@nakedev/go-scaffold 0.3.3 → 0.4.3

package/dist/prompts/generate-wizard.js

@@ -6,12 +6,20 @@ exports.promptMethodType = promptMethodType;
 exports.promptGetMode = promptGetMode;
 exports.promptMigrationName = promptMigrationName;
 exports.promptLookupField = promptLookupField;
+exports.promptModuleSurface = promptModuleSurface;
+exports.promptApplicationStyle = promptApplicationStyle;
+exports.promptModuleProfile = promptModuleProfile;
+exports.promptAdvancedModuleArchitecture = promptAdvancedModuleArchitecture;
+exports.moduleArchitectureForProfile = moduleArchitectureForProfile;
+exports.moduleProfileDescription = moduleProfileDescription;
 exports.promptModuleShape = promptModuleShape;
+exports.promptModuleCqrs = promptModuleCqrs;
 exports.promptModuleAuth = promptModuleAuth;
 exports.promptModulePermission = promptModulePermission;
 exports.promptExistingModule = promptExistingModule;
 const interactive_1 = require("./interactive");
 const naming_1 = require("../utils/naming");
+const module_profile_1 = require("../utils/module-profile");
 // wraps an assert-style validator into inquirer's true|string contract so a
 // reserved word re-prompts inline instead of aborting the whole command.
 function notKeyword(value, role) {
@@ -78,29 +86,101 @@ async function promptLookupField() {
     });
     return field.trim();
 }
-// The three `generate module` decisions that exist as flags (--full, --auth,
-// --permission). They live here next to the other generate prompts so the
-// subcommand and the bare-menu path can ask them the same way — a choice only
-// reachable by knowing the flag name isn't a choice for anyone driving this
-// from the menu.
-async function promptModuleShape() {
+// The `generate module` choices live here next to the other generate prompts so
+// the subcommand, bare menu, and project config wizard ask them consistently —
+// a choice only reachable by knowing a flag name is not a choice for someone
+// driving the CLI interactively.
+async function promptModuleSurface(defaultValue = "minimal") {
     return (0, interactive_1.select)({
         message: "What should the module contain?",
-        default: false,
+        default: defaultValue,
         choices: [
             {
                 name: "Minimal — model + wiring only",
-                value: false,
+                value: "minimal",
                 description: "the safe default; add endpoints one at a time with `generate method`",
             },
             {
                 name: "CRUD skeleton — list/get/create/update/delete",
-                value: true,
+                value: "crud",
                 description: "all five endpoints wired up; DTO fields and business rules are left as TODO",
             },
         ],
     });
 }
+async function promptApplicationStyle(defaultValue = "service") {
+    return (0, interactive_1.select)({
+        message: "How should the application boundary be organised?",
+        default: defaultValue,
+        choices: [
+            {
+                name: "Single service",
+                value: "service",
+                description: "the simpler path; use this unless reads and writes have different business needs",
+            },
+            {
+                name: "CQRS command/query handlers",
+                value: "cqrs",
+                description: "separate state-changing commands from read-only queries; storage remains shared by default",
+            },
+        ],
+    });
+}
+/**
+ * Ask for the useful decision first. The underlying surface/application
+ * choices remain available through Advanced and through the CLI flags, but a
+ * new user should not have to understand two architecture axes before making
+ * a sensible choice.
+ */
+async function promptModuleProfile(defaultValue = "lean") {
+    return (0, interactive_1.select)({
+        message: "Choose a module profile:",
+        default: defaultValue,
+        choices: [
+            {
+                name: "Lean — minimal + single service",
+                value: "lean",
+                description: "model, repository, service and handler wiring; add only the endpoints this domain needs",
+            },
+            {
+                name: "CRUD — CRUD surface + single service",
+                value: "crud",
+                description: "list/get/create/update/delete skeletons; fields and business rules remain TODOs",
+            },
+            {
+                name: "CQRS — minimal surface + command/query handlers",
+                value: "cqrs",
+                description: "separate state-changing commands from read-only queries; no broker or second database is added",
+            },
+            {
+                name: "Advanced — choose surface and application boundary",
+                value: "advanced",
+                description: "for the uncommon CRUD + CQRS combination or a deliberately customised module",
+            },
+        ],
+    });
+}
+async function promptAdvancedModuleArchitecture(defaultSurface = "minimal", defaultApplicationStyle = "service") {
+    return {
+        moduleSurface: await promptModuleSurface(defaultSurface),
+        applicationStyle: await promptApplicationStyle(defaultApplicationStyle),
+    };
+}
+function moduleArchitectureForProfile(profile) {
+    return (0, module_profile_1.architectureForModuleProfile)(profile);
+}
+function moduleProfileDescription(moduleSurface, applicationStyle) {
+    return (0, module_profile_1.describeModuleProfile)((0, module_profile_1.moduleProfileFor)(moduleSurface, applicationStyle));
+}
+// Backward-compatible boolean helpers for the existing generate-module flow.
