `${code} is your PiNomad confirmation code`, `Your code to confirm a change to your PiNomad account is ${code}. It expires in 10 minutes.
+
+` + `If you didn't ask for it, someone else may be signed in to your account: sign out everywhere.
+`);
+      return "sent";
+    },
+    async grantReauth(args) {
+      const { userId, token } = args;
+      const lockKey = accountLockKey(userId);
+      if ("password" in args) {
+        const checked = await checkPassword(userId, args.password);
+        if (checked === "limited")
+          return { status: "limited" };
+        if (checked === "wrong_password")
+          return { status: "refused", reason: "wrong_password" };
+      } else {
+        if (userFailures.isOver(lockKey, limits.userMaxFailures))
+          return { status: "limited" };
+        const email = userById(userId)?.email ?? null;
+        const spent = email !== null && transaction(() => spendCode("reauth", email, args.code, lockKey, userId));
+        if (!spent) {
+          if (email === null)
+            userFailures.bump(lockKey, limits.userWindowMs);
+          return { status: "refused", reason: "invalid_code" };
+        }
+      }
+      const reauth = randomBytes(32).toString("base64url");
+      const at = now();
+      const expiresAt = at + REAUTH_TTL_MS;
+      const granted = transaction(() => {
+        db.prepare("DELETE FROM reauth_grants WHERE expires_at <= ?").run(at);
+        return db.prepare(`INSERT INTO reauth_grants (grant_hash, session_hash, expires_at)
+             SELECT ?, token_hash, ? FROM sessions WHERE token_hash = ? AND user_id = ? AND expires_at > ?`).run(sha256Hex(reauth), expiresAt, sha256Hex(token), userId, at).changes;
+      });
+      return Number(granted) === 1 ? { status: "ok", reauth, expiresAt } : { status: "refused", reason: "unauthenticated" };
+    },
+    startOAuthFlow({ provider, kind, ip, bindingHash, native, linkUserId, linkSessionToken }) {
+      if (oauthStarts.hit(ip, oauthLimits.startMaxPerIp, oauthLimits.startWindowMs))
+        return { status: "limited" };
+      const at = now();
+      db.prepare("DELETE FROM oauth_flows WHERE expires_at <= ?").run(at);
+      const live = db.prepare("SELECT COUNT(*) AS n FROM oauth_flows").get().n;
+      if (live >= oauthLimits.maxPending)
+        return { status: "busy" };
+      const state = randomBytes(32).toString("base64url");
+      const verifier = randomBytes(32).toString("base64url");
+      const nonce = randomBytes(16).toString("base64url");
+      db.prepare(`INSERT INTO oauth_flows (state_hash, provider, kind, verifier, nonce, binding_hash, redirect_uri, code_challenge, client_state,
+                                  link_user_id, link_session_hash, created_at, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(sha256Hex(state), provider, kind, verifier, nonce, bindingHash ?? null, native?.redirectUri ?? null, native?.codeChallenge ?? null, native?.state ?? null, linkUserId ?? null, linkSessionToken === undefined ? null : sha256Hex(linkSessionToken), at, at + OAUTH_FLOW_TTL_MS);
+      return { status: "ok", state, verifier, nonce };
+    },
+    startNativeLink({ provider, ticket, bindingHash, ip }) {
+      if (oauthStarts.hit(ip, oauthLimits.startMaxPerIp, oauthLimits.startWindowMs))
+        return { status: "limited" };
+      const state = randomBytes(32).toString("base64url");
+      const row = db.prepare(`UPDATE oauth_flows SET state_hash = ?, binding_hash = ?
+           WHERE binding_hash = ? AND provider = ? AND kind = 'link' AND redirect_uri IS NOT NULL AND expires_at > ?
+           RETURNING verifier, nonce`).get(sha256Hex(state), bindingHash, sha256Hex(ticket), provider, now());
+      return row === undefined ? undefined : { status: "ok", state, verifier: row.verifier, nonce: row.nonce };
+    },
+    takeOAuthFlow(provider, state) {
+      const hash = sha256Hex(state);
+      const row = db.prepare(`SELECT provider, kind, verifier, nonce, binding_hash AS bindingHash, redirect_uri AS redirectUri, code_challenge AS codeChallenge,
+                  client_state AS clientState, link_user_id AS linkUserId, link_session_hash AS linkSessionHash, expires_at AS expiresAt
+           FROM oauth_flows WHERE state_hash = ?`).get(hash);
+      if (row !== undefined)
+        db.prepare("DELETE FROM oauth_flows WHERE state_hash = ?").run(hash);
+      if (row === undefined || row.expiresAt <= now() || row.provider !== provider)
+        return;
+      return {
+        provider: row.provider,
+        kind: row.kind,
+        verifier: row.verifier,
+        nonce: row.nonce,
+        ...row.bindingHash === null ? {} : { bindingHash: row.bindingHash },
+        ...row.redirectUri === null || row.codeChallenge === null ? {} : { native: { redirectUri: row.redirectUri, codeChallenge: row.codeChallenge, state: row.clientState ?? "" } },
+        ...row.linkUserId === null ? {} : { linkUserId: row.linkUserId },
+        ...row.linkSessionHash === null ? {} : { linkSessionHash: row.linkSessionHash }
+      };
+    },
+    resolveIdentity(identity, completion) {
+      const result = transaction(() => {
+        const bound = identityOwner(identity.provider, identity.subject);
+        if (bound !== undefined) {
+          bindIdentity(bound, identity);
+          return { status: "user", userId: bound };
+        }
+        if (identity.emailVerified && identity.email !== undefined) {
+          const owner = db.prepare("SELECT id FROM users WHERE email = ? AND email_verified_at IS NOT NULL").get(identity.email);
+          if (owner !== undefined) {
+            bindIdentity(owner.id, identity);
+            return { status: "user", userId: owner.id, notify: identity.email };
+          }
+        }
+        if (!registrationOpen)
+          return { status: "refused", reason: "registration_closed" };
+        const id = randomBytes(32).toString("base64url");
+        const at = now();
+        db.prepare("DELETE FROM oauth_pending WHERE expires_at <= ?").run(at);
+        db.prepare(`INSERT INTO oauth_pending (id_hash, provider, subject, email, email_verified, name, refresh_token, refresh_client_id,
+                                      kind, binding_hash, redirect_uri, code_challenge, client_state, created_at, expires_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(sha256Hex(id), identity.provider, identity.subject, identity.email ?? null, identity.emailVerified ? 1 : 0, identity.name ?? null, identity.refreshToken ?? null, identity.refreshClientId ?? null, completion.kind, completion.kind === "direct" ? null : completion.bindingHash, completion.kind === "native" ? completion.native.redirectUri : null, completion.kind === "native" ? completion.native.codeChallenge : null, completion.kind === "native" ? completion.native.state : null, at, at + OAUTH_PENDING_TTL_MS);
+        return { status: "pending", id, ...identity.email === undefined ? {} : { email: identity.email } };
+      });
+      if (result.notify !== undefined)
+        noticeNewMethod(result.notify, identity.provider);
+      const { notify: _notify, ...answer } = result;
+      return answer;
+    },
+    linkIdentity: (flow, identity) => linkIdentity(flow, identity),
+    pendingSignIn(id) {
+      const row = pendingRow(id);
+      if (row === undefined)
+        return;
+      return {
+        provider: row.provider,
+        ...row.email === null ? {} : { email: row.email },
+        ...row.name === null ? {} : { name: row.name },
+        completion: completionOf(row)
+      };
+    },
+    async createFromPending(id, password) {
+      if (password === undefined && mailer === undefined)
+        return { status: "refused", reason: "password_required" };
+      if (password !== undefined && weakPassword(password))
+        return { status: "refused", reason: "weak_password" };
+      const hash = password === undefined ? null : await gate.run(() => hashPassword(password));
+      if (hash === undefined)
+        return { status: "limited" };
+      return transaction(() => {
+        const row = pendingRow(id);
+        if (row === undefined)
+          return { status: "refused", reason: "not_found" };
+        if (!registrationOpen)
+          return { status: "refused", reason: "registration_closed" };
+        if (row.email === null || row.emailVerified !== 1)
+          return { status: "refused", reason: "no_verified_email" };
+        if (emailOwner(row.email) !== undefined)
+          return { status: "refused", reason: "email_taken" };
+        if (identityOwner(row.provider, row.subject) !== undefined)
+          return { status: "refused", reason: "identity_taken" };
+        const at = now();
+        const userId = Number(db.prepare("INSERT INTO users (email, email_verified_at, password_hash, created_at) VALUES (?, ?, ?, ?)").run(row.email, at, hash, at).lastInsertRowid);
+        bindIdentity(userId, identityOf(row));
+        db.prepare("DELETE FROM oauth_pending WHERE id_hash = ?").run(sha256Hex(id));
+        return { status: "ok", userId, completion: completionOf(row) };
+      });
+    },
+    linkPending(id, userId) {
+      return transaction(() => {
+        const row = pendingRow(id);
+        if (row === undefined)
+          return { status: "refused", reason: "not_found" };
+        const bound = identityOwner(row.provider, row.subject);
+        if (bound !== undefined && bound !== userId)
+          return { status: "refused", reason: "identity_taken" };
+        bindIdentity(userId, identityOf(row));
+        db.prepare("DELETE FROM oauth_pending WHERE id_hash = ?").run(sha256Hex(id));
+        return { status: "ok", userId, completion: completionOf(row) };
+      });
+    },
+    signIn(userId, device) {
+      return transaction(() => {
+        const user = userById(userId);
+        return user === undefined ? undefined : { ...issueSession(userId, device), user: accountUser(user) };
+      });
+    },
+    issueLinkCode({ identity, linkUserId, linkSessionHash, codeChallenge }) {
+      const at = now();
+      const live = db.prepare("SELECT 1 AS x FROM sessions WHERE token_hash = ? AND user_id = ? AND expires_at > ?").get(linkSessionHash, linkUserId, at);
+      if (live === undefined)
+        return "session_ended";
+      for (const [hash, entry] of linkCodes)
+        if (entry.expiresAt <= at)
+          linkCodes.delete(hash);
+      if (linkCodes.size >= oauthLimits.maxPending)
+        linkCodes.delete(linkCodes.keys().next().value);
+      const code = randomBytes(32).toString("base64url");
+      linkCodes.set(sha256Hex(code), { identity, linkUserId, linkSessionHash, codeChallenge, expiresAt: at + OAUTH_CODE_TTL_MS });
+      return { code };
+    },
+    completeLink({ code, codeVerifier, token }) {
+      const hash = sha256Hex(code);
+      const entry = linkCodes.get(hash);
+      linkCodes.delete(hash);
+      if (entry === undefined || entry.expiresAt <= now() || !safeEqual(sha256Hex(token), entry.linkSessionHash) || !safeEqual(createHash("sha256").update(codeVerifier).digest("base64url"), entry.codeChallenge)) {
+        return "invalid_grant";
+      }
+      return linkIdentity({ linkUserId: entry.linkUserId, linkSessionHash: entry.linkSessionHash }, entry.identity);
+    },
+    issueOAuthCode(userId, codeChallenge) {
+      const code = randomBytes(32).toString("base64url");
+      const at = now();
+      db.prepare("DELETE FROM oauth_codes WHERE expires_at <= ?").run(at);
+      db.prepare("INSERT INTO oauth_codes (code_hash, user_id, code_challenge, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(code), userId, codeChallenge, at + OAUTH_CODE_TTL_MS);
+      return code;
+    },
+    exchangeOAuthCode(code, codeVerifier, device) {
+      const hash = sha256Hex(code);
+      return transaction(() => {
+        const row = db.prepare("SELECT user_id AS userId, code_challenge AS challenge, expires_at AS expiresAt FROM oauth_codes WHERE code_hash = ?").get(hash);
