refactor(auth): guards, auth decorators and ephemeral tokens move into an auth-core kernel

JwtAuthGuard, OptionalJwtAuthGuard, CookieAuthGuard, AdminGuard, the global
and MFA guards, @CurrentUser, @Public, JWT verification and the ephemeral
token service lived in the auth domain, so every controller that checked a
session depended on the whole account module and its imports. They import
no domain themselves; under src/nest/auth-core they are shared kernel like
common/, every importer points there directly, and AtlasModule and
NotificationsModule stop importing AuthModule, which they only did for the
demo gate. lint:boundaries counts auth-core as kernel: 57 fewer cyclic
domain edges, the largest cycle shrinks from 46 to 40 domains.

server/scripts/import-boundaries-baseline.json

@@ -2,12 +2,10 @@
   "fileCycles": [],
   "domainCycles": [
     "accommodations -> assignments",
-    "accommodations -> auth",
     "accommodations -> mcp-shared",
     "accommodations -> places",
     "accommodations -> plugins",
     "accommodations -> realtime",
-    "addons -> auth",
     "addons -> memories",
     "addons -> settings",
     "addons -> transit",
@@ -22,30 +20,21 @@
     "admin -> plugins",
     "admin -> realtime",
     "admin -> settings",
-    "admin -> tokens",
-    "airports -> auth",
-    "assignments -> auth",
     "assignments -> days",
     "assignments -> journey",
     "assignments -> mcp-shared",
     "assignments -> plugins",
     "assignments -> realtime",
     "atlas -> addons",
-    "atlas -> auth",
     "atlas -> geo",
     "atlas -> plugins",
-    "atlas -> public-api",
-    "atlas -> tokens",
     "auth -> budget",
     "auth -> files",
     "auth -> maps",
     "auth -> notifications",
     "auth -> plugins",
     "auth -> settings",
-    "auth -> storage",
-    "auth -> tokens",
     "booking-import -> addons",
-    "booking-import -> airports",
     "booking-import -> budget",
     "booking-import -> llm-parse",
     "booking-import -> maps",
@@ -53,52 +42,40 @@
     "booking-import -> realtime",
     "booking-import -> reservations",
     "budget -> addons",
-    "budget -> auth",
     "budget -> mcp-shared",
     "budget -> plugins",
     "budget -> realtime",
     "calendar -> days",
     "calendar -> reservations",
-    "categories -> auth",
     "categories -> mcp-shared",
     "categories -> plugins",
     "collab -> addons",
-    "collab -> auth",
     "collab -> files",
     "collab -> mcp-shared",
     "collab -> notifications",
     "collab -> plugins",
     "collab -> realtime",
-    "collab -> storage",
     "collections -> addons",
-    "collections -> auth",
     "collections -> notifications",
     "collections -> places",
     "collections -> plugins",
     "collections -> realtime",
-    "collections -> storage",
-    "day-notes -> auth",
     "day-notes -> mcp-shared",
     "day-notes -> plugins",
     "day-notes -> realtime",
     "days -> accommodations",
     "days -> assignments",
-    "days -> auth",
     "days -> mcp-shared",
     "days -> places",
     "days -> plugins",
     "days -> realtime",
-    "files -> auth",
     "files -> mcp-shared",
     "files -> plugins",
     "files -> realtime",
-    "files -> storage",
     "geo -> maps",
-    "google-quota -> auth",
     "integrations -> addons",
     "integrations -> assignments",
     "integrations -> atlas",
-    "integrations -> auth",
     "integrations -> journey",
     "integrations -> mcp-shared",
     "integrations -> places",
@@ -106,7 +83,6 @@
     "integrations -> reservations",
     "journey -> addons",
     "journey -> atlas",
-    "journey -> auth",
     "journey -> files",
     "journey -> maps",
     "journey -> memories",
@@ -114,56 +90,38 @@
     "journey -> plugins",
     "journey -> realtime",
     "journey -> settings",
-    "journey -> storage",
     "llm-parse -> addons",
-    "llm-parse -> auth",
     "llm-parse -> settings",
-    "maps -> auth",
     "maps -> geo",
-    "maps -> google-quota",
-    "maps -> place-photos",
     "maps -> settings",
-    "maps -> storage",
     "mcp-shared -> realtime",
     "memories -> addons",
-    "memories -> auth",
     "memories -> notifications",
     "memories -> photos",
     "memories -> realtime",
-    "memories -> storage",
     "notifications -> admin",
-    "notifications -> auth",
     "notifications -> realtime",
-    "notifications -> storage",
     "oauth -> addons",
-    "oauth -> auth",
     "packing -> addons",
     "packing -> admin",
-    "packing -> auth",
     "packing -> mcp-shared",
     "packing -> notifications",
     "packing -> plugins",
     "packing -> realtime",
-    "photos -> auth",
     "photos -> memories",
-    "place-photos -> storage",
     "places -> accommodations",
     "places -> assignments",
     "places -> atlas",
-    "places -> auth",
     "places -> journey",
     "places -> maps",
     "places -> mcp-shared",
-    "places -> place-photos",
     "places -> plugins",
     "places -> realtime",
-    "places -> storage",
     "places -> unsplash",
     "plugins -> accommodations",
     "plugins -> addons",
     "plugins -> assignments",
     "plugins -> atlas",
-    "plugins -> auth",
     "plugins -> budget",
     "plugins -> categories",
     "plugins -> collab",
@@ -184,14 +142,10 @@
     "plugins -> trips",
     "plugins -> vacay",
     "plugins -> weather",
-    "public-api -> tokens",
-    "realtime -> auth",
     "realtime -> journey",
     "realtime -> plugins",
     "reservations -> accommodations",
-    "reservations -> airports",
     "reservations -> assignments",
-    "reservations -> auth",
     "reservations -> budget",
     "reservations -> days",
     "reservations -> integrations",
@@ -200,19 +154,12 @@
     "reservations -> plugins",
     "reservations -> realtime",
     "settings -> admin",
-    "settings -> auth",
-    "storage -> auth",
-    "tags -> auth",
     "tags -> plugins",
     "todo -> addons",
-    "todo -> auth",
     "todo -> mcp-shared",
     "todo -> plugins",
     "todo -> realtime",
-    "tokens -> auth",
-    "transit -> auth",
     "transit -> days",
-    "transit -> google-quota",
     "transit -> maps",
     "transit -> mcp-shared",
     "transit -> reservations",
@@ -235,7 +182,6 @@
     "trip-read-model -> trips",
     "trips -> accommodations",
     "trips -> addons",
-    "trips -> auth",
     "trips -> budget",
     "trips -> calendar",
     "trips -> collab",
@@ -248,30 +194,23 @@
     "trips -> realtime",
     "trips -> reservations",
     "trips -> settings",
-    "trips -> storage",
     "trips -> todo",
     "trips -> trip-members",
     "trips -> trip-read-model",
     "trips -> unsplash",
     "trips -> vacay",
     "unsplash -> settings",
-    "unsplash -> storage",
     "vacay -> addons",
     "vacay -> auth",
     "vacay -> notifications",
     "vacay -> plugins",
     "vacay -> realtime",
-    "weather -> auth",
     "weather -> plugins"
   ],
   "sharedImportsDomain": [
     "nest/common/idempotency-cleanup.job.ts -> nest/audit/audit-log.logger.ts",
     "nest/common/idempotency-cleanup.job.ts -> nest/scheduling/cron-registrar.service.ts",
     "nest/common/rowShape.ts -> nest/query-helpers/query-helpers.service.ts",
-    "nest/common/validate-route-guards.ts -> nest/auth/cookie-auth.guard.ts",
-    "nest/common/validate-route-guards.ts -> nest/auth/jwt-auth.guard.ts",
-    "nest/common/validate-route-guards.ts -> nest/auth/optional-jwt.guard.ts",
-    "nest/common/validate-route-guards.ts -> nest/auth/public.decorator.ts",
     "nest/common/validate-route-guards.ts -> nest/public-api/api-token.guard.ts"
   ],
   "domainInternals": [
@@ -301,7 +240,6 @@
     "collections -> storage/storage-upload.factory.ts",
     "days -> accommodations/night-seat.ts",
     "doc-sync -> storage/content-type.ts",
-    "files -> auth/jwt-verify.ts",
     "files -> storage/content-type.ts",
     "files -> storage/storage-upload.factory.ts",
     "geo -> maps/maps.helpers.ts",
@@ -318,8 +256,6 @@
     "place-enrichment -> maps/trek-places.client.ts",
     "places -> atlas/atlas-geo.ts",
     "places -> storage/storage-upload.factory.ts",
-    "platform -> auth/jwt-verify.ts",
-    "plugins -> auth/jwt-verify.ts",
     "plugins -> llm-parse/clients/openai-compatible.client.ts",
     "plugins -> llm-parse/llm-client.factory.ts",
     "plugins -> llm-parse/llm-config.resolver.ts",

