najm-auth 2.0.14 → 3.0.0

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // src/AuthPlugin.ts
-import { Err as Err13, plugin } from "najm-core";
+import { Err as Err15, plugin } from "najm-core";
 import { cache } from "najm-cache";
 
 // src/auth.tokens.ts
@@ -102,6 +102,17 @@ var credentialSetupSessionsTable = pgTable("credential_setup_sessions", {
   userPurposeIdx: index("credential_setup_sessions_user_purpose_idx").on(table.userId, table.purpose),
   expiresAtIdx: index("credential_setup_sessions_expires_at_idx").on(table.expiresAt)
 }));
+var credentialSetupRequirementsTable = pgTable("credential_setup_requirements", {
+  userId: text("user_id").references(() => usersTable.id, { onDelete: "cascade" }).notNull(),
+  purpose: text("purpose").notNull(),
+  temporaryCredentialKind: text("temporary_credential_kind"),
+  required: boolean("required").default(true).notNull(),
+  completedAt: timestamp("completed_at", { mode: "string" }),
+  createdAt: timestamp("created_at", { mode: "string" }).defaultNow(),
+  updatedAt: timestamp("updated_at", { mode: "string" }).defaultNow().$onUpdate(() => sql`CURRENT_TIMESTAMP`)
+}, (table) => ({
+  pk: primaryKey({ columns: [table.userId, table.purpose] })
+}));
 var rolePermissionsTable = pgTable("role_permissions", {
   roleId: text("role_id").notNull().references(() => rolesTable.id, { onDelete: "cascade" }),
   permissionId: text("permission_id").notNull().references(() => permissionsTable.id, { onDelete: "cascade" }),
@@ -114,13 +125,14 @@ var authSchema = {
   oauthAccounts: oauthAccountsTable,
   tokens: tokensTable,
   credentialSetupSessions: credentialSetupSessionsTable,
+  credentialSetupRequirements: credentialSetupRequirementsTable,
   roles: rolesTable,
   permissions: permissionsTable,
   rolePermissions: rolePermissionsTable
 };
 
 // src/schema/sqlite.ts
-import { sqliteTable, text as text2, integer as integer2, uniqueIndex as uniqueIndex2, index as index2 } from "drizzle-orm/sqlite-core";
+import { sqliteTable, text as text2, integer as integer2, primaryKey as primaryKey2, uniqueIndex as uniqueIndex2, index as index2 } from "drizzle-orm/sqlite-core";
 import { sql as sql2 } from "drizzle-orm";
 import { nanoid as nanoid2 } from "nanoid";
 var baseFields2 = /* @__PURE__ */ __name((idLength = 5) => ({
@@ -194,6 +206,17 @@ var credentialSetupSessionsTable2 = sqliteTable("credential_setup_sessions", {
   userPurposeIdx: index2("credential_setup_sessions_user_purpose_idx").on(table.userId, table.purpose),
   expiresAtIdx: index2("credential_setup_sessions_expires_at_idx").on(table.expiresAt)
 }));
+var credentialSetupRequirementsTable2 = sqliteTable("credential_setup_requirements", {
+  userId: text2("user_id").references(() => usersTable2.id, { onDelete: "cascade" }).notNull(),
+  purpose: text2("purpose").notNull(),
+  temporaryCredentialKind: text2("temporary_credential_kind"),
+  required: integer2("required", { mode: "boolean" }).default(true).notNull(),
+  completedAt: text2("completed_at"),
+  createdAt: text2("created_at").$defaultFn(() => (/* @__PURE__ */ new Date()).toISOString()),
+  updatedAt: text2("updated_at").$defaultFn(() => (/* @__PURE__ */ new Date()).toISOString()).$onUpdate(() => sql2`(datetime('now'))`)
+}, (table) => ({
+  pk: primaryKey2({ columns: [table.userId, table.purpose] })
+}));
 var rolePermissionsTable2 = sqliteTable("role_permissions", {
   ...baseFields2(10),
   roleId: text2("role_id").notNull().references(() => rolesTable2.id, { onDelete: "cascade" }),
@@ -206,6 +229,7 @@ var authSchema2 = {
   oauthAccounts: oauthAccountsTable2,
   tokens: tokensTable2,
   credentialSetupSessions: credentialSetupSessionsTable2,
+  credentialSetupRequirements: credentialSetupRequirementsTable2,
   roles: rolesTable2,
   permissions: permissionsTable2,
   rolePermissions: rolePermissionsTable2
@@ -457,14 +481,15 @@ CookieManager = __decorate2([
 ], CookieManager);
 
 // src/auth/AuthController.ts
-import { Controller, Err as Err9 } from "najm-core";
+import { Controller, Err as Err13 } from "najm-core";
 import { Get, Post, ResMsg } from "najm-core";
 import { Body, User as User2, Headers, Ctx } from "najm-core";
 
 // src/auth/AuthService.ts
-import { Injectable as Injectable8, Inject as Inject8 } from "najm-core";
-import { Err as Err8, Log } from "najm-core";
-import { I18n as I18n6, I18nService as I18nService2 } from "najm-i18n";
+import { Injectable as Injectable11, Inject as Inject11 } from "najm-core";
+import { Err as Err12, Log } from "najm-core";
+import { Transaction as Transaction4 } from "najm-database";
+import { I18n as I18n8, I18nService as I18nService2 } from "najm-i18n";
 import { EmailService, passwordResetTemplate, accountInviteTemplate } from "najm-email";
 import { nanoid as nanoid5 } from "nanoid";
 
@@ -745,6 +770,17 @@ var UserValidator = class UserValidator2 {
       Err(this.t("errors.emailExists"), 409);
     }
   }
+  /**
+   * Check that a normalized phone number is not already taken.
+   */
+  async checkPhoneUnique(phone, excludeId) {
+    if (!phone)
+      return;
+    const existingUser = await this.userRepository.findByPhone(phone);
+    if (existingUser && existingUser.id !== excludeId) {
+      Err(this.t("errors.phoneExists"), 409);
+    }
+  }
   /**
    * Check if user exists by ID
    */
@@ -827,6 +863,7 @@ var UserValidator = class UserValidator2 {
     if (!password) {
       Err("Password is required", 400);
     }
+    this.validatePasswordLength(password);
     const minLength = 8;
     const hasUppercase = /[A-Z]/.test(password);
     const hasLowercase = /[a-z]/.test(password);
@@ -844,6 +881,12 @@ var UserValidator = class UserValidator2 {
       Err("Password must contain at least one number", 400);
     }
   }
+  /** Keep every byte passed to bcrypt significant. */
+  validatePasswordLength(password) {
+    if (new TextEncoder().encode(password).length > 72) {
+      Err("Password must be at most 72 bytes", 400);
+    }
+  }
 };
 __decorate4([
   I18n("users"),
@@ -1185,6 +1228,110 @@ var isEmpty = _isEmpty;
 var isPath = /* @__PURE__ */ __name((img) => typeof img === "string" && img.trim().length > 0 && (img.startsWith("/") || img.startsWith("http") || img.startsWith("storage/")), "isPath");
 var isFile = /* @__PURE__ */ __name((img) => !!img && typeof img !== "string" && img instanceof File, "isFile");
 
+// src/identity/presets.ts
+var compactPhone = /* @__PURE__ */ __name((value) => value.trim().replace(/[\s().-]+/g, ""), "compactPhone");
+var MOROCCO_LOCAL = /^0\d{9}$/;
+var MOROCCO_NATIONAL = /^212\d{9}$/;
+var MOROCCO_E164 = /^\+212\d{9}$/;
+var normalizeMoroccanPhone = /* @__PURE__ */ __name((value) => {
+  const compact = compactPhone(value);
+  if (MOROCCO_LOCAL.test(compact))
+    return `+212${compact.slice(1)}`;
+  if (MOROCCO_NATIONAL.test(compact))
+    return `+${compact}`;
+  if (MOROCCO_E164.test(compact))
+    return compact;
+  return null;
+}, "normalizeMoroccanPhone");
+var moroccoIdentityPreset = {
+  name: "ma",
+  normalize: normalizeMoroccanPhone
+};
+var TUNISIA_LOCAL = /^\d{8}$/;
+var TUNISIA_NATIONAL = /^216\d{8}$/;
+var TUNISIA_E164 = /^\+216\d{8}$/;
+var normalizeTunisianPhone = /* @__PURE__ */ __name((value) => {
+  const compact = compactPhone(value);
+  if (TUNISIA_LOCAL.test(compact))
+    return `+216${compact}`;
+  if (TUNISIA_NATIONAL.test(compact))
+    return `+${compact}`;
+  if (TUNISIA_E164.test(compact))
+    return compact;
+  return null;
+}, "normalizeTunisianPhone");
+var tunisiaIdentityPreset = {
+  name: "tn",
+  normalize: normalizeTunisianPhone
+};
+var IDENTITY_PRESETS = {
+  ma: moroccoIdentityPreset,
+  tn: tunisiaIdentityPreset
+};
+var DEFAULT_IDENTITY_PRESET = "ma";
+
+// src/identity/resolver.ts
+var MAX_IDENTIFIER_LENGTH = 254;
+var E164 = /^\+[1-9]\d{7,14}$/;
+var normalizeE164 = /* @__PURE__ */ __name((value) => {
+  const compact = compactPhone(value);
+  const international = compact.startsWith("00") ? `+${compact.slice(2)}` : compact;
+  return E164.test(international) ? international : null;
+}, "normalizeE164");
+var selectPreset = /* @__PURE__ */ __name((preset) => {
+  if (preset === null)
+    return null;
+  if (preset === void 0)
+    return IDENTITY_PRESETS[DEFAULT_IDENTITY_PRESET];
+  if (typeof preset === "string") {
+    const selected = IDENTITY_PRESETS[preset];
+    if (!selected)
+      throw new Error(`auth.identity.preset '${preset}' is not a built-in identity preset`);
+    return selected;
+  }
+  if (typeof preset.normalize !== "function") {
+    throw new Error("auth.identity.preset must expose a normalize(value) function");
+  }
+  return preset;
+}, "selectPreset");
+function createIdentityResolver(config) {
+  const preset = selectPreset(config?.preset);
+  const extend = config?.extend ?? [];
+  if (extend.some((normalizer) => typeof normalizer !== "function")) {
+    throw new Error("auth.identity.extend must contain only normalizer functions");
+  }
+  const pipeline = [
+    ...extend,
+    ...preset ? [preset.normalize] : [],
+    normalizeE164
+  ];
+  return (value) => {
+    if (typeof value !== "string")
+      return null;
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.length > MAX_IDENTIFIER_LENGTH)
+      return null;
+    if (trimmed.includes("@"))
+      return trimmed.toLowerCase();
+    for (const normalize of pipeline) {
+      const normalized = normalize(trimmed);
+      if (normalized)
+        return normalized;
+    }
+    return null;
+  };
+}
+__name(createIdentityResolver, "createIdentityResolver");
+var defaultResolver = createIdentityResolver();
+function normalizeAuthIdentifier(value) {
+  return defaultResolver(value);
+}
+__name(normalizeAuthIdentifier, "normalizeAuthIdentifier");
+function isEmailIdentifier(value) {
+  return value.includes("@");
+}
+__name(isEmailIdentifier, "isEmailIdentifier");
+
 // src/users/UserService.ts
 import { Err as Err5 } from "najm-core";
 var __decorate8 = function(decorators, target, key, desc) {
@@ -1209,6 +1356,7 @@ var _e;
 var _f;
 var _g;
 var _h;
+var E164_PHONE = /^\+[1-9]\d{7,14}$/;
 var UserService = class UserService2 {
   static {
     __name(this, "UserService");
@@ -1296,15 +1444,25 @@ var UserService = class UserService2 {
   async getAuthRecordById(id) {
     return await this.userRepository.getRawById(id);
   }
-  async create(data) {
-    const { id, email: email2, name, image, emailVerified, password, roleId, role } = data;
+  async create(data, options = {}) {
+    const { id, email: email2, name, image, emailVerified, password, roleId, role, phone } = data;
     if (!password || typeof password !== "string" || password.trim().length === 0) {
       Err5("Password is required");
     }
-    this.userValidator.validatePasswordStrength(password);
+    this.userValidator.validatePasswordLength(password);
+    if (options.validatePasswordStrength !== false) {
+      this.userValidator.validatePasswordStrength(password);
+    }
     let userId = id || nanoid3(10);
     await this.userValidator.checkEmailUnique(data.email);
     await this.userValidator.checkUserIdIsUnique(userId);
+    const normalizedPhone = phone == null ? null : this.authConfig.identity?.resolve(phone) ?? normalizeAuthIdentifier(phone);
+    if (phone != null && (!normalizedPhone || !E164_PHONE.test(normalizedPhone))) {
+      Err5("A valid phone number is required", 400);
+    }
+    if (normalizedPhone) {
+      await this.userValidator.checkPhoneUnique(normalizedPhone, userId);
+    }
     const hashedPassword = await this.encryptionService.hashPassword(password);
     const resolvedRoleId = await this.resolveUserRole(roleId, role);
     const userDetails = {
@@ -1315,6 +1473,7 @@ var UserService = class UserService2 {
       password: hashedPassword,
       roleId: resolvedRoleId,
       emailVerified,
+      ...normalizedPhone ? { phone: normalizedPhone } : {},
       status: data.status ?? this.authConfig.registrationMode ?? "active"
     };
     const newUser = await this.userRepository.create(userDetails);
@@ -1411,7 +1570,7 @@ __decorate8([
 __decorate8([
   Transaction(),
   __metadata8("design:type", Function),
-  __metadata8("design:paramtypes", [typeof (_g = typeof Record !== "undefined" && Record) === "function" ? _g : Object]),
+  __metadata8("design:paramtypes", [typeof (_g = typeof Record !== "undefined" && Record) === "function" ? _g : Object, Object]),
   __metadata8("design:returntype", typeof (_h = typeof Promise !== "undefined" && Promise) === "function" ? _h : Object)
 ], UserService.prototype, "create", null);
 UserService = __decorate8([
@@ -1421,7 +1580,7 @@ UserService = __decorate8([
 ], UserService);
 
 // src/tokens/TokenService.ts
-import { Injectable as Injectable6, Inject as Inject7 } from "najm-core";
+import { Injectable as Injectable6, Inject as Inject8 } from "najm-core";
 import { I18n as I18n5 } from "najm-i18n";
 import { CacheService } from "najm-cache";
 import { createHash } from "crypto";
@@ -1543,7 +1702,11 @@ TokenRepository = __decorate9([
 
