From 82078b3a05f73c3bd5161fac9b2a6fb58b41f4fd Mon Sep 17 00:00:00 2001
From: RevIQ <me@rev.iq>
Date: Fri, 9 Jan 2026 16:39:33 +0800
Subject: [PATCH] Fix floating promise lint errors and apply code formatting

- Add void operator to async calls in $effect() blocks to satisfy
  noFloatingPromises lint rule:
  - passkey/+page.svelte: void authenticate()
  - verify/+page.svelte: void verifyEmail()
- Apply biome formatter import reorganization across auth files

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .../lib/components/auth/error-alert.svelte    |  12 +-
 .../src/lib/components/auth/index.ts          |   4 +-
 .../auth/password-form-field.svelte           |  52 ++--
 .../lib/components/auth/password-input.svelte |  58 ++--
 .../components/auth/password-strength.svelte  |  40 +--
 .../ui/alert/alert-description.svelte         |  16 +-
 .../components/ui/alert/alert-title.svelte    |  16 +-
 .../src/lib/components/ui/alert/alert.svelte  |  30 +--
 .../src/lib/components/ui/alert/index.ts      |  17 +-
 .../lib/components/ui/loading-button/index.ts |   5 +-
 .../ui/loading-button/loading-button.svelte   |  30 +--
 .../src/lib/stores/auth.svelte.ts             |  11 +-
 .../src/lib/utils/validation.ts               |  25 +-
 .../src/routes/auth/+layout.svelte            |  10 +-
 .../src/routes/auth/confirm/+page.svelte      | 134 +++++-----
 .../routes/auth/forgot-password/+page.svelte  |  78 +++---
 .../src/routes/auth/login/+page.svelte        |  56 ++--
 .../routes/auth/login/passkey/+page.svelte    |  14 +-
 .../routes/auth/login/password/+page.svelte   |  71 ++---
 .../routes/auth/reset-password/+page.svelte   | 126 +++++----
 .../src/routes/auth/setup/user/+page.svelte   | 130 ++++-----
 .../src/routes/auth/signup/+page.svelte       | 247 ++++++++++--------
 .../src/routes/auth/trust-device/+page.svelte | 124 ++++-----
 .../src/routes/auth/verify/+page.svelte       |  13 +-
 .../src/routes/login/+page.svelte             |  10 +-
 25 files changed, 692 insertions(+), 637 deletions(-)

diff --git a/apps/publisher-dashboard/src/lib/components/auth/error-alert.svelte b/apps/publisher-dashboard/src/lib/components/auth/error-alert.svelte
index 8940009..2e124ba 100644
--- a/apps/publisher-dashboard/src/lib/components/auth/error-alert.svelte
+++ b/apps/publisher-dashboard/src/lib/components/auth/error-alert.svelte
@@ -1,12 +1,12 @@
 <script lang="ts">
-  import { Alert, AlertDescription } from "$lib/components/ui/alert";
-  import { AlertCircle } from "@lucide/svelte";
+import { AlertCircle } from "@lucide/svelte";
+import { Alert, AlertDescription } from "$lib/components/ui/alert";
 
-  interface Props {
-    message: string;
-  }
+interface Props {
+  message: string;
+}
 
-  let { message }: Props = $props();
+let { message }: Props = $props();
 </script>
 
 {#if message}
diff --git a/apps/publisher-dashboard/src/lib/components/auth/index.ts b/apps/publisher-dashboard/src/lib/components/auth/index.ts
index 1dc6826..75f95c5 100644
--- a/apps/publisher-dashboard/src/lib/components/auth/index.ts
+++ b/apps/publisher-dashboard/src/lib/components/auth/index.ts
@@ -1,4 +1,4 @@
+export { default as ErrorAlert } from "./error-alert.svelte";
+export { default as PasswordFormField } from "./password-form-field.svelte";
 export { default as PasswordInput } from "./password-input.svelte";
 export { default as PasswordStrength } from "./password-strength.svelte";
-export { default as PasswordFormField } from "./password-form-field.svelte";
-export { default as ErrorAlert } from "./error-alert.svelte";
diff --git a/apps/publisher-dashboard/src/lib/components/auth/password-form-field.svelte b/apps/publisher-dashboard/src/lib/components/auth/password-form-field.svelte
index dbf3890..5d09bea 100644
--- a/apps/publisher-dashboard/src/lib/components/auth/password-form-field.svelte
+++ b/apps/publisher-dashboard/src/lib/components/auth/password-form-field.svelte
@@ -1,32 +1,32 @@
 <script lang="ts">
-  import { Label } from "$lib/components/ui/label";
-  import PasswordInput from "./password-input.svelte";
-  import PasswordStrength from "./password-strength.svelte";
-  import type { HTMLInputAttributes } from "svelte/elements";
+import type { HTMLInputAttributes } from "svelte/elements";
+import { Label } from "$lib/components/ui/label";
+import PasswordInput from "./password-input.svelte";
+import PasswordStrength from "./password-strength.svelte";
 
-  interface Props {
-    id?: string;
-    label?: string;
-    value?: string;
-    placeholder?: string;
-    showStrength?: boolean;
-    error?: string;
-    autocomplete?: HTMLInputAttributes["autocomplete"];
-    required?: boolean;
-    disabled?: boolean;
-  }
+interface Props {
+  id?: string;
+  label?: string;
+  value?: string;
+  placeholder?: string;
+  showStrength?: boolean;
+  error?: string;
+  autocomplete?: HTMLInputAttributes["autocomplete"];
+  required?: boolean;
+  disabled?: boolean;
+}
 
-  let {
-    id = "password",
-    label = "Password",
-    value = $bindable(""),
-    placeholder = "Enter your password",
-    showStrength = false,
-    error = "",
-    autocomplete = "current-password",
-    required = false,
-    disabled = false,
-  }: Props = $props();
+let {
+  id = "password",
+  label = "Password",
+  value = $bindable(""),
+  placeholder = "Enter your password",
+  showStrength = false,
+  error = "",
+  autocomplete = "current-password",
+  required = false,
+  disabled = false,
+}: Props = $props();
 </script>
 
 <div class="space-y-2">
diff --git a/apps/publisher-dashboard/src/lib/components/auth/password-input.svelte b/apps/publisher-dashboard/src/lib/components/auth/password-input.svelte
index ba361ec..2fedbe3 100644
--- a/apps/publisher-dashboard/src/lib/components/auth/password-input.svelte
+++ b/apps/publisher-dashboard/src/lib/components/auth/password-input.svelte
@@ -1,37 +1,37 @@
 <script lang="ts">
-  import type { HTMLInputAttributes } from "svelte/elements";
-  import { Input } from "$lib/components/ui/input";
-  import { Button } from "$lib/components/ui/button";
-  import { Eye, EyeOff } from "@lucide/svelte";
-  import { cn } from "$lib/utils";
+import type { HTMLInputAttributes } from "svelte/elements";
+import { Eye, EyeOff } from "@lucide/svelte";
+import { Button } from "$lib/components/ui/button";
+import { Input } from "$lib/components/ui/input";
+import { cn } from "$lib/utils";
 
-  interface Props {
-    value?: string;
-    placeholder?: string;
-    id?: string;
-    name?: string;
-    required?: boolean;
-    disabled?: boolean;
-    autocomplete?: HTMLInputAttributes["autocomplete"];
-    class?: string;
-  }
+interface Props {
+  value?: string;
+  placeholder?: string;
+  id?: string;
+  name?: string;
+  required?: boolean;
+  disabled?: boolean;
+  autocomplete?: HTMLInputAttributes["autocomplete"];
+  class?: string;
+}
 
-  let {
-    value = $bindable(""),
-    placeholder = "Enter your password",
-    id = "password",
-    name = "password",
-    required = false,
-    disabled = false,
-    autocomplete = "current-password",
-    class: className = "",
-  }: Props = $props();
+let {
+  value = $bindable(""),
+  placeholder = "Enter your password",
+  id = "password",
+  name = "password",
+  required = false,
+  disabled = false,
+  autocomplete = "current-password",
+  class: className = "",
+}: Props = $props();
 
