From 1088861f54da20264958fb3ffd9392ae9e879402 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Mon, 26 Oct 2026 10:35:18 +0000
Subject: [PATCH] feat: shared profile fields on signup (@profullstack/profile)

The signup form (/signup) asks for first and last name (required) and
company domain, job title and LinkedIn (optional), from
@profullstack/profile 0.1.2. Plain sign-in is unchanged and never asks.

- Validated on /api/v1/auth/link in signup mode before any link exists;
  carried on login_tokens.profile and saved to user_profiles when the link
  is spent. A failed save never blocks sign-in.
- GET/PUT/PATCH /api/v1/me/profile via mountProfileRoutes; Settings gets a
  Contact details card.
- Migration 0007: user_profiles (package DDL), login_tokens.profile, and an
  idempotent backfill of first/last name from users.name.
- Field markup is the package's, served in the shell as a <template>.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/package.json                         |  1 +
 apps/web/public/app/app.css                   |  6 ++
 apps/web/public/app/app.js                    | 81 +++++++++++++---
 apps/web/public/app/index.html                |  1 +
 apps/web/public/sw.js                         |  2 +-
 apps/web/src/api.js                           | 41 ++++++++-
 apps/web/src/app.js                           | 27 +++++-
 apps/web/src/auth.js                          | 33 ++++++-
 bun.lock                                      |  3 +
 packages/db/migrations/0007_user_profiles.sql | 41 +++++++++
 test/signup-profile.test.js                   | 92 +++++++++++++++++++
 11 files changed, 302 insertions(+), 26 deletions(-)
 create mode 100644 packages/db/migrations/0007_user_profiles.sql
 create mode 100644 test/signup-profile.test.js

diff --git a/apps/web/package.json b/apps/web/package.json
index c3a7702..183b8b7 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -7,6 +7,7 @@
     "start": "bun src/main.js"
   },
   "dependencies": {
+    "@profullstack/profile": "0.1.2",
     "@profullstack/x402-gateway": "^0.11.0",
     "@simplewebauthn/browser": "^13",
     "@simplewebauthn/server": "^13.2.0",
diff --git a/apps/web/public/app/app.css b/apps/web/public/app/app.css
index c1cbab8..2d275ac 100644
--- a/apps/web/public/app/app.css
+++ b/apps/web/public/app/app.css
@@ -101,6 +101,12 @@ label.f { display: flex; flex-direction: column; gap: 6px; font-size: 13px; colo
 .grid2 { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 12px; }
 form.stack { gap: 12px; }
 .err { color: var(--alert); font-size: 13px; min-height: 18px; }
+/* The shared profile fields (@profullstack/profile renderProfileFields), made to read like label.f. */
+.pfs-profile { border: 0; padding: 0; margin: 0; min-width: 0; display: flex; flex-direction: column; gap: 12px; }
+.pfs-profile__row { display: flex; flex-direction: column; gap: 6px; }
+.pfs-profile__row label { font-size: 13px; color: var(--muted); }
+.pfs-profile__optional { color: var(--dim); }
+.pfs-profile__error { color: var(--alert); font-size: 13px; margin: 0; }
 
