@fonderie/auth 7.22.1 → 7.24.0

package/dist/index.cjs

@@ -100,7 +100,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/routes.ts
-var import_core10 = require("@fonderie/core");
+var import_core11 = require("@fonderie/core");
 var import_middlewares2 = require("@fonderie/core/middlewares");
 
 // src/middlewares/require-email-login.ts
@@ -223,13 +223,16 @@ var schemas_exports = {};
 __export(schemas_exports, {
   appleNativeSchema: () => appleNativeSchema,
   changePasswordSchema: () => changePasswordSchema,
+  confirmDeletionSchema: () => confirmDeletionSchema,
   forgotPasswordSchema: () => forgotPasswordSchema,
   googleNativeSchema: () => googleNativeSchema,
   loginSchema: () => loginSchema,
   mfaTokenSchema: () => mfaTokenSchema,
   refreshSchema: () => refreshSchema,
   registerSchema: () => registerSchema,
+  requestDeletionSchema: () => requestDeletionSchema,
   resetPasswordSchema: () => resetPasswordSchema,
+  restoreAccountSchema: () => restoreAccountSchema,
   updateEmailSchema: () => updateEmailSchema,
   updatePhoneSchema: () => updatePhoneSchema,
   updatePreferencesSchema: () => updatePreferencesSchema,
@@ -309,6 +312,10 @@ var changePasswordSchema = import_zod.z.object({
   newPassword: password
 });
 var mfaTokenSchema = import_zod.z.object({ token: import_zod.z.string().trim().min(6).max(64) });
+var secondFactor = import_zod.z.string().trim().min(6).max(16).optional();
+var requestDeletionSchema = import_zod.z.object({ channel: import_zod.z.enum(["email", "sms"]) });
+var confirmDeletionSchema = import_zod.z.object({ code: sixDigitPin, mfaCode: secondFactor });
+var restoreAccountSchema = import_zod.z.object({ restoreToken: import_zod.z.string().min(20).max(4096), mfaCode: secondFactor });
 
 // src/services/cookies.ts
 function secureAttr(config) {
@@ -374,13 +381,23 @@ var MESSAGE_KEYS = {
   // arrives already verified by the provider and has nothing to confirm.
   oauthRegistration: "oauth-registration",
   oauthLinked: "oauth-linked",
-  oauthUnlinked: "oauth-unlinked"
+  oauthUnlinked: "oauth-unlinked",
+  // Account deletion (docs/ACCOUNT-DELETION-DESIGN.md). Each goes to the ONE
+  // verified channel the person chose — route these types to both 'email'
+  // and 'sms' in courier: auth fills in only the chosen address, and the
+  // other channel skips. SMS sends each template's text.
+  accountDeletionCode: "account-deletion-code",
+  accountDeletionScheduled: "account-deletion-scheduled",
+  accountRestored: "account-restored"
 };
 var EVENT_KEYS = {
   userRegistered: "fonderie.user.registered",
   userDeleted: "fonderie.user.deleted",
   // Emitted by purgeSoftDeletedUsers (given a bus) once the row is hard-deleted.
   userPurged: "fonderie.user.purged",
+  // An archived account was kept: { userId }. Undo what deletion paused
+  // (billing resumes a subscription set to end at the period's end).
+  userRestored: "fonderie.user.restored",
   emailVerified: "fonderie.user.email_verified",
   passwordChanged: "fonderie.user.password_changed",
   // Sessions the server revoked: { userId, sids (null = all), reason }. Reaches
@@ -389,6 +406,10 @@ var EVENT_KEYS = {
   // 'password-changed', 'admin', 'refresh-reuse' (theft signal).
   sessionRevoked: "fonderie.session.revoked"
 };
+var deletionGracePeriodDays = (config) => {
+  const days = config.accountDeletion?.gracePeriodDays;
+  return typeof days === "number" && Number.isFinite(days) && days >= 0 ? days : 30;
+};
 
 // src/services/jwt.ts
 var import_node_crypto = require("crypto");
@@ -805,6 +826,35 @@ var UserModel = class {
     );
     return row ?? null;
   }
+  /**
+   * An ARCHIVED (soft-deleted, not yet purged) account holding this address.
+   * Only for telling its owner — after they prove it is theirs — that it is
+   * scheduled for deletion, and for refusing to create a second account on
+   * the address meanwhile. Never for signing in.
+   */
+  async findArchivedByEmail(email2) {
+    const [row] = await this.store.query(
+      `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE email = $1 AND deleted_at IS NOT NULL`,
+      [email2]
+    );
+    return row ?? null;
+  }
+  /** An archived account by id (restore). */
+  async findArchivedById(id) {
+    const [row] = await this.store.query(
+      `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE id = $1 AND deleted_at IS NOT NULL`,
+      [id]
+    );
+    return row ?? null;
+  }
+  /** As findArchivedByEmail, for a phone number. */
+  async findArchivedByPhone(phone2) {
+    const [row] = await this.store.query(
+      `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE phone = $1 AND deleted_at IS NOT NULL`,
+      [phone2]
+    );
+    return row ?? null;
+  }
   async findByPhone(phone2) {
     const [row] = await this.store.query(
       `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE phone = $1 AND deleted_at IS NULL`,
@@ -1348,10 +1398,17 @@ var BackupCodeModel = class {
     );
     return rows.map((r) => ({ id: r.id, codeHash: r.code_hash }));
   }
+  /**
+   * Spend a backup code — once. Conditional on still being unused, so two
+   * requests racing with the same code cannot both sign in: the second finds
+   * it spent (false).
