diff --git a/apps/app/middleware/auth.ts b/apps/app/middleware/auth.ts
new file mode 100644
index 0000000..f625904
--- /dev/null
+++ b/apps/app/middleware/auth.ts
@@ -0,0 +1,11 @@
+/**
+ * Middleware de navigation — protège les pages authentifiées.
+ * Usage : definePageMeta({ middleware: 'auth' }) dans la page.
+ * Redirige vers /connexion si la session est absente.
+ */
+export default defineNuxtRouteMiddleware(async () => {
+  const { session } = useAuth()
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const s = (session as any)?.value ?? session
+  if (!s) return navigateTo('/connexion')
+})
diff --git a/apps/app/package.json b/apps/app/package.json
index eb9131f..2aa4de6 100644
--- a/apps/app/package.json
+++ b/apps/app/package.json
@@ -18,12 +18,15 @@
   "dependencies": {
     "@cvo/shared": "workspace:*",
     "@prisma/client": "^6.2.1",
+    "better-auth": "^1.6.15",
+    "nodemailer": "^8.0.10",
     "playwright-core": "^1.60.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@tailwindcss/vite": "^4.0.0",
     "@types/node": "^22.10.5",
+    "@types/nodemailer": "^8.0.0",
     "nuxt": "^3.15.0",
     "prisma": "^6.2.1",
     "tailwindcss": "^4.0.0",
diff --git a/apps/app/pages/profil.vue b/apps/app/pages/profil.vue
new file mode 100644
index 0000000..7696ee9
--- /dev/null
+++ b/apps/app/pages/profil.vue
@@ -0,0 +1,373 @@
+<script setup lang="ts">
+import type { ProfileDTO, ExperienceDTO, SkillDTO } from '@cvo/shared'
+import { SKILL_LEVELS } from '@cvo/shared'
+
+definePageMeta({ middleware: 'auth' })
+
+// ─── État ───────────────────────────────────────────────────────────────────
+
+const profile = ref<ProfileDTO | null>(null)
+const loadError = ref<string | null>(null)
+const saving = ref(false)
+
+// ─── Chargement ─────────────────────────────────────────────────────────────
+
+const { data, error, refresh } = await useFetch<ProfileDTO | null>('/api/profile')
+if (error.value) {
+  loadError.value = 'Impossible de charger le profil.'
+} else {
+  profile.value = data.value ?? null
+}
+
+// Formulaire en-tête
+const headline = ref(profile.value?.headline ?? '')
+const summary = ref(profile.value?.summary ?? '')
+
+// ─── Sauvegarde en-tête ──────────────────────────────────────────────────────
+
+async function saveHeader() {
+  saving.value = true
+  try {
+    const res = await $fetch<ProfileDTO>('/api/profile', {
+      method: 'PUT',
+      body: { headline: headline.value || null, summary: summary.value || null },
+    })
+    profile.value = res
+  } finally {
+    saving.value = false
+  }
+}
+
+// ─── Expériences ────────────────────────────────────────────────────────────
+
+const expForm = reactive({
+  title: '',
+  company: '',
+  startDate: '',
+  endDate: '',
+  description: '',
+  skillsUsed: '',
+})
+const addingExp = ref(false)
+
+async function addExperience() {
+  addingExp.value = true
+  try {
+    await $fetch('/api/profile/experiences', {
+      method: 'POST',
+      body: {
+        title: expForm.title,
+        company: expForm.company,
+        startDate: expForm.startDate ? new Date(expForm.startDate).toISOString() : null,
+        endDate: expForm.endDate ? new Date(expForm.endDate).toISOString() : null,
+        description: expForm.description || null,
+        skillsUsed: expForm.skillsUsed.split(',').map((s) => s.trim()).filter(Boolean),
+      },
+    })
+    Object.assign(expForm, { title: '', company: '', startDate: '', endDate: '', description: '', skillsUsed: '' })
+    await refresh()
+    profile.value = data.value ?? null
+  } finally {
+    addingExp.value = false
+  }
+}
+
+async function deleteExperience(id: string) {
+  await $fetch(`/api/profile/experiences/${id}`, { method: 'DELETE' })
+  await refresh()
+  profile.value = data.value ?? null
+}
+
+// ─── Compétences ─────────────────────────────────────────────────────────────
+
+const skillForm = reactive({ label: '', level: '' as string, years: '' })
+const addingSkill = ref(false)
+
+async function addSkill() {
+  addingSkill.value = true
+  try {
+    await $fetch('/api/profile/skills', {
+      method: 'POST',
+      body: {
+        label: skillForm.label,
+        level: skillForm.level || null,
+        years: skillForm.years ? Number(skillForm.years) : null,
+      },
+    })
+    Object.assign(skillForm, { label: '', level: '', years: '' })
+    await refresh()
+    profile.value = data.value ?? null
+  } finally {
+    addingSkill.value = false
+  }
+}
+
+async function deleteSkill(id: string) {
+  await $fetch(`/api/profile/skills/${id}`, { method: 'DELETE' })
+  await refresh()
+  profile.value = data.value ?? null
+}
+
+// ─── Import copier-coller ────────────────────────────────────────────────────
+
+const pasteText = ref('')
+const importing = ref(false)
+const importApplied = ref(false)
+
+type ParsedProfile = {
+  headline: string | null
+  summary: string | null
+  experiences: Omit<ExperienceDTO, 'id'>[]
+  skills: Omit<SkillDTO, 'id'>[]
+}
+
+const importResult = ref<ParsedProfile | null>(null)
+
+async function doParse() {
+  importing.value = true
+  importResult.value = null
+  try {
+    const res = await $fetch<ParsedProfile>('/api/profile/import-text', {
+      method: 'POST',
+      body: { text: pasteText.value },
+    })
+    importResult.value = res
+  } finally {
+    importing.value = false
+  }
+}
+
+async function applyImport() {
+  if (!importResult.value) return
+  saving.value = true
+  try {
+    const r = importResult.value
+    await $fetch('/api/profile', {
+      method: 'PUT',
+      body: { headline: r.headline, summary: r.summary },
+    })
+    for (const exp of r.experiences) {
+      await $fetch('/api/profile/experiences', { method: 'POST', body: exp })
+    }
+    for (const sk of r.skills) {
+      await $fetch('/api/profile/skills', { method: 'POST', body: sk })
+    }
+    pasteText.value = ''
+    importResult.value = null
+    importApplied.value = true
+    await refresh()
+    profile.value = data.value ?? null
+    headline.value = profile.value?.headline ?? ''
+    summary.value = profile.value?.summary ?? ''
+  } finally {
+    saving.value = false
+  }
+}
+</script>
+
+<template>
+  <div class="max-w-2xl mx-auto py-10 px-4 space-y-10">
+    <h1 class="text-2xl font-semibold text-ink-900">Mon profil</h1>
+
+    <p v-if="loadError" role="alert" class="text-danger-500 text-sm">{{ loadError }}</p>
+
+    <!-- ── En-tête profil ── -->
+    <section class="space-y-4">
+      <h2 class="text-lg font-medium text-ink-700">En-tête</h2>
+      <div class="space-y-3">
+        <div class="space-y-1">
+          <label for="headline" class="block text-sm font-medium text-ink-700">Intitulé de poste</label>
+          <input
+            id="headline"
+            v-model="headline"
+            type="text"
+            maxlength="150"
+            placeholder="ex. Développeur Full-Stack Vue / Node"
+            class="w-full rounded-card border border-ink-500/30 bg-surface px-3 py-2 text-sm text-ink-900 placeholder-ink-500 focus:outline-none focus:ring-2 focus:ring-brand-500"
+          />
+        </div>
+        <div class="space-y-1">
+          <label for="summary" class="block text-sm font-medium text-ink-700">Résumé / accroche</label>
+          <textarea
+            id="summary"
+            v-model="summary"
+            rows="4"
+            maxlength="2000"
+            placeholder="Quelques phrases sur votre parcours et vos ambitions…"
+            class="w-full rounded-card border border-ink-500/30 bg-surface px-3 py-2 text-sm text-ink-900 placeholder-ink-500 focus:outline-none focus:ring-2 focus:ring-brand-500 resize-none"
+          />
+        </div>
+        <button
+          :disabled="saving"
+          class="rounded-card bg-brand-600 px-4 py-2 text-sm font-medium text-white hover:bg-brand-700 disabled:opacity-50 transition-colors"
+          @click="saveHeader"
+        >
+          {{ saving ? 'Sauvegarde…' : 'Enregistrer' }}
+        </button>
+      </div>
+    </section>
+
+    <!-- ── Expériences ── -->
+    <section class="space-y-4">
+      <h2 class="text-lg font-medium text-ink-700">Expériences</h2>
+
+      <ul v-if="profile?.experiences.length" class="space-y-3">
+        <li
+          v-for="exp in profile.experiences"
+          :key="exp.id"
+          class="bg-surface rounded-card border border-ink-500/20 p-4 flex justify-between gap-4"
+        >
+          <div>
+            <p class="font-medium text-ink-900">{{ exp.title }}</p>
+            <p class="text-sm text-ink-500">{{ exp.company }}</p>
+          </div>
+          <button
+            class="text-sm text-danger-500 hover:underline shrink-0"
+            @click="deleteExperience(exp.id)"
+          >Supprimer</button>
+        </li>
+      </ul>
+      <p v-else class="text-sm text-ink-500">Aucune expérience saisie.</p>
+
+      <!-- Formulaire ajout -->
+      <details class="rounded-card border border-ink-500/20 bg-surface-muted">
+        <summary class="cursor-pointer px-4 py-3 text-sm font-medium text-ink-700 select-none">
+          + Ajouter une expérience
+        </summary>
+        <div class="px-4 pb-4 pt-2 space-y-3">
+          <input v-model="expForm.title" type="text" placeholder="Titre du poste *" required
+            class="w-full rounded-card border border-ink-500/30 bg-surface px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-500" />
+          <input v-model="expForm.company" type="text" placeholder="Entreprise *" required
+            class="w-full rounded-card border border-ink-500/30 bg-surface px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-500" />
+          <div class="grid grid-cols-2 gap-3">
+            <input v-model="expForm.startDate" type="date" aria-label="Date de début"
+              class="w-full rounded-card border border-ink-500/30 bg-surface px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-500" />
+            <input v-model="expForm.endDate" type="date" aria-label="Date de fin (vide = en cours)"
+              class="w-full rounded-card border border-ink-500/30 bg-surface px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-500" />
+          </div>
+          <textarea v-model="expForm.description" rows="3" placeholder="Description (optionnel)"
+            class="w-full rounded-card border border-ink-500/30 bg-surface px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-500 resize-none" />
+          <input v-model="expForm.skillsUsed" type="text" placeholder="Compétences utilisées (séparées par des virgules)"
+            class="w-full rounded-card border border-ink-500/30 bg-surface px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-500" />
+          <button
+            :disabled="addingExp || !expForm.title || !expForm.company"
+            class="rounded-card bg-brand-600 px-4 py-2 text-sm font-medium text-white hover:bg-brand-700 disabled:opacity-50 transition-colors"
+            @click="addExperience"
+          >
+            {{ addingExp ? 'Ajout…' : 'Ajouter' }}
+          </button>
+        </div>
+      </details>
+    </section>
+
+    <!-- ── Compétences ── -->
+    <section class="space-y-4">
+      <h2 class="text-lg font-medium text-ink-700">Compétences</h2>
+      <p class="text-xs text-ink-500">
+        Saisissez uniquement vos <strong>compétences réelles</strong> — elles seront la source de vérité du moteur de génération.
+      </p>
+
+      <ul v-if="profile?.skills.length" class="flex flex-wrap gap-2">
+        <li
+          v-for="sk in profile.skills"
+          :key="sk.id"
+          class="flex items-center gap-1 rounded-full bg-brand-100 px-3 py-1 text-sm text-brand-700"
+        >
+          <span>{{ sk.label }}</span>