 /* modal + toast */
 dialog { background: var(--panel); color: var(--text); border: 1px solid var(--line-2); border-radius: 18px; padding: 0; width: min(560px, calc(100vw - 32px)); max-height: calc(100vh - 48px); }
diff --git a/apps/web/public/app/app.js b/apps/web/public/app/app.js
index c142b00..cda7556 100644
--- a/apps/web/public/app/app.js
+++ b/apps/web/public/app/app.js
@@ -90,7 +90,7 @@ async function api(method, path, body) {
     go('/signin');
     throw new ApiError('Please sign in');
   }
-  if (!res.ok) throw new ApiError(data.error || `Request failed (${res.status})`);
+  if (!res.ok) throw Object.assign(new ApiError(data.error || `Request failed (${res.status})`), { errors: data.errors });
   return data;
 }
 const get = (p) => api('GET', p);
@@ -163,7 +163,7 @@ function go(path) {
 }
 window.addEventListener('popstate', () => render());
 document.addEventListener('click', (e) => {
-  const a = e.target.closest('a[href^="/app"], a[href^="/portal"], a[href="/signin"]');
+  const a = e.target.closest('a[href^="/app"], a[href^="/portal"], a[href="/signin"], a[href="/signup"]');
   if (a && !e.metaKey && !e.ctrlKey && !a.target) {
     e.preventDefault();
     go(a.getAttribute('href'));
@@ -186,7 +186,7 @@ async function render() {
   const path = location.pathname;
   const q = new URLSearchParams(location.search);
   try {
-    if (path === '/signin') return renderSignin(q);
+    if (path === '/signin' || path === '/signup') return renderSignin(q, path === '/signup');
     await loadMe();
     if (path === '/portal/records') return renderRecords(q);
     if (path.startsWith('/portal')) return renderPortal();
@@ -260,32 +260,68 @@ function bindShell() {
 
 /* --------------------------------------------------------------- sign-in -- */
 
-function renderSignin(q) {
+/**
+ * The shared profile fields (@profullstack/profile), from the <template> the
+ * server renders into the shell, filled with `values`.
+ */
+function profileFields(values = {}) {
+  const t = document.getElementById('profile-fields');
+  if (!t) return '';
+  const box = document.createElement('div');
+  box.append(t.content.cloneNode(true));
+  for (const input of box.querySelectorAll('input')) if (values[input.name] != null) input.setAttribute('value', values[input.name]);
+  return box.innerHTML;
+}
+
+/** Show the field errors a 400 from the profile validation carried, beside each box. */
+function showFieldErrors(form, errors = {}) {
+  form.querySelectorAll('.pfs-profile__error').forEach((p) => p.remove());
+  form.querySelectorAll('[aria-invalid]').forEach((i) => i.removeAttribute('aria-invalid'));
+  for (const [name, msg] of Object.entries(errors)) {
+    const input = form.querySelector(`[name="${name}"]`);
+    if (!input) continue;
+    input.setAttribute('aria-invalid', 'true');
+    const p = document.createElement('p');
+    p.className = 'pfs-profile__error';
+    p.setAttribute('role', 'alert');
+    p.textContent = msg;
+    input.after(p);
