@fonderie/auth 1.0.0

package/dist/index.cjs

@@ -0,0 +1,1952 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/services/password.ts
+var password_exports = {};
+__export(password_exports, {
+  hashPassword: () => hashPassword,
+  verifyPassword: () => verifyPassword
+});
+async function hashPassword(plain) {
+  return import_bcryptjs.default.hash(plain, ROUNDS);
+}
+async function verifyPassword(plain, hash) {
+  return import_bcryptjs.default.compare(plain, hash);
+}
+var import_bcryptjs, ROUNDS;
+var init_password = __esm({
+  "src/services/password.ts"() {
+    "use strict";
+    import_bcryptjs = __toESM(require("bcryptjs"), 1);
+    ROUNDS = 12;
+  }
+});
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AUTH_CONFIG_KEYS: () => AUTH_CONFIG_KEYS,
+  AuthModule: () => AuthModule,
+  MESSAGE_KEYS: () => MESSAGE_KEYS,
+  normalizeEmail: () => normalizeEmail,
+  normalizeEmailSafe: () => normalizeEmailSafe,
+  requireAuth: () => import_middlewares2.requireAuth,
+  toUserDTO: () => toUserDTO,
+  withSession: () => withSession
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/routes.ts
+var import_middlewares = require("@fonderie/core/middlewares");
+
+// src/middlewares/require-email-login.ts
+var import_core = require("@fonderie/core");
+var requireEmailLogin = async (ctx, next) => {
+  if (ctx.user.loginMethod !== "email") {
+    return (0, import_core.setApiResponse)(
+      import_core.HTTP.FORBIDDEN,
+      "EMAIL_LOGIN_REQUIRED",
+      "This action requires email authentication"
+    );
+  }
+  return next();
+};
+
+// src/controllers/mfa.controller.ts
+var import_qrcode = __toESM(require("qrcode"), 1);
+var import_core3 = require("@fonderie/core");
+var import_events = require("@fonderie/events");
+
+// src/config.ts
+var DEFAULT_VERIFICATION_COOLDOWN = 5 * 60 * 1e3;
+var AUTH_CONFIG_KEYS = {
+  sessionDuration: "auth.session.duration",
+  verificationCooldown: "auth.verification.cooldown",
+  mfa: "auth.mfa.enabled",
+  requireVerification: "auth.verification.required"
+};
+var MESSAGE_KEYS = {
+  emailRegistration: "email-registration",
+  emailVerification: "email-verification",
+  passwordReset: "password-reset",
+  phoneOtp: "phone-otp",
+  mfaEnabled: "mfa-enabled",
+  mfaDisabled: "mfa-disabled",
+  mfaBackupCodesRegenerated: "mfa-backup-codes-regenerated",
+  emailChanged: "email-changed",
+  phoneChanged: "phone-changed"
+};
+var EVENT_KEYS = {
+  userRegistered: "fonderie.user.registered",
+  userDeleted: "fonderie.user.deleted",
+  emailVerified: "fonderie.user.email_verified",
+  passwordChanged: "fonderie.user.password_changed"
+};
+
+// src/services/jwt.ts
+var import_jsonwebtoken = __toESM(require("jsonwebtoken"), 1);
+function issueMfaPendingToken(userId, config, loginMethod) {
+  return import_jsonwebtoken.default.sign(
+    {
+      sub: userId,
+      type: "access",
+      loginMethod,
+      phoneVerified: false,
+      mfaPending: true
+    },
+    config.jwtSecret,
+    { expiresIn: "5m" }
+  );
+}
+function issueTokenPair(userId, config, options) {
+  const duration = config.sessionDuration ?? "7d";
+  const loginMethod = options.loginMethod;
+  const phoneVerified = options.phoneVerified ?? false;
+  const accessToken = import_jsonwebtoken.default.sign(
+    { sub: userId, type: "access", loginMethod, phoneVerified },
+    config.jwtSecret,
+    { expiresIn: "24h" }
+  );
+  const refreshToken = import_jsonwebtoken.default.sign(
+    { sub: userId, type: "refresh", loginMethod, phoneVerified },
+    config.jwtSecret,
+    { expiresIn: duration }
+  );
+  return { accessToken, refreshToken };
+}
+function refreshTokenExpiry(token) {
+  const decoded = import_jsonwebtoken.default.decode(token);
+  return decoded?.exp ? new Date(decoded.exp * 1e3) : new Date(Date.now() + 7 * 24 * 60 * 60 * 1e3);
+}
+function verifyToken(token, config) {
+  try {
+    return import_jsonwebtoken.default.verify(token, config.jwtSecret);
+  } catch {
+    return null;
+  }
+}
+
+// src/services/mfa.ts
+var import_node_crypto = require("crypto");
+var STEP = 30;
+var DRIFT = 1;
+var DIGITS = 6;
+function hotp(secret, counter) {
+  const buf = Buffer.alloc(8);
+  let c = counter;
+  for (let i = 7; i >= 0; i--) {
+    buf[i] = c & 255;
+    c >>= 8;
+  }
+  const key = Buffer.from(base32Decode(secret));
+  const hmac = (0, import_node_crypto.createHmac)("sha1", key).update(buf).digest();
+  const offset = (hmac[19] ?? 0) & 15;
+  const code = (((hmac[offset] ?? 0) & 127) << 24 | ((hmac[offset + 1] ?? 0) & 255) << 16 | ((hmac[offset + 2] ?? 0) & 255) << 8 | (hmac[offset + 3] ?? 0) & 255) % Math.pow(10, DIGITS);
+  return code.toString().padStart(DIGITS, "0");
+}
+function timeCounter() {
+  return Math.floor(Date.now() / 1e3 / STEP);
+}
+function base32Decode(input) {
+  const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const clean = input.toUpperCase().replace(/=+$/, "");
+  let bits = 0;
+  let value = 0;
+  const output = [];
+  for (const char of clean) {
+    const idx = ALPHABET.indexOf(char);
+    if (idx === -1) {
+      continue;
+    }
+    value = value << 5 | idx;
+    bits += 5;
+    if (bits >= 8) {
+      output.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(output);
+}
+function base32Encode(buf) {
+  const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  let bits = 0;
+  let value = 0;
+  let output = "";
+  for (const byte of buf) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += ALPHABET[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) {
+    output += ALPHABET[value << 5 - bits & 31];
+  }
+  return output;
+}
+function generateTotpSecret() {
+  return base32Encode((0, import_node_crypto.randomBytes)(20));
+}
+function generateTotpUri(email, secret, issuer) {
+  const params = new URLSearchParams({
+    secret,
+    issuer,
+    algorithm: "SHA1",
+    digits: String(DIGITS),
+    period: String(STEP)
+  });
+  return `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(email)}?${params}`;
+}
+function verifyTotpToken(token, secret) {
+  const t = timeCounter();
+  for (let i = -DRIFT; i <= DRIFT; i++) {
+    if (hotp(secret, t + i) === token) {
+      return true;
+    }
+  }
+  return false;
+}
+function generateBackupCodes(count = 8) {
+  return Array.from({ length: count }, () => (0, import_node_crypto.randomBytes)(4).toString("hex").toUpperCase());
+}
+
+// src/controllers/mfa.controller.ts
+init_password();
+
+// src/dtos/user.ts
+var import_core2 = require("@fonderie/core");
+var DEFAULT_PREFERENCES = {
+  locale: "en-US",
+  timezone: "UTC",
+  notifications: { email: true, inApp: true, sms: false, push: false },
+  emailDigest: "immediate",
+  dateFormat: "MM/DD/YYYY",
+  timeFormat: "hh:mm A"
+};
+function toUserDTO(user, phoneVerified = false) {
+  const prefs = user.preferences ?? {};
+  return {
+    id: (0, import_core2.stringOrEmpty)(user.id),
+    email: (0, import_core2.stringOrEmpty)(user.email),
+    firstName: (0, import_core2.stringOrEmpty)(user.firstName),
+    lastName: (0, import_core2.stringOrEmpty)(user.lastName),
+    phone: (0, import_core2.stringOrEmpty)(user.phone),
+    profileImageUrl: (0, import_core2.stringOrEmpty)(user.profileImageUrl),
+    isActive: typeof user.isActive === "boolean" ? user.isActive : true,
+    lastLogin: user.lastLogin instanceof Date ? user.lastLogin.toISOString() : "",
+    preferences: {
+      ...DEFAULT_PREFERENCES,
+      ...prefs,
+      locale: user.locale || prefs.locale || "en-US",
+      timezone: user.timezone || prefs.timezone || "UTC"
+    },
+    isEmailVerified: user.emailVerifiedAt !== null,
+    isPhoneVerified: phoneVerified,
+    mfaEnabled: (0, import_core2.booleanOrFalse)(user.mfaEnabled),
+    suspended: (0, import_core2.booleanOrFalse)(user.suspended),
+    whitelist: (0, import_core2.booleanOrFalse)(user.whitelist),
+    ipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],
+    createdAt: user.createdAt instanceof Date ? user.createdAt.toISOString() : "",
+    updatedAt: user.updatedAt instanceof Date ? user.updatedAt.toISOString() : ""
+  };
+}
+
+// src/models/user.model.ts
+var USER_COLUMNS = `
+	id,
+	email,
+	password_hash      AS "passwordHash",
+	first_name         AS "firstName",
+	last_name          AS "lastName",
+	phone,
+	profile_image_url  AS "profileImageUrl",
+	locale,
+	timezone,
+	is_active          AS "isActive",
+	last_login         AS "lastLogin",
+	preferences,
+	suspended,
+	whitelist,
+	ip_whitelist       AS "ipWhitelist",
+	mfa_enabled        AS "mfaEnabled",
+	mfa_secret         AS "mfaSecret",
+	email_verified_at  AS "emailVerifiedAt",