+        if (row === undefined)
+          return;
+        db.prepare("DELETE FROM oauth_codes WHERE code_hash = ?").run(hash);
+        if (row.expiresAt <= now() || !safeEqual(createHash("sha256").update(codeVerifier).digest("base64url"), row.challenge))
+          return;
+        const user = userById(row.userId);
+        return user === undefined ? undefined : { ...issueSession(row.userId, device), user: accountUser(user) };
+      });
+    },
+    listIdentities(userId) {
+      const rows = db.prepare("SELECT provider, email, created_at AS createdAt FROM user_identities WHERE user_id = ? ORDER BY created_at, provider").all(userId);
+      return {
+        identities: rows.map((row) => ({ provider: row.provider, ...row.email === null ? {} : { email: row.email }, createdAt: row.createdAt })),
+        hasPassword: (userById(userId)?.passwordHash ?? null) !== null
+      };
+    },
+    async removeIdentity(args) {
+      const { userId, provider } = args;
+      const checked = await confirmAccount(userId, args);
+      if (checked === "limited")
+        return { status: "limited" };
+      if (typeof checked === "string")
+        return { status: "refused", reason: checked };
+      return transaction(() => {
+        const stale = stillConfirmed(userId, checked);
+        if (stale !== undefined)
+          return { status: "refused", reason: stale };
+        const counts = db.prepare("SELECT SUM(provider = ?) AS mine, SUM(provider <> ?) AS others FROM user_identities WHERE user_id = ?").get(provider, provider, userId);
+        if ((counts.mine ?? 0) === 0)
+          return { status: "refused", reason: "not_found" };
+        if ((counts.others ?? 0) === 0 && (userById(userId)?.passwordHash ?? null) === null) {
+          return { status: "refused", reason: "last_method" };
+        }
+        const grants = provider === "apple" ? appleGrants(userId) : [];
+        db.prepare("DELETE FROM user_identities WHERE user_id = ? AND provider = ?").run(userId, provider);
+        return { status: "ok", appleGrants: grants };
+      });
+    },
     revokeAllSessions(userId) {
       db.exec("BEGIN");
       try {
@@ -923,14 +1563,14 @@ async function openAccounts(options) {
       return settleHostLink(args, "denied");
     },
     exchangeHostLinkCode(code, codeVerifier) {
-      const codeHash = sha256Hex(code);
+      const codeHash2 = sha256Hex(code);
       const at = now();
       db.exec("BEGIN IMMEDIATE");
       try {
         const row = db.prepare(`SELECT host_id AS hostId, user_id AS userId, code_challenge AS challenge, auth_code_expires_at AS codeExpiresAt
-             FROM host_link_requests WHERE auth_code_hash = ? AND state = 'confirmed'`).get(codeHash);
+             FROM host_link_requests WHERE auth_code_hash = ? AND state = 'confirmed'`).get(codeHash2);
         if (row !== undefined)
-          db.prepare("DELETE FROM host_link_requests WHERE auth_code_hash = ?").run(codeHash);
+          db.prepare("DELETE FROM host_link_requests WHERE auth_code_hash = ?").run(codeHash2);
         const valid = row !== undefined && row.userId !== null && row.challenge !== null && row.codeExpiresAt !== null && row.codeExpiresAt > at && safeEqual(createHash("sha256").update(codeVerifier).digest("base64url"), row.challenge);
         const result = valid ? { status: "ok", ...mintJoinToken(row.userId, row.hostId) } : { status: "invalid" };
         db.exec("COMMIT");
@@ -976,9 +1616,9 @@ async function openAccounts(options) {
              joined_at = excluded.joined_at,
              last_seen_at = excluded.last_seen_at`).run(hostId, row.userId, noisePublicKey, hostName, at, at);
         db.prepare("DELETE FROM removed_hosts WHERE host_id = ?").run(hostId);
-        const user = db.prepare("SELECT username FROM users WHERE id = ?").get(row.userId);
+        const user = userById(row.userId);
         db.exec("COMMIT");
-        return { status: "joined", username: user?.username ?? "unknown" };
+        return { status: "joined", username: user === undefined ? "unknown" : accountUser(user).username };
       } catch (error) {
         db.exec("ROLLBACK");
         throw error;
@@ -987,20 +1627,22 @@ async function openAccounts(options) {
     leaveHost(hostId) {
       return Number(db.prepare("DELETE FROM hosts WHERE host_id = ?").run(hostId).changes) > 0;
     },
-    async removeHost({ userId, username, password, hostId }) {
+    async removeHost(args) {
+      const { userId, hostId } = args;
       const owned = () => db.prepare("SELECT 1 AS x FROM hosts WHERE host_id = ? AND user_id = ?").get(hostId, userId) !== undefined;
       if (!owned())
         return { status: "refused", reason: "not_found" };
-      const checked = await checkPassword(userId, username, password);
+      const checked = await confirmAccount(userId, args);
       if (checked === "limited")
         return { status: "limited" };
-      if (checked === "wrong_password")
-        return { status: "refused", reason: "wrong_password" };
+      if (typeof checked === "string")
+        return { status: "refused", reason: checked };
       db.exec("BEGIN IMMEDIATE");
       try {
-        if (currentHash(userId) !== checked.verifiedHash) {
+        const stale = stillConfirmed(userId, checked);
+        if (stale !== undefined) {
           db.exec("ROLLBACK");
-          return { status: "refused", reason: "wrong_password" };
+          return { status: "refused", reason: stale };
         }
         if (!owned()) {
           db.exec("ROLLBACK");
@@ -1097,22 +1739,24 @@ async function openAccounts(options) {
     confirmRevocation(hostId, publicKey) {
       db.prepare("DELETE FROM pending_revocations WHERE host_id = ? AND public_key = ?").run(hostId, publicKey);
     },
-    async kickDevice({ userId, username, password, deviceId, currentDeviceId }) {
+    async kickDevice(args) {
+      const { userId, deviceId, currentDeviceId } = args;
       const owned = () => db.prepare("SELECT 1 AS x FROM account_devices WHERE id = ? AND user_id = ?").get(deviceId, userId) !== undefined;
       if (!owned())
         return { status: "refused", reason: "not_found" };
       if (deviceId === currentDeviceId)
         return { status: "refused", reason: "current_device" };
-      const checked = await checkPassword(userId, username, password);
+      const checked = await confirmAccount(userId, args);
       if (checked === "limited")
         return { status: "limited" };
-      if (checked === "wrong_password")
-        return { status: "refused", reason: "wrong_password" };
+      if (typeof checked === "string")
+        return { status: "refused", reason: checked };
       db.exec("BEGIN IMMEDIATE");
       try {
-        if (currentHash(userId) !== checked.verifiedHash) {
+        const stale = stillConfirmed(userId, checked);
+        if (stale !== undefined) {
           db.exec("ROLLBACK");
-          return { status: "refused", reason: "wrong_password" };
+          return { status: "refused", reason: stale };
         }
         if (!owned()) {
           db.exec("ROLLBACK");
@@ -1143,43 +1787,82 @@ function dropCredentials(db, userId, keepTokenHash) {
   db.prepare("DELETE FROM join_tokens WHERE user_id = ? AND used_at IS NULL").run(userId);
   db.prepare("DELETE FROM host_link_requests WHERE user_id = ?").run(userId);
   db.prepare("DELETE FROM push_tokens WHERE user_id = ?").run(userId);
+  db.prepare("DELETE FROM email_codes WHERE user_id = ?").run(userId);
 }
-async function resetPassword(options) {
-  assertPasswordPolicy(options.password);
-  await mkdir(options.dataDir, { recursive: true });
-  const release = await lockDataDir(options.dataDir, { retries: 0 }).catch((error) => {
+async function withOperatorDatabase(dataDir, write) {
+  await mkdir(dataDir, { recursive: true });
+  const release = await lockDataDir(dataDir, { retries: 0 }).catch((error) => {
     if (isDataDirInUse(error))
       return;
     throw error;
   });
-  const db = openDatabase(options.dataDir);
+  const db = openDatabase(dataDir);
   try {
     if (release !== undefined) {
       migrate(db);
     } else if (schemaVersion(db) !== SCHEMA_VERSION) {
       throw new Error(`the running server's database schema (${schemaVersion(db)}) differs from this build's (${SCHEMA_VERSION}); restart the server on this version first`);
     }
-    const hash = await hashPassword(options.password);
-    db.exec("BEGIN IMMEDIATE");
-    try {
-      const users = options.user === undefined ? db.prepare("SELECT id FROM users").all() : db.prepare("SELECT id FROM users WHERE username = ?").all(options.user);
-      if (users.length === 0)
-        throw new Error(options.user === undefined ? "no account exists yet" : `no such account: ${options.user}`);
-      if (users.length > 1)
-        throw new Error("more than one account exists — pass --user");
-      const userId = users[0].id;
-      db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(hash, userId);
-      dropCredentials(db, userId);
-      db.exec("COMMIT");
-    } catch (error) {
-      db.exec("ROLLBACK");
-      throw error;
-    }
+    return await write(db);
   } finally {
     db.close();
     await release?.();
   }
 }
+function inTransaction(db, write) {
+  db.exec("BEGIN IMMEDIATE");
+  try {
+    const result = write();
+    db.exec("COMMIT");
+    return result;
+  } catch (error) {
+    db.exec("ROLLBACK");
+    throw error;
+  }
+}
+function operatorTarget(db, user) {
+  const users = user === undefined ? db.prepare("SELECT id FROM users").all() : db.prepare("SELECT id FROM users WHERE email = ? OR username = ?").all(normalizeEmail(user) ?? null, user);
+  if (users.length === 0)
+    throw new Error(user === undefined ? "no account exists yet" : `no such account: ${user}`);
+  if (users.length > 1)
+    throw new Error(user === undefined ? "more than one account exists — pass --user" : `${user} names more than one account`);
+  return users[0].id;
+}
+async function resetPassword(options) {
+  assertPasswordPolicy(options.password);
+  await withOperatorDatabase(options.dataDir, async (db) => {
+    const hash = await hashPassword(options.password);
+    inTransaction(db, () => {
+      const userId = operatorTarget(db, options.user);
+      db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(hash, userId);
+      dropCredentials(db, userId);
+    });
+  });
+}
+async function addUser(options) {
+  const email = requireEmail(options.email);
+  assertPasswordPolicy(options.password);
+  await withOperatorDatabase(options.dataDir, async (db) => {
+    const hash = await hashPassword(options.password);
+    inTransaction(db, () => {
+      if (db.prepare("SELECT 1 AS x FROM users WHERE email = ?").get(email) !== undefined) {
+        throw new Error(`an account with ${email} already exists`);
+      }
+      const at = Date.now();
+      db.prepare("INSERT INTO users (email, email_verified_at, password_hash, created_at) VALUES (?, ?, ?, ?)").run(email, at, hash, at);
+    });
+  });
+}
+async function setUserEmail(options) {
+  const email = requireEmail(options.email);
+  await withOperatorDatabase(options.dataDir, (db) => inTransaction(db, () => {
+    const userId = operatorTarget(db, options.user);
+    const owner = db.prepare("SELECT id FROM users WHERE email = ?").get(email);
+    if (owner !== undefined && owner.id !== userId)
+      throw new Error(`another account already has ${email}`);
+    db.prepare("UPDATE users SET email = ?, email_verified_at = ? WHERE id = ?").run(email, Date.now(), userId);
+  }));
+}
 
 // apps/server/src/apns.ts
 import { createPrivateKey, sign } from "node:crypto";
@@ -1405,41 +2088,382 @@ function openApns(config) {
   };
 }
 
-// apps/server/src/relay.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { once } from "node:events";