server/scripts/import-boundaries.mjs

@@ -25,8 +25,8 @@
  *                   the next rule instead.
  *   sharedImportsDomain
  *                   a file of the shared kernel (src/nest/common, database,
- *                   app-config), which every domain imports, importing from a
- *                   domain. That ties the domain into every other one.
+ *                   app-config, auth-core), which every domain imports,
+ *                   importing from a domain. That ties the domain into every other one.
  *   domainInternals a file in src/nest/<A>/ importing (value or type) a
  *                   file of src/nest/<B>/ that is not B's public surface.
  *                   Public is what the codebase already treats that way: the
@@ -58,8 +58,12 @@ const ts = require('typescript');
 
 export const RULES = ['fileCycles', 'domainCycles', 'sharedImportsDomain', 'domainInternals', 'dbImportsNest'];
 
-/** Folders under src/nest whose every file is shared infrastructure, open to all domains. */
-export const SHARED_DOMAINS = new Set(['common', 'database', 'app-config']);
+/**
+ * Folders under src/nest whose every file is shared infrastructure, open to all domains.
+ * auth-core holds the request-auth primitives (the guards, the decorators, JWT
+ * verification, ephemeral tokens) every controller needs; it imports no domain.
+ */
+export const SHARED_DOMAINS = new Set(['common', 'database', 'app-config', 'auth-core']);
 
 /** File name suffixes that make up a domain's public surface. */
 export const PUBLIC_SUFFIXES = [

server/src/nest/README.md

@@ -72,7 +72,13 @@ over an injected `AddonsService`.
   import them from outside the container. `geo.ts` keeps the clamped haversine,
   since `asin` of a value a hair over 1 is NaN and a NaN distance fails every
   comparison silently.
-- `auth/jwt-verify.ts`: `extractToken` and `verifyJwtAndLoadUser`, the one
+- `auth-core/`: the request-auth kernel every controller imports: the guards
+  (`JwtAuthGuard`, `OptionalJwtAuthGuard`, `CookieAuthGuard`, `AdminGuard`, the
+  global `GlobalAuthGuard` and `MfaPolicyGuard`), `@CurrentUser()`, `@Public()`/
+  `@OptionalAuth()`, JWT verification and the ephemeral download/ws tokens. It
+  imports no domain, so `lint:boundaries` treats it as shared kernel like
+  `common/`; `auth/` keeps the account flows (login, MFA, passkeys, sessions).
+- `auth-core/jwt-verify.ts`: `extractToken` and `verifyJwtAndLoadUser`, the one
   session check behind the guards, the MCP bearer path and the download token.
   `JWT_SECRET` stays a live binding from `src/config.ts`, because the admin panel
   rotates it at runtime and a `registerAs` token would freeze the boot value.

server/src/nest/accommodations/accommodations.controller.ts

@@ -14,8 +14,8 @@ import {
 import type { User } from '../../types';
 import { AccommodationsService, type MirrorSender } from './accommodations.service';
 import { AccommodationCreateDto, AccommodationUpdateDto } from './accommodations.dto';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { RequirePermission, TripAccessGuard } from '../permissions/trip-access.guard';
 
 type AccommodationBody = {

server/src/nest/addons/addons.controller.ts

@@ -1,6 +1,6 @@
 import { Controller, Get, UseGuards } from '@nestjs/common';
 import { AddonsService } from './addons.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
 
 /**
  * GET /api/addons — the enabled trip add-ons + photo providers feed.

server/src/nest/admin/admin.controller.ts

@@ -23,9 +23,9 @@ import {
 } from './admin.dto';
 import { PluginRuntimeService } from '../plugins/plugin-runtime.service';
 import { AddonsService } from '../addons/addons.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { AdminGuard } from '../auth/admin.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { AdminGuard } from '../auth-core/admin.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { getClientIp } from '../audit/client-ip';
 import { logInfo } from '../audit/audit-log.logger';
 import { AuditService } from '../audit/audit.service';

server/src/nest/airports/airports.controller.ts

@@ -1,7 +1,7 @@
 import { Controller, Get, HttpException, Param, Query, UseGuards } from '@nestjs/common';
 import type { Airport } from '@trek/shared';
 import { AirportsService } from './airports.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
 
 /**
  * /api/airports — typeahead search + single lookup by IATA code.

server/src/nest/app.module.ts

@@ -14,8 +14,8 @@ import { AssignmentsModule } from './assignments/assignments.module';
 import { AtlasModule } from './atlas/atlas.module';
 import { AuditModule } from './audit/audit.module';
 import { AuthModule } from './auth/auth.module';
-import { GlobalAuthGuard } from './auth/global-auth.guard';
-import { MfaPolicyGuard } from './auth/mfa-policy.guard';
+import { GlobalAuthGuard } from './auth-core/global-auth.guard';
+import { MfaPolicyGuard } from './auth-core/mfa-policy.guard';
 import { SessionRenewalInterceptor } from './auth/session-renewal.interceptor';
 import { BackupModule } from './backup/backup.module';
 import { BookingImportModule } from './booking-import/booking-import.module';

server/src/nest/assignments/assignments.controller.ts

@@ -23,8 +23,8 @@ import {
   AssignmentRouteDto,
   AssignmentParticipantsDto,
 } from './assignments.dto';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { RequirePermission, TripAccessGuard } from '../permissions/trip-access.guard';
 
 

server/src/nest/atlas/atlas.controller.ts

@@ -18,8 +18,8 @@ import type { AtlasLocateResponse, RegionGeo } from '@trek/shared';
 import type { User } from '../../types';
 import { AtlasService, BucketItemExistsError } from './atlas.service';
 import { AtlasMarkRegionDto, AtlasCreateBucketItemDto, AtlasUpdateBucketItemDto } from './atlas.dto';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 
 /**
  * /api/addons/atlas — visited countries/regions, region GeoJSON, bucket list.

