@fonderie/auth 7.4.0 → 7.5.0

package/brain/outcomes.md

@@ -150,6 +150,7 @@ Raw SQL ships in `node_modules/@fonderie/auth/dist/migrations/sql/` — read it
 | POST | `/auth/mfa/disable` | `requireAuth → requireEmailLogin → requireVerified → validate(mfaTokenSchema) → mfa.disable` |
 | POST | `/auth/mfa/setup` | `requireAuth → requireEmailLogin → requireVerified → mfa.setup` |
 | POST | `/auth/mfa/verify` | `ipLimit('mfaVerify') → requireAnyAuth → requireEmailLogin → requireVerified → validate(mfaTokenSchema) → mfa.verify` |
+| DELETE | `/auth/oauth/:provider` | `requireAuth → user.unlinkOauth` |
 | GET | `/auth/providers` | `async () => setApiResponse(HTTP.OK, 'AUTH_PROVIDERS', 'Sign-in methods available here', { providers: [...config.providers], })` |
 | POST | `/auth/refresh` | `validate(refreshSchema) → auth.refresh` |
 | POST | `/auth/register` | `ipLimit('register') → validate(registerSchema) → auth.register` |

package/brain/signatures.md

@@ -28,6 +28,7 @@ interface IUser {
     mfaEnabled: boolean;
     passwordHash: string | null;
     emailVerifiedAt: Date | null;
+    provider: string | null;
 }
 
 interface ISession {
@@ -99,11 +100,11 @@ interface IDataExportContributor {
 
 const AUTH_CONFIG_KEYS: { sessionDuration: string; verificationCooldown: string; mfa: string; requireVerification: string; }
 
-const MESSAGE_KEYS: { readonly emailRegistration: "email-registration"; readonly emailVerification: "email-verification"; readonly passwordReset: "password-reset"; readonly phoneOtp: "phone-otp"; readonly mfaEnabled: "mfa-enabled"; readonly mfaDisabled: "mfa-disabled"; readonly mfaBackupCodesRegenerated: "mfa-backup-codes-regenerated"; readonly emailChanged: "email-changed"; readonly phoneChanged: "phone-changed"; }
+const MESSAGE_KEYS: { readonly emailRegistration: "email-registration"; readonly emailVerification: "email-verification"; readonly passwordReset: "password-reset"; readonly phoneOtp: "phone-otp"; readonly mfaEnabled: "mfa-enabled"; readonly mfaDisabled: "mfa-disabled"; readonly mfaBackupCodesRegenerated: "mfa-backup-codes-regenerated"; readonly emailChanged: "email-changed"; readonly phoneChanged: "phone-changed"; readonly oauthRegistration: "oauth-registration"; readonly oauthLinked: "oauth-linked"; readonly oauthUnlinked: "oauth-unlinked"; }
 
 type AuthMessageKey = (typeof MESSAGE_KEYS)[keyof typeof MESSAGE_KEYS];
 
-const DEFAULT_TEMPLATES: { "email-registration": { subject: string; html: string; text: string; }; "email-verification": { subject: string; html: string; text: string; }; "password-reset": { subject: string; html: string; text: string; }; "phone-otp": { text: string; }; "mfa-enabled": { subject: string; html: string; text: string; }; "mfa-disabled": { subject: string; html: string; text: string; }; "mfa-backup-codes-regenerated": { subject: string; html: string; text: string; }; "email-changed": { subject: string; html: string; text: string; }; "phone-changed": { subject: string; html: string; text: string; }; }
+const DEFAULT_TEMPLATES: { "email-registration": { subject: string; html: string; text: string; }; "email-verification": { subject: string; html: string; text: string; }; "password-reset": { subject: string; html: string; text: string; }; "phone-otp": { text: string; }; "mfa-enabled": { subject: string; html: string; text: string; }; "mfa-disabled": { subject: string; html: string; text: string; }; "mfa-backup-codes-regenerated": { subject: string; html: string; text: string; }; "email-changed": { subject: string; html: string; text: string; }; "phone-changed": { subject: string; html: string; text: string; }; "oauth-registration": { subject: string; html: string; text: string; }; "oauth-linked": { subject: string; html: string; text: string; }; "oauth-unlinked": { subject: string; html: string; text: string; }; }
 
 interface IUserDTO {
     id: string;
@@ -118,6 +119,8 @@ interface IUserDTO {
     isEmailVerified: boolean;
     isPhoneVerified: boolean;
     mfaEnabled: boolean;
+    provider: string;
+    hasPassword: boolean;
     suspended: boolean;
     whitelist: boolean;
     ipWhitelist: string[];

package/dist/dtos/user.cjs

@@ -75,6 +75,8 @@ function toUserDTO(user, phoneVerified = false) {
     isEmailVerified: user.emailVerifiedAt !== null,
     isPhoneVerified: phoneVerified,
     mfaEnabled: (0, import_core.booleanOrFalse)(user.mfaEnabled),
+    provider: (0, import_core.stringOrEmpty)(user.provider),
+    hasPassword: user.passwordHash !== null && user.passwordHash !== void 0,
     suspended: (0, import_core.booleanOrFalse)(user.suspended),
     whitelist: (0, import_core.booleanOrFalse)(user.whitelist),
     ipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],