+	deleted_at         AS "deletedAt",
+	created_at         AS "createdAt",
+	updated_at         AS "updatedAt"
+`;
+var UserModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  async findById(id) {
+    const [row] = await this.store.query(
+      `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE id = $1 AND deleted_at IS NULL`,
+      [id]
+    );
+    return row ?? null;
+  }
+  async findByEmail(email) {
+    const [row] = await this.store.query(
+      `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE email = $1 AND deleted_at IS NULL`,
+      [email]
+    );
+    return row ?? null;
+  }
+  async findByPhone(phone) {
+    const [row] = await this.store.query(
+      `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE phone = $1 AND deleted_at IS NULL`,
+      [phone]
+    );
+    return row ?? null;
+  }
+  async findOrCreateByPhone(phone, firstName = null, lastName = null) {
+    const [row] = await this.store.query(
+      `INSERT INTO fonderie_users (phone, first_name, last_name)
+			VALUES ($1, $2, $3)
+			ON CONFLICT (phone) DO UPDATE
+			SET first_name = COALESCE(EXCLUDED.first_name, fonderie_users.first_name),
+			    last_name  = COALESCE(EXCLUDED.last_name,  fonderie_users.last_name),
+			    updated_at = now()
+			RETURNING id`,
+      [phone, firstName, lastName]
+    );
+    return row;
+  }
+  async create(email, passwordHash, firstName, lastName) {
+    const [row] = await this.store.query(
+      `INSERT INTO fonderie_users (email, password_hash, first_name, last_name)
+			VALUES ($1, $2, $3, $4)
+			RETURNING id`,
+      [email.toLowerCase().trim(), passwordHash, firstName, lastName]
+    );
+    return row ?? null;
+  }
+  async update(id, fields) {
+    const columnMap = {
+      firstName: "first_name",
+      lastName: "last_name",
+      phoneNumber: "phone",
+      avatarUrl: "profile_image_url",
+      locale: "locale",
+      timezone: "timezone",
+      preferences: "preferences"
+    };
+    const sets = [];
+    const values = [];
+    for (const [key, col] of Object.entries(columnMap)) {
+      if (fields[key] !== void 0) {
+        values.push(fields[key]);
+        sets.push(`${col} = $${values.length}`);
+      }
+    }
+    values.push(id);
+    const [row] = await this.store.query(
+      `UPDATE fonderie_users SET ${sets.join(", ")}, updated_at = now() WHERE id = $${values.length} AND deleted_at IS NULL RETURNING id`,
+      values
+    );
+    return row ?? null;
+  }
+  async updatePassword(id, passwordHash) {
+    await this.store.query(`UPDATE fonderie_users SET password_hash = $1 WHERE id = $2`, [
+      passwordHash,
+      id
+    ]);
+  }
+  async markEmailVerified(id) {
+    await this.store.query(
+      `UPDATE fonderie_users SET email_verified_at = now(), updated_at = now() WHERE id = $1`,
+      [id]
+    );
+  }
+  async softDelete(id) {
+    await this.store.query(
+      `UPDATE fonderie_users SET deleted_at = now(), updated_at = now() WHERE id = $1`,
+      [id]
+    );
+  }
+  async saveMfaSecret(id, secret) {
+    await this.store.query(`UPDATE fonderie_users SET mfa_secret = $1 WHERE id = $2`, [secret, id]);
+  }
+  async saveMfaPendingSecret(id, secret) {
+    await this.store.query(
+      `UPDATE fonderie_users
+			 SET mfa_secret_pending = $1, mfa_secret_pending_expires_at = now() + interval '15 minutes'
+			 WHERE id = $2`,
+      [secret, id]
+    );
+  }
+  async getMfaPendingSecret(id) {
+    const [row] = await this.store.query(
+      `SELECT mfa_secret_pending FROM fonderie_users
+			 WHERE id = $1 AND mfa_secret_pending_expires_at > now()`,
+      [id]
+    );
+    return row?.mfa_secret_pending ?? null;
+  }
+  async confirmMfaSecret(id) {
+    await this.store.query(
+      `UPDATE fonderie_users
+			 SET mfa_secret                    = mfa_secret_pending,
+			     mfa_secret_pending            = NULL,
+			     mfa_secret_pending_expires_at = NULL,
+			     mfa_enabled                   = true,
+			     updated_at                    = now()
+			 WHERE id = $1`,
+      [id]
+    );
+  }
+  async enableMfa(id) {
+    await this.store.query(`UPDATE fonderie_users SET mfa_enabled = true WHERE id = $1`, [id]);
+  }
+  async disableMfa(id) {
+    await this.store.query(
+      `UPDATE fonderie_users SET mfa_enabled = false, mfa_secret = NULL, updated_at = now() WHERE id = $1`,
+      [id]
+    );
+  }
+  async updateEmail(id, email) {
+    await this.store.query(
+      `UPDATE fonderie_users SET email = $1, email_verified_at = NULL, updated_at = now() WHERE id = $2`,
+      [email.toLowerCase().trim(), id]
+    );
+  }
+  async updatePhone(id, phone) {
+    await this.store.query(
+      `UPDATE fonderie_users SET phone = $1, updated_at = now() WHERE id = $2`,
+      [phone, id]
+    );
+  }
+  async updatePreferences(id, fields) {
+    const sets = [];
+    const values = [];
+    if (fields.locale !== void 0) {
+      values.push(fields.locale);
+      sets.push(`locale = $${values.length}`);
+    }
+    if (fields.timezone !== void 0) {
+      values.push(fields.timezone);
+      sets.push(`timezone = $${values.length}`);
+    }
+    if (fields.patch && Object.keys(fields.patch).length > 0) {
+      values.push(JSON.stringify(fields.patch));
+      sets.push(`preferences = preferences || $${values.length}::jsonb`);
+    }
+    if (sets.length === 0) return null;
+    values.push(id);
+    const [row] = await this.store.query(
+      `UPDATE fonderie_users SET ${sets.join(", ")}, updated_at = now() WHERE id = $${values.length} AND deleted_at IS NULL RETURNING id`,
+      values
+    );
+    return row ?? null;
+  }
+  async getMfaSecret(id) {
+    const [row] = await this.store.query(
+      `SELECT mfa_secret FROM fonderie_users WHERE id = $1`,
+      [id]
+    );
+    return row?.mfa_secret ?? null;
+  }
+  async upsertByProvider(email, provider, providerId) {
+    const [row] = await this.store.query(
+      `INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
+			VALUES ($1, now(), $2, $3)
+			ON CONFLICT (email) DO UPDATE
+			SET provider = $2, provider_id = $3
+			RETURNING id`,
+      [email, provider, providerId]
+    );
+    return row ?? null;
+  }
+};
+
+// src/models/session.model.ts
+var SessionModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  async create(userId, token, expiresAt) {
+    await this.store.query(
+      `INSERT INTO fonderie_sessions (user_id, token, expires_at)
+			VALUES ($1, $2, $3)
+			ON CONFLICT (token) DO NOTHING`,
+      [userId, token, expiresAt]
+    );
+  }
+  async delete(token) {
+    await this.store.query(`DELETE FROM fonderie_sessions WHERE token = $1`, [token]);
+  }
+  async exists(token) {
+    const rows = await this.store.query(
+      `SELECT id FROM fonderie_sessions WHERE token = $1 AND expires_at > now()`,
+      [token]
+    );
+    return rows.length > 0;
+  }
+};
+
+// src/models/backup-code.model.ts
+var BackupCodeModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  async replace(userId, codeHashes) {
+    await this.store.transaction(async (tx) => {
+      await tx.query(`DELETE FROM fonderie_mfa_backup_codes WHERE user_id = $1`, [userId]);
+      if (codeHashes.length === 0) return;
+      const placeholders = codeHashes.map((_, i) => `($1, $${i + 2})`).join(", ");
+      await tx.query(
+        `INSERT INTO fonderie_mfa_backup_codes (user_id, code_hash) VALUES ${placeholders}`,
+        [userId, ...codeHashes]
+      );
+    });
+  }
+  async findUnused(userId) {
+    const rows = await this.store.query(
+      `SELECT id, code_hash FROM fonderie_mfa_backup_codes
+			 WHERE user_id = $1 AND used_at IS NULL`,
+      [userId]
+    );
+    return rows.map((r) => ({ id: r.id, codeHash: r.code_hash }));
+  }
+  async consume(id) {
+    await this.store.query(`UPDATE fonderie_mfa_backup_codes SET used_at = now() WHERE id = $1`, [
+      id
+    ]);
+  }
+  async deleteByUser(userId) {
+    await this.store.query(`DELETE FROM fonderie_mfa_backup_codes WHERE user_id = $1`, [userId]);
+  }
+};
+
+// src/controllers/mfa.controller.ts
+function mfaController(store, config, issuer, bus) {
+  const users = new UserModel(store);
+  const sessions = new SessionModel(store);
+  const backupCodes = new BackupCodeModel(store);
+  return {
+    // ── 1. Setup ───────────────────────────────────────────────
+    setup: async (ctx) => {
+      const secret = generateTotpSecret();
+      const uri = generateTotpUri(ctx.user.email ?? ctx.user.id, secret, issuer);
+      const plainCodes = generateBackupCodes();
+      const codeHashes = await Promise.all(plainCodes.map((c) => hashPassword(c)));