server/src/nest/atlas/atlas.module.ts

@@ -7,7 +7,6 @@ import { AtlasRpc } from './atlas.rpc';
 import { PluginGuardsModule } from '../plugins/host/plugin-guards.module';
 import { AtlasMcp } from './atlas.mcp';
 import { AddonsModule } from '../addons/addons.module';
-import { AuthModule } from '../auth/auth.module';
 import { PublicStatsController } from './public-stats.controller';
 import { ApiTokenGuard } from '../public-api/api-token.guard';
 import { TokensModule } from '../tokens/tokens.module';
@@ -54,7 +53,7 @@ import { PlaceRegionsRepairJob } from './place-regions-repair.job';
  */
 @Module({
   imports: [
-    AuthModule,
+    
     PluginGuardsModule,
     AddonsModule,
     TokensModule,

server/src/nest/atlas/travel-stats.controller.ts

@@ -1,7 +1,7 @@
 import { Controller, Get, UseGuards } from '@nestjs/common';
 import { AtlasService } from './atlas.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import type { User } from '../../types';
 
 /**

server/src/nest/auth-core/jwt-verify.ts

@@ -14,7 +14,7 @@ import { dbNow } from '../../db/types';
  *
  * Free functions rather than a provider: the platform routes run outside the
  * container and would have no way to inject one, and the guards that call this
- * (the MFA policy is nest/auth/mfa-policy.guard.ts now) share the one copy.
+ * (the MFA policy is nest/auth-core/mfa-policy.guard.ts now) share the one copy.
  * Note JWT_SECRET is deliberately a live binding from src/config, not an app-config value: the admin panel rotates it
  * at runtime and `export let` is what makes a rotation take effect in-process.
  *

server/src/nest/auth/auth-public.controller.ts

@@ -3,14 +3,14 @@ import type { Request, Response } from 'express';
 import { AuthService } from './auth.service';
 import { RegisterDto, LoginDto, ForgotPasswordDto, ResetPasswordDto, MfaVerifyLoginDto } from './auth.dto';
 import { RateLimitService } from '../common/rate-limit.service';
-import { OptionalJwtGuard } from './optional-jwt.guard';
+import { OptionalJwtGuard } from '../auth-core/optional-jwt.guard';
 import { getClientIp } from '../audit/client-ip';
 import { AuditService } from '../audit/audit.service';
 import { willDropSecureCookie } from '../common/cookie';
 import type { User } from '../../types';
-import { Public } from './public.decorator';
-import { MfaExempt } from './mfa-policy.guard';
-import { extractToken, verifiedSessionClaims } from './jwt-verify';
+import { Public } from '../auth-core/public.decorator';
+import { MfaExempt } from '../auth-core/mfa-policy.guard';
+import { extractToken, verifiedSessionClaims } from '../auth-core/jwt-verify';
 import { SessionsService, sessionClientFrom } from '../sessions/sessions.service';
 
 const WINDOW = 15 * 60 * 1000;

server/src/nest/auth/auth.controller.ts

@@ -37,14 +37,14 @@ import {
   ResourceTokenDto,
 } from './auth.dto';
 import { RateLimitService } from '../common/rate-limit.service';
-import { JwtAuthGuard } from './jwt-auth.guard';
-import { CurrentUser } from './current-user.decorator';
-import { currentSessionId, decodeSessionClaims } from './jwt-verify';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
+import { currentSessionId, decodeSessionClaims } from '../auth-core/jwt-verify';
 import { sessionClientFrom } from '../sessions/sessions.service';
 import { getClientIp } from '../audit/client-ip';
 import { AuditService } from '../audit/audit.service';
 import type { User } from '../../types';
-import { MfaExempt } from './mfa-policy.guard';
+import { MfaExempt } from '../auth-core/mfa-policy.guard';
 import { ManagedForbidden } from '../common/managed';
 
 const WINDOW = 15 * 60 * 1000;

server/src/nest/auth/auth.module.ts

@@ -41,7 +41,7 @@ import { AuditModule } from '../audit/audit.module';
 import { MailerModule } from '../notifications/mailer/mailer.module';
 import { PermissionsModule } from '../permissions/permissions.module';
 import { TripMembershipModule } from '../trip-membership/trip-membership.module';
-import { EphemeralTokenModule } from './ephemeral-token.module';
+import { EphemeralTokenModule } from '../auth-core/ephemeral-token.module';
 import { MulterModule } from '@nestjs/platform-express';
 import { StorageModule } from '../storage/storage.module';
 import { StorageService } from '../storage/storage.service';

server/src/nest/auth/auth.service.ts

@@ -37,7 +37,7 @@ import { SessionsService, type SessionClient } from '../sessions/sessions.servic
 // Type-and-guard only: the app-config read reports the provider choice, it does
 // not construct one, so this does not pull the maps domain into auth.
 import { isPlacesProviderChoice } from '../maps/providers/places-provider';
-import { EphemeralTokenService } from './ephemeral-token.service';
+import { EphemeralTokenService } from '../auth-core/ephemeral-token.service';
 // Import from sessionManager directly, NOT the ../../mcp barrel: the barrel pulls
 // the whole tools fan-out (and via the domain bridges, the Nest services) into
 // every consumer of this module — a nest→mcp→nest module cycle.
@@ -45,7 +45,7 @@ import { revokeUserSessions } from '../../mcp/sessionManager';
 import { UserCleanupService } from './user-cleanup.service';
 import { splitManagedKeys } from '../common/managed';
 import { emitUserDeleted } from '../../plugin-user-lifecycle';
-import { verifyJwtAndLoadUser } from './jwt-verify';
+import { verifyJwtAndLoadUser } from '../auth-core/jwt-verify';
 import { User } from '../../types';
 import { UserIdentityTakenError, type UserRow } from '../../db/repositories/Users.repository';
 import { DEMO_EMAIL_PRIMARY, DEMO_PASS, isDemoEmail } from '../common/demo';
@@ -1110,7 +1110,7 @@ export class AuthService {
   // -------------------------------------------------------------------------
 
   /**
-   * Verify a JWT the same way `auth/jwt-verify.ts#verifyJwtAndLoadUser`
+   * Verify a JWT the same way `auth-core/jwt-verify.ts#verifyJwtAndLoadUser`
    * does — including the `password_version` check — so that stolen tokens
    * lose access the moment the victim resets their password.
    *

server/src/nest/auth/passkey.controller.ts

@@ -1,16 +1,16 @@
 import { Body, Controller, Delete, Get, HttpCode, HttpException, Param, Patch, Post, Req, Res, UseGuards } from '@nestjs/common';
 import type { Request, Response } from 'express';
 import { RateLimitService } from '../common/rate-limit.service';
-import { JwtAuthGuard } from './jwt-auth.guard';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
 import { PasskeyEnabledGuard } from './passkey-enabled.guard';
-import { CurrentUser } from './current-user.decorator';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { setAuthCookie } from '../common/cookie';
 import { getClientIp } from '../audit/client-ip';
 import { AuditService } from '../audit/audit.service';
 import { PasskeyService } from './passkey.service';
 import { PasskeyRegisterOptionsDto, PasskeyRegisterVerifyDto, PasskeyLoginVerifyDto, PasskeyRenameDto, PasskeyDeleteDto } from './auth.dto';
 import type { User } from '../../types';
-import { MfaExempt } from './mfa-policy.guard';
+import { MfaExempt } from '../auth-core/mfa-policy.guard';
 import { sessionClientFrom } from '../sessions/sessions.service';
 
 const WINDOW = 15 * 60 * 1000;

server/src/nest/auth/session-renewal.interceptor.ts

@@ -2,7 +2,7 @@ import { CallHandler, ExecutionContext, Injectable, NestInterceptor } from '@nes
 import type { Request, Response } from 'express';
 import type { Observable } from 'rxjs';
 import { SessionsService, sessionClientFrom } from '../sessions/sessions.service';
-import { decodeSessionClaims } from './jwt-verify';
+import { decodeSessionClaims } from '../auth-core/jwt-verify';
 import { setAuthCookie } from '../common/cookie';
 