package/dist/dtos/user.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/dtos/user.ts"],"sourcesContent":["import { stringOrEmpty, booleanOrFalse, dateOrEmpty } from '@fonderie/core';\n\nimport type { IUser, IUserPreferences } from '../types';\n\nexport interface IUserDTO {\n\tid: string;\n\temail: string;\n\tfirstName: string;\n\tlastName: string;\n\tphone: string;\n\tprofileImageUrl: string;\n\tisActive: boolean;\n\tlastLogin: string;\n\tpreferences: IUserPreferences;\n\tisEmailVerified: boolean;\n\tisPhoneVerified: boolean;\n\tmfaEnabled: boolean;\n\tsuspended: boolean;\n\twhitelist: boolean;\n\tipWhitelist: string[];\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nconst DEFAULT_PREFERENCES: IUserPreferences = {\n\tlocale: 'en-US',\n\ttimezone: 'UTC',\n\tnotifications: { email: true, inApp: true, sms: false, push: false },\n\temailDigest: 'immediate',\n\tdateFormat: 'MM/DD/YYYY',\n\ttimeFormat: 'hh:mm A',\n};\n\n// Historical rows may hold garbage preferences (the update schema accepted\n// `unknown` for four keys until it was typed). Only well-typed values\n// survive into the DTO, and notifications deep-merge over the defaults so a\n// partial stored object can't shrink the shape the client type promises.\nfunction cleanPreferences(prefs: IUserPreferences): Partial<IUserPreferences> {\n\tconst out: Partial<IUserPreferences> = {};\n\tif (typeof prefs.locale === 'string') out.locale = prefs.locale;\n\tif (typeof prefs.timezone === 'string') out.timezone = prefs.timezone;\n\tif (typeof prefs.emailDigest === 'string') out.emailDigest = prefs.emailDigest;\n\tif (typeof prefs.dateFormat === 'string') out.dateFormat = prefs.dateFormat;\n\tif (typeof prefs.timeFormat === 'string') out.timeFormat = prefs.timeFormat;\n\treturn out;\n}\n\nfunction cleanNotifications(value: unknown): Partial<IUserPreferences['notifications']> {\n\tif (!value || typeof value !== 'object') return {};\n\tconst out: Partial<IUserPreferences['notifications']> = {};\n\tfor (const key of ['email', 'inApp', 'sms', 'push'] as const) {\n\t\tconst v = (value as Record<string, unknown>)[key];\n\t\tif (typeof v === 'boolean') out[key] = v;\n\t}\n\treturn out;\n}\n\nexport function toUserDTO(user: IUser, phoneVerified = false): IUserDTO {\n\tconst prefs = user.preferences ?? ({} as IUserPreferences);\n\tconst cleaned = cleanPreferences(prefs);\n\treturn {\n\t\tid: stringOrEmpty(user.id),\n\t\temail: stringOrEmpty(user.email),\n\t\tfirstName: stringOrEmpty(user.firstName),\n\t\tlastName: stringOrEmpty(user.lastName),\n\t\tphone: stringOrEmpty(user.phone),\n\t\tprofileImageUrl: stringOrEmpty(user.profileImageUrl),\n\t\tisActive: typeof user.isActive === 'boolean' ? user.isActive : true,\n\t\tlastLogin: dateOrEmpty(user.lastLogin),\n\t\tpreferences: {\n\t\t\t...DEFAULT_PREFERENCES,\n\t\t\t...cleaned,\n\t\t\tnotifications: {\n\t\t\t\t...DEFAULT_PREFERENCES.notifications,\n\t\t\t\t...cleanNotifications(prefs.notifications),\n\t\t\t},\n\t\t\tlocale: user.locale || cleaned.locale || 'en-US',\n\t\t\ttimezone: user.timezone || cleaned.timezone || 'UTC',\n\t\t},\n\t\tisEmailVerified: user.emailVerifiedAt !== null,\n\t\tisPhoneVerified: phoneVerified,\n\t\tmfaEnabled: booleanOrFalse(user.mfaEnabled),\n\t\tsuspended: booleanOrFalse(user.suspended),\n\t\twhitelist: booleanOrFalse(user.whitelist),\n\t\tipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],\n\t\tcreatedAt: dateOrEmpty(user.createdAt),\n\t\tupdatedAt: dateOrEmpty(user.updatedAt),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAA2D;AAwB3D,IAAM,sBAAwC;AAAA,EAC7C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,eAAe,EAAE,OAAO,MAAM,OAAO,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EACnE,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,YAAY;AACb;AAMA,SAAS,iBAAiB,OAAoD;AAC7E,QAAM,MAAiC,CAAC;AACxC,MAAI,OAAO,MAAM,WAAW,SAAU,KAAI,SAAS,MAAM;AACzD,MAAI,OAAO,MAAM,aAAa,SAAU,KAAI,WAAW,MAAM;AAC7D,MAAI,OAAO,MAAM,gBAAgB,SAAU,KAAI,cAAc,MAAM;AACnE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,SAAO;AACR;AAEA,SAAS,mBAAmB,OAA4D;AACvF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,CAAC;AACjD,QAAM,MAAkD,CAAC;AACzD,aAAW,OAAO,CAAC,SAAS,SAAS,OAAO,MAAM,GAAY;AAC7D,UAAM,IAAK,MAAkC,GAAG;AAChD,QAAI,OAAO,MAAM,UAAW,KAAI,GAAG,IAAI;AAAA,EACxC;AACA,SAAO;AACR;AAEO,SAAS,UAAU,MAAa,gBAAgB,OAAiB;AACvE,QAAM,QAAQ,KAAK,eAAgB,CAAC;AACpC,QAAM,UAAU,iBAAiB,KAAK;AACtC,SAAO;AAAA,IACN,QAAI,2BAAc,KAAK,EAAE;AAAA,IACzB,WAAO,2BAAc,KAAK,KAAK;AAAA,IAC/B,eAAW,2BAAc,KAAK,SAAS;AAAA,IACvC,cAAU,2BAAc,KAAK,QAAQ;AAAA,IACrC,WAAO,2BAAc,KAAK,KAAK;AAAA,IAC/B,qBAAiB,2BAAc,KAAK,eAAe;AAAA,IACnD,UAAU,OAAO,KAAK,aAAa,YAAY,KAAK,WAAW;AAAA,IAC/D,eAAW,yBAAY,KAAK,SAAS;AAAA,IACrC,aAAa;AAAA,MACZ,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACd,GAAG,oBAAoB;AAAA,QACvB,GAAG,mBAAmB,MAAM,aAAa;AAAA,MAC1C;AAAA,MACA,QAAQ,KAAK,UAAU,QAAQ,UAAU;AAAA,MACzC,UAAU,KAAK,YAAY,QAAQ,YAAY;AAAA,IAChD;AAAA,IACA,iBAAiB,KAAK,oBAAoB;AAAA,IAC1C,iBAAiB;AAAA,IACjB,gBAAY,4BAAe,KAAK,UAAU;AAAA,IAC1C,eAAW,4BAAe,KAAK,SAAS;AAAA,IACxC,eAAW,4BAAe,KAAK,SAAS;AAAA,IACxC,aAAa,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,IACnE,eAAW,yBAAY,KAAK,SAAS;AAAA,IACrC,eAAW,yBAAY,KAAK,SAAS;AAAA,EACtC;AACD;","names":[]}
