@fonderie/auth 7.22.0 → 7.23.0

package/dist/index.cjs

@@ -100,7 +100,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/routes.ts
-var import_core10 = require("@fonderie/core");
+var import_core11 = require("@fonderie/core");
 var import_middlewares2 = require("@fonderie/core/middlewares");
 
 // src/middlewares/require-email-login.ts
@@ -125,6 +125,41 @@ var import_middlewares = require("@fonderie/core/middlewares");
 
 // src/services/rate-limit.ts
 var import_rate_limit = require("@fonderie/rate-limit");
+
+// src/services/email.ts
+function normalizeEmail(email2) {
+  if (typeof email2 !== "string" || email2.length === 0) {
+    throw new Error("Invalid email");
+  }
+  const lower = email2.trim().toLowerCase();
+  if (lower.length === 0) {
+    throw new Error("Email cannot be empty");
+  }
+  const atIndex = lower.indexOf("@");
+  if (atIndex === -1 || lower.lastIndexOf("@") !== atIndex) {
+    throw new Error("Invalid email format");
+  }
+  const local = lower.substring(0, atIndex);
+  const domain = lower.substring(atIndex + 1);
+  if (!local || !domain) {
+    throw new Error("Invalid email format");
+  }
+  const plusIndex = local.indexOf("+");
+  const normalizedLocal = plusIndex === -1 ? local : local.substring(0, plusIndex);
+  if (!normalizedLocal) {
+    throw new Error("Invalid email format");
+  }
+  return `${normalizedLocal}@${domain}`;
+}
+function normalizeEmailSafe(email2) {
+  try {
+    return normalizeEmail(email2);
+  } catch {
+    return null;
+  }
+}
+
+// src/services/rate-limit.ts
 var min = (n) => n * 60;
 var DEFAULTS = {
   // login: 10/15min per IP AND 5/15min per account (credential stuffing
@@ -177,7 +212,9 @@ function buildAuthAccountLimiter(route, store, config) {
   return (0, import_rate_limit.rateLimit)({
     store: r.store,
     rule: r.account.rule,
-    key: (0, import_rate_limit.byBodyField)(`auth:${route}`, r.account.field)
+    // The account bucket is keyed the way accounts are stored, so a rotating
+    // '+tag' on the same address does not buy fresh attempts.
+    key: (0, import_rate_limit.byBodyField)(`auth:${route}`, r.account.field, r.account.field === "email" ? normalizeEmailSafe : void 0)
   });
 }
 
@@ -352,6 +389,10 @@ var EVENT_KEYS = {
   // 'password-changed', 'admin', 'refresh-reuse' (theft signal).
   sessionRevoked: "fonderie.session.revoked"
 };
+var deletionGracePeriodDays = (config) => {
+  const days = config.accountDeletion?.gracePeriodDays;
+  return typeof days === "number" && Number.isFinite(days) && days >= 0 ? days : 30;
+};
 
 // src/services/jwt.ts
 var import_node_crypto = require("crypto");
@@ -768,6 +809,27 @@ var UserModel = class {
     );
     return row ?? null;
   }
+  /**
+   * An ARCHIVED (soft-deleted, not yet purged) account holding this address.
+   * Only for telling its owner — after they prove it is theirs — that it is
+   * scheduled for deletion, and for refusing to create a second account on
+   * the address meanwhile. Never for signing in.
+   */
+  async findArchivedByEmail(email2) {
+    const [row] = await this.store.query(
+      `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE email = $1 AND deleted_at IS NOT NULL`,
+      [email2]
+    );
+    return row ?? null;
+  }
+  /** As findArchivedByEmail, for a phone number. */
+  async findArchivedByPhone(phone2) {
+    const [row] = await this.store.query(
+      `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE phone = $1 AND deleted_at IS NOT NULL`,
+      [phone2]
+    );
+    return row ?? null;
+  }
   async findByPhone(phone2) {
     const [row] = await this.store.query(
       `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE phone = $1 AND deleted_at IS NULL`,
@@ -1622,7 +1684,7 @@ function mfaController(store, config, issuer, bus) {
 // src/controllers/auth.controller.ts
 var import_node_crypto6 = require("crypto");
 var import_events2 = require("@fonderie/events");
-var import_core6 = require("@fonderie/core");
+var import_core7 = require("@fonderie/core");
 
 // src/services/cooldown.ts
 function checkCooldown(lastSentAt, cooldownMs) {
@@ -1633,37 +1695,26 @@ function checkCooldown(lastSentAt, cooldownMs) {
 // src/controllers/auth.controller.ts
 init_password();
 
-// src/services/email.ts
-function normalizeEmail(email2) {
-  if (typeof email2 !== "string" || email2.length === 0) {
-    throw new Error("Invalid email");
-  }
-  const lower = email2.trim().toLowerCase();
-  if (lower.length === 0) {
-    throw new Error("Email cannot be empty");
-  }
-  const atIndex = lower.indexOf("@");
-  if (atIndex === -1 || lower.lastIndexOf("@") !== atIndex) {
-    throw new Error("Invalid email format");
-  }
-  const local = lower.substring(0, atIndex);
-  const domain = lower.substring(atIndex + 1);
-  if (!local || !domain) {
-    throw new Error("Invalid email format");
-  }
-  const plusIndex = local.indexOf("+");
-  const normalizedLocal = plusIndex === -1 ? local : local.substring(0, plusIndex);
-  if (!normalizedLocal) {
-    throw new Error("Invalid email format");
-  }
-  return `${normalizedLocal}@${domain}`;
+// src/services/pending-deletion.ts
+var import_core6 = require("@fonderie/core");
+function deletionDate(deletedAt, config) {
+  return new Date(deletedAt.getTime() + deletionGracePeriodDays(config) * 24 * 60 * 60 * 1e3);
 }
-function normalizeEmailSafe(email2) {
-  try {
-    return normalizeEmail(email2);
-  } catch {
-    return null;
-  }
+function pendingDeletionResponse(deletedAt, config) {
+  const deleteOn = deletionDate(deletedAt, config);
+  return (0, import_core6.setApiResponse)(
+    import_core6.HTTP.FORBIDDEN,
+    "ACCOUNT_PENDING_DELETION",
+    `This account is scheduled for deletion on ${deleteOn.toISOString().slice(0, 10)}.`,
+    { requestedAt: deletedAt.toISOString(), deleteOn: deleteOn.toISOString() }
+  );
+}
+function archivedAddressResponse() {
+  return (0, import_core6.setApiResponse)(
+    import_core6.HTTP.CONFLICT,
+    "ACCOUNT_PENDING_DELETION",
+    "An account using this address is scheduled for deletion. Sign in to keep it, or wait until it is deleted."
+  );
 }
 