-import { createServer } from "node:http";
-import { WebSocket, WebSocketServer } from "ws";
+// apps/server/src/mail.ts
+import { createTransport } from "nodemailer";
+function loadMailer(env = process.env) {
+  const url = env.PINOMAD_SERVER_SMTP_URL;
+  const from = env.PINOMAD_SERVER_MAIL_FROM;
+  if (url === undefined && from === undefined)
+    return;
+  if (url === undefined || from === undefined) {
+    throw new Error("PINOMAD_SERVER_SMTP_URL and PINOMAD_SERVER_MAIL_FROM go together");
+  }
+  const transport = createTransport({ url, ...url.startsWith("smtp:") ? { requireTLS: true } : {} });
+  return {
+    async send(to, subject, text) {
+      await transport.sendMail({ from, to, subject, text });
+    }
+  };
+}
 
-// apps/server/src/relay-limits.ts
-var DEFAULT_RELAY_LIMITS = {
-  perHost: 64,
-  perAccount: 256,
-  unauthenticatedPerHost: 32,
-  handshakeTimeoutMs: 30000,
-  handshakeBytes: 64 * 1024,
-  accountBytesPerSecond: 4 * 1024 * 1024,
-  accountBurstBytes: 1024 * 1024 * 1024
-};
-var RELAY_LIMIT_OPTIONS = [
-  { field: "perHost", flag: "relay-max-per-host", env: "PINOMAD_SERVER_RELAY_MAX_PER_HOST", unit: "count" },
-  { field: "perAccount", flag: "relay-max-per-account", env: "PINOMAD_SERVER_RELAY_MAX_PER_ACCOUNT", unit: "count" },
-  {
-    field: "unauthenticatedPerHost",
-    flag: "relay-max-unauthenticated-per-host",
-    env: "PINOMAD_SERVER_RELAY_MAX_UNAUTHENTICATED_PER_HOST",
-    unit: "count"
+// apps/server/src/oauth.ts
+import { createHash as createHash2, createPrivateKey as createPrivateKey2, createPublicKey, sign as sign2, verify } from "node:crypto";
+var OAUTH_PROVIDERS = ["google", "github", "apple"];
+var DEFAULT_ENDPOINTS = {
+  google: {
+    authorize: "https://accounts.google.com/o/oauth2/v2/auth",
+    token: "https://oauth2.googleapis.com/token",
+    jwks: "https://www.googleapis.com/oauth2/v3/certs",
+    issuer: "https://accounts.google.com"
   },
-  { field: "handshakeTimeoutMs", flag: "relay-handshake-timeout", env: "PINOMAD_SERVER_RELAY_HANDSHAKE_TIMEOUT", unit: "seconds" },
-  { field: "handshakeBytes", flag: "relay-handshake-bytes", env: "PINOMAD_SERVER_RELAY_HANDSHAKE_BYTES", unit: "bytes" },
-  { field: "accountBytesPerSecond", flag: "relay-account-rate", env: "PINOMAD_SERVER_RELAY_ACCOUNT_RATE", unit: "bytes" },
-  { field: "accountBurstBytes", flag: "relay-account-burst", env: "PINOMAD_SERVER_RELAY_ACCOUNT_BURST", unit: "bytes" }
-];
-var BYTE_SUFFIX = { "": 1, k: 1024, m: 1024 ** 2, g: 1024 ** 3 };
-function readRelayLimits(flags, env) {
-  const limits = {};
-  for (const option of RELAY_LIMIT_OPTIONS) {
-    const flag = flags[option.flag];
+  github: {
+    authorize: "https://github.com/login/oauth/authorize",
+    token: "https://github.com/login/oauth/access_token",
+    user: "https://api.github.com/user",
+    emails: "https://api.github.com/user/emails"
+  },
+  apple: {
+    authorize: "https://appleid.apple.com/auth/authorize",
+    token: "https://appleid.apple.com/auth/token",
+    jwks: "https://appleid.apple.com/auth/keys",
+    issuer: "https://appleid.apple.com",
+    revoke: "https://appleid.apple.com/auth/revoke"
+  }
+};
+var GOOGLE_BARE_ISSUER = "accounts.google.com";
+function loadOAuthConfig(env = process.env) {
+  const read = (name) => {
+    const value = env[`PINOMAD_SERVER_${name}`]?.replace(/\\n/g, `
+`).trim();
+    return value === "" ? undefined : value;
+  };
+  const all = (provider, names) => {
+    const values = Object.fromEntries(Object.entries(names).map(([key, name]) => [key, read(name)]));
+    const set = Object.values(values).filter((value) => value !== undefined).length;
+    if (set === 0)
+      return;
+    if (set < Object.keys(names).length) {
+      console.error(`oauth: ${Object.values(names).map((name) => `PINOMAD_SERVER_${name}`).join(", ")} must all be set — ${provider} sign-in disabled`);
+      return;
+    }
+    return values;
+  };
+  const google = all("Google", { clientId: "GOOGLE_CLIENT_ID", clientSecret: "GOOGLE_CLIENT_SECRET" });
+  const github = all("GitHub", { clientId: "GITHUB_CLIENT_ID", clientSecret: "GITHUB_CLIENT_SECRET" });
+  const apple = all("Apple", {
+    servicesId: "APPLE_SERVICES_ID",
+    teamId: "APPLE_TEAM_ID",
+    keyId: "APPLE_KEY_ID",
+    privateKey: "APPLE_PRIVATE_KEY"
+  });
+  const bundleId = read("APPLE_BUNDLE_ID");
+  return {
+    ...google === undefined ? {} : { google },
+    ...github === undefined ? {} : { github },
+    ...apple === undefined ? {} : { apple: { ...apple, ...bundleId === undefined ? {} : { bundleId } } }
+  };
+}
+var FETCH_TIMEOUT_MS = 1e4;
+var JWKS_REFETCH_MS = 60000;
+var APPLE_SECRET_TTL_S = 30 * 24 * 60 * 60;
+var APPLE_SECRET_RENEW_S = 24 * 60 * 60;
+var MAX_NAME_CODEPOINTS = 128;
+var isRecord = (value) => typeof value === "object" && value !== null;
+var failure = (error) => ({ error });
+var clipName = (name) => {
+  const clipped = [...(name ?? "").trim()].slice(0, MAX_NAME_CODEPOINTS).join("").trim();
+  return clipped === "" ? undefined : clipped;
+};
+var truthy = (value) => value === true || value === "true";
+async function fetchJson(url, init) {
+  const response = await fetch(url, { ...init, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS), redirect: "error" });
+  if (!response.ok)
+    throw new Error(`${new URL(url).host} answered ${response.status}`);
+  return await response.json();
+}
+var postForm = (url, form, headers = {}) => fetchJson(url, {
+  method: "POST",
+  headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json", ...headers },
+  body: new URLSearchParams(form).toString()
+});
+
+class JwksCache {
+  sets = new Map;
+  now;
+  constructor(now) {
+    this.now = now;
+  }
+  async key(url, kid) {
+    const cached = this.sets.get(url);
+    const known = cached?.keys.get(kid);
+    if (known !== undefined)
+      return known;
+    if (cached !== undefined && this.now() - cached.fetchedAt < JWKS_REFETCH_MS)
+      return;
+    const body = await fetchJson(url, { headers: { accept: "application/json" } });
+    const keys = new Map;
+    for (const jwk of isRecord(body) && Array.isArray(body.keys) ? body.keys : []) {
+      if (!isRecord(jwk) || typeof jwk.kid !== "string" || jwk.kty !== "RSA")
+        continue;
+      try {
+        keys.set(jwk.kid, createPublicKey({ key: jwk, format: "jwk" }));
+      } catch {}
+    }
+    this.sets.set(url, { keys, fetchedAt: this.now() });
+    return keys.get(kid);
+  }
+}
+var decodeSegment = (segment) => JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+async function verifyIdToken(jwks, token, expect) {
+  const parts = token.split(".");
+  if (parts.length !== 3)
+    return;
+  let header, claims;
+  try {
+    header = decodeSegment(parts[0]);
+    claims = decodeSegment(parts[1]);
+  } catch {
+    return;
+  }
+  if (!isRecord(header) || header.alg !== "RS256" || typeof header.kid !== "string" || !isRecord(claims))
+    return;
+  const key = await jwks.key(expect.jwksUrl, header.kid);
+  if (key === undefined)
+    return;
+  const signed = verify("RSA-SHA256", Buffer.from(`${parts[0]}.${parts[1]}`), key, Buffer.from(parts[2], "base64url"));
+  if (!signed)
+    return;
+  const audience = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+  if (typeof claims.iss !== "string" || !expect.issuers.includes(claims.iss))
+    return;
+  if (!audience.includes(expect.audience))
+    return;
+  if (typeof claims.exp !== "number" || claims.exp <= expect.nowS)
+    return;
+  if (expect.nonce !== undefined && claims.nonce !== expect.nonce)
+    return;
+  if (typeof claims.sub !== "string" || claims.sub === "")
+    return;
+  return claims;
+}
+function tokenEmail(claims, relayCountsVerified) {
+  const email = typeof claims.email === "string" ? normalizeEmail(claims.email) : undefined;
+  if (email === undefined)
+    return { emailVerified: false };
+  const relay = relayCountsVerified && (truthy(claims.is_private_email) || email.endsWith("@privaterelay.appleid.com"));
+  return { email, emailVerified: truthy(claims.email_verified) || relay };
+}
+function appleName(user) {
+  if (user === undefined)
+    return;
+  try {
+    const parsed = JSON.parse(user);
+    const name = isRecord(parsed) && isRecord(parsed.name) ? parsed.name : undefined;
+    const parts = [name?.firstName, name?.lastName].filter((part) => typeof part === "string" && part.trim() !== "");
+    return clipName(parts.join(" "));
+  } catch {
+    return;
+  }
+}
+function createOAuth(config, options = {}) {
+  const now = options.now ?? Date.now;
+  const jwks = new JwksCache(now);
+  const endpoints = (provider) => ({ ...DEFAULT_ENDPOINTS[provider], ...config[provider]?.endpoints });
+  const enabled = OAUTH_PROVIDERS.filter((provider) => config[provider] !== undefined);
+  const nowS = () => Math.floor(now() / 1000);
+  const appleKey = config.apple === undefined ? undefined : createPrivateKey2(config.apple.privateKey);
+  const appleSecrets = new Map;
+  const appleSecret = (clientId) => {
+    const apple = config.apple;
+    const cached = appleSecrets.get(clientId);
+    if (cached !== undefined && cached.expiresAt - nowS() > APPLE_SECRET_RENEW_S)
+      return cached.secret;
+    const iat = nowS();
+    const header = Buffer.from(JSON.stringify({ alg: "ES256", kid: apple.keyId })).toString("base64url");
+    const payload = Buffer.from(JSON.stringify({ iss: apple.teamId, iat, exp: iat + APPLE_SECRET_TTL_S, aud: endpoints("apple").issuer, sub: clientId })).toString("base64url");
+    const signature = sign2("sha256", Buffer.from(`${header}.${payload}`), { key: appleKey, dsaEncoding: "ieee-p1363" });
+    const secret = `${header}.${payload}.${signature.toString("base64url")}`;
+    appleSecrets.set(clientId, { secret, expiresAt: iat + APPLE_SECRET_TTL_S });
+    return secret;
+  };
+  const oidc = async (provider, idToken, audience, nonce) => {
+    const { jwks: jwksUrl, issuer } = endpoints(provider);
+    if (typeof idToken !== "string" || jwksUrl === undefined || issuer === undefined)
+      return failure("exchange_failed");
+    const issuers = provider === "google" && issuer === DEFAULT_ENDPOINTS.google.issuer ? [issuer, GOOGLE_BARE_ISSUER] : [issuer];
+    const claims = await verifyIdToken(jwks, idToken, { jwksUrl, issuers, audience, nowS: nowS(), ...nonce === undefined ? {} : { nonce } });
+    return claims === undefined ? failure("invalid_token") : { claims };
+  };
+  const exchangeGoogle = async (args) => {
+    const google = config.google;
+    const body = await postForm(endpoints("google").token, {
+      grant_type: "authorization_code",
+      code: args.code,
+      client_id: google.clientId,
+      client_secret: google.clientSecret,
+      redirect_uri: args.redirectUri,
+      code_verifier: args.verifier
+    });
+    const checked = await oidc("google", isRecord(body) ? body.id_token : undefined, google.clientId, args.nonce);
+    if ("error" in checked)
+      return checked;
+    const { claims } = checked;
+    const name = clipName(typeof claims.name === "string" ? claims.name : undefined);
+    return { provider: "google", subject: claims.sub, ...tokenEmail(claims, false), ...name === undefined ? {} : { name } };
+  };
+  const exchangeGithub = async (args) => {
+    const github = config.github;
+    const { token, user: userUrl, emails: emailsUrl } = endpoints("github");
+    const body = await postForm(token, {
+      code: args.code,
+      client_id: github.clientId,
+      client_secret: github.clientSecret,
+      redirect_uri: args.redirectUri,
+      code_verifier: args.verifier
+    });
+    const accessToken = isRecord(body) && typeof body.access_token === "string" ? body.access_token : undefined;
+    if (accessToken === undefined || userUrl === undefined || emailsUrl === undefined)
+      return failure("exchange_failed");