 // src/tokens/TokenService.ts
 import timestring2 from "timestring";
-import { Err as Err6 } from "najm-core";
+
+// src/credentialSetup/CredentialSetupRequirementRepository.ts
+import { and as and2, eq as eq5 } from "drizzle-orm";
+import { Err as Err6, Inject as Inject7, Repository as Repository4 } from "najm-core";
+import { DB as DB4 } from "najm-database";
 var __decorate10 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1553,10 +1716,82 @@ var __decorate10 = function(decorators, target, key, desc) {
 var __metadata10 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var CredentialSetupRequirementRepository = class CredentialSetupRequirementRepository2 {
+  static {
+    __name(this, "CredentialSetupRequirementRepository");
+  }
+  db;
+  schema;
+  get requirements() {
+    const requirements = this.schema.credentialSetupRequirements;
+    if (!requirements) {
+      Err6.invalidOperation("auth.schema.credentialSetupRequirements is required for credential-setup requirements");
+    }
+    return requirements;
+  }
+  get columns() {
+    const requirements = this.requirements;
+    return {
+      userId: requirements.userId,
+      purpose: requirements.purpose,
+      temporaryCredentialKind: requirements.temporaryCredentialKind,
+      required: requirements.required,
+      completedAt: requirements.completedAt
+    };
+  }
+  async markRequired(userId, purpose, temporaryCredentialKind) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const [requirement] = await this.db.insert(this.requirements).values({ userId, purpose, temporaryCredentialKind, required: true }).onConflictDoUpdate({
+      target: [this.requirements.userId, this.requirements.purpose],
+      set: { temporaryCredentialKind, required: true, completedAt: null, updatedAt: now }
+    }).returning(this.columns);
+    return requirement;
+  }
+  async find(userId, purpose) {
+    const [requirement] = await this.db.select(this.columns).from(this.requirements).where(and2(eq5(this.requirements.userId, userId), eq5(this.requirements.purpose, purpose))).limit(1);
+    return requirement;
+  }
+  async listRequired(userId) {
+    return this.db.select(this.columns).from(this.requirements).where(and2(eq5(this.requirements.userId, userId), eq5(this.requirements.required, true)));
+  }
+  /** Only a still-required row completes, so a replayed completion is a no-op. */
+  async complete(userId, purpose) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const [requirement] = await this.db.update(this.requirements).set({ required: false, completedAt: now, updatedAt: now }).where(and2(eq5(this.requirements.userId, userId), eq5(this.requirements.purpose, purpose), eq5(this.requirements.required, true))).returning(this.columns);
+    return requirement;
+  }
+};
+__decorate10([
+  DB4(),
+  __metadata10("design:type", Object)
+], CredentialSetupRequirementRepository.prototype, "db", void 0);
+__decorate10([
+  Inject7(AUTH_SCHEMA),
+  __metadata10("design:type", Object)
+], CredentialSetupRequirementRepository.prototype, "schema", void 0);
+CredentialSetupRequirementRepository = __decorate10([
+  Repository4()
+], CredentialSetupRequirementRepository);
+
+// src/credentialSetup/types.ts
+var PASSWORD_SETUP_PURPOSE = "password";
+
+// src/tokens/TokenService.ts
+import { Err as Err7 } from "najm-core";
+var __decorate11 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata11 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 var TokenService_1;
 var _a6;
 var _b4;
 var _c2;
+var _d2;
 var TokenService = class TokenService2 {
   static {
     __name(this, "TokenService");
@@ -1567,12 +1802,14 @@ var TokenService = class TokenService2 {
   tokenRepository;
   cookieManager;
   cache;
+  credentialSetupRequirements;
   config;
   t;
-  constructor(tokenRepository, cookieManager, cache2) {
+  constructor(tokenRepository, cookieManager, cache2, credentialSetupRequirements) {
     this.tokenRepository = tokenRepository;
     this.cookieManager = cookieManager;
     this.cache = cache2;
+    this.credentialSetupRequirements = credentialSetupRequirements;
   }
   /**
    * Get blacklist key prefix
@@ -1612,7 +1849,7 @@ var TokenService = class TokenService2 {
     if (authorization?.startsWith("Bearer ")) {
       return authorization.split(" ")[1];
     }
-    Err6(this.t("errors.tokenMissing"), 401);
+    Err7(this.t("errors.tokenMissing"), 401);
   }
   /**
    * Verify access token and check blacklist
@@ -1623,7 +1860,7 @@ var TokenService = class TokenService2 {
     try {
       payload = jwt.verify(token, this.config.jwt.accessSecret);
     } catch {
-      Err6(this.t("errors.tokenVerificationFailed"), 401);
+      Err7(this.t("errors.tokenVerificationFailed"), 401);
     }
     const sessionKey = this.sessionVersionKey(payload.userId);
     const blacklistKey = payload.jti ? `${this.blacklistPrefix}${payload.jti}` : null;
@@ -1636,15 +1873,15 @@ var TokenService = class TokenService2 {
     const values = await this.getCacheValues(keys);
     const valueByKey = new Map(keys.map((key, i) => [key, values[i]]));
     if (blacklistKey && valueByKey.get(blacklistKey) != null) {
-      Err6(this.t("errors.tokenRevoked"), 401);
+      Err7(this.t("errors.tokenRevoked"), 401);
     }
     if (familyKey && valueByKey.get(familyKey) != null) {
-      Err6(this.t("errors.tokenRevoked"), 401);
+      Err7(this.t("errors.tokenRevoked"), 401);
     }
     const activeSessionVersion = this.parseSessionVersion(valueByKey.get(sessionKey) ?? null);
     const tokenSessionVersion = payload.sessionVersion ?? 0;
     if (tokenSessionVersion !== activeSessionVersion) {
-      Err6(this.t("errors.tokenRevoked"), 401);
+      Err7(this.t("errors.tokenRevoked"), 401);
     }
     return payload;
   }
@@ -1653,13 +1890,13 @@ var TokenService = class TokenService2 {
     try {
       decoded = jwt.verify(token, this.config.jwt.refreshSecret);
     } catch {
-      Err6(this.t("errors.tokenVerificationFailed"), 401);
+      Err7(this.t("errors.tokenVerificationFailed"), 401);
     }
     if (decoded.type && decoded.type !== "refresh") {
-      Err6(this.t("errors.tokenVerificationFailed"), 401);
+      Err7(this.t("errors.tokenVerificationFailed"), 401);
     }
     if (!decoded.tokenFamily) {
-      Err6(this.t("errors.tokenVerificationFailed"), 401);
+      Err7(this.t("errors.tokenVerificationFailed"), 401);
     }
     return { userId: decoded.userId, tokenFamily: decoded.tokenFamily };
   }
@@ -1678,12 +1915,12 @@ var TokenService = class TokenService2 {
   async resolveRefreshSessionFromCookie() {
     const refreshToken = this.cookieManager.getRefreshToken();
     if (!refreshToken) {
-      Err6(this.t("errors.refreshTokenMissing"), 401);
+      Err7(this.t("errors.refreshTokenMissing"), 401);
     }
     const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err6(this.t("errors.refreshTokenInvalid"), 401);
+      Err7(this.t("errors.refreshTokenInvalid"), 401);
     }
     const presentedHash = this.hashToken(refreshToken);
     if (presentedHash === stored.token) {
@@ -1693,7 +1930,7 @@ var TokenService = class TokenService2 {
     if (canRecover) {
       return { userId, tokenFamily };
     }
-    Err6(this.t("errors.refreshTokenInvalid"), 401);
+    Err7(this.t("errors.refreshTokenInvalid"), 401);
   }
   async resolveUserFromCookie() {
     return (await this.resolveRefreshSessionFromCookie()).userId;
@@ -1870,12 +2107,12 @@ var TokenService = class TokenService2 {
   async refreshTokens() {
     const refreshToken = this.cookieManager.getRefreshToken();
     if (!refreshToken) {
-      Err6(this.t("errors.refreshTokenMissing"), 401);
+      Err7(this.t("errors.refreshTokenMissing"), 401);
     }
     const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err6(this.t("errors.refreshTokenInvalid"), 401);
+      Err7(this.t("errors.refreshTokenInvalid"), 401);
     }
     const presentedHash = this.hashToken(refreshToken);
     await this.requireActiveRefreshUser(userId, tokenFamily);
@@ -1886,18 +2123,25 @@ var TokenService = class TokenService2 {
     if (canRecover) {
       const claimed = await this.tokenRepository.markPreviousUsed(tokenFamily, presentedHash);
       if (!claimed?.length) {
-        Err6(this.t("errors.refreshTokenInvalid"), 401);
+        Err7(this.t("errors.refreshTokenInvalid"), 401);
       }
       return this.generateTokens(userId, tokenFamily);
     }
     await this.revokeSuspectRefreshFamily(userId, tokenFamily);
-    Err6(this.t("errors.refreshTokenInvalid"), 401);
+    Err7(this.t("errors.refreshTokenInvalid"), 401);
   }
   async requireActiveRefreshUser(userId, tokenFamily) {
     const user = await this.tokenRepository.getUser(userId);
     if (!user || user.status !== "active") {
       await this.revokeFamily(tokenFamily);
-      Err6(this.t("errors.refreshTokenInvalid"), 401);
+      Err7(this.t("errors.refreshTokenInvalid"), 401);
+    }
+    const requirement = await this.credentialSetupRequirements?.find(userId, PASSWORD_SETUP_PURPOSE);
+    if (requirement?.required) {
+      await this.revokeFamily(tokenFamily);
+      this.cookieManager.clearRefreshToken();
+      this.cookieManager.clearSessionCookie();
+      Err7(this.t("errors.credentialSetupRequired"), 403);
     }
     return user;
   }
@@ -1931,7 +2175,7 @@ var TokenService = class TokenService2 {
     const userId = await this.resolveUserFromCookie();
     const user = await this.getUserById(userId);
     if (!user) {
-      Err6(this.t("errors.refreshTokenInvalid"), 401);
+      Err7(this.t("errors.refreshTokenInvalid"), 401);
     }
     return user;
   }
@@ -2073,15 +2317,15 @@ var TokenService = class TokenService2 {
     try {
       decoded = jwt.verify(token, this.config.jwt.refreshSecret);
     } catch {
-      Err6(this.t("errors.resetTokenExpired"));
+      Err7(this.t("errors.resetTokenExpired"));
     }
     if (decoded.type !== "reset" && decoded.type !== "invite" || !decoded.jti) {
-      Err6(this.t("errors.invalidResetToken"));
+      Err7(this.t("errors.invalidResetToken"));
     }
     const key = `${this.resetTokenPrefix}${decoded.userId}`;
     const storedJti = await this.cache.get(key);
     if (!storedJti || storedJti !== decoded.jti) {
-      Err6(this.t("errors.invalidResetToken"));
+      Err7(this.t("errors.invalidResetToken"));
     }
     await this.cache.del(key);
     return decoded.userId;
@@ -2090,37 +2334,196 @@ var TokenService = class TokenService2 {
     return this.parseSessionVersion(await this.cache.get(this.sessionVersionKey(userId)));
   }
 };
-__decorate10([
-  Inject7(AUTH_CONFIG),
-  __metadata10("design:type", Object)
+__decorate11([
+  Inject8(AUTH_CONFIG),
+  __metadata11("design:type", Object)
 ], TokenService.prototype, "config", void 0);
-__decorate10([
+__decorate11([
   I18n5("auth"),
-  __metadata10("design:type", Object)
+  __metadata11("design:type", Object)
 ], TokenService.prototype, "t", void 0);
-TokenService = TokenService_1 = __decorate10([
+TokenService = TokenService_1 = __decorate11([
   Injectable6(),
-  __metadata10("design:paramtypes", [typeof (_a6 = typeof TokenRepository !== "undefined" && TokenRepository) === "function" ? _a6 : Object, typeof (_b4 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _b4 : Object, typeof (_c2 = typeof CacheService !== "undefined" && CacheService) === "function" ? _c2 : Object])
+  __metadata11("design:paramtypes", [typeof (_a6 = typeof TokenRepository !== "undefined" && TokenRepository) === "function" ? _a6 : Object, typeof (_b4 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _b4 : Object, typeof (_c2 = typeof CacheService !== "undefined" && CacheService) === "function" ? _c2 : Object, typeof (_d2 = typeof CredentialSetupRequirementRepository !== "undefined" && CredentialSetupRequirementRepository) === "function" ? _d2 : Object])
 ], TokenService);
 
 // src/auth/AuthService.ts
 import timestring3 from "timestring";
 
 // src/auth/AuthSessionService.ts
+import { Injectable as Injectable8 } from "najm-core";
+import { Err as Err9 } from "najm-core";
+
+// src/credentialSetup/CredentialSetupRequirementService.ts
 import { Injectable as Injectable7 } from "najm-core";
-import { Err as Err7 } from "najm-core";
-var __decorate11 = function(decorators, target, key, desc) {
+import { Transaction as Transaction2 } from "najm-database";
+
+// src/identity/temporaryCredential.ts
+var EXACT_TEMPORARY_CREDENTIAL_KIND = "exact";
+var exactKind = {
+  name: EXACT_TEMPORARY_CREDENTIAL_KIND,
+  normalize: /* @__PURE__ */ __name((value) => value, "normalize")
+};
+var MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND = "ma-cin";
+var MOROCCAN_CIN = /^[a-z]{1,3}\d{5,17}$/i;
+function isMoroccanCin(value) {
+  const trimmed = value.trim();
+  return trimmed.length >= 8 && trimmed.length <= 20 && MOROCCAN_CIN.test(trimmed);
+}
+__name(isMoroccanCin, "isMoroccanCin");
+function normalizeMoroccanCin(value) {
+  return isMoroccanCin(value) ? value.trim().toLowerCase() : value;
+}
+__name(normalizeMoroccanCin, "normalizeMoroccanCin");
+var moroccanCinKind = {
+  name: MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND,
+  normalize: normalizeMoroccanCin,
+  isTemporaryShape: isMoroccanCin
+};
+var KINDS = /* @__PURE__ */ new Map([
+  [exactKind.name, exactKind],
+  [moroccanCinKind.name, moroccanCinKind]
+]);
+function resolveTemporaryCredentialKind(name) {
+  const kind = KINDS.get(name?.trim() || EXACT_TEMPORARY_CREDENTIAL_KIND);
+  if (!kind) {
+    throw new Error(`Unknown temporary credential kind '${name}'`);
+  }
+  return kind;
+}
+__name(resolveTemporaryCredentialKind, "resolveTemporaryCredentialKind");
+function isTemporaryCredentialKind(name) {
+  return KINDS.has(name);
+}
+__name(isTemporaryCredentialKind, "isTemporaryCredentialKind");
+function toTemporaryCredential(input) {
+  if (typeof input === "string") {
+    return { kind: EXACT_TEMPORARY_CREDENTIAL_KIND, value: input };
+  }
+  if (!input || typeof input.value !== "string") {
+    throw new Error("temporaryCredential must be a string or { kind, value }");
+  }
+  return { kind: input.kind || EXACT_TEMPORARY_CREDENTIAL_KIND, value: input.value };
+}
+__name(toTemporaryCredential, "toTemporaryCredential");
+function moroccanCinTemporaryCredential(value) {
+  if (!isMoroccanCin(value)) {
+    throw new Error("moroccanCinTemporaryCredential requires a valid Moroccan CIN");
+  }
+  return { kind: MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, value };
+}
+__name(moroccanCinTemporaryCredential, "moroccanCinTemporaryCredential");
+
+// src/credentialSetup/purpose.ts
+import { Err as Err8 } from "najm-core";
+var PURPOSE_PATTERN = /^[a-z0-9](?:[a-z0-9:_-]{0,62}[a-z0-9])?$/;
+function normalizeSetupPurpose(purpose) {
+  const normalized = purpose?.trim().toLowerCase();
+  if (!normalized || !PURPOSE_PATTERN.test(normalized)) {
+    Err8("Credential setup purpose must be 1-64 lowercase letters, numbers, colon, underscore, or hyphen", 500);
+  }
+  return normalized;
+}
+__name(normalizeSetupPurpose, "normalizeSetupPurpose");
+
+// src/credentialSetup/CredentialSetupRequirementService.ts
+var __decorate12 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata11 = function(k, v) {
+var __metadata12 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var _a7;
 var _b5;
 var _c3;
+var CredentialSetupRequirementService = class CredentialSetupRequirementService2 {
+  static {
+    __name(this, "CredentialSetupRequirementService");
+  }
+  repository;
+  tokens;
+  constructor(repository, tokens) {
+    this.repository = repository;
+    this.tokens = tokens;
+  }
+  /**
+   * Idempotent. Re-marking clears a previous completion, and revokes the
+   * user's current sessions so an already signed-in browser cannot skip it.
+   */
+  async markRequired(userId, purpose, options = {}) {
+    const kind = options.temporaryCredentialKind ?? null;
+    if (kind)
+      resolveTemporaryCredentialKind(kind);
+    const requirement = await this.repository.markRequired(userId, normalizeSetupPurpose(purpose), kind);
+    await this.tokens.invalidateUserAccessTokens(userId);
+    await this.tokens.revokeAllForUser(userId);
+    return requirement;
+  }
+  async find(userId, purpose) {
+    const requirement = await this.repository.find(userId, normalizeSetupPurpose(purpose));
+    return requirement?.required ? requirement : void 0;
+  }
+  async isRequired(userId, purpose) {
+    return Boolean(await this.find(userId, purpose));
+  }
+  async listRequired(userId) {
+    return this.repository.listRequired(userId);
+  }
+  /** Returns the completed row, or `undefined` when nothing was still required. */
+  async completeRequirement(userId, purpose) {
+    return this.repository.complete(userId, normalizeSetupPurpose(purpose));
+  }
+};
+__decorate12([
+  Transaction2({ retries: 2 }),
+  __metadata12("design:type", Function),
+  __metadata12("design:paramtypes", [String, String, Object]),
+  __metadata12("design:returntype", typeof (_c3 = typeof Promise !== "undefined" && Promise) === "function" ? _c3 : Object)
+], CredentialSetupRequirementService.prototype, "markRequired", null);
+CredentialSetupRequirementService = __decorate12([
+  Injectable7(),
+  __metadata12("design:paramtypes", [typeof (_a7 = typeof CredentialSetupRequirementRepository !== "undefined" && CredentialSetupRequirementRepository) === "function" ? _a7 : Object, typeof (_b5 = typeof TokenService !== "undefined" && TokenService) === "function" ? _b5 : Object])
+], CredentialSetupRequirementService);
+
+// src/credentialSetup/errors.ts
+import { BaseError } from "najm-core";
+var CREDENTIAL_SETUP_CODES = {
+  /** Login succeeded but the account must replace its credential first. */
+  REQUIRED: "AUTH_CREDENTIAL_SETUP_REQUIRED",
+  /** No setup cookie was presented. */
+  SESSION_REQUIRED: "AUTH_CREDENTIAL_SETUP_SESSION_REQUIRED",
+  /** The setup cookie is unknown, already used, or expired. */
+  SESSION_INVALID: "AUTH_CREDENTIAL_SETUP_SESSION_INVALID",
+  /** Nothing was still required for this user and purpose. */
+  ALREADY_COMPLETED: "AUTH_CREDENTIAL_SETUP_ALREADY_COMPLETED",
+  /** The replacement failed the configured policy. */
+  PASSWORD_REJECTED: "AUTH_CREDENTIAL_SETUP_PASSWORD_REJECTED",
+  /** The replacement is the credential being replaced. */
+  SAME_PASSWORD: "AUTH_CREDENTIAL_SETUP_SAME_PASSWORD",
+  /** OAuth cannot mint a session while a requirement is outstanding. */
+  OAUTH_BLOCKED: "oauth_credential_setup_required"
+};
+var credentialSetupError = /* @__PURE__ */ __name((code, message, status = 400) => {
+  throw new BaseError(code, message, status);
+}, "credentialSetupError");
+
+// src/auth/AuthSessionService.ts
+var __decorate13 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata13 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a8;
+var _b6;
+var _c4;
+var _d3;
 var AuthSessionService = class AuthSessionService2 {
   static {
     __name(this, "AuthSessionService");
@@ -2128,14 +2531,19 @@ var AuthSessionService = class AuthSessionService2 {
   tokenService;
   userService;
   cookieManager;
-  constructor(tokenService, userService, cookieManager) {
+  credentialSetupRequirements;
+  constructor(tokenService, userService, cookieManager, credentialSetupRequirements) {
     this.tokenService = tokenService;
     this.userService = userService;
     this.cookieManager = cookieManager;
+    this.credentialSetupRequirements = credentialSetupRequirements;
   }
   async establish(user) {
     if (user.status !== "active") {
-      Err7("oauth_account_inactive", 403);
+      Err9("oauth_account_inactive", 403);
+    }
+    if (await this.credentialSetupRequirements?.isRequired(user.id, PASSWORD_SETUP_PURPOSE)) {
+      credentialSetupError(CREDENTIAL_SETUP_CODES.REQUIRED, "Credential setup is required before a session can be established", 403);
     }
     await this.tokenService.deleteExpiredSessions();
     const generated = await this.tokenService.generateTokens(user.id);
@@ -2158,93 +2566,485 @@ var AuthSessionService = class AuthSessionService2 {
     return { ...tokens, user };
   }
 };
-AuthSessionService = __decorate11([
-  Injectable7(),
-  __metadata11("design:paramtypes", [typeof (_a7 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a7 : Object, typeof (_b5 = typeof UserService !== "undefined" && UserService) === "function" ? _b5 : Object, typeof (_c3 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c3 : Object])
+AuthSessionService = __decorate13([
+  Injectable8(),
+  __metadata13("design:paramtypes", [typeof (_a8 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a8 : Object, typeof (_b6 = typeof UserService !== "undefined" && UserService) === "function" ? _b6 : Object, typeof (_c4 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c4 : Object, typeof (_d3 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _d3 : Object])
 ], AuthSessionService);
 
-// src/auth/authIdentity.ts
-var PHONE_PATTERN = /^\+[1-9]\d{7,14}$/;
-function normalizeAuthIdentifier(value) {
-  if (typeof value !== "string")
-    return null;
-  const trimmed = value.trim();
-  if (!trimmed || trimmed.length > 254)
-    return null;
-  if (trimmed.includes("@")) {
-    return trimmed.toLowerCase();
-  }
-  const compact = trimmed.replace(/[\s().-]+/g, "");
-  const international = compact.startsWith("00") ? `+${compact.slice(2)}` : compact;
-  return PHONE_PATTERN.test(international) ? international : null;
-}
-__name(normalizeAuthIdentifier, "normalizeAuthIdentifier");
-function isEmailIdentifier(value) {
-  return value.includes("@");
-}
-__name(isEmailIdentifier, "isEmailIdentifier");
+// src/credentialSetup/PasswordSetupService.ts
+import { Inject as Inject10, Injectable as Injectable10 } from "najm-core";
+import { I18n as I18n7 } from "najm-i18n";
 