 // src/models/password-reset.model.ts
@@ -1822,7 +1873,7 @@ function extractRefreshToken(ctx) {
   const match = cookie.match(/(?:^|;\s*)refresh_token=([^;]+)/);
   return match?.[1] ?? null;
 }
-function authController(store, config, bus, locales = (0, import_core6.defineLocales)()) {
+function authController(store, config, bus, locales = (0, import_core7.defineLocales)()) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store, config.location);
   const loginEvents = new LoginEventModel(store, config.location);
@@ -1834,23 +1885,24 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
     register: async (ctx) => {
       const body = ctx.meta["body"];
       const { email: email2, password: password2, phone: phone2, firstName = null, lastName = null } = body ?? {};
-      const locale = (0, import_core6.canonicalLocale)(body?.["locale"]) ?? locales.default;
+      const locale = (0, import_core7.canonicalLocale)(body?.["locale"]) ?? locales.default;
       if (typeof email2 === "string" && typeof password2 === "string") {
         const normalizedEmail = normalizeEmailSafe(email2);
         if (!normalizedEmail) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
         }
         if (password2.length < 8) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.UNPROCESSABLE,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.UNPROCESSABLE,
             "INVALID_PARAMETER",
             "password must be at least 8 characters"
           );
         }
         const existing = await users.findByEmail(normalizedEmail);
         if (existing) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Email already registered");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Email already registered");
         }
+        if (await users.findArchivedByEmail(normalizedEmail)) return archivedAddressResponse();
         const passwordHash = await hashPassword(password2);
         const row = await users.create(
           normalizedEmail,
@@ -1860,18 +1912,18 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           locale
         );
         if (!row) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
         const pin = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
         await emailVerif.create(row.id, pin, expiresAt);
         const user = await users.findById(row.id);
         if (!user) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
         const reqId = ctx.meta["requestId"];
         const reqOpts = reqId !== void 0 ? { requestId: reqId } : void 0;
-        await (0, import_core6.background)(bus?.emit(
+        await (0, import_core7.background)(bus?.emit(
           import_events2.NOTIFICATION_EVENT,
           {
             type: MESSAGE_KEYS.emailRegistration,
@@ -1881,7 +1933,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           },
           reqOpts
         ));
-        await (0, import_core6.background)(bus?.emit(
+        await (0, import_core7.background)(bus?.emit(
           EVENT_KEYS.userRegistered,
           {
             userId: user.id,
@@ -1925,8 +1977,9 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       if (isValidPhone(phone2)) {
         const existing = await users.findByPhone(normalizePhone(phone2));
         if (existing) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Phone already registered");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Phone already registered");
         }
+        if (await users.findArchivedByPhone(normalizePhone(phone2))) return archivedAddressResponse();
         const { id } = await users.findOrCreateByPhone(
           normalizePhone(phone2),
           firstName ?? null,
@@ -1938,11 +1991,11 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         await phoneVerif.upsert(id, normalizePhone(phone2), otp, expiresAt);
         const user = await users.findById(id);
         if (!user) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
         const reqId2 = ctx.meta["requestId"];
         const reqOpts2 = reqId2 !== void 0 ? { requestId: reqId2 } : void 0;
-        await (0, import_core6.background)(bus?.emit(
+        await (0, import_core7.background)(bus?.emit(
           import_events2.NOTIFICATION_EVENT,
           {
             type: MESSAGE_KEYS.phoneOtp,
@@ -1952,7 +2005,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           },
           reqOpts2
         ));
-        await (0, import_core6.background)(bus?.emit(
+        await (0, import_core7.background)(bus?.emit(
           EVENT_KEYS.userRegistered,
           {
             userId: user.id,
@@ -1976,8 +2029,8 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           { status: 202 }
         );
       }
-      return (0, import_core6.setApiResponse)(
-        import_core6.HTTP.UNPROCESSABLE,
+      return (0, import_core7.setApiResponse)(
+        import_core7.HTTP.UNPROCESSABLE,
         "INVALID_PARAMETER",
         "Provide email + password or a valid phone number"
       );
@@ -1989,9 +2042,25 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         const { email: rawEmail, password: password2 } = body;
         const email2 = normalizeEmailSafe(rawEmail);
         if (!email2) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
         }
         const user = await users.findByEmail(email2);
+        if (!user) {
+          const archived = await users.findArchivedByEmail(email2);
+          if (archived?.passwordHash && archived.deletedAt) {
+            const { valid: valid2 } = await verifyPasswordForLogin(password2, archived.passwordHash, config.legacyVerify);
+            await loginEvents.recordSafe({
+              userId: archived.id,
+              emailAttempted: email2,
+              method: "password",
+              outcome: "failed",
+              failureReason: valid2 ? "pending_deletion" : "bad_password",
+              ...meta
+            });
+            if (valid2) return pendingDeletionResponse(archived.deletedAt, config);
+            return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          }
+        }
         if (!user || !user.passwordHash) {
           await loginEvents.recordSafe({
             userId: null,
@@ -2001,7 +2070,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
             failureReason: "unknown_email",
             ...meta
           });
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         const { valid, needsRehash } = await verifyPasswordForLogin(
           password2,
@@ -2017,21 +2086,21 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
             failureReason: "bad_password",
             ...meta
           });
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         if (needsRehash) {
           await users.updatePassword(user.id, await hashPassword(password2));
         }
         if (user.suspended) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.FORBIDDEN,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.FORBIDDEN,
             "ACCOUNT_SUSPENDED",
             "Account suspended. Please contact support."
           );
         }
         if (user.mfaEnabled) {
           const mfaToken = issueMfaPendingToken(user.id, config, "email");
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "MFA_REQUIRED", "Multi-factor authentication required", {
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "MFA_REQUIRED", "Multi-factor authentication required", {
             mfaToken
           });
         }
@@ -2068,11 +2137,11 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       if (isValidPhone(phone2)) {
         const user = await users.findByPhone(normalizePhone(phone2));
         if (!user) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         if (user.suspended) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.FORBIDDEN,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.FORBIDDEN,
             "ACCOUNT_SUSPENDED",
             "Account suspended. Please contact support."
           );
@@ -2080,7 +2149,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         const otp = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
-        await (0, import_core6.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
+        await (0, import_core7.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneOtp,
           locale: user.locale,
           data: { otp },
@@ -2096,8 +2165,8 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           { status: 202 }
         );
       }
-      return (0, import_core6.setApiResponse)(
-        import_core6.HTTP.UNPROCESSABLE,
+      return (0, import_core7.setApiResponse)(
+        import_core7.HTTP.UNPROCESSABLE,
         "INVALID_PARAMETER",
         "Provide email + password or a valid phone number"
       );
@@ -2122,35 +2191,35 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
     refresh: async (ctx) => {
       const token = extractRefreshToken(ctx);
       if (!token) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "INVALID_PARAMETER", "No refresh token provided");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "INVALID_PARAMETER", "No refresh token provided");
       }
       const payload = verifyToken(token, config);
       if (!payload || payload.type !== "refresh") {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
       }
       const runtime = config.resolve?.(ctx);
       let issued = null;
       for (let attempt = 0; attempt < 3 && !issued; attempt++) {
         const found = await sessions.match(token);
         if (found.kind === "unknown") {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
         }
         if (found.kind === "reused") {
           await sessions.revokeById(found.row.id);
-          await (0, import_core6.background)(
+          await (0, import_core7.background)(
             bus?.emit(EVENT_KEYS.sessionRevoked, { userId: found.row.userId, sids: [found.row.sid], reason: "refresh-reuse" })
           );
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
         }
         const resolvedRefresh = configForClient(config, runtime, found.row.clientKind);
         const maxAgeMs = resolvedRefresh.sessionMaxAge ? durationMs(String(resolvedRefresh.sessionMaxAge)) : null;
         if (maxAgeMs !== null && Date.now() - found.row.createdAt.getTime() > maxAgeMs) {
           await sessions.revokeById(found.row.id);
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session reached its maximum age \u2014 sign in again");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session reached its maximum age \u2014 sign in again");
         }
         const user = await users.findById(found.row.userId);
         if (!user || user.suspended || user.deletedAt || user.id !== payload.sub) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
         }
         const pair = issueTokenPair(user.id, resolvedRefresh, {
           loginMethod: payload.loginMethod ?? "email",
@@ -2163,7 +2232,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         if (await sessions.rotate(found.row, token, next, found.kind)) issued = pair;
       }
       if (!issued) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
       }
       const { accessToken, refreshToken } = issued;
       return Response.json(
@@ -2182,16 +2251,16 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       const body = ctx.meta["body"];