+{"version":3,"sources":["../../src/dtos/user.ts"],"sourcesContent":["import { stringOrEmpty, booleanOrFalse, dateOrEmpty } from '@fonderie/core';\n\nimport type { IUser, IUserPreferences } from '../types';\n\nexport interface IUserDTO {\n\tid: string;\n\temail: string;\n\tfirstName: string;\n\tlastName: string;\n\tphone: string;\n\tprofileImageUrl: string;\n\tisActive: boolean;\n\tlastLogin: string;\n\tpreferences: IUserPreferences;\n\tisEmailVerified: boolean;\n\tisPhoneVerified: boolean;\n\tmfaEnabled: boolean;\n\t// OAuth provider linked to this account ('google', 'apple'), or '' if none.\n\tprovider: string;\n\t// Whether a password is set. Together with `provider` this is everything a\n\t// settings screen needs to render sign-in methods AND to know that\n\t// disconnecting the provider is possible — an account with no password has\n\t// no other credential, so unlinking is refused (409 PASSWORD_REQUIRED).\n\t// Exposed as a boolean precisely so the hash never can be.\n\thasPassword: boolean;\n\tsuspended: boolean;\n\twhitelist: boolean;\n\tipWhitelist: string[];\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nconst DEFAULT_PREFERENCES: IUserPreferences = {\n\tlocale: 'en-US',\n\ttimezone: 'UTC',\n\tnotifications: { email: true, inApp: true, sms: false, push: false },\n\temailDigest: 'immediate',\n\tdateFormat: 'MM/DD/YYYY',\n\ttimeFormat: 'hh:mm A',\n};\n\n// Historical rows may hold garbage preferences (the update schema accepted\n// `unknown` for four keys until it was typed). Only well-typed values\n// survive into the DTO, and notifications deep-merge over the defaults so a\n// partial stored object can't shrink the shape the client type promises.\nfunction cleanPreferences(prefs: IUserPreferences): Partial<IUserPreferences> {\n\tconst out: Partial<IUserPreferences> = {};\n\tif (typeof prefs.locale === 'string') out.locale = prefs.locale;\n\tif (typeof prefs.timezone === 'string') out.timezone = prefs.timezone;\n\tif (typeof prefs.emailDigest === 'string') out.emailDigest = prefs.emailDigest;\n\tif (typeof prefs.dateFormat === 'string') out.dateFormat = prefs.dateFormat;\n\tif (typeof prefs.timeFormat === 'string') out.timeFormat = prefs.timeFormat;\n\treturn out;\n}\n\nfunction cleanNotifications(value: unknown): Partial<IUserPreferences['notifications']> {\n\tif (!value || typeof value !== 'object') return {};\n\tconst out: Partial<IUserPreferences['notifications']> = {};\n\tfor (const key of ['email', 'inApp', 'sms', 'push'] as const) {\n\t\tconst v = (value as Record<string, unknown>)[key];\n\t\tif (typeof v === 'boolean') out[key] = v;\n\t}\n\treturn out;\n}\n\nexport function toUserDTO(user: IUser, phoneVerified = false): IUserDTO {\n\tconst prefs = user.preferences ?? ({} as IUserPreferences);\n\tconst cleaned = cleanPreferences(prefs);\n\treturn {\n\t\tid: stringOrEmpty(user.id),\n\t\temail: stringOrEmpty(user.email),\n\t\tfirstName: stringOrEmpty(user.firstName),\n\t\tlastName: stringOrEmpty(user.lastName),\n\t\tphone: stringOrEmpty(user.phone),\n\t\tprofileImageUrl: stringOrEmpty(user.profileImageUrl),\n\t\tisActive: typeof user.isActive === 'boolean' ? user.isActive : true,\n\t\tlastLogin: dateOrEmpty(user.lastLogin),\n\t\tpreferences: {\n\t\t\t...DEFAULT_PREFERENCES,\n\t\t\t...cleaned,\n\t\t\tnotifications: {\n\t\t\t\t...DEFAULT_PREFERENCES.notifications,\n\t\t\t\t...cleanNotifications(prefs.notifications),\n\t\t\t},\n\t\t\tlocale: user.locale || cleaned.locale || 'en-US',\n\t\t\ttimezone: user.timezone || cleaned.timezone || 'UTC',\n\t\t},\n\t\tisEmailVerified: user.emailVerifiedAt !== null,\n\t\tisPhoneVerified: phoneVerified,\n\t\tmfaEnabled: booleanOrFalse(user.mfaEnabled),\n\t\tprovider: stringOrEmpty(user.provider),\n\t\thasPassword: user.passwordHash !== null && user.passwordHash !== undefined,\n\t\tsuspended: booleanOrFalse(user.suspended),\n\t\twhitelist: booleanOrFalse(user.whitelist),\n\t\tipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],\n\t\tcreatedAt: dateOrEmpty(user.createdAt),\n\t\tupdatedAt: dateOrEmpty(user.updatedAt),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAA2D;AAgC3D,IAAM,sBAAwC;AAAA,EAC7C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,eAAe,EAAE,OAAO,MAAM,OAAO,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EACnE,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,YAAY;AACb;AAMA,SAAS,iBAAiB,OAAoD;AAC7E,QAAM,MAAiC,CAAC;AACxC,MAAI,OAAO,MAAM,WAAW,SAAU,KAAI,SAAS,MAAM;AACzD,MAAI,OAAO,MAAM,aAAa,SAAU,KAAI,WAAW,MAAM;AAC7D,MAAI,OAAO,MAAM,gBAAgB,SAAU,KAAI,cAAc,MAAM;AACnE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,SAAO;AACR;AAEA,SAAS,mBAAmB,OAA4D;AACvF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,CAAC;AACjD,QAAM,MAAkD,CAAC;AACzD,aAAW,OAAO,CAAC,SAAS,SAAS,OAAO,MAAM,GAAY;AAC7D,UAAM,IAAK,MAAkC,GAAG;AAChD,QAAI,OAAO,MAAM,UAAW,KAAI,GAAG,IAAI;AAAA,EACxC;AACA,SAAO;AACR;AAEO,SAAS,UAAU,MAAa,gBAAgB,OAAiB;AACvE,QAAM,QAAQ,KAAK,eAAgB,CAAC;AACpC,QAAM,UAAU,iBAAiB,KAAK;AACtC,SAAO;AAAA,IACN,QAAI,2BAAc,KAAK,EAAE;AAAA,IACzB,WAAO,2BAAc,KAAK,KAAK;AAAA,IAC/B,eAAW,2BAAc,KAAK,SAAS;AAAA,IACvC,cAAU,2BAAc,KAAK,QAAQ;AAAA,IACrC,WAAO,2BAAc,KAAK,KAAK;AAAA,IAC/B,qBAAiB,2BAAc,KAAK,eAAe;AAAA,IACnD,UAAU,OAAO,KAAK,aAAa,YAAY,KAAK,WAAW;AAAA,IAC/D,eAAW,yBAAY,KAAK,SAAS;AAAA,IACrC,aAAa;AAAA,MACZ,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACd,GAAG,oBAAoB;AAAA,QACvB,GAAG,mBAAmB,MAAM,aAAa;AAAA,MAC1C;AAAA,MACA,QAAQ,KAAK,UAAU,QAAQ,UAAU;AAAA,MACzC,UAAU,KAAK,YAAY,QAAQ,YAAY;AAAA,IAChD;AAAA,IACA,iBAAiB,KAAK,oBAAoB;AAAA,IAC1C,iBAAiB;AAAA,IACjB,gBAAY,4BAAe,KAAK,UAAU;AAAA,IAC1C,cAAU,2BAAc,KAAK,QAAQ;AAAA,IACrC,aAAa,KAAK,iBAAiB,QAAQ,KAAK,iBAAiB;AAAA,IACjE,eAAW,4BAAe,KAAK,SAAS;AAAA,IACxC,eAAW,4BAAe,KAAK,SAAS;AAAA,IACxC,aAAa,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,IACnE,eAAW,yBAAY,KAAK,SAAS;AAAA,IACrC,eAAW,yBAAY,KAAK,SAAS;AAAA,EACtC;AACD;","names":[]}