-  let showPassword = $state(false);
+let showPassword = $state(false);
 
-  function toggleVisibility() {
-    showPassword = !showPassword;
-  }
+function toggleVisibility() {
+  showPassword = !showPassword;
+}
 </script>
 
 <div class="relative">
diff --git a/apps/publisher-dashboard/src/lib/components/auth/password-strength.svelte b/apps/publisher-dashboard/src/lib/components/auth/password-strength.svelte
index 7fc28c4..c4b3510 100644
--- a/apps/publisher-dashboard/src/lib/components/auth/password-strength.svelte
+++ b/apps/publisher-dashboard/src/lib/components/auth/password-strength.svelte
@@ -1,27 +1,31 @@
 <script lang="ts">
-  import zxcvbn from "zxcvbn";
+import zxcvbn from "zxcvbn";
 
-  interface Props {
-    password: string;
-    userInputs?: string[];
-  }
+interface Props {
+  password: string;
+  userInputs?: string[];
+}
 
-  let { password, userInputs = [] }: Props = $props();
+let { password, userInputs = [] }: Props = $props();
 
-  // Compute password strength using zxcvbn
-  const result = $derived(password ? zxcvbn(password, userInputs) : null);
-  const score = $derived(result?.score ?? 0);
+// Compute password strength using zxcvbn
+const result = $derived(password ? zxcvbn(password, userInputs) : null);
+const score = $derived(result?.score ?? 0);
 
-  // Strength labels and colors
-  const strengthConfig = [
-    { label: "Very weak", color: "bg-destructive", textColor: "text-destructive" },
-    { label: "Weak", color: "bg-destructive", textColor: "text-destructive" },
-    { label: "Fair", color: "bg-warning", textColor: "text-warning" },
-    { label: "Good", color: "bg-success", textColor: "text-success" },
-    { label: "Strong", color: "bg-success", textColor: "text-success" },
-  ] as const;
+// Strength labels and colors
+const strengthConfig = [
+  {
+    label: "Very weak",
+    color: "bg-destructive",
+    textColor: "text-destructive",
+  },
+  { label: "Weak", color: "bg-destructive", textColor: "text-destructive" },
+  { label: "Fair", color: "bg-warning", textColor: "text-warning" },
+  { label: "Good", color: "bg-success", textColor: "text-success" },
+  { label: "Strong", color: "bg-success", textColor: "text-success" },
+] as const;
 
-  const config = $derived(strengthConfig[score]);
+const config = $derived(strengthConfig[score]);
 </script>
 
 {#if password}
diff --git a/apps/publisher-dashboard/src/lib/components/ui/alert/alert-description.svelte b/apps/publisher-dashboard/src/lib/components/ui/alert/alert-description.svelte
index 8b56aed..c74e5ed 100644
--- a/apps/publisher-dashboard/src/lib/components/ui/alert/alert-description.svelte
+++ b/apps/publisher-dashboard/src/lib/components/ui/alert/alert-description.svelte
@@ -1,13 +1,13 @@
 <script lang="ts">
-	import type { HTMLAttributes } from "svelte/elements";
-	import { cn, type WithElementRef } from "$lib/utils.js";
+import type { HTMLAttributes } from "svelte/elements";
+import { cn, type WithElementRef } from "$lib/utils.js";
 
-	let {
-		ref = $bindable(null),
-		class: className,
-		children,
-		...restProps
-	}: WithElementRef<HTMLAttributes<HTMLDivElement>> = $props();
+let {
+  ref = $bindable(null),
+  class: className,
+  children,
+  ...restProps
+}: WithElementRef<HTMLAttributes<HTMLDivElement>> = $props();
 </script>
 
 <div
diff --git a/apps/publisher-dashboard/src/lib/components/ui/alert/alert-title.svelte b/apps/publisher-dashboard/src/lib/components/ui/alert/alert-title.svelte
index 77e45ad..84768ce 100644
--- a/apps/publisher-dashboard/src/lib/components/ui/alert/alert-title.svelte
+++ b/apps/publisher-dashboard/src/lib/components/ui/alert/alert-title.svelte
@@ -1,13 +1,13 @@
 <script lang="ts">
-	import type { HTMLAttributes } from "svelte/elements";
-	import { cn, type WithElementRef } from "$lib/utils.js";
+import type { HTMLAttributes } from "svelte/elements";
+import { cn, type WithElementRef } from "$lib/utils.js";
 
-	let {
-		ref = $bindable(null),
-		class: className,
-		children,
-		...restProps
-	}: WithElementRef<HTMLAttributes<HTMLDivElement>> = $props();
+let {
+  ref = $bindable(null),
+  class: className,
+  children,
+  ...restProps
+}: WithElementRef<HTMLAttributes<HTMLDivElement>> = $props();
 </script>
 
 <div
diff --git a/apps/publisher-dashboard/src/lib/components/ui/alert/alert.svelte b/apps/publisher-dashboard/src/lib/components/ui/alert/alert.svelte
index 2b2eff9..1ea3e86 100644
--- a/apps/publisher-dashboard/src/lib/components/ui/alert/alert.svelte
+++ b/apps/publisher-dashboard/src/lib/components/ui/alert/alert.svelte
@@ -1,21 +1,21 @@
 <script lang="ts" module>
-	import { type VariantProps, tv } from "tailwind-variants";
+import { tv, type VariantProps } from "tailwind-variants";
 
-	export const alertVariants = tv({
-		base: "relative grid w-full grid-cols-[0_1fr] items-start gap-y-0.5 rounded-lg border px-4 py-3 text-sm has-[>svg]:grid-cols-[calc(var(--spacing)*4)_1fr] has-[>svg]:gap-x-3 [&>svg]:size-4 [&>svg]:translate-y-0.5 [&>svg]:text-current",
-		variants: {
-			variant: {
-				default: "bg-card text-card-foreground",
-				destructive:
-					"text-destructive bg-card *:data-[slot=alert-description]:text-destructive/90 [&>svg]:text-current",
-			},
-		},
-		defaultVariants: {
-			variant: "default",
-		},
-	});
+export const alertVariants = tv({
+  base: "relative grid w-full grid-cols-[0_1fr] items-start gap-y-0.5 rounded-lg border px-4 py-3 text-sm has-[>svg]:grid-cols-[calc(var(--spacing)*4)_1fr] has-[>svg]:gap-x-3 [&>svg]:size-4 [&>svg]:translate-y-0.5 [&>svg]:text-current",
+  variants: {
+    variant: {
+      default: "bg-card text-card-foreground",
+      destructive:
+        "text-destructive bg-card *:data-[slot=alert-description]:text-destructive/90 [&>svg]:text-current",
+    },
+  },
+  defaultVariants: {
+    variant: "default",
+  },
+});
 
-	export type AlertVariant = VariantProps<typeof alertVariants>["variant"];
+export type AlertVariant = VariantProps<typeof alertVariants>["variant"];
 </script>
 
 <script lang="ts">
diff --git a/apps/publisher-dashboard/src/lib/components/ui/alert/index.ts b/apps/publisher-dashboard/src/lib/components/ui/alert/index.ts
index 97e21b4..4f66a77 100644
--- a/apps/publisher-dashboard/src/lib/components/ui/alert/index.ts
+++ b/apps/publisher-dashboard/src/lib/components/ui/alert/index.ts
@@ -1,14 +1,15 @@
 import Root from "./alert.svelte";
 import Description from "./alert-description.svelte";
 import Title from "./alert-title.svelte";
-export { alertVariants, type AlertVariant } from "./alert.svelte";
+
+export { type AlertVariant, alertVariants } from "./alert.svelte";
 
 export {
-	Root,
-	Description,
-	Title,
-	//
-	Root as Alert,
-	Description as AlertDescription,
-	Title as AlertTitle,
+  Root,
+  Description,
+  Title,
+  //
+  Root as Alert,
+  Description as AlertDescription,
+  Title as AlertTitle,
 };
diff --git a/apps/publisher-dashboard/src/lib/components/ui/loading-button/index.ts b/apps/publisher-dashboard/src/lib/components/ui/loading-button/index.ts
index 5479576..7cfbfe5 100644
--- a/apps/publisher-dashboard/src/lib/components/ui/loading-button/index.ts
+++ b/apps/publisher-dashboard/src/lib/components/ui/loading-button/index.ts
@@ -1,6 +1,3 @@
 import Root from "./loading-button.svelte";
 