       const rawEmail = body?.["email"];
       if (typeof rawEmail !== "string") {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "email is required");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "email is required");
       }
       const email2 = normalizeEmailSafe(rawEmail);
       if (!email2) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
       }
       const user = await users.findByEmail(email2);
       if (!user) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.OK,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.OK,
           "PASSWORD_RESET_EMAIL_SENT",
           "Password reset email sent (if account exists)."
         );
@@ -2200,8 +2269,8 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
       const remaining = checkCooldown(await passwordReset.findLastSentAt(user.id), cooldown);
       if (remaining > 0) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.OK,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.OK,
           "PASSWORD_RESET_EMAIL_SENT",
           "Password reset email sent (if account exists)."
         );
@@ -2212,14 +2281,14 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       await passwordReset.create(user.id, pin, token, expiresAt);
       const base = resolved.passwordResetUrl;
       const resetUrl = base ? `${base}${base.includes("?") ? "&" : "?"}token=${token}` : "";
-      await (0, import_core6.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
+      await (0, import_core7.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.passwordReset,
         locale: user.locale,
         recipient: { email: email2, phone: null, deviceToken: null },
         data: { pin, token, resetUrl }
       }));
-      return (0, import_core6.setApiResponse)(
-        import_core6.HTTP.OK,
+      return (0, import_core7.setApiResponse)(
+        import_core7.HTTP.OK,
         "PASSWORD_RESET_EMAIL_SENT",
         "Password reset email sent (if account exists)."
       );
@@ -2230,11 +2299,11 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       const password2 = body?.["password"];
       const rawToken = body?.["token"];
       if (typeof password2 !== "string") {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "password is required");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "password is required");
       }
       if (password2.length < 8) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "password must be at least 8 characters"
         );
@@ -2244,8 +2313,8 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         row = await passwordReset.findByToken(rawToken.trim());
       } else {
         if (typeof raw !== "string" || !/^\d{6}$/.test(raw.trim())) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.UNPROCESSABLE,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.UNPROCESSABLE,
             "INVALID_PARAMETER",
             "a 6-digit pin or a reset token is required"
           );
@@ -2253,33 +2322,41 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         row = await passwordReset.findByPin(raw.trim());
       }
       if (!row || /* @__PURE__ */ new Date() > row.expiresAt) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.BAD_REQUEST,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.BAD_REQUEST,
           "PASSWORD_RESET_FAILED",
           "Invalid or expired reset credentials"
         );
       }
       const passwordHash = await hashPassword(password2);
-      await store.transaction(async (tx) => {
-        await Promise.all([
-          tx.query(`UPDATE fonderie_users SET password_hash = $1 WHERE id = $2`, [
-            passwordHash,
-            row.userId
-          ]),
-          tx.query(`DELETE FROM fonderie_password_resets WHERE user_id = $1`, [row.userId]),
-          // Revoke every session: the reset exists because the account may
-          // be compromised — a stolen session must not survive it.
-          tx.query(`DELETE FROM fonderie_sessions WHERE user_id = $1`, [row.userId])
-        ]);
-      });
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
+      const [changed] = await store.query(
+        `WITH changed AS (
+				   UPDATE fonderie_users SET password_hash = $1, updated_at = now()
+				   WHERE id = $2 AND deleted_at IS NULL
+				   RETURNING id
+				 ), spent AS (
+				   DELETE FROM fonderie_password_resets WHERE user_id = $2
+				 ), revoked AS (
+				   DELETE FROM fonderie_sessions WHERE user_id IN (SELECT id FROM changed)
+				 )
+				 SELECT id FROM changed`,
+        [passwordHash, row.userId]
+      );
+      if (!changed) {
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.BAD_REQUEST,
+          "PASSWORD_RESET_FAILED",
+          "Invalid or expired reset credentials"
+        );
+      }
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
     },
     verify: async (ctx) => {
       if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
       }
       if (ctx.user.loginMethod !== "phone" && ctx.user.emailVerifiedAt) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "VERIFIED", "Email verified successfully.", {
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "VERIFIED", "Email verified successfully.", {
           verified: true,
           email: ctx.user.email
         });
@@ -2287,8 +2364,8 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       const body = ctx.meta["body"];
       const raw = body?.["token"];
       if (typeof raw !== "string" || !/^\d{6}$/.test(raw.trim())) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "token must be a 6-digit code"
         );
@@ -2306,7 +2383,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
             failureReason: "invalid_pin",
             ...phoneMeta
           });
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
         }
         if (/* @__PURE__ */ new Date() > record.expiresAt) {
           await phoneVerif.deleteByUser(ctx.user.id);
@@ -2318,8 +2395,8 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
             failureReason: "expired_pin",
             ...phoneMeta
           });
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.BAD_REQUEST,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.BAD_REQUEST,
             "VERIFICATION_FAILED",
             "Verification code expired"
           );
@@ -2339,11 +2416,11 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         });
         const verifiedUser = await users.findById(ctx.user.id);
         if (!verifiedUser) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
         }
         if (verifiedUser.suspended) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.FORBIDDEN,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.FORBIDDEN,
             "ACCOUNT_SUSPENDED",
             "Account suspended. Please contact support."
           );
@@ -2365,10 +2442,10 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       }
       const row = await emailVerif.findByUser(ctx.user.id, pin);
       if (!row) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
       }
       if (/* @__PURE__ */ new Date() > row.expiresAt) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Pin expired");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Pin expired");
       }
       await store.transaction(async (tx) => {
         await Promise.all([
@@ -2382,30 +2459,30 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           ])
         ]);
       });
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "VERIFIED", "Email verified successfully.", {
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "VERIFIED", "Email verified successfully.", {
         verified: true,
         email: ctx.user.email
       });
     },
     sendVerification: async (ctx) => {
       if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
       }
       const resolved = { ...config, ...config.resolve?.(ctx) };
       const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
       if (ctx.user.loginMethod === "phone") {
         const phone2 = ctx.user.phone;
         if (!phone2) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.BAD_REQUEST,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.BAD_REQUEST,
             "NO_PHONE_ON_ACCOUNT",
             "No phone number associated with this account"
           );
         }
         const remaining2 = checkCooldown(await phoneVerif.findLastSentAt(ctx.user.id), cooldown);
         if (remaining2 > 0) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.TOO_MANY_REQUESTS,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.TOO_MANY_REQUESTS,
             "VERIFICATION_COOLDOWN",
             "Please wait before requesting a new code.",
             {
@@ -2416,35 +2493,35 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         const otp = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
         const expiresAt2 = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
-        await (0, import_core6.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
+        await (0, import_core7.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneOtp,
           locale: ctx.user.locale,
           data: { otp },
           recipient: { email: null, phone: phone2, deviceToken: null }
         }));
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.OK,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.OK,
           "VERIFICATION_SENT",
           "A verification code has been sent to your phone."
         );
       }
       if (!ctx.user.email) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.BAD_REQUEST,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.BAD_REQUEST,
           "NO_EMAIL_ON_ACCOUNT",
           "No email address associated with this account"
         );
       }
       if (ctx.user.emailVerifiedAt) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "EMAIL_VERIFIED", "Email already verified.", {
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "EMAIL_VERIFIED", "Email already verified.", {
           verified: true,
           email: ctx.user.email
         });
       }
       const remaining = checkCooldown(await emailVerif.findLastSentAt(ctx.user.id), cooldown);
       if (remaining > 0) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.TOO_MANY_REQUESTS,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.TOO_MANY_REQUESTS,
           "VERIFICATION_COOLDOWN",
           "Please wait before requesting a new code.",
           {
@@ -2455,13 +2532,13 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       const pin = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
-      await (0, import_core6.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
+      await (0, import_core7.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.emailVerification,
         locale: ctx.user.locale,
         recipient: { email: ctx.user.email, phone: null, deviceToken: null },
         data: { pin }
       }));
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "VERIFICATION_SENT", "Verification email sent.", {
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "VERIFICATION_SENT", "Verification email sent.", {
         email: ctx.user.email
       });
     }
@@ -2470,11 +2547,11 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
 