+  }
+}
+
+function renderSignin(q, signup = false) {
   const email = q.get('email') ?? '';
   root.innerHTML = `<div class="center"><div class="auth">
     <a class="brand" href="/" style="padding:0">${logo} tleehealth</a>
-    <h1>Sign in</h1>
+    <h1>${signup ? 'Create your account' : 'Sign in'}</h1>
     ${q.get('error') === 'expired' ? '<p class="err">That link has expired or was already used. Send a new one.</p>' : ''}
     <form id="link-form" class="stack">
-      <label class="f">Email<input name="email" type="email" autocomplete="email webauthn" required value="${esc(email)}"></label>
-      <button class="primary" type="submit">Email me a sign-in link</button>
+      <label class="f">Email<input name="email" type="email" autocomplete="email${signup ? '' : ' webauthn'}" required value="${esc(email)}"></label>
+      ${signup ? profileFields() : ''}
+      <button class="primary" type="submit">${signup ? 'Email me a link to finish' : 'Email me a sign-in link'}</button>
       <p class="err" id="link-err"></p>
     </form>
-    <div class="or">or</div>
-    <button id="passkey-btn" type="button">Sign in with a passkey</button>
-    <p class="dim small">No passwords. New here? Enter your email and the link creates your account. Patients: use the email your practice has on file.</p>
+    ${signup ? '' : `<div class="or">or</div>
+    <button id="passkey-btn" type="button">Sign in with a passkey</button>`}
+    <p class="dim small">${signup ? 'Already have an account? <a href="/signin">Sign in</a>.' : 'No passwords. New here? <a href="/signup">Create an account</a>, or enter your email and the link creates one. Patients: use the email your practice has on file.'}</p>
   </div></div>`;
   document.getElementById('link-form').onsubmit = async (e) => {
     e.preventDefault();
-    const { email } = formData(e.target);
+    const data = formData(e.target);
     try {
-      await post('/auth/link', { email });
-      e.target.innerHTML = `<div class="card"><div class="card-b"><h2>Check your email</h2><p class="muted">We sent a sign-in link to <b>${esc(email)}</b>. It works once and expires in 20 minutes.</p></div></div>`;
+      await post('/auth/link', signup ? { ...data, mode: 'signup' } : { email: data.email });
+      e.target.innerHTML = `<div class="card"><div class="card-b"><h2>Check your email</h2><p class="muted">We sent a sign-in link to <b>${esc(data.email)}</b>. It works once and expires in 20 minutes.</p></div></div>`;
     } catch (err) {
+      showFieldErrors(e.target, err.errors);
       document.getElementById('link-err').textContent = err.message;
     }
   };
-  document.getElementById('passkey-btn').onclick = passkeySignIn;
+  if (signup) {
+    // Fills the company box from a work email; a fresh <script> runs on each render.
+    const s = document.createElement('script');
+    s.src = '/assets/profile.js';
+    root.append(s);
+  } else document.getElementById('passkey-btn').onclick = passkeySignIn;
 }
 