-export {
-  Root,
-  Root as LoadingButton,
-};
+export { Root, Root as LoadingButton };
diff --git a/apps/publisher-dashboard/src/lib/components/ui/loading-button/loading-button.svelte b/apps/publisher-dashboard/src/lib/components/ui/loading-button/loading-button.svelte
index f9fe5f3..c484912 100644
--- a/apps/publisher-dashboard/src/lib/components/ui/loading-button/loading-button.svelte
+++ b/apps/publisher-dashboard/src/lib/components/ui/loading-button/loading-button.svelte
@@ -1,21 +1,21 @@
 <script lang="ts">
-  import { Button, type ButtonProps } from "$lib/components/ui/button";
-  import { Loader2 } from "@lucide/svelte";
-  import type { Snippet } from "svelte";
+import type { Snippet } from "svelte";
+import { Loader2 } from "@lucide/svelte";
+import { Button, type ButtonProps } from "$lib/components/ui/button";
 
-  interface Props extends ButtonProps {
-    loading?: boolean;
-    loadingText?: string;
-    children: Snippet;
-  }
+interface Props extends ButtonProps {
+  loading?: boolean;
+  loadingText?: string;
+  children: Snippet;
+}
 
-  let {
-    loading = false,
-    loadingText,
-    children,
-    disabled,
-    ...rest
-  }: Props = $props();
+let {
+  loading = false,
+  loadingText,
+  children,
+  disabled,
+  ...rest
+}: Props = $props();
 </script>
 
 <Button disabled={loading || disabled} {...rest}>
diff --git a/apps/publisher-dashboard/src/lib/stores/auth.svelte.ts b/apps/publisher-dashboard/src/lib/stores/auth.svelte.ts
index dd038c0..619005f 100644
--- a/apps/publisher-dashboard/src/lib/stores/auth.svelte.ts
+++ b/apps/publisher-dashboard/src/lib/stores/auth.svelte.ts
@@ -61,13 +61,16 @@ export function hasActiveLoginFlow(): boolean {
  * Get masked email for display (e.g., "j***@example.com")
  */
 export function getMaskedEmail(): string {
-  if (!loginFlowState.email) return "";
+  if (!loginFlowState.email) {
+    return "";
+  }
 
   const [local, domain] = loginFlowState.email.split("@");
-  if (!domain) return loginFlowState.email;
+  if (!domain) {
+    return loginFlowState.email;
+  }
 
-  const maskedLocal =
-    local.length > 1 ? local[0] + "***" : local + "***";
+  const maskedLocal = local.length > 1 ? `${local[0]}***` : `${local}***`;
 
   return `${maskedLocal}@${domain}`;
 }
diff --git a/apps/publisher-dashboard/src/lib/utils/validation.ts b/apps/publisher-dashboard/src/lib/utils/validation.ts
index 99728a8..82d9ae4 100644
--- a/apps/publisher-dashboard/src/lib/utils/validation.ts
+++ b/apps/publisher-dashboard/src/lib/utils/validation.ts
@@ -1,4 +1,7 @@
-import { parsePhoneNumberWithError, isValidPhoneNumber } from "libphonenumber-js";
+import {
+  isValidPhoneNumber,
+  parsePhoneNumberWithError,
+} from "libphonenumber-js";
 
 /**
  * Validates email format using a simple regex pattern.
@@ -12,8 +15,13 @@ export function isValidEmail(email: string): boolean {
  * Validates and formats phone numbers using libphonenumber-js.
  * Returns validation status and optionally the formatted number.
  */
-export function validatePhone(value: string): { valid: boolean; formatted?: string } {
-  if (!value) return { valid: true };
+export function validatePhone(value: string): {
+  valid: boolean;
+  formatted?: string;
+} {
+  if (!value) {
+    return { valid: true };
+  }
   try {
     const phone = parsePhoneNumberWithError(value);
     if (isValidPhoneNumber(phone.number)) {
@@ -30,10 +38,13 @@ export function validatePhone(value: string): { valid: boolean; formatted?: stri
  */
 export function maskEmail(email: string): string {
   const [local, domain] = email.split("@");
-  if (!domain) return email;
-  const masked = local.length > 1
-    ? `${local[0]}${"*".repeat(Math.min(local.length - 1, 3))}`
-    : local;
+  if (!domain) {
+    return email;
+  }
+  const masked =
+    local.length > 1
+      ? `${local[0]}${"*".repeat(Math.min(local.length - 1, 3))}`
+      : local;
   return `${masked}@${domain}`;
 }
 
diff --git a/apps/publisher-dashboard/src/routes/auth/+layout.svelte b/apps/publisher-dashboard/src/routes/auth/+layout.svelte
index fa46c10..3ae9eba 100644
--- a/apps/publisher-dashboard/src/routes/auth/+layout.svelte
+++ b/apps/publisher-dashboard/src/routes/auth/+layout.svelte
@@ -1,11 +1,11 @@
 <script lang="ts">
-  import type { Snippet } from "svelte";
+import type { Snippet } from "svelte";
 
-  interface Props {
-    children: Snippet;
-  }
+interface Props {
+  children: Snippet;
+}
 
-  let { children }: Props = $props();
+let { children }: Props = $props();
 </script>
 
 <svelte:head>
diff --git a/apps/publisher-dashboard/src/routes/auth/confirm/+page.svelte b/apps/publisher-dashboard/src/routes/auth/confirm/+page.svelte
index e979c2c..00269a9 100644
--- a/apps/publisher-dashboard/src/routes/auth/confirm/+page.svelte
+++ b/apps/publisher-dashboard/src/routes/auth/confirm/+page.svelte
@@ -1,75 +1,75 @@
 <script lang="ts">
-  import { goto } from "$app/navigation";
-  import { createQuery } from "@tanstack/svelte-query";
-  import { api } from "$lib/api/client";
-  import {
-    loginFlowState,
-    clearLoginFlowState,
-    getMaskedEmail,
-  } from "$lib/stores/auth.svelte";
-  import { ErrorAlert } from "$lib/components/auth";
-  import { Button } from "$lib/components/ui/button";
-  import { LoadingButton } from "$lib/components/ui/loading-button";
-  import { Alert, AlertDescription } from "$lib/components/ui/alert";
-  import { Loader2, Mail, AlertCircle, RefreshCw } from "@lucide/svelte";
+import { AlertCircle, Loader2, Mail, RefreshCw } from "@lucide/svelte";
+import { createQuery } from "@tanstack/svelte-query";
+import { goto } from "$app/navigation";
+import { api } from "$lib/api/client";
+import { ErrorAlert } from "$lib/components/auth";
+import { Alert, AlertDescription } from "$lib/components/ui/alert";
+import { Button } from "$lib/components/ui/button";
+import { LoadingButton } from "$lib/components/ui/loading-button";
+import {
+  clearLoginFlowState,
+  getMaskedEmail,
+  loginFlowState,
+} from "$lib/stores/auth.svelte";
 
-  let resendCooldown = $state(0);
-  let isResending = $state(false);
-  let resendError = $state<string | null>(null);
+let resendCooldown = $state(0);
+let isResending = $state(false);
+let resendError = $state<string | null>(null);
 