+          <span v-if="sk.level" class="text-xs text-brand-500">({{ sk.level.toLowerCase() }})</span>
+          <button class="text-brand-500 hover:text-danger-500 ml-1 text-xs" @click="deleteSkill(sk.id)">✕</button>
+        </li>
+      </ul>
+      <p v-else class="text-sm text-ink-500">Aucune compétence saisie.</p>
+
+      <!-- Formulaire ajout compétence -->
+      <details class="rounded-card border border-ink-500/20 bg-surface-muted">
+        <summary class="cursor-pointer px-4 py-3 text-sm font-medium text-ink-700 select-none">
+          + Ajouter une compétence
+        </summary>
+        <div class="px-4 pb-4 pt-2 space-y-3">
+          <input v-model="skillForm.label" type="text" placeholder="Compétence (ex. TypeScript) *" required
+            class="w-full rounded-card border border-ink-500/30 bg-surface px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-500" />
+          <div class="grid grid-cols-2 gap-3">
+            <select v-model="skillForm.level"
+              class="w-full rounded-card border border-ink-500/30 bg-surface px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-500">
+              <option value="">Niveau (optionnel)</option>
+              <option v-for="l in SKILL_LEVELS" :key="l" :value="l">{{ l.charAt(0) + l.slice(1).toLowerCase() }}</option>
+            </select>
+            <input v-model="skillForm.years" type="number" min="0" max="50" placeholder="Années (optionnel)"
+              class="w-full rounded-card border border-ink-500/30 bg-surface px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-500" />
+          </div>
+          <button
+            :disabled="addingSkill || !skillForm.label"
+            class="rounded-card bg-brand-600 px-4 py-2 text-sm font-medium text-white hover:bg-brand-700 disabled:opacity-50 transition-colors"
+            @click="addSkill"
+          >
+            {{ addingSkill ? 'Ajout…' : 'Ajouter' }}
+          </button>
+        </div>
+      </details>
+    </section>
+
+    <!-- ── Import copier-coller ── -->
+    <section class="space-y-4">
+      <h2 class="text-lg font-medium text-ink-700">Import par copier-coller</h2>
+      <p class="text-sm text-ink-500">
+        Copiez le texte de votre CV ou LinkedIn et collez-le ici. Une suggestion de profil sera générée
+        pour relecture — <strong>rien n'est enregistré avant votre confirmation</strong>.
+      </p>
+
+      <textarea
+        v-model="pasteText"
+        rows="8"
+        placeholder="Collez ici votre CV ou profil LinkedIn en texte brut…"
+        class="w-full rounded-card border border-ink-500/30 bg-surface px-3 py-2 text-sm text-ink-900 placeholder-ink-500 focus:outline-none focus:ring-2 focus:ring-brand-500 resize-y"
+      />
+
+      <button
+        :disabled="importing || pasteText.length < 10"
+        class="rounded-card bg-brand-600 px-4 py-2 text-sm font-medium text-white hover:bg-brand-700 disabled:opacity-50 transition-colors"
+        @click="doParse"
+      >
+        {{ importing ? 'Analyse…' : 'Analyser le texte' }}
+      </button>
+
+      <!-- Résultat de l'analyse -->
+      <div v-if="importResult" class="rounded-card border border-brand-100 bg-brand-50 p-4 space-y-3">
+        <p class="text-sm font-medium text-brand-700">Relecture avant enregistrement</p>
+        <div v-if="importResult.headline" class="text-sm text-ink-700">
+          <span class="font-medium">Intitulé :</span> {{ importResult.headline }}
+        </div>
+        <div v-if="importResult.summary" class="text-sm text-ink-700">
+          <span class="font-medium">Résumé :</span> {{ importResult.summary }}
+        </div>
+        <div v-if="importResult.experiences.length">
+          <p class="text-sm font-medium text-ink-700">{{ importResult.experiences.length }} expérience(s) détectée(s)</p>
+          <ul class="text-xs text-ink-500 list-disc list-inside">
+            <li v-for="(e, i) in importResult.experiences" :key="i">{{ e.title }} — {{ e.company }}</li>
+          </ul>
+        </div>
+        <div v-if="importResult.skills.length">
+          <p class="text-sm font-medium text-ink-700">{{ importResult.skills.length }} compétence(s) détectée(s)</p>
+          <p class="text-xs text-ink-500">{{ importResult.skills.map((s) => s.label).join(', ') }}</p>
+        </div>
+        <div class="flex gap-3">
+          <button
+            :disabled="saving"
+            class="rounded-card bg-success-500 px-4 py-2 text-sm font-medium text-white hover:opacity-90 disabled:opacity-50 transition-colors"
+            @click="applyImport"
+          >
+            {{ saving ? 'Enregistrement…' : 'Confirmer et enregistrer' }}
+          </button>
+          <button
+            class="rounded-card border border-ink-500/30 px-4 py-2 text-sm text-ink-700 hover:bg-surface-muted transition-colors"
+            @click="importResult = null"
+          >
+            Annuler
+          </button>
+        </div>
+      </div>
+
+      <p v-if="importApplied" class="text-sm text-success-500">✓ Profil importé et enregistré.</p>
+    </section>
+  </div>
+</template>
diff --git a/apps/app/server/api/profile/experiences.post.ts b/apps/app/server/api/profile/experiences.post.ts
new file mode 100644
index 0000000..5a7b622
--- /dev/null
+++ b/apps/app/server/api/profile/experiences.post.ts
@@ -0,0 +1,46 @@
+/**
+ * POST /api/profile/experiences — Ajouter une expérience au profil.
+ */
+import { z } from 'zod'
+import { getAuthSession } from '../../utils/session'
+import { prisma } from '../../utils/prisma'
+import { NOT_DELETED } from '../../utils/profile-serialize'
+
+const bodySchema = z.object({
+  title: z.string().min(1).max(150),
+  company: z.string().min(1).max(150),
+  startDate: z.string().datetime({ offset: true }).nullable().optional(),
+  endDate: z.string().datetime({ offset: true }).nullable().optional(),
+  description: z.string().max(2000).nullable().optional(),
+  skillsUsed: z.array(z.string().max(80)).max(30).default([]),
+  orderIndex: z.number().int().min(0).default(0),
+})
+
+export default defineEventHandler(async (event) => {
+  const session = await getAuthSession(event)
+  if (!session?.user) throw createError({ statusCode: 401, message: 'Non authentifié.' })
+
+  const profile = await prisma.profile.findFirst({ where: { userId: session.user.id, ...NOT_DELETED } })
+  if (!profile) throw createError({ statusCode: 404, message: 'Profil introuvable. Initialisez-le d\'abord via PUT /api/profile.' })
+
+  const body = await readBody(event)
+  const parsed = bodySchema.safeParse(body)
+  if (!parsed.success) throw createError({ statusCode: 400, message: 'Corps invalide.', data: parsed.error.flatten() })
+
+  const { title, company, startDate, endDate, description, skillsUsed, orderIndex } = parsed.data
+
+  const exp = await prisma.experience.create({
+    data: {
+      profileId: profile.id,
+      title,
+      company,
+      startDate: startDate ? new Date(startDate) : null,
+      endDate: endDate ? new Date(endDate) : null,
+      description: description ?? null,
+      skillsUsed,
+      orderIndex,
+    },
+  })
+
+  return { id: exp.id }
+})
diff --git a/apps/app/server/api/profile/experiences/[id].delete.ts b/apps/app/server/api/profile/experiences/[id].delete.ts
new file mode 100644
index 0000000..704de1c
--- /dev/null
+++ b/apps/app/server/api/profile/experiences/[id].delete.ts
@@ -0,0 +1,24 @@
+/**
+ * DELETE /api/profile/experiences/:id — Soft-delete d'une expérience.
+ * RGPD : soft-delete uniquement (la ligne reste pour le job de purge).
+ */
+import { getAuthSession } from '../../../utils/session'
+import { prisma } from '../../../utils/prisma'
+import { NOT_DELETED } from '../../../utils/profile-serialize'
+
+export default defineEventHandler(async (event) => {
+  const session = await getAuthSession(event)
+  if (!session?.user) throw createError({ statusCode: 401, message: 'Non authentifié.' })
+
+  const id = getRouterParam(event, 'id')
+  if (!id) throw createError({ statusCode: 400, message: 'id requis.' })
+
+  // Vérifier l'ownership via le profil
+  const exp = await prisma.experience.findFirst({
+    where: { id, ...NOT_DELETED, profile: { userId: session.user.id, ...NOT_DELETED } },
+  })
+  if (!exp) throw createError({ statusCode: 404, message: 'Expérience introuvable.' })
+
+  await prisma.experience.update({ where: { id }, data: { deletedAt: new Date() } })
+  return { ok: true }
+})
diff --git a/apps/app/server/api/profile/import-text.post.ts b/apps/app/server/api/profile/import-text.post.ts
new file mode 100644
index 0000000..28560b6
--- /dev/null
+++ b/apps/app/server/api/profile/import-text.post.ts
@@ -0,0 +1,122 @@
+/**
+ * POST /api/profile/import-text — Import profil par copier-coller de texte (MVP).
+ *
+ * Le texte collé est parsé de façon déterministe (pas de LLM) en blocs heuristiques.
+ * Le résultat est retourné comme suggestion — l'utilisateur confirme avant que les
+ * données soient persistées (guard : il appelle ensuite PUT /api/profile + POST skills).
+ *
+ * Garde-fou : on ne crée rien en base ici. On retourne uniquement les données parsées
+ * pour revue dans l'UI. L'utilisateur est la source de vérité.
+ */
+import { z } from 'zod'
+import { getAuthSession } from '../../utils/session'
+import type { ExperienceDTO, SkillDTO } from '@cvo/shared'
+
+const bodySchema = z.object({ text: z.string().min(10).max(10_000) })
+
+interface ParsedProfile {
+  headline: string | null
+  summary: string | null
+  experiences: Omit<ExperienceDTO, 'id'>[]
+  skills: Omit<SkillDTO, 'id'>[]
+}
+
+/**
+ * Parseur heuristique minimal (MVP) :
+ * - Lignes débutant par des marqueurs d'expérience (•, -, *, dates YYYY) → experiences
+ * - Tokens ressemblant à des compétences (courts, sans ponctuation lourde) → skills
+ * - Reste → headline / summary
+ *
+ * L'extraction visuelle d'un CV PDF est hors scope MVP (→ V1.1 THI-120 §4c).
+ */
+function parseProfileText(text: string): ParsedProfile {
+  const lines = text.split('\n').map((l) => l.trim()).filter(Boolean)
+
+  const experiences: Omit<ExperienceDTO, 'id'>[] = []
+  const skillSet = new Set<string>()
+  const summaryLines: string[] = []
+
+  // Heuristiques simples
+  const expLineRe = /^(\d{4})\s*[-–]\s*(\d{4}|présent|aujourd'hui|actuel|en cours)/i
+  const bulletRe = /^[•\-*]\s+(.+)/
+
+  let idx = 0
+  let orderIndex = 0
+
+  while (idx < lines.length) {
+    const line = lines[idx]!
+
+    // Ligne de type "YYYY – YYYY  Titre  |  Entreprise"
+    const expMatch = line.match(expLineRe)
+    if (expMatch) {
+      const rest = line.slice(line.indexOf(expMatch[2]!) + expMatch[2]!.length).trim()
+      const parts = rest.split(/\s{2,}|\s*\|\s*/)
+      experiences.push({
+        title: parts[0] ?? rest,
+        company: parts[1] ?? '',
+        startDate: expMatch[1] ? `${expMatch[1]}-01-01T00:00:00.000Z` : null,
+        endDate: expMatch[2]?.match(/\d{4}/) ? `${expMatch[2]}-12-31T00:00:00.000Z` : null,
+        description: null,
+        skillsUsed: [],
+        orderIndex: orderIndex++,
+      })
+      idx++
+      continue
+    }
+
+    // Bullet → potentielle compétence ou description
+    const bulletMatch = line.match(bulletRe)
+    if (bulletMatch) {
+      const content = bulletMatch[1]!
+      // Court (<= 40 chars sans virgule) → compétence candidate
+      if (content.length <= 40 && !content.includes(',')) {
+        skillSet.add(content)
+      } else if (experiences.length > 0) {
+        // Ajouter à la description de la dernière expérience
+        const last = experiences[experiences.length - 1]!
+        last.description = last.description ? `${last.description}\n${content}` : content
+      } else {
+        summaryLines.push(content)
+      }
+      idx++