+      const qr = await import_qrcode.default.toDataURL(uri);
+      await Promise.all([
+        users.saveMfaPendingSecret(ctx.user.id, secret),
+        backupCodes.replace(ctx.user.id, codeHashes)
+      ]);
+      return (0, import_core3.setApiResponse)(
+        import_core3.HTTP.OK,
+        "MFA_SETUP_INITIATED",
+        "Scan the QR code with your authenticator app.",
+        {
+          qr,
+          // uri — expose when adding a "manual entry" flow in the UI (otpauth:// URI lets
+          // users add the credential by typing the secret instead of scanning the QR code)
+          backupCodes: plainCodes
+        }
+      );
+    },
+    // ── 2. Verify (setup confirm · TOTP login · backup code login) ──
+    verify: async (ctx) => {
+      const body = ctx.meta["body"];
+      const token = body?.["token"];
+      if (typeof token !== "string") {
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "token is required");
+      }
+      const pendingSecret = await users.getMfaPendingSecret(ctx.user.id);
+      if (pendingSecret) {
+        if (!verifyTotpToken(token, pendingSecret)) {
+          return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
+        }
+        await users.confirmMfaSecret(ctx.user.id);
+        bus?.emit(import_events.NOTIFICATION_EVENT, {
+          type: MESSAGE_KEYS.mfaEnabled,
+          data: {},
+          recipient: { email: ctx.user.email, phone: null, deviceToken: null }
+        }).catch(() => {
+        });
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "MFA_VERIFIED", "MFA verified successfully.", {
+          mfaEnabled: true
+        });
+      } else if (/^[A-Z0-9]{8}$/i.test(token)) {
+        if (!ctx.user.mfaPending) {
+          return (0, import_core3.setApiResponse)(
+            import_core3.HTTP.FORBIDDEN,
+            "MFA_NOT_PENDING",
+            "Use the mfaToken from the login response"
+          );
+        }
+        if (!ctx.user.mfaEnabled) {
+          return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "MFA_NOT_CONFIGURED", "MFA not configured");
+        }
+        const unused = await backupCodes.findUnused(ctx.user.id);
+        const checks = await Promise.all(
+          unused.map(async (row) => ({
+            id: row.id,
+            match: await verifyPassword(token.toUpperCase(), row.codeHash)
+          }))
+        );
+        const matched = checks.find((r) => r.match);
+        if (!matched) {
+          return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid backup code");
+        }
+        await backupCodes.consume(matched.id);
+      } else {
+        if (!ctx.user.mfaPending) {
+          return (0, import_core3.setApiResponse)(
+            import_core3.HTTP.FORBIDDEN,
+            "MFA_NOT_PENDING",
+            "Use the mfaToken from the login response"
+          );
+        }
+        const secret = await users.getMfaSecret(ctx.user.id);
+        if (!secret) {
+          return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "MFA_NOT_CONFIGURED", "MFA not configured");
+        }
+        if (!verifyTotpToken(token, secret)) {
+          return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
+        }
+        if (!ctx.user.mfaEnabled) {
+          await users.enableMfa(ctx.user.id);
+        }
+      }
+      const { accessToken, refreshToken } = issueTokenPair(ctx.user.id, config, {
+        loginMethod: ctx.user.loginMethod
+      });
+      await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken));
+      const fullUser = await users.findById(ctx.user.id);
+      if (!fullUser) {
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.SERVER_ERROR, "SERVER_ERROR", "User not found after MFA verify");
+      }
+      return Response.json(
+        {
+          reason: "MFA_VERIFIED",
+          explanation: "MFA verified successfully.",
+          result: {
+            tokens: { access: accessToken, refresh: refreshToken },
+            user: toUserDTO(fullUser)
+          }
+        },
+        {
+          status: 200,
+          headers: {
+            "Set-Cookie": [
+              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
+              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
+            ].join(", ")
+          }
+        }
+      );
+    },
+    // ── 3. Regenerate backup codes ────────────────────────────
+    regenerateBackupCodes: async (ctx) => {
+      const body = ctx.meta["body"];
+      const token = body?.["token"];
+      if (typeof token !== "string") {
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "TOTP token is required");
+      }
+      if (!ctx.user.mfaEnabled) {
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "MFA_NOT_ENABLED", "MFA is not enabled");
+      }
+      const secret = await users.getMfaSecret(ctx.user.id);
+      if (!secret || !verifyTotpToken(token, secret)) {
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid TOTP code");
+      }
+      const plainCodes = generateBackupCodes();
+      const codeHashes = await Promise.all(plainCodes.map((c) => hashPassword(c)));
+      await backupCodes.replace(ctx.user.id, codeHashes);
+      bus?.emit(import_events.NOTIFICATION_EVENT, {
+        type: MESSAGE_KEYS.mfaBackupCodesRegenerated,
+        data: {},
+        recipient: { email: ctx.user.email, phone: null, deviceToken: null }
+      }).catch(() => {
+      });
+      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "BACKUP_CODES_REGENERATED", "Backup codes regenerated.", {
+        backupCodes: plainCodes
+      });
+    },
+    // ── 4. Disable ─────────────────────────────────────────────
+    disable: async (ctx) => {
+      const body = ctx.meta["body"];
+      const token = body?.["token"];
+      if (typeof token !== "string") {
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "TOTP token is required");
+      }
+      const user = await users.findById(ctx.user.id);
+      if (!user || !user.mfaEnabled) {
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "MFA_NOT_ENABLED", "MFA is not enabled");
+      }
+      const secret = user.mfaSecret;
+      if (!secret || !verifyTotpToken(token, secret)) {
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid TOTP code");
+      }
+      await Promise.all([users.disableMfa(ctx.user.id), backupCodes.deleteByUser(ctx.user.id)]);
+      bus?.emit(import_events.NOTIFICATION_EVENT, {
+        type: MESSAGE_KEYS.mfaDisabled,
+        data: {},
+        recipient: { email: user.email, phone: null, deviceToken: null }
+      }).catch(() => {
+      });
+      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "MFA_DISABLED", "MFA disabled successfully.");
+    }
+  };
+}
+
+// src/controllers/auth.controller.ts
+var import_node_crypto2 = require("crypto");
+var import_events2 = require("@fonderie/events");
+var import_core4 = require("@fonderie/core");
+
+// src/services/cooldown.ts
+function checkCooldown(lastSentAt, cooldownMs) {
+  if (!lastSentAt) return 0;
+  return Math.max(0, cooldownMs - (Date.now() - lastSentAt.getTime()));
+}
+
+// src/controllers/auth.controller.ts
+init_password();
+
+// src/services/email.ts
+function normalizeEmail(email) {
+  if (typeof email !== "string" || email.length === 0) {
+    throw new Error("Invalid email");
+  }
+  const lower = email.trim().toLowerCase();
+  if (lower.length === 0) {
+    throw new Error("Email cannot be empty");
+  }
+  const atIndex = lower.indexOf("@");
+  if (atIndex === -1 || lower.lastIndexOf("@") !== atIndex) {
+    throw new Error("Invalid email format");
+  }
+  const local = lower.substring(0, atIndex);
+  const domain = lower.substring(atIndex + 1);
+  if (!local || !domain) {
+    throw new Error("Invalid email format");
+  }
+  const plusIndex = local.indexOf("+");
+  const normalizedLocal = plusIndex === -1 ? local : local.substring(0, plusIndex);
+  if (!normalizedLocal) {
+    throw new Error("Invalid email format");
+  }
+  return `${normalizedLocal}@${domain}`;
+}
+function normalizeEmailSafe(email) {
+  try {
+    return normalizeEmail(email);
+  } catch {
+    return null;
+  }
+}
+
+// src/models/password-reset.model.ts
+var PasswordResetModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  async create(userId, pin, expiresAt) {
+    await this.store.query(
+      `INSERT INTO fonderie_password_resets (user_id, pin, expires_at, created_at)
+			VALUES ($1, $2, $3, now())
+			ON CONFLICT (user_id) DO UPDATE
+			SET pin = $2, expires_at = $3, created_at = now()`,
+      [userId, pin, expiresAt]
+    );
+  }
+  async findLastSentAt(userId) {
