@fonderie/auth 5.0.2 → 5.0.3

package/dist/index.cjs

@@ -255,7 +255,7 @@ function cookieHeaders(cookies) {
 
 // src/controllers/mfa.controller.ts
 var import_qrcode = __toESM(require("qrcode"), 1);
-var import_core3 = require("@fonderie/core");
+var import_core4 = require("@fonderie/core");
 var import_events = require("@fonderie/events");
 
 // src/config.ts
@@ -332,6 +332,7 @@ function verifyToken(token, config) {
 
 // src/services/mfa.ts
 var import_node_crypto2 = require("crypto");
+var import_core2 = require("@fonderie/core");
 var STEP = 30;
 var DRIFT = 1;
 var DIGITS = 6;
@@ -402,16 +403,10 @@ function generateTotpUri(email2, secret, issuer) {
   });
   return `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(email2)}?${params}`;
 }
-function safeCodeEqual(a, b) {
-  const bufA = Buffer.from(a);
-  const bufB = Buffer.from(b);
-  if (bufA.length !== bufB.length) return false;
-  return (0, import_node_crypto2.timingSafeEqual)(bufA, bufB);
-}
 function verifyTotpToken(token, secret) {
   const t = timeCounter();
   for (let i = -DRIFT; i <= DRIFT; i++) {
-    if (safeCodeEqual(hotp(secret, t + i), token)) {
+    if ((0, import_core2.constantTimeEqual)(hotp(secret, t + i), token)) {
       return true;
     }
   }
@@ -460,7 +455,7 @@ function makeMfaCipher(keyHex) {
 }
 
 // src/dtos/user.ts
-var import_core2 = require("@fonderie/core");
+var import_core3 = require("@fonderie/core");
 var DEFAULT_PREFERENCES = {
   locale: "en-US",
   timezone: "UTC",
@@ -491,14 +486,14 @@ function toUserDTO(user, phoneVerified = false) {
   const prefs = user.preferences ?? {};
   const cleaned = cleanPreferences(prefs);
   return {
-    id: (0, import_core2.stringOrEmpty)(user.id),
-    email: (0, import_core2.stringOrEmpty)(user.email),
-    firstName: (0, import_core2.stringOrEmpty)(user.firstName),
-    lastName: (0, import_core2.stringOrEmpty)(user.lastName),
-    phone: (0, import_core2.stringOrEmpty)(user.phone),
-    profileImageUrl: (0, import_core2.stringOrEmpty)(user.profileImageUrl),
+    id: (0, import_core3.stringOrEmpty)(user.id),
+    email: (0, import_core3.stringOrEmpty)(user.email),
+    firstName: (0, import_core3.stringOrEmpty)(user.firstName),
+    lastName: (0, import_core3.stringOrEmpty)(user.lastName),
+    phone: (0, import_core3.stringOrEmpty)(user.phone),
+    profileImageUrl: (0, import_core3.stringOrEmpty)(user.profileImageUrl),
     isActive: typeof user.isActive === "boolean" ? user.isActive : true,
-    lastLogin: user.lastLogin instanceof Date ? user.lastLogin.toISOString() : "",
+    lastLogin: (0, import_core3.dateOrEmpty)(user.lastLogin),
     preferences: {
       ...DEFAULT_PREFERENCES,
       ...cleaned,
@@ -511,12 +506,12 @@ function toUserDTO(user, phoneVerified = false) {
     },
     isEmailVerified: user.emailVerifiedAt !== null,
     isPhoneVerified: phoneVerified,
-    mfaEnabled: (0, import_core2.booleanOrFalse)(user.mfaEnabled),
-    suspended: (0, import_core2.booleanOrFalse)(user.suspended),
-    whitelist: (0, import_core2.booleanOrFalse)(user.whitelist),
+    mfaEnabled: (0, import_core3.booleanOrFalse)(user.mfaEnabled),
+    suspended: (0, import_core3.booleanOrFalse)(user.suspended),
+    whitelist: (0, import_core3.booleanOrFalse)(user.whitelist),
     ipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],
-    createdAt: user.createdAt instanceof Date ? user.createdAt.toISOString() : "",
-    updatedAt: user.updatedAt instanceof Date ? user.updatedAt.toISOString() : ""
+    createdAt: (0, import_core3.dateOrEmpty)(user.createdAt),
+    updatedAt: (0, import_core3.dateOrEmpty)(user.updatedAt)
   };
 }
 
@@ -835,8 +830,8 @@ function mfaController(store, config, issuer, bus) {
         users.saveMfaPendingSecret(ctx.user.id, mfaCipher.encrypt(secret)),
         backupCodes.replace(ctx.user.id, codeHashes)
       ]);
-      return (0, import_core3.setApiResponse)(
-        import_core3.HTTP.OK,
+      return (0, import_core4.setApiResponse)(
+        import_core4.HTTP.OK,
         "MFA_SETUP_INITIATED",
         "Scan the QR code with your authenticator app.",
         {
@@ -852,13 +847,13 @@ function mfaController(store, config, issuer, bus) {
       const body = ctx.meta["body"];
       const token = body?.["token"];
       if (typeof token !== "string") {
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "token is required");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "token is required");
       }
       const pendingCipher = await users.getMfaPendingSecret(ctx.user.id);
       const pendingSecret = pendingCipher ? mfaCipher.decrypt(pendingCipher) : null;
       if (pendingSecret) {
         if (!verifyTotpToken(token, pendingSecret)) {
-          return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
         }
         await users.confirmMfaSecret(ctx.user.id);
         bus?.emit(import_events.NOTIFICATION_EVENT, {
@@ -868,19 +863,19 @@ function mfaController(store, config, issuer, bus) {
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }).catch(() => {
         });
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "MFA_VERIFIED", "MFA verified successfully.", {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "MFA_VERIFIED", "MFA verified successfully.", {
           mfaEnabled: true