-// src/auth/AuthService.ts
-var __decorate12 = function(decorators, target, key, desc) {
+// src/credentialSetup/CredentialSetupService.ts
+import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { CookieService as CookieService2 } from "najm-cookies";
+import { Err as Err11, Injectable as Injectable9 } from "najm-core";
+import { Transaction as Transaction3 } from "najm-database";
+import { I18n as I18n6 } from "najm-i18n";
+
+// src/credentialSetup/CredentialSetupRepository.ts
+import { and as and3, eq as eq6, gt, isNull as isNull2, lt as lt2 } from "drizzle-orm";
+import { Err as Err10, Inject as Inject9, Repository as Repository5 } from "najm-core";
+import { DB as DB5 } from "najm-database";
+var __decorate14 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata12 = function(k, v) {
+var __metadata14 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a8;
-var _b6;
-var _c4;
-var _d2;
-var _e2;
-var _f2;
-var _g2;
-var _h2;
-var AuthService = class AuthService2 {
+var CredentialSetupRepository = class CredentialSetupRepository2 {
   static {
-    __name(this, "AuthService");
+    __name(this, "CredentialSetupRepository");
   }
-  tokenService;
-  userService;
-  userValidator;
-  encryptionService;
-  cookieManager;
-  i18nService;
-  emailService;
-  authSessionService;
-  config;
-  t;
-  logger;
-  dummyHash;
-  constructor(tokenService, userService, userValidator, encryptionService, cookieManager, i18nService, emailService, authSessionService) {
-    this.tokenService = tokenService;
-    this.userService = userService;
-    this.userValidator = userValidator;
-    this.encryptionService = encryptionService;
-    this.cookieManager = cookieManager;
-    this.i18nService = i18nService;
-    this.emailService = emailService;
-    this.authSessionService = authSessionService;
+  db;
+  schema;
+  get sessions() {
+    const sessions = this.schema.credentialSetupSessions;
+    if (!sessions) {
+      Err10.invalidOperation("auth.schema.credentialSetupSessions is required to use CredentialSetupService");
+    }
+    return sessions;
   }
-  isLockoutActive(lockoutUntil) {
-    if (!lockoutUntil)
-      return false;
-    return new Date(lockoutUntil).getTime() > Date.now();
+  async replaceActive(data) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    await this.db.update(this.sessions).set({ revokedAt: now, updatedAt: now }).where(and3(eq6(this.sessions.userId, data.userId), eq6(this.sessions.purpose, data.purpose), isNull2(this.sessions.consumedAt), isNull2(this.sessions.revokedAt)));
+    const [session] = await this.db.insert(this.sessions).values(data).returning({
+      userId: this.sessions.userId,
+      purpose: this.sessions.purpose,
+      expiresAt: this.sessions.expiresAt
+    });
+    return session;
   }
-  nextLockoutUntil() {
-    const durationMs = timestring3(this.config.lockout.duration, "ms");
-    return new Date(Date.now() + durationMs).toISOString();
+  async findActive(tokenHash, purpose) {
+    const [session] = await this.db.select({
+      userId: this.sessions.userId,
+      purpose: this.sessions.purpose,
+      expiresAt: this.sessions.expiresAt
+    }).from(this.sessions).where(and3(eq6(this.sessions.tokenHash, tokenHash), eq6(this.sessions.purpose, purpose), isNull2(this.sessions.consumedAt), isNull2(this.sessions.revokedAt), gt(this.sessions.expiresAt, (/* @__PURE__ */ new Date()).toISOString()))).limit(1);
+    return session;
   }
-  getDummyHash() {
-    this.dummyHash ??= this.encryptionService.hashPassword("najm-auth-dummy-password");
-    return this.dummyHash;
+  async consume(tokenHash, purpose) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const [session] = await this.db.update(this.sessions).set({ consumedAt: now, updatedAt: now }).where(and3(eq6(this.sessions.tokenHash, tokenHash), eq6(this.sessions.purpose, purpose), isNull2(this.sessions.consumedAt), isNull2(this.sessions.revokedAt), gt(this.sessions.expiresAt, now))).returning({
+      userId: this.sessions.userId,
+      purpose: this.sessions.purpose,
+      expiresAt: this.sessions.expiresAt
+    });
+    return session;
   }
-  async warmupPasswordHash() {
-    await this.getDummyHash();
+  async revoke(tokenHash, purpose) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const [session] = await this.db.update(this.sessions).set({ revokedAt: now, updatedAt: now }).where(and3(eq6(this.sessions.tokenHash, tokenHash), eq6(this.sessions.purpose, purpose), isNull2(this.sessions.consumedAt), isNull2(this.sessions.revokedAt))).returning({ userId: this.sessions.userId });
+    return session;
   }
-  async registerUser(body) {
+  async deleteExpired() {
+    return this.db.delete(this.sessions).where(lt2(this.sessions.expiresAt, (/* @__PURE__ */ new Date()).toISOString())).returning({ userId: this.sessions.userId });
+  }
+};
+__decorate14([
+  DB5(),
+  __metadata14("design:type", Object)
+], CredentialSetupRepository.prototype, "db", void 0);
+__decorate14([
+  Inject9(AUTH_SCHEMA),
+  __metadata14("design:type", Object)
+], CredentialSetupRepository.prototype, "schema", void 0);
+CredentialSetupRepository = __decorate14([
+  Repository5()
+], CredentialSetupRepository);
+
+// src/credentialSetup/CredentialSetupService.ts
+var __decorate15 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata15 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a9;
+var _b7;
+var _c5;
+var _d4;
+var _e2;
+var _f2;
+var _g2;
+var DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME = "najm.credential-setup";
+var DEFAULT_CREDENTIAL_SETUP_TTL_MS = 10 * 60 * 1e3;
+var MAX_TTL_MS = 24 * 60 * 60 * 1e3;
+var COOKIE_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+var CredentialSetupService = class CredentialSetupService2 {
+  static {
+    __name(this, "CredentialSetupService");
+  }
+  repository;
+  tokens;
+  authCookies;
+  cookies;
+  t;
+  constructor(repository, tokens, authCookies, cookies2) {
+    this.repository = repository;
+    this.tokens = tokens;
+    this.authCookies = authCookies;
+    this.cookies = cookies2;
+  }
+  /**
+   * Revoke normal auth sessions and issue a single-purpose, short-lived,
+   * browser-session cookie. No access or refresh token is minted.
+   */
+  async begin(userId, options) {
+    const resolved = this.resolveOptions(options);
+    const token = randomBytes2(32).toString("base64url");
+    const expiresAt = new Date(Date.now() + resolved.ttlMs).toISOString();
+    await this.repository.deleteExpired();
+    await this.repository.replaceActive({
+      userId,
+      purpose: resolved.purpose,
+      tokenHash: this.hashToken(token),
+      expiresAt
+    });
+    await this.tokens.invalidateUserAccessTokens(userId);
+    await this.tokens.revokeAllForUser(userId);
+    this.authCookies.clearRefreshToken();
+    this.authCookies.clearSessionCookie();
+    this.setCookie(token, resolved);
+    return { purpose: resolved.purpose, expiresAt };
+  }
+  /** Validate and return the current active setup session without consuming it. */
+  async require(options) {
+    const resolved = this.resolveOptions(options);
+    const token = this.cookies.get(resolved.cookieName);
+    if (!token)
+      this.sessionRequired();
+    const session = await this.repository.findActive(this.hashToken(token), resolved.purpose);
+    if (!session) {
+      this.clearCookie(resolved);
+      this.sessionInvalid();
+    }
+    return session;
+  }
+  /**
+   * Atomically consume the setup session and execute the application-owned
+   * credential mutation in the same database transaction. If the callback
+   * fails, consumption rolls back and the browser may safely retry.
+   */
+  async consume(options, complete) {
+    const resolved = this.resolveOptions(options);
+    const token = this.cookies.get(resolved.cookieName);
+    if (!token)
+      this.sessionRequired();
+    const session = await this.repository.consume(this.hashToken(token), resolved.purpose);
+    if (!session) {
+      this.clearCookie(resolved);
+      this.sessionInvalid();
+    }
+    const result = await complete(session);
+    this.clearCookie(resolved);
+    return result;
+  }
+  async cancel(options) {
+    const resolved = this.resolveOptions(options);
+    const token = this.cookies.get(resolved.cookieName);
+    if (token) {
+      await this.repository.revoke(this.hashToken(token), resolved.purpose);
+    }
+    this.clearCookie(resolved);
+    return { cancelled: true };
+  }
+  async pruneExpired() {
+    await this.repository.deleteExpired();
+  }
+  /** Tolerates direct construction outside DI, where `t` is not injected. */
+  message(key, fallback) {
+    try {
+      return this.t?.(key) || fallback;
+    } catch {
+      return fallback;
+    }
+  }
+  sessionRequired() {
+    return credentialSetupError(CREDENTIAL_SETUP_CODES.SESSION_REQUIRED, this.message("errors.credentialSetupSessionRequired", "Credential setup session is required"), 401);
+  }
+  sessionInvalid() {
+    return credentialSetupError(CREDENTIAL_SETUP_CODES.SESSION_INVALID, this.message("errors.credentialSetupSessionInvalid", "Credential setup session is invalid or expired"), 401);
+  }
+  resolveOptions(options) {
+    const purpose = normalizeSetupPurpose(options.purpose);
+    const cookieName = options.cookieName?.trim() || DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME;
+    const ttlMs = options.ttlMs ?? DEFAULT_CREDENTIAL_SETUP_TTL_MS;
+    const cookiePath = options.cookiePath ?? "/";
+    if (!COOKIE_NAME_PATTERN.test(cookieName) || cookieName.length > 128) {
+      Err11("Credential setup cookie name is invalid", 500);
+    }
+    if (!Number.isInteger(ttlMs) || ttlMs < 1e3 || ttlMs > MAX_TTL_MS) {
+      Err11("Credential setup ttlMs must be an integer between 1000 and 86400000", 500);
+    }
+    if (!cookiePath.startsWith("/") || cookiePath.includes(";") || cookiePath.includes("\\")) {
+      Err11("Credential setup cookiePath must be a same-origin path", 500);
+    }
+    return { purpose, cookieName, ttlMs, cookiePath };
+  }
+  hashToken(token) {
+    return createHash2("sha256").update(token).digest("hex");
+  }
+  setCookie(token, options) {
+    this.cookies.setSession(options.cookieName, token, {
+      httpOnly: true,
+      path: options.cookiePath,
+      sameSite: "Strict",
+      secure: process.env.NODE_ENV === "production"
+    });
+  }
+  clearCookie(options) {
+    this.cookies.delete(options.cookieName, {
+      path: options.cookiePath,
+      secure: process.env.NODE_ENV === "production"
+    });
+  }
+};
+__decorate15([
+  I18n6("auth"),
+  __metadata15("design:type", Object)
+], CredentialSetupService.prototype, "t", void 0);
+__decorate15([
+  Transaction3({ retries: 2 }),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [String, Object]),
+  __metadata15("design:returntype", typeof (_e2 = typeof Promise !== "undefined" && Promise) === "function" ? _e2 : Object)
+], CredentialSetupService.prototype, "begin", null);
+__decorate15([
+  Transaction3({ retries: 2 }),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object, Function]),
+  __metadata15("design:returntype", typeof (_f2 = typeof Promise !== "undefined" && Promise) === "function" ? _f2 : Object)
+], CredentialSetupService.prototype, "consume", null);
+__decorate15([
+  Transaction3({ retries: 2 }),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", typeof (_g2 = typeof Promise !== "undefined" && Promise) === "function" ? _g2 : Object)
+], CredentialSetupService.prototype, "cancel", null);
+CredentialSetupService = __decorate15([
+  Injectable9(),
+  __metadata15("design:paramtypes", [typeof (_a9 = typeof CredentialSetupRepository !== "undefined" && CredentialSetupRepository) === "function" ? _a9 : Object, typeof (_b7 = typeof TokenService !== "undefined" && TokenService) === "function" ? _b7 : Object, typeof (_c5 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c5 : Object, typeof (_d4 = typeof CookieService2 !== "undefined" && CookieService2) === "function" ? _d4 : Object])
+], CredentialSetupService);
+
+// src/credentialSetup/PasswordSetupService.ts
+var __decorate16 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata16 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a10;
+var _b8;
+var _c6;
+var _d5;
+var _e3;
+var _f3;
+var PasswordSetupService = class PasswordSetupService2 {
+  static {
+    __name(this, "PasswordSetupService");
+  }
+  setup;
+  requirements;
+  users;
+  userRecords;
+  validator;
+  encryption;
+  config;
+  t;
+  constructor(setup, requirements, users, userRecords, validator, encryption) {
+    this.setup = setup;
+    this.requirements = requirements;
+    this.users = users;
+    this.userRecords = userRecords;
+    this.validator = validator;
+    this.encryption = encryption;
+  }
+  /** Tolerates direct construction outside DI, where `t` is not injected. */
+  message(key, fallback) {
+    try {
+      return this.t?.(key) || fallback;
+    } catch {
+      return fallback;
+    }
+  }
+  get options() {
+    const { cookieName, ttlMs } = this.config.credentialSetup.password;
+    return { purpose: PASSWORD_SETUP_PURPOSE, cookieName, ttlMs };
+  }
+  pending(session) {
+    return {
+      nextStep: "credential_setup",
+      setupRequired: true,
+      purpose: session.purpose,
+      expiresAt: session.expiresAt
+    };
+  }
+  /** Revoke normal sessions and hand the browser a short-lived setup cookie. */
+  async begin(userId) {
+    return this.pending(await this.setup.begin(userId, this.options));
+  }
+  /** Read the active setup session without consuming it. */
+  async status() {
+    return this.pending(await this.setup.require(this.options));
+  }
+  /**
+   * Everything that can fail on the user's input is checked against the
+   * *unconsumed* session, so a mistyped replacement leaves the browser able to
+   * retry. Only the two writes that must agree — the password and the
+   * requirement — happen inside the one-time consumption.
+   */
+  async change(newPassword) {
+    const { userId } = await this.setup.require(this.options);
+    const password = await this.validateReplacement(userId, newPassword);
+    const hashed = await this.encryption.hashPassword(password);
+    await this.setup.consume(this.options, (session) => this.persist(session.userId, hashed));
+    return { changed: true, signInAgain: true };
+  }
+  async cancel() {
+    return this.setup.cancel(this.options);
+  }
+  async validateReplacement(userId, submitted) {
+    const requirement = await this.requirements.find(userId, PASSWORD_SETUP_PURPOSE);
+    if (!requirement) {
+      credentialSetupError(CREDENTIAL_SETUP_CODES.ALREADY_COMPLETED, this.message("errors.credentialSetupAlreadyCompleted", "The password was already replaced. Please sign in again."), 409);
+    }
+    const kind = resolveTemporaryCredentialKind(requirement.temporaryCredentialKind);
+    const newPassword = this.validatePolicy(submitted);
+    if (kind.isTemporaryShape?.(newPassword)) {
+      credentialSetupError(CREDENTIAL_SETUP_CODES.PASSWORD_REJECTED, this.message("errors.credentialSetupTemporaryShape", "Choose a password that is not your temporary credential."), 400);
+    }
+    const user = await this.users.getAuthRecordById(userId);
+    if (!user?.password) {
+      credentialSetupError(CREDENTIAL_SETUP_CODES.SESSION_INVALID, this.message("errors.invalidCredentials", "Invalid email or password"), 401);
+    }
+    if (await this.isCurrentPassword(newPassword, kind.normalize(newPassword), user.password)) {
+      credentialSetupError(CREDENTIAL_SETUP_CODES.SAME_PASSWORD, this.message("errors.credentialSetupSamePassword", "Choose a password different from your current one."), 400);
+    }
+    return newPassword;
+  }
+  /**
+   * Runs inside the setup-session consumption transaction, so the password
+   * update, the requirement completion, and the one-time session all commit or
+   * roll back together.
+   */
+  async persist(userId, password) {
+    await this.userRecords.update(userId, { password });
+    const completed = await this.requirements.completeRequirement(userId, PASSWORD_SETUP_PURPOSE);
+    if (!completed) {
+      credentialSetupError(CREDENTIAL_SETUP_CODES.ALREADY_COMPLETED, this.message("errors.credentialSetupAlreadyCompleted", "The password was already replaced. Please sign in again."), 409);
+    }
+    return userId;
+  }
+  validatePolicy(submitted) {
+    const parsed = this.config.credentialSetup.password.passwordSchema.safeParse(submitted);
+    if (!parsed.success) {
+      credentialSetupError(CREDENTIAL_SETUP_CODES.PASSWORD_REJECTED, parsed.error.issues[0]?.message ?? this.message("errors.credentialSetupPasswordRejected", "Choose a different password."), 422);
+    }
+    return parsed.data;
+  }
+  /**
+   * The stored hash is of the *normalized* temporary credential, so a
+   * differently-cased retype has to be compared in both forms.
+   */
+  async isCurrentPassword(submitted, normalized, storedHash) {
+    if (await this.validator.comparePassword(submitted, storedHash))
+      return true;
+    if (normalized === submitted)
+      return false;
+    return this.validator.comparePassword(normalized, storedHash);
+  }
+};
+__decorate16([
+  Inject10(AUTH_CONFIG),
+  __metadata16("design:type", Object)
+], PasswordSetupService.prototype, "config", void 0);
+__decorate16([
+  I18n7("auth"),
+  __metadata16("design:type", Object)
+], PasswordSetupService.prototype, "t", void 0);
+PasswordSetupService = __decorate16([
+  Injectable10(),
+  __metadata16("design:paramtypes", [typeof (_a10 = typeof CredentialSetupService !== "undefined" && CredentialSetupService) === "function" ? _a10 : Object, typeof (_b8 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _b8 : Object, typeof (_c6 = typeof UserService !== "undefined" && UserService) === "function" ? _c6 : Object, typeof (_d5 = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _d5 : Object, typeof (_e3 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _e3 : Object, typeof (_f3 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _f3 : Object])
+], PasswordSetupService);
+
+// src/auth/AuthService.ts
+var __decorate17 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata17 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a11;
+var _b9;
+var _c7;
+var _d6;
+var _e4;
+var _f4;
+var _g3;
+var _h2;
+var _j;
+var _k;
+var _l;
+var AuthService = class AuthService2 {
+  static {
+    __name(this, "AuthService");
+  }
+  tokenService;
+  userService;
+  userValidator;
+  encryptionService;
+  cookieManager;
+  i18nService;
+  emailService;
+  authSessionService;
+  credentialSetupRequirements;
+  passwordSetup;
+  config;
+  t;
+  logger;
+  dummyHash;
+  constructor(tokenService, userService, userValidator, encryptionService, cookieManager, i18nService, emailService, authSessionService, credentialSetupRequirements, passwordSetup) {
+    this.tokenService = tokenService;
+    this.userService = userService;
+    this.userValidator = userValidator;
+    this.encryptionService = encryptionService;
+    this.cookieManager = cookieManager;
+    this.i18nService = i18nService;
+    this.emailService = emailService;
+    this.authSessionService = authSessionService;
+    this.credentialSetupRequirements = credentialSetupRequirements;
+    this.passwordSetup = passwordSetup;
+  }
+  isLockoutActive(lockoutUntil) {
+    if (!lockoutUntil)
+      return false;
+    return new Date(lockoutUntil).getTime() > Date.now();
+  }
+  nextLockoutUntil() {
+    const durationMs = timestring3(this.config.lockout.duration, "ms");
+    return new Date(Date.now() + durationMs).toISOString();
+  }
+  getDummyHash() {
+    this.dummyHash ??= this.encryptionService.hashPassword("najm-auth-dummy-password");
+    return this.dummyHash;
+  }
+  async warmupPasswordHash() {
+    await this.getDummyHash();
+  }
+  async registerUser(body) {
     return await this.userService.create({
       name: body.name,
       email: body.email,
@@ -2268,6 +3068,7 @@ var AuthService = class AuthService2 {
       id: body.id,
       name: body.name,
       email: body.email,
+      phone: body.phone,
       role: body.role,
       roleId: body.roleId,
       image: body.image,
@@ -2298,24 +3099,79 @@ var AuthService = class AuthService2 {
    * Returns the created (sanitized) user so the caller can link `userId`.
    */
   async provisionUser(body) {
-    const password = typeof body.password === "string" ? body.password.trim() : "";
+    const input = body;
+    if (input.requireCredentialSetup) {
+      return this.provisionWithCredentialSetup(input);
+    }
+    if (input.temporaryCredential) {
+      Err12("provisionUser requires requireCredentialSetup when a temporaryCredential is supplied", 400);
+    }
+    const password = typeof input.password === "string" ? input.password.trim() : "";
     if (password) {
       return this.userService.create({
-        id: body.id,
-        name: body.name,
-        email: body.email,
-        role: body.role,
-        roleId: body.roleId,
-        image: body.image,
+        id: input.id,
+        name: input.name,
+        email: input.email,
+        phone: input.phone,
+        role: input.role,
+        roleId: input.roleId,
+        image: input.image,
         password,
-        status: body.status ?? "active"
+        status: input.status ?? "active"
       });
     }
-    return this.inviteUser(body);
+    return this.inviteUser(input);
+  }
+  /**
+   * Create the account and mark the durable requirement in one transaction, so
+   * a user never exists holding a temporary credential that nothing forces
+   * them to replace. No session is issued here.
+   */
+  async provisionWithCredentialSetup(body) {
+    if (body.password != null) {
+      Err12("provisionUser cannot set a password and a temporaryCredential at the same time", 400);
+    }
+    if (!body.temporaryCredential) {
+      Err12("provisionUser requires a temporaryCredential when credential setup is required", 400);
+    }
+    if (!this.credentialSetupRequirements) {
+      Err12.invalidOperation("Credential setup is unavailable: CredentialSetupRequirementService is not registered");
+    }
+    const temporary = toTemporaryCredential(body.temporaryCredential);
+    const kind = resolveTemporaryCredentialKind(temporary.kind);
+    if (kind.isTemporaryShape && !kind.isTemporaryShape(temporary.value)) {
+      Err12(`Invalid temporary credential for kind '${kind.name}'`, 400);
+    }
+    const password = kind.normalize(temporary.value);
+    if (!password?.trim()) {
+      Err12("provisionUser requires a non-empty temporaryCredential", 400);
+    }
+    const user = await this.userService.create({
+      id: body.id,
+      name: body.name,
+      email: body.email,
+      phone: body.phone,
+      role: body.role,
+      roleId: body.roleId,
+      image: body.image,
+      password,
+      status: body.status ?? "active"
+    }, { validatePasswordStrength: false });
+    await this.credentialSetupRequirements.markRequired(user.id, body.requireCredentialSetup, {
+      temporaryCredentialKind: kind.name
+    });
+    return user;
   }
   async loginUser(body) {
-    const user = await this.verifyCredentials(body);
-    return this.establishSession(user);
+    const { user, requirement } = await this.authenticate(body, { kind: "active" });
+    if (requirement) {
+      if (!this.passwordSetup) {
+        Err12.invalidOperation("Credential setup is required but PasswordSetupService is not registered");
+      }
+      return this.passwordSetup.begin(user.id);
+    }
+    const session = await this.establishSession(user);
+    return { ...session, nextStep: "authenticated" };
   }
   /**
    * Verify credentials and account policy without minting access/refresh
@@ -2323,7 +3179,7 @@ var AuthService = class AuthService2 {
    * this before issuing a purpose-bound CredentialSetupService session.
    */
   async verifyCredentials(body) {
-    return this.verifyCredentialsForPolicy(body, { kind: "active" });
+    return (await this.authenticate(body, { kind: "active" })).user;
   }
   /**
    * Verify a pending, unverified account for one exact application role.
@@ -2332,17 +3188,22 @@ var AuthService = class AuthService2 {
    */
   async verifyPendingCredentials(body, expectedRole) {
     if (!expectedRole.trim()) {
-      Err8(this.t("errors.invalidCredentials"), 401);
+      Err12(this.t("errors.invalidCredentials"), 401);
     }
-    return this.verifyCredentialsForPolicy(body, {
+    return (await this.authenticate(body, {
       kind: "pending",
       expectedRole: expectedRole.trim().toLowerCase()
-    });
+    })).user;
   }
-  async verifyCredentialsForPolicy(body, policy) {
-    const password = body.password;
+  /**
+   * The one credential path. Resolves identity, the durable setup requirement,
+   * and the credential normalization that requirement implies — in that order —
+   * before a single hash comparison decides the outcome. Nothing about the
+   * requirement is revealed until credentials and account policy have passed.
+   */
+  async authenticate(body, policy) {
     const rawIdentifier = "identifier" in body ? body.identifier : body.email;
-    const identifier = normalizeAuthIdentifier(rawIdentifier);
+    const identifier = this.config.identity?.resolve(rawIdentifier) ?? normalizeAuthIdentifier(rawIdentifier);
     let user;
     if (identifier && isEmailIdentifier(identifier)) {
       user = await this.userService.findByEmailInsensitive(identifier);
@@ -2356,42 +3217,65 @@ var AuthService = class AuthService2 {
       user.lockoutUntil = null;
     }
     if (user && this.isLockoutActive(user.lockoutUntil)) {
-      Err8(this.t("errors.accountLocked"), 423);
+      Err12(this.t("errors.accountLocked"), 423);
     }
-    const storedHash = user?.password ?? await this.getDummyHash();
-    const isValid = await this.userValidator.comparePassword(password, storedHash);
+    const requirement = await this.credentialSetupRequirements?.find(user?.id ?? "", PASSWORD_SETUP_PURPOSE);
+    const { credential, kindUnavailable } = this.resolveLoginCredential(body.password, requirement);
+    const storedHash = kindUnavailable || !user?.password ? await this.getDummyHash() : user.password;
+    const isValid = await this.userValidator.comparePassword(credential, storedHash);
     if (!user || !isValid) {
       if (user) {
         const attempts = await this.userService.incrementFailedAttempts(user.id);
         if (attempts >= this.config.lockout.maxAttempts) {
           await this.userService.setLockout(user.id, this.nextLockoutUntil());
-          Err8(this.t("errors.accountLocked"), 423);
+          Err12(this.t("errors.accountLocked"), 423);
         }
       }
-      Err8(this.t("errors.invalidCredentials"), 401);
+      Err12(this.t("errors.invalidCredentials"), 401);
     }
     if (policy.kind === "pending") {
       const role = typeof user.role === "string" ? user.role.toLowerCase() : "";
       if (user.status !== "pending" || user.emailVerified || role !== policy.expectedRole) {
-        Err8(this.t("errors.invalidCredentials"), 401);
+        Err12(this.t("errors.invalidCredentials"), 401);
       }
     } else {
       if (user.status !== "active") {
-        Err8(this.t("errors.accountInactive"), 403);
+        Err12(this.t("errors.accountInactive"), 403);
       }
       if (this.config.requireVerifiedEmail && !user.emailVerified) {
-        Err8(this.t("errors.emailNotVerified"), 403);
+        Err12(this.t("errors.emailNotVerified"), 403);
       }
     }
     if ((user.failedLoginAttempts ?? 0) > 0 || user.lockoutUntil) {
       await this.userService.resetFailedAttempts(user.id);
     }
     const { password: _, failedLoginAttempts: __, lockoutUntil: ___, ...sanitized } = user;
-    return sanitized;
+    return { user: sanitized, requirement };
+  }
+  /**
+   * A user-chosen password is compared byte-for-byte. Only an active
+   * requirement, and only its own stored kind, can transform the submitted
+   * value — so lowercasing a CIN never leaks into normal logins.
+   */
+  resolveLoginCredential(password, requirement) {
+    if (!requirement)
+      return { credential: password, kindUnavailable: false };
+    try {
+      const kind = resolveTemporaryCredentialKind(requirement.temporaryCredentialKind);
+      return { credential: kind.normalize(password), kindUnavailable: false };
+    } catch (error) {
+      this.logger.error("Unresolvable temporary credential kind on an active requirement", {
+        userId: requirement.userId,
+        purpose: requirement.purpose,
+        kind: requirement.temporaryCredentialKind,
+        error
+      });
+      return { credential: password, kindUnavailable: true };
+    }
   }
   /** Establish a complete normal auth session for an already verified user. */
   async establishSession(user) {
-    this.authSessionService ??= new AuthSessionService(this.tokenService, this.userService, this.cookieManager);
+    this.authSessionService ??= new AuthSessionService(this.tokenService, this.userService, this.cookieManager, this.credentialSetupRequirements);
     return this.authSessionService.establish(user);
   }
   async refreshTokens() {
@@ -2509,11 +3393,11 @@ var AuthService = class AuthService2 {
   async changePassword(userId, currentPassword, newPassword) {
     const user = await this.userService.getAuthRecordById(userId);
     if (!user?.password) {
-      Err8(this.t("errors.invalidCredentials"), 401);
+      Err12(this.t("errors.invalidCredentials"), 401);
     }
     const isValid = await this.userValidator.comparePassword(currentPassword, user.password);
     if (!isValid) {
-      Err8(this.t("errors.invalidCredentials"), 401);
+      Err12(this.t("errors.invalidCredentials"), 401);
     }
     this.userValidator.validatePasswordStrength(newPassword);
     await this.userService.update(userId, { password: newPassword });
@@ -2534,33 +3418,39 @@ var AuthService = class AuthService2 {
     return { message: this.t("success.passwordReset") };
   }
 };
-__decorate12([
-  Inject8(AUTH_CONFIG),
-  __metadata12("design:type", Object)
+__decorate17([
+  Inject11(AUTH_CONFIG),
+  __metadata17("design:type", Object)
 ], AuthService.prototype, "config", void 0);
-__decorate12([
-  I18n6("auth"),
-  __metadata12("design:type", Object)
+__decorate17([
+  I18n8("auth"),
+  __metadata17("design:type", Object)
 ], AuthService.prototype, "t", void 0);
-__decorate12([
+__decorate17([
   Log(),
-  __metadata12("design:type", Object)
+  __metadata17("design:type", Object)
 ], AuthService.prototype, "logger", void 0);
-AuthService = __decorate12([
-  Injectable8(),
-  __metadata12("design:paramtypes", [typeof (_a8 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a8 : Object, typeof (_b6 = typeof UserService !== "undefined" && UserService) === "function" ? _b6 : Object, typeof (_c4 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _c4 : Object, typeof (_d2 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _d2 : Object, typeof (_e2 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _e2 : Object, typeof (_f2 = typeof I18nService2 !== "undefined" && I18nService2) === "function" ? _f2 : Object, typeof (_g2 = typeof EmailService !== "undefined" && EmailService) === "function" ? _g2 : Object, typeof (_h2 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _h2 : Object])
+__decorate17([
+  Transaction4(),
+  __metadata17("design:type", Function),
+  __metadata17("design:paramtypes", [Object]),
+  __metadata17("design:returntype", typeof (_l = typeof Promise !== "undefined" && Promise) === "function" ? _l : Object)
+], AuthService.prototype, "provisionWithCredentialSetup", null);
+AuthService = __decorate17([
+  Injectable11(),
+  __metadata17("design:paramtypes", [typeof (_a11 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a11 : Object, typeof (_b9 = typeof UserService !== "undefined" && UserService) === "function" ? _b9 : Object, typeof (_c7 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _c7 : Object, typeof (_d6 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _d6 : Object, typeof (_e4 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _e4 : Object, typeof (_f4 = typeof I18nService2 !== "undefined" && I18nService2) === "function" ? _f4 : Object, typeof (_g3 = typeof EmailService !== "undefined" && EmailService) === "function" ? _g3 : Object, typeof (_h2 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _h2 : Object, typeof (_j = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _j : Object, typeof (_k = typeof PasswordSetupService !== "undefined" && PasswordSetupService) === "function" ? _k : Object])
 ], AuthService);
 