+    const [row] = await this.store.query(
+      `SELECT created_at FROM fonderie_password_resets WHERE user_id = $1`,
+      [userId]
+    );
+    if (!row) return null;
+    return new Date(row.created_at);
+  }
+  async findByPin(pin) {
+    const [row] = await this.store.query(
+      `SELECT user_id, expires_at FROM fonderie_password_resets WHERE pin = $1`,
+      [pin]
+    );
+    if (!row) return null;
+    return { userId: row.user_id, expiresAt: new Date(row.expires_at) };
+  }
+  async deleteByUser(userId) {
+    await this.store.query(`DELETE FROM fonderie_password_resets WHERE user_id = $1`, [userId]);
+  }
+};
+
+// src/models/email-verification.model.ts
+var EmailVerificationModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  async create(userId, pin, expiresAt) {
+    await this.store.query(
+      `INSERT INTO fonderie_email_verifications (user_id, token, expires_at)
+			VALUES ($1, $2, $3)
+			ON CONFLICT (user_id) DO UPDATE SET token = $2, expires_at = $3`,
+      [userId, pin, expiresAt]
+    );
+  }
+  async find(pin) {
+    const [row] = await this.store.query(
+      `SELECT user_id, expires_at FROM fonderie_email_verifications WHERE token = $1`,
+      [pin]
+    );
+    if (!row) return null;
+    return { userId: row.user_id, expiresAt: new Date(row.expires_at) };
+  }
+  async delete(pin) {
+    await this.store.query(`DELETE FROM fonderie_email_verifications WHERE token = $1`, [pin]);
+  }
+  async findByUser(userId, pin) {
+    const [row] = await this.store.query(
+      `SELECT expires_at FROM fonderie_email_verifications WHERE user_id = $1 AND token = $2`,
+      [userId, pin]
+    );
+    if (!row) return null;
+    return { expiresAt: new Date(row.expires_at) };
+  }
+  async findLastSentAt(userId) {
+    const [row] = await this.store.query(
+      `SELECT created_at FROM fonderie_email_verifications WHERE user_id = $1`,
+      [userId]
+    );
+    if (!row) return null;
+    return new Date(row.created_at);
+  }
+  async replace(userId, pin, expiresAt) {
+    await this.store.transaction(async (tx) => {
+      await tx.query(`DELETE FROM fonderie_email_verifications WHERE user_id = $1`, [userId]);
+      await tx.query(
+        `INSERT INTO fonderie_email_verifications (token, user_id, expires_at)
+				VALUES ($1, $2, $3)`,
+        [pin, userId, expiresAt]
+      );
+    });
+  }
+};
+
+// src/models/phone-verification.model.ts
+var PhoneVerificationModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  async upsert(userId, phone, otp, expiresAt) {
+    await this.store.query(
+      `INSERT INTO fonderie_phone_verifications (phone, user_id, otp, expires_at)
+			VALUES ($1, $2, $3, $4)
+			ON CONFLICT (phone) DO UPDATE
+			SET user_id = $2, otp = $3, expires_at = $4, created_at = now()`,
+      [phone, userId, otp, expiresAt]
+    );
+  }
+  async findByUser(userId, otp) {
+    const [row] = await this.store.query(
+      `SELECT phone, expires_at FROM fonderie_phone_verifications WHERE user_id = $1 AND otp = $2`,
+      [userId, otp]
+    );
+    if (!row) return null;
+    return { phone: row.phone, expiresAt: new Date(row.expires_at) };
+  }
+  async findLastSentAt(userId) {
+    const [row] = await this.store.query(
+      `SELECT created_at FROM fonderie_phone_verifications WHERE user_id = $1`,
+      [userId]
+    );
+    if (!row) return null;
+    return new Date(row.created_at);
+  }
+  async deleteByUser(userId) {
+    await this.store.query(`DELETE FROM fonderie_phone_verifications WHERE user_id = $1`, [userId]);
+  }
+};
+
+// src/controllers/auth.controller.ts
+function normalizePhone(phone) {
+  return phone.trim().replace(/[\s()\-\.]/g, "");
+}
+function isValidPhone(phone) {
+  return typeof phone === "string" && /^\+?[1-9]\d{6,14}$/.test(normalizePhone(phone));
+}
+function extractRefreshToken(ctx) {
+  const body = ctx.meta["body"];
+  if (typeof body?.["refreshToken"] === "string") {
+    return body["refreshToken"];
+  }
+  const cookie = ctx.request.headers.get("cookie") ?? "";
+  const match = cookie.match(/(?:^|;\s*)refresh_token=([^;]+)/);
+  return match?.[1] ?? null;
+}
+function authController(store, config, bus) {
+  const users = new UserModel(store);
+  const sessions = new SessionModel(store);
+  const passwordReset = new PasswordResetModel(store);
+  const emailVerif = new EmailVerificationModel(store);
+  const phoneVerif = new PhoneVerificationModel(store);
+  const OTP_TTL_MS = 10 * 60 * 1e3;
+  return {
+    register: async (ctx) => {
+      const body = ctx.meta["body"];
+      const { email, password, phone, firstName = null, lastName = null } = body ?? {};
+      if (typeof email === "string" && typeof password === "string") {
+        const normalizedEmail = normalizeEmailSafe(email);
+        if (!normalizedEmail) {
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+        }
+        if (password.length < 8) {
+          return (0, import_core4.setApiResponse)(
+            import_core4.HTTP.UNPROCESSABLE,
+            "INVALID_PARAMETER",
+            "password must be at least 8 characters"
+          );
+        }
+        const existing = await users.findByEmail(normalizedEmail);
+        if (existing) {
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Email already registered");
+        }
+        const passwordHash = await hashPassword(password);
+        const row = await users.create(
+          normalizedEmail,
+          passwordHash,
+          firstName,
+          lastName
+        );
+        if (!row) {
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+        }
+        const pin = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+        const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
+        await emailVerif.create(row.id, pin, expiresAt);
+        const user = await users.findById(row.id);
+        if (!user) {
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+        }
+        const reqId = ctx.meta["requestId"];
+        const reqOpts = reqId !== void 0 ? { requestId: reqId } : void 0;
+        bus?.emit(
+          import_events2.NOTIFICATION_EVENT,
+          {
+            type: MESSAGE_KEYS.emailRegistration,
+            data: { pin, firstName: firstName ?? "" },
+            recipient: { email: normalizedEmail, phone: null, deviceToken: null }
+          },
+          reqOpts
+        ).catch(() => {
+        });
+        bus?.emit(
+          EVENT_KEYS.userRegistered,
+          {
+            userId: user.id,
+            email: user.email,
+            firstName: user.firstName,
+            lastName: user.lastName,
+            loginMethod: "email"
+          },
+          reqOpts
+        ).catch(() => {
+        });
+        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+          loginMethod: "email"
+        });
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        const resolvedRegister = { ...config, ...config.resolve?.(ctx) };
+        const requiresVerification = !!resolvedRegister.requireVerification && !user.emailVerifiedAt;
+        return Response.json(
+          {
+            reason: "USER_EMAIL_REGISTERED",
+            explanation: "Account created. Check your email for a verification code.",
+            result: {
+              tokens: { access: accessToken, refresh: refreshToken },
+              user: toUserDTO(user),
+              requiresVerification
+            }
+          },
+          {
+            status: 201,
+            headers: {
+              "Set-Cookie": [
+                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
+                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
+              ].join(", ")
+            }
+          }
+        );
+      }
+      if (isValidPhone(phone)) {
+        const existing = await users.findByPhone(normalizePhone(phone));
+        if (existing) {
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Phone already registered");
+        }
+        const { id } = await users.findOrCreateByPhone(
+          normalizePhone(phone),
+          firstName ?? null,
+          lastName ?? null
+        );
+        const otp = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+        const expiresAt = new Date(Date.now() + OTP_TTL_MS);
+        await phoneVerif.upsert(id, normalizePhone(phone), otp, expiresAt);
+        const user = await users.findById(id);
+        if (!user) {
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+        }
+        const reqId2 = ctx.meta["requestId"];
+        const reqOpts2 = reqId2 !== void 0 ? { requestId: reqId2 } : void 0;