         });
       } else if (/^[A-Z0-9]{8}$/i.test(token)) {
         if (!ctx.user.mfaPending) {
-          return (0, import_core3.setApiResponse)(
-            import_core3.HTTP.FORBIDDEN,
+          return (0, import_core4.setApiResponse)(
+            import_core4.HTTP.FORBIDDEN,
             "MFA_NOT_PENDING",
             "Use the mfaToken from the login response"
           );
         }
         if (!ctx.user.mfaEnabled) {
-          return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "MFA_NOT_CONFIGURED", "MFA not configured");
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "MFA_NOT_CONFIGURED", "MFA not configured");
         }
         const unused = await backupCodes.findUnused(ctx.user.id);
         const checks = await Promise.all(
@@ -891,24 +886,24 @@ function mfaController(store, config, issuer, bus) {
         );
         const matched = checks.find((r) => r.match);
         if (!matched) {
-          return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid backup code");
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid backup code");
         }
         await backupCodes.consume(matched.id);
       } else {
         if (!ctx.user.mfaPending) {
-          return (0, import_core3.setApiResponse)(
-            import_core3.HTTP.FORBIDDEN,
+          return (0, import_core4.setApiResponse)(
+            import_core4.HTTP.FORBIDDEN,
             "MFA_NOT_PENDING",
             "Use the mfaToken from the login response"
           );
         }
         const storedSecret = await users.getMfaSecret(ctx.user.id);
         if (!storedSecret) {
-          return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "MFA_NOT_CONFIGURED", "MFA not configured");
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "MFA_NOT_CONFIGURED", "MFA not configured");
         }
         const secret = mfaCipher.decrypt(storedSecret);
         if (!verifyTotpToken(token, secret)) {
-          return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
+          return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
         }
         if (!ctx.user.mfaEnabled) {
           await users.enableMfa(ctx.user.id);
@@ -921,7 +916,7 @@ function mfaController(store, config, issuer, bus) {
       await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       const fullUser = await users.findById(ctx.user.id);
       if (!fullUser) {
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.SERVER_ERROR, "SERVER_ERROR", "User not found after MFA verify");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.SERVER_ERROR, "SERVER_ERROR", "User not found after MFA verify");
       }
       return Response.json(
         {
@@ -943,15 +938,15 @@ function mfaController(store, config, issuer, bus) {
       const body = ctx.meta["body"];
       const token = body?.["token"];
       if (typeof token !== "string") {
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "TOTP token is required");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "TOTP token is required");
       }
       if (!ctx.user.mfaEnabled) {
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "MFA_NOT_ENABLED", "MFA is not enabled");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "MFA_NOT_ENABLED", "MFA is not enabled");
       }
       const storedSecret = await users.getMfaSecret(ctx.user.id);
       const secret = storedSecret ? mfaCipher.decrypt(storedSecret) : null;
       if (!secret || !verifyTotpToken(token, secret)) {
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid TOTP code");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid TOTP code");
       }
       const plainCodes = generateBackupCodes();
       const codeHashes = await Promise.all(plainCodes.map((c) => hashPassword(c)));
@@ -963,7 +958,7 @@ function mfaController(store, config, issuer, bus) {
         recipient: { email: ctx.user.email, phone: null, deviceToken: null }
       }).catch(() => {
       });
-      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "BACKUP_CODES_REGENERATED", "Backup codes regenerated.", {
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "BACKUP_CODES_REGENERATED", "Backup codes regenerated.", {
         backupCodes: plainCodes
       });
     },
@@ -972,16 +967,16 @@ function mfaController(store, config, issuer, bus) {
       const body = ctx.meta["body"];
       const token = body?.["token"];
       if (typeof token !== "string") {
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "TOTP token is required");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "TOTP token is required");
       }
       const user = await users.findById(ctx.user.id);
       if (!user || !user.mfaEnabled) {
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "MFA_NOT_ENABLED", "MFA is not enabled");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "MFA_NOT_ENABLED", "MFA is not enabled");
       }
       const storedSecret = await users.getMfaSecret(ctx.user.id);
       const secret = storedSecret ? mfaCipher.decrypt(storedSecret) : null;
       if (!secret || !verifyTotpToken(token, secret)) {
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid TOTP code");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid TOTP code");
       }