+// The richer enum prompts are also used by the project config wizard so one
+// set of choices describes both the default and the per-module override.
+async function promptModuleShape(defaultValue = false) {
+    return (await promptModuleSurface(defaultValue ? "crud" : "minimal")) === "crud";
+}
+async function promptModuleCqrs(defaultValue = false) {
+    return (await promptApplicationStyle(defaultValue ? "cqrs" : "service")) === "cqrs";
+}
 async function promptModuleAuth() {
     return (0, interactive_1.confirm)({
         message: "Require a valid access token for this module's routes?",

package/dist/templates/auth-manifest.js

@@ -8,27 +8,57 @@ const SHARED = [
     { template: "add/auth/internal/app/user/model/user.go.hbs", output: "internal/app/user/model/user.go" },
     { template: "add/auth/internal/app/user/model/identity.go.hbs", output: "internal/app/user/model/identity.go" },
     { template: "add/auth/internal/app/user/model/loginthrottle.go.hbs", output: "internal/app/user/model/loginthrottle.go" },
+    { template: "add/auth/internal/app/user/model/authtoken.go.hbs", output: "internal/app/user/model/authtoken.go" },
+    { template: "add/auth/internal/app/user/model/mfa_enrollment.go.hbs", output: "internal/app/user/model/mfa_enrollment.go" },
+    { template: "add/auth/internal/app/user/model/mfa_challenge.go.hbs", output: "internal/app/user/model/mfa_challenge.go" },
+    { template: "add/auth/internal/app/user/model/mfa_recovery_code.go.hbs", output: "internal/app/user/model/mfa_recovery_code.go" },
+    { template: "add/auth/internal/app/user/application/recovery.go.hbs", output: "internal/app/user/application/recovery.go" },
+    { template: "add/auth/internal/app/user/application/oauth.go.hbs", output: "internal/app/user/application/oauth.go" },
+    { template: "add/auth/internal/app/user/contracts.go.hbs", output: "internal/app/user/contracts.go" },
+    { template: "add/auth/internal/app/user/composition.go.hbs", output: "internal/app/user/composition.go" },
+    { template: "add/auth/internal/app/user/provider_test.go.hbs", output: "internal/app/user/provider_test.go" },
+    { template: "add/auth/internal/app/user/handler_test.go.hbs", output: "internal/app/user/handler_test.go" },
+    { template: "add/auth/internal/app/user/tokenstore_recovery.go.hbs", output: "internal/app/user/tokenstore_recovery.go" },
     { template: "add/auth/internal/app/user/dto.go.hbs", output: "internal/app/user/dto.go" },
     { template: "add/auth/internal/app/user/errors.go.hbs", output: "internal/app/user/errors.go" },
     { template: "add/auth/internal/app/user/jwt.go.hbs", output: "internal/app/user/jwt.go" },
     { template: "add/auth/internal/app/user/tokenstore.go.hbs", output: "internal/app/user/tokenstore.go" },
+    { template: "add/auth/internal/app/user/mfa_store.go.hbs", output: "internal/app/user/mfa_store.go" },
+    { template: "add/auth/internal/app/user/mfa_store_test.go.hbs", output: "internal/app/user/mfa_store_test.go" },
+    { template: "add/auth/internal/app/user/mfa_service.go.hbs", output: "internal/app/user/mfa_service.go" },
+    { template: "add/auth/internal/app/user/mfa_service_test.go.hbs", output: "internal/app/user/mfa_service_test.go" },
     { template: "add/auth/internal/app/user/repository.go.hbs", output: "internal/app/user/repository.go" },
     { template: "add/auth/internal/app/user/service.go.hbs", output: "internal/app/user/service.go" },
+    { template: "add/auth/internal/app/user/local_auth.go.hbs", output: "internal/app/user/local_auth.go" },