+   */
   async consume(id) {
-    await this.store.query(`UPDATE fonderie_mfa_backup_codes SET used_at = now() WHERE id = $1`, [
-      id
-    ]);
+    const rows = await this.store.query(
+      `UPDATE fonderie_mfa_backup_codes SET used_at = now() WHERE id = $1 AND used_at IS NULL RETURNING id`,
+      [id]
+    );
+    return rows.length > 0;
   }
   async deleteByUser(userId) {
     await this.store.query(`DELETE FROM fonderie_mfa_backup_codes WHERE user_id = $1`, [userId]);
@@ -1491,6 +1548,7 @@ function mfaController(store, config, issuer, bus) {
     },
     // ── 2. Verify (setup confirm · TOTP login · backup code login) ──
     verify: async (ctx) => {
+      if (ctx.user.deletedAt) return (0, import_core5.setApiResponse)(import_core5.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
       const body = ctx.meta["body"];
       const token = body?.["token"];
       const isLoginCompletion = ctx.user.mfaPending === true;
@@ -1545,7 +1603,10 @@ function mfaController(store, config, issuer, bus) {
           if (isLoginCompletion) await failedMfa();
           return (0, import_core5.setApiResponse)(import_core5.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid backup code");
         }
-        await backupCodes.consume(matched.id);
+        if (!await backupCodes.consume(matched.id)) {
+          if (isLoginCompletion) await failedMfa();
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid backup code");
+        }
       } else {
         if (!ctx.user.mfaPending) {
           return (0, import_core5.setApiResponse)(
@@ -1659,7 +1720,7 @@ function mfaController(store, config, issuer, bus) {
 // src/controllers/auth.controller.ts
 var import_node_crypto6 = require("crypto");
 var import_events2 = require("@fonderie/events");
-var import_core6 = require("@fonderie/core");
+var import_core7 = require("@fonderie/core");
 
 // src/services/cooldown.ts
 function checkCooldown(lastSentAt, cooldownMs) {
@@ -1670,6 +1731,72 @@ function checkCooldown(lastSentAt, cooldownMs) {
 // src/controllers/auth.controller.ts
 init_password();
 
+// src/services/pending-deletion.ts
+var import_core6 = require("@fonderie/core");
+
+// src/services/restore-token.ts
+var import_jsonwebtoken2 = __toESM(require("jsonwebtoken"), 1);
+var RESTORE_TTL = "10m";
+function issueRestoreToken(userId, deletedAt, loginMethod, config) {
+  return import_jsonwebtoken2.default.sign(
+    { sub: userId, type: "restore", loginMethod, archivedAt: deletedAt.toISOString() },
+    config.jwtSecret,
+    { expiresIn: RESTORE_TTL, keyid: keyIdOf(config.jwtSecret) }
+  );
+}
+function verifyRestoreToken(token, config) {
+  const payload = verifyToken(token, config);
+  if (!payload || payload.type !== "restore" || typeof payload.sub !== "string" || typeof payload.archivedAt !== "string") return null;
+  return payload;
+}
+
+// src/services/pending-deletion.ts
+function deletionDate(deletedAt, config) {
+  return new Date(deletedAt.getTime() + deletionGracePeriodDays(config) * 24 * 60 * 60 * 1e3);
+}
+function pendingDeletionResponse(user, loginMethod, config) {
+  const deleteOn = deletionDate(user.deletedAt, config);
+  return (0, import_core6.setApiResponse)(
+    import_core6.HTTP.FORBIDDEN,
+    "ACCOUNT_PENDING_DELETION",
+    `This account is scheduled for deletion on ${deleteOn.toISOString().slice(0, 10)}.`,
+    {
+      requestedAt: user.deletedAt.toISOString(),
+      deleteOn: deleteOn.toISOString(),
+      restoreToken: issueRestoreToken(user.id, user.deletedAt, loginMethod, config),
+      mfaRequired: user.mfaEnabled === true
+    }
+  );
+}
+function archivedAddressResponse() {
+  return (0, import_core6.setApiResponse)(
+    import_core6.HTTP.CONFLICT,
+    "ACCOUNT_PENDING_DELETION",
+    "An account using this address is scheduled for deletion. Sign in to keep it, or wait until it is deleted."