       await Promise.all([users.disableMfa(ctx.user.id), backupCodes.deleteByUser(ctx.user.id)]);
       bus?.emit(import_events.NOTIFICATION_EVENT, {
@@ -991,7 +986,7 @@ function mfaController(store, config, issuer, bus) {
         recipient: { email: user.email, phone: null, deviceToken: null }
       }).catch(() => {
       });
-      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "MFA_DISABLED", "MFA disabled successfully.");
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "MFA_DISABLED", "MFA disabled successfully.");
     }
   };
 }
@@ -999,7 +994,7 @@ function mfaController(store, config, issuer, bus) {
 // src/controllers/auth.controller.ts
 var import_node_crypto4 = require("crypto");
 var import_events2 = require("@fonderie/events");
-var import_core4 = require("@fonderie/core");
+var import_core5 = require("@fonderie/core");
 
 // src/services/cooldown.ts
 function checkCooldown(lastSentAt, cooldownMs) {
@@ -1198,18 +1193,18 @@ function authController(store, config, bus) {
       if (typeof email2 === "string" && typeof password2 === "string") {
         const normalizedEmail = normalizeEmailSafe(email2);
         if (!normalizedEmail) {
-          return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
         }
         if (password2.length < 8) {
-          return (0, import_core4.setApiResponse)(
-            import_core4.HTTP.UNPROCESSABLE,
+          return (0, import_core5.setApiResponse)(
+            import_core5.HTTP.UNPROCESSABLE,
             "INVALID_PARAMETER",
             "password must be at least 8 characters"
           );
         }
         const existing = await users.findByEmail(normalizedEmail);
         if (existing) {
-          return (0, import_core4.setApiResponse)(import_core4.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Email already registered");
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Email already registered");
         }
         const passwordHash = await hashPassword(password2);
         const row = await users.create(
@@ -1219,14 +1214,14 @@ function authController(store, config, bus) {
           lastName
         );
         if (!row) {
-          return (0, import_core4.setApiResponse)(import_core4.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
         const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
         await emailVerif.create(row.id, pin, expiresAt);
         const user = await users.findById(row.id);
         if (!user) {
-          return (0, import_core4.setApiResponse)(import_core4.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
         const reqId = ctx.meta["requestId"];
         const reqOpts = reqId !== void 0 ? { requestId: reqId } : void 0;
@@ -1278,7 +1273,7 @@ function authController(store, config, bus) {
       if (isValidPhone(phone2)) {
         const existing = await users.findByPhone(normalizePhone(phone2));
         if (existing) {
-          return (0, import_core4.setApiResponse)(import_core4.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Phone already registered");
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Phone already registered");
         }
         const { id } = await users.findOrCreateByPhone(
           normalizePhone(phone2),
@@ -1290,7 +1285,7 @@ function authController(store, config, bus) {
         await phoneVerif.upsert(id, normalizePhone(phone2), otp, expiresAt);
         const user = await users.findById(id);
         if (!user) {
-          return (0, import_core4.setApiResponse)(import_core4.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
         const reqId2 = ctx.meta["requestId"];
         const reqOpts2 = reqId2 !== void 0 ? { requestId: reqId2 } : void 0;
@@ -1336,8 +1331,8 @@ function authController(store, config, bus) {
           }
         );
       }
-      return (0, import_core4.setApiResponse)(
-        import_core4.HTTP.UNPROCESSABLE,
+      return (0, import_core5.setApiResponse)(
+        import_core5.HTTP.UNPROCESSABLE,
         "INVALID_PARAMETER",
         "Provide email + password or a valid phone number"
       );
@@ -1348,11 +1343,11 @@ function authController(store, config, bus) {
         const { email: rawEmail, password: password2 } = body;
         const email2 = normalizeEmailSafe(rawEmail);
         if (!email2) {
-          return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
         }
         const user = await users.findByEmail(email2);
         if (!user || !user.passwordHash) {
-          return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         const { valid, needsRehash } = await verifyPasswordForLogin(
           password2,
@@ -1360,21 +1355,21 @@ function authController(store, config, bus) {
           config.legacyVerify
         );
         if (!valid) {
-          return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         if (needsRehash) {
           await users.updatePassword(user.id, await hashPassword(password2));
         }
         if (user.suspended) {
-          return (0, import_core4.setApiResponse)(
-            import_core4.HTTP.FORBIDDEN,
+          return (0, import_core5.setApiResponse)(
+            import_core5.HTTP.FORBIDDEN,
             "ACCOUNT_SUSPENDED",
             "Account suspended. Please contact support."