-  // Guard: redirect to /auth/login if no active login flow
-  $effect(() => {
-    if (!loginFlowState.email) {
-      goto("/auth/login");
-    }
-  });
-
-  // Poll for login completion every 3 seconds
-  // In Svelte 5 with TanStack Query v6, options are passed as a thunk (function)
-  const statusQuery = createQuery(() => ({
-    queryKey: ["loginStatus"],
-    queryFn: () => api.auth.loginIfRequestIsCompleted(),
-    refetchInterval: 3000,
-    enabled: !!loginFlowState.email,
-  }));
-
-  // Watch for completed status
-  // In TanStack Query v6 for Svelte 5, query results are reactive objects (not stores)
-  $effect(() => {
-    if (statusQuery.data?.status === "completed") {
-      clearLoginFlowState();
-      goto(statusQuery.data.redirectTo || "/performance");
-    }
-  });
-
-  // Handle cooldown timer
-  $effect(() => {
-    if (resendCooldown > 0) {
-      const timer = setTimeout(() => {
-        resendCooldown = resendCooldown - 1;
-      }, 1000);
-      return () => clearTimeout(timer);
-    }
-  });
-
-  async function handleResendEmail() {
-    resendError = null;
-    isResending = true;
-
-    try {
-      await api.auth.resendVerificationEmail();
-      resendCooldown = 60;
-    } catch (err) {
-      resendError = err instanceof Error ? err.message : "Failed to resend email";
-    } finally {
-      isResending = false;
-    }
-  }
-
-  function handleDifferentEmail() {
-    clearLoginFlowState();
+// Guard: redirect to /auth/login if no active login flow
+$effect(() => {
+  if (!loginFlowState.email) {
     goto("/auth/login");
   }
+});
+
+// Poll for login completion every 3 seconds
+// In Svelte 5 with TanStack Query v6, options are passed as a thunk (function)
+const statusQuery = createQuery(() => ({
+  queryKey: ["loginStatus"],
+  queryFn: () => api.auth.loginIfRequestIsCompleted(),
+  refetchInterval: 3000,
+  enabled: !!loginFlowState.email,
+}));
+
+// Watch for completed status
+// In TanStack Query v6 for Svelte 5, query results are reactive objects (not stores)
+$effect(() => {
+  if (statusQuery.data?.status === "completed") {
+    clearLoginFlowState();
+    goto(statusQuery.data.redirectTo || "/performance");
+  }
+});
+
+// Handle cooldown timer
+$effect(() => {
+  if (resendCooldown > 0) {
+    const timer = setTimeout(() => {
+      resendCooldown -= 1;
+    }, 1000);
+    return () => clearTimeout(timer);
+  }
+});
+
+async function handleResendEmail() {
+  resendError = null;
+  isResending = true;
+
+  try {
+    await api.auth.resendVerificationEmail();
+    resendCooldown = 60;
+  } catch (err) {
+    resendError = err instanceof Error ? err.message : "Failed to resend email";
+  } finally {
+    isResending = false;
+  }
+}
+
+function handleDifferentEmail() {
+  clearLoginFlowState();
+  goto("/auth/login");
+}
 </script>
 
 <div class="space-y-6">
diff --git a/apps/publisher-dashboard/src/routes/auth/forgot-password/+page.svelte b/apps/publisher-dashboard/src/routes/auth/forgot-password/+page.svelte
index a77f7bb..7ad525c 100644
--- a/apps/publisher-dashboard/src/routes/auth/forgot-password/+page.svelte
+++ b/apps/publisher-dashboard/src/routes/auth/forgot-password/+page.svelte
@@ -1,46 +1,48 @@
 <script lang="ts">
-  import { api } from "$lib/api/client";
-  import { ErrorAlert } from "$lib/components/auth";
-  import { Alert, AlertDescription } from "$lib/components/ui/alert";
-  import { Button } from "$lib/components/ui/button";
-  import { Input } from "$lib/components/ui/input";
-  import { Label } from "$lib/components/ui/label";
-  import { LoadingButton } from "$lib/components/ui/loading-button";
-  import { CheckCircle2 } from "@lucide/svelte";
+import { CheckCircle2 } from "@lucide/svelte";
+import { api } from "$lib/api/client";
+import { ErrorAlert } from "$lib/components/auth";
+import { Alert, AlertDescription } from "$lib/components/ui/alert";
+import { Button } from "$lib/components/ui/button";
+import { Input } from "$lib/components/ui/input";
+import { Label } from "$lib/components/ui/label";
+import { LoadingButton } from "$lib/components/ui/loading-button";
 
-  // Form state
-  let email = $state("");
-  let isLoading = $state(false);
-  let error = $state("");
-  let isSubmitted = $state(false);
+// Form state
+let email = $state("");
+let isLoading = $state(false);
+let error = $state("");
+let isSubmitted = $state(false);
 
-  // Form validation
-  const isFormValid = $derived(email.length > 0 && email.includes("@"));
+// Form validation
+const isFormValid = $derived(email.length > 0 && email.includes("@"));
 
-  async function handleSubmit(e: Event) {
-    e.preventDefault();
-    if (!isFormValid) return;
-
-    isLoading = true;
-    error = "";
-
-    try {
-      await api.auth.forgotPassword({ email });
-      // Always show success to prevent email enumeration
-      isSubmitted = true;
-    } catch (err) {
-      // Even on error, show success message to prevent enumeration
-      // Only show error for network/unexpected issues
-      if (err instanceof Error && err.message.includes("network")) {
-        error = "Unable to connect. Please check your connection and try again.";
-      } else {
-        // Still show success to prevent enumeration
-        isSubmitted = true;
-      }
-    } finally {
-      isLoading = false;
-    }
+async function handleSubmit(e: Event) {
+  e.preventDefault();
+  if (!isFormValid) {
+    return;
   }
+
+  isLoading = true;
+  error = "";
+
+  try {
+    await api.auth.forgotPassword({ email });
+    // Always show success to prevent email enumeration
+    isSubmitted = true;
+  } catch (err) {
+    // Even on error, show success message to prevent enumeration
+    // Only show error for network/unexpected issues
+    if (err instanceof Error && err.message.includes("network")) {
+      error = "Unable to connect. Please check your connection and try again.";
+    } else {
+      // Still show success to prevent enumeration
+      isSubmitted = true;
+    }
+  } finally {
+    isLoading = false;
+  }
+}
 </script>
 
 <svelte:head>
diff --git a/apps/publisher-dashboard/src/routes/auth/login/+page.svelte b/apps/publisher-dashboard/src/routes/auth/login/+page.svelte
index b5287ee..2abd865 100644
--- a/apps/publisher-dashboard/src/routes/auth/login/+page.svelte
+++ b/apps/publisher-dashboard/src/routes/auth/login/+page.svelte
@@ -1,38 +1,38 @@
 <script lang="ts">
-  import { goto } from "$app/navigation";
-  import { api } from "$lib/api/client";
-  import { setLoginFlowState } from "$lib/stores/auth.svelte";
-  import { ErrorAlert } from "$lib/components/auth";
-  import { Input } from "$lib/components/ui/input";
-  import { Label } from "$lib/components/ui/label";
-  import { LoadingButton } from "$lib/components/ui/loading-button";
+import { goto } from "$app/navigation";
+import { api } from "$lib/api/client";
+import { ErrorAlert } from "$lib/components/auth";
+import { Input } from "$lib/components/ui/input";
+import { Label } from "$lib/components/ui/label";
+import { LoadingButton } from "$lib/components/ui/loading-button";
+import { setLoginFlowState } from "$lib/stores/auth.svelte";
 
-  let email = $state("");
-  let isLoading = $state(false);
-  let error = $state<string | null>(null);
+let email = $state("");
+let isLoading = $state(false);
+let error = $state<string | null>(null);
 