+    const headers = { authorization: `Bearer ${accessToken}`, accept: "application/vnd.github+json", "user-agent": "pinomad-server" };
+    const [user, emails] = await Promise.all([fetchJson(userUrl, { headers }), fetchJson(emailsUrl, { headers })]);
+    if (!isRecord(user) || typeof user.id !== "number" || !Number.isSafeInteger(user.id))
+      return failure("exchange_failed");
+    const primary = Array.isArray(emails) ? emails.find((entry) => isRecord(entry) && entry.primary === true) : undefined;
+    const email = isRecord(primary) && typeof primary.email === "string" ? normalizeEmail(primary.email) : undefined;
+    const name = clipName(typeof user.name === "string" ? user.name : undefined);
+    return {
+      provider: "github",
+      subject: String(user.id),
+      ...email === undefined ? {} : { email },
+      emailVerified: email !== undefined && isRecord(primary) && primary.verified === true,
+      ...name === undefined ? {} : { name }
+    };
+  };
+  const exchangeApple = async (args) => {
+    const body = await postForm(endpoints("apple").token, {
+      grant_type: "authorization_code",
+      code: args.code,
+      client_id: args.clientId,
+      client_secret: appleSecret(args.clientId),
+      ...args.redirectUri === undefined ? {} : { redirect_uri: args.redirectUri }
+    });
+    if (!isRecord(body))
+      return failure("exchange_failed");
+    const checked = await oidc("apple", body.id_token, args.clientId, args.nonce);
+    if ("error" in checked)
+      return checked;
+    const { claims } = checked;
+    return {
+      provider: "apple",
+      subject: claims.sub,
+      ...tokenEmail(claims, true),
+      ...args.name === undefined ? {} : { name: args.name },
+      ...typeof body.refresh_token === "string" ? { refreshToken: body.refresh_token, refreshClientId: args.clientId } : {}
+    };
+  };
+  const guarded = async (run, provider) => {
+    try {
+      return await run();
+    } catch (error) {
+      console.error(JSON.stringify({ event: "oauth_failed", provider, error: error instanceof Error ? error.message : String(error) }));
+      return failure("exchange_failed");
+    }
+  };
+  return {
+    enabled,
+    appleNative: config.apple?.bundleId !== undefined,
+    authorizeUrl(provider, { state, nonce, codeChallenge, redirectUri }) {
+      const url = new URL(endpoints(provider).authorize);
+      const params = provider === "google" ? {
+        client_id: config.google.clientId,
+        scope: "openid email profile",
+        nonce,
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256"
+      } : provider === "github" ? { client_id: config.github.clientId, scope: "read:user user:email", code_challenge: codeChallenge, code_challenge_method: "S256" } : { client_id: config.apple.servicesId, scope: "name email", response_mode: "form_post", nonce };
+      for (const [key, value] of Object.entries({ response_type: "code", redirect_uri: redirectUri, state, ...params })) {
+        url.searchParams.set(key, value);
+      }
+      return url.toString();
+    },
+    exchange(provider, args) {
+      return guarded(() => {
+        if (provider === "google")
+          return exchangeGoogle(args);
+        if (provider === "github")
+          return exchangeGithub(args);
+        return exchangeApple({ code: args.code, clientId: config.apple.servicesId, redirectUri: args.redirectUri, nonce: args.nonce, name: appleName(args.user) });
+      }, provider);
+    },
+    verifyAppleNative({ identityToken, authorizationCode, nonce, name }) {
+      return guarded(async () => {
+        const bundleId = config.apple?.bundleId;
+        if (bundleId === undefined)
+          return failure("exchange_failed");
+        const hashed = nonce === undefined ? undefined : createHash2("sha256").update(nonce).digest("hex");
+        const checked = await oidc("apple", identityToken, bundleId, hashed);
+        if ("error" in checked)
+          return checked;
+        const traded = await exchangeApple({ code: authorizationCode, clientId: bundleId, nonce: undefined, name: clipName(name) });
+        if ("error" in traded)
+          return traded;
+        return traded.subject === checked.claims.sub ? traded : failure("invalid_token");
+      }, "apple");
+    },
+    revokeApple(refreshToken, clientId) {
+      const revoke = endpoints("apple").revoke;
+      if (config.apple === undefined || revoke === undefined)
+        return;
+      fetch(revoke, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ client_id: clientId, client_secret: appleSecret(clientId), token: refreshToken, token_type_hint: "refresh_token" }).toString(),
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+      }).then((response) => {
+        if (!response.ok)
+          throw new Error(`apple answered ${response.status}`);
+      }).catch((error) => {
+        console.error(JSON.stringify({ event: "apple_revoke_failed", error: error instanceof Error ? error.message : String(error) }));
+      });
+    }
+  };
+}
+
+// apps/server/src/relay.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { once } from "node:events";
+import { createServer } from "node:http";
+import { WebSocket, WebSocketServer } from "ws";
+
+// apps/server/src/relay-limits.ts
+var DEFAULT_RELAY_LIMITS = {
+  perHost: 64,
+  perAccount: 256,
+  unauthenticatedPerHost: 32,
+  handshakeTimeoutMs: 30000,
+  handshakeBytes: 64 * 1024,
+  accountBytesPerSecond: 4 * 1024 * 1024,
+  accountBurstBytes: 1024 * 1024 * 1024
+};
+var RELAY_LIMIT_OPTIONS = [
+  { field: "perHost", flag: "relay-max-per-host", env: "PINOMAD_SERVER_RELAY_MAX_PER_HOST", unit: "count" },
+  { field: "perAccount", flag: "relay-max-per-account", env: "PINOMAD_SERVER_RELAY_MAX_PER_ACCOUNT", unit: "count" },
+  {
+    field: "unauthenticatedPerHost",
+    flag: "relay-max-unauthenticated-per-host",
+    env: "PINOMAD_SERVER_RELAY_MAX_UNAUTHENTICATED_PER_HOST",
+    unit: "count"
+  },
+  { field: "handshakeTimeoutMs", flag: "relay-handshake-timeout", env: "PINOMAD_SERVER_RELAY_HANDSHAKE_TIMEOUT", unit: "seconds" },
+  { field: "handshakeBytes", flag: "relay-handshake-bytes", env: "PINOMAD_SERVER_RELAY_HANDSHAKE_BYTES", unit: "bytes" },
+  { field: "accountBytesPerSecond", flag: "relay-account-rate", env: "PINOMAD_SERVER_RELAY_ACCOUNT_RATE", unit: "bytes" },
+  { field: "accountBurstBytes", flag: "relay-account-burst", env: "PINOMAD_SERVER_RELAY_ACCOUNT_BURST", unit: "bytes" }
+];
+var BYTE_SUFFIX = { "": 1, k: 1024, m: 1024 ** 2, g: 1024 ** 3 };
+function readRelayLimits(flags, env) {
+  const limits = {};
+  for (const option of RELAY_LIMIT_OPTIONS) {
+    const flag = flags[option.flag];
     const raw = typeof flag === "string" ? flag : env[option.env];
     if (raw === undefined)
       continue;
@@ -1539,12 +2563,14 @@ function createRelayLimiter(limits, now = Date.now) {
 }
 
 // apps/server/src/api.ts
+import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 var SESSION_COOKIE = "__Host-pinomad-session";
 var HOST_ID_PATTERN = /^[A-Za-z0-9_-]{43}$/;
 var PKCE_CHALLENGE = /^[A-Za-z0-9_-]{43}$/;
 var PKCE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/;
 var LOOPBACK_STATE = /^[A-Za-z0-9_-]{1,128}$/;
 var MAX_REDIRECT_URI = 256;
+var LINK_TICKET = /^[A-Za-z0-9_-]{43}$/;
 function parseLoopback(value) {
   const { redirectUri, codeChallenge, state } = value;
   if (typeof redirectUri !== "string" || redirectUri.length > MAX_REDIRECT_URI)
@@ -1562,7 +2588,50 @@ function parseLoopback(value) {
   const loopbackOnly = url.protocol === "http:" && url.hostname === "127.0.0.1" && url.port !== "" && url.username === "" && url.password === "" && url.search === "" && url.hash === "" && url.href === redirectUri;
   return loopbackOnly ? { redirectUri, codeChallenge, state } : null;
 }
+function parseNativeRedirect(redirectUri, codeChallenge, state) {
+  if (redirectUri === null || codeChallenge === null || state === null)
+    return null;
+  if (!PKCE_CHALLENGE.test(codeChallenge) || !LOOPBACK_STATE.test(state))
+    return null;
+  const loopback = /^http:\/\/127\.0\.0\.1:([1-9][0-9]{0,4})(?:\/|\/callback)?$/.exec(redirectUri);
+  const allowed = redirectUri === "pinomad://auth" || loopback !== null && Number(loopback[1]) <= 65535;
+  return allowed ? { redirectUri, codeChallenge, state } : null;
+}
+var withParams = (redirectUri, params) => {
+  const url = new URL(redirectUri);
+  for (const [key, value] of Object.entries(params))
+    url.searchParams.set(key, value);
+  return url.toString();
+};
 var MAX_BODY = 8 * 1024;
+var MAX_CODE_LENGTH = 32;
+var ANONYMOUS_ACCOUNT_ROUTES = new Set([
+  "/api/login",
+  "/api/register/code",
+  "/api/register",
+  "/api/password/reset/code",
+  "/api/password/reset"
+]);
+var bodyEmail = (value) => {
+  const email = value?.email;
+  return typeof email === "string" && email.length <= 1024 ? normalizeEmail(email) : undefined;
+};
+var bodyCode = (value) => {
+  const code = value?.code;
+  return typeof code === "string" && code.length <= MAX_CODE_LENGTH ? code : undefined;
+};
+var OAUTH_TOKEN_ROUTE = /^\/api\/oauth\/(?:token|apple\/native|pending\/[A-Za-z0-9_-]{43}\/(?:create|link))$/;
+function bodyConfirmation(value, token) {
+  const { password, reauth } = typeof value === "object" && value !== null ? value : {};
+  if (typeof reauth === "string" && password === undefined)
+    return reauth.length <= 256 ? { reauth, token } : undefined;
+  if (typeof password === "string" && reauth === undefined)
+    return [...password].length <= MAX_PASSWORD_CODEPOINTS ? { password } : undefined;
+  return;
+}
+var sha256Hex2 = (value) => createHash3("sha256").update(value, "utf8").digest("hex");
+var pkceChallenge = (verifier) => createHash3("sha256").update(verifier).digest("base64url");
+var sameHash = (a, b) => a.length === b.length && timingSafeEqual2(Buffer.from(a), Buffer.from(b));
 var MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var DESKTOP_ORIGIN = "app://pinomad";
 var isLoopback = (address) => address !== undefined && (address.startsWith("127.") || address === "::1" || address.startsWith("::ffff:127."));
@@ -1609,23 +2678,53 @@ async function readJson(request, optional = false) {
     return { ok: false, tooLarge: false };
   }
 }
-function sessionToken(request) {
-  const authorization = request.headers.authorization;
-  if (authorization !== undefined && authorization.startsWith("Bearer "))
-    return authorization.slice("Bearer ".length);
+async function authedJson(accounts, request, token, optional = false) {
+  const body = await readJson(request, optional);
+  if (!body.ok)
+    return { ok: false, status: body.tooLarge ? 413 : 400, error: body.tooLarge ? "payload_too_large" : "invalid_json" };
+  const session = accounts.authenticate(token);
+  if (session === undefined)
+    return { ok: false, status: 401, error: "unauthenticated" };
+  return { ok: true, value: body.value, session };
+}
+function cookie(request, name) {
   const header = request.headers.cookie;
   if (header === undefined)
     return;
   for (const part of header.split(";")) {
     const eq = part.indexOf("=");
-    if (eq > 0 && part.slice(0, eq).trim() === SESSION_COOKIE)
+    if (eq > 0 && part.slice(0, eq).trim() === name)
       return part.slice(eq + 1).trim();
   }
   return;
 }
+function sessionToken(request) {
+  const authorization = request.headers.authorization;
+  if (authorization !== undefined && authorization.startsWith("Bearer "))
+    return authorization.slice("Bearer ".length);
+  return cookie(request, SESSION_COOKIE);
+}
 var cookieAttributes = "Path=/; Secure; HttpOnly; SameSite=Strict";
 var setSessionCookie = (token) => `${SESSION_COOKIE}=${token}; ${cookieAttributes}`;
 var clearSessionCookie = `${SESSION_COOKIE}=; ${cookieAttributes}; Max-Age=0`;
+var BINDING_COOKIE = "__Host-pinomad-oauth";
+var bindingAttributes = "Path=/; Secure; HttpOnly; SameSite=None";