           );
         }
         if (user.mfaEnabled) {
           const mfaToken = issueMfaPendingToken(user.id, config, "email");
-          return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "MFA_REQUIRED", "Multi-factor authentication required", {
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "MFA_REQUIRED", "Multi-factor authentication required", {
             mfaToken
           });
         }
@@ -1404,11 +1399,11 @@ function authController(store, config, bus) {
       if (isValidPhone(phone2)) {
         const user = await users.findByPhone(normalizePhone(phone2));
         if (!user) {
-          return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         if (user.suspended) {
-          return (0, import_core4.setApiResponse)(
-            import_core4.HTTP.FORBIDDEN,
+          return (0, import_core5.setApiResponse)(
+            import_core5.HTTP.FORBIDDEN,
             "ACCOUNT_SUSPENDED",
             "Account suspended. Please contact support."
           );
@@ -1442,8 +1437,8 @@ function authController(store, config, bus) {
           }
         );
       }
-      return (0, import_core4.setApiResponse)(
-        import_core4.HTTP.UNPROCESSABLE,
+      return (0, import_core5.setApiResponse)(
+        import_core5.HTTP.UNPROCESSABLE,
         "INVALID_PARAMETER",
         "Provide email + password or a valid phone number"
       );
@@ -1464,23 +1459,23 @@ function authController(store, config, bus) {
     refresh: async (ctx) => {
       const token = extractRefreshToken(ctx);
       if (!token) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "INVALID_PARAMETER", "No refresh token provided");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNAUTHORIZED, "INVALID_PARAMETER", "No refresh token provided");
       }
       const payload = verifyToken(token, config);
       if (!payload || payload.type !== "refresh") {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
       }
       const valid = await sessions.exists(token);
       if (!valid) {
-        return (0, import_core4.setApiResponse)(
-          import_core4.HTTP.UNAUTHORIZED,
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.UNAUTHORIZED,
           "TOKEN_REFRESH_FAILED",
           "Session expired or already revoked"
         );
       }
       const user = await users.findById(payload.sub);
       if (!user || user.suspended || user.deletedAt) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
       }
       await sessions.delete(token);
       const { accessToken, refreshToken, sid } = issueTokenPair(user.id, config, {
@@ -1504,16 +1499,16 @@ function authController(store, config, bus) {
       const body = ctx.meta["body"];
       const rawEmail = body?.["email"];
       if (typeof rawEmail !== "string") {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "email is required");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "email is required");
       }
       const email2 = normalizeEmailSafe(rawEmail);
       if (!email2) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
       }
       const user = await users.findByEmail(email2);
       if (!user) {
-        return (0, import_core4.setApiResponse)(
-          import_core4.HTTP.OK,
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.OK,
           "PASSWORD_RESET_EMAIL_SENT",
           "Password reset email sent (if account exists)."
         );
@@ -1522,8 +1517,8 @@ function authController(store, config, bus) {
       const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
       const remaining = checkCooldown(await passwordReset.findLastSentAt(user.id), cooldown);
       if (remaining > 0) {
-        return (0, import_core4.setApiResponse)(
-          import_core4.HTTP.OK,
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.OK,
           "PASSWORD_RESET_EMAIL_SENT",
           "Password reset email sent (if account exists)."