+      continue
+    }
+
+    // Ligne avec des virgules → liste de compétences
+    if (line.includes(',') && line.length < 200) {
+      line.split(',').forEach((s) => {
+        const t = s.trim()
+        if (t && t.length <= 60) skillSet.add(t)
+      })
+      idx++
+      continue
+    }
+
+    summaryLines.push(line)
+    idx++
+  }
+
+  const skills: Omit<SkillDTO, 'id'>[] = Array.from(skillSet).map((label, i) => ({
+    label,
+    level: null,
+    years: null,
+    orderIndex: i,
+  }))
+
+  const headline = summaryLines[0] ?? null
+  const summary = summaryLines.slice(1).join(' ').trim() || null
+
+  return { headline, summary, experiences, skills }
+}
+
+export default defineEventHandler(async (event) => {
+  const session = await getAuthSession(event)
+  if (!session?.user) throw createError({ statusCode: 401, message: 'Non authentifié.' })
+
+  const body = await readBody(event)
+  const parsed = bodySchema.safeParse(body)
+  if (!parsed.success) throw createError({ statusCode: 400, message: 'Corps invalide.', data: parsed.error.flatten() })
+
+  // Aucune écriture en base : on retourne uniquement la suggestion.
+  return parseProfileText(parsed.data.text)
+})
diff --git a/apps/app/server/api/profile/index.get.ts b/apps/app/server/api/profile/index.get.ts
new file mode 100644
index 0000000..372c193
--- /dev/null
+++ b/apps/app/server/api/profile/index.get.ts
@@ -0,0 +1,25 @@
+/**
+ * GET /api/profile — Lecture du profil candidat connecté.
+ * Retourne le profil existant (ou null si jamais créé).
+ * Seuls les sous-éléments non soft-delete sont exposés.
+ */
+import { getAuthSession } from '../../utils/session'
+import { prisma } from '../../utils/prisma'
+import { NOT_DELETED, toProfileDTO } from '../../utils/profile-serialize'
+
+export default defineEventHandler(async (event) => {
+  const session = await getAuthSession(event)
+  if (!session?.user) throw createError({ statusCode: 401, message: 'Non authentifié.' })
+
+  const profile = await prisma.profile.findFirst({
+    where: { userId: session.user.id, ...NOT_DELETED },
+    include: {
+      experiences: { orderBy: { orderIndex: 'asc' } },
+      skills: { orderBy: { orderIndex: 'asc' } },
+      education: { orderBy: { orderIndex: 'asc' } },
+    },
+  })
+
+  if (!profile) return null
+  return toProfileDTO(profile)
+})
diff --git a/apps/app/server/api/profile/index.put.ts b/apps/app/server/api/profile/index.put.ts
new file mode 100644
index 0000000..f9faf20
--- /dev/null
+++ b/apps/app/server/api/profile/index.put.ts
@@ -0,0 +1,44 @@
+/**
+ * PUT /api/profile — Upsert des champs scalaires du profil (headline + summary).
+ * Crée le profil s'il n'existe pas encore (premier appel après création de compte).
+ */
+import { z } from 'zod'
+import { getAuthSession } from '../../utils/session'
+import { prisma } from '../../utils/prisma'
+import { toProfileDTO } from '../../utils/profile-serialize'
+
+const bodySchema = z.object({
+  headline: z.string().max(150).nullable().optional(),
+  summary: z.string().max(2000).nullable().optional(),
+})
+
+export default defineEventHandler(async (event) => {
+  const session = await getAuthSession(event)
+  if (!session?.user) throw createError({ statusCode: 401, message: 'Non authentifié.' })
+
+  const body = await readBody(event)
+  const parsed = bodySchema.safeParse(body)
+  if (!parsed.success) throw createError({ statusCode: 400, message: 'Corps invalide.', data: parsed.error.flatten() })
+
+  const { headline, summary } = parsed.data
+
+  const profile = await prisma.profile.upsert({
+    where: { userId: session.user.id },
+    update: {
+      ...(headline !== undefined && { headline }),
+      ...(summary !== undefined && { summary }),
+    },
+    create: {
+      userId: session.user.id,
+      headline: headline ?? null,
+      summary: summary ?? null,
+    },
+    include: {
+      experiences: { orderBy: { orderIndex: 'asc' } },
+      skills: { orderBy: { orderIndex: 'asc' } },
+      education: { orderBy: { orderIndex: 'asc' } },
+    },
+  })
+
+  return toProfileDTO(profile)
+})
diff --git a/apps/app/server/api/profile/skills.post.ts b/apps/app/server/api/profile/skills.post.ts
new file mode 100644
index 0000000..95f80ff
--- /dev/null
+++ b/apps/app/server/api/profile/skills.post.ts
@@ -0,0 +1,43 @@
+/**
+ * POST /api/profile/skills — Ajouter une compétence RÉELLE déclarée.
+ * Garde-fou : ces données saisies = seule source de vérité du moteur (THI-124).
+ */
+import { z } from 'zod'
+import { SKILL_LEVELS } from '@cvo/shared'
+import { getAuthSession } from '../../utils/session'
+import { prisma } from '../../utils/prisma'
+import { NOT_DELETED } from '../../utils/profile-serialize'
+
+const bodySchema = z.object({
+  label: z.string().min(1).max(80),
+  level: z.enum(SKILL_LEVELS as [string, ...string[]]).nullable().optional(),
+  years: z.number().int().min(0).max(50).nullable().optional(),
+  orderIndex: z.number().int().min(0).default(0),
+})
+
+export default defineEventHandler(async (event) => {
+  const session = await getAuthSession(event)
+  if (!session?.user) throw createError({ statusCode: 401, message: 'Non authentifié.' })
+
+  const profile = await prisma.profile.findFirst({ where: { userId: session.user.id, ...NOT_DELETED } })
+  if (!profile) throw createError({ statusCode: 404, message: 'Profil introuvable.' })
+
+  const body = await readBody(event)
+  const parsed = bodySchema.safeParse(body)
+  if (!parsed.success) throw createError({ statusCode: 400, message: 'Corps invalide.', data: parsed.error.flatten() })
+
+  const { label, level, years, orderIndex } = parsed.data
+
+  const skill = await prisma.skill.create({
+    data: {
+      profileId: profile.id,
+      label,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      level: (level as any) ?? null,
+      years: years ?? null,
+      orderIndex,
+    },
+  })
+
+  return { id: skill.id }
+})
diff --git a/apps/app/server/api/profile/skills/[id].delete.ts b/apps/app/server/api/profile/skills/[id].delete.ts
new file mode 100644
index 0000000..87b17b7
--- /dev/null
+++ b/apps/app/server/api/profile/skills/[id].delete.ts
@@ -0,0 +1,22 @@
+/**
+ * DELETE /api/profile/skills/:id — Soft-delete d'une compétence.
+ */
+import { getAuthSession } from '../../../utils/session'
+import { prisma } from '../../../utils/prisma'
+import { NOT_DELETED } from '../../../utils/profile-serialize'
+
+export default defineEventHandler(async (event) => {
+  const session = await getAuthSession(event)
+  if (!session?.user) throw createError({ statusCode: 401, message: 'Non authentifié.' })
+
+  const id = getRouterParam(event, 'id')
+  if (!id) throw createError({ statusCode: 400, message: 'id requis.' })
+
+  const skill = await prisma.skill.findFirst({
+    where: { id, ...NOT_DELETED, profile: { userId: session.user.id, ...NOT_DELETED } },
+  })
+  if (!skill) throw createError({ statusCode: 404, message: 'Compétence introuvable.' })
+
+  await prisma.skill.update({ where: { id }, data: { deletedAt: new Date() } })
+  return { ok: true }
+})
diff --git a/apps/app/server/utils/profile-serialize.ts b/apps/app/server/utils/profile-serialize.ts
new file mode 100644
index 0000000..b47e089
--- /dev/null
+++ b/apps/app/server/utils/profile-serialize.ts
@@ -0,0 +1,108 @@
+import type { EducationDTO, ExperienceDTO, ProfileDTO, SkillDTO } from '@cvo/shared'
+
+/**
+ * Sérialisation Profil (Prisma → DTO transport) et fragment de filtre soft-delete.
+ * Fonctions PURES → testables sans base. Règle : on n'expose jamais une ligne
+ * dont `deletedAt` est renseigné (RGPD, droit à l'effacement).
+ */
+
+/**
+ * Fragment Prisma « non supprimé » à réutiliser dans tous les `where` de lecture.
+ * Exemple : `prisma.profile.findFirst({ where: { userId, ...NOT_DELETED } })`.
+ */
+export const NOT_DELETED = { deletedAt: null } as const
+
+/** Date Prisma (ou null) → ISO-8601 string (ou null) pour le transport. */
+export function toIso(value: Date | null): string | null {
+  return value === null ? null : value.toISOString()
+}
+
+/** Forme minimale d'une ligne porteuse de soft-delete (pour le typage des helpers). */
+interface SoftDeletable {
+  deletedAt: Date | null
+}
+
+/** Exclut les lignes soft-delete puis trie par `orderIndex` croissant. */
+export function activeOrdered<T extends SoftDeletable & { orderIndex: number }>(rows: T[]): T[] {
+  return rows.filter((r) => r.deletedAt === null).sort((a, b) => a.orderIndex - b.orderIndex)
+}
+
+// Formes Prisma minimales attendues en entrée (sous-ensemble des modèles).
+interface ExperienceRow extends SoftDeletable {
+  id: string
+  title: string
+  company: string
+  startDate: Date | null
+  endDate: Date | null
+  description: string | null
+  skillsUsed: string[]
+  orderIndex: number
+}
+interface SkillRow extends SoftDeletable {
+  id: string
+  label: string
+  level: SkillDTO['level']
+  years: number | null
+  orderIndex: number
+}
+interface EducationRow extends SoftDeletable {
+  id: string
+  degree: string
+  school: string
+  startDate: Date | null
+  endDate: Date | null
+  description: string | null
+  orderIndex: number
+}
+interface ProfileRow {
+  id: string
+  headline: string | null
+  summary: string | null
+  experiences: ExperienceRow[]
+  skills: SkillRow[]
+  education: EducationRow[]
+}
+
+function toExperienceDTO(e: ExperienceRow): ExperienceDTO {
+  return {
+    id: e.id,
+    title: e.title,
+    company: e.company,
+    startDate: toIso(e.startDate),
+    endDate: toIso(e.endDate),
+    description: e.description,
+    skillsUsed: e.skillsUsed,
+    orderIndex: e.orderIndex,
+  }
+}
+
+function toSkillDTO(s: SkillRow): SkillDTO {
+  return { id: s.id, label: s.label, level: s.level, years: s.years, orderIndex: s.orderIndex }
+}
+
+function toEducationDTO(ed: EducationRow): EducationDTO {
+  return {
+    id: ed.id,
+    degree: ed.degree,
+    school: ed.school,
+    startDate: toIso(ed.startDate),
+    endDate: toIso(ed.endDate),
+    description: ed.description,
+    orderIndex: ed.orderIndex,
+  }
+}
+
+/**
+ * Mappe un profil Prisma (avec relations) vers le DTO transport : exclut les
+ * enfants soft-delete et garantit l'ordre d'affichage.
+ */
+export function toProfileDTO(profile: ProfileRow): ProfileDTO {
+  return {
+    id: profile.id,
+    headline: profile.headline,
+    summary: profile.summary,
+    experiences: activeOrdered(profile.experiences).map(toExperienceDTO),
+    skills: activeOrdered(profile.skills).map(toSkillDTO),
+    education: activeOrdered(profile.education).map(toEducationDTO),
+  }
+}
diff --git a/apps/app/server/utils/session.ts b/apps/app/server/utils/session.ts
index fa9f921..0a0b35f 100644
--- a/apps/app/server/utils/session.ts
+++ b/apps/app/server/utils/session.ts
@@ -1,18 +1,18 @@
 /**
- * Résolution de l'utilisateur courant côté serveur (Nitro).
+ * Helpers de session serveur (Nitro).
  *
- * Découplage volontaire du lot Auth (THI-131) : on lit `event.context.userId`,
- * renseigné par le middleware d'authentification (Better Auth). Ce WS (THI-126)
- * n'importe donc pas l'instance auth, ce qui le garde indépendant de l'ordre de
- * merge. Quand le middleware d'auth est en place, l'id est disponible ici ;
- * sinon l'accès est refusé (401) plutôt que d'attribuer l'usage au mauvais compte.
+ * - `requireUserId` (THI-126) : lit `event.context.userId` posé par le middleware
+ *   d'auth (THI-134) et lève une 401 si absent. Découplé de l'instance Better Auth.
+ * - `getAuthSession` (THI-132) : récupère la session Better Auth complète depuis
+ *   l'événement (headers Web API via `toWebRequest`). Retourne null si non authentifié.
  */
 import { createError, type H3Event } from 'h3'
+import { auth } from './auth'
 