 // src/auth/AuthGuard.ts
 import { Service as Service2, User } from "najm-core";
 import { createGuard } from "najm-guard";
-var __decorate13 = function(decorators, target, key, desc) {
+var __decorate18 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata13 = function(k, v) {
+var __metadata18 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param3 = function(paramIndex, decorator) {
@@ -2576,13 +3466,13 @@ var AuthGuard = class AuthGuard2 {
     return !!user;
   }
 };
-__decorate13([
+__decorate18([
   __param3(0, User()),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [Object]),
-  __metadata13("design:returntype", Boolean)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Boolean)
 ], AuthGuard.prototype, "canActivate", null);
-AuthGuard = __decorate13([
+AuthGuard = __decorate18([
   Service2()
 ], AuthGuard);
 var isAuth = createGuard(AuthGuard);
@@ -2591,13 +3481,13 @@ var isAuth = createGuard(AuthGuard);
 import { Service as Service3 } from "najm-core";
 import { GuardParams, Role as RequestRole } from "najm-core";
 import { composeGuards, createGuard as createGuard2 } from "najm-guard";
-var __decorate14 = function(decorators, target, key, desc) {
+var __decorate19 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata14 = function(k, v) {
+var __metadata19 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param4 = function(paramIndex, decorator) {
@@ -2620,14 +3510,14 @@ var RoleGuard = class RoleGuard2 {
     return false;
   }
 };
-__decorate14([
+__decorate19([
   __param4(0, GuardParams()),
   __param4(1, RequestRole()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object, String]),
-  __metadata14("design:returntype", void 0)
+  __metadata19("design:type", Function),
+  __metadata19("design:paramtypes", [Object, String]),
+  __metadata19("design:returntype", void 0)
 ], RoleGuard.prototype, "canActivate", null);
-RoleGuard = __decorate14([
+RoleGuard = __decorate19([
   Service3()
 ], RoleGuard);
 var Role = createGuard2(RoleGuard);
@@ -2637,7 +3527,23 @@ var isAdministrator = composeGuards(isAuth(), Role(ROLE_GROUPS.ADMINISTRATORS));
 // src/auth/AuthController.ts
 import { Validate } from "najm-validation";
 import { RateLimit } from "najm-rate";
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
+
+// src/identity/requestResolver.ts
+var CONTEXT_RESOLVER_KEY = "najm.auth.identityResolver";
+var defaultResolver2 = createIdentityResolver();
+function setRequestIdentityResolver(context, resolver) {
+  context.set(CONTEXT_RESOLVER_KEY, resolver);
+}
+__name(setRequestIdentityResolver, "setRequestIdentityResolver");
+function getRequestIdentityResolver(context) {
+  try {
+    return context.get(CONTEXT_RESOLVER_KEY) ?? defaultResolver2;
+  } catch {
+    return defaultResolver2;
+  }
+}
+__name(getRequestIdentityResolver, "getRequestIdentityResolver");
 
 // src/users/UserDto.ts
 import { z } from "zod";
@@ -2670,14 +3576,17 @@ var userIdParam = z.object({
   id: z.string().min(1, "User ID is required")
 });
 var identifierField = z.string().trim().min(1).max(254);
+var loginCredentialField = z.string().min(1, "Password is required").refine((v) => new TextEncoder().encode(v).length <= 72, "Password must be at most 72 bytes");
 var loginDto = z.union([
   z.object({
     identifier: identifierField,
-    password: passwordField
+    password: loginCredentialField,
+    rememberMe: z.boolean().optional()
   }),
   z.object({
     email: emailField,
-    password: passwordField
+    password: loginCredentialField,
+    rememberMe: z.boolean().optional()
   })
 ]);
 var changePasswordDto = z.object({
@@ -2710,13 +3619,13 @@ var userListQuery = z.object({
 });
 
 // src/auth/AuthController.ts
-var __decorate15 = function(decorators, target, key, desc) {
+var __decorate20 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata15 = function(k, v) {
+var __metadata20 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param5 = function(paramIndex, decorator) {
@@ -2724,8 +3633,8 @@ var __param5 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a9;
-var hashKeyPart = /* @__PURE__ */ __name((value) => createHash2("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
+var _a12;
+var hashKeyPart = /* @__PURE__ */ __name((value) => createHash3("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
 var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx) => {
   const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
   const cookie = ctx.req.raw.headers.get("cookie") ?? "";
@@ -2737,7 +3646,7 @@ var authIdentityRateLimitKey = /* @__PURE__ */ __name(async (ctx) => {
   try {
     const body = await ctx.req.json();
     const identity = body?.identifier ?? body?.email;
-    const normalizedIdentity = normalizeAuthIdentifier(identity);
+    const normalizedIdentity = getRequestIdentityResolver(ctx)(identity);
     if (normalizedIdentity) {
       return `${ip}:${hashKeyPart(normalizedIdentity)}`;
     }
@@ -2767,7 +3676,7 @@ var AuthController = class AuthController2 {
   }
   async recoverSession(recoveryRequest, ctx) {
     if (recoveryRequest !== "1") {
-      Err9("Invalid session recovery request", 400);
+      Err13("Invalid session recovery request", 400);
     }
     ctx.header("Cache-Control", "private, no-store");
     ctx.header("Vary", "Cookie");
@@ -2789,123 +3698,123 @@ var AuthController = class AuthController2 {
     return this.authService.resetPassword(body.token, body.newPassword);
   }
 };
-__decorate15([
+__decorate20([
   Post("/register"),
   RateLimit({ limit: 5, window: "15m", key: authIdentityRateLimitKey }),
   Validate(registerDto),
   ResMsg("auth.success.register"),
   __param5(0, Body()),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object]),
-  __metadata15("design:returntype", Promise)
+  __metadata20("design:type", Function),
+  __metadata20("design:paramtypes", [Object]),
+  __metadata20("design:returntype", Promise)
 ], AuthController.prototype, "registerUser", null);
-__decorate15([
+__decorate20([
   Post("/login"),
   RateLimit({ limit: 5, window: "15m", key: authIdentityRateLimitKey, message: "Too many login attempts. Please try again later." }),
   Validate(loginDto),
   ResMsg("auth.success.login"),
   __param5(0, Body()),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object]),
-  __metadata15("design:returntype", Promise)
+  __metadata20("design:type", Function),
+  __metadata20("design:paramtypes", [Object]),
+  __metadata20("design:returntype", Promise)
 ], AuthController.prototype, "loginUser", null);
-__decorate15([
+__decorate20([
   Post("/invite"),
   isAdmin(),
   RateLimit({ limit: 20, window: "15m", key: "user" }),
   Validate(inviteUserDto),
   ResMsg("auth.success.accountInviteSent"),
   __param5(0, Body()),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object]),
-  __metadata15("design:returntype", Promise)
+  __metadata20("design:type", Function),
+  __metadata20("design:paramtypes", [Object]),
+  __metadata20("design:returntype", Promise)
 ], AuthController.prototype, "inviteUser", null);
-__decorate15([
+__decorate20([
   Post("/refresh"),
   RateLimit({ limit: 15, window: "15m", key: cookieFingerprint() }),
   ResMsg("auth.success.tokenRefreshed"),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", []),
-  __metadata15("design:returntype", Promise)
+  __metadata20("design:type", Function),
+  __metadata20("design:paramtypes", []),
+  __metadata20("design:returntype", Promise)
 ], AuthController.prototype, "refreshTokens", null);
-__decorate15([
+__decorate20([
   Post("/session/recover"),
   RateLimit({ limit: 120, window: "1m", key: cookieFingerprint() }),
   ResMsg("auth.success.sessionRecovered"),
   __param5(0, Headers("x-najm-session-recovery")),
   __param5(1, Ctx()),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [String, Object]),
-  __metadata15("design:returntype", Promise)
+  __metadata20("design:type", Function),
+  __metadata20("design:paramtypes", [String, Object]),
+  __metadata20("design:returntype", Promise)
 ], AuthController.prototype, "recoverSession", null);
-__decorate15([
+__decorate20([
   Post("/logout"),
   isAuth(),
   RateLimit({ limit: 10, window: "15m", key: "user" }),
   __param5(0, User2("id")),
   __param5(1, Headers("authorization")),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [String, String]),
-  __metadata15("design:returntype", Promise)
+  __metadata20("design:type", Function),
+  __metadata20("design:paramtypes", [String, String]),
+  __metadata20("design:returntype", Promise)
 ], AuthController.prototype, "logoutUser", null);
-__decorate15([
+__decorate20([
   Post("/change-password"),
   isAuth(),
   Validate(changePasswordDto),
   ResMsg("auth.success.passwordChanged"),
   __param5(0, User2("id")),
   __param5(1, Body()),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [String, Object]),
-  __metadata15("design:returntype", Promise)
+  __metadata20("design:type", Function),
+  __metadata20("design:paramtypes", [String, Object]),
+  __metadata20("design:returntype", Promise)
 ], AuthController.prototype, "changePassword", null);
-__decorate15([
+__decorate20([
   Get("/me"),
   RateLimit({ limit: 30, window: "1m", key: cookieFingerprint() }),
   ResMsg("auth.users.success.retrieved"),
   __param5(0, Headers("authorization")),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [String]),
-  __metadata15("design:returntype", Promise)
+  __metadata20("design:type", Function),
+  __metadata20("design:paramtypes", [String]),
+  __metadata20("design:returntype", Promise)
 ], AuthController.prototype, "userProfile", null);
-__decorate15([
+__decorate20([
   Post("/forgot-password"),
   RateLimit({ limit: 3, window: "15m", key: authIdentityRateLimitKey, message: "Too many password reset requests. Please try again later." }),
   Validate(resetPasswordDto),
   ResMsg("auth.success.passwordResetSent"),
   __param5(0, Body()),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object]),
-  __metadata15("design:returntype", Promise)
+  __metadata20("design:type", Function),
+  __metadata20("design:paramtypes", [Object]),
+  __metadata20("design:returntype", Promise)
 ], AuthController.prototype, "forgotPassword", null);
-__decorate15([
+__decorate20([
   Post("/reset-password"),
   RateLimit({ limit: 5, window: "15m", key: "ip", message: "Too many password reset attempts. Please try again later." }),
   Validate(confirmResetPasswordDto),
   ResMsg("auth.success.passwordReset"),
   __param5(0, Body()),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object]),
-  __metadata15("design:returntype", Promise)
+  __metadata20("design:type", Function),
+  __metadata20("design:paramtypes", [Object]),
+  __metadata20("design:returntype", Promise)
 ], AuthController.prototype, "resetPassword", null);
-AuthController = __decorate15([
+AuthController = __decorate20([
   Controller("/auth"),
-  __metadata15("design:paramtypes", [typeof (_a9 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a9 : Object])
+  __metadata20("design:paramtypes", [typeof (_a12 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a12 : Object])
 ], AuthController);
 