+        bus?.emit(
+          import_events2.NOTIFICATION_EVENT,
+          {
+            type: MESSAGE_KEYS.phoneOtp,
+            data: { otp },
+            recipient: { email: null, phone: normalizePhone(phone), deviceToken: null }
+          },
+          reqOpts2
+        ).catch(() => {
+        });
+        bus?.emit(
+          EVENT_KEYS.userRegistered,
+          {
+            userId: user.id,
+            email: user.email,
+            firstName: user.firstName,
+            lastName: user.lastName,
+            loginMethod: "phone"
+          },
+          reqOpts2
+        ).catch(() => {
+        });
+        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+          loginMethod: "phone"
+        });
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        return Response.json(
+          {
+            reason: "USER_PHONE_REGISTERED",
+            explanation: "Account created. A verification code has been sent to your phone.",
+            result: {
+              tokens: { access: accessToken, refresh: refreshToken },
+              user: toUserDTO(user)
+            }
+          },
+          {
+            status: 202,
+            headers: {
+              "Set-Cookie": [
+                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
+                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
+              ].join(", ")
+            }
+          }
+        );
+      }
+      return (0, import_core4.setApiResponse)(
+        import_core4.HTTP.UNPROCESSABLE,
+        "INVALID_PARAMETER",
+        "Provide email + password or a valid phone number"
+      );
+    },
+    login: async (ctx) => {
+      const body = ctx.meta["body"];
+      if (typeof body?.["email"] === "string" && typeof body?.["password"] === "string") {
+        const { email: rawEmail, password } = body;
+        const email = normalizeEmailSafe(rawEmail);
+        if (!email) {
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+        }
+        const user = await users.findByEmail(email);
+        if (!user || !user.passwordHash) {
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+        }
+        const valid = await verifyPassword(password, user.passwordHash);
+        if (!valid) {
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+        }
+        if (user.suspended) {
+          return (0, import_core4.setApiResponse)(
+            import_core4.HTTP.FORBIDDEN,
+            "ACCOUNT_SUSPENDED",
+            "Account suspended. Please contact support."
+          );
+        }
+        if (user.mfaEnabled) {
+          const mfaToken = issueMfaPendingToken(user.id, config, "email");
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "MFA_REQUIRED", "Multi-factor authentication required", {
+            mfaToken
+          });
+        }
+        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+          loginMethod: "email"
+        });
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        const resolvedLogin = { ...config, ...config.resolve?.(ctx) };
+        const requiresVerification = !!resolvedLogin.requireVerification && !user.emailVerifiedAt;
+        return Response.json(
+          {
+            reason: "USER_EMAIL_LOGIN",
+            explanation: "Login successful.",
+            result: {
+              tokens: { access: accessToken, refresh: refreshToken },
+              user: toUserDTO(user),
+              requiresVerification
+            }
+          },
+          {
+            status: 200,
+            headers: {
+              "Set-Cookie": [
+                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
+                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
+              ].join(", ")
+            }
+          }
+        );
+      }
+      const phone = body?.["phone"];
+      if (isValidPhone(phone)) {
+        const user = await users.findByPhone(normalizePhone(phone));
+        if (!user) {
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+        }
+        if (user.suspended) {
+          return (0, import_core4.setApiResponse)(
+            import_core4.HTTP.FORBIDDEN,
+            "ACCOUNT_SUSPENDED",
+            "Account suspended. Please contact support."
+          );
+        }
+        const otp = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+        const expiresAt = new Date(Date.now() + OTP_TTL_MS);
+        await phoneVerif.upsert(user.id, normalizePhone(phone), otp, expiresAt);
+        bus?.emit(import_events2.NOTIFICATION_EVENT, {
+          type: MESSAGE_KEYS.phoneOtp,
+          data: { otp },
+          recipient: { email: null, phone: normalizePhone(phone), deviceToken: null }
+        }).catch(() => {
+        });
+        const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+          loginMethod: "phone"
+        });
+        await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        return Response.json(
+          {
+            reason: "USER_PHONE_OTP_SENT",
+            explanation: "A verification code has been sent to your phone.",
+            result: {
+              tokens: { access: accessToken, refresh: refreshToken },
+              user: toUserDTO(user, false)
+            }
+          },
+          {
+            status: 202,
+            headers: {
+              "Set-Cookie": [
+                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
+                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
+              ].join(", ")
+            }
+          }
+        );
+      }
+      return (0, import_core4.setApiResponse)(
+        import_core4.HTTP.UNPROCESSABLE,
+        "INVALID_PARAMETER",
+        "Provide email + password or a valid phone number"
+      );
+    },
+    logout: async (ctx) => {
+      const token = extractRefreshToken(ctx);
+      if (token) {
+        await sessions.delete(token).catch(() => void 0);
+      }
+      return Response.json(
+        { reason: "USER_LOGOUT", explanation: "Logged out successfully." },
+        {
+          status: 200,
+          headers: {
+            "Set-Cookie": [
+              "access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0",
+              "refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0"
+            ].join(", ")
+          }
+        }
+      );
+    },
+    refresh: async (ctx) => {
+      const token = extractRefreshToken(ctx);
+      if (!token) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_PARAMETER", "No refresh token provided");
+      }
+      const payload = verifyToken(token, config);
+      if (!payload || payload.type !== "refresh") {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
+      }
+      const valid = await sessions.exists(token);
+      if (!valid) {
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.UNAUTHORIZED,
+          "TOKEN_REFRESH_FAILED",
+          "Session expired or already revoked"
+        );
+      }
+      const user = await users.findById(payload.sub);
+      if (!user || user.suspended || user.deletedAt) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
+      }
+      await sessions.delete(token);
+      const { accessToken, refreshToken } = issueTokenPair(user.id, config, {
+        loginMethod: payload.loginMethod ?? "email",
+        phoneVerified: payload.phoneVerified ?? false
+      });
+      await sessions.create(user.id, refreshToken, refreshTokenExpiry(refreshToken));
+      return Response.json(
+        {
+          reason: "TOKENS_REFRESHED",
+          explanation: "Tokens refreshed successfully.",
+          result: { tokens: { access: accessToken, refresh: refreshToken } }
+        },
+        {
+          status: 200,
+          headers: {
+            "Set-Cookie": [
+              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
+              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
+            ].join(", ")
+          }
+        }
+      );
+    },
+    forgotPassword: async (ctx) => {
+      const body = ctx.meta["body"];
+      const rawEmail = body?.["email"];
+      if (typeof rawEmail !== "string") {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "email is required");
+      }
+      const email = normalizeEmailSafe(rawEmail);
+      if (!email) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+      }
+      const user = await users.findByEmail(email);
+      if (!user) {
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.OK,
+          "PASSWORD_RESET_EMAIL_SENT",
+          "Password reset email sent (if account exists)."