+  );
+}
+
+// src/services/second-factor.ts
+init_password();
+async function verifySecondFactor(store, config, userId, code) {
+  if (typeof code !== "string") return false;
+  const value = code.trim();
+  if (/^\d{6}$/.test(value)) {
+    const stored = await new UserModel(store).getMfaSecret(userId);
+    if (!stored) return false;
+    return verifyTotpToken(value, makeMfaCipher(config.mfaSecretKey).decrypt(stored));
+  }
+  if (/^[A-Z0-9]{8}$/i.test(value)) {
+    const backupCodes = new BackupCodeModel(store);
+    for (const row of await backupCodes.findUnused(userId)) {
+      if (await verifyPassword(value.toUpperCase(), row.codeHash)) {
+        return backupCodes.consume(row.id);
+      }
+    }
+  }
+  return false;
+}
+
 // src/models/password-reset.model.ts
 var import_node_crypto5 = require("crypto");
 var hashSecret = (value) => (0, import_node_crypto5.createHash)("sha256").update(value).digest("hex");
@@ -1826,7 +1953,7 @@ function extractRefreshToken(ctx) {
   const match = cookie.match(/(?:^|;\s*)refresh_token=([^;]+)/);
   return match?.[1] ?? null;
 }
-function authController(store, config, bus, locales = (0, import_core6.defineLocales)()) {
+function authController(store, config, bus, locales = (0, import_core7.defineLocales)()) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store, config.location);
   const loginEvents = new LoginEventModel(store, config.location);
@@ -1838,23 +1965,24 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
     register: async (ctx) => {
       const body = ctx.meta["body"];
       const { email: email2, password: password2, phone: phone2, firstName = null, lastName = null } = body ?? {};
-      const locale = (0, import_core6.canonicalLocale)(body?.["locale"]) ?? locales.default;
+      const locale = (0, import_core7.canonicalLocale)(body?.["locale"]) ?? locales.default;
       if (typeof email2 === "string" && typeof password2 === "string") {
         const normalizedEmail = normalizeEmailSafe(email2);
         if (!normalizedEmail) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
         }
         if (password2.length < 8) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.UNPROCESSABLE,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.UNPROCESSABLE,
             "INVALID_PARAMETER",
             "password must be at least 8 characters"
           );
         }
         const existing = await users.findByEmail(normalizedEmail);
         if (existing) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Email already registered");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Email already registered");
         }
+        if (await users.findArchivedByEmail(normalizedEmail)) return archivedAddressResponse();
         const passwordHash = await hashPassword(password2);
         const row = await users.create(
           normalizedEmail,
@@ -1864,18 +1992,18 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           locale
         );
         if (!row) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
         const pin = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
         await emailVerif.create(row.id, pin, expiresAt);
         const user = await users.findById(row.id);
         if (!user) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
         const reqId = ctx.meta["requestId"];
         const reqOpts = reqId !== void 0 ? { requestId: reqId } : void 0;
-        await (0, import_core6.background)(bus?.emit(
+        await (0, import_core7.background)(bus?.emit(
           import_events2.NOTIFICATION_EVENT,
           {
             type: MESSAGE_KEYS.emailRegistration,
@@ -1885,7 +2013,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           },
           reqOpts
         ));
-        await (0, import_core6.background)(bus?.emit(
+        await (0, import_core7.background)(bus?.emit(
           EVENT_KEYS.userRegistered,
           {
             userId: user.id,
@@ -1929,8 +2057,9 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       if (isValidPhone(phone2)) {
         const existing = await users.findByPhone(normalizePhone(phone2));
         if (existing) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Phone already registered");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.CONFLICT, "USER_ALREADY_EXISTS", "Phone already registered");
         }
+        if (await users.findArchivedByPhone(normalizePhone(phone2))) return archivedAddressResponse();
         const { id } = await users.findOrCreateByPhone(
           normalizePhone(phone2),
           firstName ?? null,
@@ -1942,11 +2071,11 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         await phoneVerif.upsert(id, normalizePhone(phone2), otp, expiresAt);
         const user = await users.findById(id);
         if (!user) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
         const reqId2 = ctx.meta["requestId"];
         const reqOpts2 = reqId2 !== void 0 ? { requestId: reqId2 } : void 0;
-        await (0, import_core6.background)(bus?.emit(
+        await (0, import_core7.background)(bus?.emit(
           import_events2.NOTIFICATION_EVENT,
           {
             type: MESSAGE_KEYS.phoneOtp,
@@ -1956,7 +2085,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           },
           reqOpts2
         ));
-        await (0, import_core6.background)(bus?.emit(
+        await (0, import_core7.background)(bus?.emit(
           EVENT_KEYS.userRegistered,
           {
             userId: user.id,
@@ -1980,8 +2109,8 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           { status: 202 }
         );
       }
-      return (0, import_core6.setApiResponse)(
-        import_core6.HTTP.UNPROCESSABLE,
+      return (0, import_core7.setApiResponse)(
+        import_core7.HTTP.UNPROCESSABLE,
         "INVALID_PARAMETER",
         "Provide email + password or a valid phone number"
       );
@@ -1993,9 +2122,25 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         const { email: rawEmail, password: password2 } = body;
         const email2 = normalizeEmailSafe(rawEmail);
         if (!email2) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
         }
         const user = await users.findByEmail(email2);
+        if (!user) {
+          const archived = await users.findArchivedByEmail(email2);
+          if (archived?.passwordHash && archived.deletedAt) {
+            const { valid: valid2 } = await verifyPasswordForLogin(password2, archived.passwordHash, config.legacyVerify);
+            await loginEvents.recordSafe({
+              userId: archived.id,
+              emailAttempted: email2,
+              method: "password",
+              outcome: "failed",
+              failureReason: valid2 ? "pending_deletion" : "bad_password",
+              ...meta
+            });
+            if (valid2) return pendingDeletionResponse({ ...archived, deletedAt: archived.deletedAt }, "email", config);
+            return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          }
+        }
         if (!user || !user.passwordHash) {
           await loginEvents.recordSafe({
             userId: null,
@@ -2005,7 +2150,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
             failureReason: "unknown_email",
             ...meta
           });
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         const { valid, needsRehash } = await verifyPasswordForLogin(
           password2,
@@ -2021,21 +2166,21 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
             failureReason: "bad_password",
             ...meta
           });
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         if (needsRehash) {
           await users.updatePassword(user.id, await hashPassword(password2));
         }
         if (user.suspended) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.FORBIDDEN,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.FORBIDDEN,
             "ACCOUNT_SUSPENDED",
             "Account suspended. Please contact support."