+    { template: "add/auth/internal/app/user/sessions.go.hbs", output: "internal/app/user/sessions.go" },
+    { template: "add/auth/internal/app/user/recovery_service.go.hbs", output: "internal/app/user/recovery_service.go" },
+    { template: "add/auth/internal/app/user/external_login.go.hbs", output: "internal/app/user/external_login.go" },
+    { template: "add/auth/internal/app/user/user_query.go.hbs", output: "internal/app/user/user_query.go" },
     { template: "add/auth/internal/app/user/service_test.go.hbs", output: "internal/app/user/service_test.go" },
     { template: "add/auth/internal/app/user/repository_test.go.hbs", output: "internal/app/user/repository_test.go" },
     { template: "add/auth/internal/app/user/handler.go.hbs", output: "internal/app/user/handler.go" },
+    { template: "add/auth/internal/app/user/handler_local.go.hbs", output: "internal/app/user/handler_local.go" },
+    { template: "add/auth/internal/app/user/handler_recovery.go.hbs", output: "internal/app/user/handler_recovery.go" },
+    { template: "add/auth/internal/app/user/handler_oauth.go.hbs", output: "internal/app/user/handler_oauth.go" },
+    { template: "add/auth/internal/app/user/handler_user.go.hbs", output: "internal/app/user/handler_user.go" },
+    { template: "add/auth/internal/app/user/handler_mfa.go.hbs", output: "internal/app/user/handler_mfa.go" },
+    { template: "add/auth/internal/app/user/session_cookie.go.hbs", output: "internal/app/user/session_cookie.go" },
+    { template: "add/auth/internal/app/user/browser_policy.go.hbs", output: "internal/app/user/browser_policy.go" },
+    { template: "add/auth/internal/platform/authprovider/google/google.go.hbs", output: "internal/platform/authprovider/google/google.go" },
+    { template: "add/auth/internal/platform/authprovider/google/google_test.go.hbs", output: "internal/platform/authprovider/google/google_test.go" },
     { template: "add/auth/cmd/seed/main.go.hbs", output: "cmd/seed/main.go" },
 ];
 // Only the chosen store's implementation is written. Shipping both would drag
 // go-redis into every project's go.mod for a file it never constructs — the
 // same reason `add worker` writes one queue adapter, not two.
 const POSTGRES = [
-    { template: "add/auth/internal/app/user/model/authtoken.go.hbs", output: "internal/app/user/model/authtoken.go" },
     { template: "add/auth/internal/app/user/tokenstore_pg.go.hbs", output: "internal/app/user/tokenstore_pg.go" },
+    { template: "add/auth/internal/app/user/tokenstore_pg_test.go.hbs", output: "internal/app/user/tokenstore_pg_test.go" },
     { template: "add/auth/internal/shared/middleware/ratelimit_memory.go.hbs", output: "internal/shared/middleware/ratelimit_memory.go" },
 ];
 const REDIS = [
     { template: "add/auth/internal/app/user/tokenstore_redis.go.hbs", output: "internal/app/user/tokenstore_redis.go" },
+    { template: "add/auth/internal/app/user/tokenstore_redis_test.go.hbs", output: "internal/app/user/tokenstore_redis_test.go" },
     { template: "add/auth/internal/shared/middleware/ratelimit_redis.go.hbs", output: "internal/shared/middleware/ratelimit_redis.go" },
 ];
 function authFiles(store) {

package/dist/templates/create-manifest.js

@@ -57,6 +57,10 @@ exports.CREATE_MANIFEST = [
         template: "create/base/internal/shared/middleware/cors.go.hbs",
         output: "internal/shared/middleware/cors.go",
     },
+    {
+        template: "create/base/internal/shared/middleware/cors_test.go.hbs",