package/dist/dtos/user.d.cts

@@ -13,6 +13,8 @@ interface IUserDTO {
     isEmailVerified: boolean;
     isPhoneVerified: boolean;
     mfaEnabled: boolean;
+    provider: string;
+    hasPassword: boolean;
     suspended: boolean;
     whitelist: boolean;
     ipWhitelist: string[];

package/dist/dtos/user.d.ts

@@ -13,6 +13,8 @@ interface IUserDTO {
     isEmailVerified: boolean;
     isPhoneVerified: boolean;
     mfaEnabled: boolean;
+    provider: string;
+    hasPassword: boolean;
     suspended: boolean;
     whitelist: boolean;
     ipWhitelist: string[];

package/dist/dtos/user.js

@@ -51,6 +51,8 @@ function toUserDTO(user, phoneVerified = false) {
     isEmailVerified: user.emailVerifiedAt !== null,
     isPhoneVerified: phoneVerified,
     mfaEnabled: booleanOrFalse(user.mfaEnabled),
+    provider: stringOrEmpty(user.provider),
+    hasPassword: user.passwordHash !== null && user.passwordHash !== void 0,
     suspended: booleanOrFalse(user.suspended),
     whitelist: booleanOrFalse(user.whitelist),
     ipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],

package/dist/dtos/user.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/dtos/user.ts"],"sourcesContent":["import { stringOrEmpty, booleanOrFalse, dateOrEmpty } from '@fonderie/core';\n\nimport type { IUser, IUserPreferences } from '../types';\n\nexport interface IUserDTO {\n\tid: string;\n\temail: string;\n\tfirstName: string;\n\tlastName: string;\n\tphone: string;\n\tprofileImageUrl: string;\n\tisActive: boolean;\n\tlastLogin: string;\n\tpreferences: IUserPreferences;\n\tisEmailVerified: boolean;\n\tisPhoneVerified: boolean;\n\tmfaEnabled: boolean;\n\tsuspended: boolean;\n\twhitelist: boolean;\n\tipWhitelist: string[];\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nconst DEFAULT_PREFERENCES: IUserPreferences = {\n\tlocale: 'en-US',\n\ttimezone: 'UTC',\n\tnotifications: { email: true, inApp: true, sms: false, push: false },\n\temailDigest: 'immediate',\n\tdateFormat: 'MM/DD/YYYY',\n\ttimeFormat: 'hh:mm A',\n};\n\n// Historical rows may hold garbage preferences (the update schema accepted\n// `unknown` for four keys until it was typed). Only well-typed values\n// survive into the DTO, and notifications deep-merge over the defaults so a\n// partial stored object can't shrink the shape the client type promises.\nfunction cleanPreferences(prefs: IUserPreferences): Partial<IUserPreferences> {\n\tconst out: Partial<IUserPreferences> = {};\n\tif (typeof prefs.locale === 'string') out.locale = prefs.locale;\n\tif (typeof prefs.timezone === 'string') out.timezone = prefs.timezone;\n\tif (typeof prefs.emailDigest === 'string') out.emailDigest = prefs.emailDigest;\n\tif (typeof prefs.dateFormat === 'string') out.dateFormat = prefs.dateFormat;\n\tif (typeof prefs.timeFormat === 'string') out.timeFormat = prefs.timeFormat;\n\treturn out;\n}\n\nfunction cleanNotifications(value: unknown): Partial<IUserPreferences['notifications']> {\n\tif (!value || typeof value !== 'object') return {};\n\tconst out: Partial<IUserPreferences['notifications']> = {};\n\tfor (const key of ['email', 'inApp', 'sms', 'push'] as const) {\n\t\tconst v = (value as Record<string, unknown>)[key];\n\t\tif (typeof v === 'boolean') out[key] = v;\n\t}\n\treturn out;\n}\n\nexport function toUserDTO(user: IUser, phoneVerified = false): IUserDTO {\n\tconst prefs = user.preferences ?? ({} as IUserPreferences);\n\tconst cleaned = cleanPreferences(prefs);\n\treturn {\n\t\tid: stringOrEmpty(user.id),\n\t\temail: stringOrEmpty(user.email),\n\t\tfirstName: stringOrEmpty(user.firstName),\n\t\tlastName: stringOrEmpty(user.lastName),\n\t\tphone: stringOrEmpty(user.phone),\n\t\tprofileImageUrl: stringOrEmpty(user.profileImageUrl),\n\t\tisActive: typeof user.isActive === 'boolean' ? user.isActive : true,\n\t\tlastLogin: dateOrEmpty(user.lastLogin),\n\t\tpreferences: {\n\t\t\t...DEFAULT_PREFERENCES,\n\t\t\t...cleaned,\n\t\t\tnotifications: {\n\t\t\t\t...DEFAULT_PREFERENCES.notifications,\n\t\t\t\t...cleanNotifications(prefs.notifications),\n\t\t\t},\n\t\t\tlocale: user.locale || cleaned.locale || 'en-US',\n\t\t\ttimezone: user.timezone || cleaned.timezone || 'UTC',\n\t\t},\n\t\tisEmailVerified: user.emailVerifiedAt !