 // Le middleware d'auth renseigne l'id utilisateur dans le contexte de requête.
 declare module 'h3' {
   interface H3EventContext {
-    /** Id de l'utilisateur authentifié (renseigné par le middleware auth, THI-131). */
+    /** Id de l'utilisateur authentifié (renseigné par le middleware auth, THI-131/THI-134). */
     userId?: string
   }
 }
@@ -25,3 +25,9 @@ export function requireUserId(event: H3Event): string {
   }
   return userId
 }
+
+/** Récupère la session Better Auth complète (ou null si non authentifié). */
+export async function getAuthSession(event: H3Event) {
+  const req = toWebRequest(event)
+  return auth.api.getSession({ headers: req.headers })
+}
diff --git a/apps/app/test/profile-serialize.spec.ts b/apps/app/test/profile-serialize.spec.ts
new file mode 100644
index 0000000..f7cb93f
--- /dev/null
+++ b/apps/app/test/profile-serialize.spec.ts
@@ -0,0 +1,92 @@
+import { describe, it, expect } from 'vitest'
+import {
+  NOT_DELETED,
+  activeOrdered,
+  toIso,
+  toProfileDTO,
+} from '../server/utils/profile-serialize'
+
+describe('NOT_DELETED', () => {
+  it('is the Prisma fragment selecting non-soft-deleted rows', () => {
+    expect(NOT_DELETED).toEqual({ deletedAt: null })
+  })
+})
+
+describe('toIso', () => {
+  it('passes null through', () => {
+    expect(toIso(null)).toBeNull()
+  })
+  it('serialises a Date to ISO-8601', () => {
+    expect(toIso(new Date('2026-01-02T03:04:05.000Z'))).toBe('2026-01-02T03:04:05.000Z')
+  })
+})
+
+describe('activeOrdered', () => {
+  const rows = [
+    { id: 'b', orderIndex: 1, deletedAt: null },
+    { id: 'gone', orderIndex: 0, deletedAt: new Date('2026-01-01T00:00:00.000Z') },
+    { id: 'a', orderIndex: 0, deletedAt: null },
+  ]
+
+  it('drops soft-deleted rows and sorts by orderIndex', () => {
+    expect(activeOrdered(rows).map((r) => r.id)).toEqual(['a', 'b'])
+  })
+})
+
+describe('toProfileDTO', () => {
+  const d = (s: string) => new Date(s)
+  const profile = {
+    id: 'p1',
+    headline: 'Développeuse Full-Stack',
+    summary: null,
+    experiences: [
+      {
+        id: 'e2',
+        title: 'Lead',
+        company: 'Acme',
+        startDate: d('2023-01-01T00:00:00.000Z'),
+        endDate: null,
+        description: 'En cours',
+        skillsUsed: ['Vue', 'Nitro'],
+        orderIndex: 1,
+        deletedAt: null,
+      },
+      {
+        id: 'e-del',
+        title: 'Supprimée',
+        company: 'X',
+        startDate: null,
+        endDate: null,
+        description: null,
+        skillsUsed: [],
+        orderIndex: 0,
+        deletedAt: d('2026-01-01T00:00:00.000Z'),
+      },
+      {
+        id: 'e1',
+        title: 'Dev',
+        company: 'Beta',
+        startDate: d('2020-01-01T00:00:00.000Z'),
+        endDate: d('2022-12-31T00:00:00.000Z'),
+        description: null,
+        skillsUsed: [],
+        orderIndex: 0,
+        deletedAt: null,
+      },
+    ],
+    skills: [{ id: 's1', label: 'TypeScript', level: 'EXPERT' as const, years: 6, orderIndex: 0, deletedAt: null }],
+    education: [],
+  }
+
+  it('maps to DTO, excludes soft-deleted children and keeps display order', () => {
+    const dto = toProfileDTO(profile)
+    expect(dto.id).toBe('p1')
+    expect(dto.experiences.map((e) => e.id)).toEqual(['e1', 'e2'])
+    expect(dto.experiences[0]!.startDate).toBe('2020-01-01T00:00:00.000Z')
+    expect(dto.experiences[1]!.endDate).toBeNull()
+    expect(dto.skills).toEqual([
+      { id: 's1', label: 'TypeScript', level: 'EXPERT', years: 6, orderIndex: 0 },
+    ])
+    expect(dto.education).toEqual([])
+  })
+})
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 47e973e..b3d035e 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -38,6 +38,12 @@ importers:
       '@prisma/client':
         specifier: ^6.2.1
         version: 6.19.3(prisma@6.19.3(magicast@0.5.3)(typescript@5.9.3))(typescript@5.9.3)
+      better-auth:
+        specifier: ^1.6.15
+        version: 1.6.15(@prisma/client@6.19.3(prisma@6.19.3(magicast@0.5.3)(typescript@5.9.3))(typescript@5.9.3))(prisma@6.19.3(magicast@0.5.3)(typescript@5.9.3))(vitest@3.2.6(@types/node@22.19.20)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(yaml@2.9.0))(vue@3.5.35(typescript@5.9.3))
+      nodemailer:
+        specifier: ^8.0.10
+        version: 8.0.10
       playwright-core:
         specifier: ^1.60.0
         version: 1.60.0
@@ -51,6 +57,9 @@ importers:
       '@types/node':
         specifier: ^22.10.5
         version: 22.19.20
+      '@types/nodemailer':
+        specifier: ^8.0.0
+        version: 8.0.0
       nuxt:
         specifier: ^3.15.0
         version: 3.21.8(@parcel/watcher@2.5.6)(@types/node@22.19.20)(@vue/compiler-sfc@3.5.35)(cac@6.7.14)(db0@0.3.4)(eslint@9.39.4(jiti@2.7.0))(ioredis@5.11.1)(lightningcss@1.32.0)(magicast@0.5.3)(optionator@0.9.4)(rollup-plugin-visualizer@7.0.1(rollup@4.61.1))(rollup@4.61.1)(srvx@0.11.16)(terser@5.48.0)(typescript@5.9.3)(vite@7.3.5(@types/node@22.19.20)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(yaml@2.9.0))(vue-tsc@2.2.12(typescript@5.9.3))(yaml@2.9.0)
@@ -198,6 +207,85 @@ packages:
     resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
     engines: {node: '>=6.9.0'}
 