           );
         }
         if (user.mfaEnabled) {
           const mfaToken = issueMfaPendingToken(user.id, config, "email");
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "MFA_REQUIRED", "Multi-factor authentication required", {
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "MFA_REQUIRED", "Multi-factor authentication required", {
             mfaToken
           });
         }
@@ -2070,13 +2215,13 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       }
       const phone2 = body?.["phone"];
       if (isValidPhone(phone2)) {
-        const user = await users.findByPhone(normalizePhone(phone2));
+        const user = await users.findByPhone(normalizePhone(phone2)) ?? await users.findArchivedByPhone(normalizePhone(phone2));
         if (!user) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
         if (user.suspended) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.FORBIDDEN,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.FORBIDDEN,
             "ACCOUNT_SUSPENDED",
             "Account suspended. Please contact support."
           );
@@ -2084,7 +2229,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         const otp = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
-        await (0, import_core6.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
+        await (0, import_core7.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneOtp,
           locale: user.locale,
           data: { otp },
@@ -2100,12 +2245,71 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           { status: 202 }
         );
       }
-      return (0, import_core6.setApiResponse)(
-        import_core6.HTTP.UNPROCESSABLE,
+      return (0, import_core7.setApiResponse)(
+        import_core7.HTTP.UNPROCESSABLE,
         "INVALID_PARAMETER",
         "Provide email + password or a valid phone number"
       );
     },
+    /**
+     * "Keep my account": the restoreToken from a sign-in to an archived account
+     * (proof already given: password, Google / Apple, phone code), plus a
+     * second factor when two-factor is on. Un-archives in one statement —
+     * only the SAME archive the proof was for — then signs the person in.
+     */
+    restoreAccount: async (ctx) => {
+      const body = ctx.meta["body"];
+      const proof = verifyRestoreToken(String(body?.["restoreToken"] ?? ""), config);
+      const invalid = () => (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "RESTORE_TOKEN_INVALID", "Sign in again to keep your account.");
+      if (!proof) return invalid();
+      const archived = await users.findArchivedById(proof.sub);
+      if (!archived?.deletedAt || archived.deletedAt.toISOString() !== proof.archivedAt) return invalid();
+      if (archived.suspended) {
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.FORBIDDEN, "ACCOUNT_SUSPENDED", "Account suspended. Please contact support.");
+      }
+      if (archived.mfaEnabled && !await verifySecondFactor(store, config, archived.id, body?.["mfaCode"])) {
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "MFA_REQUIRED", "Enter a code from your authenticator app (or a backup code) to keep your account.");
+      }
+      const [restored] = await store.query(
+        `UPDATE fonderie_users
+				 SET deleted_at = NULL, deletion_channel = NULL, deletion_reminded_at = NULL, updated_at = now()
+				 -- The SAME archive the proof was for. Postgres keeps microseconds,
+				 -- the proof (a JS date) milliseconds: compare at that precision.