 // src/controllers/user.controller.ts
 var import_node_crypto7 = require("crypto");
-var import_core8 = require("@fonderie/core");
+var import_core9 = require("@fonderie/core");
 var import_events3 = require("@fonderie/events");
 
 // src/dtos/login-activity.ts
-var import_core7 = require("@fonderie/core");
+var import_core8 = require("@fonderie/core");
 function toLoginEventDTO(row) {
   return {
     id: row.id,
@@ -2491,10 +2568,10 @@ function toLoginEventDTO(row) {
 }
 function toLoginHistoryPageDTO(page) {
   const last = page.events[page.events.length - 1];
-  const nextCursor = page.hasMore && last ? (0, import_core7.encodeKeysetCursor)(last.createdAtRaw ?? last.createdAt.toISOString(), last.id) : null;
+  const nextCursor = page.hasMore && last ? (0, import_core8.encodeKeysetCursor)(last.createdAtRaw ?? last.createdAt.toISOString(), last.id) : null;
   return { events: page.events.map(toLoginEventDTO), nextCursor };
 }
-var decodeLoginCursor = import_core7.decodeKeysetCursor;
+var decodeLoginCursor = import_core8.decodeKeysetCursor;
 function toSessionDTO(row, currentSid) {
   return {
     id: row.id,
@@ -2525,9 +2602,9 @@ function userController(store, config, bus) {
     me: async (ctx) => {
       const user = await users.findById(ctx.user.id);
       if (!user) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       }
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "USER_ACCOUNT_FETCHED", "User account fetched successful.", {
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "USER_ACCOUNT_FETCHED", "User account fetched successful.", {
         user: toUserDTO(user, ctx.user.phoneVerified)
       });
     },
@@ -2538,14 +2615,14 @@ function userController(store, config, bus) {
       const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50;
       const outcomeParam = params.get("outcome");
       if (outcomeParam !== null && outcomeParam !== "success" && outcomeParam !== "failed") {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "outcome must be 'success' or 'failed'");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "outcome must be 'success' or 'failed'");
       }
       const cursorParam = params.get("cursor");
       let cursor = null;
       if (cursorParam) {
         cursor = decodeLoginCursor(cursorParam);
         if (!cursor) {
-          return (0, import_core8.setApiResponse)(import_core8.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
+          return (0, import_core9.setApiResponse)(import_core9.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
         }
       }
       const query = { userId: ctx.user.id, limit };
@@ -2556,8 +2633,8 @@ function userController(store, config, bus) {
       if (from) query.from = new Date(from);
       if (to) query.to = new Date(to);
       const page = await loginEvents.listByUser(query);
-      return (0, import_core8.setApiResponse)(
-        import_core8.HTTP.OK,
+      return (0, import_core9.setApiResponse)(
+        import_core9.HTTP.OK,
         "LOGIN_HISTORY_FETCHED",
         "Login history retrieved.",
         toLoginHistoryPageDTO(page)
@@ -2567,35 +2644,35 @@ function userController(store, config, bus) {
     listSessions: async (ctx) => {
       const rows = await sessions.listLiveByUser(ctx.user.id);
       const currentSid = ctx.user.sid ?? null;
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "SESSIONS_FETCHED", "Active sessions retrieved.", {
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "SESSIONS_FETCHED", "Active sessions retrieved.", {
         sessions: rows.map((r) => toSessionDTO(r, currentSid))
       });
     },
     terminateSession: async (ctx) => {
       const id = ctx.meta["params"]?.["id"];
       if (!id) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
       }
       const removed = await sessions.terminateByIdReturningSid(ctx.user.id, id);
       if (removed === void 0) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
       }
-      await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: [removed], reason: "terminated" }));
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "SESSION_TERMINATED", "Session terminated.", { id });
+      await (0, import_core9.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: [removed], reason: "terminated" }));
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "SESSION_TERMINATED", "Session terminated.", { id });
     },
     terminateOtherSessions: async (ctx) => {
       const currentSid = ctx.user.sid ?? null;
       if (!currentSid) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.UNPROCESSABLE,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.UNPROCESSABLE,
           "NO_CURRENT_SESSION",
           "Cannot terminate others without a current session context"
         );
       }
       const sids = await sessions.terminateOthersReturningSids(ctx.user.id, currentSid);
       const count = sids.length;
-      if (count) await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids, reason: "terminated" }));
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "SESSIONS_TERMINATED", "Other sessions terminated.", { count });
+      if (count) await (0, import_core9.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids, reason: "terminated" }));
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "SESSIONS_TERMINATED", "Other sessions terminated.", { count });
     },
     updateProfile: async (ctx) => {
       const body = ctx.meta["body"];
@@ -2605,18 +2682,18 @@ function userController(store, config, bus) {
         if (body?.[key] !== void 0) fields[key] = body[key];
       }
       if (Object.keys(fields).length === 0) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.UNPROCESSABLE,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Provide at least one of: firstName, lastName, avatarUrl"
         );
       }
       const row = await users.update(ctx.user.id, fields);
       if (!row) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       }
       const updated = await users.findById(ctx.user.id);
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "PROFILE_UPDATED", "Profile updated.", {
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "PROFILE_UPDATED", "Profile updated.", {
         user: toUserDTO(updated, ctx.user.phoneVerified)
       });
     },
@@ -2633,14 +2710,14 @@ function userController(store, config, bus) {
       if (Object.keys(patch).length > 0) fields.patch = patch;
       const row = await users.updatePreferences(ctx.user.id, fields);
       if (!row) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.UNPROCESSABLE,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Provide at least one preference field"
         );
       }
       const updated = await users.findById(ctx.user.id);
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "PREFERENCES_UPDATED", "Preferences updated.", {
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "PREFERENCES_UPDATED", "Preferences updated.", {
         user: toUserDTO(updated, ctx.user.phoneVerified)
       });
     },
@@ -2649,44 +2726,44 @@ function userController(store, config, bus) {
       const newEmail = body?.["email"];
       const normalised = typeof newEmail === "string" ? normalizeEmailSafe(newEmail) : null;
       if (!normalised) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.UNPROCESSABLE,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "A valid email address is required"
         );
       }
       const oldEmail = ctx.user.email;
       if (normalised === oldEmail) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.UNPROCESSABLE,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "New email must differ from current email"
         );
       }
       const existing = await users.findByEmail(normalised);
       if (existing) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
       }
       const pin = (0, import_node_crypto7.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       await users.updateEmail(ctx.user.id, normalised);
-      await (0, import_core8.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+      await (0, import_core9.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.emailVerification,
         locale: ctx.user.locale,
         data: { pin },
         recipient: { email: normalised, phone: null, deviceToken: null }
       }));
       if (oldEmail) {
-        await (0, import_core8.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+        await (0, import_core9.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.emailChanged,
           locale: ctx.user.locale,
           data: { newEmail: normalised },
           recipient: { email: oldEmail, phone: null, deviceToken: null }
         }));
       }
-      return (0, import_core8.setApiResponse)(
-        import_core8.HTTP.OK,
+      return (0, import_core9.setApiResponse)(
+        import_core9.HTTP.OK,
         "EMAIL_UPDATED",
         "Email updated. A verification code has been sent to your new address.",
         {
@@ -2698,8 +2775,8 @@ function userController(store, config, bus) {
       const body = ctx.meta["body"];
       const newPhone = body?.["phone"];
       if (!isValidPhone2(newPhone)) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.UNPROCESSABLE,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "A valid phone number is required"
         );
@@ -2707,28 +2784,28 @@ function userController(store, config, bus) {
       const normalised = normalizePhone2(newPhone);
       const existing = await users.findByPhone(normalised);
       if (existing) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
       }
       const otp = (0, import_node_crypto7.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
       await phoneVerif.upsert(ctx.user.id, normalised, otp, expiresAt);
       await users.updatePhone(ctx.user.id, normalised);
-      await (0, import_core8.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+      await (0, import_core9.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.phoneOtp,
         locale: ctx.user.locale,
         data: { otp },
         recipient: { email: null, phone: normalised, deviceToken: null }
       }));
       if (ctx.user.email) {
-        await (0, import_core8.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+        await (0, import_core9.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneChanged,
           locale: ctx.user.locale,
           data: {},
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }));
       }
-      return (0, import_core8.setApiResponse)(
-        import_core8.HTTP.OK,
+      return (0, import_core9.setApiResponse)(
+        import_core9.HTTP.OK,
         "PHONE_UPDATED",
         "Phone number updated. A verification code has been sent to your new number.",
         {
@@ -2741,23 +2818,23 @@ function userController(store, config, bus) {
       const currentPassword = body?.["currentPassword"];
       const newPassword = body?.["newPassword"];
       if (typeof currentPassword !== "string" || !currentPassword) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "currentPassword is required");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "currentPassword is required");
       }
       if (typeof newPassword !== "string" || newPassword.length < 8) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "newPassword must be at least 8 characters");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "newPassword must be at least 8 characters");
       }
       const user = await users.findById(ctx.user.id);
-      if (!user) return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      if (!user) return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       const { hashPassword: hashPassword2, verifyPassword: verifyPassword2 } = await Promise.resolve().then(() => (init_password(), password_exports));
       const valid = await verifyPassword2(currentPassword, user.passwordHash ?? "");
       if (!valid) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.UNPROCESSABLE, "INVALID_CREDENTIAL", "Current password is incorrect");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNPROCESSABLE, "INVALID_CREDENTIAL", "Current password is incorrect");
       }
       const hash = await hashPassword2(newPassword);
       await users.updatePassword(ctx.user.id, hash);
       await sessions.deleteByUser(ctx.user.id);
-      await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: null, reason: "password-changed" }));
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
+      await (0, import_core9.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: null, reason: "password-changed" }));
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
     /**
      * Remove an OAuth provider from the account.
@@ -2776,44 +2853,50 @@ function userController(store, config, bus) {
       const provider = String(ctx.meta["params"]?.["provider"] ?? "");
       const current = await users.findById(ctx.user.id);
       if (!current?.provider) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_LINKED", "No sign-in provider is linked.");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_LINKED", "No sign-in provider is linked.");
       }
       if (provider && provider.toLowerCase() !== current.provider.toLowerCase()) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.NOT_FOUND,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.NOT_FOUND,
           "NOT_LINKED",
           `This account is not linked to ${provider}.`
         );
       }
       const removed = await users.clearProvider(ctx.user.id);
       if (!removed) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.CONFLICT,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.CONFLICT,
           "PASSWORD_REQUIRED",
           "Set a password before disconnecting this provider \u2014 it is currently the only way to sign in."
         );
       }
       if (ctx.user.email) {
-        await (0, import_core8.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+        await (0, import_core9.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.oauthUnlinked,
           locale: ctx.user.locale,
           data: { provider: current.provider },
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }));
       }
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "OAUTH_UNLINKED", "Sign-in provider removed.");
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "OAUTH_UNLINKED", "Sign-in provider removed.");
     },
     deleteMe: async (ctx) => {
       const userId = ctx.user.id;
       await users.softDelete(userId);
       await sessions.deleteByUser(userId);
+      await store.query(
+        `WITH resets AS (DELETE FROM fonderie_password_resets WHERE user_id = $1),
+				      emails AS (DELETE FROM fonderie_email_verifications WHERE user_id = $1)
+				 DELETE FROM fonderie_phone_verifications WHERE user_id = $1`,
+        [userId]
+      );
       const reqId = ctx.meta["requestId"];
-      await (0, import_core8.background)(bus?.emit(
+      await (0, import_core9.background)(bus?.emit(
         EVENT_KEYS.userDeleted,
         { userId },
         reqId !== void 0 ? { requestId: reqId } : void 0
       ));
-      await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId, sids: null, reason: "account-deleted" }));
+      await (0, import_core9.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId, sids: null, reason: "account-deleted" }));
       return Response.json(
         { reason: "ACCOUNT_DELETED", explanation: "Account successfully deleted." },
         {
@@ -2827,7 +2910,7 @@ function userController(store, config, bus) {
     // no MFA secret, no session tokens (session metadata only).
     exportMe: async (ctx) => {
       const user = await users.findById(ctx.user.id);
-      if (!user) return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      if (!user) return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       const sessionRows = await sessions.listByUser(ctx.user.id);
       const bundle = {
         exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2836,8 +2919,8 @@ function userController(store, config, bus) {
           id: s.id,
           userAgent: s.userAgent,
           ipAddress: s.ipAddress,
-          createdAt: (0, import_core8.dateOrEmpty)(s.createdAt),
-          expiresAt: (0, import_core8.dateOrEmpty)(s.expiresAt)
+          createdAt: (0, import_core9.dateOrEmpty)(s.createdAt),
+          expiresAt: (0, import_core9.dateOrEmpty)(s.expiresAt)
         })),
         security: {
           mfaEnabled: user.mfaEnabled === true,
@@ -2856,7 +2939,7 @@ function userController(store, config, bus) {
         }
         bundle["modules"] = modules;
       }
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "DATA_EXPORT", "Your account data.", bundle);
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "DATA_EXPORT", "Your account data.", bundle);
     }
   };
 }
@@ -2864,7 +2947,7 @@ function userController(store, config, bus) {
 // src/controllers/oauth.controller.ts
 var import_node_crypto9 = require("crypto");
 var import_jsonwebtoken2 = __toESM(require("jsonwebtoken"), 1);
-var import_core9 = require("@fonderie/core");
+var import_core10 = require("@fonderie/core");
 var import_events4 = require("@fonderie/events");
 