+  '@better-auth/core@1.6.15':
+    resolution: {integrity: sha512-gPgeEn+2t2cohSKj1CJFCJLo4jNqvtvhKP/y6Uwuurg4ReEf2Y9PUCYffvbp7DDc+GevWTuD0Cv9x0+e83+HpA==}
+    peerDependencies:
+      '@better-auth/utils': 0.4.1
+      '@better-fetch/fetch': 1.1.21
+      '@cloudflare/workers-types': '>=4'
+      '@opentelemetry/api': ^1.9.0
+      better-call: 1.3.5
+      jose: ^6.1.0
+      kysely: ^0.28.5 || ^0.29.0
+      nanostores: ^1.0.1
+    peerDependenciesMeta:
+      '@cloudflare/workers-types':
+        optional: true
+      '@opentelemetry/api':
+        optional: true
+
+  '@better-auth/drizzle-adapter@1.6.15':
+    resolution: {integrity: sha512-+ho2RozN6cZmCN+6XkZd/ec5iolVlefgInQ7znJ18qRPbgllHxdyu9tGrgKZyEsXSCyqAa6wi5Yb4hd3WZmTNQ==}
+    peerDependencies:
+      '@better-auth/core': ^1.6.15
+      '@better-auth/utils': 0.4.1
+      drizzle-orm: ^0.45.2
+    peerDependenciesMeta:
+      drizzle-orm:
+        optional: true
+
+  '@better-auth/kysely-adapter@1.6.15':
+    resolution: {integrity: sha512-E29Sugm+DWRK4oQNBPrjPA4kBYiKy2bBtX1arIlkuyAB9A1BEb4Xn+8t7wlNIF5eFcxpkFZ3F80ceSpWDSYU0Q==}
+    peerDependencies:
+      '@better-auth/core': ^1.6.15
+      '@better-auth/utils': 0.4.1
+      kysely: ^0.28.17 || ^0.29.0
+    peerDependenciesMeta:
+      kysely:
+        optional: true
+
+  '@better-auth/memory-adapter@1.6.15':
+    resolution: {integrity: sha512-BRE5Ft0Tn5thOPjCmyXHge7kOI/paLybaKDU+Hzg24DZMU6JvWooYWzvf52r1viDbxq5tz0G97iyaH4bouDyug==}
+    peerDependencies:
+      '@better-auth/core': ^1.6.15
+      '@better-auth/utils': 0.4.1
+
+  '@better-auth/mongo-adapter@1.6.15':
+    resolution: {integrity: sha512-r0X9AtFhwDeOU1KMP9kZ5NeV0O3TSFzn8+uidaH+aicy2e1dNUsd9nPYrozEloSxdA2ZOnv5gD4jzH7HPeKkUQ==}
+    peerDependencies:
+      '@better-auth/core': ^1.6.15
+      '@better-auth/utils': 0.4.1
+      mongodb: ^6.0.0 || ^7.0.0
+    peerDependenciesMeta:
+      mongodb:
+        optional: true
+
+  '@better-auth/prisma-adapter@1.6.15':
+    resolution: {integrity: sha512-pUOlIUnpMu2l8C2ytgu46+OoOr3LZ+aLpJMFRGIPdnWl1BF2co2YaoZPT3+ZBu1Lzm0FrBN1ZRCAzZbkFoeIAQ==}
+    peerDependencies:
+      '@better-auth/core': ^1.6.15
+      '@better-auth/utils': 0.4.1
+      '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0
+      prisma: ^5.0.0 || ^6.0.0 || ^7.0.0
+    peerDependenciesMeta:
+      '@prisma/client':
+        optional: true
+      prisma:
+        optional: true
+
+  '@better-auth/telemetry@1.6.15':
+    resolution: {integrity: sha512-eoFlUPVrVXLML9saHD11OSKKSRCAYETgRgBW4vQF3Y6pCgmThKD9oehYk3kkb/FsRgfqmsocmvAFqsiyjPIygg==}
+    peerDependencies:
+      '@better-auth/core': ^1.6.15
+      '@better-auth/utils': 0.4.1
+      '@better-fetch/fetch': 1.1.21
+
+  '@better-auth/utils@0.4.1':
+    resolution: {integrity: sha512-SZBPRPF3z0nBvE5ygOkxae35wnnXPRShmqFo78S+qslLeFoPu/pMgnXAuNKFMMybac3tiLaVg1e3MQW5MC+1iA==}
+
+  '@better-fetch/fetch@1.1.21':
+    resolution: {integrity: sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A==}
+
   '@bomb.sh/tab@0.0.15':
     resolution: {integrity: sha512-Y90ub44TAvbdO9P8mcD/XPyQjFhiR5xmd4Fk7JErmWmEWEUimNnjWiBrVZ16Tj3GA1rLZ+uvCN2V/pzLawv31g==}
     hasBin: true
@@ -665,6 +753,14 @@ packages:
       '@emnapi/core': ^1.7.1
       '@emnapi/runtime': ^1.7.1
 