+				 WHERE id = $1 AND date_trunc('milliseconds', deleted_at) = date_trunc('milliseconds', $2::timestamptz)
+				 RETURNING (SELECT deletion_channel FROM fonderie_users WHERE id = $1) AS channel`,
+        [archived.id, proof.archivedAt]
+      );
+      if (!restored) return invalid();
+      const meta = requestMeta(ctx);
+      const method = proof.loginMethod === "google" ? "oauth-google" : proof.loginMethod === "apple" ? "oauth-apple" : proof.loginMethod === "phone" ? "phone" : "password";
+      const { accessToken, refreshToken, sid } = issueTokenPair(archived.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
+        loginMethod: proof.loginMethod,
+        phoneVerified: proof.loginMethod === "phone"
+      });
+      await sessions.create(archived.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+      await loginEvents.recordSafe({ userId: archived.id, emailAttempted: archived.email, method, outcome: "success", ...meta });
+      const reqId = ctx.meta["requestId"];
+      await (0, import_core7.background)(bus?.emit(EVENT_KEYS.userRestored, { userId: archived.id }, reqId !== void 0 ? { requestId: reqId } : void 0));
+      const viaSms = restored.channel === "sms" || !archived.email && !!archived.phone;
+      const address = viaSms ? archived.phone : archived.email;
+      if (address) {
+        await (0, import_core7.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
+          type: MESSAGE_KEYS.accountRestored,
+          locale: archived.locale,
+          data: {},
+          recipient: viaSms ? { email: null, phone: address, deviceToken: null } : { email: address, phone: null, deviceToken: null }
+        }));
+      }
+      const user = await users.findById(archived.id);
+      return Response.json(
+        {
+          reason: "ACCOUNT_RESTORED",
+          explanation: "Your account is active again.",
+          result: { tokens: { access: accessToken, refresh: refreshToken }, user: user ? toUserDTO(user) : null }
+        },
+        { status: 200, headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config)) }
+      );
+    },
     logout: async (ctx) => {
       const sid = ctx.user?.sid;
       if (sid) {
@@ -2126,35 +2330,35 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
     refresh: async (ctx) => {
       const token = extractRefreshToken(ctx);
       if (!token) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "INVALID_PARAMETER", "No refresh token provided");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "INVALID_PARAMETER", "No refresh token provided");
       }
       const payload = verifyToken(token, config);
       if (!payload || payload.type !== "refresh") {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Invalid refresh token");
       }
       const runtime = config.resolve?.(ctx);
       let issued = null;
       for (let attempt = 0; attempt < 3 && !issued; attempt++) {
         const found = await sessions.match(token);
         if (found.kind === "unknown") {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
         }
         if (found.kind === "reused") {
           await sessions.revokeById(found.row.id);
-          await (0, import_core6.background)(
+          await (0, import_core7.background)(
             bus?.emit(EVENT_KEYS.sessionRevoked, { userId: found.row.userId, sids: [found.row.sid], reason: "refresh-reuse" })
           );
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
         }
         const resolvedRefresh = configForClient(config, runtime, found.row.clientKind);
         const maxAgeMs = resolvedRefresh.sessionMaxAge ? durationMs(String(resolvedRefresh.sessionMaxAge)) : null;
         if (maxAgeMs !== null && Date.now() - found.row.createdAt.getTime() > maxAgeMs) {
           await sessions.revokeById(found.row.id);
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session reached its maximum age \u2014 sign in again");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session reached its maximum age \u2014 sign in again");
         }
         const user = await users.findById(found.row.userId);
         if (!user || user.suspended || user.deletedAt || user.id !== payload.sub) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
         }
         const pair = issueTokenPair(user.id, resolvedRefresh, {
           loginMethod: payload.loginMethod ?? "email",
@@ -2167,7 +2371,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         if (await sessions.rotate(found.row, token, next, found.kind)) issued = pair;
       }
       if (!issued) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
       }
       const { accessToken, refreshToken } = issued;
       return Response.json(
@@ -2186,16 +2390,16 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       const body = ctx.meta["body"];
       const rawEmail = body?.["email"];
       if (typeof rawEmail !== "string") {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "email is required");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "email is required");
       }
       const email2 = normalizeEmailSafe(rawEmail);
       if (!email2) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid email address");
       }
       const user = await users.findByEmail(email2);
       if (!user) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.OK,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.OK,
           "PASSWORD_RESET_EMAIL_SENT",
           "Password reset email sent (if account exists)."
         );
@@ -2204,8 +2408,8 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
       const remaining = checkCooldown(await passwordReset.findLastSentAt(user.id), cooldown);
       if (remaining > 0) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.OK,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.OK,
           "PASSWORD_RESET_EMAIL_SENT",
           "Password reset email sent (if account exists)."
         );
@@ -2216,14 +2420,14 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       await passwordReset.create(user.id, pin, token, expiresAt);
       const base = resolved.passwordResetUrl;
       const resetUrl = base ? `${base}${base.includes("?") ? "&" : "?"}token=${token}` : "";
-      await (0, import_core6.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
+      await (0, import_core7.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.passwordReset,
         locale: user.locale,
         recipient: { email: email2, phone: null, deviceToken: null },
         data: { pin, token, resetUrl }
       }));
-      return (0, import_core6.setApiResponse)(
-        import_core6.HTTP.OK,
+      return (0, import_core7.setApiResponse)(
+        import_core7.HTTP.OK,
         "PASSWORD_RESET_EMAIL_SENT",
         "Password reset email sent (if account exists)."