-  async function handleSubmit(e: SubmitEvent) {
-    e.preventDefault();
-    error = null;
-    isLoading = true;
+async function handleSubmit(e: SubmitEvent) {
+  e.preventDefault();
+  error = null;
+  isLoading = true;
 
-    try {
-      const response = await api.auth.createLoginRequest({ email });
-      setLoginFlowState(response);
+  try {
+    const response = await api.auth.createLoginRequest({ email });
+    setLoginFlowState(response);
 
-      if (response.hasPasskey) {
-        goto("/auth/login/passkey");
-      } else if (response.hasPassword) {
-        goto("/auth/login/password");
-      } else {
-        // Anti-enumeration: always redirect to confirm even if user doesn't exist
-        goto("/auth/confirm");
-      }
-    } catch (err) {
-      error = err instanceof Error ? err.message : "An unexpected error occurred";
-      isLoading = false;
+    if (response.hasPasskey) {
+      goto("/auth/login/passkey");
+    } else if (response.hasPassword) {
+      goto("/auth/login/password");
+    } else {
+      // Anti-enumeration: always redirect to confirm even if user doesn't exist
+      goto("/auth/confirm");
     }
+  } catch (err) {
+    error = err instanceof Error ? err.message : "An unexpected error occurred";
+    isLoading = false;
   }
+}
 </script>
 
 <div class="space-y-6">
diff --git a/apps/publisher-dashboard/src/routes/auth/login/passkey/+page.svelte b/apps/publisher-dashboard/src/routes/auth/login/passkey/+page.svelte
index 7cd1b77..ac2f594 100644
--- a/apps/publisher-dashboard/src/routes/auth/login/passkey/+page.svelte
+++ b/apps/publisher-dashboard/src/routes/auth/login/passkey/+page.svelte
@@ -1,12 +1,12 @@
 <script lang="ts">
-import { goto } from "$app/navigation";
+import { Fingerprint, KeyRound, Loader2 } from "@lucide/svelte";
 import { startAuthentication } from "@simplewebauthn/browser";
+import { goto } from "$app/navigation";
+import { api } from "$lib/api/client";
 import { ErrorAlert } from "$lib/components/auth";
 import { Button } from "$lib/components/ui/button";
 import { LoadingButton } from "$lib/components/ui/loading-button";
-import { api } from "$lib/api/client";
-import { loginFlowState, getMaskedEmail } from "$lib/stores/auth.svelte";
-import { Fingerprint, KeyRound, Loader2 } from "@lucide/svelte";
+import { getMaskedEmail, loginFlowState } from "$lib/stores/auth.svelte";
 
 /**
  * Passkey authentication page
@@ -32,7 +32,9 @@ async function authenticate(): Promise<void> {
     const options = await api.auth.webauthn.createAuthenticationOptions();
 
     // Trigger browser WebAuthn prompt
-    const credential = await startAuthentication({ optionsJSON: options.options });
+    const credential = await startAuthentication({
+      optionsJSON: options.options,
+    });
 
     // Verify with server
     await api.auth.webauthn.verifyAuthentication({
@@ -60,7 +62,7 @@ $effect(() => {
 // Auto-trigger authentication on mount
 $effect(() => {
   if (loginFlowState.email && !hasAttempted) {
-    authenticate();
+    void authenticate();
   }
 });
 </script>
diff --git a/apps/publisher-dashboard/src/routes/auth/login/password/+page.svelte b/apps/publisher-dashboard/src/routes/auth/login/password/+page.svelte
index dca079c..7202733 100644
--- a/apps/publisher-dashboard/src/routes/auth/login/password/+page.svelte
+++ b/apps/publisher-dashboard/src/routes/auth/login/password/+page.svelte
@@ -1,42 +1,45 @@
 <script lang="ts">
-  import { goto } from "$app/navigation";
-  import { api } from "$lib/api/client";
-  import { loginFlowState, clearLoginFlowState } from "$lib/stores/auth.svelte";
-  import { Button } from "$lib/components/ui/button";
-  import { Label } from "$lib/components/ui/label";
-  import { PasswordInput, ErrorAlert } from "$lib/components/auth";
-  import { LoadingButton } from "$lib/components/ui/loading-button";
+import { goto } from "$app/navigation";
+import { api } from "$lib/api/client";
+import { ErrorAlert, PasswordInput } from "$lib/components/auth";
+import { Button } from "$lib/components/ui/button";
+import { Label } from "$lib/components/ui/label";
+import { LoadingButton } from "$lib/components/ui/loading-button";
+import { clearLoginFlowState, loginFlowState } from "$lib/stores/auth.svelte";
 
-  let password = $state("");
-  let isLoading = $state(false);
-  let error = $state<string | null>(null);
+let password = $state("");
+let isLoading = $state(false);
+let error = $state<string | null>(null);
 
-  // Guard: redirect to /auth/login if no active login flow
-  $effect(() => {
-    if (!loginFlowState.email) {
-      goto("/auth/login");
-    }
-  });
-
-  async function handleSubmit(e: SubmitEvent) {
-    e.preventDefault();
-    error = null;
-    isLoading = true;
-
-    try {
-      await api.auth.loginPassword({ password });
-      // On success, redirect to confirm page for email verification
-      goto("/auth/confirm");
-    } catch (err) {
-      error = err instanceof Error ? err.message : "Invalid password. Please try again.";
-      isLoading = false;
-    }
-  }
-
-  function handleDifferentEmail() {
-    clearLoginFlowState();
+// Guard: redirect to /auth/login if no active login flow
+$effect(() => {
+  if (!loginFlowState.email) {
     goto("/auth/login");
   }
+});
+
+async function handleSubmit(e: SubmitEvent) {
+  e.preventDefault();
+  error = null;
+  isLoading = true;
+
+  try {
+    await api.auth.loginPassword({ password });
+    // On success, redirect to confirm page for email verification
+    goto("/auth/confirm");
+  } catch (err) {
+    error =
+      err instanceof Error
+        ? err.message
+        : "Invalid password. Please try again.";
+    isLoading = false;
+  }
+}
+
+function handleDifferentEmail() {
+  clearLoginFlowState();
+  goto("/auth/login");
+}
 </script>
 
 <div class="space-y-6">
diff --git a/apps/publisher-dashboard/src/routes/auth/reset-password/+page.svelte b/apps/publisher-dashboard/src/routes/auth/reset-password/+page.svelte
index 5be836d..31889ec 100644
--- a/apps/publisher-dashboard/src/routes/auth/reset-password/+page.svelte
+++ b/apps/publisher-dashboard/src/routes/auth/reset-password/+page.svelte
@@ -1,68 +1,78 @@
 <script lang="ts">
-  import { goto } from "$app/navigation";
-  import { page } from "$app/stores";
-  import { api } from "$lib/api/client";
-  import { PasswordInput, PasswordStrength, ErrorAlert } from "$lib/components/auth";
-  import { Alert, AlertDescription } from "$lib/components/ui/alert";
-  import { Button } from "$lib/components/ui/button";
-  import { Label } from "$lib/components/ui/label";
-  import { LoadingButton } from "$lib/components/ui/loading-button";
-  import { AlertCircle } from "@lucide/svelte";
-  import { toast } from "svelte-sonner";
-  import zxcvbn from "zxcvbn";
+import { AlertCircle } from "@lucide/svelte";
+import { toast } from "svelte-sonner";
+import zxcvbn from "zxcvbn";
+import { goto } from "$app/navigation";
+import { page } from "$app/stores";
+import { api } from "$lib/api/client";
+import {
+  ErrorAlert,
+  PasswordInput,
+  PasswordStrength,
+} from "$lib/components/auth";
+import { Alert, AlertDescription } from "$lib/components/ui/alert";
+import { Button } from "$lib/components/ui/button";
+import { Label } from "$lib/components/ui/label";
+import { LoadingButton } from "$lib/components/ui/loading-button";
 