+        );
+      }
+      const resolved = { ...config, ...config.resolve?.(ctx) };
+      const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
+      const remaining = checkCooldown(await passwordReset.findLastSentAt(user.id), cooldown);
+      if (remaining > 0) {
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.TOO_MANY_REQUESTS,
+          "VERIFICATION_COOLDOWN",
+          "Please wait before requesting a new password reset code.",
+          {
+            retryAfter: Math.ceil(remaining / 1e3)
+          }
+        );
+      }
+      const pin = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+      const expiresAt = new Date(Date.now() + 1e3 * 60 * 60);
+      await passwordReset.create(user.id, pin, expiresAt);
+      bus?.emit(import_events2.NOTIFICATION_EVENT, {
+        type: MESSAGE_KEYS.passwordReset,
+        recipient: { email, phone: null, deviceToken: null },
+        data: { pin }
+      }).catch(() => {
+      });
+      return (0, import_core4.setApiResponse)(
+        import_core4.HTTP.OK,
+        "PASSWORD_RESET_EMAIL_SENT",
+        "Password reset email sent (if account exists)."
+      );
+    },
+    resetPassword: async (ctx) => {
+      const body = ctx.meta["body"];
+      const raw = body?.["pin"];
+      const password = body?.["password"];
+      if (typeof raw !== "string" || typeof password !== "string") {
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.UNPROCESSABLE,
+          "INVALID_PARAMETER",
+          "pin and password are required"
+        );
+      }
+      if (!/^\d{6}$/.test(raw.trim())) {
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.UNPROCESSABLE,
+          "INVALID_PARAMETER",
+          "pin must be a 6-digit code"
+        );
+      }
+      if (password.length < 8) {
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.UNPROCESSABLE,
+          "INVALID_PARAMETER",
+          "password must be at least 8 characters"
+        );
+      }
+      const pin = raw.trim();
+      const row = await passwordReset.findByPin(pin);
+      if (!row || /* @__PURE__ */ new Date() > row.expiresAt) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "PASSWORD_RESET_FAILED", "Invalid or expired pin");
+      }
+      const passwordHash = await hashPassword(password);
+      await store.transaction(async (tx) => {
+        await Promise.all([
+          tx.query(`UPDATE fonderie_users SET password_hash = $1 WHERE id = $2`, [
+            passwordHash,
+            row.userId
+          ]),
+          tx.query(`DELETE FROM fonderie_password_resets WHERE user_id = $1`, [row.userId])
+        ]);
+      });
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
+    },
+    verify: async (ctx) => {
+      if (ctx.user.loginMethod !== "phone" && ctx.user.emailVerifiedAt) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "VERIFIED", "Email verified successfully.", {
+          verified: true,
+          email: ctx.user.email
+        });
+      }
+      const body = ctx.meta["body"];
+      const raw = body?.["token"];
+      if (typeof raw !== "string" || !/^\d{6}$/.test(raw.trim())) {
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.UNPROCESSABLE,
+          "INVALID_PARAMETER",
+          "token must be a 6-digit code"
+        );
+      }
+      const pin = raw.trim();
+      if (ctx.user.loginMethod === "phone") {
+        const record = await phoneVerif.findByUser(ctx.user.id, pin);
+        if (!record) {
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
+        }
+        if (/* @__PURE__ */ new Date() > record.expiresAt) {
+          await phoneVerif.deleteByUser(ctx.user.id);
+          return (0, import_core4.setApiResponse)(
+            import_core4.HTTP.BAD_REQUEST,
+            "VERIFICATION_FAILED",
+            "Verification code expired"
+          );
+        }
+        await phoneVerif.deleteByUser(ctx.user.id);
+        const { accessToken, refreshToken } = issueTokenPair(ctx.user.id, config, {
+          loginMethod: "phone",
+          phoneVerified: true
+        });
+        await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken));
+        const verifiedUser = await users.findById(ctx.user.id);
+        if (!verifiedUser) {
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+        }
+        if (verifiedUser.suspended) {
+          return (0, import_core4.setApiResponse)(
+            import_core4.HTTP.FORBIDDEN,
+            "ACCOUNT_SUSPENDED",
+            "Account suspended. Please contact support."
+          );
+        }
+        return Response.json(
+          {
+            reason: "VERIFIED",
+            explanation: "Phone verified successfully.",
+            result: {
+              tokens: { access: accessToken, refresh: refreshToken },
+              user: toUserDTO(verifiedUser, true)
+            }
+          },
+          {
+            status: 200,
+            headers: {
+              "Set-Cookie": [
+                `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
+                `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
+              ].join(", ")
+            }
+          }
+        );
+      }
+      const row = await emailVerif.findByUser(ctx.user.id, pin);
+      if (!row) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
+      }
+      if (/* @__PURE__ */ new Date() > row.expiresAt) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Pin expired");
+      }
+      await store.transaction(async (tx) => {
+        await Promise.all([
+          tx.query(
+            `UPDATE fonderie_users SET email_verified_at = now(), updated_at = now() WHERE id = $1`,
+            [ctx.user.id]
+          ),
+          tx.query(`DELETE FROM fonderie_email_verifications WHERE user_id = $1 AND token = $2`, [
+            ctx.user.id,
+            pin
+          ])
+        ]);
+      });
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "VERIFIED", "Email verified successfully.", {
+        verified: true,
+        email: ctx.user.email
+      });
+    },
+    sendVerification: async (ctx) => {
+      const resolved = { ...config, ...config.resolve?.(ctx) };
+      const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
+      if (ctx.user.loginMethod === "phone") {
+        const phone = ctx.user.phone;
+        if (!phone) {
+          return (0, import_core4.setApiResponse)(
+            import_core4.HTTP.BAD_REQUEST,
+            "NO_PHONE_ON_ACCOUNT",
+            "No phone number associated with this account"
+          );
+        }
+        const remaining2 = checkCooldown(await phoneVerif.findLastSentAt(ctx.user.id), cooldown);
+        if (remaining2 > 0) {
+          return (0, import_core4.setApiResponse)(
+            import_core4.HTTP.TOO_MANY_REQUESTS,
+            "VERIFICATION_COOLDOWN",
+            "Please wait before requesting a new code.",
+            {
+              retryAfter: Math.ceil(remaining2 / 1e3)
+            }
+          );
+        }
+        const otp = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+        const expiresAt2 = new Date(Date.now() + OTP_TTL_MS);
+        await phoneVerif.upsert(ctx.user.id, phone, otp, expiresAt2);
+        bus?.emit(import_events2.NOTIFICATION_EVENT, {
+          type: MESSAGE_KEYS.phoneOtp,
+          data: { otp },
+          recipient: { email: null, phone, deviceToken: null }
+        }).catch(() => {
+        });
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.OK,
+          "VERIFICATION_SENT",
+          "A verification code has been sent to your phone."