         );
@@ -1538,8 +1533,8 @@ function authController(store, config, bus) {
         data: { pin }
       }).catch(() => {
       });
-      return (0, import_core4.setApiResponse)(
-        import_core4.HTTP.OK,
+      return (0, import_core5.setApiResponse)(
+        import_core5.HTTP.OK,
         "PASSWORD_RESET_EMAIL_SENT",
         "Password reset email sent (if account exists)."
       );
@@ -1549,22 +1544,22 @@ function authController(store, config, bus) {
       const raw = body?.["pin"];
       const password2 = body?.["password"];
       if (typeof raw !== "string" || typeof password2 !== "string") {
-        return (0, import_core4.setApiResponse)(
-          import_core4.HTTP.UNPROCESSABLE,
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "pin and password are required"
         );
       }
       if (!/^\d{6}$/.test(raw.trim())) {
-        return (0, import_core4.setApiResponse)(
-          import_core4.HTTP.UNPROCESSABLE,
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "pin must be a 6-digit code"
         );
       }
       if (password2.length < 8) {
-        return (0, import_core4.setApiResponse)(
-          import_core4.HTTP.UNPROCESSABLE,
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "password must be at least 8 characters"
         );
@@ -1572,7 +1567,7 @@ function authController(store, config, bus) {
       const pin = raw.trim();
       const row = await passwordReset.findByPin(pin);
       if (!row || /* @__PURE__ */ new Date() > row.expiresAt) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "PASSWORD_RESET_FAILED", "Invalid or expired pin");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.BAD_REQUEST, "PASSWORD_RESET_FAILED", "Invalid or expired pin");
       }
       const passwordHash = await hashPassword(password2);
       await store.transaction(async (tx) => {
@@ -1584,11 +1579,11 @@ function authController(store, config, bus) {
           tx.query(`DELETE FROM fonderie_password_resets WHERE user_id = $1`, [row.userId])
         ]);
       });
-      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
     },
     verify: async (ctx) => {
       if (ctx.user.loginMethod !== "phone" && ctx.user.emailVerifiedAt) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "VERIFIED", "Email verified successfully.", {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "VERIFIED", "Email verified successfully.", {
           verified: true,
           email: ctx.user.email
         });
@@ -1596,8 +1591,8 @@ function authController(store, config, bus) {
       const body = ctx.meta["body"];
       const raw = body?.["token"];
       if (typeof raw !== "string" || !/^\d{6}$/.test(raw.trim())) {
-        return (0, import_core4.setApiResponse)(
-          import_core4.HTTP.UNPROCESSABLE,
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "token must be a 6-digit code"
         );
@@ -1606,12 +1601,12 @@ function authController(store, config, bus) {
       if (ctx.user.loginMethod === "phone") {
         const record = await phoneVerif.findByUser(ctx.user.id, pin);
         if (!record) {
-          return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
         }
         if (/* @__PURE__ */ new Date() > record.expiresAt) {
           await phoneVerif.deleteByUser(ctx.user.id);
-          return (0, import_core4.setApiResponse)(
-            import_core4.HTTP.BAD_REQUEST,
+          return (0, import_core5.setApiResponse)(
+            import_core5.HTTP.BAD_REQUEST,
             "VERIFICATION_FAILED",
             "Verification code expired"
           );
@@ -1624,11 +1619,11 @@ function authController(store, config, bus) {
         await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
         const verifiedUser = await users.findById(ctx.user.id);
         if (!verifiedUser) {
-          return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
         }
         if (verifiedUser.suspended) {
-          return (0, import_core4.setApiResponse)(
-            import_core4.HTTP.FORBIDDEN,
+          return (0, import_core5.setApiResponse)(
+            import_core5.HTTP.FORBIDDEN,
             "ACCOUNT_SUSPENDED",
             "Account suspended. Please contact support."