-  // Get token from URL
-  const token = $derived($page.url.searchParams.get("token") ?? "");
+// Get token from URL
+const token = $derived($page.url.searchParams.get("token") ?? "");
 
-  // Form state
-  let newPassword = $state("");
-  let confirmPassword = $state("");
-  let isLoading = $state(false);
-  let error = $state("");
+// Form state
+let newPassword = $state("");
+let confirmPassword = $state("");
+let isLoading = $state(false);
+let error = $state("");
 
-  // Password validation
-  const passwordScore = $derived(newPassword ? zxcvbn(newPassword).score : 0);
-  const passwordsMatch = $derived(newPassword === confirmPassword);
-  const isPasswordValid = $derived(
-    newPassword.length >= 8 && passwordScore >= 3 && passwordsMatch && confirmPassword.length > 0
-  );
+// Password validation
+const passwordScore = $derived(newPassword ? zxcvbn(newPassword).score : 0);
+const passwordsMatch = $derived(newPassword === confirmPassword);
+const isPasswordValid = $derived(
+  newPassword.length >= 8 &&
+    passwordScore >= 3 &&
+    passwordsMatch &&
+    confirmPassword.length > 0,
+);
 
-  // Form validation
-  const isFormValid = $derived(token.length > 0 && isPasswordValid);
+// Form validation
+const isFormValid = $derived(token.length > 0 && isPasswordValid);
 
-  async function handleSubmit(e: Event) {
-    e.preventDefault();
-    if (!isFormValid) return;
-
-    isLoading = true;
-    error = "";
-
-    try {
-      await api.auth.resetPassword({
-        token,
-        newPassword,
-      });
-
-      // Show success toast and redirect to login
-      toast.success("Password reset successfully", {
-        description: "You can now sign in with your new password.",
-      });
-      await goto("/auth/login");
-    } catch (err) {
-      if (err instanceof Error) {
-        // Handle specific error cases
-        if (err.message.includes("expired") || err.message.includes("invalid")) {
-          error = "This password reset link has expired or is invalid. Please request a new one.";
-        } else {
-          error = err.message;
-        }
-      } else {
-        error = "An unexpected error occurred. Please try again.";
-      }
-    } finally {
-      isLoading = false;
-    }
+async function handleSubmit(e: Event) {
+  e.preventDefault();
+  if (!isFormValid) {
+    return;
   }
+
+  isLoading = true;
+  error = "";
+
+  try {
+    await api.auth.resetPassword({
+      token,
+      newPassword,
+    });
+
+    // Show success toast and redirect to login
+    toast.success("Password reset successfully", {
+      description: "You can now sign in with your new password.",
+    });
+    await goto("/auth/login");
+  } catch (err) {
+    if (err instanceof Error) {
+      // Handle specific error cases
+      if (err.message.includes("expired") || err.message.includes("invalid")) {
+        error =
+          "This password reset link has expired or is invalid. Please request a new one.";
+      } else {
+        error = err.message;
+      }
+    } else {
+      error = "An unexpected error occurred. Please try again.";
+    }
+  } finally {
+    isLoading = false;
+  }
+}
 </script>
 
 <svelte:head>
diff --git a/apps/publisher-dashboard/src/routes/auth/setup/user/+page.svelte b/apps/publisher-dashboard/src/routes/auth/setup/user/+page.svelte
index f87155d..7cfee3b 100644
--- a/apps/publisher-dashboard/src/routes/auth/setup/user/+page.svelte
+++ b/apps/publisher-dashboard/src/routes/auth/setup/user/+page.svelte
@@ -1,78 +1,80 @@
 <script lang="ts">
-  import { goto } from "$app/navigation";
-  import { api } from "$lib/api/client";
-  import { ErrorAlert } from "$lib/components/auth";
-  import { Button } from "$lib/components/ui/button";
-  import { Input } from "$lib/components/ui/input";
-  import { Label } from "$lib/components/ui/label";
-  import { Alert, AlertDescription } from "$lib/components/ui/alert";
-  import { LoadingButton } from "$lib/components/ui/loading-button";
-  import { AlertCircle, Loader2 } from "@lucide/svelte";
-  import { createQuery } from "@tanstack/svelte-query";
-  import { toast } from "svelte-sonner";
-  import { validatePhone } from "$lib/utils/validation";
+import { AlertCircle, Loader2 } from "@lucide/svelte";
+import { createQuery } from "@tanstack/svelte-query";
+import { toast } from "svelte-sonner";
+import { goto } from "$app/navigation";
+import { api } from "$lib/api/client";
+import { ErrorAlert } from "$lib/components/auth";
+import { Alert, AlertDescription } from "$lib/components/ui/alert";
+import { Button } from "$lib/components/ui/button";
+import { Input } from "$lib/components/ui/input";
+import { Label } from "$lib/components/ui/label";
+import { LoadingButton } from "$lib/components/ui/loading-button";
+import { validatePhone } from "$lib/utils/validation";
 
-  // Fetch current user to check if setup is needed
-  // TanStack Query v6 with Svelte 5: options passed as thunk, results accessed directly
-  const userQuery = createQuery(() => ({
-    queryKey: ["me"],
-    queryFn: () => api.me.get(),
-  }));
+// Fetch current user to check if setup is needed
+// TanStack Query v6 with Svelte 5: options passed as thunk, results accessed directly
+const userQuery = createQuery(() => ({
+  queryKey: ["me"],
+  queryFn: () => api.me.get(),
+}));
 
-  // Redirect if user doesn't need setup
-  $effect(() => {
-    if (userQuery.data && !userQuery.data.needsSetup) {
-      goto("/performance");
-    }
-  });
+// Redirect if user doesn't need setup
+$effect(() => {
+  if (userQuery.data && !userQuery.data.needsSetup) {
+    goto("/performance");
+  }
+});
 
-  let displayName = $state("");
-  let fullName = $state("");
-  let phoneNumber = $state("");
-  let isSubmitting = $state(false);
-  let error = $state("");
-  let phoneError = $state("");
+let displayName = $state("");
+let fullName = $state("");
+let phoneNumber = $state("");
+let isSubmitting = $state(false);
+let error = $state("");
+let phoneError = $state("");
 
-  function handlePhoneBlur() {
-    const result = validatePhone(phoneNumber);
-    if (phoneNumber && !result.valid) {
-      phoneError = "Please enter a valid phone number (e.g., +1 555 123 4567)";
-    } else {
-      phoneError = "";
-      if (phoneNumber && result.formatted) {
-        phoneNumber = result.formatted;
-      }
+function handlePhoneBlur() {
+  const result = validatePhone(phoneNumber);
+  if (phoneNumber && !result.valid) {
+    phoneError = "Please enter a valid phone number (e.g., +1 555 123 4567)";
+  } else {
+    phoneError = "";
+    if (phoneNumber && result.formatted) {
+      phoneNumber = result.formatted;
     }
   }
+}
 
-  const isValid = $derived(
-    displayName.trim().length >= 1 &&
+const isValid = $derived(
+  displayName.trim().length >= 1 &&
     displayName.trim().length <= 100 &&
-    (!phoneNumber || validatePhone(phoneNumber).valid)
-  );
+    (!phoneNumber || validatePhone(phoneNumber).valid),
+);
 
-  async function handleSubmit(e: Event) {
-    e.preventDefault();
-    if (!isValid || isSubmitting) return;
-
-    isSubmitting = true;
-    error = "";
-
-    try {
-      await api.me.setupProfile({
-        displayName: displayName.trim(),
-        fullName: fullName.trim() || undefined,
-        phoneNumber: phoneNumber.trim() || undefined,
-      });
-
-      toast.success("Profile setup complete!");
-      goto("/performance");
-    } catch (e) {
-      error = e instanceof Error ? e.message : "Failed to save profile";
-    } finally {
-      isSubmitting = false;
-    }
+async function handleSubmit(e: Event) {
+  e.preventDefault();
+  if (!isValid || isSubmitting) {
+    return;
   }
+
+  isSubmitting = true;
+  error = "";
+
+  try {
+    await api.me.setupProfile({
+      displayName: displayName.trim(),
+      fullName: fullName.trim() || undefined,
+      phoneNumber: phoneNumber.trim() || undefined,
+    });
+
+    toast.success("Profile setup complete!");
+    goto("/performance");
+  } catch (e) {
+    error = e instanceof Error ? e.message : "Failed to save profile";
+  } finally {
+    isSubmitting = false;
+  }
+}
 </script>
 