== null,\n\t\tisPhoneVerified: phoneVerified,\n\t\tmfaEnabled: booleanOrFalse(user.mfaEnabled),\n\t\tsuspended: booleanOrFalse(user.suspended),\n\t\twhitelist: booleanOrFalse(user.whitelist),\n\t\tipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],\n\t\tcreatedAt: dateOrEmpty(user.createdAt),\n\t\tupdatedAt: dateOrEmpty(user.updatedAt),\n\t};\n}\n"],"mappings":";AAAA,SAAS,eAAe,gBAAgB,mBAAmB;AAwB3D,IAAM,sBAAwC;AAAA,EAC7C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,eAAe,EAAE,OAAO,MAAM,OAAO,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EACnE,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,YAAY;AACb;AAMA,SAAS,iBAAiB,OAAoD;AAC7E,QAAM,MAAiC,CAAC;AACxC,MAAI,OAAO,MAAM,WAAW,SAAU,KAAI,SAAS,MAAM;AACzD,MAAI,OAAO,MAAM,aAAa,SAAU,KAAI,WAAW,MAAM;AAC7D,MAAI,OAAO,MAAM,gBAAgB,SAAU,KAAI,cAAc,MAAM;AACnE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,SAAO;AACR;AAEA,SAAS,mBAAmB,OAA4D;AACvF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,CAAC;AACjD,QAAM,MAAkD,CAAC;AACzD,aAAW,OAAO,CAAC,SAAS,SAAS,OAAO,MAAM,GAAY;AAC7D,UAAM,IAAK,MAAkC,GAAG;AAChD,QAAI,OAAO,MAAM,UAAW,KAAI,GAAG,IAAI;AAAA,EACxC;AACA,SAAO;AACR;AAEO,SAAS,UAAU,MAAa,gBAAgB,OAAiB;AACvE,QAAM,QAAQ,KAAK,eAAgB,CAAC;AACpC,QAAM,UAAU,iBAAiB,KAAK;AACtC,SAAO;AAAA,IACN,IAAI,cAAc,KAAK,EAAE;AAAA,IACzB,OAAO,cAAc,KAAK,KAAK;AAAA,IAC/B,WAAW,cAAc,KAAK,SAAS;AAAA,IACvC,UAAU,cAAc,KAAK,QAAQ;AAAA,IACrC,OAAO,cAAc,KAAK,KAAK;AAAA,IAC/B,iBAAiB,cAAc,KAAK,eAAe;AAAA,IACnD,UAAU,OAAO,KAAK,aAAa,YAAY,KAAK,WAAW;AAAA,IAC/D,WAAW,YAAY,KAAK,SAAS;AAAA,IACrC,aAAa;AAAA,MACZ,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACd,GAAG,oBAAoB;AAAA,QACvB,GAAG,mBAAmB,MAAM,aAAa;AAAA,MAC1C;AAAA,MACA,QAAQ,KAAK,UAAU,QAAQ,UAAU;AAAA,MACzC,UAAU,KAAK,YAAY,QAAQ,YAAY;AAAA,IAChD;AAAA,IACA,iBAAiB,KAAK,oBAAoB;AAAA,IAC1C,iBAAiB;AAAA,IACjB,YAAY,eAAe,KAAK,UAAU;AAAA,IAC1C,WAAW,eAAe,KAAK,SAAS;AAAA,IACxC,WAAW,eAAe,KAAK,SAAS;AAAA,IACxC,aAAa,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,IACnE,WAAW,YAAY,KAAK,SAAS;AAAA,IACrC,WAAW,YAAY,KAAK,SAAS;AAAA,EACtC;AACD;","names":[]}
+{"version":3,"sources":["../../src/dtos/user.ts"],"sourcesContent":["import { stringOrEmpty, booleanOrFalse, dateOrEmpty } from '@fonderie/core';\n\nimport type { IUser, IUserPreferences } from '../types';\n\nexport interface IUserDTO {\n\tid: string;\n\temail: string;\n\tfirstName: string;\n\tlastName: string;\n\tphone: string;\n\tprofileImageUrl: string;\n\tisActive: boolean;\n\tlastLogin: string;\n\tpreferences: IUserPreferences;\n\tisEmailVerified: boolean;\n\tisPhoneVerified: boolean;\n\tmfaEnabled: boolean;\n\t// OAuth provider linked to this account ('google', 'apple'), or '' if none.\n\tprovider: string;\n\t// Whether a password is set. Together with `provider` this is everything a\n\t// settings screen needs to render sign-in methods AND to know that\n\t// disconnecting the provider is possible — an account with no password has\n\t// no other credential, so unlinking is refused (409 PASSWORD_REQUIRED).\n\t// Exposed as a boolean precisely so the hash never can be.\n\thasPassword: boolean;\n\tsuspended: boolean;\n\twhitelist: boolean;\n\tipWhitelist: string[];\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nconst DEFAULT_PREFERENCES: IUserPreferences = {\n\tlocale: 'en-US',\n\ttimezone: 'UTC',\n\tnotifications: { email: true, inApp: true, sms: false, push: false },\n\temailDigest: 'immediate',\n\tdateFormat: 'MM/DD/YYYY',\n\ttimeFormat: 'hh:mm A',\n};\n\n// Historical rows may hold garbage preferences (the update schema accepted\n// `unknown` for four keys until it was typed). Only well-typed values\n// survive into the DTO, and notifications deep-merge over the defaults so a\n// partial stored object can't shrink the shape the client type promises.