 async function passkeySignIn() {
@@ -1193,7 +1229,7 @@ async function viewBilling(q) {
 /* -------------------------------------------------------------- settings -- */
 
 async function viewSettings() {
-  const [{ keys }, cs] = await Promise.all([get('/keys'), get(`/orgs/${state.orgId}/call-settings`)]);
+  const [{ keys }, cs, { profile }] = await Promise.all([get('/keys'), get(`/orgs/${state.orgId}/call-settings`), get('/me/profile')]);
   const s = cs.settings;
   const html = `
   <div class="head"><h1>Settings</h1><button id="signout">Sign out</button></div>
@@ -1202,6 +1238,9 @@ async function viewSettings() {
       <section class="card"><div class="card-h"><h2>You</h2></div><div class="card-b">
         <form id="me-form" class="row"><label class="f" style="flex:1">Name<input name="name" value="${esc(state.me.user.name ?? '')}"></label><button type="submit" style="align-self:flex-end">Save</button></form>
         <p class="dim small">${esc(state.me.user.email)}</p></div></section>
+      <section class="card" id="contact"><div class="card-h"><h2>Contact details</h2></div><div class="card-b">
+        <form id="contact-form" class="stack">${profileFields(profile)}<div><button type="submit">Save contact details</button></div></form>
+        <p class="dim small">Private to your account. Sent with ${esc(state.me.user.email)}.</p></div></section>
       <section class="card"><div class="card-h"><h2>Passkeys</h2><button class="sm" id="add-passkey">Add a passkey</button></div>
         <div class="card-b muted">${state.me.passkeys ? `${state.me.passkeys} passkey${state.me.passkeys === 1 ? '' : 's'} saved. Sign in with Face ID, Touch ID or your security key.` : 'Add one to sign in without waiting for an email.'}</div></section>
       ${is(ADMIN) ? `<section class="card"><div class="card-h"><h2>AI calls</h2>${cs.calling_configured ? '' : '<span class="badge b-warn">not connected yet</span>'}</div><div class="card-b">
@@ -1232,6 +1271,18 @@ async function viewSettings() {
         e.preventDefault();
         act(() => api('PATCH', '/me', formData(e.target)), 'Saved');
       };
+      document.getElementById('contact-form').onsubmit = async (e) => {
+        e.preventDefault();
+        try {
+          // Every box, blanks included, so clearing one clears it.
+          await api('PATCH', '/me/profile', Object.fromEntries(new FormData(e.target)));
+          showFieldErrors(e.target);
+          toast('Contact details saved');
+        } catch (err) {
+          showFieldErrors(e.target, err.errors);
+          toast(err.message, true);
+        }
+      };
       document.getElementById('calls-form')?.addEventListener('submit', (e) => {
         e.preventDefault();
         const d = formData(e.target);
diff --git a/apps/web/public/app/index.html b/apps/web/public/app/index.html
index b3f07ae..5b9595e 100644
--- a/apps/web/public/app/index.html
+++ b/apps/web/public/app/index.html
@@ -19,5 +19,6 @@
 <div id="root"><div class="boot">tleehealth</div></div>
 <div id="toast" role="status" aria-live="polite"></div>
 <dialog id="modal"></dialog>
+<!--profile-fields-->
 </body>
 </html>
diff --git a/apps/web/public/sw.js b/apps/web/public/sw.js
index 41ca471..329b729 100644
--- a/apps/web/public/sw.js
+++ b/apps/web/public/sw.js
@@ -1,6 +1,6 @@
 // Minimal service worker: makes the app installable and keeps the shell offline.
 // Bump VERSION on every shell change or returning visitors keep the old page.
-const VERSION = 'tleehealth-v5';
+const VERSION = 'tleehealth-v6';
 self.addEventListener('install', (e) => {
   e.waitUntil(caches.open(VERSION).then((c) => c.addAll(['/', '/app', '/assets/app.js', '/assets/app.css', '/icon.svg', '/manifest.webmanifest'])));
   self.skipWaiting();
diff --git a/apps/web/src/api.js b/apps/web/src/api.js
index 4bb6b06..f90a819 100644
--- a/apps/web/src/api.js
+++ b/apps/web/src/api.js
@@ -1,5 +1,6 @@
 import { db, orgs } from '@tleehealth/db';
 import { createCheckout, paymentsEnabled, settleWebhook, verifyWebhook } from '@tleehealth/payments';
+import { createProfileStore, mountProfileRoutes, saveSignupProfile, validateProfile } from '@profullstack/profile';
 import { Hono } from 'hono';
 import { getCookie } from 'hono/cookie';
 import * as auth from './auth.js';
@@ -114,12 +115,21 @@ async function personIn(orgId, id, types, what = 'person') {
 /* ----------------------------------------------------------------- sign-in -- */
 
 api.post('/auth/link', async (c) => {
-  const { email } = await body(c);
-  const e = str(email, 254)?.toLowerCase();
+  const b = await body(c);
+  const e = str(b.email, 254)?.toLowerCase();
   if (!e || !EMAIL.test(e)) return c.json({ error: 'enter a valid email address' }, 400);
+  // The signup form carries the shared profile fields; plain sign-in does not and
+  // is never asked for them. Checked before any link exists, with the same answer
+  // for a known or unknown address.
+  let profile = null;
+  if (b.mode === 'signup') {
+    const check = validateProfile(b);
+    if (!check.ok) return c.json({ error: 'Some fields need fixing.', errors: check.errors }, 400);
+    profile = check.profile;
+  }
   // Same answer whether or not the address has an account.
   try {
-    await sendLoginLink({ email: e, url: await auth.createLoginLink(e) });
+    await sendLoginLink({ email: e, url: await auth.createLoginLink(e, { profile }) });
   } catch (err) {
     console.error(`[auth] could not send link: ${err?.message ?? err}`);
   }
@@ -162,6 +172,31 @@ api.post('/auth/passkey/login/verify', async (c) => {
 
 /* ---------------------------------------------------------------- account -- */
 