+  '@noble/ciphers@2.2.0':
+    resolution: {integrity: sha512-Z6pjIZ/8IJcCGzb2S/0Px5J81yij85xASuk1teLNeg75bfT07MV3a/O2Mtn1I2se43k3lkVEcFaR10N4cgQcZA==}
+    engines: {node: '>= 20.19.0'}
+
+  '@noble/hashes@2.2.0':
+    resolution: {integrity: sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==}
+    engines: {node: '>= 20.19.0'}
+
   '@nodelib/fs.scandir@2.1.5':
     resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
     engines: {node: '>= 8'}
@@ -748,6 +844,10 @@ packages:
       rollup-plugin-visualizer:
         optional: true
 
+  '@opentelemetry/semantic-conventions@1.41.1':
+    resolution: {integrity: sha512-/UhIkaZgPutTFmQ7RnIJGgDXZmtEJ7Dvi86xNTFWcnRxVRNk/aotsqDJYeEvDP+FSMB2SdW+pQzNMcWP0rwuNA==}
+    engines: {node: '>=14'}
+
   '@oxc-minify/binding-android-arm-eabi@0.132.0':
     resolution: {integrity: sha512-NXxgL3FNGEBz8r+8iSl8wSdyCEMGisVmn2GVuJc5GycWgGzxiP9V9/svgD039JnO9nRAi0j+hP3FNAuDCP4aQg==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -1570,6 +1670,9 @@ packages:
   '@types/node@22.19.20':
     resolution: {integrity: sha512-6tELRwSDYWW9EdZhbeZmYGZ1/7Djkt+Ah3/ScEYT9cDord7UJzasR/4D3VONg9tQI5CDp+/CZC1AXj2pCFOvpw==}
 