\nfunction cleanPreferences(prefs: IUserPreferences): Partial<IUserPreferences> {\n\tconst out: Partial<IUserPreferences> = {};\n\tif (typeof prefs.locale === 'string') out.locale = prefs.locale;\n\tif (typeof prefs.timezone === 'string') out.timezone = prefs.timezone;\n\tif (typeof prefs.emailDigest === 'string') out.emailDigest = prefs.emailDigest;\n\tif (typeof prefs.dateFormat === 'string') out.dateFormat = prefs.dateFormat;\n\tif (typeof prefs.timeFormat === 'string') out.timeFormat = prefs.timeFormat;\n\treturn out;\n}\n\nfunction cleanNotifications(value: unknown): Partial<IUserPreferences['notifications']> {\n\tif (!value || typeof value !== 'object') return {};\n\tconst out: Partial<IUserPreferences['notifications']> = {};\n\tfor (const key of ['email', 'inApp', 'sms', 'push'] as const) {\n\t\tconst v = (value as Record<string, unknown>)[key];\n\t\tif (typeof v === 'boolean') out[key] = v;\n\t}\n\treturn out;\n}\n\nexport function toUserDTO(user: IUser, phoneVerified = false): IUserDTO {\n\tconst prefs = user.preferences ?? ({} as IUserPreferences);\n\tconst cleaned = cleanPreferences(prefs);\n\treturn {\n\t\tid: stringOrEmpty(user.id),\n\t\temail: stringOrEmpty(user.email),\n\t\tfirstName: stringOrEmpty(user.firstName),\n\t\tlastName: stringOrEmpty(user.lastName),\n\t\tphone: stringOrEmpty(user.phone),\n\t\tprofileImageUrl: stringOrEmpty(user.profileImageUrl),\n\t\tisActive: typeof user.isActive === 'boolean' ? user.isActive : true,\n\t\tlastLogin: dateOrEmpty(user.lastLogin),\n\t\tpreferences: {\n\t\t\t...DEFAULT_PREFERENCES,\n\t\t\t...cleaned,\n\t\t\tnotifications: {\n\t\t\t\t...DEFAULT_PREFERENCES.notifications,\n\t\t\t\t...cleanNotifications(prefs.notifications),\n\t\t\t},\n\t\t\tlocale: user.locale || cleaned.locale || 'en-US',\n\t\t\ttimezone: user.timezone || cleaned.timezone || 'UTC',\n\t\t},\n\t\tisEmailVerified: user.emailVerifiedAt !== null,\n\t\tisPhoneVerified: phoneVerified,\n\t\tmfaEnabled: booleanOrFalse(user.mfaEnabled),\n\t\tprovider: stringOrEmpty(user.provider),\n\t\thasPassword: user.passwordHash !== null && user.passwordHash !== undefined,\n\t\tsuspended: booleanOrFalse(user.suspended),\n\t\twhitelist: booleanOrFalse(user.whitelist),\n\t\tipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],\n\t\tcreatedAt: dateOrEmpty(user.createdAt),\n\t\tupdatedAt: dateOrEmpty(user.updatedAt),\n\t};\n}\n"],"mappings":";AAAA,SAAS,eAAe,gBAAgB,mBAAmB;AAgC3D,IAAM,sBAAwC;AAAA,EAC7C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,eAAe,EAAE,OAAO,MAAM,OAAO,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EACnE,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,YAAY;AACb;AAMA,SAAS,iBAAiB,OAAoD;AAC7E,QAAM,MAAiC,CAAC;AACxC,MAAI,OAAO,MAAM,WAAW,SAAU,KAAI,SAAS,MAAM;AACzD,MAAI,OAAO,MAAM,aAAa,SAAU,KAAI,WAAW,MAAM;AAC7D,MAAI,OAAO,MAAM,gBAAgB,SAAU,KAAI,cAAc,MAAM;AACnE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,SAAO;AACR;AAEA,SAAS,mBAAmB,OAA4D;AACvF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,CAAC;AACjD,QAAM,MAAkD,CAAC;AACzD,aAAW,OAAO,CAAC,SAAS,SAAS,OAAO,MAAM,GAAY;AAC7D,UAAM,IAAK,MAAkC,GAAG;AAChD,QAAI,OAAO,MAAM,UAAW,KAAI,GAAG,IAAI;AAAA,EACxC;AACA,SAAO;AACR;AAEO,SAAS,UAAU,MAAa,gBAAgB,OAAiB;AACvE,QAAM,QAAQ,KAAK,eAAgB,CAAC;AACpC,QAAM,UAAU,iBAAiB,KAAK;AACtC,SAAO;AAAA,IACN,IAAI,cAAc,KAAK,EAAE;AAAA,IACzB,OAAO,cAAc,KAAK,KAAK;AAAA,IAC/B,WAAW,cAAc,KAAK,SAAS;AAAA,IACvC,UAAU,cAAc,KAAK,QAAQ;AAAA,IACrC,OAAO,cAAc,KAAK,KAAK;AAAA,IAC/B,iBAAiB,cAAc,KAAK,eAAe;AAAA,IACnD,UAAU,OAAO,KAAK,aAAa,YAAY,KAAK,WAAW;AAAA,IAC/D,WAAW,YAAY,KAAK,SAAS;AAAA,IACrC,aAAa;AAAA,MACZ,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACd,GAAG,oBAAoB;AAAA,QACvB,GAAG,mBAAmB,MAAM,aAAa;AAAA,MAC1C;AAAA,MACA,QAAQ,KAAK,UAAU,QAAQ,UAAU;AAAA,MACzC,UAAU,KAAK,YAAY,QAAQ,YAAY;AAAA,IAChD;AAAA,IACA,iBAAiB,KAAK,oBAAoB;AAAA,IAC1C,iBAAiB;AAAA,IACjB,YAAY,eAAe,KAAK,UAAU;AAAA,IAC1C,UAAU,cAAc,KAAK,QAAQ;AAAA,IACrC,aAAa,KAAK,iBAAiB,QAAQ,KAAK,iBAAiB;AAAA,IACjE,WAAW,eAAe,KAAK,SAAS;AAAA,IACxC,WAAW,eAAe,KAAK,SAAS;AAAA,IACxC,aAAa,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,IACnE,WAAW,YAAY,KAAK,SAAS;AAAA,IACrC,WAAW,YAAY,KAAK,SAAS;AAAA,EACtC;AACD;","names":[]}