           );
@@ -1650,10 +1645,10 @@ function authController(store, config, bus) {
       }
       const row = await emailVerif.findByUser(ctx.user.id, pin);
       if (!row) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
       }
       if (/* @__PURE__ */ new Date() > row.expiresAt) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Pin expired");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Pin expired");
       }
       await store.transaction(async (tx) => {
         await Promise.all([
@@ -1667,7 +1662,7 @@ function authController(store, config, bus) {
           ])
         ]);
       });
-      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "VERIFIED", "Email verified successfully.", {
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "VERIFIED", "Email verified successfully.", {
         verified: true,
         email: ctx.user.email
       });
@@ -1678,16 +1673,16 @@ function authController(store, config, bus) {
       if (ctx.user.loginMethod === "phone") {
         const phone2 = ctx.user.phone;
         if (!phone2) {
-          return (0, import_core4.setApiResponse)(
-            import_core4.HTTP.BAD_REQUEST,
+          return (0, import_core5.setApiResponse)(
+            import_core5.HTTP.BAD_REQUEST,
             "NO_PHONE_ON_ACCOUNT",
             "No phone number associated with this account"
           );
         }
         const remaining2 = checkCooldown(await phoneVerif.findLastSentAt(ctx.user.id), cooldown);
         if (remaining2 > 0) {
-          return (0, import_core4.setApiResponse)(
-            import_core4.HTTP.TOO_MANY_REQUESTS,
+          return (0, import_core5.setApiResponse)(
+            import_core5.HTTP.TOO_MANY_REQUESTS,
             "VERIFICATION_COOLDOWN",
             "Please wait before requesting a new code.",
             {
@@ -1705,29 +1700,29 @@ function authController(store, config, bus) {
           recipient: { email: null, phone: phone2, deviceToken: null }
         }).catch(() => {
         });
-        return (0, import_core4.setApiResponse)(
-          import_core4.HTTP.OK,
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.OK,
           "VERIFICATION_SENT",
           "A verification code has been sent to your phone."
         );
       }
       if (!ctx.user.email) {
-        return (0, import_core4.setApiResponse)(
-          import_core4.HTTP.BAD_REQUEST,
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.BAD_REQUEST,
           "NO_EMAIL_ON_ACCOUNT",
           "No email address associated with this account"
         );
       }
       if (ctx.user.emailVerifiedAt) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "EMAIL_VERIFIED", "Email already verified.", {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "EMAIL_VERIFIED", "Email already verified.", {
           verified: true,
           email: ctx.user.email
         });
       }
       const remaining = checkCooldown(await emailVerif.findLastSentAt(ctx.user.id), cooldown);
       if (remaining > 0) {
-        return (0, import_core4.setApiResponse)(
-          import_core4.HTTP.TOO_MANY_REQUESTS,
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.TOO_MANY_REQUESTS,
           "VERIFICATION_COOLDOWN",
           "Please wait before requesting a new code.",
           {
@@ -1745,7 +1740,7 @@ function authController(store, config, bus) {
         data: { pin }
       }).catch(() => {
       });
-      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "VERIFICATION_SENT", "Verification email sent.", {
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "VERIFICATION_SENT", "Verification email sent.", {
         email: ctx.user.email
       });
     }
@@ -1754,7 +1749,7 @@ function authController(store, config, bus) {
 
 // src/controllers/user.controller.ts
 var import_node_crypto5 = require("crypto");
-var import_core5 = require("@fonderie/core");
+var import_core6 = require("@fonderie/core");
 var import_events3 = require("@fonderie/events");
 function normalizePhone2(phone2) {
   return phone2.trim().replace(/[\s()\-\.]/g, "");
@@ -1771,9 +1766,9 @@ function userController(store, config, bus) {
     me: async (ctx) => {
       const user = await users.findById(ctx.user.id);
       if (!user) {
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       }
-      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "USER_ACCOUNT_FETCHED", "User account fetched successful.", {
+      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "USER_ACCOUNT_FETCHED", "User account fetched successful.", {
         user: toUserDTO(user, ctx.user.phoneVerified)
       });
     },
@@ -1785,18 +1780,18 @@ function userController(store, config, bus) {
         if (body?.[key] !== void 0) fields[key] = body[key];
       }
       if (Object.keys(fields).length === 0) {
-        return (0, import_core5.setApiResponse)(
-          import_core5.HTTP.UNPROCESSABLE,
+        return (0, import_core6.setApiResponse)(
+          import_core6.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Provide at least one of: firstName, lastName, avatarUrl"
         );
       }
       const row = await users.update(ctx.user.id, fields);
       if (!row) {
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       }
       const updated = await users.findById(ctx.user.id);
-      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "PROFILE_UPDATED", "Profile updated.", {
+      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "PROFILE_UPDATED", "Profile updated.", {