+        );
+      }
+      if (!ctx.user.email) {
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.BAD_REQUEST,
+          "NO_EMAIL_ON_ACCOUNT",
+          "No email address associated with this account"
+        );
+      }
+      if (ctx.user.emailVerifiedAt) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "EMAIL_VERIFIED", "Email already verified.", {
+          verified: true,
+          email: ctx.user.email
+        });
+      }
+      const remaining = checkCooldown(await emailVerif.findLastSentAt(ctx.user.id), cooldown);
+      if (remaining > 0) {
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.TOO_MANY_REQUESTS,
+          "VERIFICATION_COOLDOWN",
+          "Please wait before requesting a new code.",
+          {
+            retryAfter: Math.ceil(remaining / 1e3)
+          }
+        );
+      }
+      const pin = (0, import_node_crypto2.randomInt)(1e5, 1e6).toString();
+      const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
+      await emailVerif.replace(ctx.user.id, pin, expiresAt);
+      bus?.emit(import_events2.NOTIFICATION_EVENT, {
+        type: MESSAGE_KEYS.emailVerification,
+        recipient: { email: ctx.user.email, phone: null, deviceToken: null },
+        data: { pin }
+      }).catch(() => {
+      });
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "VERIFICATION_SENT", "Verification email sent.", {
+        email: ctx.user.email
+      });
+    }
+  };
+}
+
+// src/controllers/user.controller.ts
+var import_node_crypto3 = require("crypto");
+var import_core5 = require("@fonderie/core");
+var import_events3 = require("@fonderie/events");
+function normalizePhone2(phone) {
+  return phone.trim().replace(/[\s()\-\.]/g, "");
+}
+function isValidPhone2(phone) {
+  return typeof phone === "string" && /^\+?[1-9]\d{6,14}$/.test(normalizePhone2(phone));
+}
+function userController(store, bus) {
+  const users = new UserModel(store);
+  const emailVerif = new EmailVerificationModel(store);
+  const phoneVerif = new PhoneVerificationModel(store);
+  return {
+    me: async (ctx) => {
+      const user = await users.findById(ctx.user.id);
+      if (!user) {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      }
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "USER_ACCOUNT_FETCHED", "User account fetched successful.", {
+        user: toUserDTO(user, ctx.user.phoneVerified)
+      });
+    },
+    updateProfile: async (ctx) => {
+      const body = ctx.meta["body"];
+      const allowed = ["firstName", "lastName", "avatarUrl"];
+      const fields = {};
+      for (const key of allowed) {
+        if (body?.[key] !== void 0) fields[key] = body[key];
+      }
+      if (Object.keys(fields).length === 0) {
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.UNPROCESSABLE,
+          "INVALID_PARAMETER",
+          "Provide at least one of: firstName, lastName, avatarUrl"
+        );
+      }
+      const row = await users.update(ctx.user.id, fields);
+      if (!row) {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      }
+      const updated = await users.findById(ctx.user.id);
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "PROFILE_UPDATED", "Profile updated.", {
+        user: toUserDTO(updated, ctx.user.phoneVerified)
+      });
+    },
+    updatePreferences: async (ctx) => {
+      const body = ctx.meta["body"];
+      const fields = {};
+      if (typeof body?.["locale"] === "string") fields.locale = body["locale"];
+      if (typeof body?.["timezone"] === "string") fields.timezone = body["timezone"];
+      const prefKeys = ["notifications", "emailDigest", "dateFormat", "timeFormat"];
+      const patch = {};
+      for (const key of prefKeys) {
+        if (body?.[key] !== void 0) patch[key] = body[key];
+      }
+      if (Object.keys(patch).length > 0) fields.patch = patch;
+      const row = await users.updatePreferences(ctx.user.id, fields);
+      if (!row) {
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.UNPROCESSABLE,
+          "INVALID_PARAMETER",
+          "Provide at least one preference field"
+        );
+      }
+      const updated = await users.findById(ctx.user.id);
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "PREFERENCES_UPDATED", "Preferences updated.", {
+        user: toUserDTO(updated, ctx.user.phoneVerified)
+      });
+    },
+    updateEmail: async (ctx) => {
+      const body = ctx.meta["body"];
+      const newEmail = body?.["email"];
+      const normalised = typeof newEmail === "string" ? normalizeEmailSafe(newEmail) : null;
+      if (!normalised) {
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.UNPROCESSABLE,
+          "INVALID_PARAMETER",
+          "A valid email address is required"
+        );
+      }
+      const oldEmail = ctx.user.email;
+      if (normalised === oldEmail) {
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.UNPROCESSABLE,
+          "INVALID_PARAMETER",
+          "New email must differ from current email"
+        );
+      }
+      const existing = await users.findByEmail(normalised);
+      if (existing) {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
+      }
+      const pin = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
+      const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
+      await emailVerif.replace(ctx.user.id, pin, expiresAt);
+      await users.updateEmail(ctx.user.id, normalised);
+      bus?.emit(import_events3.NOTIFICATION_EVENT, {
+        type: MESSAGE_KEYS.emailVerification,
+        data: { pin },
+        recipient: { email: normalised, phone: null, deviceToken: null }
+      }).catch(() => {
+      });
+      if (oldEmail) {
+        bus?.emit(import_events3.NOTIFICATION_EVENT, {
+          type: MESSAGE_KEYS.emailChanged,
+          data: { newEmail: normalised },
+          recipient: { email: oldEmail, phone: null, deviceToken: null }
+        }).catch(() => {
+        });
+      }
+      return (0, import_core5.setApiResponse)(
+        import_core5.HTTP.OK,
+        "EMAIL_UPDATED",
+        "Email updated. A verification code has been sent to your new address.",
+        {
+          email: normalised
+        }
+      );
+    },
+    updatePhone: async (ctx) => {
+      const body = ctx.meta["body"];
+      const newPhone = body?.["phone"];
+      if (!isValidPhone2(newPhone)) {
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.UNPROCESSABLE,
+          "INVALID_PARAMETER",
+          "A valid phone number is required"
+        );
+      }
+      const normalised = normalizePhone2(newPhone);
+      const existing = await users.findByPhone(normalised);
+      if (existing) {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
+      }
+      const otp = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
+      const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
+      await phoneVerif.upsert(ctx.user.id, normalised, otp, expiresAt);
+      await users.updatePhone(ctx.user.id, normalised);
+      bus?.emit(import_events3.NOTIFICATION_EVENT, {
+        type: MESSAGE_KEYS.phoneOtp,
+        data: { otp },
+        recipient: { email: null, phone: normalised, deviceToken: null }
+      }).catch(() => {
+      });
+      if (ctx.user.email) {
+        bus?.emit(import_events3.NOTIFICATION_EVENT, {
+          type: MESSAGE_KEYS.phoneChanged,
+          data: {},
+          recipient: { email: ctx.user.email, phone: null, deviceToken: null }
+        }).catch(() => {
+        });
+      }
+      return (0, import_core5.setApiResponse)(
+        import_core5.HTTP.OK,
+        "PHONE_UPDATED",
+        "Phone number updated. A verification code has been sent to your new number.",
+        {
+          phone: normalised
+        }
+      );
+    },
+    changePassword: async (ctx) => {
+      const body = ctx.meta["body"];
+      const currentPassword = body?.["currentPassword"];
+      const newPassword = body?.["newPassword"];
+      if (typeof currentPassword !== "string" || !currentPassword) {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "currentPassword is required");
+      }
+      if (typeof newPassword !== "string" || newPassword.length < 8) {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "newPassword must be at least 8 characters");
+      }
+      const user = await users.findById(ctx.user.id);
+      if (!user) return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      const { hashPassword: hashPassword2, verifyPassword: verifyPassword2 } = await Promise.resolve().then(() => (init_password(), password_exports));
+      const valid = await verifyPassword2(currentPassword, user.passwordHash ?? "");
+      if (!valid) {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_CREDENTIAL", "Current password is incorrect");
+      }
+      const hash = await hashPassword2(newPassword);
+      await users.updatePassword(ctx.user.id, hash);
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
+    },
+    deleteMe: async (ctx) => {
+      const userId = ctx.user.id;
+      await users.softDelete(userId);
+      const reqId = ctx.meta["requestId"];
+      bus?.emit(