package/dist/index.cjs

@@ -296,7 +296,16 @@ var MESSAGE_KEYS = {
   mfaDisabled: "mfa-disabled",
   mfaBackupCodesRegenerated: "mfa-backup-codes-regenerated",
   emailChanged: "email-changed",
-  phoneChanged: "phone-changed"
+  phoneChanged: "phone-changed",
+  // Changing HOW an account can be signed into is a security event for the
+  // account's owner, who may not be the person doing it. Both directions are
+  // notified for the same reason password changes are.
+  // Welcome for an account CREATED by an OAuth sign-in. Distinct from
+  // emailRegistration, which carries a verification PIN — an OAuth signup
+  // arrives already verified by the provider and has nothing to confirm.
+  oauthRegistration: "oauth-registration",
+  oauthLinked: "oauth-linked",
+  oauthUnlinked: "oauth-unlinked"
 };
 var EVENT_KEYS = {
   userRegistered: "fonderie.user.registered",
@@ -528,6 +537,8 @@ function toUserDTO(user, phoneVerified = false) {
     isEmailVerified: user.emailVerifiedAt !== null,
     isPhoneVerified: phoneVerified,
     mfaEnabled: (0, import_core3.booleanOrFalse)(user.mfaEnabled),
+    provider: (0, import_core3.stringOrEmpty)(user.provider),
+    hasPassword: user.passwordHash !== null && user.passwordHash !== void 0,
     suspended: (0, import_core3.booleanOrFalse)(user.suspended),
     whitelist: (0, import_core3.booleanOrFalse)(user.whitelist),
     ipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],
@@ -555,6 +566,7 @@ var USER_COLUMNS = `
 	ip_whitelist       AS "ipWhitelist",
 	mfa_enabled        AS "mfaEnabled",
 	email_verified_at  AS "emailVerifiedAt",
+	provider,
 	deleted_at         AS "deletedAt",
 	created_at         AS "createdAt",
 	updated_at         AS "updatedAt"
@@ -632,6 +644,31 @@ var UserModel = class {
     );
     return row ?? null;
   }
+  /**
+   * Clear the OAuth provider, but ONLY when the account can still be signed
+   * into afterwards.
+   *
+   * An account created through Google has no password. Unlinking it without
+   * checking would not be "removing a sign-in method" — it would be locking
+   * the owner out permanently, which is account deletion wearing a friendlier
+   * label. The guard lives in the WHERE clause so the check and the write are
+   * one atomic statement: a password cannot be removed between them.
+   *
+   * Returns false when the account has no password (nothing was changed) so
+   * the caller can say why rather than reporting a silent success.
+   */
+  async clearProvider(id) {
+    const rows = await this.store.query(
+      `UPDATE fonderie_users
+			    SET provider = NULL, provider_id = NULL
+			  WHERE id = $1
+			    AND password_hash IS NOT NULL
+			    AND provider IS NOT NULL
+			 RETURNING id`,
+      [id]
+    );
+    return rows.length > 0;
+  }
   async updatePassword(id, passwordHash) {
     await this.store.query(`UPDATE fonderie_users SET password_hash = $1 WHERE id = $2`, [
       passwordHash,
@@ -732,14 +769,44 @@ var UserModel = class {
     );
     return row?.mfa_secret ?? null;
   }
+  /**
+   * Link an OAuth identity to the account owning `email`, creating it if there
+   * is none.
+   *
+   * Returns what HAPPENED, not just who it happened to. Three outcomes hide
+   * behind one upsert, and callers must tell them apart:
+   *
+   *   • `inserted` — a brand-new account. Whoever provisions on signup (the
+   *     personal workspace, a wallet, a welcome email) must run, exactly as
+   *     it does for a password registration. This is the case that was
+   *     previously invisible: the upsert returned an id and looked identical
+   *     to a returning user signing in, so OAuth signups silently skipped
+   *     every signup side effect.
+   *   • `previousProvider` differs — an existing account gained, or switched,
+   *     a way to sign in. A security event for the owner.
+   *   • `previousProvider` is the same — an ordinary login. Nothing to do, and
+   *     notifying here would email the user on every single sign-in.
+   *
+   * The prior state is read in a CTE of the SAME statement, so it sees the
+   * snapshot from before the insert. Reading it in a separate query would
+   * race two concurrent logins into both seeing "new".
+   */
   async upsertByProvider(email2, provider, providerId) {
     const [row] = await this.store.query(
-      `INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
-			VALUES ($1, now(), $2, $3)
-			ON CONFLICT (email) DO UPDATE
-			SET provider = $2, provider_id = $3,
-			    email_verified_at = COALESCE(fonderie_users.email_verified_at, now())
-			RETURNING id`,
+      `WITH prior AS (
+				SELECT provider FROM fonderie_users WHERE email = $1
+			), upserted AS (
+				INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
+				VALUES ($1, now(), $2, $3)
+				ON CONFLICT (email) DO UPDATE
+				SET provider = $2, provider_id = $3,
+				    email_verified_at = COALESCE(fonderie_users.email_verified_at, now())
+				RETURNING id
+			)
+			SELECT upserted.id,
+			       NOT EXISTS (SELECT 1 FROM prior)   AS inserted,
+			       (SELECT provider FROM prior)       AS "previousProvider"
+			FROM upserted`,
       [email2, provider, providerId]
     );
     return row ?? null;
@@ -2232,6 +2299,50 @@ function userController(store, config, bus) {
       await sessions.deleteByUser(ctx.user.id);
       return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
+    /**
+     * Remove an OAuth provider from the account.
+     *
+     * Refuses when the account has no password, because unlinking would
+     * then leave NO way to sign in — that is account deletion, not a
+     * settings toggle, and a user clicking "disconnect Google" is not
+     * asking for it. The check is inside the UPDATE's WHERE clause, so a
+     * password cannot disappear between the check and the write.
+     *
+     * Notifies the account's email either way: changing how an account can
+     * be signed into is a security event for its owner, who is not
+     * necessarily the person doing it.
+     */
+    unlinkOauth: async (ctx) => {
+      const provider = String(ctx.meta["params"]?.["provider"] ?? "");
+      const current = await users.findById(ctx.user.id);
+      if (!current?.provider) {
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_LINKED", "No sign-in provider is linked.");
+      }
+      if (provider && provider.toLowerCase() !== current.provider.toLowerCase()) {
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.NOT_FOUND,
+          "NOT_LINKED",
+          `This account is not linked to ${provider}.`
+        );
+      }
+      const removed = await users.clearProvider(ctx.user.id);
+      if (!removed) {
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.CONFLICT,
+          "PASSWORD_REQUIRED",
+          "Set a password before disconnecting this provider \u2014 it is currently the only way to sign in."
+        );
+      }
+      if (ctx.user.email) {
+        await (0, import_core8.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+          type: MESSAGE_KEYS.oauthUnlinked,
+          locale: ctx.user.locale,
+          data: { provider: current.provider },
+          recipient: { email: ctx.user.email, phone: null, deviceToken: null }
+        }));
+      }
+      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "OAUTH_UNLINKED", "Sign-in provider removed.");
+    },
     deleteMe: async (ctx) => {
       const userId = ctx.user.id;
       await users.softDelete(userId);
@@ -2292,6 +2403,7 @@ function userController(store, config, bus) {
 var import_node_crypto7 = require("crypto");
 var import_jsonwebtoken2 = __toESM(require("jsonwebtoken"), 1);
 var import_core9 = require("@fonderie/core");
+var import_events4 = require("@fonderie/events");
 
 // src/models/consumed-token.model.ts
 var ConsumedTokenModel = class {
@@ -2392,11 +2504,56 @@ async function verifyAppleIdToken(idToken, opts) {
   }
 }
 var appleEmailVerified = (c) => c.email_verified === true || c.email_verified === "true";
-function oauthController(store, config) {
+function oauthController(store, config, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const loginEvents = new LoginEventModel(store);
   const consumedTokens = new ConsumedTokenModel(store);
+  const announceOAuthUpsert = async (ctx, upserted, provider, user) => {
+    if (!bus) return;
+    const reqId = ctx.meta["requestId"];
+    const reqOpts = reqId !== void 0 ? { requestId: reqId } : void 0;
+    const label = provider.charAt(0).toUpperCase() + provider.slice(1);
+    const recipient = { email: user.email, phone: null, deviceToken: null };
+    if (upserted.inserted) {
+      await (0, import_core9.background)(bus.emit(
+        EVENT_KEYS.userRegistered,
+        {
+          userId: upserted.id,
+          email: user.email,
+          firstName: user.firstName,
+          lastName: user.lastName,
+          loginMethod: provider
+        },
+        reqOpts
+      ));
+      if (user.email) {
+        await (0, import_core9.background)(bus.emit(
+          import_events4.NOTIFICATION_EVENT,
+          {
+            type: MESSAGE_KEYS.oauthRegistration,
+            locale: user.locale,
+            data: { provider: label, appName: config.appName ?? "Fonderie" },
+            recipient
+          },
+          reqOpts
+        ));
+      }
+      return;
+    }
+    if (upserted.previousProvider !== provider && user.email) {
+      await (0, import_core9.background)(bus.emit(
+        import_events4.NOTIFICATION_EVENT,
+        {
+          type: MESSAGE_KEYS.oauthLinked,
+          locale: user.locale,
+          data: { provider: label },
+          recipient
+        },
+        reqOpts
+      ));
+    }
+  };
   const completeAppleLogin = async (ctx, claims) => {
     const meta = requestMeta(ctx);
     if (!claims.email) {
@@ -2425,6 +2582,7 @@ function oauthController(store, config) {
     if (!fullUser) {
       return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
     }
+    await announceOAuthUpsert(ctx, upserted, "apple", fullUser);
     const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, { loginMethod: "apple" });
     await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
     await loginEvents.recordSafe({
@@ -2575,6 +2733,7 @@ function oauthController(store, config) {
       if (!fullUser) {
         return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
+      await announceOAuthUpsert(ctx, upserted, "google", fullUser);
       const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
         loginMethod: "google"
       });
@@ -2739,7 +2898,7 @@ function oauthController(store, config) {
 function buildAuthRoutes(store, config, bus) {
   const user = userController(store, config, bus);
   const auth = authController(store, config, bus);
-  const oauth = oauthController(store, config);
+  const oauth = oauthController(store, config, bus);
   const mfa = mfaController(store, config, config.appName ?? "Fonderie", bus);
   const verifyGate = config.requireVerification ? import_middlewares2.requireVerified : (_ctx, next) => next();
   const passthrough = (_ctx, next) => next();
@@ -2797,6 +2956,9 @@ function buildAuthRoutes(store, config, bus) {
     R("updateEmail", "PUT", "/users/email", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updateEmailSchema), user.updateEmail),
     R("updatePhone", "PUT", "/users/phone", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updatePhoneSchema), user.updatePhone),
     R("changePassword", "PUT", "/users/password", import_middlewares2.requireAuth, (0, import_middlewares.validate)(changePasswordSchema), user.changePassword),
+    // Disconnect an OAuth provider. requireAuth only — the controller
+    // refuses when it would leave the account with no way to sign in.
+    R("unlinkOauth", "DELETE", "/auth/oauth/:provider", import_middlewares2.requireAuth, user.unlinkOauth),
     R("deleteMe", "DELETE", "/users", import_middlewares2.requireAuth, verifyGate, user.deleteMe),
     R("exportMe", "GET", "/users/export", import_middlewares2.requireAuth, user.exportMe),
     // Security surfaces (Protected; the caller's own login history + sessions).
@@ -3109,9 +3271,47 @@ If you made this change, you're all set. If not, contact support right away \u20
 The phone number on your account was just updated.
 
 If you made this change, you're all set. If not, contact support right away \u2014 someone may have access to your account.`
+  },
+  [MESSAGE_KEYS.oauthRegistration]: {
+    subject: "Welcome to {{appName}}",
+    html: `<h1>Welcome to {{appName}}</h1>
+<p>Your account was created using <strong>{{provider}}</strong>. Sign in any time with the same {{provider}} account &mdash; there is no password to remember.</p>
+<p class="muted">If you did not create this account, contact support.</p>`,
+    text: `Welcome
+
+Your account was created using {{provider}}. Sign in any time with the same
+{{provider}} account \u2014 there is no password to remember.
+
+If you did not create this account, contact support.`
+  },
+  [MESSAGE_KEYS.oauthLinked]: {
+    subject: "A new sign-in method was added to your account",
+    html: `<h1>{{provider}} sign-in was added</h1>
+<p>Your account can now also be signed into with <strong>{{provider}}</strong>.</p>
+<p class="muted">If you did this, nothing more is needed. If not, contact support right away and change your password &mdash; someone else may be able to sign in as you.</p>`,
+    text: `{{provider}} sign-in was added
+
+Your account can now also be signed into with {{provider}}.
+
+If you did this, nothing more is needed. If not, contact support right away and
+change your password \u2014 someone else may be able to sign in as you.`
+  },
+  [MESSAGE_KEYS.oauthUnlinked]: {
+    subject: "A sign-in method was removed from your account",
+    html: `<h1>{{provider}} sign-in was removed</h1>
+<p><strong>{{provider}}</strong> can no longer be used to sign in. Your email and password still work.</p>
+<p class="muted">If you did this, you&rsquo;re all set. If not, contact support right away.</p>`,
+    text: `{{provider}} sign-in was removed
+
+{{provider}} can no longer be used to sign in. Your email and password still work.
+
+If you did this, you're all set. If not, contact support right away.`
   }
 };
 var SAMPLE_PAYLOADS = {
+  [MESSAGE_KEYS.oauthRegistration]: { provider: "Google", appName: "Fonderie" },
+  [MESSAGE_KEYS.oauthLinked]: { provider: "Google" },
+  [MESSAGE_KEYS.oauthUnlinked]: { provider: "Google" },
   [MESSAGE_KEYS.emailRegistration]: { firstName: "", pin: "123456" },
   [MESSAGE_KEYS.emailVerification]: { firstName: "Ada", pin: "123456" },
   [MESSAGE_KEYS.passwordReset]: {