 // src/auth/AuthResolver.ts
-import { APP, Container, DI, Inject as Inject9, LOGGER, Meta, Service as Service4 } from "najm-core";
+import { APP, Container, DI, Inject as Inject12, LOGGER, Meta, Service as Service4 } from "najm-core";
 import { USER, ROLE, PERMISSIONS } from "najm-guard";
-var __decorate16 = function(decorators, target, key, desc) {
+var __decorate21 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata16 = function(k, v) {
+var __metadata21 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a10;
+var _a13;
 var AuthResolver = class AuthResolver2 {
   static {
     __name(this, "AuthResolver");
@@ -3016,27 +3925,76 @@ var AuthResolver = class AuthResolver2 {
       await next();
     });
   }
-  async onReady() {
-    const authService = await this.container.resolve(AuthService);
-    await authService.warmupPasswordHash();
+  async onReady() {
+    const authService = await this.container.resolve(AuthService);
+    await authService.warmupPasswordHash();
+  }
+};
+__decorate21([
+  DI(),
+  __metadata21("design:type", typeof (_a13 = typeof Container !== "undefined" && Container) === "function" ? _a13 : Object)
+], AuthResolver.prototype, "container", void 0);
+__decorate21([
+  Inject12(APP),
+  __metadata21("design:type", Object)
+], AuthResolver.prototype, "app", void 0);
+__decorate21([
+  Inject12(LOGGER),
+  __metadata21("design:type", Object)
+], AuthResolver.prototype, "log", void 0);
+AuthResolver = __decorate21([
+  Service4(),
+  Meta({ layer: "plugin", order: 30 })
+], AuthResolver);
+
+// src/auth/AuthIdentityContextService.ts
+import { DI as DI2, Inject as Inject13, INJECTION_TYPES, Meta as Meta2, Service as Service5 } from "najm-core";
+var __decorate22 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata22 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param6 = function(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+};
+var AuthIdentityContextService = class AuthIdentityContextService2 {
+  static {
+    __name(this, "AuthIdentityContextService");
+  }
+  config;
+  container;
+  constructor(config) {
+    this.config = config;
+  }
+  async configure() {
+    this.container.setInjection({
+      type: INJECTION_TYPES.MIDDLEWARE,
+      scope: "global",
+      name: "auth-identity-context",
+      order: 14,
+      handler: /* @__PURE__ */ __name(async (context, next) => {
+        setRequestIdentityResolver(context, this.config.identity.resolve);
+        return next();
+      }, "handler")
+    });
   }
 };
-__decorate16([
-  DI(),
-  __metadata16("design:type", typeof (_a10 = typeof Container !== "undefined" && Container) === "function" ? _a10 : Object)
-], AuthResolver.prototype, "container", void 0);
-__decorate16([
-  Inject9(APP),
-  __metadata16("design:type", Object)
-], AuthResolver.prototype, "app", void 0);
-__decorate16([
-  Inject9(LOGGER),
-  __metadata16("design:type", Object)
-], AuthResolver.prototype, "log", void 0);
-AuthResolver = __decorate16([
-  Service4(),
-  Meta({ layer: "plugin", order: 30 })
-], AuthResolver);
+__decorate22([
+  DI2(),
+  __metadata22("design:type", Object)
+], AuthIdentityContextService.prototype, "container", void 0);
+AuthIdentityContextService = __decorate22([
+  Service5(),
+  Meta2({ layer: "plugin", order: 14 }),
+  __param6(0, Inject13(AUTH_CONFIG)),
+  __metadata22("design:paramtypes", [Object])
+], AuthIdentityContextService);
 
 // src/auth/runAsUser.ts
 import { randomUUID } from "crypto";
@@ -3069,7 +4027,8 @@ var AUTH_MODULE = [
   EncryptionService,
   AuthGuard,
   AuthController,
-  AuthResolver
+  AuthResolver,
+  AuthIdentityContextService
 ];
 
 // src/users/index.ts
@@ -3180,21 +4139,21 @@ var assignRoleDto = z2.object({
 });
 
 // src/roles/RoleController.ts
-var __decorate17 = function(decorators, target, key, desc) {
+var __decorate23 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata17 = function(k, v) {
+var __metadata23 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param6 = function(paramIndex, decorator) {
+var __param7 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
-var _a11;
+var _a14;
 var RoleController = class RoleController2 {
   static {
     __name(this, "RoleController");
@@ -3219,35 +4178,35 @@ var RoleController = class RoleController2 {
     return this.roleService.delete(params.id);
   }
 };
-__decorate17([
+__decorate23([
   Get2(),
   isAdmin(),
   ResMsg2("roles.success.retrieved"),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", []),
-  __metadata17("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", []),
+  __metadata23("design:returntype", Promise)
 ], RoleController.prototype, "getRoles", null);
-__decorate17([
+__decorate23([
   Get2("/:id"),
   isAdmin(),
   Validate2({ params: roleIdParam }),
   ResMsg2("roles.success.retrieved"),
-  __param6(0, Params()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __param7(0, Params()),
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], RoleController.prototype, "getRole", null);
-__decorate17([
+__decorate23([
   Post2(),
   isAdmin(),
   Validate2(createRoleDto),
   ResMsg2("roles.success.created"),
-  __param6(0, Body2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __param7(0, Body2()),
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], RoleController.prototype, "createRole", null);
-__decorate17([
+__decorate23([
   Put("/:id"),
   isAdmin(),
   Validate2({
@@ -3255,44 +4214,44 @@ __decorate17([
     body: updateRoleDto
   }),
   ResMsg2("roles.success.updated"),
-  __param6(0, Params()),
-  __param6(1, Body2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object, Object]),
-  __metadata17("design:returntype", Promise)
+  __param7(0, Params()),
+  __param7(1, Body2()),
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object, Object]),
+  __metadata23("design:returntype", Promise)
 ], RoleController.prototype, "updateRole", null);
-__decorate17([
+__decorate23([
   Delete("/:id"),
   isAdmin(),
   Validate2({ params: roleIdParam }),
   ResMsg2("roles.success.deleted"),
-  __param6(0, Params()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __param7(0, Params()),
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], RoleController.prototype, "deleteRole", null);
-RoleController = __decorate17([
+RoleController = __decorate23([
   Controller2("/roles"),
-  __metadata17("design:paramtypes", [typeof (_a11 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a11 : Object])
+  __metadata23("design:paramtypes", [typeof (_a14 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a14 : Object])
 ], RoleController);
 
 // src/users/UserController.ts
 import { Validate as Validate3 } from "najm-validation";
-var __decorate18 = function(decorators, target, key, desc) {
+var __decorate24 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata18 = function(k, v) {
+var __metadata24 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param7 = function(paramIndex, decorator) {
+var __param8 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
-var _a12;
+var _a15;
 var UserController = class UserController2 {
   static {
     __name(this, "UserController");
@@ -3339,75 +4298,75 @@ var UserController = class UserController2 {
     return this.userService.removeRole(params.userId);
   }
 };
-__decorate18([
+__decorate24([
   Get3(),
   isAdmin(),
   Validate3({ query: userListQuery }),
   ResMsg3("users.success.retrieved"),
-  __param7(0, Query()),
-  __metadata18("design:type", Function),
-  __metadata18("design:paramtypes", [Object]),
-  __metadata18("design:returntype", Promise)
+  __param8(0, Query()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object]),
+  __metadata24("design:returntype", Promise)
 ], UserController.prototype, "getUsers", null);
-__decorate18([
+__decorate24([
   Get3("/lang"),
   isAuth(),
   ResMsg3("users.success.retrieved"),
-  __metadata18("design:type", Function),
-  __metadata18("design:paramtypes", []),
-  __metadata18("design:returntype", Promise)
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", []),
+  __metadata24("design:returntype", Promise)
 ], UserController.prototype, "getLang", null);
-__decorate18([
+__decorate24([
   Post3("/lang/:language"),
   isAuth(),
   Validate3({ params: languageParam }),
   ResMsg3("users.success.updated"),
-  __param7(0, Params2()),
-  __metadata18("design:type", Function),
-  __metadata18("design:paramtypes", [Object]),
-  __metadata18("design:returntype", Promise)
+  __param8(0, Params2()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object]),
+  __metadata24("design:returntype", Promise)
 ], UserController.prototype, "updateLang", null);
-__decorate18([
+__decorate24([
   Get3("/:id"),
   isAdmin(),
   Validate3({ params: userIdParam }),
   ResMsg3("users.success.retrieved"),
-  __param7(0, Params2()),
-  __metadata18("design:type", Function),
-  __metadata18("design:paramtypes", [Object]),
-  __metadata18("design:returntype", Promise)
+  __param8(0, Params2()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object]),
+  __metadata24("design:returntype", Promise)
 ], UserController.prototype, "getUser", null);
-__decorate18([
+__decorate24([
   Get3("/email/:email"),
   isAdmin(),
   Validate3({ params: emailParam }),
   ResMsg3("users.success.retrieved"),
-  __param7(0, Params2()),
-  __metadata18("design:type", Function),
-  __metadata18("design:paramtypes", [Object]),
-  __metadata18("design:returntype", Promise)
+  __param8(0, Params2()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object]),
+  __metadata24("design:returntype", Promise)
 ], UserController.prototype, "getByEmail", null);
-__decorate18([
+__decorate24([
   Get3("/role/:userId"),
   isAdmin(),
   Validate3({ params: userIdInParam }),
   ResMsg3("users.success.retrieved"),
-  __param7(0, Params2()),
-  __metadata18("design:type", Function),
-  __metadata18("design:paramtypes", [Object]),
-  __metadata18("design:returntype", Promise)
+  __param8(0, Params2()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object]),
+  __metadata24("design:returntype", Promise)
 ], UserController.prototype, "getRole", null);
-__decorate18([
+__decorate24([
   Post3(),
   isAdmin(),
   Validate3(createUserDto),
   ResMsg3("users.success.created"),
-  __param7(0, Body3()),
-  __metadata18("design:type", Function),
-  __metadata18("design:paramtypes", [Object]),
-  __metadata18("design:returntype", Promise)
+  __param8(0, Body3()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object]),
+  __metadata24("design:returntype", Promise)
 ], UserController.prototype, "create", null);
-__decorate18([
+__decorate24([
   Put2("/:id"),
   isAdmin(),
   Validate3({
@@ -3415,53 +4374,53 @@ __decorate18([
     body: updateUserDto
   }),
   ResMsg3("users.success.updated"),
-  __param7(0, Params2()),
-  __param7(1, Body3()),
-  __metadata18("design:type", Function),
-  __metadata18("design:paramtypes", [Object, Object]),
-  __metadata18("design:returntype", Promise)
+  __param8(0, Params2()),
+  __param8(1, Body3()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object, Object]),
+  __metadata24("design:returntype", Promise)
 ], UserController.prototype, "update", null);
-__decorate18([
+__decorate24([
   Delete2("/:id"),
   isAdmin(),
   Validate3({ params: userIdParam }),
   ResMsg3("users.success.deleted"),
-  __param7(0, Params2()),
-  __metadata18("design:type", Function),
-  __metadata18("design:paramtypes", [Object]),
-  __metadata18("design:returntype", Promise)
+  __param8(0, Params2()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object]),
+  __metadata24("design:returntype", Promise)
 ], UserController.prototype, "delete", null);
-__decorate18([
+__decorate24([
   Delete2(),
   isAdmin(),
   ResMsg3("users.success.allDeleted"),
-  __metadata18("design:type", Function),
-  __metadata18("design:paramtypes", []),
-  __metadata18("design:returntype", Promise)
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", []),
+  __metadata24("design:returntype", Promise)
 ], UserController.prototype, "deleteAll", null);
-__decorate18([
+__decorate24([
   Post3("/assign/:userId/:roleId"),
   isAdmin(),
   Validate3({ params: assignRoleParams }),
   ResMsg3("users.success.updated"),
-  __param7(0, Params2()),
-  __metadata18("design:type", Function),
-  __metadata18("design:paramtypes", [Object]),
-  __metadata18("design:returntype", Promise)
+  __param8(0, Params2()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object]),
+  __metadata24("design:returntype", Promise)
 ], UserController.prototype, "assignRole", null);
-__decorate18([
+__decorate24([
   Delete2("/remove/:userId"),
   isAdmin(),
   Validate3({ params: userIdInParam }),
   ResMsg3("users.success.updated"),
-  __param7(0, Params2()),
-  __metadata18("design:type", Function),
-  __metadata18("design:paramtypes", [Object]),
-  __metadata18("design:returntype", Promise)
+  __param8(0, Params2()),
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object]),
+  __metadata24("design:returntype", Promise)
 ], UserController.prototype, "removeRole", null);
-UserController = __decorate18([
+UserController = __decorate24([
   Controller3("/users"),
-  __metadata18("design:paramtypes", [typeof (_a12 = typeof UserService !== "undefined" && UserService) === "function" ? _a12 : Object])
+  __metadata24("design:paramtypes", [typeof (_a15 = typeof UserService !== "undefined" && UserService) === "function" ? _a15 : Object])
 ], UserController);
 
 // src/permissions/index.ts
@@ -3481,16 +4440,16 @@ __export(permissions_exports, {
 });
 
 // src/permissions/PermissionRepository.ts
-import { eq as eq5, and as and2 } from "drizzle-orm";
-import { Repository as Repository4, Inject as Inject10 } from "najm-core";
-import { DB as DB4 } from "najm-database";
-var __decorate19 = function(decorators, target, key, desc) {
+import { eq as eq7, and as and4 } from "drizzle-orm";
+import { Repository as Repository6, Inject as Inject14 } from "najm-core";
+import { DB as DB6 } from "najm-database";
+var __decorate25 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata19 = function(k, v) {
+var __metadata25 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var PermissionRepository = class PermissionRepository2 {
@@ -3512,26 +4471,26 @@ var PermissionRepository = class PermissionRepository2 {
     return await this.db.select().from(this.permissions);
   }
   async getById(id) {
-    const [existingPermission] = await this.db.select().from(this.permissions).where(eq5(this.permissions.id, id));
+    const [existingPermission] = await this.db.select().from(this.permissions).where(eq7(this.permissions.id, id));
     return existingPermission;
   }
   async getByName(name) {
-    const [existingPermission] = await this.db.select().from(this.permissions).where(eq5(this.permissions.name, name));
+    const [existingPermission] = await this.db.select().from(this.permissions).where(eq7(this.permissions.name, name));
     return existingPermission;
   }
   async getByResource(resource) {
-    return await this.db.select().from(this.permissions).where(eq5(this.permissions.resource, resource));
+    return await this.db.select().from(this.permissions).where(eq7(this.permissions.resource, resource));
   }
   async create(data) {
     const [newPermission] = await this.db.insert(this.permissions).values(data).returning();
     return newPermission;
   }
   async update(id, data) {
-    const [updatedPermission] = await this.db.update(this.permissions).set(data).where(eq5(this.permissions.id, id)).returning();
+    const [updatedPermission] = await this.db.update(this.permissions).set(data).where(eq7(this.permissions.id, id)).returning();
     return updatedPermission;
   }
   async delete(id) {
-    const [deletedPermission] = await this.db.delete(this.permissions).where(eq5(this.permissions.id, id)).returning();
+    const [deletedPermission] = await this.db.delete(this.permissions).where(eq7(this.permissions.id, id)).returning();
     return deletedPermission;
   }
   async getPermissionsByRole(roleId) {
@@ -3541,25 +4500,25 @@ var PermissionRepository = class PermissionRepository2 {
       description: this.permissions.description,
       resource: this.permissions.resource,
       action: this.permissions.action
-    }).from(this.rolePermissions).leftJoin(this.permissions, eq5(this.rolePermissions.permissionId, this.permissions.id)).where(eq5(this.rolePermissions.roleId, roleId));
+    }).from(this.rolePermissions).leftJoin(this.permissions, eq7(this.rolePermissions.permissionId, this.permissions.id)).where(eq7(this.rolePermissions.roleId, roleId));
   }
   async getRolesByPermission(permissionId) {
     return await this.db.select({
       id: this.roles.id,
       name: this.roles.name,
       description: this.roles.description
-    }).from(this.rolePermissions).leftJoin(this.roles, eq5(this.rolePermissions.roleId, this.roles.id)).where(eq5(this.rolePermissions.permissionId, permissionId));
+    }).from(this.rolePermissions).leftJoin(this.roles, eq7(this.rolePermissions.roleId, this.roles.id)).where(eq7(this.rolePermissions.permissionId, permissionId));
   }
   async assignPermissionToRole(roleId, permissionId) {
     const [newRolePermission] = await this.db.insert(this.rolePermissions).values({ roleId, permissionId }).returning();
     return newRolePermission;
   }
   async removePermissionFromRole(roleId, permissionId) {
-    const [deletedRolePermission] = await this.db.delete(this.rolePermissions).where(and2(eq5(this.rolePermissions.roleId, roleId), eq5(this.rolePermissions.permissionId, permissionId))).returning();
+    const [deletedRolePermission] = await this.db.delete(this.rolePermissions).where(and4(eq7(this.rolePermissions.roleId, roleId), eq7(this.rolePermissions.permissionId, permissionId))).returning();
     return deletedRolePermission;
   }
   async checkRoleHasPermission(roleId, permissionId) {
-    const [rolePermission] = await this.db.select().from(this.rolePermissions).where(and2(eq5(this.rolePermissions.roleId, roleId), eq5(this.rolePermissions.permissionId, permissionId)));
+    const [rolePermission] = await this.db.select().from(this.rolePermissions).where(and4(eq7(this.rolePermissions.roleId, roleId), eq7(this.rolePermissions.permissionId, permissionId)));
     return !!rolePermission;
   }
   async deleteAll() {
@@ -3568,32 +4527,32 @@ var PermissionRepository = class PermissionRepository2 {
     return deletedPermissions;
   }
 };
-__decorate19([
-  DB4(),
-  __metadata19("design:type", Object)
+__decorate25([
+  DB6(),
+  __metadata25("design:type", Object)
 ], PermissionRepository.prototype, "db", void 0);
-__decorate19([
-  Inject10(AUTH_SCHEMA),
-  __metadata19("design:type", Object)
+__decorate25([
+  Inject14(AUTH_SCHEMA),
+  __metadata25("design:type", Object)
 ], PermissionRepository.prototype, "schema", void 0);
-PermissionRepository = __decorate19([
-  Repository4()
+PermissionRepository = __decorate25([
+  Repository6()
 ], PermissionRepository);
 
 // src/permissions/PermissionGuards.ts
-import { Injectable as Injectable9 } from "najm-core";
+import { Injectable as Injectable12 } from "najm-core";
 import { GuardParams as GuardParams2, User as User3 } from "najm-core";
 import { createGuard as createGuard4, composeGuards as composeGuards3 } from "najm-guard";
-var __decorate20 = function(decorators, target, key, desc) {
+var __decorate26 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata20 = function(k, v) {
+var __metadata26 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param8 = function(paramIndex, decorator) {
+var __param9 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
@@ -3626,15 +4585,15 @@ var PermissionGuard = class PermissionGuard2 {
     return false;
   }
 };
-__decorate20([
-  __param8(0, GuardParams2()),
-  __param8(1, User3("permissions")),
-  __metadata20("design:type", Function),
-  __metadata20("design:paramtypes", [String, Array]),
-  __metadata20("design:returntype", Object)
+__decorate26([
+  __param9(0, GuardParams2()),
+  __param9(1, User3("permissions")),
+  __metadata26("design:type", Function),
+  __metadata26("design:paramtypes", [String, Array]),
+  __metadata26("design:returntype", Object)
 ], PermissionGuard.prototype, "canActivate", null);
-PermissionGuard = __decorate20([
-  Injectable9()
+PermissionGuard = __decorate26([
+  Injectable12()
 ], PermissionGuard);
 var Permission = createGuard4(PermissionGuard);
 var Can = /* @__PURE__ */ __name((permission) => composeGuards3(isAuth(), Permission(permission))(), "Can");
@@ -3645,23 +4604,23 @@ import { Get as Get4, Post as Post4, Put as Put3, Delete as Delete3, ResMsg as R
 import { Params as Params3, Body as Body4 } from "najm-core";
 