 <svelte:head>
diff --git a/apps/publisher-dashboard/src/routes/auth/signup/+page.svelte b/apps/publisher-dashboard/src/routes/auth/signup/+page.svelte
index ea9a90c..69397d3 100644
--- a/apps/publisher-dashboard/src/routes/auth/signup/+page.svelte
+++ b/apps/publisher-dashboard/src/routes/auth/signup/+page.svelte
@@ -1,127 +1,142 @@
 <script lang="ts">
-  import { goto } from "$app/navigation";
-  import { api } from "$lib/api/client";
-  import { PasswordInput, PasswordStrength, ErrorAlert } from "$lib/components/auth";
-  import { Input } from "$lib/components/ui/input";
-  import { Label } from "$lib/components/ui/label";
-  import { LoadingButton } from "$lib/components/ui/loading-button";
-  import { browserSupportsWebAuthn, startRegistration } from "@simplewebauthn/browser";
-  import zxcvbn from "zxcvbn";
+import {
+  browserSupportsWebAuthn,
+  startRegistration,
+} from "@simplewebauthn/browser";
+import zxcvbn from "zxcvbn";
+import { goto } from "$app/navigation";
+import { api } from "$lib/api/client";
+import {
+  ErrorAlert,
+  PasswordInput,
+  PasswordStrength,
+} from "$lib/components/auth";
+import { Input } from "$lib/components/ui/input";
+import { Label } from "$lib/components/ui/label";
+import { LoadingButton } from "$lib/components/ui/loading-button";
 
-  // Form state
-  let email = $state("");
-  let password = $state("");
-  let confirmPassword = $state("");
-  let isLoading = $state(false);
-  let error = $state("");
+// Form state
+let email = $state("");
+let password = $state("");
+let confirmPassword = $state("");
+let isLoading = $state(false);
+let error = $state("");
 
-  // Authentication mode: "passkey" or "password"
-  let authMode = $state<"passkey" | "password">("passkey");
+// Authentication mode: "passkey" or "password"
+let authMode = $state<"passkey" | "password">("passkey");
 
-  // Check passkey support on mount
-  let supportsPasskey = $state(false);
-  $effect(() => {
-    supportsPasskey = browserSupportsWebAuthn();
-    if (!supportsPasskey) {
-      authMode = "password";
-    }
-  });
-
-  // Password validation
-  const passwordScore = $derived(password ? zxcvbn(password, [email]).score : 0);
-  const passwordsMatch = $derived(password === confirmPassword);
-  const isPasswordValid = $derived(
-    password.length >= 8 && passwordScore >= 3 && passwordsMatch && confirmPassword.length > 0
-  );
-
-  // Form validation
-  const isFormValid = $derived(
-    authMode === "passkey"
-      ? email.length > 0 && email.includes("@")
-      : email.length > 0 && email.includes("@") && isPasswordValid
-  );
-
-  async function handlePasskeySignup() {
-    isLoading = true;
-    error = "";
-
-    try {
-      // Step 1: Get registration options from server
-      const { challengeId, options } = await api.auth.webauthn.createRegistrationOptions({ email });
-
-      // Step 2: Start WebAuthn registration
-      const registrationResponse = await startRegistration({ optionsJSON: options });
-
-      // Step 3: Complete signup with passkey info
-      await api.auth.signup({
-        email,
-        passkeyInfo: {
-          challengeId,
-          response: registrationResponse,
-        },
-      });
-
-      // Redirect to user setup
-      await goto("/auth/setup/user");
-    } catch (err) {
-      if (err instanceof Error) {
-        // Handle WebAuthn cancellation
-        if (err.name === "NotAllowedError") {
-          error = "Passkey creation was cancelled. Please try again.";
-        } else {
-          error = err.message;
-        }
-      } else {
-        error = "An unexpected error occurred. Please try again.";
-      }
-    } finally {
-      isLoading = false;
-    }
-  }
-
-  async function handlePasswordSignup() {
-    isLoading = true;
-    error = "";
-
-    try {
-      await api.auth.signup({
-        email,
-        password,
-      });
-
-      // Redirect to user setup
-      await goto("/auth/setup/user");
-    } catch (err) {
-      if (err instanceof Error) {
-        error = err.message;
-      } else {
-        error = "An unexpected error occurred. Please try again.";
-      }
-    } finally {
-      isLoading = false;
-    }
-  }
-
-  async function handleSubmit(e: Event) {
-    e.preventDefault();
-    if (!isFormValid) return;
-
-    if (authMode === "passkey") {
-      await handlePasskeySignup();
-    } else {
-      await handlePasswordSignup();
-    }
-  }
-
-  function switchToPassword() {
+// Check passkey support on mount
+let supportsPasskey = $state(false);
+$effect(() => {
+  supportsPasskey = browserSupportsWebAuthn();
+  if (!supportsPasskey) {
     authMode = "password";
   }
+});
 
-  function switchToPasskey() {
-    authMode = "passkey";
-    password = "";
-    confirmPassword = "";
+// Password validation
+const passwordScore = $derived(password ? zxcvbn(password, [email]).score : 0);
+const passwordsMatch = $derived(password === confirmPassword);
+const isPasswordValid = $derived(
+  password.length >= 8 &&
+    passwordScore >= 3 &&
+    passwordsMatch &&
+    confirmPassword.length > 0,
+);
+
+// Form validation
+const isFormValid = $derived(
+  authMode === "passkey"
+    ? email.length > 0 && email.includes("@")
+    : email.length > 0 && email.includes("@") && isPasswordValid,
+);
+
+async function handlePasskeySignup() {
+  isLoading = true;
+  error = "";
+
+  try {
+    // Step 1: Get registration options from server
+    const { challengeId, options } =
+      await api.auth.webauthn.createRegistrationOptions({ email });
+
+    // Step 2: Start WebAuthn registration
+    const registrationResponse = await startRegistration({
+      optionsJSON: options,
+    });
+
+    // Step 3: Complete signup with passkey info
+    await api.auth.signup({
+      email,
+      passkeyInfo: {
+        challengeId,
+        response: registrationResponse,
+      },
+    });
+
+    // Redirect to user setup
+    await goto("/auth/setup/user");
+  } catch (err) {
+    if (err instanceof Error) {
+      // Handle WebAuthn cancellation
+      if (err.name === "NotAllowedError") {
+        error = "Passkey creation was cancelled. Please try again.";
+      } else {
+        error = err.message;
+      }
+    } else {
+      error = "An unexpected error occurred. Please try again.";
+    }
+  } finally {
+    isLoading = false;
   }
+}
+
+async function handlePasswordSignup() {
+  isLoading = true;
+  error = "";
+
+  try {
+    await api.auth.signup({
+      email,
+      password,
+    });
+
+    // Redirect to user setup
+    await goto("/auth/setup/user");
+  } catch (err) {
+    if (err instanceof Error) {
+      error = err.message;
+    } else {
+      error = "An unexpected error occurred. Please try again.";
+    }
+  } finally {
+    isLoading = false;
+  }
+}
+
+async function handleSubmit(e: Event) {
+  e.preventDefault();
+  if (!isFormValid) {
+    return;
+  }
+
+  if (authMode === "passkey") {
+    await handlePasskeySignup();
+  } else {
+    await handlePasswordSignup();
+  }
+}
+
+function switchToPassword() {
+  authMode = "password";
+}
+
+function switchToPasskey() {
+  authMode = "passkey";
+  password = "";
+  confirmPassword = "";
+}
 </script>
 