 /**

server/src/nest/auth/sessions.controller.ts

@@ -15,9 +15,9 @@ import { SessionsService } from '../sessions/sessions.service';
 import { isDemoEmail } from '../common/demo';
 import { readEnv } from '../../app-config';
 import type { User } from '../../types';
-import { CurrentUser } from './current-user.decorator';
-import { currentSessionId } from './jwt-verify';
-import { JwtAuthGuard } from './jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
+import { currentSessionId } from '../auth-core/jwt-verify';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
 
 /**
  * The signed-in user's own sessions: where they are signed in, and signing

server/src/nest/backup/backup.controller.ts

@@ -21,9 +21,9 @@ import { readEnv } from '../../app-config';
 import type { User } from '../../types';
 import { BackupService } from './backup.service';
 import { AutoBackupJob } from './auto-backup.job';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { AdminGuard } from '../auth/admin.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { AdminGuard } from '../auth-core/admin.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { AutoBackupSettingsDto } from './backup.dto';
 import { getClientIp } from '../audit/client-ip';
 import { AuditService } from '../audit/audit.service';

server/src/nest/budget/budget.controller.ts

@@ -14,8 +14,8 @@ import {
 } from '@nestjs/common';
 import type { User } from '../../types';
 import { BudgetService } from './budget.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { RequirePermission, TripAccessGuard } from '../permissions/trip-access.guard';
 import { Trip } from '../permissions/trip.decorator';
 import type { TripAccess } from '../../db/repositories/Trips.repository';

server/src/nest/categories/categories.controller.ts

@@ -3,9 +3,9 @@ import type { Category, CategoryListResponse } from '@trek/shared';
 import type { User } from '../../types';
 import { CategoriesService } from './categories.service';
 import { CategoryCreateDto, CategoryUpdateDto } from './categories.dto';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { AdminGuard } from '../auth/admin.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { AdminGuard } from '../auth-core/admin.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 
 /**
  * /api/categories — place-category palette CRUD.

server/src/nest/collab/collab.controller.ts

@@ -32,8 +32,8 @@ import {
   CollabMessageCreateDto,
   CollabReactionDto,
 } from './collab.dto';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { RequirePermission, TripAccessGuard } from '../permissions/trip-access.guard';
 import { BLOCKED_EXTENSIONS, MAX_FILE_SIZE } from '../files/files.constants';
 import { SpoolCleanupInterceptor } from '../common/spool-cleanup.interceptor';

server/src/nest/collections/collections.controller.ts

@@ -25,8 +25,8 @@ import { CollectionsService } from './collections.service';
 import { AddonGuard } from '../addons/addon.guard';
 import { RequireAddon } from '../addons/require-addon.decorator';
 import { ADDON_IDS } from '../../addons';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { PLACE_IMAGE_FILE_FILTER } from '../common/place-image-upload';
 import { StorageService } from '../storage/storage.service';
 import { placeImageUrl } from '../places/place-image';

server/src/nest/common/validate-route-guards.ts

@@ -1,10 +1,10 @@
 import { METHOD_METADATA, PATH_METADATA, GUARDS_METADATA } from '@nestjs/common/constants';
 import { ModulesContainer } from '@nestjs/core';
 import type { INestApplication } from '@nestjs/common';
-import { IS_PUBLIC, OPTIONAL_AUTH } from '../auth/public.decorator';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CookieAuthGuard } from '../auth/cookie-auth.guard';
-import { OptionalJwtGuard } from '../auth/optional-jwt.guard';
+import { IS_PUBLIC, OPTIONAL_AUTH } from '../auth-core/public.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CookieAuthGuard } from '../auth-core/cookie-auth.guard';
+import { OptionalJwtGuard } from '../auth-core/optional-jwt.guard';
 import { ApiTokenGuard } from '../public-api/api-token.guard';
 
 export interface RouteGuardEntry {

server/src/nest/config/config.controller.ts

@@ -1,7 +1,7 @@
 import { Controller, Get } from '@nestjs/common';
 import type { PublicConfig } from '@trek/shared';
 import { DEFAULT_LANGUAGE } from '../../config';
-import { Public } from '../auth/public.decorator';
+import { Public } from '../auth-core/public.decorator';
 
 /**
  * /api/config — public (unauthenticated) bootstrap config.

server/src/nest/day-notes/day-notes.controller.ts

@@ -13,8 +13,8 @@ import {
 import type { User } from '../../types';
 import { DayNotesService } from './day-notes.service';
 import { DayNoteCreateDto, DayNoteUpdateDto } from './day-notes.dto';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { RequirePermission, TripAccessGuard } from '../permissions/trip-access.guard';
 
 /**

server/src/nest/days/days.controller.ts

@@ -14,8 +14,8 @@ import type { User } from '../../types';
 import { DaysService, DayReorderError, DayAppendError, type DatedDayAppend } from './days.service';
 import { DayRemovalService, DayDeleteError, type DayRemoval } from './day-removal.service';
 import { DayCreateDto, DayReorderDto, DayTransportDto, DayUpdateDto } from './days.dto';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { RequirePermission, TripAccessGuard } from '../permissions/trip-access.guard';
 
 /**

server/src/nest/doc-sync/doc-sync-webhook.controller.ts

@@ -2,7 +2,7 @@ import { Controller, HttpCode, OnModuleDestroy, Param, Post, Req } from '@nestjs
 import { MikroORM } from '@mikro-orm/core';
 import type { Request } from 'express';
 import crypto from 'crypto';
-import { Public } from '../auth/public.decorator';
+import { Public } from '../auth-core/public.decorator';
 import { withRequestContext } from '../database/request-context';
 import { WEBHOOK_NUDGE_DEBOUNCE_SECONDS } from './doc-sync.constants';
 import { DocSyncConfigService, type LinkRow } from './doc-sync-config.service';

server/src/nest/doc-sync/doc-sync.controller.ts

@@ -20,8 +20,8 @@ import type { User } from '../../types';
 import { ADDON_IDS } from '../../addons';
 import { AddonGuard } from '../addons/addon.guard';
 import { RequireAddon } from '../addons/require-addon.decorator';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { TripAccessGuard } from '../permissions/trip-access.guard';
 import { RealtimeService } from '../realtime/realtime.service';
 import { withRequestContext } from '../database/request-context';

server/src/nest/feeds/feeds.controller.ts

@@ -13,13 +13,13 @@ import type { Request, Response } from 'express';
 import { readEnv } from '../../app-config';
 import { contentDisposition } from '../common/content-disposition';
 import { FeedsService } from './feeds.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import type { User } from '../../types';
 import { RequirePermission, TripAccessGuard } from '../permissions/trip-access.guard';
 import { Trip } from '../permissions/trip.decorator';
 import type { TripAccess } from '../../db/repositories/Trips.repository';
-import { Public } from '../auth/public.decorator';
+import { Public } from '../auth-core/public.decorator';
 