 // src/permissions/PermissionService.ts
-import { Injectable as Injectable11 } from "najm-core";
+import { Injectable as Injectable14 } from "najm-core";
 
 // src/permissions/PermissionValidator.ts
-import { Injectable as Injectable10 } from "najm-core";
-import { I18n as I18n7 } from "najm-i18n";
-import { Err as Err10 } from "najm-core";
-var __decorate21 = function(decorators, target, key, desc) {
+import { Injectable as Injectable13 } from "najm-core";
+import { I18n as I18n9 } from "najm-i18n";
+import { Err as Err14 } from "najm-core";
+var __decorate27 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata21 = function(k, v) {
+var __metadata27 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a13;
-var _b7;
+var _a16;
+var _b10;
 var PermissionValidator = class PermissionValidator2 {
   static {
     __name(this, "PermissionValidator");
@@ -3679,7 +4638,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExists(id) {
     const permission = await this.permissionRepository.getById(id);
     if (!permission) {
-      Err10(this.t("errors.notFound"), 404);
+      Err14(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -3689,7 +4648,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExistsByName(name) {
     const permission = await this.permissionRepository.getByName(name);
     if (!permission) {
-      Err10(this.t("errors.notFound"), 404);
+      Err14(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -3701,7 +4660,7 @@ var PermissionValidator = class PermissionValidator2 {
       return;
     const existingPermission = await this.permissionRepository.getByName(name);
     if (existingPermission && existingPermission.id !== excludeId) {
-      Err10(this.t("errors.nameExists"), 409);
+      Err14(this.t("errors.nameExists"), 409);
     }
   }
   /**
@@ -3724,32 +4683,32 @@ var PermissionValidator = class PermissionValidator2 {
     await this.checkPermissionExists(permissionId);
     const hasPermission = await this.permissionRepository.checkRoleHasPermission(roleId, permissionId);
     if (hasPermission) {
-      Err10(this.t("errors.roleAlreadyHasPermission"), 409);
+      Err14(this.t("errors.roleAlreadyHasPermission"), 409);
     }
   }
 };
-__decorate21([
-  I18n7("permissions"),
-  __metadata21("design:type", Object)
+__decorate27([
+  I18n9("permissions"),
+  __metadata27("design:type", Object)
 ], PermissionValidator.prototype, "t", void 0);
-PermissionValidator = __decorate21([
-  Injectable10(),
-  __metadata21("design:paramtypes", [typeof (_a13 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a13 : Object, typeof (_b7 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b7 : Object])
+PermissionValidator = __decorate27([
+  Injectable13(),
+  __metadata27("design:paramtypes", [typeof (_a16 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a16 : Object, typeof (_b10 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b10 : Object])
 ], PermissionValidator);
 
 // src/permissions/PermissionService.ts
-var __decorate22 = function(decorators, target, key, desc) {
+var __decorate28 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata22 = function(k, v) {
+var __metadata28 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a14;
-var _b8;
-var _c5;
+var _a17;
+var _b11;
+var _c8;
 var PermissionService = class PermissionService2 {
   static {
     __name(this, "PermissionService");
@@ -3854,9 +4813,9 @@ var PermissionService = class PermissionService2 {
     return await this.permissionRepository.deleteAll();
   }
 };
-PermissionService = __decorate22([
-  Injectable11(),
-  __metadata22("design:paramtypes", [typeof (_a14 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a14 : Object, typeof (_b8 = typeof PermissionValidator !== "undefined" && PermissionValidator) === "function" ? _b8 : Object, typeof (_c5 = typeof RoleService !== "undefined" && RoleService) === "function" ? _c5 : Object])
+PermissionService = __decorate28([
+  Injectable14(),
+  __metadata28("design:paramtypes", [typeof (_a17 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a17 : Object, typeof (_b11 = typeof PermissionValidator !== "undefined" && PermissionValidator) === "function" ? _b11 : Object, typeof (_c8 = typeof RoleService !== "undefined" && RoleService) === "function" ? _c8 : Object])
 ], PermissionService);
 
 // src/permissions/PermissionController.ts
@@ -3889,21 +4848,21 @@ var checkPermissionDto = z3.object({
 });
 
 // src/permissions/PermissionController.ts
-var __decorate23 = function(decorators, target, key, desc) {
+var __decorate29 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata23 = function(k, v) {
+var __metadata29 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param9 = function(paramIndex, decorator) {
+var __param10 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
-var _a15;
+var _a18;
 var PermissionController = class PermissionController2 {
   static {
     __name(this, "PermissionController");
@@ -3949,101 +4908,101 @@ var PermissionController = class PermissionController2 {
     return this.permissionService.deleteAll();
   }
 };
-__decorate23([
+__decorate29([
   Get4(),
   ResMsg4("permissions.success.retrieved"),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", []),
-  __metadata23("design:returntype", Promise)
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", []),
+  __metadata29("design:returntype", Promise)
 ], PermissionController.prototype, "getPermissions", null);
-__decorate23([
+__decorate29([
   Get4("/:id"),
   Validate4({ params: permissionIdParam }),
   ResMsg4("permissions.success.retrieved"),
-  __param9(0, Params3()),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", [Object]),
-  __metadata23("design:returntype", Promise)
+  __param10(0, Params3()),
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", [Object]),
+  __metadata29("design:returntype", Promise)
 ], PermissionController.prototype, "getPermission", null);
-__decorate23([
+__decorate29([
   Post4(),
   Validate4(createPermissionDto),
   ResMsg4({ message: "Permission created successfully", status: 201 }),
-  __param9(0, Body4()),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", [Object]),
-  __metadata23("design:returntype", Promise)
+  __param10(0, Body4()),
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", [Object]),
+  __metadata29("design:returntype", Promise)
 ], PermissionController.prototype, "create", null);
-__decorate23([
+__decorate29([
   Put3("/:id"),
   Validate4({
     params: permissionIdParam,
     body: updatePermissionDto
   }),
   ResMsg4("permissions.success.updated"),
-  __param9(0, Params3()),
-  __param9(1, Body4()),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", [Object, Object]),
-  __metadata23("design:returntype", Promise)
+  __param10(0, Params3()),
+  __param10(1, Body4()),
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", [Object, Object]),
+  __metadata29("design:returntype", Promise)
 ], PermissionController.prototype, "update", null);
-__decorate23([
+__decorate29([
   Delete3("/:id"),
   Validate4({ params: permissionIdParam }),
   ResMsg4("permissions.success.deleted"),
-  __param9(0, Params3()),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", [Object]),
-  __metadata23("design:returntype", Promise)
+  __param10(0, Params3()),
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", [Object]),
+  __metadata29("design:returntype", Promise)
 ], PermissionController.prototype, "delete", null);
-__decorate23([
+__decorate29([
   Get4("/role/:id"),
   Validate4({ params: roleIdParam }),
   ResMsg4("permissions.success.retrieved"),
-  __param9(0, Params3()),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", [Object]),
-  __metadata23("design:returntype", Promise)
+  __param10(0, Params3()),
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", [Object]),
+  __metadata29("design:returntype", Promise)
 ], PermissionController.prototype, "getByRole", null);
-__decorate23([
+__decorate29([
   Get4("/roles/:id"),
   Validate4({ params: permissionIdParam }),
   ResMsg4("permissions.success.retrieved"),
-  __param9(0, Params3()),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", [Object]),
-  __metadata23("design:returntype", Promise)
+  __param10(0, Params3()),
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", [Object]),
+  __metadata29("design:returntype", Promise)
 ], PermissionController.prototype, "getRolesByPermission", null);
-__decorate23([
+__decorate29([
   Post4("/assign/:roleId/:permissionId"),
   Validate4({ params: assignPermissionDto }),
   ResMsg4("permissions.success.assigned"),
-  __param9(0, Params3()),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", [Object]),
-  __metadata23("design:returntype", Promise)
+  __param10(0, Params3()),
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", [Object]),
+  __metadata29("design:returntype", Promise)
 ], PermissionController.prototype, "assignToRole", null);
-__decorate23([
+__decorate29([
   Delete3("/remove/:roleId/:permissionId"),
   Validate4({ params: assignPermissionDto }),
   ResMsg4("permissions.success.removed"),
-  __param9(0, Params3()),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", [Object]),
-  __metadata23("design:returntype", Promise)
+  __param10(0, Params3()),
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", [Object]),
+  __metadata29("design:returntype", Promise)
 ], PermissionController.prototype, "removeFromRole", null);
-__decorate23([
+__decorate29([
   Delete3(),
   isAdmin(),
   ResMsg4("permissions.success.allDeleted"),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", []),
-  __metadata23("design:returntype", Promise)
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", []),
+  __metadata29("design:returntype", Promise)
 ], PermissionController.prototype, "deleteAll", null);
-PermissionController = __decorate23([
+PermissionController = __decorate29([
   Controller4("/permissions"),
   isAdmin(),
-  __metadata23("design:paramtypes", [typeof (_a15 = typeof PermissionService !== "undefined" && PermissionService) === "function" ? _a15 : Object])
+  __metadata29("design:paramtypes", [typeof (_a18 = typeof PermissionService !== "undefined" && PermissionService) === "function" ? _a18 : Object])
 ], PermissionController);
 
 // src/tokens/index.ts
@@ -4088,7 +5047,7 @@ var revokeTokenDto = z4.object({
 });
 
 // src/ownership/scopedOwnership.ts
-import { aliasedTable, eq as eq6, getTableColumns, sql as sql4 } from "drizzle-orm";
+import { aliasedTable, eq as eq8, getTableColumns, sql as sql4 } from "drizzle-orm";
 var DEFAULT_ADMIN_ROLES = ["admin"];
 var DRIZZLE_NAME = Symbol.for("drizzle:Name");
 var DRIZZLE_BASE_NAME = Symbol.for("drizzle:BaseName");
@@ -4175,8 +5134,8 @@ function compile(steps) {
   return (uid, query) => {
     let q = query;
     for (const j of joins)
-      q = q.innerJoin(j.table, eq6(j.left, j.right));
-    return { query: q, condition: eq6(owner.col, uid) };
+      q = q.innerJoin(j.table, eq8(j.left, j.right));
+    return { query: q, condition: eq8(owner.col, uid) };
   };
 }
 __name(compile, "compile");
@@ -4250,18 +5209,18 @@ function own(table, opts) {
 __name(own, "own");
 
 // src/ownership/configureOwnership.ts
-import { Injectable as Injectable12, Inject as Inject11, User as User4, Body as Body5, Params as Params4 } from "najm-core";
+import { Injectable as Injectable15, Inject as Inject15, User as User4, Body as Body5, Params as Params4 } from "najm-core";
 import { createGuard as createGuard5, composeGuards as composeGuards4 } from "najm-guard";
-var __decorate24 = function(decorators, target, key, desc) {
+var __decorate30 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata24 = function(k, v) {
+var __metadata30 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param10 = function(paramIndex, decorator) {
+var __param11 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
@@ -4278,7 +5237,7 @@ function toSingular(plural) {
 }
 __name(toSingular, "toSingular");
 function createResourceGuards(ownershipClass, resourceType, resource, options) {
-  var _a23, _b13;
+  var _a26, _b15;
   const writeGuard = options?.adminGuard ?? isAdmin;
   let AccessGuard = class AccessGuard {
     static {
@@ -4290,19 +5249,19 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
       return allowed ? { owner: user } : false;
     }
   };
-  __decorate24([
-    Inject11(ownershipClass),
-    __metadata24("design:type", Object)
+  __decorate30([
+    Inject15(ownershipClass),
+    __metadata30("design:type", Object)
   ], AccessGuard.prototype, "ownership", void 0);
-  __decorate24([
-    __param10(0, User4()),
-    __param10(1, Params4("id")),
-    __metadata24("design:type", Function),
-    __metadata24("design:paramtypes", [Object, String]),
-    __metadata24("design:returntype", typeof (_a23 = typeof Promise !== "undefined" && Promise) === "function" ? _a23 : Object)
+  __decorate30([
+    __param11(0, User4()),
+    __param11(1, Params4("id")),
+    __metadata30("design:type", Function),
+    __metadata30("design:paramtypes", [Object, String]),
+    __metadata30("design:returntype", typeof (_a26 = typeof Promise !== "undefined" && Promise) === "function" ? _a26 : Object)
   ], AccessGuard.prototype, "canActivate", null);
-  AccessGuard = __decorate24([
-    Injectable12()
+  AccessGuard = __decorate30([
+    Injectable15()
   ], AccessGuard);
   let ListGuard = class ListGuard {
     static {
@@ -4314,18 +5273,18 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
       return { filter: ids };
     }
   };
-  __decorate24([
-    Inject11(ownershipClass),
-    __metadata24("design:type", Object)
+  __decorate30([
+    Inject15(ownershipClass),
+    __metadata30("design:type", Object)
   ], ListGuard.prototype, "ownership", void 0);
-  __decorate24([
-    __param10(0, User4()),
-    __metadata24("design:type", Function),
-    __metadata24("design:paramtypes", [Object]),
-    __metadata24("design:returntype", typeof (_b13 = typeof Promise !== "undefined" && Promise) === "function" ? _b13 : Object)
+  __decorate30([
+    __param11(0, User4()),
+    __metadata30("design:type", Function),
+    __metadata30("design:paramtypes", [Object]),
+    __metadata30("design:returntype", typeof (_b15 = typeof Promise !== "undefined" && Promise) === "function" ? _b15 : Object)
   ], ListGuard.prototype, "canActivate", null);
-  ListGuard = __decorate24([
-    Injectable12()
+  ListGuard = __decorate30([
+    Injectable15()
   ], ListGuard);
   const access = createGuard5(AccessGuard);
   const list = createGuard5(ListGuard);
@@ -4456,11 +5415,11 @@ function configureOwnership(config) {
       }
     }
   };
-  GeneratedOwnershipService = __decorate24([
-    Injectable12()
+  GeneratedOwnershipService = __decorate30([
+    Injectable15()
   ], GeneratedOwnershipService);
   function bodyGuard(resourceType, bodyField, optional = false) {
-    var _a23;
+    var _a26;
     let BodyAccessGuard = class BodyAccessGuard {
       static {
         __name(this, "BodyAccessGuard");
@@ -4473,19 +5432,19 @@ function configureOwnership(config) {
         return this.ownership.canAccess(user, resourceType, id);
       }
     };
-    __decorate24([
-      Inject11(GeneratedOwnershipService),
-      __metadata24("design:type", GeneratedOwnershipService)
+    __decorate30([
+      Inject15(GeneratedOwnershipService),
+      __metadata30("design:type", GeneratedOwnershipService)
     ], BodyAccessGuard.prototype, "ownership", void 0);
-    __decorate24([
-      __param10(0, User4()),
-      __param10(1, Body5()),
-      __metadata24("design:type", Function),
-      __metadata24("design:paramtypes", [Object, Object]),
-      __metadata24("design:returntype", typeof (_a23 = typeof Promise !== "undefined" && Promise) === "function" ? _a23 : Object)
+    __decorate30([
+      __param11(0, User4()),
+      __param11(1, Body5()),
+      __metadata30("design:type", Function),
+      __metadata30("design:paramtypes", [Object, Object]),
+      __metadata30("design:returntype", typeof (_a26 = typeof Promise !== "undefined" && Promise) === "function" ? _a26 : Object)
     ], BodyAccessGuard.prototype, "canActivate", null);
-    BodyAccessGuard = __decorate24([
-      Injectable12()
+    BodyAccessGuard = __decorate30([
+      Injectable15()
     ], BodyAccessGuard);
     return createGuard5(BodyAccessGuard);
   }
@@ -4599,19 +5558,19 @@ __name(Policy, "Policy");
 
 // src/ownership/OwnedDecorator.ts
 import "reflect-metadata";
-import { sql as sql5, and as and3 } from "drizzle-orm";
-import { Injectable as Injectable13, Inject as Inject12, DI as DI2, Container as Container2, REQUEST_ID } from "najm-core";
+import { sql as sql5, and as and5 } from "drizzle-orm";
+import { Injectable as Injectable16, Inject as Inject16, DI as DI3, Container as Container2, REQUEST_ID } from "najm-core";
 import { USER as USER2 } from "najm-guard";
-var __decorate25 = function(decorators, target, key, desc) {
+var __decorate31 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata25 = function(k, v) {
+var __metadata31 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a16;
+var _a19;
 var OWNED_META = Symbol.for("najm:owned");
 var ScopeContext = class ScopeContext2 {
   static {
@@ -4643,18 +5602,18 @@ var ScopeContext = class ScopeContext2 {
     }
   }
 };
-__decorate25([
-  DI2(),
-  __metadata25("design:type", typeof (_a16 = typeof Container2 !== "undefined" && Container2) === "function" ? _a16 : Object)
+__decorate31([
+  DI3(),
+  __metadata31("design:type", typeof (_a19 = typeof Container2 !== "undefined" && Container2) === "function" ? _a19 : Object)
 ], ScopeContext.prototype, "container", void 0);
-ScopeContext = __decorate25([
-  Injectable13()
+ScopeContext = __decorate31([
+  Injectable16()
 ], ScopeContext);
 function Owned(token) {
   return function(target) {
     Reflect.defineMetadata(OWNED_META, token, target);
     const proto = target.prototype;
-    Inject12(ScopeContext)(proto, "_scopeCtx");
+    Inject16(ScopeContext)(proto, "_scopeCtx");
     function getUser(self) {
       return self._scopeCtx?.getUser() ?? null;
     }
@@ -4669,7 +5628,7 @@ function Owned(token) {
         return null;
       if (filtered.length === 1)
         return filtered[0];
-      return and3(...filtered);
+      return and5(...filtered);
     }
     __name(combineConditions, "combineConditions");
     function applyQueryOptions(query, opts = {}, whereCondition) {
@@ -4762,7 +5721,15 @@ var en_default = {
       oauthProviderAccountLinked: "This Google account is already linked.",
       oauthSignupDisabled: "Registration with Google is disabled.",
       oauthHostedDomainDenied: "This Google Workspace domain is not allowed.",
-      oauthLinkSessionExpired: "Your session changed before Google could be linked. Please try again."
+      oauthLinkSessionExpired: "Your session changed before Google could be linked. Please try again.",
+      oauthCredentialSetupRequired: "Set a new password before signing in with Google.",
+      credentialSetupRequired: "Set a new password before continuing.",
+      credentialSetupSessionRequired: "Credential setup session is required.",
+      credentialSetupSessionInvalid: "Credential setup session is invalid or expired.",
+      credentialSetupAlreadyCompleted: "The password was already replaced. Please sign in again.",
+      credentialSetupPasswordRejected: "Choose a different password.",
+      credentialSetupTemporaryShape: "Choose a password that is not your temporary credential.",
+      credentialSetupSamePassword: "Choose a password different from your current one."
     },
     success: {
       login: "Login successful",
@@ -4775,7 +5742,10 @@ var en_default = {
       tokenRefreshed: "Token refreshed successfully",
       sessionRecovered: "Session recovered successfully",
       oauthLogin: "Google sign-in successful",
-      oauthLinked: "Google account linked successfully"
+      oauthLinked: "Google account linked successfully",
+      credentialSetupPending: "Password setup is required",
+      credentialSetupPasswordReplaced: "Password set successfully",
+      credentialSetupCancelled: "Password setup cancelled"
     },
     emails: {
       passwordReset: {
@@ -4791,6 +5761,7 @@ var en_default = {
       notFound: "User not found",
       idExists: "User ID already exists",
       emailRequired: "Email is required",
+      phoneExists: "Phone number already registered",
       passwordRequired: "Password is required",
       invalidEmail: "Invalid email format",
       weakPassword: "Password is too weak",
@@ -4852,7 +5823,7 @@ __name(getAuthLocale, "getAuthLocale");
 var AUTH_SUPPORTED_LANGUAGES = Object.keys(AUTH_LOCALES);
 