+/*
+ * The shared Profullstack profile (@profullstack/profile): email, names, company
+ * domain, job title and LinkedIn, in user_profiles. The store is made on first use
+ * because the database is (tests and the CLI load this file without one).
+ * GET/PUT/PATCH /api/v1/me/profile are the package's own handlers.
+ */
+let profileStore = null;
+export const profiles = new Proxy({}, { get: (_, k) => (profileStore ??= createProfileStore(db()))[k] });
+mountProfileRoutes(api, {
+  path: '/me/profile',
+  store: profiles,
+  getUser: async (_req, c) => {
+    const u = await currentUser(c);
+    return u ? { id: u.id, email: u.email } : null;
+  },
+});
+
+/** Save what a signup typed, once the link has proved the mailbox. Never blocks sign-in. */
+export async function saveSignup(user, profile) {
+  if (!profile) return;
+  await saveSignupProfile(profiles, user.id, profile, { email: user.email }).catch((err) =>
+    console.error(`[auth] signup profile save failed: ${err?.message ?? err}`),
+  );
+}
+
 api.get('/me', async (c) => {
   const user = await requireUser(c);
   const memberships = await db()`
diff --git a/apps/web/src/app.js b/apps/web/src/app.js
index 77a192e..ce1b046 100644
--- a/apps/web/src/app.js
+++ b/apps/web/src/app.js
@@ -2,10 +2,11 @@ import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { ping } from '@tleehealth/db';
+import { COLUMNS as PROFILE_COLUMNS, PROFILE_ENHANCE_SCRIPT, renderProfileFields } from '@profullstack/profile';
 import { Hono } from 'hono';
 import { x402Gateway } from '@profullstack/x402-gateway/hono';
 import { createCrawlGate } from './crawl-gate.js';
-import { api, coinpayWebhook } from './api.js';
+import { api, coinpayWebhook, saveSignup } from './api.js';
 import { withPitFooter } from './pit-footer.js';
 import * as auth from './auth.js';
 import * as calls from './calls.js';
@@ -39,13 +40,31 @@ app.get('/', (c) => page(c, 'index.html'));
 app.get('/healthz', (c) => c.text('ok'));
 
 // The app: one shell for the team, patients and sign-in. It talks only to /api/v1.
-const shell = (c) => page(c, 'app/index.html');
-for (const p of ['/app', '/app/*', '/signin', '/portal', '/portal/*']) app.get(p, shell);
+// The shared profile fields (@profullstack/profile) ride in the shell as a
+// <template>: the signup form and Settings clone them, so the markup is the
+// package's own. Email is each form's own box, so the package renders the other five.
+const PROFILE_TEMPLATE = `<template id="profile-fields">${renderProfileFields({
+  fields: PROFILE_COLUMNS.filter((f) => f !== 'email'),
+})}</template>`;
+const shell = async (c) =>
+  c.html(
+    await withPitFooter(
+      pub('app/index.html')
+        .toString()
+        .replace('<!--year-->', String(new Date().getFullYear()))
+        .replace('<!--profile-fields-->', PROFILE_TEMPLATE),
+    ),
+  );
+for (const p of ['/app', '/app/*', '/signin', '/signup', '/portal', '/portal/*']) app.get(p, shell);
 app.get('/patient', (c) => c.redirect('/portal', 301));
 const asset = (name, type) => (c) =>
   c.body(pub(`app/${name}`), 200, { 'content-type': type, 'cache-control': 'no-cache' });
 app.get('/assets/app.js', asset('app.js', 'text/javascript; charset=utf-8'));
 app.get('/assets/app.css', asset('app.css', 'text/css; charset=utf-8'));
+// The signup form's company-from-work-email helper, from @profullstack/profile.
+app.get('/assets/profile.js', (c) =>
+  c.body(PROFILE_ENHANCE_SCRIPT, 200, { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-cache' }),
+);
 // The WebAuthn browser helper, served from our own origin rather than a CDN.
 const WEBAUTHN_JS = [join(here, '..', 'node_modules'), join(root, 'node_modules')]
   .map((d) => join(d, '@simplewebauthn/browser/dist/bundle/index.umd.min.js'))
@@ -68,6 +87,7 @@ app.get('/auth/magic', async (c) => {
   const token = c.req.query('t');
   const s = token ? await auth.consumeLoginLink(token, { userAgent: c.req.header('user-agent') }) : null;
   if (!s) return c.redirect('/signin?error=expired', 302);
+  await saveSignup(s.user, s.profile);
   c.header('set-cookie', auth.sessionCookie(s.sessionId));
   return c.redirect('/app', 302);
 });
@@ -183,6 +203,7 @@ Pricing: $10 per team seat per month, or $199/month for up to 1,000 seats. Patie
 Authenticate with a session cookie or \`Authorization: Bearer th_live_...\` (create a key in the app under Settings).
 - GET /health
 - GET /me                                   your practices and user type in each
+- GET|PUT|PATCH /me/profile                 your contact details: first_name, last_name, company_domain, job_title, linkedin_url
 - GET /schedule?date=YYYY-MM-DD&org=<id>    the day's appointments
 - GET /orgs/:org/today                      appointments + refills, labs and summaries waiting on a human
 - GET|POST /orgs/:org/people?type=team|patient|lead
diff --git a/apps/web/src/auth.js b/apps/web/src/auth.js
index 58a844f..623ffa2 100644
--- a/apps/web/src/auth.js
+++ b/apps/web/src/auth.js
@@ -31,11 +31,17 @@ export const expectedOrigins = () => {
 