 // Resolve the public origin used to build feed URLs. APP_URL wins — it is the
 // canonical externally-reachable URL behind a reverse proxy. When it is unset

server/src/nest/files/files-download.controller.ts

@@ -3,7 +3,7 @@ import type { Request, Response } from 'express';
 import path from 'path';
 import { FilesService } from './files.service';
 import { contentDisposition } from '../common/content-disposition';
-import { Public } from '../auth/public.decorator';
+import { Public } from '../auth-core/public.decorator';
 import { StorageService } from '../storage/storage.service';
 
 /**

server/src/nest/files/files.controller.ts

@@ -24,8 +24,8 @@ import fs from 'fs';
 import type { User } from '../../types';
 import { StorageService } from '../storage/storage.service';
 import { FilesService } from './files.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { TripAccessGuard } from '../permissions/trip-access.guard';
 import type { TripAccess } from '../../db/repositories/Trips.repository';
 import { Trip } from '../permissions/trip.decorator';

server/src/nest/files/files.module.ts

@@ -10,7 +10,7 @@ import { PluginGuardsModule } from '../plugins/host/plugin-guards.module';
 import { RealtimeModule } from '../realtime/realtime.module';
 import { PermissionsModule } from '../permissions/permissions.module';
 import { AppConfigModule } from '../app-config/app-config.module';
-import { EphemeralTokenModule } from '../auth/ephemeral-token.module';
+import { EphemeralTokenModule } from '../auth-core/ephemeral-token.module';
 import { MulterModule } from '@nestjs/platform-express';
 import { AllowedFileTypesModule } from './allowed-file-types.module';
 import { AllowedFileTypesService } from './allowed-file-types.service';

server/src/nest/files/files.service.ts

@@ -8,8 +8,8 @@ import type { TrekWsPayload, TrekWsTripEventName } from '@trek/shared';
 import { RealtimeService } from '../realtime/realtime.service';
 import { PermissionsService } from '../permissions/permissions.service';
 import { avatarUrl } from '../common/avatarUrl';
-import { EphemeralTokenService } from '../auth/ephemeral-token.service';
-import { verifyJwtAndLoadUser } from '../auth/jwt-verify';
+import { EphemeralTokenService } from '../auth-core/ephemeral-token.service';
+import { verifyJwtAndLoadUser } from '../auth-core/jwt-verify';
 import { EntityManager } from '@mikro-orm/core';
 import { Users } from '../../db/entities/Users.entity';
 import { UserSessions } from '../../db/entities/UserSessions.entity';

server/src/nest/google-quota/google-quota.controller.ts

@@ -1,9 +1,9 @@
 import { Body, Controller, Get, Put, Req, UseGuards } from '@nestjs/common';
 import type { Request } from 'express';
 import type { GoogleQuotaStatus } from '@trek/shared';
-import { AdminGuard } from '../auth/admin.guard';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { AdminGuard } from '../auth-core/admin.guard';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { AuditService } from '../audit/audit.service';
 import { getClientIp } from '../audit/client-ip';
 import type { User } from '../../types';

server/src/nest/health/features.controller.ts

@@ -4,7 +4,7 @@ import { MaintenanceRepository } from '../../db/repositories/MaintenanceReposito
 import { KitineraryExtractorService } from '../booking-import/kitinerary-extractor.service';
 import { AddonsService } from '../addons/addons.service';
 import { ADDON_IDS } from '../../addons';
-import { Public } from '../auth/public.decorator';
+import { Public } from '../auth-core/public.decorator';
 import { ReadinessService } from './readiness.service';
 
 /** Exposes the container probe and the server feature flags consumed by the

server/src/nest/help/help.controller.ts

@@ -1,6 +1,6 @@
 import { Controller, Get, HttpException, Param, Query, Req, Res } from '@nestjs/common';
 import type { Request, Response } from 'express';
-import { Public } from '../auth/public.decorator';
+import { Public } from '../auth-core/public.decorator';
 import {
   getWikiIndex,
   getWikiPage,

server/src/nest/integrations/airtrail.controller.ts

@@ -1,8 +1,8 @@
 import { Body, Controller, Get, HttpCode, HttpException, Post, Put, Req, UseGuards } from '@nestjs/common';
 import type { Request } from 'express';
 import type { User } from '../../types';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { AddonGuard } from '../addons/addon.guard';
 import { RequireAddon } from '../addons/require-addon.decorator';
 import { ADDON_IDS } from '../../addons';

server/src/nest/integrations/dawarich.controller.ts

@@ -14,8 +14,8 @@ import {
 } from '@nestjs/common';
 import type { Request } from 'express';
 import type { User } from '../../types';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { AddonGuard } from '../addons/addon.guard';
 import { RequireAddon } from '../addons/require-addon.decorator';
 import { ADDON_IDS } from '../../addons';

server/src/nest/journey/journey-public.controller.ts

@@ -6,7 +6,7 @@ import { StorageService } from '../storage/storage.service';
 import { AddonGuard } from '../addons/addon.guard';
 import { RequireAddon } from '../addons/require-addon.decorator';
 import { ADDON_IDS } from '../../addons';
-import { Public } from '../auth/public.decorator';
+import { Public } from '../auth-core/public.decorator';
 
 /**
  * /api/public/journey — unauthenticated, share-token validated read + photo

server/src/nest/journey/journey.controller.ts

@@ -30,8 +30,8 @@ import { JourneyPhotoCaptureService } from './journey-photo-capture.service';
 import { AddonGuard } from '../addons/addon.guard';
 import { RequireAddon } from '../addons/require-addon.decorator';
 import { ADDON_IDS } from '../../addons';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import {
   JourneyAddTripDto, JourneyContributorAddDto, JourneyContributorUpdateDto, JourneyCreateDto,
   JourneyEntryCreateDto, JourneyEntryPhotoUploadDto, JourneyEntryUpdateDto, JourneyGalleryVideoDto,

server/src/nest/llm-parse/llm-capabilities.controller.ts

@@ -1,8 +1,8 @@
 import { Controller, Get, UseGuards } from '@nestjs/common';
 import type { LlmCapabilitiesResponse } from '@trek/shared';
 import type { User } from '../../types';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { LlmParseService } from './llm-parse.service';
 
 /**

server/src/nest/llm-parse/llm-local.controller.ts

@@ -1,7 +1,7 @@
 import { Controller, Get, Post, Query, Body, Res, UseGuards } from '@nestjs/common';
 import type { Response } from 'express';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { AdminGuard } from '../auth/admin.guard';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { AdminGuard } from '../auth-core/admin.guard';
 import { LlmLocalService } from './llm-local.service';
 import { LlmLocalPullDto } from './llm-local.dto';
 import { ManagedForbidden } from '../common/managed';

server/src/nest/maps/maps.controller.ts

@@ -25,8 +25,8 @@ import type { User } from '../../types';
 import { MapsService } from './maps.service';
 import { StorageService } from '../storage/storage.service';
 import { isClientAbortError } from '../storage/storage.types';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { MapsSearchDto, MapsNearbyDto, MapsAutocompleteDto, MapsResolveUrlDto } from './maps.dto';
 
 /** Google's session-token shape: URL-safe ASCII, at most 36 characters. The

server/src/nest/mcp-transport/mcp-transport.controller.ts

@@ -1,6 +1,6 @@
 import { Controller, Delete, Get, Post, Req, Res } from '@nestjs/common';
 import type { Request, Response } from 'express';
-import { Public } from '../auth/public.decorator';
+import { Public } from '../auth-core/public.decorator';
 import { McpTransportService } from './mcp-transport.service';
 