 // src/oauth/google/GoogleOAuthProvider.ts
-import { Inject as Inject14, Injectable as Injectable15 } from "najm-core";
+import { Inject as Inject18, Injectable as Injectable18 } from "najm-core";
 
 // src/oauth/types.ts
 var OAuthFlowError = class extends Error {
@@ -4870,15 +5841,15 @@ var OAuthFlowError = class extends Error {
 };
 
 // src/oauth/google/GoogleTokenVerifier.ts
-import { Inject as Inject13, Injectable as Injectable14 } from "najm-core";
+import { Inject as Inject17, Injectable as Injectable17 } from "najm-core";
 import { createRemoteJWKSet, jwtVerify } from "jose";
-var __decorate26 = function(decorators, target, key, desc) {
+var __decorate32 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata26 = function(k, v) {
+var __metadata32 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var GOOGLE_JWKS = createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
@@ -4930,25 +5901,25 @@ var GoogleTokenVerifier = class GoogleTokenVerifier2 {
     return google;
   }
 };
-__decorate26([
-  Inject13(AUTH_CONFIG),
-  __metadata26("design:type", Object)
+__decorate32([
+  Inject17(AUTH_CONFIG),
+  __metadata32("design:type", Object)
 ], GoogleTokenVerifier.prototype, "config", void 0);
-GoogleTokenVerifier = __decorate26([
-  Injectable14()
+GoogleTokenVerifier = __decorate32([
+  Injectable17()
 ], GoogleTokenVerifier);
 
 // src/oauth/google/GoogleOAuthProvider.ts
-var __decorate27 = function(decorators, target, key, desc) {
+var __decorate33 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata27 = function(k, v) {
+var __metadata33 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a17;
+var _a20;
 var AUTHORIZATION_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
 var TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
 var GoogleOAuthProvider = class GoogleOAuthProvider2 {
@@ -5015,27 +5986,27 @@ var GoogleOAuthProvider = class GoogleOAuthProvider2 {
       throw new OAuthFlowError("oauth_provider_disabled", 404);
     return google;
   }
-};
-__decorate27([
-  Inject14(AUTH_CONFIG),
-  __metadata27("design:type", Object)
+};
+__decorate33([
+  Inject18(AUTH_CONFIG),
+  __metadata33("design:type", Object)
 ], GoogleOAuthProvider.prototype, "config", void 0);
-GoogleOAuthProvider = __decorate27([
-  Injectable15(),
-  __metadata27("design:paramtypes", [typeof (_a17 = typeof GoogleTokenVerifier !== "undefined" && GoogleTokenVerifier) === "function" ? _a17 : Object])
+GoogleOAuthProvider = __decorate33([
+  Injectable18(),
+  __metadata33("design:paramtypes", [typeof (_a20 = typeof GoogleTokenVerifier !== "undefined" && GoogleTokenVerifier) === "function" ? _a20 : Object])
 ], GoogleOAuthProvider);
 
 // src/oauth/OAuthAccountRepository.ts
-import { and as and4, eq as eq7 } from "drizzle-orm";
-import { Inject as Inject15, Repository as Repository5 } from "najm-core";
-import { DB as DB5 } from "najm-database";
-var __decorate28 = function(decorators, target, key, desc) {
+import { and as and6, eq as eq9 } from "drizzle-orm";
+import { Inject as Inject19, Repository as Repository7 } from "najm-core";
+import { DB as DB7 } from "najm-database";
+var __decorate34 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata28 = function(k, v) {
+var __metadata34 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var OAuthAccountRepository = class OAuthAccountRepository2 {
@@ -5051,11 +6022,11 @@ var OAuthAccountRepository = class OAuthAccountRepository2 {
     return this.schema.oauthAccounts;
   }
   async getByProviderAccount(provider, providerAccountId) {
-    const [account] = await this.db.select().from(this.accounts).where(and4(eq7(this.accounts.provider, provider), eq7(this.accounts.providerAccountId, providerAccountId))).limit(1);
+    const [account] = await this.db.select().from(this.accounts).where(and6(eq9(this.accounts.provider, provider), eq9(this.accounts.providerAccountId, providerAccountId))).limit(1);
     return account;
   }
   async getByUserProvider(userId, provider) {
-    const [account] = await this.db.select().from(this.accounts).where(and4(eq7(this.accounts.userId, userId), eq7(this.accounts.provider, provider))).limit(1);
+    const [account] = await this.db.select().from(this.accounts).where(and6(eq9(this.accounts.userId, userId), eq9(this.accounts.provider, provider))).limit(1);
     return account;
   }
   async create(data) {
@@ -5063,35 +6034,35 @@ var OAuthAccountRepository = class OAuthAccountRepository2 {
     return account;
   }
 };
-__decorate28([
-  DB5(),
-  __metadata28("design:type", Object)
+__decorate34([
+  DB7(),
+  __metadata34("design:type", Object)
 ], OAuthAccountRepository.prototype, "db", void 0);
-__decorate28([
-  Inject15(AUTH_SCHEMA),
-  __metadata28("design:type", Object)
+__decorate34([
+  Inject19(AUTH_SCHEMA),
+  __metadata34("design:type", Object)
 ], OAuthAccountRepository.prototype, "schema", void 0);
-OAuthAccountRepository = __decorate28([
-  Repository5()
+OAuthAccountRepository = __decorate34([
+  Repository7()
 ], OAuthAccountRepository);
 
 // src/oauth/OAuthAccountService.ts
-import { randomBytes as randomBytes2 } from "crypto";
-import { Inject as Inject16, Injectable as Injectable16 } from "najm-core";
-import { Transaction as Transaction2 } from "najm-database";
-var __decorate29 = function(decorators, target, key, desc) {
+import { randomBytes as randomBytes3 } from "crypto";
+import { Inject as Inject20, Injectable as Injectable19 } from "najm-core";
+import { Transaction as Transaction5 } from "najm-database";
+var __decorate35 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata29 = function(k, v) {
+var __metadata35 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a18;
-var _b9;
-var _c6;
-var _d3;
+var _a21;
+var _b12;
+var _c9;
+var _d7;
 var OAuthAccountService = class OAuthAccountService2 {
   static {
     __name(this, "OAuthAccountService");
@@ -5118,7 +6089,7 @@ var OAuthAccountService = class OAuthAccountService2 {
     if (!this.googleConfig().allowSignup) {
       throw new OAuthFlowError("oauth_signup_disabled", 403);
     }
-    const password = `${randomBytes2(32).toString("base64url")}Aa1`;
+    const password = `${randomBytes3(32).toString("base64url")}Aa1`;
     const user = await this.users.create({
       name: identity.name,
       email: identity.email,
@@ -5167,50 +6138,50 @@ var OAuthAccountService = class OAuthAccountService2 {
     return google;
   }
 };
-__decorate29([
-  Inject16(AUTH_CONFIG),
-  __metadata29("design:type", Object)
+__decorate35([
+  Inject20(AUTH_CONFIG),
+  __metadata35("design:type", Object)
 ], OAuthAccountService.prototype, "config", void 0);
-__decorate29([
-  Transaction2(),
-  __metadata29("design:type", Function),
-  __metadata29("design:paramtypes", [Object]),
-  __metadata29("design:returntype", typeof (_c6 = typeof Promise !== "undefined" && Promise) === "function" ? _c6 : Object)
+__decorate35([
+  Transaction5(),
+  __metadata35("design:type", Function),
+  __metadata35("design:paramtypes", [Object]),
+  __metadata35("design:returntype", typeof (_c9 = typeof Promise !== "undefined" && Promise) === "function" ? _c9 : Object)
 ], OAuthAccountService.prototype, "resolveForLogin", null);
-__decorate29([
-  Transaction2(),
-  __metadata29("design:type", Function),
-  __metadata29("design:paramtypes", [String, Object]),
-  __metadata29("design:returntype", typeof (_d3 = typeof Promise !== "undefined" && Promise) === "function" ? _d3 : Object)
+__decorate35([
+  Transaction5(),
+  __metadata35("design:type", Function),
+  __metadata35("design:paramtypes", [String, Object]),
+  __metadata35("design:returntype", typeof (_d7 = typeof Promise !== "undefined" && Promise) === "function" ? _d7 : Object)
 ], OAuthAccountService.prototype, "linkUser", null);
-OAuthAccountService = __decorate29([
-  Injectable16(),
-  __metadata29("design:paramtypes", [typeof (_a18 = typeof OAuthAccountRepository !== "undefined" && OAuthAccountRepository) === "function" ? _a18 : Object, typeof (_b9 = typeof UserService !== "undefined" && UserService) === "function" ? _b9 : Object])
+OAuthAccountService = __decorate35([
+  Injectable19(),
+  __metadata35("design:paramtypes", [typeof (_a21 = typeof OAuthAccountRepository !== "undefined" && OAuthAccountRepository) === "function" ? _a21 : Object, typeof (_b12 = typeof UserService !== "undefined" && UserService) === "function" ? _b12 : Object])
 ], OAuthAccountService);
 
 // src/oauth/OAuthController.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { Controller as Controller5, Ctx as Ctx2, Get as Get5, Post as Post5, Query as Query2, User as User5 } from "najm-core";
 import { RateLimit as RateLimit2 } from "najm-rate";
 
 // src/oauth/OAuthService.ts
-import { Inject as Inject17, Injectable as Injectable18, Log as Log2 } from "najm-core";
+import { Inject as Inject21, Injectable as Injectable21, Log as Log2 } from "najm-core";
 
 // src/oauth/OAuthStateService.ts
-import { createHash as createHash3, randomBytes as randomBytes3, timingSafeEqual } from "crypto";
-import { Injectable as Injectable17 } from "najm-core";
-import { CookieService as CookieService2 } from "najm-cookies";
-var __decorate30 = function(decorators, target, key, desc) {
+import { createHash as createHash4, randomBytes as randomBytes4, timingSafeEqual } from "crypto";
+import { Injectable as Injectable20 } from "najm-core";
+import { CookieService as CookieService3 } from "najm-cookies";
+var __decorate36 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata30 = function(k, v) {
+var __metadata36 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a19;
-var _b10;
+var _a22;
+var _b13;
 var ATTEMPT_TTL_MS = 10 * 60 * 1e3;
 var COOKIE_PREFIX = "najm.oauth.google.";
 var OAuthStateService = class OAuthStateService2 {
@@ -5224,13 +6195,13 @@ var OAuthStateService = class OAuthStateService2 {
     this.encryption = encryption;
   }
   create(input) {
-    const state = randomBytes3(32).toString("base64url");
-    const codeVerifier = randomBytes3(48).toString("base64url");
+    const state = randomBytes4(32).toString("base64url");
+    const codeVerifier = randomBytes4(48).toString("base64url");
     const attempt = {
       provider: "google",
       intent: input.intent,
       state,
-      nonce: randomBytes3(32).toString("base64url"),
+      nonce: randomBytes4(32).toString("base64url"),
       codeVerifier,
       returnTo: this.validateReturnTo(input.returnTo),
       userId: input.userId,
@@ -5245,7 +6216,7 @@ var OAuthStateService = class OAuthStateService2 {
     });
     return {
       attempt,
-      codeChallenge: createHash3("sha256").update(codeVerifier).digest("base64url")
+      codeChallenge: createHash4("sha256").update(codeVerifier).digest("base64url")
     };
   }
   consume(state) {
@@ -5299,27 +6270,28 @@ var OAuthStateService = class OAuthStateService2 {
     return /^[A-Za-z0-9_-]{40,128}$/.test(state);
   }
 };
-OAuthStateService = __decorate30([
-  Injectable17(),
-  __metadata30("design:paramtypes", [typeof (_a19 = typeof CookieService2 !== "undefined" && CookieService2) === "function" ? _a19 : Object, typeof (_b10 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _b10 : Object])
+OAuthStateService = __decorate36([
+  Injectable20(),
+  __metadata36("design:paramtypes", [typeof (_a22 = typeof CookieService3 !== "undefined" && CookieService3) === "function" ? _a22 : Object, typeof (_b13 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _b13 : Object])
 ], OAuthStateService);
 
 // src/oauth/OAuthService.ts
-var __decorate31 = function(decorators, target, key, desc) {
+var __decorate37 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata31 = function(k, v) {
+var __metadata37 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a20;
-var _b11;
-var _c7;
-var _d4;
-var _e3;
-var _f3;
+var _a23;
+var _b14;
+var _c10;
+var _d8;
+var _e5;
+var _f5;
+var _g4;
 var OAuthService = class OAuthService2 {
   static {
     __name(this, "OAuthService");
@@ -5330,15 +6302,17 @@ var OAuthService = class OAuthService2 {
   sessions;
   tokens;
   users;
+  requirements;
   config;
   logger;
-  constructor(state, google, accounts, sessions, tokens, users) {
+  constructor(state, google, accounts, sessions, tokens, users, requirements) {
     this.state = state;
     this.google = google;
     this.accounts = accounts;
     this.sessions = sessions;
     this.tokens = tokens;
     this.users = users;
+    this.requirements = requirements;
   }
   startGoogleLogin(returnTo) {
     this.googleConfig();
@@ -5382,6 +6356,9 @@ var OAuthService = class OAuthService2 {
         await this.accounts.linkUser(attempt.userId, identity);
       } else {
         const user = await this.accounts.resolveForLogin(identity);
+        if (await this.requirements?.isRequired(user.id, PASSWORD_SETUP_PURPOSE)) {
+          throw new OAuthFlowError(CREDENTIAL_SETUP_CODES.OAUTH_BLOCKED, 403);
+        }
         await this.sessions.establish(user);
       }
       return this.frontendSuccessUrl(attempt.returnTo, attempt.intent);
@@ -5419,39 +6396,39 @@ var OAuthService = class OAuthService2 {
     return google;
   }
 };
-__decorate31([
-  Inject17(AUTH_CONFIG),
-  __metadata31("design:type", Object)
+__decorate37([
+  Inject21(AUTH_CONFIG),
+  __metadata37("design:type", Object)
 ], OAuthService.prototype, "config", void 0);
-__decorate31([
+__decorate37([
   Log2(),
-  __metadata31("design:type", Object)
+  __metadata37("design:type", Object)
 ], OAuthService.prototype, "logger", void 0);
-OAuthService = __decorate31([
-  Injectable18(),
-  __metadata31("design:paramtypes", [typeof (_a20 = typeof OAuthStateService !== "undefined" && OAuthStateService) === "function" ? _a20 : Object, typeof (_b11 = typeof GoogleOAuthProvider !== "undefined" && GoogleOAuthProvider) === "function" ? _b11 : Object, typeof (_c7 = typeof OAuthAccountService !== "undefined" && OAuthAccountService) === "function" ? _c7 : Object, typeof (_d4 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _d4 : Object, typeof (_e3 = typeof TokenService !== "undefined" && TokenService) === "function" ? _e3 : Object, typeof (_f3 = typeof UserService !== "undefined" && UserService) === "function" ? _f3 : Object])
+OAuthService = __decorate37([
+  Injectable21(),
+  __metadata37("design:paramtypes", [typeof (_a23 = typeof OAuthStateService !== "undefined" && OAuthStateService) === "function" ? _a23 : Object, typeof (_b14 = typeof GoogleOAuthProvider !== "undefined" && GoogleOAuthProvider) === "function" ? _b14 : Object, typeof (_c10 = typeof OAuthAccountService !== "undefined" && OAuthAccountService) === "function" ? _c10 : Object, typeof (_d8 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _d8 : Object, typeof (_e5 = typeof TokenService !== "undefined" && TokenService) === "function" ? _e5 : Object, typeof (_f5 = typeof UserService !== "undefined" && UserService) === "function" ? _f5 : Object, typeof (_g4 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _g4 : Object])
 ], OAuthService);
 
 // src/oauth/OAuthController.ts
-var __decorate32 = function(decorators, target, key, desc) {
+var __decorate38 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata32 = function(k, v) {
+var __metadata38 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param11 = function(paramIndex, decorator) {
+var __param12 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
-var _a21;
+var _a24;
 var callbackKey = /* @__PURE__ */ __name((ctx) => {
   const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
   const state = ctx.req.query("state") ?? "none";
-  const fingerprint = createHash4("sha256").update(state).digest("base64url").slice(0, 24);
+  const fingerprint = createHash5("sha256").update(state).digest("base64url").slice(0, 24);
   return `${ip}:${fingerprint}`;
 }, "callbackKey");
 var OAuthController = class OAuthController2 {
@@ -5473,39 +6450,39 @@ var OAuthController = class OAuthController2 {
     return this.oauth.startGoogleLink(userId, returnTo);
   }
 };
-__decorate32([
+__decorate38([
   Get5("/start"),
   RateLimit2({ limit: 20, window: "15m", key: "ip" }),
-  __param11(0, Ctx2()),
-  __param11(1, Query2("returnTo")),
-  __metadata32("design:type", Function),
-  __metadata32("design:paramtypes", [Object, String]),
-  __metadata32("design:returntype", void 0)
+  __param12(0, Ctx2()),
+  __param12(1, Query2("returnTo")),
+  __metadata38("design:type", Function),
+  __metadata38("design:paramtypes", [Object, String]),
+  __metadata38("design:returntype", void 0)
 ], OAuthController.prototype, "start", null);
-__decorate32([
+__decorate38([
   Get5("/callback"),
   RateLimit2({ limit: 20, window: "15m", key: callbackKey }),
-  __param11(0, Ctx2()),
-  __param11(1, Query2("code")),
-  __param11(2, Query2("state")),
-  __param11(3, Query2("error")),
-  __metadata32("design:type", Function),
-  __metadata32("design:paramtypes", [Object, String, String, String]),
-  __metadata32("design:returntype", Promise)
+  __param12(0, Ctx2()),
+  __param12(1, Query2("code")),
+  __param12(2, Query2("state")),
+  __param12(3, Query2("error")),
+  __metadata38("design:type", Function),
+  __metadata38("design:paramtypes", [Object, String, String, String]),
+  __metadata38("design:returntype", Promise)
 ], OAuthController.prototype, "callback", null);
-__decorate32([
+__decorate38([
   Post5("/link"),
   isAuth(),
   RateLimit2({ limit: 10, window: "15m", key: "user" }),
-  __param11(0, User5("id")),
-  __param11(1, Query2("returnTo")),
-  __metadata32("design:type", Function),
-  __metadata32("design:paramtypes", [String, String]),
-  __metadata32("design:returntype", void 0)
+  __param12(0, User5("id")),
+  __param12(1, Query2("returnTo")),
+  __metadata38("design:type", Function),
+  __metadata38("design:paramtypes", [String, String]),
+  __metadata38("design:returntype", void 0)
 ], OAuthController.prototype, "link", null);
-OAuthController = __decorate32([
+OAuthController = __decorate38([
   Controller5("/auth/oauth/google"),
-  __metadata32("design:paramtypes", [typeof (_a21 = typeof OAuthService !== "undefined" && OAuthService) === "function" ? _a21 : Object])
+  __metadata38("design:paramtypes", [typeof (_a24 = typeof OAuthService !== "undefined" && OAuthService) === "function" ? _a24 : Object])
 ], OAuthController);
 
 // src/oauth/index.ts
@@ -5519,250 +6496,91 @@ var OAUTH_MODULE = [
   OAuthController
 ];
 