       );
@@ -2234,56 +2438,72 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       const password2 = body?.["password"];
       const rawToken = body?.["token"];
       if (typeof password2 !== "string") {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "password is required");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "password is required");
       }
       if (password2.length < 8) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "password must be at least 8 characters"
         );
       }
       let row;
+      let presented;
       if (typeof rawToken === "string" && rawToken.trim().length >= 32) {
-        row = await passwordReset.findByToken(rawToken.trim());
+        presented = rawToken.trim();
+        row = await passwordReset.findByToken(presented);
       } else {
         if (typeof raw !== "string" || !/^\d{6}$/.test(raw.trim())) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.UNPROCESSABLE,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.UNPROCESSABLE,
             "INVALID_PARAMETER",
             "a 6-digit pin or a reset token is required"
           );
         }
-        row = await passwordReset.findByPin(raw.trim());
+        presented = raw.trim();
+        row = await passwordReset.findByPin(presented);
       }
       if (!row || /* @__PURE__ */ new Date() > row.expiresAt) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.BAD_REQUEST,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.BAD_REQUEST,
           "PASSWORD_RESET_FAILED",
           "Invalid or expired reset credentials"
         );
       }
       const passwordHash = await hashPassword(password2);
-      await store.transaction(async (tx) => {
-        await Promise.all([
-          tx.query(`UPDATE fonderie_users SET password_hash = $1 WHERE id = $2`, [
-            passwordHash,
-            row.userId
-          ]),
-          tx.query(`DELETE FROM fonderie_password_resets WHERE user_id = $1`, [row.userId]),
-          // Revoke every session: the reset exists because the account may
-          // be compromised — a stolen session must not survive it.
-          tx.query(`DELETE FROM fonderie_sessions WHERE user_id = $1`, [row.userId])
-        ]);
-      });
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
+      const [changed] = await store.query(
+        `WITH spent AS (
+				   -- The code is spent HERE, and only what this statement spent
+				   -- changes a password: two resets racing with one code \u2014 the
+				   -- second finds it gone and changes nothing.
+				   DELETE FROM fonderie_password_resets
+				   WHERE user_id = $2 AND (pin = $3 OR token = $3) AND expires_at > now()
+				   RETURNING user_id
+				 ), changed AS (
+				   UPDATE fonderie_users SET password_hash = $1, updated_at = now()
+				   WHERE id IN (SELECT user_id FROM spent) AND deleted_at IS NULL
+				   RETURNING id
+				 ), revoked AS (
+				   DELETE FROM fonderie_sessions WHERE user_id IN (SELECT id FROM changed)
+				 )
+				 SELECT id FROM changed`,
+        [passwordHash, row.userId, hashSecret(presented)]
+      );
+      if (!changed) {
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.BAD_REQUEST,
+          "PASSWORD_RESET_FAILED",
+          "Invalid or expired reset credentials"
+        );
+      }
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
     },
     verify: async (ctx) => {
       if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
       }
       if (ctx.user.loginMethod !== "phone" && ctx.user.emailVerifiedAt) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "VERIFIED", "Email verified successfully.", {
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "VERIFIED", "Email verified successfully.", {
           verified: true,
           email: ctx.user.email
         });
@@ -2291,8 +2511,8 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       const body = ctx.meta["body"];
       const raw = body?.["token"];
       if (typeof raw !== "string" || !/^\d{6}$/.test(raw.trim())) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.UNPROCESSABLE,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "token must be a 6-digit code"
         );
@@ -2310,7 +2530,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
             failureReason: "invalid_pin",
             ...phoneMeta
           });
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
         }
         if (/* @__PURE__ */ new Date() > record.expiresAt) {
           await phoneVerif.deleteByUser(ctx.user.id);
@@ -2322,13 +2542,24 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
             failureReason: "expired_pin",
             ...phoneMeta
           });
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.BAD_REQUEST,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.BAD_REQUEST,
             "VERIFICATION_FAILED",
             "Verification code expired"
           );
         }
         await phoneVerif.deleteByUser(ctx.user.id);
+        if (ctx.user.deletedAt) {
+          await loginEvents.recordSafe({
+            userId: ctx.user.id,
+            emailAttempted: null,
+            method: "phone",
+            outcome: "failed",
+            failureReason: "pending_deletion",
+            ...phoneMeta
+          });
+          return pendingDeletionResponse({ ...ctx.user, deletedAt: ctx.user.deletedAt }, "phone", config);
+        }
         const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
           loginMethod: "phone",
           phoneVerified: true
@@ -2343,11 +2574,11 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         });
         const verifiedUser = await users.findById(ctx.user.id);
         if (!verifiedUser) {
-          return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+          return (0, import_core7.setApiResponse)(import_core7.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
         }
         if (verifiedUser.suspended) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.FORBIDDEN,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.FORBIDDEN,
             "ACCOUNT_SUSPENDED",
             "Account suspended. Please contact support."