 <svelte:head>
diff --git a/apps/publisher-dashboard/src/routes/auth/trust-device/+page.svelte b/apps/publisher-dashboard/src/routes/auth/trust-device/+page.svelte
index 943b3e6..e404f64 100644
--- a/apps/publisher-dashboard/src/routes/auth/trust-device/+page.svelte
+++ b/apps/publisher-dashboard/src/routes/auth/trust-device/+page.svelte
@@ -1,78 +1,82 @@
 <script lang="ts">
-  import { goto } from "$app/navigation";
-  import { api } from "$lib/api/client";
-  import { ErrorAlert } from "$lib/components/auth";
-  import { Button } from "$lib/components/ui/button";
-  import { Input } from "$lib/components/ui/input";
-  import { Label } from "$lib/components/ui/label";
-  import { LoadingButton } from "$lib/components/ui/loading-button";
-  import { Monitor, Smartphone, Tablet, Shield, MapPin } from "@lucide/svelte";
-  import { createQuery } from "@tanstack/svelte-query";
-  import { toast } from "svelte-sonner";
-  import { UAParser } from "ua-parser-js";
+import { MapPin, Monitor, Shield, Smartphone, Tablet } from "@lucide/svelte";
+import { createQuery } from "@tanstack/svelte-query";
+import { toast } from "svelte-sonner";
+import { UAParser } from "ua-parser-js";
+import { goto } from "$app/navigation";
+import { api } from "$lib/api/client";
+import { ErrorAlert } from "$lib/components/auth";
+import { Button } from "$lib/components/ui/button";
+import { Input } from "$lib/components/ui/input";
+import { Label } from "$lib/components/ui/label";
+import { LoadingButton } from "$lib/components/ui/loading-button";
 
-  // Fetch device info from server
-  // TanStack Query v6 with Svelte 5: options passed as thunk, results accessed directly
-  const deviceQuery = createQuery(() => ({
-    queryKey: ["deviceInfo"],
-    queryFn: () => api.me.getDeviceInfo(),
-  }));
+// Fetch device info from server
+// TanStack Query v6 with Svelte 5: options passed as thunk, results accessed directly
+const deviceQuery = createQuery(() => ({
+  queryKey: ["deviceInfo"],
+  queryFn: () => api.me.getDeviceInfo(),
+}));
 
-  // Parse user agent for suggested device name
-  const parser = new UAParser(navigator.userAgent);
-  const browserName = parser.getBrowser().name || "Browser";
-  const osName = parser.getOS().name || "Device";
-  const deviceType = parser.getDevice().type;
+// Parse user agent for suggested device name
+const parser = new UAParser(navigator.userAgent);
+const browserName = parser.getBrowser().name || "Browser";
+const osName = parser.getOS().name || "Device";
+const deviceType = parser.getDevice().type;
 
-  const suggestedName = $derived(`${browserName} on ${osName}`);
+const suggestedName = $derived(`${browserName} on ${osName}`);
 
-  let deviceName = $state("");
-  let isSubmitting = $state(false);
-  let error = $state("");
+let deviceName = $state("");
+let isSubmitting = $state(false);
+let error = $state("");
 
-  // Initialize device name with suggestion
-  $effect(() => {
-    if (!deviceName && suggestedName) {
-      deviceName = suggestedName;
-    }
-  });
+// Initialize device name with suggestion
+$effect(() => {
+  if (!deviceName && suggestedName) {
+    deviceName = suggestedName;
+  }
+});
 
-  const isValid = $derived(deviceName.trim().length >= 1 && deviceName.trim().length <= 100);
+const isValid = $derived(
+  deviceName.trim().length >= 1 && deviceName.trim().length <= 100,
+);
 
-  async function handleTrust() {
-    if (!isValid || isSubmitting) return;
-
-    isSubmitting = true;
-    error = "";
-
-    try {
-      await api.me.trustDevice({ name: deviceName.trim() });
-      toast.success("Device trusted successfully!");
-      goto("/performance");
-    } catch (e) {
-      error = e instanceof Error ? e.message : "Failed to trust device";
-    } finally {
-      isSubmitting = false;
-    }
+async function handleTrust() {
+  if (!isValid || isSubmitting) {
+    return;
   }
 
-  async function handleSkip() {
+  isSubmitting = true;
+  error = "";
+
+  try {
+    await api.me.trustDevice({ name: deviceName.trim() });
+    toast.success("Device trusted successfully!");
     goto("/performance");
+  } catch (e) {
+    error = e instanceof Error ? e.message : "Failed to trust device";
+  } finally {
+    isSubmitting = false;
   }
+}
 
-  // Get device icon based on type
-  function getDeviceIcon() {
-    switch (deviceType) {
-      case "mobile":
-        return Smartphone;
-      case "tablet":
-        return Tablet;
-      default:
-        return Monitor;
-    }
+async function handleSkip() {
+  goto("/performance");
+}
+
+// Get device icon based on type
+function getDeviceIcon() {
+  switch (deviceType) {
+    case "mobile":
+      return Smartphone;
+    case "tablet":
+      return Tablet;
+    default:
+      return Monitor;
   }
+}
 
-  const DeviceIcon = getDeviceIcon();
+const DeviceIcon = getDeviceIcon();
 </script>
 
 <svelte:head>
diff --git a/apps/publisher-dashboard/src/routes/auth/verify/+page.svelte b/apps/publisher-dashboard/src/routes/auth/verify/+page.svelte
index fa994c7..95bea6d 100644
--- a/apps/publisher-dashboard/src/routes/auth/verify/+page.svelte
+++ b/apps/publisher-dashboard/src/routes/auth/verify/+page.svelte
@@ -1,11 +1,11 @@
 <script lang="ts">
-import { page } from "$app/state";
-import { goto } from "$app/navigation";
+import { CheckCircle2, Loader2, Mail, XCircle } from "@lucide/svelte";
 import { toast } from "svelte-sonner";
+import { goto } from "$app/navigation";
+import { page } from "$app/state";
+import { api } from "$lib/api/client";
 import { ErrorAlert } from "$lib/components/auth";
 import { Button } from "$lib/components/ui/button";
-import { api } from "$lib/api/client";
-import { Mail, XCircle, CheckCircle2, Loader2 } from "@lucide/svelte";
 
 /**
  * Email verification callback page
@@ -42,7 +42,7 @@ async function verifyEmail(): Promise<void> {
 // Auto-verify on mount
 $effect(() => {
   if (token) {
-    verifyEmail();
+    void verifyEmail();
   } else {
     error = "No verification token provided";
     isVerifying = false;
@@ -58,7 +58,8 @@ async function resendVerification(): Promise<void> {
     toast.success("Verification email sent! Check your inbox.");
     error = "";
   } catch (e) {
-    const message = e instanceof Error ? e.message : "Failed to send verification email";
+    const message =
+      e instanceof Error ? e.message : "Failed to send verification email";
     toast.error(message);
   }
 }
diff --git a/apps/publisher-dashboard/src/routes/login/+page.svelte b/apps/publisher-dashboard/src/routes/login/+page.svelte
index f8cf816..bda2dd1 100644
--- a/apps/publisher-dashboard/src/routes/login/+page.svelte
+++ b/apps/publisher-dashboard/src/routes/login/+page.svelte
@@ -1,10 +1,10 @@
 <script lang="ts">
-  import { goto } from "$app/navigation";
+import { goto } from "$app/navigation";
 
-  // Redirect old /login route to new /auth/login
-  $effect(() => {
-    goto("/auth/login", { replaceState: true });
-  });
+// Redirect old /login route to new /auth/login
+$effect(() => {
+  goto("/auth/login", { replaceState: true });
+});
 </script>
 
 <div class="flex min-h-screen items-center justify-center">