 /**

server/src/nest/memories/immich.controller.ts

@@ -2,8 +2,8 @@ import { Body, Controller, Get, Headers, HttpCode, Param, Post, Put, Req, Res, U
 import type { Request, Response } from 'express';
 import type { User } from '../../types';
 import { MemoriesService } from './memories.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { getClientIp } from '../audit/client-ip';
 import { ImmichSearchDto, ImmichSettingsDto, ImmichTestDto } from './memories.dto';
 

server/src/nest/memories/synology.controller.ts

@@ -4,8 +4,8 @@ import type { User } from '../../types';
 import type { ServiceResult } from './memories.helpers';
 import { fail, success } from './memories.helpers';
 import { MemoriesService } from './memories.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { SynologySearchDto, SynologySettingsDto, SynologyTestDto } from './memories.dto';
 
 function _parseStringBodyField(value: unknown): string {

server/src/nest/memories/unified.controller.ts

@@ -3,8 +3,8 @@ import type { Response } from 'express';
 import type { User } from '../../types';
 import type { Selection } from './memories.helpers';
 import { MemoriesService } from './memories.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { AddTripPhotosDto, CreateAlbumLinkDto, RemoveTripPhotoDto, SetTripPhotoSharingDto } from './memories.dto';
 
 /**

server/src/nest/notifications/notifications.controller.ts

@@ -22,11 +22,11 @@ import {
   TestNtfyDto,
   NotificationRespondDto,
 } from './notifications.dto';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { AdminGuard } from '../auth/admin.guard';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { AdminGuard } from '../auth-core/admin.guard';
 import { NotificationPreferencesService } from './notification-preferences.service';
 import { AdminNotificationPreferencesDto, NotificationDefaultsUpdateDto } from '../admin/admin.dto';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { ManagedForbidden } from '../common/managed';
 
 // The masked placeholder the client sends instead of a stored secret (8× U+2022).

server/src/nest/notifications/notifications.module.ts

@@ -13,7 +13,6 @@ import { PushController } from './push/push.controller';
 import { PushSubscriptionsService } from './push/push-subscriptions.service';
 import { VapidKeysService } from './push/vapid-keys.service';
 import { MailerModule } from './mailer/mailer.module';
-import { AuthModule } from '../auth/auth.module';
 import { SchedulingModule } from '../scheduling/scheduling.module';
 import { StorageModule } from '../storage/storage.module';
 import { Notifications } from '../../db/entities/Notifications.entity';
@@ -25,9 +24,9 @@ import { TodoItems } from '../../db/entities/TodoItems.entity';
 import { PushSubscriptions } from '../../db/entities/PushSubscriptions.entity';
 
 /** Notifications domain (L6 leaf module). Registered in AppModule.
- *  AuthModule feeds NotificationsMcp's demo gate; MailerModule carries SMTP,
- *  which lives outside this module so AuthService can send the password-reset
- *  mail without AuthModule and NotificationsModule importing each other.
+ *  MailerModule carries SMTP, which lives outside this module so AuthService
+ *  can send the password-reset mail without AuthModule and NotificationsModule
+ *  importing each other.
  *  StorageModule feeds StorageHealthNotifierService, which bridges replica
  *  failures into admin notifications — this direction has no cycle (Storage
  *  imports only AppConfig+Audit+Scheduling).
@@ -63,7 +62,7 @@ import { PushSubscriptions } from '../../db/entities/PushSubscriptions.entity';
       TodoItems,
       PushSubscriptions,
     ]),
-    AuthModule,
+    
     MailerModule,
     SchedulingModule,
     StorageModule,

server/src/nest/notifications/push/push.controller.ts

@@ -1,8 +1,8 @@
 import { Body, Controller, Delete, Get, Headers, HttpCode, HttpException, Post, UseGuards } from '@nestjs/common';
 import type { PushPublicKeyResult, PushSubscribeResult, PushUnsubscribeResult } from '@trek/shared';
 import type { User } from '../../../types';
-import { CurrentUser } from '../../auth/current-user.decorator';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { CurrentUser } from '../../auth-core/current-user.decorator';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { PushSubscribeDto, PushUnsubscribeDto } from '../notifications.dto';
 import { checkPushSubscription } from './push-subscription.helpers';
 import { PushSubscriptionsService } from './push-subscriptions.service';

server/src/nest/oauth/oauth-api.controller.ts

@@ -2,10 +2,10 @@ import { Body, Controller, Delete, Get, HttpCode, HttpException, Param, Post, Qu
 import type { Request, Response } from 'express';
 import { OauthService } from './oauth.service';
 import { RateLimitService } from '../common/rate-limit.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CookieAuthGuard } from '../auth/cookie-auth.guard';
-import { OptionalJwtGuard } from '../auth/optional-jwt.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CookieAuthGuard } from '../auth-core/cookie-auth.guard';
+import { OptionalJwtGuard } from '../auth-core/optional-jwt.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { getClientIp } from '../audit/client-ip';
 import type { User } from '../../types';
 import type { AuthorizeParams } from './oauth.service';

server/src/nest/oauth/oauth-public.controller.ts

@@ -5,7 +5,7 @@ import { RateLimitService } from '../common/rate-limit.service';
 import { getClientIp } from '../audit/client-ip';
 import { logWarn } from '../audit/audit-log.logger';
 import { AuditService } from '../audit/audit.service';
-import { Public } from '../auth/public.decorator';
+import { Public } from '../auth-core/public.decorator';
 import { OAUTH_CLIENT_ALLOWED_SCOPES } from '../../db/json-columns';
 import { decodeJson } from '../../utils/json-column';
 

server/src/nest/oidc/oidc.controller.ts

@@ -4,14 +4,14 @@ import { oidcLoginQuerySchema } from '@trek/shared';
 import { readEnv } from '../../app-config';
 import { OidcService, OIDC_STATE_TTL_MS, OIDC_AUTH_CODE_TTL_MS } from './oidc.service';
 import { cookieOptions } from '../common/cookie';
-import { AdminGuard } from '../auth/admin.guard';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { AdminGuard } from '../auth-core/admin.guard';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import type { User } from '../../types';
 import { AuditService } from '../audit/audit.service';
 import { getClientIp } from '../audit/client-ip';
 import { AdminOidcUpdateDto } from '../admin/admin.dto';
-import { Public } from '../auth/public.decorator';
+import { Public } from '../auth-core/public.decorator';
 import { ManagedForbidden } from '../common/managed';
 import { sessionClientFrom } from '../sessions/sessions.service';
 

server/src/nest/packing/admin-packing-templates.controller.ts

@@ -2,9 +2,9 @@ import { Body, Controller, Delete, Get, HttpCode, HttpException, Param, Post, Pu
 import type { Request } from 'express';
 import { PackingService } from './packing.service';
 import { AdminTemplateNameDto } from '../admin/admin.dto';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { AdminGuard } from '../auth/admin.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { AdminGuard } from '../auth-core/admin.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { getClientIp } from '../audit/client-ip';
 import { AuditService } from '../audit/audit.service';
 import type { User } from '../../types';

server/src/nest/packing/packing.controller.ts

@@ -15,8 +15,8 @@ import type { TrekWsPayload, TrekWsTripEventName } from '@trek/shared';
 import type { User } from '../../types';
 import { PackingService, isInvalidBagRef } from './packing.service';
 import { isUpdateConflict } from '../common/conflictResult';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { RequirePermission, TripAccessGuard } from '../permissions/trip-access.guard';
 import { toRowId } from '../common/row-id';
 import {