+var setBindingCookie = (value) => `${BINDING_COOKIE}=${value}; ${bindingAttributes}; Max-Age=600`;
+var clearBindingCookie = `${BINDING_COOKIE}=; ${bindingAttributes}; Max-Age=0`;
+var bound = (request, bindingHash) => {
+  const value = cookie(request, BINDING_COOKIE);
+  return value !== undefined && bindingHash !== undefined && sameHash(sha256Hex2(value), bindingHash);
+};
+async function readForm(request) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    size += chunk.length;
+    if (size <= MAX_BODY)
+      chunks.push(chunk);
+  }
+  return size > MAX_BODY ? undefined : new URLSearchParams(Buffer.concat(chunks).toString("utf8"));
+}
 async function handleApiRequest(request, response, ctx) {
   const { accounts } = ctx;
   const origin = request.headers.origin;
@@ -1639,6 +2738,26 @@ async function handleApiRequest(request, response, ctx) {
   const cors = origin === DESKTOP_ORIGIN ? { "access-control-allow-origin": DESKTOP_ORIGIN, vary: "Origin" } : {};
   const send = (status, body, headers) => respond(response, status, body, { ...cors, ...headers });
   const deny = (status, error, headers) => send(status, { error }, headers);
+  const profile = (user) => ({
+    user,
+    ...user.email === undefined && accounts.emailEnabled ? { needsEmail: true } : {}
+  });
+  const signedIn = (session) => {
+    const cookieMode = origin === ctx.publicOrigin;
+    send(200, { ...profile(session.user), expiresAt: session.expiresAt, ...cookieMode ? {} : { token: session.token } }, cookieMode ? { "set-cookie": setSessionCookie(session.token) } : undefined);
+  };
+  const codeSent = (result, closed) => {
+    if (result === "limited")
+      deny(429, "rate_limited");
+    else if (result === "closed")
+      deny(403, closed);
+    else if (result === "taken")
+      deny(409, "email_taken");
+    else if (result === "wrong_password" || result === "invalid_reauth")
+      deny(403, result);
+    else
+      send(202);
+  };
   if (!secureTransport(request, ctx.trustProxy)) {
     deny(403, "https_required");
     return;
@@ -1651,9 +2770,10 @@ async function handleApiRequest(request, response, ctx) {
     return;
   }
   const bearer = (request.headers.authorization ?? "").startsWith("Bearer ");
-  const loginTokenMode = (pathname === "/api/login" || pathname === "/api/register") && (origin === undefined || origin === DESKTOP_ORIGIN);
+  const loginTokenMode = (ANONYMOUS_ACCOUNT_ROUTES.has(pathname) || OAUTH_TOKEN_ROUTE.test(pathname)) && (origin === undefined || origin === DESKTOP_ORIGIN);
+  const appleFormPost = pathname === "/api/oauth/apple/callback";
   const hostLinkHostMode = (pathname === "/api/host-link/start" || pathname === "/api/host-link/poll" || pathname === "/api/host-link/token") && origin === undefined;
-  if (MUTATING.has(method) && !bearer && !loginTokenMode && !hostLinkHostMode && origin !== ctx.publicOrigin) {
+  if (MUTATING.has(method) && !bearer && !loginTokenMode && !hostLinkHostMode && !appleFormPost && origin !== ctx.publicOrigin) {
     deny(403, "origin_mismatch");
     return;
   }
@@ -1687,50 +2807,562 @@ async function handleApiRequest(request, response, ctx) {
       deny(401, "invalid_credentials");
       return;
     }
-    const cookieMode = origin === ctx.publicOrigin;
-    send(200, {
-      user: { username },
-      ...result.admin ? { admin: true } : {},
-      expiresAt: result.expiresAt,
-      ...cookieMode ? {} : { token: result.token }
-    }, cookieMode ? { "set-cookie": setSessionCookie(result.token) } : undefined);
+    signedIn(result);
+    return;
+  }
+  if (pathname === "/api/auth/methods") {
+    if (method !== "GET") {
+      deny(405, "method_not_allowed", { allow: "GET" });
+      return;
+    }
+    send(200, { registration: accounts.registrationOpen, email: accounts.emailEnabled, providers: ctx.oauth?.enabled ?? [] });
+    return;
+  }
+  const oauth = ctx.oauth;
+  const enabledProvider = (name) => oauth?.enabled.find((provider) => provider === name);
+  const callbackUri = (provider) => `${ctx.publicOrigin}/api/oauth/${provider}/callback`;
+  const redirect = (to, cookies = []) => {
+    response.writeHead(302, { location: to, ...cookies.length === 0 ? {} : { "set-cookie": [...cookies] } });
+    response.end();
+  };
+  const toWebClient = (param, value, cookies) => redirect(`${ctx.publicOrigin}/?${new URLSearchParams({ [param]: value })}`, cookies);
+  const nativeCode = (userId, native) => withParams(native.redirectUri, { code: accounts.issueOAuthCode(userId, native.codeChallenge), state: native.state });
+  const pendingRefused = (result) => {
+    if (result.status === "limited") {
+      deny(429, "rate_limited");
+      return;
+    }
+    const status = {
+      not_found: 404,
+      registration_closed: 403,
+      no_verified_email: 400,
+      email_taken: 409,
+      identity_taken: 409,
+      password_required: 400,
+      weak_password: 400
+    }[result.reason];
+    deny(status, result.reason);
+  };
+  const providerRoute = /^\/api\/oauth\/([a-z]+)\/(start|callback)$/.exec(pathname);
+  if (providerRoute !== null) {
+    const provider = enabledProvider(providerRoute[1]);
+    const expected = providerRoute[2] === "callback" && provider === "apple" ? "POST" : "GET";
+    if (provider === undefined) {
+      deny(404, "not_found");
+      return;
+    }
+    if (method !== expected) {
+      deny(405, "method_not_allowed", { allow: expected });
+      return;
+    }
+    if (providerRoute[2] === "start") {
+      const query = new URL(request.url ?? "/", "http://server.invalid").searchParams;
+      const ticket = query.get("link");
+      if (ticket !== null) {
+        const binding2 = randomBytes2(32).toString("base64url");
+        const flow3 = LINK_TICKET.test(ticket) ? accounts.startNativeLink({ provider, ticket, bindingHash: sha256Hex2(binding2), ip: clientIp(request, ctx.trustProxy) }) : undefined;
+        if (flow3 === undefined)
+          toWebClient("oauth_error", "invalid_state");
+        else if (flow3.status === "limited")
+          deny(429, "rate_limited");
+        else {
+          const to = oauth.authorizeUrl(provider, {
+            state: flow3.state,
+            nonce: flow3.nonce,
+            codeChallenge: pkceChallenge(flow3.verifier),
+            redirectUri: callbackUri(provider)
+          });
+          redirect(to, [setBindingCookie(binding2)]);
+        }
+        return;
+      }
+      const client = query.get("client") ?? "web";
+      const native = client === "native" ? parseNativeRedirect(query.get("redirect_uri"), query.get("code_challenge"), query.get("state")) : undefined;
+      if (client !== "web" && client !== "native" || native === null) {
+        deny(400, "invalid_request");
+        return;
+      }
+      const binding = randomBytes2(32).toString("base64url");
+      const flow2 = accounts.startOAuthFlow({
+        provider,
+        kind: native === undefined ? "web" : "native",
+        ip: clientIp(request, ctx.trustProxy),
+        bindingHash: sha256Hex2(binding),
+        ...native === undefined ? {} : { native }
+      });
+      if (flow2.status === "limited")
+        deny(429, "rate_limited");
+      else if (flow2.status === "busy")
+        deny(503, "busy");
+      else {
+        const to = oauth.authorizeUrl(provider, {
+          state: flow2.state,
+          nonce: flow2.nonce,
+          codeChallenge: pkceChallenge(flow2.verifier),
+          redirectUri: callbackUri(provider)
+        });
+        redirect(to, [setBindingCookie(binding)]);
+      }
+      return;
+    }
+    const params = method === "POST" ? await readForm(request) : new URL(request.url ?? "/", "http://server.invalid").searchParams;
+    const state = params?.get("state");
+    const flow = state === null || state === undefined || state.length > 256 ? undefined : accounts.takeOAuthFlow(provider, state);
+    if (flow === undefined) {
+      toWebClient("oauth_error", "invalid_state");
+      return;
+    }
+    const fail = (reason) => {
+      if (flow.native === undefined)
+        toWebClient("oauth_error", reason);
+      else
+        redirect(withParams(flow.native.redirectUri, { error: reason, state: flow.native.state }));
+    };
+    if (!bound(request, flow.bindingHash)) {
+      fail("invalid_state");
+      return;
+    }
+    const code = params.get("code");
+    if (params.get("error") !== null || code === null) {
+      fail(params.get("error") === null ? "invalid_request" : "access_denied");
+      return;
+    }
+    const identity = await oauth.exchange(provider, {
+      code,
+      verifier: flow.verifier,
+      nonce: flow.nonce,
+      redirectUri: callbackUri(provider),
+      ...params.get("user") === null ? {} : { user: params.get("user") }
+    });
+    if ("error" in identity) {
+      fail(identity.error);
+      return;
+    }
+    if (flow.kind === "link") {
+      if (flow.linkUserId === undefined || flow.linkSessionHash === undefined) {
+        fail("session_ended");
+        return;
+      }
+      const link = { linkUserId: flow.linkUserId, linkSessionHash: flow.linkSessionHash };
+      if (flow.native !== undefined) {
+        const issued = accounts.issueLinkCode({ identity, ...link, codeChallenge: flow.native.codeChallenge });
+        if (issued === "session_ended")
+          fail(issued);
+        else
+          redirect(withParams(flow.native.redirectUri, { code: issued.code, state: flow.native.state }), [clearBindingCookie]);
+        return;
+      }
+      const linked = accounts.linkIdentity(link, identity);
+      if (linked !== "linked")
+        fail(linked);
+      else
+        toWebClient("oauth_linked", provider, [clearBindingCookie]);
+      return;
+    }
+    const completion = flow.native === undefined ? { kind: "web", bindingHash: flow.bindingHash } : { kind: "native", bindingHash: flow.bindingHash, native: flow.native };
+    const resolved = accounts.resolveIdentity(identity, completion);
+    if (resolved.status === "refused") {
+      fail(resolved.reason);
+      return;
+    }
+    if (resolved.status === "pending") {
+      toWebClient("oauth_pending", resolved.id, [setBindingCookie(cookie(request, BINDING_COOKIE))]);
+      return;
+    }
+    if (flow.native !== undefined) {
+      redirect(nativeCode(resolved.userId, flow.native));
+      return;
+    }
+    const session = accounts.signIn(resolved.userId);
+    if (session === undefined)
+      fail("not_found");
+    else
+      redirect(`${ctx.publicOrigin}/`, [setSessionCookie(session.token), clearBindingCookie]);
     return;
   }
-  if (pathname === "/api/register") {
+  if (pathname === "/api/oauth/token" || pathname === "/api/oauth/apple/native") {
     if (method !== "POST") {
       deny(405, "method_not_allowed", { allow: "POST" });
       return;
     }
+    if (pathname === "/api/oauth/apple/native" && oauth?.appleNative !== true) {
+      deny(404, "not_found");
+      return;
+    }
     const body = await readJson(request);
     if (!body.ok) {
       deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
       return;
     }
-    const value = body.value;
-    const device = parseDeviceClaim(value?.device);
-    if (typeof value?.invite !== "string" || typeof value.username !== "string" || typeof value.password !== "string" || device === "invalid") {
+    const value = typeof body.value === "object" && body.value !== null ? body.value : {};
+    const device = parseDeviceClaim(value.device);
+    if (device === "invalid") {
+      deny(400, "invalid_request");
+      return;
+    }
+    if (pathname === "/api/oauth/token") {
+      const { code, code_verifier: verifier } = value;
+      if (typeof code !== "string" || code.length > 256 || typeof verifier !== "string" || !PKCE_VERIFIER.test(verifier)) {
+        deny(400, "invalid_request");
+        return;
+      }
+      const session = accounts.exchangeOAuthCode(code, verifier, device);