 /* -------------------------------------------------------------- magic link -- */
 
-export async function createLoginLink(email) {
+/**
+ * `profile` is the validated signup form (@profullstack/profile fields), held on
+ * the token because the account row does not exist until the link is spent.
+ * Bound as text and cast, so the driver never JSON-encodes the string a second time.
+ */
+export async function createLoginLink(email, { profile = null } = {}) {
   const token = randomBytes(32).toString('base64url');
   await db()`
-    insert into login_tokens (token_hash, email, expires_at)
-    values (${sha(token)}, ${email.trim().toLowerCase()}, ${new Date(Date.now() + TOKEN_TTL_MINUTES * 60_000)})`;
+    insert into login_tokens (token_hash, email, expires_at, profile)
+    values (${sha(token)}, ${email.trim().toLowerCase()}, ${new Date(Date.now() + TOKEN_TTL_MINUTES * 60_000)},
+            ${profile ? JSON.stringify(profile) : null}::text::jsonb)`;
   return `${config.siteUrl}/auth/magic?t=${token}`;
 }
 
@@ -46,8 +52,27 @@ export async function consumeLoginLink(token, { userAgent } = {}) {
     where token_hash = ${sha(token)} and used_at is null and expires_at > now()
     returning email`;
   if (!row) return null;
+  const profile = await takeSignupProfile(sha(token));
   const user = await findOrCreateUser(row.email);
-  return { user, sessionId: await startSession(user.id, userAgent) };
+  return { user, sessionId: await startSession(user.id, userAgent), profile };
+}
+
+/**
+ * The signup fields a just-spent link carried, handed out once and then cleared.
+ * RETURNING sees the row after the update, so the old value comes from a subquery.
+ */
+async function takeSignupProfile(tokenHash) {
+  const [row] = await db()`
+    update login_tokens t set profile = null
+    from (
+      select token_hash, profile from login_tokens
+      where token_hash = ${tokenHash} and used_at is not null and profile is not null
+      for update
+    ) old
+    where t.token_hash = old.token_hash
+    returning old.profile`;
+  if (!row) return null;
+  return typeof row.profile === 'string' ? JSON.parse(row.profile) : row.profile;
 }
 
 export async function findOrCreateUser(email) {
diff --git a/bun.lock b/bun.lock
index 87d777c..d130929 100644
--- a/bun.lock
+++ b/bun.lock
@@ -9,6 +9,7 @@
       "name": "@tleehealth/web",
       "version": "0.1.2",
       "dependencies": {
+        "@profullstack/profile": "0.1.2",
         "@profullstack/x402-gateway": "^0.11.0",
         "@simplewebauthn/browser": "^13",
         "@simplewebauthn/server": "^13.2.0",
@@ -87,6 +88,8 @@
 