server/src/nest/photos/photos.controller.ts

@@ -2,8 +2,8 @@ import { Controller, Get, Headers, HttpException, Param, Res, UseGuards } from '
 import type { Response } from 'express';
 import type { User } from '../../types';
 import { PhotosService } from './photos.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 
 /**
  * /api/photos/:id/{thumbnail,original,info} — global (not trip-scoped) photo

server/src/nest/place-enrichment/place-enrichment.controller.ts

@@ -2,8 +2,8 @@ import { Body, Controller, Get, HttpCode, HttpException, Param, Post, Req, UseGu
 import type { Request } from 'express';
 import type { MapsPlaceEnrichmentResult } from '@trek/shared';
 import type { User } from '../../types';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { RateLimitService } from '../common/rate-limit.service';
 import { PlaceEnrichmentService } from './place-enrichment.service';
 import { PlaceEnrichmentDto } from './place-enrichment.dto';

server/src/nest/place-shadow/place-shadow.controller.ts

@@ -4,8 +4,8 @@ import type {
   PlaceShadowPickResult,
   PlaceShadowSummaryResult,
 } from '@trek/shared';
-import { AdminGuard } from '../auth/admin.guard';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { AdminGuard } from '../auth-core/admin.guard';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
 import { PlaceShadowPickDto } from './place-shadow.dto';
 import { PlaceShadowService } from './place-shadow.service';
 

server/src/nest/places/places.controller.ts

@@ -26,8 +26,8 @@ import type { User } from '../../types';
 import { PlacesService } from './places.service';
 import { isDirectionsUrl } from './maps-dir.helpers';
 import { isUpdateConflict } from '../common/conflictResult';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { RequirePermission, TripAccessGuard } from '../permissions/trip-access.guard';
 import { PLACE_IMAGE_FILE_FILTER } from '../common/place-image-upload';
 import { StorageService } from '../storage/storage.service';

server/src/nest/platform/discovery.controller.ts

@@ -1,6 +1,6 @@
 import { All, Controller, Get, NotFoundException, Req, Res } from '@nestjs/common';
 import type { Request, Response } from 'express';
-import { Public } from '../auth/public.decorator';
+import { Public } from '../auth-core/public.decorator';
 import { DiscoveryMetadataService } from './discovery-metadata.service';
 import { AddonsService } from '../addons/addons.service';
 import { ADDON_IDS } from '../../addons';

server/src/nest/platform/platform.routes.ts

@@ -3,7 +3,7 @@ import path from 'node:path';
 import type { EntityManager } from '@mikro-orm/core';
 
 import { readEnv } from '../../app-config';
-import { verifyJwtAndLoadUser } from '../auth/jwt-verify';
+import { verifyJwtAndLoadUser } from '../auth-core/jwt-verify';
 import { withRequestContext } from '../database/request-context';
 import { StorageService } from '../storage/storage.service';
 import { StorageInvalidKeyError, StorageNotFoundError, type StorageCategory } from '../storage/storage.types';

server/src/nest/plugins/contributions/atlas-layers.controller.ts

@@ -1,6 +1,6 @@
 import { Controller, Get, Req, UseGuards } from '@nestjs/common';
 import type { Request } from 'express';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { stripEmoji } from '../text-sanitize';

server/src/nest/plugins/contributions/day-schedule.controller.ts

@@ -5,7 +5,7 @@ import { Trips } from '../../../db/entities/Trips.entity';
 import type { TripsRepository } from '../../../db/repositories/Trips.repository';
 import { Days } from '../../../db/entities/Days.entity';
 import type { DaysRepository } from '../../../db/repositories/Days.repository';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { stripEmoji } from '../text-sanitize';

server/src/nest/plugins/contributions/day-tints.controller.ts

@@ -5,7 +5,7 @@ import { Trips } from '../../../db/entities/Trips.entity';
 import type { TripsRepository } from '../../../db/repositories/Trips.repository';
 import { Days } from '../../../db/entities/Days.entity';
 import type { DaysRepository } from '../../../db/repositories/Days.repository';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { stripEmoji } from '../text-sanitize';

server/src/nest/plugins/contributions/journal-entry-rows.controller.ts

@@ -6,7 +6,7 @@ import { JourneyEntries } from '../../../db/entities/JourneyEntries.entity';
 import type { JourneyEntriesRepository } from '../../../db/repositories/JourneyEntries.repository';
 import { AddonsService } from '../../addons/addons.service';
 import { ADDON_IDS } from '../../../addons';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { stripEmoji } from '../text-sanitize';

server/src/nest/plugins/contributions/map-layers.controller.ts

@@ -3,7 +3,7 @@ import type { Request } from 'express';
 import { InjectRepository } from '@mikro-orm/nestjs';
 import { Trips } from '../../../db/entities/Trips.entity';
 import type { TripsRepository } from '../../../db/repositories/Trips.repository';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { stripEmoji } from '../text-sanitize';

server/src/nest/plugins/contributions/map-markers.controller.ts

@@ -3,7 +3,7 @@ import type { Request } from 'express';
 import { InjectRepository } from '@mikro-orm/nestjs';
 import { Trips } from '../../../db/entities/Trips.entity';
 import type { TripsRepository } from '../../../db/repositories/Trips.repository';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { stripEmoji } from '../text-sanitize';

server/src/nest/plugins/contributions/pdf-sections.controller.ts

@@ -3,7 +3,7 @@ import type { Request } from 'express';
 import { InjectRepository } from '@mikro-orm/nestjs';
 import { Trips } from '../../../db/entities/Trips.entity';
 import type { TripsRepository } from '../../../db/repositories/Trips.repository';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { stripEmoji } from '../text-sanitize';

server/src/nest/plugins/contributions/place-details.controller.ts

@@ -5,7 +5,7 @@ import { Trips } from '../../../db/entities/Trips.entity';
 import type { TripsRepository } from '../../../db/repositories/Trips.repository';
 import { Places } from '../../../db/entities/Places.entity';
 import type { PlacesRepository } from '../../../db/repositories/Places.repository';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { stripEmoji } from '../text-sanitize';

server/src/nest/plugins/contributions/plugin-calendar.controller.ts

@@ -1,6 +1,6 @@
 import { Controller, Get, Query, Req, UseGuards } from '@nestjs/common';
 import type { Request } from 'express';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { stripEmoji } from '../text-sanitize';

server/src/nest/plugins/contributions/plugin-photos.controller.ts

@@ -1,6 +1,6 @@
 import { Controller, Get, Query, Req, UseGuards } from '@nestjs/common';
 import type { Request } from 'express';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { stripEmoji } from '../text-sanitize';

server/src/nest/plugins/contributions/plugin-pois.controller.ts

@@ -1,8 +1,8 @@
 import { Controller, Get, HttpException, Query, UseGuards } from '@nestjs/common';
 import { pluginPoiQuerySchema, type PluginPoiQuery, type PluginPoiResponse } from '@trek/shared';
 import type { User } from '../../../types';
-import { CurrentUser } from '../../auth/current-user.decorator';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { CurrentUser } from '../../auth-core/current-user.decorator';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { PluginPoisService, UNKNOWN_POI_CATEGORY } from './plugin-pois.service';
 