         user: toUserDTO(updated, ctx.user.phoneVerified)
       });
     },
@@ -1813,14 +1808,14 @@ function userController(store, config, bus) {
       if (Object.keys(patch).length > 0) fields.patch = patch;
       const row = await users.updatePreferences(ctx.user.id, fields);
       if (!row) {
-        return (0, import_core5.setApiResponse)(
-          import_core5.HTTP.UNPROCESSABLE,
+        return (0, import_core6.setApiResponse)(
+          import_core6.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Provide at least one preference field"
         );
       }
       const updated = await users.findById(ctx.user.id);
-      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "PREFERENCES_UPDATED", "Preferences updated.", {
+      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "PREFERENCES_UPDATED", "Preferences updated.", {
         user: toUserDTO(updated, ctx.user.phoneVerified)
       });
     },
@@ -1829,23 +1824,23 @@ function userController(store, config, bus) {
       const newEmail = body?.["email"];
       const normalised = typeof newEmail === "string" ? normalizeEmailSafe(newEmail) : null;
       if (!normalised) {
-        return (0, import_core5.setApiResponse)(
-          import_core5.HTTP.UNPROCESSABLE,
+        return (0, import_core6.setApiResponse)(
+          import_core6.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "A valid email address is required"
         );
       }
       const oldEmail = ctx.user.email;
       if (normalised === oldEmail) {
-        return (0, import_core5.setApiResponse)(
-          import_core5.HTTP.UNPROCESSABLE,
+        return (0, import_core6.setApiResponse)(
+          import_core6.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "New email must differ from current email"
         );
       }
       const existing = await users.findByEmail(normalised);
       if (existing) {
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
       }
       const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
@@ -1867,8 +1862,8 @@ function userController(store, config, bus) {
         }).catch(() => {
         });
       }
-      return (0, import_core5.setApiResponse)(
-        import_core5.HTTP.OK,
+      return (0, import_core6.setApiResponse)(
+        import_core6.HTTP.OK,
         "EMAIL_UPDATED",
         "Email updated. A verification code has been sent to your new address.",
         {
@@ -1880,8 +1875,8 @@ function userController(store, config, bus) {
       const body = ctx.meta["body"];
       const newPhone = body?.["phone"];
       if (!isValidPhone2(newPhone)) {
-        return (0, import_core5.setApiResponse)(
-          import_core5.HTTP.UNPROCESSABLE,
+        return (0, import_core6.setApiResponse)(
+          import_core6.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "A valid phone number is required"
         );
@@ -1889,7 +1884,7 @@ function userController(store, config, bus) {
       const normalised = normalizePhone2(newPhone);
       const existing = await users.findByPhone(normalised);
       if (existing) {
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
       }
       const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
@@ -1911,8 +1906,8 @@ function userController(store, config, bus) {
         }).catch(() => {
         });
       }
-      return (0, import_core5.setApiResponse)(
-        import_core5.HTTP.OK,
+      return (0, import_core6.setApiResponse)(
+        import_core6.HTTP.OK,
         "PHONE_UPDATED",
         "Phone number updated. A verification code has been sent to your new number.",
         {
@@ -1925,22 +1920,22 @@ function userController(store, config, bus) {
       const currentPassword = body?.["currentPassword"];
       const newPassword = body?.["newPassword"];
       if (typeof currentPassword !== "string" || !currentPassword) {
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "currentPassword is required");
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "currentPassword is required");
       }
       if (typeof newPassword !== "string" || newPassword.length < 8) {
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "newPassword must be at least 8 characters");
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "newPassword must be at least 8 characters");
       }
       const user = await users.findById(ctx.user.id);
-      if (!user) return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      if (!user) return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       const { hashPassword: hashPassword2, verifyPassword: verifyPassword2 } = await Promise.resolve().then(() => (init_password(), password_exports));
       const valid = await verifyPassword2(currentPassword, user.passwordHash ?? "");
       if (!valid) {
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_CREDENTIAL", "Current password is incorrect");
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_CREDENTIAL", "Current password is incorrect");
       }
       const hash = await hashPassword2(newPassword);
       await users.updatePassword(ctx.user.id, hash);
       await sessions.deleteByUser(ctx.user.id);
-      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
+      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
     deleteMe: async (ctx) => {
       const userId = ctx.user.id;
@@ -1965,7 +1960,7 @@ function userController(store, config, bus) {
     // no MFA secret, no session tokens (session metadata only).