           );
@@ -2369,10 +2600,10 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       }
       const row = await emailVerif.findByUser(ctx.user.id, pin);
       if (!row) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Invalid or expired pin");
       }
       if (/* @__PURE__ */ new Date() > row.expiresAt) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Pin expired");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "VERIFICATION_FAILED", "Pin expired");
       }
       await store.transaction(async (tx) => {
         await Promise.all([
@@ -2386,30 +2617,30 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
           ])
         ]);
       });
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "VERIFIED", "Email verified successfully.", {
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "VERIFIED", "Email verified successfully.", {
         verified: true,
         email: ctx.user.email
       });
     },
     sendVerification: async (ctx) => {
       if (ctx.user.mfaPending && ctx.user.loginMethod !== "phone") {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.FORBIDDEN, "MFA_REQUIRED", "Complete MFA verification to continue");
       }
       const resolved = { ...config, ...config.resolve?.(ctx) };
       const cooldown = resolved.verificationCooldown ?? DEFAULT_VERIFICATION_COOLDOWN;
       if (ctx.user.loginMethod === "phone") {
         const phone2 = ctx.user.phone;
         if (!phone2) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.BAD_REQUEST,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.BAD_REQUEST,
             "NO_PHONE_ON_ACCOUNT",
             "No phone number associated with this account"
           );
         }
         const remaining2 = checkCooldown(await phoneVerif.findLastSentAt(ctx.user.id), cooldown);
         if (remaining2 > 0) {
-          return (0, import_core6.setApiResponse)(
-            import_core6.HTTP.TOO_MANY_REQUESTS,
+          return (0, import_core7.setApiResponse)(
+            import_core7.HTTP.TOO_MANY_REQUESTS,
             "VERIFICATION_COOLDOWN",
             "Please wait before requesting a new code.",
             {
@@ -2420,35 +2651,35 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         const otp = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
         const expiresAt2 = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
-        await (0, import_core6.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
+        await (0, import_core7.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneOtp,
           locale: ctx.user.locale,
           data: { otp },
           recipient: { email: null, phone: phone2, deviceToken: null }
         }));
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.OK,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.OK,
           "VERIFICATION_SENT",
           "A verification code has been sent to your phone."
         );
       }
       if (!ctx.user.email) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.BAD_REQUEST,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.BAD_REQUEST,
           "NO_EMAIL_ON_ACCOUNT",
           "No email address associated with this account"
         );
       }
       if (ctx.user.emailVerifiedAt) {
-        return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "EMAIL_VERIFIED", "Email already verified.", {
+        return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "EMAIL_VERIFIED", "Email already verified.", {
           verified: true,
           email: ctx.user.email
         });
       }
       const remaining = checkCooldown(await emailVerif.findLastSentAt(ctx.user.id), cooldown);
       if (remaining > 0) {
-        return (0, import_core6.setApiResponse)(
-          import_core6.HTTP.TOO_MANY_REQUESTS,
+        return (0, import_core7.setApiResponse)(
+          import_core7.HTTP.TOO_MANY_REQUESTS,
           "VERIFICATION_COOLDOWN",
           "Please wait before requesting a new code.",
           {
@@ -2459,13 +2690,13 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
       const pin = (0, import_node_crypto6.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
-      await (0, import_core6.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
+      await (0, import_core7.background)(bus?.emit(import_events2.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.emailVerification,
         locale: ctx.user.locale,
         recipient: { email: ctx.user.email, phone: null, deviceToken: null },
         data: { pin }
       }));
-      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "VERIFICATION_SENT", "Verification email sent.", {
+      return (0, import_core7.setApiResponse)(import_core7.HTTP.OK, "VERIFICATION_SENT", "Verification email sent.", {
         email: ctx.user.email
       });
     }
@@ -2473,12 +2704,12 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
 }
 
 // src/controllers/user.controller.ts
-var import_node_crypto7 = require("crypto");
-var import_core8 = require("@fonderie/core");
+var import_node_crypto8 = require("crypto");
+var import_core9 = require("@fonderie/core");
 var import_events3 = require("@fonderie/events");
 
 // src/dtos/login-activity.ts
-var import_core7 = require("@fonderie/core");
+var import_core8 = require("@fonderie/core");
 function toLoginEventDTO(row) {
   return {
     id: row.id,
@@ -2495,10 +2726,10 @@ function toLoginEventDTO(row) {
 }
 function toLoginHistoryPageDTO(page) {
   const last = page.events[page.events.length - 1];
-  const nextCursor = page.hasMore && last ? (0, import_core7.encodeKeysetCursor)(last.createdAtRaw ?? last.createdAt.toISOString(), last.id) : null;
+  const nextCursor = page.hasMore && last ? (0, import_core8.encodeKeysetCursor)(last.createdAtRaw ?? last.createdAt.toISOString(), last.id) : null;
   return { events: page.events.map(toLoginEventDTO), nextCursor };
 }
-var decodeLoginCursor = import_core7.decodeKeysetCursor;
+var decodeLoginCursor = import_core8.decodeKeysetCursor;
 function toSessionDTO(row, currentSid) {
   return {
     id: row.id,
@@ -2512,7 +2743,64 @@ function toSessionDTO(row, currentSid) {
   };
 }
 
+// src/models/account-deletion.model.ts
+var import_node_crypto7 = require("crypto");
+var hashCode = (code) => (0, import_node_crypto7.createHash)("sha256").update(code).digest("hex");
+var DELETION_CODE_MAX_ATTEMPTS = 5;
+var AccountDeletionModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  /** Replace any pending code (a new request supersedes the old one). */
+  async saveCode(userId, code, channel, expiresAt) {
+    await this.store.query(
+      `INSERT INTO fonderie_account_deletion_codes (user_id, code_hash, channel, attempts, expires_at, created_at)
+			 VALUES ($1, $2, $3, 0, $4, now())
+			 ON CONFLICT (user_id) DO UPDATE
+			 SET code_hash = $2, channel = $3, attempts = 0, expires_at = $4, created_at = now()`,
+      [userId, hashCode(code), channel, expiresAt]
+    );
+  }
+  async lastSentAt(userId) {
+    const [row] = await this.store.query(
+      `SELECT created_at AS "createdAt" FROM fonderie_account_deletion_codes WHERE user_id = $1`,
+      [userId]
+    );
+    return row ? new Date(row.createdAt) : null;
+  }
+  /**
+   * Check a code in ONE statement: a wrong code spends an attempt, a right
+   * one is consumed (deleted) — so a code is good once, and a guesser gets
+   * five tries in total however many requests they race.