+        EVENT_KEYS.userDeleted,
+        { userId },
+        reqId !== void 0 ? { requestId: reqId } : void 0
+      ).catch(() => {
+      });
+      return Response.json(
+        { reason: "ACCOUNT_DELETED", explanation: "Account successfully deleted." },
+        {
+          status: 200,
+          headers: {
+            "Set-Cookie": [
+              "access_token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0",
+              "refresh_token=; HttpOnly; SameSite=Strict; Path=/auth/refresh; Max-Age=0"
+            ].join(", ")
+          }
+        }
+      );
+    }
+  };
+}
+
+// src/controllers/oauth.controller.ts
+var import_core6 = require("@fonderie/core");
+function oauthController(store, config) {
+  const users = new UserModel(store);
+  const sessions = new SessionModel(store);
+  return {
+    googleInit: async (_ctx) => {
+      const google = config.google;
+      if (!google) {
+        return (0, import_core6.setApiResponse)(
+          import_core6.HTTP.NOT_IMPLEMENTED,
+          "NOT_CONFIGURED",
+          "Google OAuth not configured"
+        );
+      }
+      const params = new URLSearchParams({
+        client_id: google.clientId,
+        redirect_uri: google.redirectUri,
+        response_type: "code",
+        scope: "openid email profile"
+      });
+      const url = `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
+      return (0, import_core6.setApiResponse)(
+        import_core6.HTTP.OK,
+        "GOOGLE_AUTH_URL",
+        "Redirect the user to the returned URL to begin Google OAuth.",
+        { url }
+      );
+    },
+    googleCallback: async (ctx) => {
+      const google = config.google;
+      if (!google) {
+        return (0, import_core6.setApiResponse)(
+          import_core6.HTTP.NOT_IMPLEMENTED,
+          "NOT_CONFIGURED",
+          "Google OAuth not configured"
+        );
+      }
+      const url = new URL(ctx.request.url);
+      const code = url.searchParams.get("code");
+      if (!code) {
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
+      }
+      const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          code,
+          client_id: google.clientId,
+          client_secret: google.clientSecret,
+          redirect_uri: google.redirectUri,
+          grant_type: "authorization_code"
+        })
+      });
+      const tokenData = await tokenRes.json();
+      if (!tokenData.id_token) {
+        return (0, import_core6.setApiResponse)(
+          import_core6.HTTP.BAD_REQUEST,
+          "GOOGLE_AUTH_FAILED",
+          "OAuth token exchange failed"
+        );
+      }
+      const payload = JSON.parse(
+        Buffer.from(tokenData.id_token.split(".")[1] ?? "", "base64url").toString()
+      );
+      if (!payload.email) {
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
+      }
+      const normalizedEmail = normalizeEmailSafe(payload.email);
+      if (!normalizedEmail) {
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "Invalid email in OAuth response");
+      }
+      const upserted = await users.upsertByProvider(normalizedEmail, "google", payload.sub ?? "");
+      if (!upserted) {
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
+      }
+      const fullUser = await users.findById(upserted.id);
+      if (!fullUser) {
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
+      }
+      const { accessToken, refreshToken } = issueTokenPair(upserted.id, config, {
+        loginMethod: "google"
+      });
+      await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken));
+      return Response.json(
+        {
+          reason: "GOOGLE_AUTH_SUCCESS",
+          explanation: "Google authentication successful.",
+          result: {
+            tokens: { access: accessToken, refresh: refreshToken },
+            user: toUserDTO(fullUser)
+          }
+        },
+        {
+          status: 200,
+          headers: {
+            "Set-Cookie": [
+              `access_token=${accessToken}; HttpOnly; SameSite=Strict; Path=/`,
+              `refresh_token=${refreshToken}; HttpOnly; SameSite=Strict; Path=/auth/refresh`
+            ].join(", ")
+          }
+        }
+      );
+    }
+  };
+}
+
+// src/routes.ts
+function buildAuthRoutes(store, config, bus) {
+  const user = userController(store, bus);
+  const auth = authController(store, config, bus);
+  const oauth = oauthController(store, config);
+  const mfa = mfaController(store, config, config.appName ?? "Fonderie", bus);
+  const verifyGate = config.requireVerification ? import_middlewares.requireVerified : (_ctx, next) => next();
+  const routes = [
+    // Registration & Login (Public)
+    ["POST", "/auth/register", auth.register],
+    ["POST", "/auth/login", auth.login],
+    // Token Management (Public)
+    ["POST", "/auth/refresh", auth.refresh],
+    // Email — Password Recovery (Public)
+    ["POST", "/auth/email/forgot", auth.forgotPassword],
+    ["POST", "/auth/email/reset", auth.resetPassword],
+    // Verification (Protected — email or phone, determined by loginMethod)
+    ["POST", "/auth/verify", import_middlewares.requireAuth, auth.verify],
+    ["GET", "/auth/send-verification", import_middlewares.requireAuth, auth.sendVerification],
+    // Account Management (Protected)
+    ["POST", "/auth/logout", import_middlewares.requireAuth, auth.logout],
+    // User Profile (Protected; writes also gate on requireVerification)
+    ["GET", "/users", import_middlewares.requireAuth, user.me],
+    ["PUT", "/users/profile", import_middlewares.requireAuth, verifyGate, user.updateProfile],
+    ["PUT", "/users/preferences", import_middlewares.requireAuth, verifyGate, user.updatePreferences],
+    ["PUT", "/users/email", import_middlewares.requireAuth, verifyGate, user.updateEmail],
+    ["PUT", "/users/phone", import_middlewares.requireAuth, verifyGate, user.updatePhone],
+    ["PUT", "/users/password", import_middlewares.requireAuth, user.changePassword],
+    ["DELETE", "/users", import_middlewares.requireAuth, verifyGate, user.deleteMe],
+    // MFA (email sessions only — requireVerified is always enforced here
+    // because MFA is a security feature and email verification is meaningful)
+    ["POST", "/auth/mfa/setup", import_middlewares.requireAuth, requireEmailLogin, import_middlewares.requireVerified, mfa.setup],
+    // /auth/mfa/verify accepts both mfaPending tokens (TOTP/backup-code login)
+    // and full tokens (setup confirmation), so requireAnyAuth is used here.
+    ["POST", "/auth/mfa/verify", import_middlewares.requireAnyAuth, requireEmailLogin, import_middlewares.requireVerified, mfa.verify],
+    ["POST", "/auth/mfa/disable", import_middlewares.requireAuth, requireEmailLogin, import_middlewares.requireVerified, mfa.disable],
+    [
+      "POST",
+      "/auth/mfa/backup-codes",
+      import_middlewares.requireAuth,
+      requireEmailLogin,
+      import_middlewares.requireVerified,
+      mfa.regenerateBackupCodes
+    ]
+  ];
+  if (config.providers.includes("google")) {
+    routes.push(
+      ["GET", "/auth/google", oauth.googleInit],
+      ["GET", "/auth/google/callback", oauth.googleCallback]
+    );
+  }
+  return routes;
+}
+
+// src/middlewares/session.ts
+function withSession(store, config) {
+  const users = new UserModel(store);
+  return async (ctx, next) => {
+    const token = extractToken(ctx.request);
+    if (!token) {
+      return next();
+    }
+    const payload = verifyToken(token, config);
+    if (!payload || payload.type !== "access") {
+      return next();
+    }
+    const user = await users.findById(payload.sub);
+    if (!user || user.suspended || user.deletedAt) {
+      return next();
+    }
+    Object.assign(ctx, {
+      user: {
+        ...user,
+        loginMethod: payload.loginMethod ?? "email",
+        phoneVerified: payload.phoneVerified ?? false,
+        mfaPending: payload.mfaPending ?? false
+      }
+    });
+    return next();
+  };
+}
+function extractToken(request) {
+  const auth = request.headers.get("authorization");
+  if (auth?.startsWith("Bearer ")) {
+    return auth.slice(7);
+  }
+  const cookie = request.headers.get("cookie") ?? "";
+  const match = cookie.match(/(?:^|;\s*)access_token=([^;]+)/);
+  return match?.[1] ?? null;
+}
+
+// src/module.ts
+var AuthModule = class {
+  constructor(store, config, bus) {
+    this.store = store;
+    this.config = config;
+    this.bus = bus;
+  }
+  store;
+  config;
+  bus;
+  name = "@fonderie/auth";
+  install(app) {
+    app.use(withSession(this.store, this.config));
+    const routes = buildAuthRoutes(this.store, this.config, this.bus);
+    for (const [method, path, ...handlers] of routes) {
+      app.addRoute(method, path, ...handlers);
+    }
+  }
+};
+
+// src/middlewares/require-auth.ts
+var import_middlewares2 = require("@fonderie/core/middlewares");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AUTH_CONFIG_KEYS,
+  AuthModule,
+  MESSAGE_KEYS,
+  normalizeEmail,
+  normalizeEmailSafe,
+  requireAuth,
+  toUserDTO,
+  withSession
+});
+//# sourceMappingURL=index.cjs.map