     exportMe: async (ctx) => {
       const user = await users.findById(ctx.user.id);
-      if (!user) return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      if (!user) return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       const sessionRows = await sessions.listByUser(ctx.user.id);
       const bundle = {
         exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -1974,8 +1969,8 @@ function userController(store, config, bus) {
           id: s.id,
           userAgent: s.userAgent,
           ipAddress: s.ipAddress,
-          createdAt: s.createdAt instanceof Date ? s.createdAt.toISOString() : s.createdAt,
-          expiresAt: s.expiresAt instanceof Date ? s.expiresAt.toISOString() : s.expiresAt
+          createdAt: (0, import_core6.dateOrEmpty)(s.createdAt),
+          expiresAt: (0, import_core6.dateOrEmpty)(s.expiresAt)
         })),
         security: {
           mfaEnabled: user.mfaEnabled === true,
@@ -1994,13 +1989,13 @@ function userController(store, config, bus) {
         }
         bundle["modules"] = modules;
       }
-      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "DATA_EXPORT", "Your account data.", bundle);
+      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "DATA_EXPORT", "Your account data.", bundle);
     }
   };
 }
 
 // src/controllers/oauth.controller.ts
-var import_core6 = require("@fonderie/core");
+var import_core7 = require("@fonderie/core");
 function oauthController(store, config) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
@@ -2008,8 +2003,8 @@ function oauthController(store, config) {
     googleInit: async (_ctx) => {
       const google = config.google;
       if (!google) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.NOT_IMPLEMENTED,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
           "Google OAuth not configured"
         );
@@ -2021,8 +2016,8 @@ function oauthController(store, config) {
         scope: "openid email profile"
       });
       const url = `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
-      return (0, import_core6.setApiResponse)(
-        import_core6.HTTP.OK,
+      return (0, import_core7.setApiResponse)(
+        import_core7.HTTP.OK,
         "GOOGLE_AUTH_URL",
         "Redirect the user to the returned URL to begin Google OAuth.",
         { url }
@@ -2031,8 +2026,8 @@ function oauthController(store, config) {
     googleCallback: async (ctx) => {
       const google = config.google;
       if (!google) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.NOT_IMPLEMENTED,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
           "Google OAuth not configured"
         );
@@ -2040,7 +2035,7 @@ function oauthController(store, config) {
       const url = new URL(ctx.request.url);
       const code = url.searchParams.get("code");
       if (!code) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
       }
       const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
         method: "POST",
@@ -2055,8 +2050,8 @@ function oauthController(store, config) {
       });
       const tokenData = await tokenRes.json();
       if (!tokenData.id_token) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.BAD_REQUEST,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.BAD_REQUEST,
           "GOOGLE_AUTH_FAILED",
           "OAuth token exchange failed"
         );
@@ -2065,19 +2060,19 @@ function oauthController(store, config) {
         Buffer.from(tokenData.id_token.split(".")[1] ?? "", "base64url").toString()
       );
       if (!payload.email) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
       }
       const normalizedEmail = normalizeEmailSafe(payload.email);
       if (!normalizedEmail) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "Invalid email in OAuth response");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "Invalid email in OAuth response");
       }
       const upserted = await users.upsertByProvider(normalizedEmail, "google", payload.sub ?? "");
       if (!upserted) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
       const fullUser = await users.findById(upserted.id);
       if (!fullUser) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
       const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
         loginMethod: "google"
@@ -2159,19 +2154,19 @@ function buildAuthRoutes(store, config, bus) {
 }
 
 // src/services/config-guard.ts
+var import_core8 = require("@fonderie/core");
 var MODULE = "@fonderie/auth";
-var PLACEHOLDER_SECRET = /dev-secret|test-secret|changeme|change-me|your[-_]secret|placeholder|example|insecure|min-32-chars/i;
-var MIN_SECRET_LENGTH = 32;
 function collectAuthConfigProblems(config) {
   const problems = [];
   const secret = config.jwtSecret ?? "";
-  if (secret.length < MIN_SECRET_LENGTH) {
+  const secretProblem = (0, import_core8.secretStrengthProblem)(secret);
+  if (secretProblem === "too-short") {
     problems.push({
       module: MODULE,
       severity: "error",
-      message: `jwtSecret must be at least ${MIN_SECRET_LENGTH} characters (got ${secret.length})`
+      message: `jwtSecret must be at least ${import_core8.MIN_SECRET_LENGTH} characters (got ${secret.length})`
     });
-  } else if (PLACEHOLDER_SECRET.test(secret)) {
+  } else if (secretProblem === "placeholder") {
     problems.push({
       module: MODULE,
       severity: "error",
@@ -2193,7 +2188,7 @@ function collectAuthConfigProblems(config) {
         severity: "error",
         message: "google OAuth is configured but clientId, clientSecret, or redirectUri is missing"
       });
-    } else if (PLACEHOLDER_SECRET.test(clientSecret)) {
+    } else if (import_core8.PLACEHOLDER_SECRET.test(clientSecret)) {
       problems.push({
         module: MODULE,
         severity: "error",