+      if (session === undefined)
+        deny(400, "invalid_grant");
+      else
+        signedIn(session);
+      return;
+    }
+    const { identityToken, authorizationCode, nonce, name } = value;
+    if (typeof identityToken !== "string" || typeof authorizationCode !== "string" || authorizationCode.length > 1024 || nonce !== undefined && (typeof nonce !== "string" || nonce.length > 256) || name !== undefined && typeof name !== "string") {
+      deny(400, "invalid_request");
+      return;
+    }
+    let linkToken;
+    if (value.password !== undefined || value.reauth !== undefined) {
+      const token = bearer ? sessionToken(request) : undefined;
+      if (token === undefined) {
+        deny(401, "unauthenticated");
+        return;
+      }
+      const current = accounts.authenticate(token);
+      if (current === undefined) {
+        deny(401, "unauthenticated");
+        return;
+      }
+      const confirmation = bodyConfirmation(value, token);
+      if (confirmation === undefined) {
+        deny(400, "invalid_request");
+        return;
+      }
+      const confirmed = await accounts.confirm(current.userId, confirmation);
+      if (confirmed !== "ok") {
+        deny(confirmed === "limited" ? 429 : 403, confirmed === "limited" ? "rate_limited" : confirmed);
+        return;
+      }
+      linkToken = token;
+    }
+    const identity = await oauth.verifyAppleNative({
+      identityToken,
+      authorizationCode,
+      ...nonce === undefined ? {} : { nonce },
+      ...name === undefined ? {} : { name }
+    });
+    if ("error" in identity) {
+      deny(identity.error === "invalid_token" ? 401 : 400, identity.error === "invalid_token" ? "invalid_token" : "invalid_grant");
+      return;
+    }
+    if (linkToken !== undefined) {
+      const current = accounts.authenticate(linkToken);
+      const linked = current === undefined ? "session_ended" : accounts.linkIdentity({ linkUserId: current.userId, linkSessionHash: sha256Hex2(linkToken) }, identity);
+      if (linked === "linked")
+        send(204);
+      else
+        deny(linked === "identity_taken" ? 409 : 401, linked);
+      return;
+    }
+    const resolved = accounts.resolveIdentity(identity, { kind: "direct" });
+    if (resolved.status === "refused")
+      deny(403, resolved.reason);
+    else if (resolved.status === "pending") {
+      send(409, { error: "no_account", reason: "no_account", pending: resolved.id, ...resolved.email === undefined ? {} : { email: resolved.email } });
+    } else {
+      const session = accounts.signIn(resolved.userId, device);
+      if (session === undefined)
+        deny(404, "not_found");
+      else
+        signedIn(session);
+    }
+    return;
+  }
+  const pendingRoute = /^\/api\/oauth\/pending\/([A-Za-z0-9_-]{43})(?:\/(create|link))?$/.exec(pathname);
+  if (pendingRoute !== null) {
+    const id = pendingRoute[1];
+    const action = pendingRoute[2];
+    const expected = action === undefined ? "GET" : "POST";
+    if (method !== expected) {
+      deny(405, "method_not_allowed", { allow: expected });
+      return;
+    }
+    const visible = () => {
+      const pending = accounts.pendingSignIn(id);
+      if (pending === undefined)
+        return;
+      const { completion } = pending;
+      if (completion.kind !== "direct")
+        return bound(request, completion.bindingHash) ? pending : undefined;
+      const tokenMode = (origin === undefined || origin === DESKTOP_ORIGIN) && cookie(request, SESSION_COOKIE) === undefined;
+      return (action === "link" ? bearer : tokenMode) ? pending : undefined;
+    };
+    if (action === undefined) {
+      const pending = visible();
+      if (pending === undefined)
+        deny(404, "not_found");
+      else {
+        send(200, {
+          provider: pending.provider,
+          ...pending.email === undefined ? {} : { email: pending.email },
+          ...pending.name === undefined ? {} : { name: pending.name }
+        });
+      }
+      return;
+    }
+    if (action === "create") {
+      const body2 = await readJson(request, true);
+      if (!body2.ok) {
+        deny(body2.tooLarge ? 413 : 400, body2.tooLarge ? "payload_too_large" : "invalid_json");
+        return;
+      }
+      const value = body2.value;
+      const device = parseDeviceClaim(value?.device);
+      const password = value?.password;
+      if (device === "invalid" || password !== undefined && (typeof password !== "string" || [...password].length > MAX_PASSWORD_CODEPOINTS)) {
+        deny(400, "invalid_request");
+        return;
+      }
+      if (visible() === undefined) {
+        deny(404, "not_found");
+        return;
+      }
+      const result2 = await accounts.createFromPending(id, password);
+      if (result2.status !== "ok") {
+        pendingRefused(result2);
+        return;
+      }
+      if (result2.completion.kind === "native") {
+        send(200, { redirect: nativeCode(result2.userId, result2.completion.native) });
+        return;
+      }
+      const session = accounts.signIn(result2.userId, device);
+      if (session === undefined)
+        deny(404, "not_found");
+      else
+        signedIn(session);
+      return;
+    }
+    const token = sessionToken(request);
+    if (token === undefined || accounts.authenticate(token) === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    const body = await authedJson(accounts, request, token, true);
+    if (!body.ok) {
+      deny(body.status, body.error);
+      return;
+    }
+    const confirmation = bodyConfirmation(body.value, token);
+    if (confirmation === undefined) {
+      deny(400, "invalid_request");
+      return;
+    }
+    if (visible() === undefined) {
+      deny(404, "not_found");
+      return;
+    }
+    const confirmed = await accounts.confirm(body.session.userId, confirmation);
+    if (confirmed !== "ok") {
+      deny(confirmed === "limited" ? 429 : 403, confirmed === "limited" ? "rate_limited" : confirmed);
+      return;
+    }
+    if (accounts.authenticate(token)?.userId !== body.session.userId) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    const result = accounts.linkPending(id, body.session.userId);
+    if (result.status !== "ok")
+      pendingRefused(result);
+    else if (result.completion.kind === "native")
+      send(200, { redirect: nativeCode(result.userId, result.completion.native) });
+    else
+      send(204);
+    return;
+  }
+  const linkRoute = /^\/api\/oauth\/([a-z]+)\/link$/.exec(pathname);
+  const removeRoute = /^\/api\/me\/identities\/([a-z]+)\/remove$/.exec(pathname);
+  const linkComplete = pathname === "/api/oauth/link/complete";
+  if (pathname === "/api/me/identities" || pathname === "/api/reauth/code" || pathname === "/api/reauth" || linkComplete || linkRoute !== null || removeRoute !== null) {
+    const expected = pathname === "/api/me/identities" ? "GET" : "POST";
+    if (method !== expected) {
+      deny(405, "method_not_allowed", { allow: expected });
+      return;
+    }
+    const token = sessionToken(request);
+    const session = token === undefined ? undefined : accounts.authenticate(token);
+    if (session === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    if (pathname === "/api/me/identities") {
+      send(200, accounts.listIdentities(session.userId));
+      return;
+    }
+    const body = await authedJson(accounts, request, token, true);
+    if (!body.ok) {
+      deny(body.status, body.error);
+      return;
+    }
+    const current = body.session;
+    if (linkComplete) {
+      const { code, code_verifier: verifier } = typeof body.value === "object" && body.value !== null ? body.value : {};
+      if (typeof code !== "string" || code.length > 256 || typeof verifier !== "string" || !PKCE_VERIFIER.test(verifier)) {
+        deny(400, "invalid_request");
+        return;
+      }
+      const linked = accounts.completeLink({ code, codeVerifier: verifier, token });
+      if (linked === "linked")
+        send(204);
+      else
+        deny({ invalid_grant: 400, identity_taken: 409, session_ended: 401 }[linked], linked);
+      return;
+    }
+    if (pathname === "/api/reauth/code") {
+      const result = accounts.requestReauthCode({ userId: current.userId, ip: clientIp(request, ctx.trustProxy) });
+      if (result === "no_email")
+        deny(409, "no_email");
+      else
+        codeSent(result, "email_unavailable");
+      return;
+    }
+    if (pathname === "/api/reauth") {
+      const { password, code } = typeof body.value === "object" && body.value !== null ? body.value : {};
+      const proof = typeof password === "string" && code === undefined && [...password].length <= MAX_PASSWORD_CODEPOINTS ? { password } : typeof code === "string" && password === undefined && code.length <= MAX_CODE_LENGTH ? { code } : undefined;
+      if (proof === undefined) {
+        deny(400, "invalid_request");
+        return;
+      }
+      const result = await accounts.grantReauth({ userId: current.userId, token, ...proof });
+      if (result.status === "limited")
+        deny(429, "rate_limited");
+      else if (result.status === "refused")
+        deny(result.reason === "unauthenticated" ? 401 : 403, result.reason);
+      else
+        send(200, { reauth: result.reauth, expiresAt: result.expiresAt });
+      return;
+    }
+    const confirmation = bodyConfirmation(body.value, token);
+    if (confirmation === undefined) {
       deny(400, "invalid_request");
       return;
     }
-    const { invite, username } = value;
-    const result = await accounts.register({
-      invite,
-      username,
-      password: value.password,
+    if (removeRoute !== null) {
+      const provider2 = OAUTH_PROVIDERS.find((name) => name === removeRoute[1]);
+      if (provider2 === undefined) {
+        deny(404, "not_found");
+        return;
+      }
+      const result = await accounts.removeIdentity({ userId: current.userId, provider: provider2, ...confirmation });
+      if (result.status === "limited")
+        deny(429, "rate_limited");
+      else if (result.status === "refused") {
+        deny(result.reason === "not_found" ? 404 : result.reason === "last_method" ? 409 : 403, result.reason);
+      } else {
+        for (const grant of result.appleGrants)
+          oauth?.revokeApple(grant.refreshToken, grant.clientId);
+        send(204);
+      }
+      return;
+    }
+    const provider = enabledProvider(linkRoute[1]);
+    if (provider === undefined) {
+      deny(404, "not_found");
+      return;
+    }
+    const linkParams = typeof body.value === "object" && body.value !== null ? body.value : {};
+    const client = linkParams.client ?? "web";
+    const text = (key) => typeof linkParams[key] === "string" ? linkParams[key] : null;
+    const native = client === "native" ? parseNativeRedirect(text("redirect_uri"), text("code_challenge"), text("state")) : undefined;
+    if (client !== "web" && client !== "native" || native === null) {
+      deny(400, "invalid_request");
+      return;
+    }
+    const confirmed = await accounts.confirm(current.userId, confirmation);
+    if (confirmed !== "ok") {
+      deny(confirmed === "limited" ? 429 : 403, confirmed === "limited" ? "rate_limited" : confirmed);
+      return;
+    }
+    const binding = randomBytes2(32).toString("base64url");
+    const flow = accounts.startOAuthFlow({
+      provider,
+      kind: "link",
       ip: clientIp(request, ctx.trustProxy),
-      ...device === undefined ? {} : { device }
+      bindingHash: sha256Hex2(binding),
+      linkUserId: current.userId,
+      linkSessionToken: token,
+      ...native === undefined ? {} : { native }
     });
-    if (result.status === "limited") {
+    if (flow.status === "limited")
       deny(429, "rate_limited");
+    else if (flow.status === "busy")
+      deny(503, "busy");