+  '@types/nodemailer@8.0.0':
+    resolution: {integrity: sha512-fyf8jWULsCo0d0BuoQ75i6IeoHs47qcqxWc7yUdUcV0pOZGjUTTOvwdG1PRXUDqN/8A64yQdQdnA2pZgcdi+cA==}
+
   '@types/resolve@1.20.2':
     resolution: {integrity: sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==}
 
@@ -1942,6 +2045,76 @@ packages:
     engines: {node: '>=6.0.0'}
     hasBin: true
 
+  better-auth@1.6.15:
+    resolution: {integrity: sha512-0nuQuEru3ZrLF+9xFUuN3llAmR+6gHLtLunoXaZxB9lXGjSmfBcc6SZUgYq4DfzugPnLvdnzYazsyprZFSFC4Q==}
+    peerDependencies:
+      '@lynx-js/react': '*'
+      '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0
+      '@sveltejs/kit': ^2.0.0
+      '@tanstack/react-start': ^1.0.0
+      '@tanstack/solid-start': ^1.0.0
+      better-sqlite3: ^12.0.0
+      drizzle-kit: '>=0.31.4'
+      drizzle-orm: ^0.45.2
+      mongodb: ^6.0.0 || ^7.0.0
+      mysql2: ^3.0.0
+      next: ^14.0.0 || ^15.0.0 || ^16.0.0
+      pg: ^8.0.0
+      prisma: ^5.0.0 || ^6.0.0 || ^7.0.0
+      react: ^18.0.0 || ^19.0.0
+      react-dom: ^18.0.0 || ^19.0.0
+      solid-js: ^1.0.0
+      svelte: ^4.0.0 || ^5.0.0
+      vitest: ^2.0.0 || ^3.0.0 || ^4.0.0
+      vue: ^3.0.0
+    peerDependenciesMeta:
+      '@lynx-js/react':
+        optional: true
+      '@prisma/client':
+        optional: true
+      '@sveltejs/kit':
+        optional: true
+      '@tanstack/react-start':
+        optional: true
+      '@tanstack/solid-start':
+        optional: true
+      better-sqlite3:
+        optional: true
+      drizzle-kit:
+        optional: true
+      drizzle-orm:
+        optional: true
+      mongodb:
+        optional: true
+      mysql2:
+        optional: true
+      next:
+        optional: true
+      pg:
+        optional: true
+      prisma:
+        optional: true
+      react:
+        optional: true
+      react-dom:
+        optional: true
+      solid-js:
+        optional: true
+      svelte:
+        optional: true
+      vitest:
+        optional: true
+      vue:
+        optional: true
+
+  better-call@1.3.5:
+    resolution: {integrity: sha512-kOFJkBP7utAQLEYrobZm3vkTH8mXq5GNgvjc5/XEST1ilVHaxXUXfeDeFlqoETMtyqS4+3/h4ONX2i++ebZrvA==}
+    peerDependencies:
+      zod: ^4.0.0
+    peerDependenciesMeta:
+      zod:
+        optional: true
+
   bindings@1.5.0:
     resolution: {integrity: sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==}
 
@@ -2794,6 +2967,9 @@ packages:
     resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
     hasBin: true
 
+  jose@6.2.3:
+    resolution: {integrity: sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==}
+
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
@@ -2837,6 +3013,10 @@ packages:
   knitwork@1.3.0:
     resolution: {integrity: sha512-4LqMNoONzR43B1W0ek0fhXMsDNW/zxa1NdFAVMY+k28pgZLovR4G3PB5MrpTxCy1QaZCqNoiaKPr5w5qZHfSNw==}
 
+  kysely@0.29.2:
+    resolution: {integrity: sha512-s6WVJyEZrbm6jhBpiKHsGHyePMrVQKJ85wZCFCr9W4QHv6WTjWIrdvTmO9hDEA3bNK0xkrE2DqrHsXMLWuZpQg==}
+    engines: {node: '>=22.0.0'}
+
   launch-editor@2.14.1:
     resolution: {integrity: sha512-QWBrQsMpH7gPr965dsKD/3cKWiNoTjpATQf++Xq63N6sKRGMwlVXz41O1IZTMfZQgBctD/K5Zt06+/I6pP6+HA==}
 
@@ -3050,6 +3230,10 @@ packages:
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
+  nanostores@1.3.0:
+    resolution: {integrity: sha512-XPUa/jz+P1oJvN9VBxw4L9MtdFfaH3DAryqPssqhb2kXjmb9npz0dly6rCsgFWOPr4Yg9mTfM3MDZgZZ+7A3lA==}
+    engines: {node: ^20.0.0 || >=22.0.0}
+
   nanotar@0.3.0:
     resolution: {integrity: sha512-Kv2JYYiCzt16Kt5QwAc9BFG89xfPNBx+oQL4GQXD9nLqPkZBiNaqaCWtwnbk/q7UVsTYevvM1b0UF8zmEI4pCg==}
 
@@ -3096,6 +3280,10 @@ packages:
     resolution: {integrity: sha512-Uzmd6LXpouKo8EUK68IjH4+E01w/hXyV3R3g/geCJo+rXLNfh1xucB+LOzYEOQPSiUK3h/xZf0cQGcSsmyL2Og==}
     engines: {node: '>=18'}
 
+  nodemailer@8.0.10:
+    resolution: {integrity: sha512-BLFuSth7QtHOkBzyqTehWWyub0NTRDuK2Q2SQfnGLsrJnzyU+Yeh4WpV1eZGuARFj1xQJHIdnTuJZLP+b9R1GQ==}
+    engines: {node: '>=6.0.0'}
+
   nopt@8.1.0:
     resolution: {integrity: sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A==}
     engines: {node: ^18.17.0 || >=20.5.0}
@@ -3582,6 +3770,9 @@ packages:
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
+  rou3@0.7.12:
+    resolution: {integrity: sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg==}
+
   rou3@0.8.1:
     resolution: {integrity: sha512-ePa+XGk00/3HuCqrEnK3LxJW7I0SdNg6EFzKUJG73hMAdDcOUC/i/aSz7LSDwLrGr33kal/rqOGydzwl6U7zBA==}
 
@@ -3633,6 +3824,9 @@ packages:
     resolution: {integrity: sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==}
     engines: {node: '>= 18'}
 
+  set-cookie-parser@3.1.0:
+    resolution: {integrity: sha512-kjnC1DXBHcxaOaOXBHBeRtltsDG2nUiUni+jP92M9gYdW12rsmx92UsfpH7o5tDRs7I1ZZPSQJQGv3UaRfCiuw==}
+
   setprototypeof@1.2.0:
     resolution: {integrity: sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==}
 
@@ -4487,6 +4681,60 @@ snapshots:
       '@babel/helper-string-parser': 7.29.7
       '@babel/helper-validator-identifier': 7.29.7
 