 const BBOX_FIELDS: ReadonlySet<string> = new Set(['south', 'west', 'north', 'east', 'bbox']);

server/src/nest/plugins/contributions/plugin-routes.controller.ts

@@ -5,7 +5,7 @@ import { Trips } from '../../../db/entities/Trips.entity';
 import type { TripsRepository } from '../../../db/repositories/Trips.repository';
 import { Plugins } from '../../../db/entities/Plugins.entity';
 import type { PluginsRepository } from '../../../db/repositories/Plugins.repository';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { PluginRouteDto } from '../plugins.dto';

server/src/nest/plugins/contributions/plugin-search.controller.ts

@@ -1,7 +1,7 @@
 import { Controller, Get, Query, Req, UseGuards } from '@nestjs/common';
 import type { Request } from 'express';
 import { PLUGIN_SEARCH_SUGGEST_MAX } from '@trek/shared';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import {

server/src/nest/plugins/contributions/trip-card-contributions.controller.ts

@@ -3,7 +3,7 @@ import type { Request } from 'express';
 import { InjectRepository } from '@mikro-orm/nestjs';
 import { Trips } from '../../../db/entities/Trips.entity';
 import type { TripsRepository } from '../../../db/repositories/Trips.repository';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { stripEmoji } from '../text-sanitize';

server/src/nest/plugins/contributions/trip-warnings.controller.ts

@@ -3,7 +3,7 @@ import type { Request } from 'express';
 import { InjectRepository } from '@mikro-orm/nestjs';
 import { Trips } from '../../../db/entities/Trips.entity';
 import type { TripsRepository } from '../../../db/repositories/Trips.repository';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { stripEmoji } from '../text-sanitize';

server/src/nest/plugins/contributions/view-contributions.controller.ts

@@ -3,7 +3,7 @@ import type { Request } from 'express';
 import { InjectRepository } from '@mikro-orm/nestjs';
 import { Trips } from '../../../db/entities/Trips.entity';
 import type { TripsRepository } from '../../../db/repositories/Trips.repository';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginHooks } from '../plugin-hooks.service';
 import { stripEmoji } from '../text-sanitize';

server/src/nest/plugins/oauth/plugin-oauth.controller.ts

@@ -1,7 +1,7 @@
 import { Controller, Get, Param, Post, Query, Req, Res, UseGuards } from '@nestjs/common';
 import type { Request, Response } from 'express';
 import { InjectRepository } from '@mikro-orm/nestjs';
-import { JwtAuthGuard } from '../../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from '../kill-switch';
 import { PluginOAuthService } from './plugin-oauth.service';
 import { Plugins } from '../../../db/entities/Plugins.entity';

server/src/nest/plugins/plugin-activity.controller.ts

@@ -3,7 +3,7 @@ import type { Request } from 'express';
 import { InjectRepository } from '@mikro-orm/nestjs';
 import { PluginCapabilityAudit } from '../../db/entities/PluginCapabilityAudit.entity';
 import type { PluginCapabilityAuditRepository } from '../../db/repositories/PluginCapabilityAudit.repository';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from './kill-switch';
 import { readAuditForUser } from './host/plugin-audit';
 

server/src/nest/plugins/plugin-frame.controller.ts

@@ -5,7 +5,7 @@ import path from 'node:path';
 import { pluginsEnabled } from './kill-switch';
 import { PluginRuntimeService } from './plugin-runtime.service';
 import { pluginCodeDir } from './paths';
-import { Public } from '../auth/public.decorator';
+import { Public } from '../auth-core/public.decorator';
 
 /**
  * Serves a page/widget plugin's static client from /plugin-frame/:id/* (#plugins,

server/src/nest/plugins/plugin-user-settings.controller.ts

@@ -1,7 +1,7 @@
 import { Body, Controller, Get, HttpCode, HttpException, Param, Post, Req, UseGuards } from '@nestjs/common';
 import type { Request } from 'express';
 import { InjectRepository } from '@mikro-orm/nestjs';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from './kill-switch';
 import { PluginsService, MissingRequiredSettingError } from './plugins.service';
 import { PluginRuntimeService } from './plugin-runtime.service';

server/src/nest/plugins/plugins-feed.controller.ts

@@ -3,7 +3,7 @@ import { InjectRepository } from '@mikro-orm/nestjs';
 import type { PluginPoiCategory } from '@trek/shared';
 import { Plugins } from '../../db/entities/Plugins.entity';
 import type { PluginsRepository } from '../../db/repositories/Plugins.repository';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
 import { pluginsEnabled } from './kill-switch';
 import { POI_CATEGORY_PERMISSION, poiCategoriesOf } from './poi-categories';
 

server/src/nest/plugins/plugins-proxy.controller.ts

@@ -1,10 +1,10 @@
 import { All, Controller, Param, Req, Res } from '@nestjs/common';
 import { EntityManager } from '@mikro-orm/core';
 import type { Request, Response } from 'express';
-import { extractToken, verifyJwtAndLoadUser } from '../auth/jwt-verify';
+import { extractToken, verifyJwtAndLoadUser } from '../auth-core/jwt-verify';
 import { pluginsEnabled } from './kill-switch';
 import { PluginRuntimeService } from './plugin-runtime.service';
-import { Public } from '../auth/public.decorator';
+import { Public } from '../auth-core/public.decorator';
 import { Users } from '../../db/entities/Users.entity';
 import { UserSessions } from '../../db/entities/UserSessions.entity';
 

server/src/nest/plugins/plugins.controller.ts

@@ -5,9 +5,9 @@ import { PluginsService, MissingRequiredSettingError } from './plugins.service';
 import { PluginRuntimeService, PluginConsentRequired, PluginDependencyError } from './plugin-runtime.service';
 import { DependencyCycleError } from './dependencies';
 import { PluginRegistryService, RegistryError } from './registry/registry.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { AdminGuard } from '../auth/admin.guard';
-import { CurrentUser } from '../auth/current-user.decorator';
+import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
+import { AdminGuard } from '../auth-core/admin.guard';
+import { CurrentUser } from '../auth-core/current-user.decorator';
 import { getClientIp } from '../audit/client-ip';
 import { pluginsEnabled } from './kill-switch';
 import { devLinkEnabled } from './dev-link';

server/src/nest/realtime/realtime-gateway.module.ts

@@ -1,7 +1,7 @@
 import { Module, type OnModuleDestroy } from '@nestjs/common';
 import { MikroOrmModule } from '@mikro-orm/nestjs';
 import { RealtimeGateway } from './realtime.gateway';
-import { EphemeralTokenModule } from '../auth/ephemeral-token.module';
+import { EphemeralTokenModule } from '../auth-core/ephemeral-token.module';
 import { JourneyDomainModule } from '../journey/journey-domain.module';
 import { AppSettings } from '../../db/entities/AppSettings.entity';
 import { Users } from '../../db/entities/Users.entity';

server/src/nest/realtime/realtime.gateway.ts

@@ -11,7 +11,7 @@ import {
 import type { IncomingMessage } from 'node:http';
 import type { WebSocketServer } from 'ws';
 import { InjectRepository } from '@mikro-orm/nestjs';
-import { EphemeralTokenService } from '../auth/ephemeral-token.service';
+import { EphemeralTokenService } from '../auth-core/ephemeral-token.service';
 import { AppSettings } from '../../db/entities/AppSettings.entity';
 import type { AppSettingsRepository } from '../../db/repositories/AppSettings.repository';
 import { Users } from '../../db/entities/Users.entity';