+    else if (native !== undefined) {
+      send(200, { url: `${ctx.publicOrigin}/api/oauth/${provider}/start?${new URLSearchParams({ link: binding })}` });
+    } else {
+      const url = oauth.authorizeUrl(provider, {
+        state: flow.state,
+        nonce: flow.nonce,
+        codeChallenge: pkceChallenge(flow.verifier),
+        redirectUri: callbackUri(provider)
+      });
+      send(200, { url }, { "set-cookie": setBindingCookie(binding) });
+    }
+    return;
+  }
+  if (pathname === "/api/register/code" || pathname === "/api/password/reset/code") {
+    if (method !== "POST") {
+      deny(405, "method_not_allowed", { allow: "POST" });
       return;
     }
-    if (result.status === "refused") {
-      const status = result.reason === "invalid_invite" || result.reason === "invite_expired" ? 403 : result.reason === "username_taken" ? 409 : 400;
-      deny(status, result.reason);
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
       return;
     }
-    const cookieMode = origin === ctx.publicOrigin;
-    send(200, { user: { username }, expiresAt: result.expiresAt, ...cookieMode ? {} : { token: result.token } }, cookieMode ? { "set-cookie": setSessionCookie(result.token) } : undefined);
+    const email = bodyEmail(body.value);
+    if (email === undefined) {
+      deny(400, "invalid_email");
+      return;
+    }
+    const args = { email, ip: clientIp(request, ctx.trustProxy) };
+    const signup = pathname === "/api/register/code";
+    codeSent(signup ? accounts.requestSignupCode(args) : accounts.requestPasswordReset(args), signup ? "registration_closed" : "email_unavailable");
+    return;
+  }
+  if (pathname === "/api/register" || pathname === "/api/password/reset") {
+    if (method !== "POST") {
+      deny(405, "method_not_allowed", { allow: "POST" });
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    const value = body.value;
+    const email = bodyEmail(value);
+    const code = bodyCode(value);
+    const device = parseDeviceClaim(value?.device);
+    if (email === undefined || code === undefined || typeof value?.password !== "string" || device === "invalid") {
+      deny(400, "invalid_request");
+      return;
+    }
+    const args = { email, code, password: value.password, ip: clientIp(request, ctx.trustProxy) };
+    if (pathname === "/api/password/reset") {
+      const result2 = await accounts.resetPasswordWithCode(args);
+      if (result2.status === "limited")
+        deny(429, "rate_limited");
+      else if (result2.status === "refused")
+        deny(result2.reason === "email_unavailable" ? 403 : 400, result2.reason);
+      else
+        send(204);
+      return;
+    }
+    const result = await accounts.register({ ...args, ...device === undefined ? {} : { device } });
+    if (result.status === "limited")
+      deny(429, "rate_limited");
+    else if (result.status === "refused")
+      deny(result.reason === "registration_closed" ? 403 : 400, result.reason);
+    else
+      signedIn(result);
     return;
   }
   if (pathname === "/api/host-link/start" || pathname === "/api/host-link/poll" || pathname === "/api/host-link/token") {
@@ -1829,9 +3461,9 @@ async function handleApiRequest(request, response, ctx) {
       deny(401, "unauthenticated");
       return;
     }
-    const body = await readJson(request);
+    const body = await authedJson(accounts, request, token);
     if (!body.ok) {
-      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      deny(body.status, body.error);
       return;
     }
     const named = body.value;
@@ -1840,12 +3472,7 @@ async function handleApiRequest(request, response, ctx) {
       deny(400, "invalid_request");
       return;
     }
-    const session = accounts.authenticate(token);
-    if (session === undefined) {
-      deny(401, "unauthenticated");
-      return;
-    }
-    const args = { userId: session.userId, ip: clientIp(request, ctx.trustProxy), ...ref };
+    const args = { userId: body.session.userId, ip: clientIp(request, ctx.trustProxy), ...ref };
     const result = pathname === "/api/host-link/lookup" ? accounts.lookupHostLink(args) : pathname === "/api/host-link/confirm" ? accounts.confirmHostLink(args) : accounts.denyHostLink(args);
     if (result.status === "limited") {
       deny(429, "rate_limited");
@@ -1863,49 +3490,6 @@ async function handleApiRequest(request, response, ctx) {
       send(204);
     return;
   }
-  if (pathname === "/api/invites" || pathname === "/api/invites/revoke") {
-    const allowed = pathname === "/api/invites" ? ["GET", "POST"] : ["POST"];
-    if (!allowed.includes(method)) {
-      deny(405, "method_not_allowed", { allow: allowed.join(", ") });
-      return;
-    }
-    const token = sessionToken(request);
-    const session = token === undefined ? undefined : accounts.authenticate(token);
-    if (session === undefined) {
-      deny(401, "unauthenticated");
-      return;
-    }
-    if (!session.admin) {
-      deny(403, "forbidden");
-      return;
-    }
-    if (pathname === "/api/invites") {
-      if (method === "GET")
-        send(200, accounts.listInvites());
-      else
-        send(200, accounts.createInvite(session.userId));
-      return;
-    }
-    const body = await readJson(request);
-    if (!body.ok) {
-      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
-      return;
-    }
-    const id = body.value?.id;
-    if (typeof id !== "number" || !Number.isSafeInteger(id)) {
-      deny(400, "invalid_request");
-      return;
-    }
-    if (accounts.authenticate(token)?.admin !== true) {
-      deny(401, "unauthenticated");
-      return;
-    }
-    if (accounts.revokeInvite(id))
-      send(204);
-    else
-      deny(404, "not_found");
-    return;
-  }
   const hostRemove = /^\/api\/hosts\/([A-Za-z0-9_-]{43})\/remove$/.exec(pathname);
   if (hostRemove !== null) {
     if (method !== "POST") {
@@ -1917,27 +3501,18 @@ async function handleApiRequest(request, response, ctx) {
       deny(401, "unauthenticated");
       return;
     }
-    const body = await readJson(request);
+    const body = await authedJson(accounts, request, token);
     if (!body.ok) {
-      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      deny(body.status, body.error);
       return;
     }
-    const value = body.value;
-    if (typeof value?.password !== "string" || [...value.password].length > MAX_PASSWORD_CODEPOINTS) {
+    const confirmation = bodyConfirmation(body.value, token);
+    if (confirmation === undefined) {
       deny(400, "invalid_request");
       return;
     }
-    const current = accounts.authenticate(token);
-    if (current === undefined) {
-      deny(401, "unauthenticated");
-      return;
-    }
-    const result = await accounts.removeHost({
-      userId: current.userId,
-      username: current.username,
-      password: value.password,
-      hostId: hostRemove[1]
-    });
+    const current = body.session;
+    const result = await accounts.removeHost({ userId: current.userId, hostId: hostRemove[1], ...confirmation });
     if (result.status === "limited") {
       deny(429, "rate_limited");
       return;
@@ -2044,27 +3619,22 @@ async function handleApiRequest(request, response, ctx) {
       send(200, accounts.listDevices(session.userId).map((device) => ({ ...device, current: device.id === session.deviceId })));
       return;
     }
-    const body = await readJson(request);
+    const body = await authedJson(accounts, request, token);
     if (!body.ok) {
-      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      deny(body.status, body.error);
       return;
     }
-    const value = body.value;
-    if (typeof value?.password !== "string" || [...value.password].length > MAX_PASSWORD_CODEPOINTS) {
+    const confirmation = bodyConfirmation(body.value, token);
+    if (confirmation === undefined) {
       deny(400, "invalid_request");
       return;
     }
-    const current = accounts.authenticate(token);
-    if (current === undefined) {
-      deny(401, "unauthenticated");
-      return;
-    }
+    const current = body.session;
     const result = await accounts.kickDevice({
       userId: current.userId,
-      username: current.username,
-      password: value.password,
       deviceId: Number(deviceKick[1]),
-      ...current.deviceId === undefined ? {} : { currentDeviceId: current.deviceId }
+      ...current.deviceId === undefined ? {} : { currentDeviceId: current.deviceId },
+      ...confirmation
     });
     if (result.status === "limited") {
       deny(429, "rate_limited");
@@ -2079,7 +3649,7 @@ async function handleApiRequest(request, response, ctx) {
     send(204);
     return;
   }
-  if (pathname === "/api/me" || pathname === "/api/logout" || pathname === "/api/sessions/revoke-all" || pathname === "/api/password" || pathname === "/api/me/delete" || pathname === "/api/join-tokens" || pathname === "/api/push-tokens" || pathname === "/api/push-tokens/remove") {
+  if (pathname === "/api/me" || pathname === "/api/me/email/code" || pathname === "/api/me/email" || pathname === "/api/logout" || pathname === "/api/sessions/revoke-all" || pathname === "/api/password" || pathname === "/api/me/delete" || pathname === "/api/join-tokens" || pathname === "/api/push-tokens" || pathname === "/api/push-tokens/remove") {
     const expected = pathname === "/api/me" ? "GET" : "POST";
     if (method !== expected) {
       deny(405, "method_not_allowed", { allow: expected });
@@ -2092,13 +3662,49 @@ async function handleApiRequest(request, response, ctx) {
       return;
     }
     if (pathname === "/api/me") {
-      send(200, { user: { username: session.username }, ...session.admin ? { admin: true } : {} });
+      send(200, profile(session.user));
+      return;
+    }
+    if (pathname === "/api/me/email/code" || pathname === "/api/me/email") {
+      const body = await authedJson(accounts, request, token);
+      if (!body.ok) {
+        deny(body.status, body.error);
+        return;
+      }
+      const confirmation = bodyConfirmation(body.value, token);
+      if (confirmation === undefined) {
+        deny(400, "invalid_request");
+        return;
+      }
+      const email = bodyEmail(body.value);
+      if (email === undefined) {
+        deny(400, "invalid_email");
+        return;
+      }
+      const current = body.session;
+      if (pathname === "/api/me/email/code") {
+        codeSent(await accounts.requestEmailCode({ userId: current.userId, email, ip: clientIp(request, ctx.trustProxy), ...confirmation }), "email_unavailable");
+        return;
+      }
+      const code = bodyCode(body.value);
+      if (code === undefined) {
+        deny(400, "invalid_request");
+        return;
+      }
+      const result = await accounts.setEmail({ userId: current.userId, email, code, ...confirmation });
+      if (result.status === "limited")
+        deny(429, "rate_limited");
+      else if (result.status === "refused") {
+        const status = { email_taken: 409, email_unavailable: 403, wrong_password: 403, invalid_reauth: 403, invalid_code: 400 }[result.reason];
+        deny(status, result.reason);
+      } else
+        send(200, profile(result.user));
       return;
     }
     if (pathname === "/api/push-tokens" || pathname === "/api/push-tokens/remove") {
-      const body = await readJson(request);
+      const body = await authedJson(accounts, request, token);
       if (!body.ok) {
-        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        deny(body.status, body.error);
         return;
       }
       const value = body.value;
@@ -2108,68 +3714,64 @@ async function handleApiRequest(request, response, ctx) {
         deny(400, "invalid_request");
         return;
       }
-      const current = accounts.authenticate(token);
-      if (current === undefined) {
-        deny(401, "unauthenticated");
-        return;
-      }