 // src/services/jwks.ts
@@ -3015,7 +3098,7 @@ function oauthController(store, config, bus) {
     const label = provider.charAt(0).toUpperCase() + provider.slice(1);
     const recipient = { email: user.email, phone: null, deviceToken: null };
     if (upserted.clearedUnverifiedPassword && user.email) {
-      await (0, import_core9.background)(bus.emit(
+      await (0, import_core10.background)(bus.emit(
         import_events4.NOTIFICATION_EVENT,
         {
           type: MESSAGE_KEYS.passwordRevoked,
@@ -3027,7 +3110,7 @@ function oauthController(store, config, bus) {
       ));
     }
     if (upserted.inserted) {
-      await (0, import_core9.background)(bus.emit(
+      await (0, import_core10.background)(bus.emit(
         EVENT_KEYS.userRegistered,
         {
           userId: upserted.id,
@@ -3039,7 +3122,7 @@ function oauthController(store, config, bus) {
         reqOpts
       ));
       if (user.email) {
-        await (0, import_core9.background)(bus.emit(
+        await (0, import_core10.background)(bus.emit(
           import_events4.NOTIFICATION_EVENT,
           {
             type: MESSAGE_KEYS.oauthRegistration,
@@ -3053,7 +3136,7 @@ function oauthController(store, config, bus) {
       return;
     }
     if (upserted.previousProvider !== provider && user.email) {
-      await (0, import_core9.background)(bus.emit(
+      await (0, import_core10.background)(bus.emit(
         import_events4.NOTIFICATION_EVENT,
         {
           type: MESSAGE_KEYS.oauthLinked,
@@ -3074,14 +3157,29 @@ function oauthController(store, config, bus) {
     const method = provider === "apple" ? "oauth-apple" : "oauth-google";
     const meta = requestMeta(ctx);
     if (!claims.email) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, p.failed, `No email in ${p.label} identity token`);
+      return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, p.failed, `No email in ${p.label} identity token`);
     }
     if (!claims.emailVerified) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, p.failed, `${p.label} account email is not verified`);
+      return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, p.failed, `${p.label} account email is not verified`);
     }
     const normalizedEmail = normalizeEmailSafe(claims.email);
     if (!normalizedEmail) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, p.failed, `Invalid email in ${p.label} identity token`);
+      return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, p.failed, `Invalid email in ${p.label} identity token`);
+    }
+    const archived = await users.findArchivedByEmail(normalizedEmail);
+    if (archived?.deletedAt) {
+      await loginEvents.recordSafe({
+        userId: archived.id,
+        emailAttempted: normalizedEmail,
+        method,
+        outcome: "failed",
+        failureReason: "pending_deletion",
+        ...meta
+      });
+      const res = pendingDeletionResponse(archived.deletedAt, config);
+      const headers = cookieHeaders(clearCookies);
+      headers.set("content-type", res.headers.get("content-type") ?? "application/json");
+      return new Response(res.body, { status: res.status, headers });
     }
     const upserted = await users.upsertByProvider(normalizedEmail, provider, claims.sub ?? "");
     if (!upserted) {
@@ -3093,15 +3191,15 @@ function oauthController(store, config, bus) {
         failureReason: "provider_upsert_failed",
         ...meta
       });
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
+      return (0, import_core10.setApiResponse)(import_core10.HTTP.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
     }
     const fullUser = await users.findById(upserted.id);
     if (!fullUser) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
+      return (0, import_core10.setApiResponse)(import_core10.HTTP.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
     }
     await announceOAuthUpsert(ctx, upserted, provider, fullUser);
     if (fullUser.suspended) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.FORBIDDEN, "ACCOUNT_SUSPENDED", "Account suspended. Please contact support.");
+      return (0, import_core10.setApiResponse)(import_core10.HTTP.FORBIDDEN, "ACCOUNT_SUSPENDED", "Account suspended. Please contact support.");
     }
     if (fullUser.mfaEnabled) {
       const mfaToken = issueMfaPendingToken(upserted.id, config, provider);
@@ -3144,8 +3242,8 @@ function oauthController(store, config, bus) {
     googleInit: async (_ctx) => {
       const google = config.google;
       if (!google || !google.clientSecret || !google.redirectUri) {
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.NOT_IMPLEMENTED,
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
           "Google OAuth not configured"
         );
@@ -3179,8 +3277,8 @@ function oauthController(store, config, bus) {
     googleCallback: async (ctx) => {
       const google = config.google;
       if (!google || !google.clientSecret || !google.redirectUri) {
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.NOT_IMPLEMENTED,
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
           "Google OAuth not configured"
         );
@@ -3188,14 +3286,14 @@ function oauthController(store, config, bus) {
       const url = new URL(ctx.request.url);
       const code = url.searchParams.get("code");
       if (!code) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
       }
       const returnedState = url.searchParams.get("state") ?? "";
       const cookieHeader = ctx.request.headers.get("cookie") ?? "";
       const expectedState = cookieHeader.match(/(?:^|;\s*)oauth_state=([^;]+)/)?.[1] ?? "";
-      if (!returnedState || !expectedState || !(0, import_core9.constantTimeEqual)(Buffer.from(returnedState), Buffer.from(expectedState))) {
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.BAD_REQUEST,
+      if (!returnedState || !expectedState || !(0, import_core10.constantTimeEqual)(Buffer.from(returnedState), Buffer.from(expectedState))) {
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.BAD_REQUEST,
           "GOOGLE_AUTH_FAILED",
           "OAuth state mismatch \u2014 restart the sign-in flow"
         );
@@ -3213,8 +3311,8 @@ function oauthController(store, config, bus) {
       });
       const tokenData = await tokenRes.json();
       if (!tokenData.id_token) {
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.BAD_REQUEST,
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.BAD_REQUEST,
           "GOOGLE_AUTH_FAILED",
           "OAuth token exchange failed"
         );
@@ -3223,20 +3321,20 @@ function oauthController(store, config, bus) {
         Buffer.from(tokenData.id_token.split(".")[1] ?? "", "base64url").toString()
       );
       if (payload.aud !== google.clientId) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token audience mismatch");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token audience mismatch");
       }
       if (payload.iss !== "https://accounts.google.com" && payload.iss !== "accounts.google.com") {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token issuer mismatch");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token issuer mismatch");
       }
       if (typeof payload.exp !== "number" || payload.exp * 1e3 < Date.now()) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token expired");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token expired");
       }
       if (!payload.email) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
       }
       if (payload.email_verified !== true) {
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.BAD_REQUEST,
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.BAD_REQUEST,
           "GOOGLE_AUTH_FAILED",
           "Google account email is not verified"
         );
@@ -3250,7 +3348,7 @@ function oauthController(store, config, bus) {
     appleInit: async (_ctx) => {
       const apple = config.apple;
       if (!apple) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
       }
       const state = (0, import_node_crypto9.randomBytes)(16).toString("hex");
       const params = new URLSearchParams({
@@ -3281,20 +3379,20 @@ function oauthController(store, config, bus) {
     appleCallback: async (ctx) => {
       const apple = config.apple;
       if (!apple) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
       }
       const pre = ctx.meta["body"];
       const form = pre && typeof pre === "object" ? new URLSearchParams(pre) : new URLSearchParams(await ctx.request.text());
       const code = form.get("code");
       if (!code) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
       }
       const returnedState = form.get("state") ?? "";
       const cookieHeader = ctx.request.headers.get("cookie") ?? "";
       const expectedState = cookieHeader.match(/(?:^|;\s*)oauth_state=([^;]+)/)?.[1] ?? "";
-      if (!returnedState || !expectedState || !(0, import_core9.constantTimeEqual)(Buffer.from(returnedState), Buffer.from(expectedState))) {
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.BAD_REQUEST,
+      if (!returnedState || !expectedState || !(0, import_core10.constantTimeEqual)(Buffer.from(returnedState), Buffer.from(expectedState))) {
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.BAD_REQUEST,
           "APPLE_AUTH_FAILED",
           "OAuth state mismatch \u2014 restart the sign-in flow"
         );
@@ -3312,11 +3410,11 @@ function oauthController(store, config, bus) {
       });
       const tokenData = await tokenRes.json();
       if (!tokenData.id_token) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "OAuth token exchange failed");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "OAuth token exchange failed");
       }
       const claims = await verifyAppleIdToken(tokenData.id_token, { audiences: [apple.clientId] });
       if (!claims) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
       }
       return completeOAuthLogin(ctx, "apple", {
         email: claims.email,
@@ -3327,12 +3425,12 @@ function oauthController(store, config, bus) {
     appleNative: async (ctx) => {
       const apple = config.apple;
       if (!apple) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
       }
       const body = ctx.meta["body"];
       const identityToken = body?.identityToken;
       if (!identityToken) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing identityToken");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing identityToken");
       }
       const audiences = apple.nativeClientIds && apple.nativeClientIds.length ? apple.nativeClientIds : [apple.clientId];
       const claims = await verifyAppleIdToken(identityToken, { audiences, nonce: body?.nonce });
@@ -3346,7 +3444,7 @@ function oauthController(store, config, bus) {
           failureReason: "invalid_identity_token",
           ...meta
         });
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNAUTHORIZED, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.UNAUTHORIZED, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
       }
       const tokenHash = (0, import_node_crypto9.createHash)("sha256").update(identityToken).digest("hex");
       const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
@@ -3355,14 +3453,14 @@ function oauthController(store, config, bus) {
         const meta = requestMeta(ctx);
         await loginEvents.recordSafe({
           userId: null,
-          emailAttempted: claims.email ?? null,
+          emailAttempted: claims.email ? normalizeEmailSafe(claims.email) ?? claims.email : null,
           method: "oauth-apple",
           outcome: "failed",
           failureReason: "token_replayed",
           ...meta
         });
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.UNAUTHORIZED,
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.UNAUTHORIZED,
           "APPLE_AUTH_FAILED",
           "This Apple identity token has already been used"
         );
@@ -3379,12 +3477,12 @@ function oauthController(store, config, bus) {
     googleNative: async (ctx) => {
       const audiences = config.google?.nativeClientIds ?? [];
       if (!config.google || audiences.length === 0) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Native Google sign-in not configured");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Native Google sign-in not configured");
       }
       const body = ctx.meta["body"];
       const idToken = body?.idToken;
       if (!idToken) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing idToken");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing idToken");
       }
       const claims = await verifyGoogleIdToken(idToken, { audiences, nonce: body?.nonce });
       if (!claims) {
@@ -3396,20 +3494,20 @@ function oauthController(store, config, bus) {
           failureReason: "invalid_identity_token",
           ...requestMeta(ctx)
         });
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "Invalid Google ID token");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "Invalid Google ID token");
       }
       const tokenHash = (0, import_node_crypto9.createHash)("sha256").update(idToken).digest("hex");
       const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
       if (!await consumedTokens.consumeOnce(tokenHash, new Date(expMs))) {
         await loginEvents.recordSafe({
           userId: null,
-          emailAttempted: claims.email ?? null,
+          emailAttempted: claims.email ? normalizeEmailSafe(claims.email) ?? claims.email : null,
           method: "oauth-google",
           outcome: "failed",
           failureReason: "token_replayed",
           ...requestMeta(ctx)
         });
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "This Google ID token has already been used");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "This Google ID token has already been used");
       }
       consumedTokens.sweepExpiredSafe();
       return completeOAuthLogin(ctx, "google", {
@@ -3455,7 +3553,7 @@ function buildAuthRoutes(store, config, bus, locales) {
       "providers",
       "GET",
       "/auth/providers",
-      async () => (0, import_core10.setApiResponse)(import_core10.HTTP.OK, "AUTH_PROVIDERS", "Sign-in methods available here", {
+      async () => (0, import_core11.setApiResponse)(import_core11.HTTP.OK, "AUTH_PROVIDERS", "Sign-in methods available here", {
         providers: [...config.providers]
       })
     ),
@@ -3530,20 +3628,20 @@ function buildAuthRoutes(store, config, bus, locales) {
 }
 