-// src/credentialSetup/CredentialSetupRepository.ts
-import { and as and5, eq as eq8, gt, isNull as isNull2, lt as lt2 } from "drizzle-orm";
-import { Err as Err11, Inject as Inject18, Repository as Repository6 } from "najm-core";
-import { DB as DB6 } from "najm-database";
-var __decorate33 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata33 = function(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var CredentialSetupRepository = class CredentialSetupRepository2 {
-  static {
-    __name(this, "CredentialSetupRepository");
-  }
-  db;
-  schema;
-  get sessions() {
-    const sessions = this.schema.credentialSetupSessions;
-    if (!sessions) {
-      Err11.invalidOperation("auth.schema.credentialSetupSessions is required to use CredentialSetupService");
-    }
-    return sessions;
-  }
-  async replaceActive(data) {
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    await this.db.update(this.sessions).set({ revokedAt: now, updatedAt: now }).where(and5(eq8(this.sessions.userId, data.userId), eq8(this.sessions.purpose, data.purpose), isNull2(this.sessions.consumedAt), isNull2(this.sessions.revokedAt)));
-    const [session] = await this.db.insert(this.sessions).values(data).returning({
-      userId: this.sessions.userId,
-      purpose: this.sessions.purpose,
-      expiresAt: this.sessions.expiresAt
-    });
-    return session;
-  }
-  async findActive(tokenHash, purpose) {
-    const [session] = await this.db.select({
-      userId: this.sessions.userId,
-      purpose: this.sessions.purpose,
-      expiresAt: this.sessions.expiresAt
-    }).from(this.sessions).where(and5(eq8(this.sessions.tokenHash, tokenHash), eq8(this.sessions.purpose, purpose), isNull2(this.sessions.consumedAt), isNull2(this.sessions.revokedAt), gt(this.sessions.expiresAt, (/* @__PURE__ */ new Date()).toISOString()))).limit(1);
-    return session;
-  }
-  async consume(tokenHash, purpose) {
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const [session] = await this.db.update(this.sessions).set({ consumedAt: now, updatedAt: now }).where(and5(eq8(this.sessions.tokenHash, tokenHash), eq8(this.sessions.purpose, purpose), isNull2(this.sessions.consumedAt), isNull2(this.sessions.revokedAt), gt(this.sessions.expiresAt, now))).returning({
-      userId: this.sessions.userId,
-      purpose: this.sessions.purpose,
-      expiresAt: this.sessions.expiresAt
-    });
-    return session;
-  }
-  async revoke(tokenHash, purpose) {
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const [session] = await this.db.update(this.sessions).set({ revokedAt: now, updatedAt: now }).where(and5(eq8(this.sessions.tokenHash, tokenHash), eq8(this.sessions.purpose, purpose), isNull2(this.sessions.consumedAt), isNull2(this.sessions.revokedAt))).returning({ userId: this.sessions.userId });
-    return session;
-  }
-  async deleteExpired() {
-    return this.db.delete(this.sessions).where(lt2(this.sessions.expiresAt, (/* @__PURE__ */ new Date()).toISOString())).returning({ userId: this.sessions.userId });
-  }
-};
-__decorate33([
-  DB6(),
-  __metadata33("design:type", Object)
-], CredentialSetupRepository.prototype, "db", void 0);
-__decorate33([
-  Inject18(AUTH_SCHEMA),
-  __metadata33("design:type", Object)
-], CredentialSetupRepository.prototype, "schema", void 0);
-CredentialSetupRepository = __decorate33([
-  Repository6()
-], CredentialSetupRepository);
+// src/credentialSetup/CredentialSetupController.ts
+import { Body as Body6, Controller as Controller6, Get as Get6, Post as Post6, ResMsg as ResMsg5 } from "najm-core";
+import { RateLimit as RateLimit3 } from "najm-rate";
+import { Validate as Validate5 } from "najm-validation";
 
-// src/credentialSetup/CredentialSetupService.ts
-import { createHash as createHash5, randomBytes as randomBytes4 } from "crypto";
-import { CookieService as CookieService3 } from "najm-cookies";
-import { Err as Err12, Injectable as Injectable19 } from "najm-core";
-import { Transaction as Transaction3 } from "najm-database";
-var __decorate34 = function(decorators, target, key, desc) {
+// src/credentialSetup/CredentialSetupDto.ts
+import { z as z5 } from "zod";
+var defaultCredentialSetupPasswordSchema = z5.string().min(8, "Password must be at least 8 characters").refine((v) => new TextEncoder().encode(v).length <= 72, "Password must be at most 72 bytes").regex(/[a-zA-Z]/, "Password must contain at least one letter").regex(/\d/, "Password must contain at least one number");
+var credentialSetupChangeDto = z5.object({
+  newPassword: z5.string().min(1, "A new password is required").max(256)
+});
+
+// src/credentialSetup/CredentialSetupController.ts
+var __decorate39 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata34 = function(k, v) {
+var __metadata39 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a22;
-var _b12;
-var _c8;
-var _d5;
-var _e4;
-var _f4;
-var _g3;
-var DEFAULT_COOKIE_NAME = "najm.credential-setup";
-var DEFAULT_TTL_MS = 10 * 60 * 1e3;
-var MAX_TTL_MS = 24 * 60 * 60 * 1e3;
-var PURPOSE_PATTERN = /^[a-z0-9](?:[a-z0-9:_-]{0,62}[a-z0-9])?$/;
-var COOKIE_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-var CredentialSetupService = class CredentialSetupService2 {
+var __param13 = function(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+};
+var _a25;
+var CredentialSetupController = class CredentialSetupController2 {
   static {
-    __name(this, "CredentialSetupService");
-  }
-  repository;
-  tokens;
-  authCookies;
-  cookies;
-  constructor(repository, tokens, authCookies, cookies2) {
-    this.repository = repository;
-    this.tokens = tokens;
-    this.authCookies = authCookies;
-    this.cookies = cookies2;
-  }
-  /**
-   * Revoke normal auth sessions and issue a single-purpose, short-lived,
-   * browser-session cookie. No access or refresh token is minted.
-   */
-  async begin(userId, options) {
-    const resolved = this.resolveOptions(options);
-    const token = randomBytes4(32).toString("base64url");
-    const expiresAt = new Date(Date.now() + resolved.ttlMs).toISOString();
-    await this.repository.deleteExpired();
-    await this.repository.replaceActive({
-      userId,
-      purpose: resolved.purpose,
-      tokenHash: this.hashToken(token),
-      expiresAt
-    });
-    await this.tokens.invalidateUserAccessTokens(userId);
-    await this.tokens.revokeAllForUser(userId);
-    this.authCookies.clearRefreshToken();
-    this.authCookies.clearSessionCookie();
-    this.setCookie(token, resolved);
-    return { purpose: resolved.purpose, expiresAt };
-  }
-  /** Validate and return the current active setup session without consuming it. */
-  async require(options) {
-    const resolved = this.resolveOptions(options);
-    const token = this.cookies.get(resolved.cookieName);
-    if (!token)
-      Err12("Credential setup session is required", 401);
-    const session = await this.repository.findActive(this.hashToken(token), resolved.purpose);
-    if (!session) {
-      this.clearCookie(resolved);
-      Err12("Credential setup session is invalid or expired", 401);
-    }
-    return session;
-  }
-  /**
-   * Atomically consume the setup session and execute the application-owned
-   * credential mutation in the same database transaction. If the callback
-   * fails, consumption rolls back and the browser may safely retry.
-   */
-  async consume(options, complete) {
-    const resolved = this.resolveOptions(options);
-    const token = this.cookies.get(resolved.cookieName);
-    if (!token)
-      Err12("Credential setup session is required", 401);
-    const session = await this.repository.consume(this.hashToken(token), resolved.purpose);
-    if (!session) {
-      this.clearCookie(resolved);
-      Err12("Credential setup session is invalid or expired", 401);
-    }
-    const result = await complete(session);
-    this.clearCookie(resolved);
-    return result;
-  }
-  async cancel(options) {
-    const resolved = this.resolveOptions(options);
-    const token = this.cookies.get(resolved.cookieName);
-    if (token) {
-      await this.repository.revoke(this.hashToken(token), resolved.purpose);
-    }
-    this.clearCookie(resolved);
-    return { cancelled: true };
-  }
-  async pruneExpired() {
-    await this.repository.deleteExpired();
+    __name(this, "CredentialSetupController");
   }
-  resolveOptions(options) {
-    const purpose = options.purpose?.trim().toLowerCase();
-    const cookieName = options.cookieName?.trim() || DEFAULT_COOKIE_NAME;
-    const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
-    const cookiePath = options.cookiePath ?? "/";
-    if (!purpose || !PURPOSE_PATTERN.test(purpose)) {
-      Err12("Credential setup purpose must be 1-64 lowercase letters, numbers, colon, underscore, or hyphen", 500);
-    }
-    if (!COOKIE_NAME_PATTERN.test(cookieName) || cookieName.length > 128) {
-      Err12("Credential setup cookie name is invalid", 500);
-    }
-    if (!Number.isInteger(ttlMs) || ttlMs < 1e3 || ttlMs > MAX_TTL_MS) {
-      Err12("Credential setup ttlMs must be an integer between 1000 and 86400000", 500);
-    }
-    if (!cookiePath.startsWith("/") || cookiePath.includes(";") || cookiePath.includes("\\")) {
-      Err12("Credential setup cookiePath must be a same-origin path", 500);
-    }
-    return { purpose, cookieName, ttlMs, cookiePath };
+  passwords;
+  constructor(passwords) {
+    this.passwords = passwords;
   }
-  hashToken(token) {
-    return createHash5("sha256").update(token).digest("hex");
+  status() {
+    return this.passwords.status();
   }
-  setCookie(token, options) {
-    this.cookies.setSession(options.cookieName, token, {
-      httpOnly: true,
-      path: options.cookiePath,
-      sameSite: "Strict",
-      secure: process.env.NODE_ENV === "production"
-    });
+  change(body) {
+    return this.passwords.change(body.newPassword);
   }
-  clearCookie(options) {
-    this.cookies.delete(options.cookieName, {
-      path: options.cookiePath,
-      secure: process.env.NODE_ENV === "production"
-    });
+  cancel() {
+    return this.passwords.cancel();
   }
 };
-__decorate34([
-  Transaction3({ retries: 2 }),
-  __metadata34("design:type", Function),
-  __metadata34("design:paramtypes", [String, Object]),
-  __metadata34("design:returntype", typeof (_e4 = typeof Promise !== "undefined" && Promise) === "function" ? _e4 : Object)
-], CredentialSetupService.prototype, "begin", null);
-__decorate34([
-  Transaction3({ retries: 2 }),
-  __metadata34("design:type", Function),
-  __metadata34("design:paramtypes", [Object, Function]),
-  __metadata34("design:returntype", typeof (_f4 = typeof Promise !== "undefined" && Promise) === "function" ? _f4 : Object)
-], CredentialSetupService.prototype, "consume", null);
-__decorate34([
-  Transaction3({ retries: 2 }),
-  __metadata34("design:type", Function),
-  __metadata34("design:paramtypes", [Object]),
-  __metadata34("design:returntype", typeof (_g3 = typeof Promise !== "undefined" && Promise) === "function" ? _g3 : Object)
-], CredentialSetupService.prototype, "cancel", null);
-CredentialSetupService = __decorate34([
-  Injectable19(),
-  __metadata34("design:paramtypes", [typeof (_a22 = typeof CredentialSetupRepository !== "undefined" && CredentialSetupRepository) === "function" ? _a22 : Object, typeof (_b12 = typeof TokenService !== "undefined" && TokenService) === "function" ? _b12 : Object, typeof (_c8 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c8 : Object, typeof (_d5 = typeof CookieService3 !== "undefined" && CookieService3) === "function" ? _d5 : Object])
-], CredentialSetupService);
+__decorate39([
+  Get6("/setup"),
+  RateLimit3({ limit: 30, window: "15m", key: "ip" }),
+  ResMsg5("auth.success.credentialSetupPending"),
+  __metadata39("design:type", Function),
+  __metadata39("design:paramtypes", []),
+  __metadata39("design:returntype", void 0)
+], CredentialSetupController.prototype, "status", null);
+__decorate39([
+  Post6("/change"),
+  RateLimit3({ limit: 5, window: "15m", key: "ip" }),
+  Validate5(credentialSetupChangeDto),
+  ResMsg5("auth.success.credentialSetupPasswordReplaced"),
+  __param13(0, Body6()),
+  __metadata39("design:type", Function),
+  __metadata39("design:paramtypes", [Object]),
+  __metadata39("design:returntype", void 0)
+], CredentialSetupController.prototype, "change", null);
+__decorate39([
+  Post6("/cancel"),
+  RateLimit3({ limit: 10, window: "15m", key: "ip" }),
+  ResMsg5("auth.success.credentialSetupCancelled"),
+  __metadata39("design:type", Function),
+  __metadata39("design:paramtypes", []),
+  __metadata39("design:returntype", void 0)
+], CredentialSetupController.prototype, "cancel", null);
+CredentialSetupController = __decorate39([
+  Controller6("/auth/credential-setup"),
+  __metadata39("design:paramtypes", [typeof (_a25 = typeof PasswordSetupService !== "undefined" && PasswordSetupService) === "function" ? _a25 : Object])
+], CredentialSetupController);
 
 // src/credentialSetup/index.ts
 var CREDENTIAL_SETUP_MODULE = [
   CredentialSetupRepository,
-  CredentialSetupService
+  CredentialSetupRequirementRepository,
+  CredentialSetupService,
+  CredentialSetupRequirementService,
+  PasswordSetupService,
+  CredentialSetupController
 ];
 
 // src/AuthPlugin.ts
@@ -5786,9 +6604,9 @@ var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
   const clientId = google.clientId ?? process.env.GOOGLE_CLIENT_ID ?? "";
   const clientSecret = google.clientSecret ?? process.env.GOOGLE_CLIENT_SECRET ?? "";
   if (!clientId)
-    throw Err13.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
+    throw Err15.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
   if (!clientSecret)
-    throw Err13.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
+    throw Err15.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
   const frontendUrl = config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000";
   const callbackUrl = google.callbackUrl ?? process.env.GOOGLE_CALLBACK_URL ?? `${frontendUrl.replace(/\/$/, "")}/api/auth/oauth/google/callback`;
   let callback;
@@ -5812,6 +6630,20 @@ var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
     allowedHostedDomains: [...new Set((google.allowedHostedDomains ?? []).map((domain) => domain.trim().toLowerCase()).filter(Boolean))]
   };
 }, "resolveGoogleConfig");
+var resolveCredentialSetupConfig = /* @__PURE__ */ __name((config) => {
+  const password = config?.credentialSetup?.password ?? {};
+  const ttlMs = password.ttlMs ?? DEFAULT_CREDENTIAL_SETUP_TTL_MS;
+  if (!Number.isInteger(ttlMs) || ttlMs < 1e3 || ttlMs > 24 * 60 * 60 * 1e3) {
+    throw new Error("auth.credentialSetup.password.ttlMs must be an integer between 1000 and 86400000");
+  }
+  return {
+    password: {
+      ttlMs,
+      cookieName: password.cookieName?.trim() || DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME,
+      passwordSchema: password.passwordSchema ?? defaultCredentialSetupPasswordSchema
+    }
+  };
+}, "resolveCredentialSetupConfig");
 var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
   const bcryptRounds = config?.bcryptRounds ?? 10;
   if (!Number.isInteger(bcryptRounds) || bcryptRounds < 4 || bcryptRounds > 31) {
@@ -5835,6 +6667,9 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
       duration: config?.lockout?.duration ?? "15m"
     },
     bcryptRounds,
+    identity: {
+      resolve: createIdentityResolver(config?.identity)
+    },
     session: {
       name: config?.session?.name ?? "najm.session",
       maxAge: config?.session?.maxAge ?? 300,
@@ -5842,15 +6677,16 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
       // CookieManager falls back to jwt.accessSecret when this is undefined.
       secret: config?.session?.secret ?? process.env.NAJM_SESSION_SECRET
     },
+    credentialSetup: resolveCredentialSetupConfig(config),
     oauth: {
       google: resolveGoogleConfig(config)
     }
   };
   if (!finalConfig.jwt.accessSecret) {
-    throw Err13.configRequired("auth", "JWT_ACCESS_SECRET");
+    throw Err15.configRequired("auth", "JWT_ACCESS_SECRET");
   }
   if (!finalConfig.jwt.refreshSecret) {
-    throw Err13.configRequired("auth", "JWT_REFRESH_SECRET");
+    throw Err15.configRequired("auth", "JWT_REFRESH_SECRET");
   }
   return finalConfig;
 }, "resolveAuthConfig");
@@ -5859,6 +6695,12 @@ var selectAuthSchema = /* @__PURE__ */ __name((config) => {
     if (config.oauth?.google && !config.schema.oauthAccounts) {
       throw new Error("auth.schema.oauthAccounts is required when Google OAuth is enabled");
     }
+    if (!config.schema.credentialSetupSessions) {
+      throw new Error("auth.schema.credentialSetupSessions is required \u2014 re-export it from najm-auth/pg or najm-auth/sqlite");
+    }
+    if (!config.schema.credentialSetupRequirements) {
+      throw new Error("auth.schema.credentialSetupRequirements is required \u2014 re-export it from najm-auth/pg or najm-auth/sqlite");
+    }
     return config.schema;
   }
   const dialect = config?.dialect ?? "pg";
@@ -6017,6 +6859,7 @@ export {
   AuthResolver,
   AuthService,
   AuthSessionService,
+  CREDENTIAL_SETUP_CODES,
   CREDENTIAL_SETUP_MODULE,
   Can,
   CanCreate,
@@ -6025,11 +6868,22 @@ export {
   CanRead,
   CanUpdate,
   CookieManager,
+  CredentialSetupController,
   CredentialSetupRepository,
+  CredentialSetupRequirementRepository,
+  CredentialSetupRequirementService,
   CredentialSetupService,
+  DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME,
+  DEFAULT_CREDENTIAL_SETUP_TTL_MS,
+  DEFAULT_IDENTITY_PRESET,
+  EXACT_TEMPORARY_CREDENTIAL_KIND,
   EncryptionService,
+  IDENTITY_PRESETS,
+  MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND,
   Owned,
   OwnershipToken,
+  PASSWORD_SETUP_PURPOSE,
+  PasswordSetupService,
   PermissionController,
   PermissionGuard,
   PermissionRepository,
@@ -6068,13 +6922,19 @@ export {
   changePasswordDto,
   checkPermissionDto,
   clean,
+  compactPhone,
   configureOwnership,
   confirmResetPasswordDto,
+  createIdentityResolver,
   createPermissionDto,
   createRoleDto,
   createTokenDto,
   createUserDto,
+  credentialSetupChangeDto,
+  credentialSetupError,
+  credentialSetupRequirementsTable,
   credentialSetupSessionsTable,
+  defaultCredentialSetupPasswordSchema,
   defineRoles,
   emailParam,
   formatDate,
@@ -6087,11 +6947,19 @@ export {
   isEmailIdentifier,
   isEmpty,
   isFile,
+  isMoroccanCin,
   isPath,
+  isTemporaryCredentialKind,
   join2 as join,
   languageParam,
   loginDto,
+  moroccanCinTemporaryCredential,
+  moroccoIdentityPreset,
   normalizeAuthIdentifier,
+  normalizeMoroccanCin,
+  normalizeMoroccanPhone,
+  normalizeSetupPurpose,
+  normalizeTunisianPhone,
   oauthAccountsTable,
   own,
   parseSchema,
@@ -6101,16 +6969,19 @@ export {
   refreshTokenDto,
   registerDto,
   resetPasswordDto,
+  resolveTemporaryCredentialKind,
   revokeTokenDto,
   roleIdParam,
   rolePermissionsTable,
   rolesTable,
   runAsUser,
   seedAuthData,
+  toTemporaryCredential,
   tokenIdParam,
   tokenStatusEnum,
   tokenTypeEnum,
   tokensTable,
+  tunisiaIdentityPreset,
   updatePermissionDto,
   updateRoleDto,
   updateTokenDto,