+      const current = body.session;
       if (pathname === "/api/push-tokens")
-        accounts.registerPushToken(session.userId, apns, environment, current.deviceId);
+        accounts.registerPushToken(current.userId, apns, environment, current.deviceId);
       else
-        accounts.removePushToken(session.userId, apns, environment);
+        accounts.removePushToken(current.userId, apns, environment);
       send(204);
       return;
     }
     if (pathname === "/api/me/delete") {
-      const body = await readJson(request);
+      const body = await authedJson(accounts, request, token);
       if (!body.ok) {
-        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        deny(body.status, body.error);
         return;
       }
-      const value = body.value;
-      if (typeof value?.password !== "string" || [...value.password].length > MAX_PASSWORD_CODEPOINTS) {
+      const current = body.session;
+      const confirmation = bodyConfirmation(body.value, token);
+      if (confirmation === undefined) {
         deny(400, "invalid_request");
         return;
       }
-      const result = await accounts.deleteAccount({ userId: session.userId, username: session.username, password: value.password });
+      const result = await accounts.deleteAccount({ userId: current.userId, keepToken: token, ...confirmation });
       if (result.status === "limited") {
         deny(429, "rate_limited");
         return;
       }
       if (result.status === "refused") {
-        deny(403, result.reason);
+        deny(result.reason === "unauthenticated" ? 401 : 403, result.reason);
         return;
       }
       for (const hostId of result.hostIds)
         ctx.disconnectHost(hostId);
-      ctx.forgetAccount(session.userId);
+      ctx.forgetAccount(current.userId);
+      for (const grant of result.appleGrants)
+        oauth?.revokeApple(grant.refreshToken, grant.clientId);
       send(204, undefined, { "set-cookie": clearSessionCookie });
       return;
     }
     if (pathname === "/api/password") {
-      const body = await readJson(request);
+      const body = await authedJson(accounts, request, token);
       if (!body.ok) {
-        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        deny(body.status, body.error);
         return;
       }
+      const current = body.session;
       const value = body.value;
-      if (typeof value?.currentPassword !== "string" || typeof value.newPassword !== "string" || [...value.currentPassword].length > MAX_PASSWORD_CODEPOINTS) {
+      const proof = typeof value?.currentPassword === "string" && value.reauth === undefined && [...value.currentPassword].length <= MAX_PASSWORD_CODEPOINTS ? { currentPassword: value.currentPassword } : typeof value?.reauth === "string" && value.currentPassword === undefined && value.reauth.length <= 256 ? { reauth: value.reauth } : undefined;
+      if (proof === undefined || typeof value?.newPassword !== "string") {
         deny(400, "invalid_request");
         return;
       }
-      const result = await accounts.changePassword({
-        userId: session.userId,
-        username: session.username,
-        keepToken: token,
-        currentPassword: value.currentPassword,
-        newPassword: value.newPassword
-      });
+      const result = await accounts.changePassword({ userId: current.userId, keepToken: token, newPassword: value.newPassword, ...proof });
       if (result.status === "limited") {
         deny(429, "rate_limited");
         return;
       }
       if (result.status === "refused") {
-        deny(result.reason === "wrong_password" ? 403 : 400, result.reason);
+        const status = result.reason === "weak_password" ? 400 : result.reason === "unauthenticated" ? 401 : 403;
+        deny(status, result.reason);
         return;
       }
       send(204);
@@ -2185,9 +3787,9 @@ async function handleApiRequest(request, response, ctx) {
       return;
     }
     if (pathname === "/api/logout") {
-      const body = await readJson(request, true);
+      const body = await authedJson(accounts, request, token, true);
       if (!body.ok) {
-        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        deny(body.status, body.error);
         return;
       }
       const value = body.value;
@@ -2312,7 +3914,7 @@ async function startRelay(options) {
       return Promise.resolve({ status: "too_many" });
     }
     return new Promise((resolve) => {
-      const requestId = randomBytes2(16).toString("base64url");
+      const requestId = randomBytes3(16).toString("base64url");
       const settle = (result) => {
         if (!pairingRequests.delete(requestId))
           return;
@@ -2432,7 +4034,7 @@ async function startRelay(options) {
   }
   function onControl(socket) {
     track(socket);
-    const nonce = randomBytes2(32).toString("base64url");
+    const nonce = randomBytes3(32).toString("base64url");
     socket.send(encodeRelayFrame({ t: "challenge", nonce }));
     let hostId;
     const deadline = setTimeout(() => socket.close(1008, "register timeout"), registerTimeoutMs);
@@ -2496,13 +4098,13 @@ async function startRelay(options) {
       }
       let noisePublicKey;
       if (frame.signatureV2 !== undefined) {
-        const bound = frame.noisePublicKey !== undefined && verifyRelayChallengeV2(frame.signatureV2, {
+        const bound2 = frame.noisePublicKey !== undefined && verifyRelayChallengeV2(frame.signatureV2, {
           relayOrigin: publicOrigin,
           hostId: frame.hostId,
           nonce,
           noisePublicKey: frame.noisePublicKey
         });
-        if (!bound) {
+        if (!bound2) {
           socket.close(RELAY_CLOSE.badSignature);
           return;
         }
@@ -2576,7 +4178,7 @@ async function startRelay(options) {
       if (devices.size === 0 && hostDevices.get(hostId) === devices)
         hostDevices.delete(hostId);
     });
-    const connId = randomBytes2(16).toString("base64url");
+    const connId = randomBytes3(16).toString("base64url");
     const entry = {
       control,
       socket,
@@ -2648,7 +4250,8 @@ async function startRelay(options) {
         pairing,
         disconnectHost,
         forgetAccount: (userId) => limiter.forgetAccount(accountKey(userId)),
-        sendRevocations
+        sendRevocations,
+        ...options.oauth === undefined ? {} : { oauth: options.oauth }
       }).catch(() => {
         if (!response.headersSent)
           response.writeHead(500);
@@ -2764,6 +4367,12 @@ async function readStdin(limit) {
   }
   return Buffer.concat(chunks).toString("utf8");
 }
+async function passwordFromStdin(command) {
+  if (process.stdin.isTTY) {
+    throw new Error(`pipe the password on stdin, e.g. \`printenv NEW_PINOMAD_SERVER_PASSWORD | ${commandHint("server")} ${command}\``);
+  }
+  return (await readStdin(16 * 1024)).replace(/[\r\n]+$/, "");
+}
 async function passwdMain(argv) {
   const { values } = parseArgs({
     args: [...argv],
@@ -2773,18 +4382,36 @@ async function passwdMain(argv) {
     },
     strict: true
   });
-  if (process.stdin.isTTY) {
-    console.error("pipe the new password on stdin, e.g. `printenv NEW_PINOMAD_SERVER_PASSWORD | " + commandHint("server") + " passwd`");
-    process.exit(1);
-  }
   const dataDir = resolveDataDir(values["data-dir"]);
-  const password = (await readStdin(16 * 1024)).replace(/[\r\n]+$/, "");
+  const password = await passwordFromStdin("passwd");
   await resetPassword({ dataDir, user: values.user, password });
   console.log(JSON.stringify({ event: "passwd", dataDir }));
 }
+async function userMain(argv) {
+  const { values, positionals } = parseArgs({
+    args: [...argv],
+    options: { "data-dir": { type: "string" } },
+    allowPositionals: true,
+    strict: true
+  });
+  const dataDir = resolveDataDir(values["data-dir"]);
+  const [command, ...rest] = positionals;
+  if (command === "add" && rest.length === 1) {
+    await addUser({ dataDir, email: rest[0], password: await passwordFromStdin(`user add ${rest[0]}`) });
+    console.log(JSON.stringify({ event: "user-added", dataDir }));
+    return;
+  }
+  if (command === "set-email" && rest.length === 2) {
+    await setUserEmail({ dataDir, user: rest[0], email: rest[1] });
+    console.log(JSON.stringify({ event: "email-set", dataDir }));
+    return;
+  }
+  throw new Error(`usage: ${commandHint("server")} user add EMAIL | user set-email NAME EMAIL [--data-dir DIR]`);
+}
 async function main(argv) {
-  if (argv[0] === "passwd") {
-    await passwdMain(argv.slice(1)).catch((error) => {
+  const subcommand = argv[0] === "passwd" ? passwdMain : argv[0] === "user" ? userMain : undefined;
+  if (subcommand !== undefined) {
+    await subcommand(argv.slice(1)).catch((error) => {
       console.error(error instanceof Error ? error.message : String(error));
       process.exit(1);
     });
@@ -2803,8 +4430,13 @@ async function main(argv) {
   });
   if (values["public-origin"] === undefined) {
     console.error(`usage: ${commandHint("server")} --public-origin ORIGIN [--data-dir DIR] [--trust-proxy] [--port 7430] [--listen 127.0.0.1]
-` + `       ${commandHint("server")} passwd [--data-dir DIR] [--user NAME]   (reset a password, server running or not; new password on stdin)
-` + `       env: PINOMAD_SERVER_USER, PINOMAD_SERVER_PASSWORD, PINOMAD_SERVER_DATA_DIR
+` + `       ${commandHint("server")} passwd [--data-dir DIR] [--user EMAIL|NAME]   (reset a password, server running or not; new password on stdin)
+` + `       ${commandHint("server")} user add EMAIL [--data-dir DIR]   (add an account; its password on stdin)
+` + `       ${commandHint("server")} user set-email NAME EMAIL [--data-dir DIR]   (give an account its email, taken as verified)
+` + `       env: PINOMAD_SERVER_USER, PINOMAD_SERVER_PASSWORD, PINOMAD_SERVER_DATA_DIR,
+` + `            PINOMAD_SERVER_REGISTRATION (open|closed), PINOMAD_SERVER_SMTP_URL, PINOMAD_SERVER_MAIL_FROM,
+` + `            PINOMAD_SERVER_GOOGLE_CLIENT_ID/_SECRET, PINOMAD_SERVER_GITHUB_CLIENT_ID/_SECRET,
+` + `            PINOMAD_SERVER_APPLE_SERVICES_ID/_TEAM_ID/_KEY_ID/_PRIVATE_KEY [/_BUNDLE_ID]
 ` + "       relay limits (flag or env, 0 = off): " + RELAY_LIMIT_OPTIONS.map((option) => `--${option.flag} / ${option.env}`).join(", "));
     process.exit(1);
   }
@@ -2815,10 +4447,25 @@ async function main(argv) {
     console.error(error instanceof Error ? error.message : String(error));
     process.exit(1);
   }
+  const registration = process.env.PINOMAD_SERVER_REGISTRATION ?? "closed";
+  let mailer;
+  let oauth;
+  try {
+    if (registration !== "open" && registration !== "closed") {
+      throw new Error(`PINOMAD_SERVER_REGISTRATION must be open or closed, not ${registration}`);
+    }
+    mailer = loadMailer();
+    oauth = createOAuth(loadOAuthConfig());
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
   const accounts = await openAccounts({
     dataDir: resolveDataDir(values["data-dir"]),
     bootstrapUser: process.env.PINOMAD_SERVER_USER,
-    bootstrapPassword: process.env.PINOMAD_SERVER_PASSWORD
+    bootstrapPassword: process.env.PINOMAD_SERVER_PASSWORD,
+    registration,
+    ...mailer === undefined ? {} : { mailer }
   }).catch((error) => {
     console.error(error instanceof Error ? error.message : String(error));
     process.exit(1);
@@ -2833,6 +4480,7 @@ async function main(argv) {
     accounts,
     trustProxy: values["trust-proxy"],
     ...apns === undefined ? {} : { push: apns },
+    oauth,
     limits
   });
   console.log(JSON.stringify({
@@ -2840,6 +4488,9 @@ async function main(argv) {
     url: relay.url,
     publicOrigin: values["public-origin"],
     push: apns?.environments ?? [],
+    registration: accounts.registrationOpen ? "open" : "closed",
+    mail: accounts.emailEnabled,
+    providers: oauth.enabled,
     relayLimits: { ...DEFAULT_RELAY_LIMITS, ...limits }
   }));
   let stopping = false;