 // src/services/config-guard.ts
-var import_core11 = require("@fonderie/core");
+var import_core12 = require("@fonderie/core");
 var MODULE = "@fonderie/auth";
 function collectAuthConfigProblems(config) {
   const problems = [];
   const secret = config.jwtSecret ?? "";
-  const secretProblem = (0, import_core11.secretStrengthProblem)(secret);
+  const secretProblem = (0, import_core12.secretStrengthProblem)(secret);
   if (secretProblem === "too-short") {
     problems.push({
       module: MODULE,
       severity: "error",
-      message: `jwtSecret must be at least ${import_core11.MIN_SECRET_LENGTH} characters (got ${secret.length})`,
+      message: `jwtSecret must be at least ${import_core12.MIN_SECRET_LENGTH} characters (got ${secret.length})`,
       domain: "auth",
       reason: "JWT_SECRET_TOO_SHORT",
-      metadata: { min: import_core11.MIN_SECRET_LENGTH, got: secret.length }
+      metadata: { min: import_core12.MIN_SECRET_LENGTH, got: secret.length }
     });
   } else if (secretProblem === "placeholder") {
     problems.push({
@@ -3555,7 +3653,7 @@ function collectAuthConfigProblems(config) {
     });
   }
   (config.jwtPreviousSecrets ?? []).forEach((previous, index) => {
-    if ((0, import_core11.secretStrengthProblem)(previous ?? "")) {
+    if ((0, import_core12.secretStrengthProblem)(previous ?? "")) {
       problems.push({
         module: MODULE,
         severity: "error",
@@ -3588,7 +3686,7 @@ function collectAuthConfigProblems(config) {
         domain: "auth",
         reason: "GOOGLE_INCOMPLETE"
       });
-    } else if (clientSecret && import_core11.PLACEHOLDER_SECRET.test(clientSecret)) {
+    } else if (clientSecret && import_core12.PLACEHOLDER_SECRET.test(clientSecret)) {
       problems.push({
         module: MODULE,
         severity: "error",
@@ -3719,8 +3817,8 @@ function extractToken(request) {
 }
 
 // src/admin.ts
-var import_core12 = require("@fonderie/core");
 var import_core13 = require("@fonderie/core");
+var import_core14 = require("@fonderie/core");
 function toAdminUserDTO(user) {
   return {
     ...toUserDTO(user),
@@ -3731,12 +3829,12 @@ function toAdminUserDTO(user) {
 }
 function toAdminUserPageDTO(page) {
   const last = page.users[page.users.length - 1];
-  const nextCursor = page.hasMore && last ? (0, import_core12.encodeKeysetCursor)(last.createdAtRaw ?? last.createdAt.toISOString(), last.id) : null;
+  const nextCursor = page.hasMore && last ? (0, import_core13.encodeKeysetCursor)(last.createdAtRaw ?? last.createdAt.toISOString(), last.id) : null;
   return { users: page.users.map(toAdminUserDTO), nextCursor };
 }
 var ADMIN_PREFIX = "/_admin";
 var idOf = (ctx) => ctx.meta.params?.["id"] ?? "";
-var NOT_FOUND = () => (0, import_core12.setApiResponse)(import_core12.HTTP.NOT_FOUND, "NOT_FOUND", "No such user");
+var NOT_FOUND = () => (0, import_core13.setApiResponse)(import_core13.HTTP.NOT_FOUND, "NOT_FOUND", "No such user");
 function adminRouteTable(store, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
@@ -3745,8 +3843,8 @@ function adminRouteTable(store, bus) {
     const ok = await users.setSuspended(idOf(ctx), suspended);
     if (!ok) return NOT_FOUND();
     const user = await users.findById(idOf(ctx));
-    return user ? (0, import_core12.setApiResponse)(
-      import_core12.HTTP.OK,
+    return user ? (0, import_core13.setApiResponse)(
+      import_core13.HTTP.OK,
       suspended ? "USER_SUSPENDED" : "USER_UNSUSPENDED",
       suspended ? "User suspended" : "User unsuspended",
       toAdminUserDTO(user)
@@ -3761,24 +3859,25 @@ function adminRouteTable(store, bus) {
       // see anything cannot discover who signed up this morning.
       async (ctx) => {
         const params = new URL(ctx.request.url).searchParams;
-        const email2 = params.get("email")?.trim().toLowerCase();
+        const raw = params.get("email")?.trim();
+        const email2 = raw ? normalizeEmailSafe(raw) ?? raw.toLowerCase() : void 0;
         if (email2) {
           const user = await users.findByEmail(email2);
-          return user ? (0, import_core12.setApiResponse)(import_core12.HTTP.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
+          return user ? (0, import_core13.setApiResponse)(import_core13.HTTP.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
         }
         const rawLimit = Number(params.get("limit") ?? 50);
         const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50;
         const cursorParam = params.get("cursor");
         const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null;
         if (cursorParam && !cursor)
-          return (0, import_core12.setApiResponse)(import_core12.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
+          return (0, import_core13.setApiResponse)(import_core13.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
         const deleted = params.get("deleted") === "1" || params.get("deleted") === "true";
         const page = await users.list({
           limit,
           ...cursor ? { cursor } : {},
           ...deleted ? { deleted } : {}
         });
-        return (0, import_core12.setApiResponse)(import_core12.HTTP.OK, "USERS", "Users", toAdminUserPageDTO(page));
+        return (0, import_core13.setApiResponse)(import_core13.HTTP.OK, "USERS", "Users", toAdminUserPageDTO(page));
       }
     ],
     [
@@ -3786,7 +3885,7 @@ function adminRouteTable(store, bus) {
       "/_admin/users/:id",
       async (ctx) => {
         const user = await users.findByIdIncludingDeleted(idOf(ctx));
-        return user ? (0, import_core12.setApiResponse)(import_core12.HTTP.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
+        return user ? (0, import_core13.setApiResponse)(import_core13.HTTP.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
       }
     ],
     [
@@ -3795,8 +3894,8 @@ function adminRouteTable(store, bus) {
       async (ctx) => {
         if (!await users.findById(idOf(ctx))) return NOT_FOUND();
         const rows = await sessions.listLiveByUser(idOf(ctx));
-        return (0, import_core12.setApiResponse)(
-          import_core12.HTTP.OK,
+        return (0, import_core13.setApiResponse)(
+          import_core13.HTTP.OK,
           "SESSIONS",
           "Live sessions",
           rows.map((r) => toSessionDTO(r, null))
@@ -3810,8 +3909,8 @@ function adminRouteTable(store, bus) {
       async (ctx) => {
         if (!await users.findById(idOf(ctx))) return NOT_FOUND();
         await sessions.deleteByUser(idOf(ctx));
-        await (0, import_core13.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: idOf(ctx), sids: null, reason: "admin" }));
-        return (0, import_core12.setApiResponse)(import_core12.HTTP.OK, "SESSIONS_REVOKED", "All sessions revoked");
+        await (0, import_core14.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: idOf(ctx), sids: null, reason: "admin" }));
+        return (0, import_core13.setApiResponse)(import_core13.HTTP.OK, "SESSIONS_REVOKED", "All sessions revoked");
       }
     ],
     [
@@ -3825,14 +3924,14 @@ function adminRouteTable(store, bus) {
         const cursorParam = params.get("cursor");
         const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null;
         if (cursorParam && !cursor)
-          return (0, import_core12.setApiResponse)(import_core12.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
+          return (0, import_core13.setApiResponse)(import_core13.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
         const page = await events.listByUser({
           userId: idOf(ctx),
           limit,
           ...cursor ? { cursor } : {}
         });
-        return (0, import_core12.setApiResponse)(
-          import_core12.HTTP.OK,
+        return (0, import_core13.setApiResponse)(
+          import_core13.HTTP.OK,
           "LOGIN_HISTORY",
           "Login history",
           toLoginHistoryPageDTO(page)
@@ -3865,7 +3964,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.22.0";
+  version = "7.23.0";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store, this.bus) };
@@ -3896,7 +3995,7 @@ var AuthModule = class {
 };
 
 // src/templates.ts
-var import_core14 = require("@fonderie/core");
+var import_core15 = require("@fonderie/core");
 
 // src/templates.es.ts
 var ES_TEMPLATES = {
@@ -4681,7 +4780,7 @@ change your password \u2014 someone else may be able to sign in as you.`
 If you did this, you're all set. If not, contact support right away.`
   }
 };
-var DEFAULT_TEMPLATES = (0, import_core14.withTranslations)(EN_TEMPLATES, {
+var DEFAULT_TEMPLATES = (0, import_core15.withTranslations)(EN_TEMPLATES, {
   fr: FR_TEMPLATES,
   es: ES_TEMPLATES,
   "zh-Hans": ZH_HANS_TEMPLATES,
@@ -4721,7 +4820,9 @@ async function importUser(store, user) {
     placeholders.push(`$${vals.length}`);
   };
   if (user.id !== void 0) add("id", user.id);
-  add("email", user.email.toLowerCase().trim());
+  const email2 = normalizeEmailSafe(user.email);
+  if (!email2) throw new Error(`[auth] importUser: '${user.email}' is not an email address`);
+  add("email", email2);
   if (user.passwordHash !== void 0) add("password_hash", user.passwordHash);
   if (user.firstName !== void 0) add("first_name", user.firstName);
   if (user.lastName !== void 0) add("last_name", user.lastName);