     "@profullstack/orgs": ["@profullstack/orgs@0.2.0", "", { "peerDependencies": { "postgres": "^3.4.0" }, "bin": { "orgs": "src/cli.js" } }, "sha512-KYax/CBA4MGIqWennoroPjbsrCthY1iXwvad7YUHUwLwus9FyLDOriRnyLMWjMVCG/pihkDfKALUfdCYFGu+Ng=="],
 
+    "@profullstack/profile": ["@profullstack/profile@0.1.2", "", { "peerDependencies": { "@libsql/client": ">=0.6.0", "postgres": "^3.4.0", "react": ">=18" }, "optionalPeers": ["@libsql/client", "postgres", "react"], "bin": { "profile": "src/cli.js" } }, "sha512-IRpMa8xFWIs5UnZiOZt5GSQCsNM7utq1ZgSqqJ/Buye89GcKCxhMtfRIe1zRHe+96Lc2egEuKeCfmNtxa3ej5Q=="],
+
     "@profullstack/tleehealth": ["@profullstack/tleehealth@workspace:packages/cli"],
 
     "@profullstack/tleehealth-mcp": ["@profullstack/tleehealth-mcp@workspace:packages/mcp"],
diff --git a/packages/db/migrations/0007_user_profiles.sql b/packages/db/migrations/0007_user_profiles.sql
new file mode 100644
index 0000000..17d76f4
--- /dev/null
+++ b/packages/db/migrations/0007_user_profiles.sql
@@ -0,0 +1,41 @@
+-- The shared Profullstack profile: email, first_name, last_name, company_domain,
+-- job_title, linkedin_url, owned by @profullstack/profile.
+--
+-- The package's own table, keyed by users.id, so `profile export` and the store
+-- work here with no options. DDL is `profile schema --key user_id --key-type uuid`
+-- output. No foreign key, as the package documents; deleting a user is the host's job.
+create table if not exists "user_profiles" (
+  "user_id" uuid primary key,
+  "email" text,
+  "first_name" text,
+  "last_name" text,
+  "company_domain" text,
+  "job_title" text,
+  "linkedin_url" text,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+create index if not exists "user_profiles_email" on "user_profiles" (lower("email"));
+create index if not exists "user_profiles_company_domain" on "user_profiles" ("company_domain");
+
+-- The account row is only created when the emailed link is spent, so the fields a
+-- signup typed ride on the token until then. Validated before they are stored here,
+-- and saved only once the link proves the mailbox: nobody can put a name on somebody
+-- else's address by requesting a link for it.
+alter table login_tokens add column if not exists profile jsonb;
+
+-- One-time backfill from users.name (the name a person typed under Settings).
+-- First word to first_name, the rest to last_name. Only blanks are filled, so a
+-- re-run (or a profile somebody has since typed) is never overwritten.
+insert into user_profiles (user_id, email, first_name, last_name)
+select
+  u.id,
+  lower(u.email),
+  split_part(btrim(u.name), ' ', 1),
+  nullif(btrim(substr(btrim(u.name), length(split_part(btrim(u.name), ' ', 1)) + 1)), '')
+from users u
+where nullif(btrim(u.name), '') is not null
+on conflict (user_id) do update set
+  email      = coalesce(user_profiles.email, excluded.email),
+  first_name = coalesce(user_profiles.first_name, excluded.first_name),
+  last_name  = coalesce(user_profiles.last_name, excluded.last_name);
diff --git a/test/signup-profile.test.js b/test/signup-profile.test.js
new file mode 100644
index 0000000..f64afcb
--- /dev/null
+++ b/test/signup-profile.test.js
@@ -0,0 +1,92 @@
+// The shared @profullstack/profile fields on signup, against a real Postgres
+// (DATABASE_URL; CI provides one): asked for in signup mode only, carried on the
+// magic-link token (the account does not exist until the link is spent), and saved
+// into user_profiles on verify.
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { close, configured, db } from '../packages/db/src/index.js';
+import { migrate } from '../packages/db/src/migrate.js';
+import { app } from '../apps/web/src/app.js';
+
+const auth = configured() ? await import('../apps/web/src/auth.js') : null;
+
+const link = (body) =>
+  app.request('/api/v1/auth/link', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+
+test('the signup page shell carries the profile fields, once each', async () => {
+  const html = await (await app.request('/signup')).text();
+  for (const name of ['first_name', 'last_name', 'company_domain', 'job_title', 'linkedin_url'])
+    expect(html.match(new RegExp(`name="${name}"`, 'g'))?.length).toBe(1);
+  // Email is the form's own box, not the template's.
+  expect(html).not.toContain('name="email"');
+  expect((await app.request('/assets/profile.js')).headers.get('content-type')).toContain('javascript');
+});
+
+describe.skipIf(!configured())('signup profile', () => {
+  const tag = Date.now();
+
+  beforeAll(() => migrate({ log: () => {} }));
+  afterAll(() => close());
+
+  test('a signup without a last name is refused before any link exists', async () => {
+    const email = `nolast${tag}@acme.com`;
+    const res = await link({ mode: 'signup', email, first_name: 'Ada' });
+    expect(res.status).toBe(400);
+    expect(Object.keys((await res.json()).errors)).toContain('last_name');
+    const [{ n }] = await db()`select count(*)::int as n from login_tokens where email = ${email}`;
+    expect(n).toBe(0);
+  });
+
+  test('plain sign-in is never asked for the fields', async () => {
+    const email = `plain${tag}@acme.com`;
+    expect((await link({ email })).status).toBe(200);
+    const [row] = await db()`select profile from login_tokens where email = ${email}`;
+    expect(row.profile).toBeNull();
+  });
+
+  test('signup fields ride the token and are saved when the link is spent', async () => {
+    const email = `ada${tag}@acme.com`;
+    const res = await link({
+      mode: 'signup',
+      email: email.replace('ada', 'Ada'),
+      first_name: 'Ada',
+      last_name: 'Lovelace',
+      company_domain: 'https://www.acme.com/about',
+      job_title: 'VP Engineering',
+      linkedin_url: 'in/ada-lovelace',
+    });
+    expect(res.status).toBe(200);
+    const [token] = await db()`select profile from login_tokens where email = ${email}`;
+    expect(token.profile).toMatchObject({ first_name: 'Ada', last_name: 'Lovelace' });
+
+    // The route's link went to the mailer; mint one the same way to spend it here.
+    const url = new URL(await auth.createLoginLink(email, { profile: token.profile }));
+    const spent = await app.request(`/auth/magic?t=${url.searchParams.get('t')}`);
+    expect(spent.status).toBe(302);
+    const cookie = spent.headers.get('set-cookie').split(';')[0];
+
+    const me = await app.request('/api/v1/me/profile', { headers: { cookie } });
+    expect(me.status).toBe(200);
+    expect((await me.json()).profile).toMatchObject({
+      email,
+      first_name: 'Ada',
+      last_name: 'Lovelace',
+      company_domain: 'acme.com',
+      job_title: 'VP Engineering',
+      linkedin_url: 'https://www.linkedin.com/in/ada-lovelace',
+    });
+    // Handed out once: the spent token no longer holds the fields.
+    const [{ n }] = await db()`select count(*)::int as n from login_tokens
+                               where email = ${email} and used_at is not null and profile is not null`;
+    expect(n).toBe(0);
+  });
+
+  test('the profile API answers 401 without a session', async () => {
+    const res = await app.request('/api/v1/me/profile');
+    expect(res.status).toBe(401);
+    expect(await res.json()).toHaveProperty('error');
+  });
+});