+  '@better-auth/core@1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0)':
+    dependencies:
+      '@better-auth/utils': 0.4.1
+      '@better-fetch/fetch': 1.1.21
+      '@opentelemetry/semantic-conventions': 1.41.1
+      '@standard-schema/spec': 1.1.0
+      better-call: 1.3.5(zod@4.4.3)
+      jose: 6.2.3
+      kysely: 0.29.2
+      nanostores: 1.3.0
+      zod: 4.4.3
+
+  '@better-auth/drizzle-adapter@1.6.15(@better-auth/core@1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0))(@better-auth/utils@0.4.1)':
+    dependencies:
+      '@better-auth/core': 1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0)
+      '@better-auth/utils': 0.4.1
+
+  '@better-auth/kysely-adapter@1.6.15(@better-auth/core@1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0))(@better-auth/utils@0.4.1)(kysely@0.29.2)':
+    dependencies:
+      '@better-auth/core': 1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0)
+      '@better-auth/utils': 0.4.1
+    optionalDependencies:
+      kysely: 0.29.2
+
+  '@better-auth/memory-adapter@1.6.15(@better-auth/core@1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0))(@better-auth/utils@0.4.1)':
+    dependencies:
+      '@better-auth/core': 1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0)
+      '@better-auth/utils': 0.4.1
+
+  '@better-auth/mongo-adapter@1.6.15(@better-auth/core@1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0))(@better-auth/utils@0.4.1)':
+    dependencies:
+      '@better-auth/core': 1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0)
+      '@better-auth/utils': 0.4.1
+
+  '@better-auth/prisma-adapter@1.6.15(@better-auth/core@1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0))(@better-auth/utils@0.4.1)(@prisma/client@6.19.3(prisma@6.19.3(magicast@0.5.3)(typescript@5.9.3))(typescript@5.9.3))(prisma@6.19.3(magicast@0.5.3)(typescript@5.9.3))':
+    dependencies:
+      '@better-auth/core': 1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0)
+      '@better-auth/utils': 0.4.1
+    optionalDependencies:
+      '@prisma/client': 6.19.3(prisma@6.19.3(magicast@0.5.3)(typescript@5.9.3))(typescript@5.9.3)
+      prisma: 6.19.3(magicast@0.5.3)(typescript@5.9.3)
+
+  '@better-auth/telemetry@1.6.15(@better-auth/core@1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0))(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)':
+    dependencies:
+      '@better-auth/core': 1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0)
+      '@better-auth/utils': 0.4.1
+      '@better-fetch/fetch': 1.1.21
+
+  '@better-auth/utils@0.4.1':
+    dependencies:
+      '@noble/hashes': 2.2.0
+
+  '@better-fetch/fetch@1.1.21': {}
+
   '@bomb.sh/tab@0.0.15(cac@6.7.14)(citty@0.2.2)':
     optionalDependencies:
       cac: 6.7.14
@@ -4823,6 +5071,10 @@ snapshots:
       '@tybys/wasm-util': 0.10.2
     optional: true
 
+  '@noble/ciphers@2.2.0': {}
+
+  '@noble/hashes@2.2.0': {}
+
   '@nodelib/fs.scandir@2.1.5':
     dependencies:
       '@nodelib/fs.stat': 2.0.5
@@ -5133,6 +5385,8 @@ snapshots:
       - vue-tsc
       - yaml
 
+  '@opentelemetry/semantic-conventions@1.41.1': {}
+
   '@oxc-minify/binding-android-arm-eabi@0.132.0':
     optional: true
 
@@ -5686,6 +5940,10 @@ snapshots:
     dependencies:
       undici-types: 6.21.0
 
+  '@types/nodemailer@8.0.0':
+    dependencies:
+      '@types/node': 22.19.20
+
   '@types/resolve@1.20.2': {}
 
   '@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)':
@@ -6159,6 +6417,43 @@ snapshots:
 
   baseline-browser-mapping@2.10.34: {}
 
+  better-auth@1.6.15(@prisma/client@6.19.3(prisma@6.19.3(magicast@0.5.3)(typescript@5.9.3))(typescript@5.9.3))(prisma@6.19.3(magicast@0.5.3)(typescript@5.9.3))(vitest@3.2.6(@types/node@22.19.20)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(yaml@2.9.0))(vue@3.5.35(typescript@5.9.3)):
+    dependencies:
+      '@better-auth/core': 1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0)
+      '@better-auth/drizzle-adapter': 1.6.15(@better-auth/core@1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0))(@better-auth/utils@0.4.1)
+      '@better-auth/kysely-adapter': 1.6.15(@better-auth/core@1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0))(@better-auth/utils@0.4.1)(kysely@0.29.2)
+      '@better-auth/memory-adapter': 1.6.15(@better-auth/core@1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0))(@better-auth/utils@0.4.1)
+      '@better-auth/mongo-adapter': 1.6.15(@better-auth/core@1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0))(@better-auth/utils@0.4.1)
+      '@better-auth/prisma-adapter': 1.6.15(@better-auth/core@1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0))(@better-auth/utils@0.4.1)(@prisma/client@6.19.3(prisma@6.19.3(magicast@0.5.3)(typescript@5.9.3))(typescript@5.9.3))(prisma@6.19.3(magicast@0.5.3)(typescript@5.9.3))
+      '@better-auth/telemetry': 1.6.15(@better-auth/core@1.6.15(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.29.2)(nanostores@1.3.0))(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)
+      '@better-auth/utils': 0.4.1
+      '@better-fetch/fetch': 1.1.21
+      '@noble/ciphers': 2.2.0
+      '@noble/hashes': 2.2.0
+      better-call: 1.3.5(zod@4.4.3)
+      defu: 6.1.7
+      jose: 6.2.3
+      kysely: 0.29.2
+      nanostores: 1.3.0
+      zod: 4.4.3
+    optionalDependencies:
+      '@prisma/client': 6.19.3(prisma@6.19.3(magicast@0.5.3)(typescript@5.9.3))(typescript@5.9.3)
+      prisma: 6.19.3(magicast@0.5.3)(typescript@5.9.3)
+      vitest: 3.2.6(@types/node@22.19.20)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(yaml@2.9.0)
+      vue: 3.5.35(typescript@5.9.3)
+    transitivePeerDependencies:
+      - '@cloudflare/workers-types'
+      - '@opentelemetry/api'
+
+  better-call@1.3.5(zod@4.4.3):
+    dependencies:
+      '@better-auth/utils': 0.4.1
+      '@better-fetch/fetch': 1.1.21
+      rou3: 0.7.12
+      set-cookie-parser: 3.1.0
+    optionalDependencies:
+      zod: 4.4.3
+
   bindings@1.5.0:
     dependencies:
       file-uri-to-path: 1.0.0
@@ -7033,6 +7328,8 @@ snapshots:
 
   jiti@2.7.0: {}
 
+  jose@6.2.3: {}
+
   js-tokens@4.0.0: {}
 
   js-tokens@9.0.1: {}
@@ -7061,6 +7358,8 @@ snapshots:
 
   knitwork@1.3.0: {}
 
+  kysely@0.29.2: {}
+
   launch-editor@2.14.1:
     dependencies:
       picocolors: 1.1.1
@@ -7260,6 +7559,8 @@ snapshots:
 
   nanoid@3.3.12: {}
 
+  nanostores@1.3.0: {}
+
   nanotar@0.3.0: {}
 
   natural-compare@1.4.0: {}
@@ -7385,6 +7686,8 @@ snapshots:
 
   node-releases@2.0.47: {}
 
+  nodemailer@8.0.10: {}
+
   nopt@8.1.0:
     dependencies:
       abbrev: 3.0.1
@@ -8026,6 +8329,8 @@ snapshots:
       '@rollup/rollup-win32-x64-msvc': 4.61.1
       fsevents: 2.3.3
 
+  rou3@0.7.12: {}
+
   rou3@0.8.1: {}
 
   run-applescript@7.1.0: {}
@@ -8079,6 +8384,8 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  set-cookie-parser@3.1.0: {}
+
   setprototypeof@1.2.0: {}
 
   shebang-command@2.0.0: