@fonderie/auth 7.22.0 → 7.23.0

package/dist/index.js

@@ -44,7 +44,7 @@ var init_password = __esm({
 });
 
 // src/routes.ts
-import { setApiResponse as setApiResponse6, HTTP as HTTP6 } from "@fonderie/core";
+import { setApiResponse as setApiResponse7, HTTP as HTTP7 } from "@fonderie/core";
 import { requireAuth, requireAnyAuth, requireVerified } from "@fonderie/core/middlewares";
 
 // src/middlewares/require-email-login.ts
@@ -74,6 +74,41 @@ import {
   rateLimit,
   StoreAdapterStore
 } from "@fonderie/rate-limit";
+
+// src/services/email.ts
+function normalizeEmail(email2) {
+  if (typeof email2 !== "string" || email2.length === 0) {
+    throw new Error("Invalid email");
+  }
+  const lower = email2.trim().toLowerCase();
+  if (lower.length === 0) {
+    throw new Error("Email cannot be empty");
+  }
+  const atIndex = lower.indexOf("@");
+  if (atIndex === -1 || lower.lastIndexOf("@") !== atIndex) {
+    throw new Error("Invalid email format");
+  }
+  const local = lower.substring(0, atIndex);
+  const domain = lower.substring(atIndex + 1);
+  if (!local || !domain) {
+    throw new Error("Invalid email format");
+  }
+  const plusIndex = local.indexOf("+");
+  const normalizedLocal = plusIndex === -1 ? local : local.substring(0, plusIndex);
+  if (!normalizedLocal) {
+    throw new Error("Invalid email format");
+  }
+  return `${normalizedLocal}@${domain}`;
+}
+function normalizeEmailSafe(email2) {
+  try {
+    return normalizeEmail(email2);
+  } catch {
+    return null;
+  }
+}
+
+// src/services/rate-limit.ts
 var min = (n) => n * 60;
 var DEFAULTS = {
   // login: 10/15min per IP AND 5/15min per account (credential stuffing
@@ -126,7 +161,9 @@ function buildAuthAccountLimiter(route, store, config) {
   return rateLimit({
     store: r.store,
     rule: r.account.rule,
-    key: byBodyField(`auth:${route}`, r.account.field)
+    // The account bucket is keyed the way accounts are stored, so a rotating
+    // '+tag' on the same address does not buy fresh attempts.
+    key: byBodyField(`auth:${route}`, r.account.field, r.account.field === "email" ? normalizeEmailSafe : void 0)
   });
 }
 
@@ -301,6 +338,10 @@ var EVENT_KEYS = {
   // 'password-changed', 'admin', 'refresh-reuse' (theft signal).
   sessionRevoked: "fonderie.session.revoked"
 };
+var deletionGracePeriodDays = (config) => {
+  const days = config.accountDeletion?.gracePeriodDays;
+  return typeof days === "number" && Number.isFinite(days) && days >= 0 ? days : 30;
+};
 
 // src/services/jwt.ts
 import { createHash, randomUUID } from "crypto";
@@ -717,6 +758,27 @@ var UserModel = class {
     );
     return row ?? null;
   }
+  /**
+   * An ARCHIVED (soft-deleted, not yet purged) account holding this address.
+   * Only for telling its owner — after they prove it is theirs — that it is
+   * scheduled for deletion, and for refusing to create a second account on
+   * the address meanwhile. Never for signing in.
+   */
+  async findArchivedByEmail(email2) {
+    const [row] = await this.store.query(
+      `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE email = $1 AND deleted_at IS NOT NULL`,
+      [email2]
+    );
+    return row ?? null;
+  }
+  /** As findArchivedByEmail, for a phone number. */
+  async findArchivedByPhone(phone2) {
+    const [row] = await this.store.query(
+      `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE phone = $1 AND deleted_at IS NOT NULL`,
+      [phone2]
+    );
+    return row ?? null;
+  }
   async findByPhone(phone2) {
     const [row] = await this.store.query(
       `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE phone = $1 AND deleted_at IS NULL`,
@@ -1571,7 +1633,7 @@ function mfaController(store, config, issuer, bus) {
 // src/controllers/auth.controller.ts
 import { randomBytes as randomBytes3, randomInt } from "crypto";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT2 } from "@fonderie/events";
-import { setApiResponse as setApiResponse3, HTTP as HTTP3, background as background3, canonicalLocale, defineLocales } from "@fonderie/core";
+import { setApiResponse as setApiResponse4, HTTP as HTTP4, background as background3, canonicalLocale, defineLocales } from "@fonderie/core";
 
 // src/services/cooldown.ts
 function checkCooldown(lastSentAt, cooldownMs) {
@@ -1582,37 +1644,26 @@ function checkCooldown(lastSentAt, cooldownMs) {
 // src/controllers/auth.controller.ts
 init_password();
 
-// src/services/email.ts
-function normalizeEmail(email2) {
-  if (typeof email2 !== "string" || email2.length === 0) {
-    throw new Error("Invalid email");
-  }
-  const lower = email2.trim().toLowerCase();
-  if (lower.length === 0) {
-    throw new Error("Email cannot be empty");
-  }
-  const atIndex = lower.indexOf("@");
-  if (atIndex === -1 || lower.lastIndexOf("@") !== atIndex) {
-    throw new Error("Invalid email format");
-  }
-  const local = lower.substring(0, atIndex);
-  const domain = lower.substring(atIndex + 1);
-  if (!local || !domain) {
-    throw new Error("Invalid email format");
-  }
-  const plusIndex = local.indexOf("+");
-  const normalizedLocal = plusIndex === -1 ? local : local.substring(0, plusIndex);
-  if (!normalizedLocal) {
-    throw new Error("Invalid email format");
-  }
-  return `${normalizedLocal}@${domain}`;
+// src/services/pending-deletion.ts
+import { setApiResponse as setApiResponse3, HTTP as HTTP3 } from "@fonderie/core";
+function deletionDate(deletedAt, config) {
+  return new Date(deletedAt.getTime() + deletionGracePeriodDays(config) * 24 * 60 * 60 * 1e3);
 }
-function normalizeEmailSafe(email2) {
-  try {
-    return normalizeEmail(email2);
-  } catch {
-    return null;
-  }
+function pendingDeletionResponse(deletedAt, config) {
+  const deleteOn = deletionDate(deletedAt, config);
+  return setApiResponse3(
+    HTTP3.FORBIDDEN,
+    "ACCOUNT_PENDING_DELETION",
+    `This account is scheduled for deletion on ${deleteOn.toISOString().slice(0, 10)}.`,
+    { requestedAt: deletedAt.toISOString(), deleteOn: deleteOn.toISOString() }
+  );
+}
+function archivedAddressResponse() {
+  return setApiResponse3(
+    HTTP3.CONFLICT,
+    "ACCOUNT_PENDING_DELETION",
+    "An account using this address is scheduled for deletion. Sign in to keep it, or wait until it is deleted."
+  );
 }
 
 // src/models/password-reset.model.ts
@@ -1787,19 +1838,20 @@ function authController(store, config, bus, locales = defineLocales()) {
       if (typeof email2 === "string" && typeof password2 === "string") {
         const normalizedEmail = normalizeEmailSafe(email2);
         if (!normalizedEmail) {
-          return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+          return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
         }
         if (password2.length < 8) {
-          return setApiResponse3(
-            HTTP3.UNPROCESSABLE,
+          return setApiResponse4(
+            HTTP4.UNPROCESSABLE,
             "INVALID_PARAMETER",
             "password must be at least 8 characters"
           );
         }
         const existing = await users.findByEmail(normalizedEmail);
         if (existing) {
-          return setApiResponse3(HTTP3.CONFLICT, "USER_ALREADY_EXISTS", "Email already registered");
+          return setApiResponse4(HTTP4.CONFLICT, "USER_ALREADY_EXISTS", "Email already registered");
         }
+        if (await users.findArchivedByEmail(normalizedEmail)) return archivedAddressResponse();
         const passwordHash = await hashPassword(password2);
         const row = await users.create(
           normalizedEmail,
@@ -1809,14 +1861,14 @@ function authController(store, config, bus, locales = defineLocales()) {
           locale
         );
         if (!row) {
-          return setApiResponse3(HTTP3.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+          return setApiResponse4(HTTP4.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
         const pin = randomInt(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
         await emailVerif.create(row.id, pin, expiresAt);
         const user = await users.findById(row.id);
         if (!user) {
-          return setApiResponse3(HTTP3.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+          return setApiResponse4(HTTP4.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
         const reqId = ctx.meta["requestId"];
         const reqOpts = reqId !== void 0 ? { requestId: reqId } : void 0;
@@ -1874,8 +1926,9 @@ function authController(store, config, bus, locales = defineLocales()) {
       if (isValidPhone(phone2)) {
         const existing = await users.findByPhone(normalizePhone(phone2));
         if (existing) {
-          return setApiResponse3(HTTP3.CONFLICT, "USER_ALREADY_EXISTS", "Phone already registered");
+          return setApiResponse4(HTTP4.CONFLICT, "USER_ALREADY_EXISTS", "Phone already registered");
         }
+        if (await users.findArchivedByPhone(normalizePhone(phone2))) return archivedAddressResponse();
         const { id } = await users.findOrCreateByPhone(
           normalizePhone(phone2),
           firstName ?? null,
@@ -1887,7 +1940,7 @@ function authController(store, config, bus, locales = defineLocales()) {
         await phoneVerif.upsert(id, normalizePhone(phone2), otp, expiresAt);
         const user = await users.findById(id);
         if (!user) {
-          return setApiResponse3(HTTP3.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+          return setApiResponse4(HTTP4.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
         const reqId2 = ctx.meta["requestId"];
         const reqOpts2 = reqId2 !== void 0 ? { requestId: reqId2 } : void 0;
@@ -1925,8 +1978,8 @@ function authController(store, config, bus, locales = defineLocales()) {
           { status: 202 }
         );
       }
-      return setApiResponse3(
-        HTTP3.UNPROCESSABLE,
+      return setApiResponse4(
+        HTTP4.UNPROCESSABLE,
         "INVALID_PARAMETER",
         "Provide email + password or a valid phone number"
       );
@@ -1938,9 +1991,25 @@ function authController(store, config, bus, locales = defineLocales()) {
         const { email: rawEmail, password: password2 } = body;
         const email2 = normalizeEmailSafe(rawEmail);
         if (!email2) {
-          return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+          return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
         }
         const user = await users.findByEmail(email2);
+        if (!user) {
+          const archived = await users.findArchivedByEmail(email2);
+          if (archived?.passwordHash && archived.deletedAt) {
+            const { valid: valid2 } = await verifyPasswordForLogin(password2, archived.passwordHash, config.legacyVerify);
+            await loginEvents.recordSafe({
+              userId: archived.id,
+              emailAttempted: email2,
+              method: "password",
+              outcome: "failed",
+              failureReason: valid2 ? "pending_deletion" : "bad_password",
+              ...meta
+            });
+            if (valid2) return pendingDeletionResponse(archived.deletedAt, config);
+            return setApiResponse4(HTTP4.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          }
+        }
         if (!user || !user.passwordHash) {
           await loginEvents.recordSafe({
             userId: null,
@@ -1950,7 +2019,7 @@ function authController(store, config, bus, locales = defineLocales()) {
             failureReason: "unknown_email",
             ...meta
           });
-          return setApiResponse3(HTTP3.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          return setApiResponse4(HTTP4.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         const { valid, needsRehash } = await verifyPasswordForLogin(
           password2,
@@ -1966,21 +2035,21 @@ function authController(store, config, bus, locales = defineLocales()) {
             failureReason: "bad_password",
             ...meta
           });
-          return setApiResponse3(HTTP3.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          return setApiResponse4(HTTP4.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         if (needsRehash) {
           await users.updatePassword(user.id, await hashPassword(password2));
         }
         if (user.suspended) {
-          return setApiResponse3(
-            HTTP3.FORBIDDEN,
+          return setApiResponse4(
+            HTTP4.FORBIDDEN,
             "ACCOUNT_SUSPENDED",
             "Account suspended. Please contact support."
           );
         }
         if (user.mfaEnabled) {
           const mfaToken = issueMfaPendingToken(user.id, config, "email");
-          return setApiResponse3(HTTP3.OK, "MFA_REQUIRED", "Multi-factor authentication required", {
+          return setApiResponse4(HTTP4.OK, "MFA_REQUIRED", "Multi-factor authentication required", {
             mfaToken
           });
         }
@@ -2017,11 +2086,11 @@ function authController(store, config, bus, locales = defineLocales()) {
       if (isValidPhone(phone2)) {
         const user = await users.findByPhone(normalizePhone(phone2));
         if (!user) {
-          return setApiResponse3(HTTP3.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          return setApiResponse4(HTTP4.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         if (user.suspended) {
-          return setApiResponse3(
-            HTTP3.FORBIDDEN,
+          return setApiResponse4(
+            HTTP4.FORBIDDEN,
             "ACCOUNT_SUSPENDED",
             "Account suspended. Please contact support."
           );
@@ -2045,8 +2114,8 @@ function authController(store, config, bus, locales = defineLocales()) {
           { status: 202 }
         );
       }
-      return setApiResponse3(
-        HTTP3.UNPROCESSABLE,
+      return setApiResponse4(
+        HTTP4.UNPROCESSABLE,
         "INVALID_PARAMETER",
         "Provide email + password or a valid phone number"
       );
@@ -2071,35 +2140,35 @@ function authController(store, config, bus, locales = defineLocales()) {
     refresh: async (ctx) => {
       const token = extractRefreshToken(ctx);
       if (!token) {
-        return setApiResponse3(HTTP3.UNAUTHORIZED, "INVALID_PARAMETER", "No refresh token provided");
+        return setApiResponse4(HTTP4.UNAUTHORIZED, "INVALID_PARAMETER", "No refresh token provided");
       }
       const payload = verifyToken(token, config);
       if (!payload || payload.type !== "refresh") {
-        return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
+        return setApiResponse4(HTTP4.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
       }
       const runtime = config.resolve?.(ctx);
       let issued = null;
       for (let attempt = 0; attempt < 3 && !issued; attempt++) {
         const found = await sessions.match(token);
         if (found.kind === "unknown") {
-          return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
+          return setApiResponse4(HTTP4.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
         }
         if (found.kind === "reused") {
           await sessions.revokeById(found.row.id);
           await background3(
             bus?.emit(EVENT_KEYS.sessionRevoked, { userId: found.row.userId, sids: [found.row.sid], reason: "refresh-reuse" })
           );
-          return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
+          return setApiResponse4(HTTP4.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
         }
         const resolvedRefresh = configForClient(config, runtime, found.row.clientKind);
         const maxAgeMs = resolvedRefresh.sessionMaxAge ? durationMs(String(resolvedRefresh.sessionMaxAge)) : null;
         if (maxAgeMs !== null && Date.now() - found.row.createdAt.getTime() > maxAgeMs) {
           await sessions.revokeById(found.row.id);
-          return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session reached its maximum age \u2014 sign in again");
+          return setApiResponse4(HTTP4.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session reached its maximum age \u2014 sign in again");
         }
         const user = await users.findById(found.row.userId);
         if (!user || user.suspended || user.deletedAt || user.id !== payload.sub) {
-          return setApiResponse3(HTTP3.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
+          return setApiResponse4(HTTP4.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
         }
         const pair = issueTokenPair(user.id, resolvedRefresh, {
           loginMethod: payload.loginMethod ?? "email",
@@ -2112,7 +2181,7 @@ function authController(store, config, bus, locales = defineLocales()) {
         if (await sessions.rotate(found.row, token, next, found.kind)) issued = pair;
       }
       if (!issued) {
-        return setApiResponse3(HTTP3.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
+        return setApiResponse4(HTTP4.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
       }
       const { accessToken, refreshToken } = issued;
       return Response.json(
@@ -2131,16 +2200,16 @@ function authController(store, config, bus, locales = defineLocales()) {
       const body = ctx.meta["body"];
       const rawEmail = body?.["email"];
       if (typeof rawEmail !== "string") {
-        return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "email is required");
+        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "email is required");
       }
       const email2 = normalizeEmailSafe(rawEmail);
       if (!email2) {
-        return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
       }
       const user = await users.findByEmail(email2);
       if (!user) {
-        return setApiResponse3(
-          HTTP3.OK,
+        return setApiResponse4(
+          HTTP4.OK,
           "PASSWORD_RESET_EMAIL_SENT",
           "Password reset email sent (if account exists)."
         );
@@ -2149,8 +2218,8 @@ function authController(store, config, bus, locales = defineLocales()) {
       const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
       const remaining = checkCooldown(await passwordReset.findLastSentAt(user.id), cooldown);
       if (remaining > 0) {
-        return setApiResponse3(
-          HTTP3.OK,
+        return setApiResponse4(
+          HTTP4.OK,
           "PASSWORD_RESET_EMAIL_SENT",
           "Password reset email sent (if account exists)."
         );
@@ -2167,8 +2236,8 @@ function authController(store, config, bus, locales = defineLocales()) {
         recipient: { email: email2, phone: null, deviceToken: null },
         data: { pin, token, resetUrl }
       }));
-      return setApiResponse3(
-        HTTP3.OK,
+      return setApiResponse4(
+        HTTP4.OK,
         "PASSWORD_RESET_EMAIL_SENT",
         "Password reset email sent (if account exists)."
       );
@@ -2179,11 +2248,11 @@ function authController(store, config, bus, locales = defineLocales()) {
       const password2 = body?.["password"];
       const rawToken = body?.["token"];
       if (typeof password2 !== "string") {
-        return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "password is required");
+        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "password is required");
       }
       if (password2.length < 8) {
-        return setApiResponse3(
-          HTTP3.UNPROCESSABLE,
+        return setApiResponse4(
+          HTTP4.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "password must be at least 8 characters"
         );
@@ -2193,8 +2262,8 @@ function authController(store, config, bus, locales = defineLocales()) {
         row = await passwordReset.findByToken(rawToken.trim());
       } else {
         if (typeof raw !== "string" || !/^\d{6}$/.test(raw.trim())) {
-          return setApiResponse3(
-            HTTP3.UNPROCESSABLE,
+          return setApiResponse4(
+            HTTP4.UNPROCESSABLE,
             "INVALID_PARAMETER",
             "a 6-digit pin or a reset token is required"
           );
@@ -2202,33 +2271,41 @@ function authController(store, config, bus, locales = defineLocales()) {
         row = await passwordReset.findByPin(raw.trim());
       }
       if (!row || /* @__PURE__ */ new Date() > row.expiresAt) {
-        return setApiResponse3(
-          HTTP3.BAD_REQUEST,
+        return setApiResponse4(
+          HTTP4.BAD_REQUEST,
           "PASSWORD_RESET_FAILED",
           "Invalid or expired reset credentials"
         );
       }
       const passwordHash = await hashPassword(password2);
-      await store.transaction(async (tx) => {
-        await Promise.all([
-          tx.query(`UPDATE fonderie_users SET password_hash = $1 WHERE id = $2`, [
-            passwordHash,
-            row.userId
-          ]),
-          tx.query(`DELETE FROM fonderie_password_resets WHERE user_id = $1`, [row.userId]),
-          // Revoke every session: the reset exists because the account may
-          // be compromised — a stolen session must not survive it.
-          tx.query(`DELETE FROM fonderie_sessions WHERE user_id = $1`, [row.userId])
-        ]);
-      });
-      return setApiResponse3(HTTP3.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
+      const [changed] = await store.query(
+        `WITH changed AS (
+				   UPDATE fonderie_users SET password_hash = $1, updated_at = now()
+				   WHERE id = $2 AND deleted_at IS NULL
+				   RETURNING id
+				 ), spent AS (
+				   DELETE FROM fonderie_password_resets WHERE user_id = $2
+				 ), revoked AS (
+				   DELETE FROM fonderie_sessions WHERE user_id IN (SELECT id FROM changed)
+				 )
+				 SELECT id FROM changed`,
+        [passwordHash, row.userId]
+      );
+      if (!changed) {
+        return setApiResponse4(
+          HTTP4.BAD_REQUEST,
+          "PASSWORD_RESET_FAILED",
+          "Invalid or expired reset credentials"
+        );
+      }
+      return setApiResponse4(HTTP4.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
     },
     verify: async (ctx) => {
       if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
-        return setApiResponse3(HTTP3.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+        return setApiResponse4(HTTP4.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
       }
       if (ctx.user.loginMethod !== "phone" && ctx.user.emailVerifiedAt) {
-        return setApiResponse3(HTTP3.OK, "VERIFIED", "Email verified successfully.", {
+        return setApiResponse4(HTTP4.OK, "VERIFIED", "Email verified successfully.", {
           verified: true,
           email: ctx.user.email
         });
@@ -2236,8 +2313,8 @@ function authController(store, config, bus, locales = defineLocales()) {
       const body = ctx.meta["body"];
       const raw = body?.["token"];
       if (typeof raw !== "string" || !/^\d{6}$/.test(raw.trim())) {
-        return setApiResponse3(
-          HTTP3.UNPROCESSABLE,
+        return setApiResponse4(
+          HTTP4.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "token must be a 6-digit code"
         );
@@ -2255,7 +2332,7 @@ function authController(store, config, bus, locales = defineLocales()) {
             failureReason: "invalid_pin",
             ...phoneMeta
           });
-          return setApiResponse3(HTTP3.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
+          return setApiResponse4(HTTP4.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
         }
         if (/* @__PURE__ */ new Date() > record.expiresAt) {
           await phoneVerif.deleteByUser(ctx.user.id);
@@ -2267,8 +2344,8 @@ function authController(store, config, bus, locales = defineLocales()) {
             failureReason: "expired_pin",
             ...phoneMeta
           });
-          return setApiResponse3(
-            HTTP3.BAD_REQUEST,
+          return setApiResponse4(
+            HTTP4.BAD_REQUEST,
             "VERIFICATION_FAILED",
             "Verification code expired"
           );
@@ -2288,11 +2365,11 @@ function authController(store, config, bus, locales = defineLocales()) {
         });
         const verifiedUser = await users.findById(ctx.user.id);
         if (!verifiedUser) {
-          return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "User not found");
+          return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "User not found");
         }
         if (verifiedUser.suspended) {
-          return setApiResponse3(
-            HTTP3.FORBIDDEN,
+          return setApiResponse4(
+            HTTP4.FORBIDDEN,
             "ACCOUNT_SUSPENDED",
             "Account suspended. Please contact support."
           );
@@ -2314,10 +2391,10 @@ function authController(store, config, bus, locales = defineLocales()) {
       }
       const row = await emailVerif.findByUser(ctx.user.id, pin);
       if (!row) {
-        return setApiResponse3(HTTP3.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
+        return setApiResponse4(HTTP4.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
       }
       if (/* @__PURE__ */ new Date() > row.expiresAt) {
-        return setApiResponse3(HTTP3.BAD_REQUEST, "VERIFICATION_FAILED", "Pin expired");
+        return setApiResponse4(HTTP4.BAD_REQUEST, "VERIFICATION_FAILED", "Pin expired");
       }
       await store.transaction(async (tx) => {
         await Promise.all([
@@ -2331,30 +2408,30 @@ function authController(store, config, bus, locales = defineLocales()) {
           ])
         ]);
       });
-      return setApiResponse3(HTTP3.OK, "VERIFIED", "Email verified successfully.", {
+      return setApiResponse4(HTTP4.OK, "VERIFIED", "Email verified successfully.", {
         verified: true,
         email: ctx.user.email
       });
     },
     sendVerification: async (ctx) => {
       if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
-        return setApiResponse3(HTTP3.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+        return setApiResponse4(HTTP4.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
       }
       const resolved = { ...config, ...config.resolve?.(ctx) };
       const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
       if (ctx.user.loginMethod === "phone") {
         const phone2 = ctx.user.phone;
         if (!phone2) {
-          return setApiResponse3(
-            HTTP3.BAD_REQUEST,
+          return setApiResponse4(
+            HTTP4.BAD_REQUEST,
             "NO_PHONE_ON_ACCOUNT",
             "No phone number associated with this account"
           );
         }
         const remaining2 = checkCooldown(await phoneVerif.findLastSentAt(ctx.user.id), cooldown);
         if (remaining2 > 0) {
-          return setApiResponse3(
-            HTTP3.TOO_MANY_REQUESTS,
+          return setApiResponse4(
+            HTTP4.TOO_MANY_REQUESTS,
             "VERIFICATION_COOLDOWN",
             "Please wait before requesting a new code.",
             {
@@ -2371,29 +2448,29 @@ function authController(store, config, bus, locales = defineLocales()) {
           data: { otp },
           recipient: { email: null, phone: phone2, deviceToken: null }
         }));
-        return setApiResponse3(
-          HTTP3.OK,
+        return setApiResponse4(
+          HTTP4.OK,
           "VERIFICATION_SENT",
           "A verification code has been sent to your phone."
         );
       }
       if (!ctx.user.email) {
-        return setApiResponse3(
-          HTTP3.BAD_REQUEST,
+        return setApiResponse4(
+          HTTP4.BAD_REQUEST,
           "NO_EMAIL_ON_ACCOUNT",
           "No email address associated with this account"
         );
       }
       if (ctx.user.emailVerifiedAt) {
-        return setApiResponse3(HTTP3.OK, "EMAIL_VERIFIED", "Email already verified.", {
+        return setApiResponse4(HTTP4.OK, "EMAIL_VERIFIED", "Email already verified.", {
           verified: true,
           email: ctx.user.email
         });
       }
       const remaining = checkCooldown(await emailVerif.findLastSentAt(ctx.user.id), cooldown);
       if (remaining > 0) {
-        return setApiResponse3(
-          HTTP3.TOO_MANY_REQUESTS,
+        return setApiResponse4(
+          HTTP4.TOO_MANY_REQUESTS,
           "VERIFICATION_COOLDOWN",
           "Please wait before requesting a new code.",
           {
@@ -2410,7 +2487,7 @@ function authController(store, config, bus, locales = defineLocales()) {
         recipient: { email: ctx.user.email, phone: null, deviceToken: null },
         data: { pin }
       }));
-      return setApiResponse3(HTTP3.OK, "VERIFICATION_SENT", "Verification email sent.", {
+      return setApiResponse4(HTTP4.OK, "VERIFICATION_SENT", "Verification email sent.", {
         email: ctx.user.email
       });
     }
@@ -2419,7 +2496,7 @@ function authController(store, config, bus, locales = defineLocales()) {
 
 // src/controllers/user.controller.ts
 import { randomInt as randomInt2 } from "crypto";
-import { setApiResponse as setApiResponse4, HTTP as HTTP4, dateOrEmpty as dateOrEmpty2, background as background4 } from "@fonderie/core";
+import { setApiResponse as setApiResponse5, HTTP as HTTP5, dateOrEmpty as dateOrEmpty2, background as background4 } from "@fonderie/core";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT3 } from "@fonderie/events";
 
 // src/dtos/login-activity.ts
@@ -2474,9 +2551,9 @@ function userController(store, config, bus) {
     me: async (ctx) => {
       const user = await users.findById(ctx.user.id);
       if (!user) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "User not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "User not found");
       }
-      return setApiResponse4(HTTP4.OK, "USER_ACCOUNT_FETCHED", "User account fetched successful.", {
+      return setApiResponse5(HTTP5.OK, "USER_ACCOUNT_FETCHED", "User account fetched successful.", {
         user: toUserDTO(user, ctx.user.phoneVerified)
       });
     },
@@ -2487,14 +2564,14 @@ function userController(store, config, bus) {
       const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50;
       const outcomeParam = params.get("outcome");
       if (outcomeParam !== null && outcomeParam !== "success" && outcomeParam !== "failed") {
-        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "outcome must be 'success' or 'failed'");
+        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "outcome must be 'success' or 'failed'");
       }
       const cursorParam = params.get("cursor");
       let cursor = null;
       if (cursorParam) {
         cursor = decodeLoginCursor(cursorParam);
         if (!cursor) {
-          return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
+          return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
         }
       }
       const query = { userId: ctx.user.id, limit };
@@ -2505,8 +2582,8 @@ function userController(store, config, bus) {
       if (from) query.from = new Date(from);
       if (to) query.to = new Date(to);
       const page = await loginEvents.listByUser(query);
-      return setApiResponse4(
-        HTTP4.OK,
+      return setApiResponse5(
+        HTTP5.OK,
         "LOGIN_HISTORY_FETCHED",
         "Login history retrieved.",
         toLoginHistoryPageDTO(page)
@@ -2516,27 +2593,27 @@ function userController(store, config, bus) {
     listSessions: async (ctx) => {
       const rows = await sessions.listLiveByUser(ctx.user.id);
       const currentSid = ctx.user.sid ?? null;
-      return setApiResponse4(HTTP4.OK, "SESSIONS_FETCHED", "Active sessions retrieved.", {
+      return setApiResponse5(HTTP5.OK, "SESSIONS_FETCHED", "Active sessions retrieved.", {
         sessions: rows.map((r) => toSessionDTO(r, currentSid))
       });
     },
     terminateSession: async (ctx) => {
       const id = ctx.meta["params"]?.["id"];
       if (!id) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Session not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Session not found");
       }
       const removed = await sessions.terminateByIdReturningSid(ctx.user.id, id);
       if (removed === void 0) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Session not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Session not found");
       }
       await background4(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: [removed], reason: "terminated" }));
-      return setApiResponse4(HTTP4.OK, "SESSION_TERMINATED", "Session terminated.", { id });
+      return setApiResponse5(HTTP5.OK, "SESSION_TERMINATED", "Session terminated.", { id });
     },
     terminateOtherSessions: async (ctx) => {
       const currentSid = ctx.user.sid ?? null;
       if (!currentSid) {
-        return setApiResponse4(
-          HTTP4.UNPROCESSABLE,
+        return setApiResponse5(
+          HTTP5.UNPROCESSABLE,
           "NO_CURRENT_SESSION",
           "Cannot terminate others without a current session context"
         );
@@ -2544,7 +2621,7 @@ function userController(store, config, bus) {
       const sids = await sessions.terminateOthersReturningSids(ctx.user.id, currentSid);
       const count = sids.length;
       if (count) await background4(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids, reason: "terminated" }));
-      return setApiResponse4(HTTP4.OK, "SESSIONS_TERMINATED", "Other sessions terminated.", { count });
+      return setApiResponse5(HTTP5.OK, "SESSIONS_TERMINATED", "Other sessions terminated.", { count });
     },
     updateProfile: async (ctx) => {
       const body = ctx.meta["body"];
@@ -2554,18 +2631,18 @@ function userController(store, config, bus) {
         if (body?.[key] !== void 0) fields[key] = body[key];
       }
       if (Object.keys(fields).length === 0) {
-        return setApiResponse4(
-          HTTP4.UNPROCESSABLE,
+        return setApiResponse5(
+          HTTP5.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Provide at least one of: firstName, lastName, avatarUrl"
         );
       }
       const row = await users.update(ctx.user.id, fields);
       if (!row) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "User not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "User not found");
       }
       const updated = await users.findById(ctx.user.id);
-      return setApiResponse4(HTTP4.OK, "PROFILE_UPDATED", "Profile updated.", {
+      return setApiResponse5(HTTP5.OK, "PROFILE_UPDATED", "Profile updated.", {
         user: toUserDTO(updated, ctx.user.phoneVerified)
       });
     },
@@ -2582,14 +2659,14 @@ function userController(store, config, bus) {
       if (Object.keys(patch).length > 0) fields.patch = patch;
       const row = await users.updatePreferences(ctx.user.id, fields);
       if (!row) {
-        return setApiResponse4(
-          HTTP4.UNPROCESSABLE,
+        return setApiResponse5(
+          HTTP5.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Provide at least one preference field"
         );
       }
       const updated = await users.findById(ctx.user.id);
-      return setApiResponse4(HTTP4.OK, "PREFERENCES_UPDATED", "Preferences updated.", {
+      return setApiResponse5(HTTP5.OK, "PREFERENCES_UPDATED", "Preferences updated.", {
         user: toUserDTO(updated, ctx.user.phoneVerified)
       });
     },
@@ -2598,23 +2675,23 @@ function userController(store, config, bus) {
       const newEmail = body?.["email"];
       const normalised = typeof newEmail === "string" ? normalizeEmailSafe(newEmail) : null;
       if (!normalised) {
-        return setApiResponse4(
-          HTTP4.UNPROCESSABLE,
+        return setApiResponse5(
+          HTTP5.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "A valid email address is required"
         );
       }
       const oldEmail = ctx.user.email;
       if (normalised === oldEmail) {
-        return setApiResponse4(
-          HTTP4.UNPROCESSABLE,
+        return setApiResponse5(
+          HTTP5.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "New email must differ from current email"
         );
       }
       const existing = await users.findByEmail(normalised);
       if (existing) {
-        return setApiResponse4(HTTP4.CONFLICT, "EMAIL_IN_USE", "Email already in use");
+        return setApiResponse5(HTTP5.CONFLICT, "EMAIL_IN_USE", "Email already in use");
       }
       const pin = randomInt2(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
@@ -2634,8 +2711,8 @@ function userController(store, config, bus) {
           recipient: { email: oldEmail, phone: null, deviceToken: null }
         }));
       }
-      return setApiResponse4(
-        HTTP4.OK,
+      return setApiResponse5(
+        HTTP5.OK,
         "EMAIL_UPDATED",
         "Email updated. A verification code has been sent to your new address.",
         {
@@ -2647,8 +2724,8 @@ function userController(store, config, bus) {
       const body = ctx.meta["body"];
       const newPhone = body?.["phone"];
       if (!isValidPhone2(newPhone)) {
-        return setApiResponse4(
-          HTTP4.UNPROCESSABLE,
+        return setApiResponse5(
+          HTTP5.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "A valid phone number is required"
         );
@@ -2656,7 +2733,7 @@ function userController(store, config, bus) {
       const normalised = normalizePhone2(newPhone);
       const existing = await users.findByPhone(normalised);
       if (existing) {
-        return setApiResponse4(HTTP4.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
+        return setApiResponse5(HTTP5.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
       }
       const otp = randomInt2(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
@@ -2676,8 +2753,8 @@ function userController(store, config, bus) {
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }));
       }
-      return setApiResponse4(
-        HTTP4.OK,
+      return setApiResponse5(
+        HTTP5.OK,
         "PHONE_UPDATED",
         "Phone number updated. A verification code has been sent to your new number.",
         {
@@ -2690,23 +2767,23 @@ function userController(store, config, bus) {
       const currentPassword = body?.["currentPassword"];
       const newPassword = body?.["newPassword"];
       if (typeof currentPassword !== "string" || !currentPassword) {
-        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "currentPassword is required");
+        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "currentPassword is required");
       }
       if (typeof newPassword !== "string" || newPassword.length < 8) {
-        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "newPassword must be at least 8 characters");
+        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "newPassword must be at least 8 characters");
       }
       const user = await users.findById(ctx.user.id);
-      if (!user) return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "User not found");
+      if (!user) return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "User not found");
       const { hashPassword: hashPassword2, verifyPassword: verifyPassword2 } = await Promise.resolve().then(() => (init_password(), password_exports));
       const valid = await verifyPassword2(currentPassword, user.passwordHash ?? "");
       if (!valid) {
-        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_CREDENTIAL", "Current password is incorrect");
+        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_CREDENTIAL", "Current password is incorrect");
       }
       const hash = await hashPassword2(newPassword);
       await users.updatePassword(ctx.user.id, hash);
       await sessions.deleteByUser(ctx.user.id);
       await background4(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: null, reason: "password-changed" }));
-      return setApiResponse4(HTTP4.OK, "PASSWORD_CHANGED", "Password updated successfully.");
+      return setApiResponse5(HTTP5.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
     /**
      * Remove an OAuth provider from the account.
@@ -2725,19 +2802,19 @@ function userController(store, config, bus) {
       const provider = String(ctx.meta["params"]?.["provider"] ?? "");
       const current = await users.findById(ctx.user.id);
       if (!current?.provider) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_LINKED", "No sign-in provider is linked.");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_LINKED", "No sign-in provider is linked.");
       }
       if (provider && provider.toLowerCase() !== current.provider.toLowerCase()) {
-        return setApiResponse4(
-          HTTP4.NOT_FOUND,
+        return setApiResponse5(
+          HTTP5.NOT_FOUND,
           "NOT_LINKED",
           `This account is not linked to ${provider}.`
         );
       }
       const removed = await users.clearProvider(ctx.user.id);
       if (!removed) {
-        return setApiResponse4(
-          HTTP4.CONFLICT,
+        return setApiResponse5(
+          HTTP5.CONFLICT,
           "PASSWORD_REQUIRED",
           "Set a password before disconnecting this provider \u2014 it is currently the only way to sign in."
         );
@@ -2750,12 +2827,18 @@ function userController(store, config, bus) {
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }));
       }
-      return setApiResponse4(HTTP4.OK, "OAUTH_UNLINKED", "Sign-in provider removed.");
+      return setApiResponse5(HTTP5.OK, "OAUTH_UNLINKED", "Sign-in provider removed.");
     },
     deleteMe: async (ctx) => {
       const userId = ctx.user.id;
       await users.softDelete(userId);
       await sessions.deleteByUser(userId);
+      await store.query(
+        `WITH resets AS (DELETE FROM fonderie_password_resets WHERE user_id = $1),
+				      emails AS (DELETE FROM fonderie_email_verifications WHERE user_id = $1)
+				 DELETE FROM fonderie_phone_verifications WHERE user_id = $1`,
+        [userId]
+      );
       const reqId = ctx.meta["requestId"];
       await background4(bus?.emit(
         EVENT_KEYS.userDeleted,
@@ -2776,7 +2859,7 @@ function userController(store, config, bus) {
     // no MFA secret, no session tokens (session metadata only).
     exportMe: async (ctx) => {
       const user = await users.findById(ctx.user.id);
-      if (!user) return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "User not found");
+      if (!user) return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "User not found");
       const sessionRows = await sessions.listByUser(ctx.user.id);
       const bundle = {
         exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2805,7 +2888,7 @@ function userController(store, config, bus) {
         }
         bundle["modules"] = modules;
       }
-      return setApiResponse4(HTTP4.OK, "DATA_EXPORT", "Your account data.", bundle);
+      return setApiResponse5(HTTP5.OK, "DATA_EXPORT", "Your account data.", bundle);
     }
   };
 }
@@ -2813,7 +2896,7 @@ function userController(store, config, bus) {
 // src/controllers/oauth.controller.ts
 import { randomBytes as randomBytes4, createHash as createHash4 } from "crypto";
 import jwt2 from "jsonwebtoken";
-import { setApiResponse as setApiResponse5, HTTP as HTTP5, constantTimeEqual as constantTimeEqual2, background as background5 } from "@fonderie/core";
+import { setApiResponse as setApiResponse6, HTTP as HTTP6, constantTimeEqual as constantTimeEqual2, background as background5 } from "@fonderie/core";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT4 } from "@fonderie/events";
 
 // src/services/jwks.ts
@@ -3023,14 +3106,29 @@ function oauthController(store, config, bus) {
     const method = provider === "apple" ? "oauth-apple" : "oauth-google";
     const meta = requestMeta(ctx);
     if (!claims.email) {
-      return setApiResponse5(HTTP5.BAD_REQUEST, p.failed, `No email in ${p.label} identity token`);
+      return setApiResponse6(HTTP6.BAD_REQUEST, p.failed, `No email in ${p.label} identity token`);
     }
     if (!claims.emailVerified) {
-      return setApiResponse5(HTTP5.BAD_REQUEST, p.failed, `${p.label} account email is not verified`);
+      return setApiResponse6(HTTP6.BAD_REQUEST, p.failed, `${p.label} account email is not verified`);
     }
     const normalizedEmail = normalizeEmailSafe(claims.email);
     if (!normalizedEmail) {
-      return setApiResponse5(HTTP5.BAD_REQUEST, p.failed, `Invalid email in ${p.label} identity token`);
+      return setApiResponse6(HTTP6.BAD_REQUEST, p.failed, `Invalid email in ${p.label} identity token`);
+    }
+    const archived = await users.findArchivedByEmail(normalizedEmail);
+    if (archived?.deletedAt) {
+      await loginEvents.recordSafe({
+        userId: archived.id,
+        emailAttempted: normalizedEmail,
+        method,
+        outcome: "failed",
+        failureReason: "pending_deletion",
+        ...meta
+      });
+      const res = pendingDeletionResponse(archived.deletedAt, config);
+      const headers = cookieHeaders(clearCookies);
+      headers.set("content-type", res.headers.get("content-type") ?? "application/json");
+      return new Response(res.body, { status: res.status, headers });
     }
     const upserted = await users.upsertByProvider(normalizedEmail, provider, claims.sub ?? "");
     if (!upserted) {
@@ -3042,15 +3140,15 @@ function oauthController(store, config, bus) {
         failureReason: "provider_upsert_failed",
         ...meta
       });
-      return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
+      return setApiResponse6(HTTP6.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
     }
     const fullUser = await users.findById(upserted.id);
     if (!fullUser) {
-      return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
+      return setApiResponse6(HTTP6.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
     }
     await announceOAuthUpsert(ctx, upserted, provider, fullUser);
     if (fullUser.suspended) {
-      return setApiResponse5(HTTP5.FORBIDDEN, "ACCOUNT_SUSPENDED", "Account suspended. Please contact support.");
+      return setApiResponse6(HTTP6.FORBIDDEN, "ACCOUNT_SUSPENDED", "Account suspended. Please contact support.");
     }
     if (fullUser.mfaEnabled) {
       const mfaToken = issueMfaPendingToken(upserted.id, config, provider);
@@ -3093,8 +3191,8 @@ function oauthController(store, config, bus) {
     googleInit: async (_ctx) => {
       const google = config.google;
       if (!google || !google.clientSecret || !google.redirectUri) {
-        return setApiResponse5(
-          HTTP5.NOT_IMPLEMENTED,
+        return setApiResponse6(
+          HTTP6.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
           "Google OAuth not configured"
         );
@@ -3128,8 +3226,8 @@ function oauthController(store, config, bus) {
     googleCallback: async (ctx) => {
       const google = config.google;
       if (!google || !google.clientSecret || !google.redirectUri) {
-        return setApiResponse5(
-          HTTP5.NOT_IMPLEMENTED,
+        return setApiResponse6(
+          HTTP6.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
           "Google OAuth not configured"
         );
@@ -3137,14 +3235,14 @@ function oauthController(store, config, bus) {
       const url = new URL(ctx.request.url);
       const code = url.searchParams.get("code");
       if (!code) {
-        return setApiResponse5(HTTP5.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
+        return setApiResponse6(HTTP6.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
       }
       const returnedState = url.searchParams.get("state") ?? "";
       const cookieHeader = ctx.request.headers.get("cookie") ?? "";
       const expectedState = cookieHeader.match(/(?:^|;\s*)oauth_state=([^;]+)/)?.[1] ?? "";
       if (!returnedState || !expectedState || !constantTimeEqual2(Buffer.from(returnedState), Buffer.from(expectedState))) {
-        return setApiResponse5(
-          HTTP5.BAD_REQUEST,
+        return setApiResponse6(
+          HTTP6.BAD_REQUEST,
           "GOOGLE_AUTH_FAILED",
           "OAuth state mismatch \u2014 restart the sign-in flow"
         );
@@ -3162,8 +3260,8 @@ function oauthController(store, config, bus) {
       });
       const tokenData = await tokenRes.json();
       if (!tokenData.id_token) {
-        return setApiResponse5(
-          HTTP5.BAD_REQUEST,
+        return setApiResponse6(
+          HTTP6.BAD_REQUEST,
           "GOOGLE_AUTH_FAILED",
           "OAuth token exchange failed"
         );
@@ -3172,20 +3270,20 @@ function oauthController(store, config, bus) {
         Buffer.from(tokenData.id_token.split(".")[1] ?? "", "base64url").toString()
       );
       if (payload.aud !== google.clientId) {
-        return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token audience mismatch");
+        return setApiResponse6(HTTP6.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token audience mismatch");
       }
       if (payload.iss !== "https://accounts.google.com" && payload.iss !== "accounts.google.com") {
-        return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token issuer mismatch");
+        return setApiResponse6(HTTP6.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token issuer mismatch");
       }
       if (typeof payload.exp !== "number" || payload.exp * 1e3 < Date.now()) {
-        return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token expired");
+        return setApiResponse6(HTTP6.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token expired");
       }
       if (!payload.email) {
-        return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
+        return setApiResponse6(HTTP6.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
       }
       if (payload.email_verified !== true) {
-        return setApiResponse5(
-          HTTP5.BAD_REQUEST,
+        return setApiResponse6(
+          HTTP6.BAD_REQUEST,
           "GOOGLE_AUTH_FAILED",
           "Google account email is not verified"
         );
@@ -3199,7 +3297,7 @@ function oauthController(store, config, bus) {
     appleInit: async (_ctx) => {
       const apple = config.apple;
       if (!apple) {
-        return setApiResponse5(HTTP5.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+        return setApiResponse6(HTTP6.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
       }
       const state = randomBytes4(16).toString("hex");
       const params = new URLSearchParams({
@@ -3230,20 +3328,20 @@ function oauthController(store, config, bus) {
     appleCallback: async (ctx) => {
       const apple = config.apple;
       if (!apple) {
-        return setApiResponse5(HTTP5.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+        return setApiResponse6(HTTP6.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
       }
       const pre = ctx.meta["body"];
       const form = pre && typeof pre === "object" ? new URLSearchParams(pre) : new URLSearchParams(await ctx.request.text());
       const code = form.get("code");
       if (!code) {
-        return setApiResponse5(HTTP5.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
+        return setApiResponse6(HTTP6.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
       }
       const returnedState = form.get("state") ?? "";
       const cookieHeader = ctx.request.headers.get("cookie") ?? "";
       const expectedState = cookieHeader.match(/(?:^|;\s*)oauth_state=([^;]+)/)?.[1] ?? "";
       if (!returnedState || !expectedState || !constantTimeEqual2(Buffer.from(returnedState), Buffer.from(expectedState))) {
-        return setApiResponse5(
-          HTTP5.BAD_REQUEST,
+        return setApiResponse6(
+          HTTP6.BAD_REQUEST,
           "APPLE_AUTH_FAILED",
           "OAuth state mismatch \u2014 restart the sign-in flow"
         );
@@ -3261,11 +3359,11 @@ function oauthController(store, config, bus) {
       });
       const tokenData = await tokenRes.json();
       if (!tokenData.id_token) {
-        return setApiResponse5(HTTP5.BAD_REQUEST, "APPLE_AUTH_FAILED", "OAuth token exchange failed");
+        return setApiResponse6(HTTP6.BAD_REQUEST, "APPLE_AUTH_FAILED", "OAuth token exchange failed");
       }
       const claims = await verifyAppleIdToken(tokenData.id_token, { audiences: [apple.clientId] });
       if (!claims) {
-        return setApiResponse5(HTTP5.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
+        return setApiResponse6(HTTP6.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
       }
       return completeOAuthLogin(ctx, "apple", {
         email: claims.email,
@@ -3276,12 +3374,12 @@ function oauthController(store, config, bus) {
     appleNative: async (ctx) => {
       const apple = config.apple;
       if (!apple) {
-        return setApiResponse5(HTTP5.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+        return setApiResponse6(HTTP6.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
       }
       const body = ctx.meta["body"];
       const identityToken = body?.identityToken;
       if (!identityToken) {
-        return setApiResponse5(HTTP5.BAD_REQUEST, "INVALID_PARAMETER", "Missing identityToken");
+        return setApiResponse6(HTTP6.BAD_REQUEST, "INVALID_PARAMETER", "Missing identityToken");
       }
       const audiences = apple.nativeClientIds && apple.nativeClientIds.length ? apple.nativeClientIds : [apple.clientId];
       const claims = await verifyAppleIdToken(identityToken, { audiences, nonce: body?.nonce });
@@ -3295,7 +3393,7 @@ function oauthController(store, config, bus) {
           failureReason: "invalid_identity_token",
           ...meta
         });
-        return setApiResponse5(HTTP5.UNAUTHORIZED, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
+        return setApiResponse6(HTTP6.UNAUTHORIZED, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
       }
       const tokenHash = createHash4("sha256").update(identityToken).digest("hex");
       const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
@@ -3304,14 +3402,14 @@ function oauthController(store, config, bus) {
         const meta = requestMeta(ctx);
         await loginEvents.recordSafe({
           userId: null,
-          emailAttempted: claims.email ?? null,
+          emailAttempted: claims.email ? normalizeEmailSafe(claims.email) ?? claims.email : null,
           method: "oauth-apple",
           outcome: "failed",
           failureReason: "token_replayed",
           ...meta
         });
-        return setApiResponse5(
-          HTTP5.UNAUTHORIZED,
+        return setApiResponse6(
+          HTTP6.UNAUTHORIZED,
           "APPLE_AUTH_FAILED",
           "This Apple identity token has already been used"
         );
@@ -3328,12 +3426,12 @@ function oauthController(store, config, bus) {
     googleNative: async (ctx) => {
       const audiences = config.google?.nativeClientIds ?? [];
       if (!config.google || audiences.length === 0) {
-        return setApiResponse5(HTTP5.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Native Google sign-in not configured");
+        return setApiResponse6(HTTP6.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Native Google sign-in not configured");
       }
       const body = ctx.meta["body"];
       const idToken = body?.idToken;
       if (!idToken) {
-        return setApiResponse5(HTTP5.BAD_REQUEST, "INVALID_PARAMETER", "Missing idToken");
+        return setApiResponse6(HTTP6.BAD_REQUEST, "INVALID_PARAMETER", "Missing idToken");
       }
       const claims = await verifyGoogleIdToken(idToken, { audiences, nonce: body?.nonce });
       if (!claims) {
@@ -3345,20 +3443,20 @@ function oauthController(store, config, bus) {
           failureReason: "invalid_identity_token",
           ...requestMeta(ctx)
         });
-        return setApiResponse5(HTTP5.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "Invalid Google ID token");
+        return setApiResponse6(HTTP6.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "Invalid Google ID token");
       }
       const tokenHash = createHash4("sha256").update(idToken).digest("hex");
       const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
       if (!await consumedTokens.consumeOnce(tokenHash, new Date(expMs))) {
         await loginEvents.recordSafe({
           userId: null,
-          emailAttempted: claims.email ?? null,
+          emailAttempted: claims.email ? normalizeEmailSafe(claims.email) ?? claims.email : null,
           method: "oauth-google",
           outcome: "failed",
           failureReason: "token_replayed",
           ...requestMeta(ctx)
         });
-        return setApiResponse5(HTTP5.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "This Google ID token has already been used");
+        return setApiResponse6(HTTP6.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "This Google ID token has already been used");
       }
       consumedTokens.sweepExpiredSafe();
       return completeOAuthLogin(ctx, "google", {
@@ -3404,7 +3502,7 @@ function buildAuthRoutes(store, config, bus, locales) {
       "providers",
       "GET",
       "/auth/providers",
-      async () => setApiResponse6(HTTP6.OK, "AUTH_PROVIDERS", "Sign-in methods available here", {
+      async () => setApiResponse7(HTTP7.OK, "AUTH_PROVIDERS", "Sign-in methods available here", {
         providers: [...config.providers]
       })
     ),
@@ -3668,7 +3766,7 @@ function extractToken(request) {
 }
 
 // src/admin.ts
-import { HTTP as HTTP7, encodeKeysetCursor as encodeKeysetCursor2, setApiResponse as setApiResponse7 } from "@fonderie/core";
+import { HTTP as HTTP8, encodeKeysetCursor as encodeKeysetCursor2, setApiResponse as setApiResponse8 } from "@fonderie/core";
 import { background as background6 } from "@fonderie/core";
 function toAdminUserDTO(user) {
   return {
@@ -3685,7 +3783,7 @@ function toAdminUserPageDTO(page) {
 }
 var ADMIN_PREFIX = "/_admin";
 var idOf = (ctx) => ctx.meta.params?.["id"] ?? "";
-var NOT_FOUND = () => setApiResponse7(HTTP7.NOT_FOUND, "NOT_FOUND", "No such user");
+var NOT_FOUND = () => setApiResponse8(HTTP8.NOT_FOUND, "NOT_FOUND", "No such user");
 function adminRouteTable(store, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
@@ -3694,8 +3792,8 @@ function adminRouteTable(store, bus) {
     const ok = await users.setSuspended(idOf(ctx), suspended);
     if (!ok) return NOT_FOUND();
     const user = await users.findById(idOf(ctx));
-    return user ? setApiResponse7(
-      HTTP7.OK,
+    return user ? setApiResponse8(
+      HTTP8.OK,
       suspended ? "USER_SUSPENDED" : "USER_UNSUSPENDED",
       suspended ? "User suspended" : "User unsuspended",
       toAdminUserDTO(user)
@@ -3710,24 +3808,25 @@ function adminRouteTable(store, bus) {
       // see anything cannot discover who signed up this morning.
       async (ctx) => {
         const params = new URL(ctx.request.url).searchParams;
-        const email2 = params.get("email")?.trim().toLowerCase();
+        const raw = params.get("email")?.trim();
+        const email2 = raw ? normalizeEmailSafe(raw) ?? raw.toLowerCase() : void 0;
         if (email2) {
           const user = await users.findByEmail(email2);
-          return user ? setApiResponse7(HTTP7.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
+          return user ? setApiResponse8(HTTP8.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
         }
         const rawLimit = Number(params.get("limit") ?? 50);
         const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50;
         const cursorParam = params.get("cursor");
         const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null;
         if (cursorParam && !cursor)
-          return setApiResponse7(HTTP7.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
+          return setApiResponse8(HTTP8.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
         const deleted = params.get("deleted") === "1" || params.get("deleted") === "true";
         const page = await users.list({
           limit,
           ...cursor ? { cursor } : {},
           ...deleted ? { deleted } : {}
         });
-        return setApiResponse7(HTTP7.OK, "USERS", "Users", toAdminUserPageDTO(page));
+        return setApiResponse8(HTTP8.OK, "USERS", "Users", toAdminUserPageDTO(page));
       }
     ],
     [
@@ -3735,7 +3834,7 @@ function adminRouteTable(store, bus) {
       "/_admin/users/:id",
       async (ctx) => {
         const user = await users.findByIdIncludingDeleted(idOf(ctx));
-        return user ? setApiResponse7(HTTP7.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
+        return user ? setApiResponse8(HTTP8.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
       }
     ],
     [
@@ -3744,8 +3843,8 @@ function adminRouteTable(store, bus) {
       async (ctx) => {
         if (!await users.findById(idOf(ctx))) return NOT_FOUND();
         const rows = await sessions.listLiveByUser(idOf(ctx));
-        return setApiResponse7(
-          HTTP7.OK,
+        return setApiResponse8(
+          HTTP8.OK,
           "SESSIONS",
           "Live sessions",
           rows.map((r) => toSessionDTO(r, null))
@@ -3760,7 +3859,7 @@ function adminRouteTable(store, bus) {
         if (!await users.findById(idOf(ctx))) return NOT_FOUND();
         await sessions.deleteByUser(idOf(ctx));
         await background6(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: idOf(ctx), sids: null, reason: "admin" }));
-        return setApiResponse7(HTTP7.OK, "SESSIONS_REVOKED", "All sessions revoked");
+        return setApiResponse8(HTTP8.OK, "SESSIONS_REVOKED", "All sessions revoked");
       }
     ],
     [
@@ -3774,14 +3873,14 @@ function adminRouteTable(store, bus) {
         const cursorParam = params.get("cursor");
         const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null;
         if (cursorParam && !cursor)
-          return setApiResponse7(HTTP7.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
+          return setApiResponse8(HTTP8.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
         const page = await events.listByUser({
           userId: idOf(ctx),
           limit,
           ...cursor ? { cursor } : {}
         });
-        return setApiResponse7(
-          HTTP7.OK,
+        return setApiResponse8(
+          HTTP8.OK,
           "LOGIN_HISTORY",
           "Login history",
           toLoginHistoryPageDTO(page)
@@ -3814,7 +3913,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.22.0";
+  version = "7.23.0";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store, this.bus) };
@@ -4670,7 +4769,9 @@ async function importUser(store, user) {
     placeholders.push(`$${vals.length}`);
   };
   if (user.id !== void 0) add("id", user.id);
-  add("email", user.email.toLowerCase().trim());
+  const email2 = normalizeEmailSafe(user.email);
+  if (!email2) throw new Error(`[auth] importUser: '${user.email}' is not an email address`);
+  add("email", email2);
   if (user.passwordHash !== void 0) add("password_hash", user.passwordHash);
   if (user.firstName !== void 0) add("first_name", user.firstName);
   if (user.lastName !== void 0) add("last_name", user.lastName);