+        output: "internal/shared/middleware/cors_test.go",
+    },
     {
         template: "create/base/internal/shared/middleware/error.go.hbs",
         output: "internal/shared/middleware/error.go",

package/dist/templates/module-manifest.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MODULE_FILES_MINIMAL = exports.MODULE_FILES = void 0;
+exports.MODULE_FILES_MINIMAL_CQRS = exports.MODULE_FILES_MINIMAL = exports.MODULE_FILES_CQRS = exports.MODULE_FILES = void 0;
 // output paths are relative to the module's own directory
 // (internal/app/<pkg> or internal/app/v<version>/<pkg>)
 exports.MODULE_FILES = [
@@ -9,11 +9,31 @@ exports.MODULE_FILES = [
     { template: "generate/module/errors.go.hbs", output: "errors.go" },
     { template: "generate/module/repository.go.hbs", output: "repository.go" },
     { template: "generate/module/service.go.hbs", output: "service.go" },
+    { template: "generate/module/composition.go.hbs", output: "composition.go" },
     { template: "generate/module/handler.go.hbs", output: "handler.go" },
     { template: "generate/module/service_test.go.hbs", output: "service_test.go" },
     { template: "generate/module/handler_test.go.hbs", output: "handler_test.go" },
     { template: "generate/module/repository_test.go.hbs", output: "repository_test.go" },
 ];
+// CQRS is opt-in so a simple CRUD module does not pay for command/query
+// ceremony. The implementation files are still in the feature package, which
+// keeps the module easy to adopt incrementally and lets `generate method` patch
+// the correct side later.
+exports.MODULE_FILES_CQRS = [
+    { template: "generate/module/model/model.go.hbs", output: "model/model.go" },
+    { template: "generate/module/dto.go.hbs", output: "dto.go" },
+    { template: "generate/module/errors.go.hbs", output: "errors.go" },
+    { template: "generate/module/repository.go.hbs", output: "repository.go" },
+    { template: "generate/module/commands.go.hbs", output: "commands.go" },
+    { template: "generate/module/queries.go.hbs", output: "queries.go" },
+    { template: "generate/module/service.go.hbs", output: "service.go" },
+    { template: "generate/module/composition.go.hbs", output: "composition.go" },
+    { template: "generate/module/handler.go.hbs", output: "handler.go" },
+    { template: "generate/module/service_test.go.hbs", output: "service_test.go" },
+    { template: "generate/module/handler_test.go.hbs", output: "handler_test.go" },
+    { template: "generate/module/repository_test.go.hbs", output: "repository_test.go" },
+    { template: "generate/module/cqrs_test.go.hbs", output: "cqrs_test.go" },
+];
 // minimal: same model/errors/repository (generate method's patches assume the
 // full data-access surface exists), but no default CRUD in dto/service/handler
 // — add endpoints one at a time with `generate method`.
@@ -23,8 +43,24 @@ exports.MODULE_FILES_MINIMAL = [
     { template: "generate/module/errors.go.hbs", output: "errors.go" },
     { template: "generate/module/repository.go.hbs", output: "repository.go" },
     { template: "generate/module/minimal/service.go.hbs", output: "service.go" },
+    { template: "generate/module/composition.go.hbs", output: "composition.go" },
+    { template: "generate/module/minimal/handler.go.hbs", output: "handler.go" },
+    { template: "generate/module/minimal/service_test.go.hbs", output: "service_test.go" },
+    { template: "generate/module/minimal/handler_test.go.hbs", output: "handler_test.go" },
+    { template: "generate/module/repository_test.go.hbs", output: "repository_test.go" },
+];
+exports.MODULE_FILES_MINIMAL_CQRS = [
+    { template: "generate/module/model/model.go.hbs", output: "model/model.go" },
+    { template: "generate/module/minimal/dto.go.hbs", output: "dto.go" },
+    { template: "generate/module/errors.go.hbs", output: "errors.go" },
+    { template: "generate/module/repository.go.hbs", output: "repository.go" },
+    { template: "generate/module/minimal/commands.go.hbs", output: "commands.go" },
+    { template: "generate/module/minimal/queries.go.hbs", output: "queries.go" },
+    { template: "generate/module/minimal/service.go.hbs", output: "service.go" },
+    { template: "generate/module/composition.go.hbs", output: "composition.go" },
     { template: "generate/module/minimal/handler.go.hbs", output: "handler.go" },
     { template: "generate/module/minimal/service_test.go.hbs", output: "service_test.go" },
     { template: "generate/module/minimal/handler_test.go.hbs", output: "handler_test.go" },
     { template: "generate/module/repository_test.go.hbs", output: "repository_test.go" },
+    { template: "generate/module/cqrs_test.go.hbs", output: "cqrs_test.go" },
 ];

package/dist/templates/rbac-manifest.js

@@ -12,6 +12,7 @@ exports.RBAC_FILES = [
     { template: "add/rbac/internal/app/role/service.go.hbs", output: "internal/app/role/service.go" },
     { template: "add/rbac/internal/app/role/service_test.go.hbs", output: "internal/app/role/service_test.go" },
     { template: "add/rbac/internal/app/role/repository_test.go.hbs", output: "internal/app/role/repository_test.go" },
+    { template: "add/rbac/internal/app/role/composition.go.hbs", output: "internal/app/role/composition.go" },
     { template: "add/rbac/internal/app/role/handler.go.hbs", output: "internal/app/role/handler.go" },
     { template: "add/rbac/internal/app/role/dto.go.hbs", output: "internal/app/role/dto.go" },
     { template: "add/rbac/internal/app/role/errors.go.hbs", output: "internal/app/role/errors.go" },

package/dist/types.js

@@ -1,2 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_ARCHITECTURE_CONFIG = void 0;
+exports.DEFAULT_ARCHITECTURE_CONFIG = {
+    style: "modular-monolith",
+    defaultModuleSurface: "minimal",
+    defaultApplicationStyle: "service",
+};

package/dist/utils/auth-patcher.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.patchConfigForAuth = patchConfigForAuth;
 exports.authWiringLines = authWiringLines;
+exports.authHandlerLineFor = authHandlerLineFor;
 exports.patchMainGoForAuth = patchMainGoForAuth;
 exports.upgradeMailerToQueue = upgradeMailerToQueue;
 const fs_extra_1 = __importDefault(require("fs-extra"));
@@ -17,8 +18,7 @@ const PLATFORM_INIT_MARKER = "// go-scaffold:platform-init";
 const SCHEMA_MARKER = "// go-scaffold:schemas";
 const MODEL_MARKER = "// go-scaffold:models";
 const ROUTE_MARKER = "// go-scaffold:routes";
-const SHUTDOWN_MARKER = "// go-scaffold:shutdown";
-// patchConfigForAuth adds JWT/cookie/password-reset/Google OAuth fields to
+// patchConfigForAuth adds JWT/cookie/password-reset/browser OAuth fields to
 // Config, the same marker-based text insertion patchConfigForWorker uses
 // (config.go.hbs is only rendered once, at `create` — everything after that
 // is a real file a human may have already edited).
@@ -28,8 +28,11 @@ function patchConfigForAuth(configGoPath) {
         "JWTSecret string",
         "JWTAccessTTL time.Duration",
         "JWTRefreshTTL time.Duration",
+        "JWTRefreshMaxTTL time.Duration",
+        "OAuthStateTTL time.Duration",
         "CookieSecure bool",
         "CookieSameSite string",
+        "AuthBrowserTopology string",
         "",
         "PasswordResetTTL time.Duration",
         "PasswordResetURL string",
@@ -39,15 +42,25 @@ function patchConfigForAuth(configGoPath) {
         "",
         "GoogleClientID string",
         "GoogleClientSecret string",
-        "GoogleRedirectURL string",
+        "GoogleOAuthRedirectURI string",
+        "",
+        "AuthMFAEnabled bool",
+        "MFAIssuer string",
+        "MFAEncryptionKey string",
+        "MFAChallengeTTL time.Duration",
+        "MFATOTPWindow int",
+        "MFARecoveryCodeCount int",
     ].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_FIELDS_MARKER, fieldsBlock, "JWTSecret");
     const loadBlock = [
         'JWTSecret:     env("JWT_SECRET", "dev-secret-change-me"),',
         'JWTAccessTTL:  time.Duration(envInt("JWT_ACCESS_TTL_MIN", 15)) * time.Minute,',
         'JWTRefreshTTL: time.Duration(envInt("JWT_REFRESH_TTL_MIN", 43200)) * time.Minute,',
+        'JWTRefreshMaxTTL: time.Duration(envInt("JWT_REFRESH_MAX_TTL_MIN", 43200)) * time.Minute,',
+        'OAuthStateTTL: time.Duration(envInt("OAUTH_STATE_TTL_MIN", 10)) * time.Minute,',
         'CookieSecure:  env("COOKIE_SECURE", "false") == "true",',
         'CookieSameSite: env("COOKIE_SAMESITE", "strict"),',
+        'AuthBrowserTopology:    env("AUTH_BROWSER_TOPOLOGY", "same-site"),',
         "",
         'PasswordResetTTL: time.Duration(envInt("PASSWORD_RESET_TTL_MIN", 30)) * time.Minute,',
         'PasswordResetURL: env("PASSWORD_RESET_URL", "http://localhost:3000/reset-password"),',
@@ -57,7 +70,14 @@ function patchConfigForAuth(configGoPath) {
         "",
         'GoogleClientID:     env("GOOGLE_CLIENT_ID", ""),',
         'GoogleClientSecret: env("GOOGLE_CLIENT_SECRET", ""),',
-        'GoogleRedirectURL:  env("GOOGLE_REDIRECT_URL", ""),',
+        'GoogleOAuthRedirectURI: env("GOOGLE_OAUTH_REDIRECT_URI", ""),',
+        "",
+        'AuthMFAEnabled: env("AUTH_MFA_ENABLED", "false") == "true",',
+        'MFAIssuer: env("MFA_ISSUER", "go-scaffold"),',
+        'MFAEncryptionKey: env("MFA_ENCRYPTION_KEY", ""),',
+        'MFAChallengeTTL: time.Duration(envInt("MFA_CHALLENGE_TTL_MIN", 5)) * time.Minute,',
+        'MFATOTPWindow: envInt("MFA_TOTP_WINDOW", 1),',
+        'MFARecoveryCodeCount: envInt("MFA_RECOVERY_CODE_COUNT", 10),',
     ].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_LOAD_MARKER, loadBlock, 'env("JWT_SECRET"');
     fs_extra_1.default.writeFileSync(configGoPath, content);
@@ -68,13 +88,25 @@ function patchConfigForAuth(configGoPath) {
 function authWiringLines(w) {
     const postgres = w.store === "postgres";
     return {
-        tokenStore: postgres ? "user.NewPgTokenStore(db)" : "user.NewRedisTokenStore(rdb)",
+        tokenStore: postgres ? "user.NewPgTokenStore(db)" : "user.NewRedisTokenStore(rdb, db)",
         limiter: postgres ? "middleware.NewMemoryLimiter()" : "middleware.NewRedisLimiter(rdb)",
         // with a queue the mail is enqueued and the request returns immediately;
         // without one it goes out inline, which is the cost of not running a worker
         mailer: w.worker ? "mail.NewAsyncClient(q)" : "mail.NewSyncClient(mail.Open(cfg))",
     };
 }
+// authHandlerLineFor is the one root-level auth route shape. The feature owns
+// construction; wiring.go only hands it shared infrastructure and, when RBAC
+// is present, the role feature's public capabilities.
+function authHandlerLineFor(w, roleDependencies = ["nil", "nil"]) {
+    const args = ["db", "cfg"];
+    if (w.store === "redis")
+        args.push("rdb");
+    if (w.worker)
+        args.push("q");
+    args.push(...roleDependencies);
+    return `user.NewHandlerFromDB(${args.join(", ")}).Register(api)`;
+}
 function patchMainGoForAuth(mainGoPath, w) {
     const { goModule, queueBackend, store } = w;
     let content = fs_extra_1.default.readFileSync(mainGoPath, "utf8");
@@ -86,8 +118,6 @@ function patchMainGoForAuth(mainGoPath, w) {
         const queueImportLine = `"${goModule}/internal/platform/queue"`;
         content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, queueImportLine, queueImportLine);
     }
-    const mailImportLine = `"${goModule}/internal/platform/mail"`;
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, mailImportLine, mailImportLine);
     const checkBlock = [
         'if cfg.IsProd() && cfg.JWTSecret == "dev-secret-change-me" {',
         '\treturn errors.New("JWT_SECRET is still the dev default — set a real secret before deploying with APP_ENV=production")',
@@ -105,6 +135,21 @@ function patchMainGoForAuth(mainGoPath, w) {
         "}",
     ].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_CHECKS_MARKER, smtpCheckBlock, "SMTP_HOST is unset");
+    const mfaCheckBlock = [
+        "if cfg.AuthMFAEnabled {",
+        "\tif err := user.ValidateMFASettings(user.MFASettings{",
+        "\t\tEnabled: cfg.AuthMFAEnabled,",
+        "\t\tIssuer: cfg.MFAIssuer,",
+        "\t\tEncryptionKey: cfg.MFAEncryptionKey,",
+        "\t\tChallengeTTL: cfg.MFAChallengeTTL,",
+        "\t\tTOTPWindow: cfg.MFATOTPWindow,",
+        "\t\tRecoveryCodeCount: cfg.MFARecoveryCodeCount,",
+        "\t}); err != nil {",
+        "\t\treturn fmt.Errorf(\"invalid MFA configuration: %w\", err)",
+        "\t}",
+        "}",
+    ].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_CHECKS_MARKER, mfaCheckBlock, "invalid MFA configuration");
     // The enqueuer is built from whatever backend `add worker` chose — the
     // constructor differs, everything downstream of it (mail.NewAsyncClient)
     // only sees the queue.Enqueuer interface and doesn't change.
@@ -120,24 +165,27 @@ function patchMainGoForAuth(mainGoPath, w) {
     ].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, SCHEMA_MARKER, schemaBlock, "CREATE SCHEMA IF NOT EXISTS user_svc");
     const migrateLines = ["&usermodel.User{},", "&usermodel.Identity{},", "&usermodel.LoginThrottle{},"];
-    // only the Postgres store has a table for AutoMigrate to create
-    if (store === "postgres")
-        migrateLines.push("&usermodel.AuthToken{},");
+    // Recovery tokens are always durable in Postgres, even when refresh tokens
+    // live in Redis, so reset/verification can share the user transaction.
+    migrateLines.push("&usermodel.AuthToken{},");
+    migrateLines.push("&usermodel.MFAEnrollment{},", "&usermodel.MFAChallenge{},", "&usermodel.MFARecoveryCode{},");
     for (const line of migrateLines) {
         content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, MODEL_MARKER, line, line);
     }
-    // same two-line shape every generated module uses: a named service, then
-    // the handler that registers it. `add rbac` extends both lines later, and a
-    // human wiring another domain into user's service edits line one in place.
-    const { tokenStore, limiter, mailer } = authWiringLines(w);
-    const svcLine = `userSvc := user.NewService(user.NewRepository(db), ${tokenStore}, ${mailer}, cfg)`;
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, ROUTE_MARKER, svcLine, "userSvc :=");
-    const routeLine = `user.NewHandler(userSvc, cfg.JWTSecret, cfg.JWTRefreshTTL, cfg.CookieSecure, cfg.CookieSameSite, ${limiter}).Register(api)`;
+    // Keep auth construction inside the feature package. The root only chooses
+    // shared infrastructure and registers the resulting handler.
+    const routeLine = authHandlerLineFor(w);
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, ROUTE_MARKER, routeLine, routeLine);
     content = content.replace(/\n\t_ = api \/\/ dropped once `generate module` registers the first route\n/, "\n");
     if (w.worker) {
-        const shutdownBlock = ["if err := q.Close(); err != nil {", '\tlogger.Error("close queue", "error", err)', "}"].join("\n");
-        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, SHUTDOWN_MARKER, shutdownBlock, "if err := q.Close()");
+        const cleanupBlock = [
+            "defer func() {",
+            '\tif err := q.Close(); err != nil {',
+            '\t\tlogger.Error("close queue", "error", err)',
+            "\t}",
+            "}()",
+        ].join("\n");
+        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, cleanupBlock, "defer func() {\n\tif err := q.Close()");
     }
     fs_extra_1.default.writeFileSync(mainGoPath, content);
 }
@@ -153,19 +201,62 @@ function patchMainGoForAuth(mainGoPath, w) {
 // at all — both simply don't contain the line it looks for. Returns whether
 // it actually upgraded something, so the caller's printed summary can say
 // which happened instead of always assuming "no auth yet".
-function upgradeMailerToQueue(mainGoPath, goModule, queueBackend) {
+function upgradeMailerToQueue(mainGoPath, goModule, queueBackend, compositionGoPath) {
     let content = fs_extra_1.default.readFileSync(mainGoPath, "utf8");
     const syncMailer = "mail.NewSyncClient(mail.Open(cfg))";
-    if (!content.includes(syncMailer))
+    let upgradedComposition = false;
+    // Auth now keeps mailer construction in internal/app/user. A worker added
+    // later must upgrade that feature-local composition and thread q into the
+    // existing root registration, rather than moving construction back to the
+    // composition root.
+    if (compositionGoPath && fs_extra_1.default.existsSync(compositionGoPath)) {
+        let composition = fs_extra_1.default.readFileSync(compositionGoPath, "utf8");
+        if (composition.includes(syncMailer)) {
+            composition = (0, marker_patch_1.ensureImport)(composition, `${goModule}/internal/platform/queue`);
+            if (!composition.includes("q queue.Enqueuer")) {
+                const configParam = "\tcfg config.Config,\n";
+                const redisParam = "\trdb *redis.Client,\n";
+                const queueAnchor = composition.includes(redisParam) ? redisParam : configParam;
+                if (!composition.includes(queueAnchor)) {
+                    throw new Error(`${compositionGoPath} is missing the cfg parameter needed to upgrade auth mail to a queue`);
+                }
+                composition = composition.replace(queueAnchor, `${queueAnchor}\tq queue.Enqueuer,\n`);
+            }
+            composition = composition.replace(syncMailer, "mail.NewAsyncClient(q)");
+            fs_extra_1.default.writeFileSync(compositionGoPath, composition);
+            upgradedComposition = true;
+            const routeMatch = content.match(/user\.NewHandlerFromDB\(db, cfg, ([^)]*)\)\.Register\(api\)/);
+            if (!routeMatch) {
+                throw new Error("cmd/api/wiring.go is missing auth's feature-local NewHandlerFromDB route while adding the worker");
+            }
+            const args = routeMatch[1].split(",").map((arg) => arg.trim());
+            if (!args.includes("q")) {
+                if (args.length < 2)
+                    throw new Error("auth's NewHandlerFromDB route has no role/authz dependency slots");
+                args.splice(args.length - 2, 0, "q");
+                content = content.replace(routeMatch[0], `user.NewHandlerFromDB(db, cfg, ${args.join(", ")}).Register(api)`);
+            }
+        }
+    }
+    // Keep the fallback for projects scaffolded before feature-local auth
+    // composition existed. New projects take the branch above.
+    if (!upgradedComposition && !content.includes(syncMailer))
         return false;
     const queueImportLine = `"${goModule}/internal/platform/queue"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, queueImportLine, queueImportLine);
     const queueCtor = queueBackend === "river" ? "queue.NewRiverEnqueuer(db)" : "queue.NewAsynqEnqueuer(cfg.RedisURL)";
     const queueInitBlock = [`q, err := ${queueCtor}`, "if err != nil {", '\treturn fmt.Errorf("open queue: %w", err)', "}"].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, queueInitBlock, "q, err := queue.New");
-    const shutdownBlock = ["if err := q.Close(); err != nil {", '\tlogger.Error("close queue", "error", err)', "}"].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, SHUTDOWN_MARKER, shutdownBlock, "if err := q.Close()");
-    content = content.replace(syncMailer, () => "mail.NewAsyncClient(q)");
+    const cleanupBlock = [
+        "defer func() {",
+        '\tif err := q.Close(); err != nil {',
+        '\t\tlogger.Error("close queue", "error", err)',
+        "\t}",
+        "}()",
+    ].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, cleanupBlock, "defer func() {\n\tif err := q.Close()");
+    if (!upgradedComposition)
+        content = content.replace(syncMailer, () => "mail.NewAsyncClient(q)");
     fs_extra_1.default.writeFileSync(mainGoPath, content);
     return true;
 }