+   */
+  async checkCode(userId, code) {
+    const [row] = await this.store.query(
+      `WITH current AS (
+			   SELECT user_id, code_hash = $2 AS matched, expires_at <= now() AS expired, attempts, channel
+			   FROM fonderie_account_deletion_codes WHERE user_id = $1
+			   FOR UPDATE
+			 ), spent AS (
+			   DELETE FROM fonderie_account_deletion_codes d USING current c
+			   WHERE d.user_id = c.user_id AND c.matched AND NOT c.expired AND c.attempts < $3
+			 ), missed AS (
+			   UPDATE fonderie_account_deletion_codes d SET attempts = d.attempts + 1
+			   FROM current c
+			   WHERE d.user_id = c.user_id AND NOT (c.matched AND NOT c.expired AND c.attempts < $3)
+			 )
+			 SELECT matched, expired, attempts, channel FROM current`,
+      [userId, hashCode(code), DELETION_CODE_MAX_ATTEMPTS]
+    );
+    if (!row) return { result: "none" };
+    if (row.attempts >= DELETION_CODE_MAX_ATTEMPTS) return { result: "exhausted" };
+    if (row.expired) return { result: "expired" };
+    return { result: row.matched ? "ok" : "invalid", channel: row.channel };
+  }
+};
+
 // src/controllers/user.controller.ts
+var DELETION_CODE_TTL_MS = 15 * 60 * 1e3;
+var DELETION_CODE_COOLDOWN_MS = 60 * 1e3;
 function normalizePhone2(phone2) {
   return phone2.trim().replace(/[\s()\-\.]/g, "");
 }
@@ -2525,13 +2813,62 @@ function userController(store, config, bus) {
   const loginEvents = new LoginEventModel(store, config.location);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
+  const deletions = new AccountDeletionModel(store);
+  const deletionBlocked = async (userId) => {
+    for (const blocker of config.accountDeletion?.blockers ?? []) {
+      const refusal = await blocker(userId);
+      if (refusal) return (0, import_core9.setApiResponse)(import_core9.HTTP.CONFLICT, refusal.reason, refusal.explanation, refusal.details);
+    }
+    return null;
+  };
+  const archive = async (userId, channel) => {
+    const [row] = await store.query(
+      `WITH archived AS (
+			   UPDATE fonderie_users
+			   SET deleted_at = now(), updated_at = now(), deletion_channel = $2, deletion_reminded_at = NULL
+			   WHERE id = $1 AND deleted_at IS NULL
+			   RETURNING id, deleted_at
+			 ), sessions_ended AS (
+			   DELETE FROM fonderie_sessions WHERE user_id = $1
+			 ), resets AS (
+			   DELETE FROM fonderie_password_resets WHERE user_id = $1
+			 ), emails AS (
+			   DELETE FROM fonderie_email_verifications WHERE user_id = $1
+			 ), phones AS (
+			   DELETE FROM fonderie_phone_verifications WHERE user_id = $1
+			 ), codes AS (
+			   DELETE FROM fonderie_account_deletion_codes WHERE user_id = $1
+			 )
+			 SELECT deleted_at AS "deletedAt" FROM archived`,
+      [userId, channel]
+    );
+    return row ? new Date(row.deletedAt) : /* @__PURE__ */ new Date();
+  };
+  const announceArchived = async (ctx, deletedAt) => {
+    const userId = ctx.user.id;
+    const reqId = ctx.meta["requestId"];
+    await (0, import_core9.background)(bus?.emit(
+      EVENT_KEYS.userDeleted,
+      { userId, deletedAt: deletedAt.toISOString(), deleteOn: deletionDate(deletedAt, config).toISOString() },
+      reqId !== void 0 ? { requestId: reqId } : void 0
+    ));
+    await (0, import_core9.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId, sids: null, reason: "account-deleted" }));
+  };
+  const archivedResponse = (deletedAt) => Response.json(
+    {
+      reason: "ACCOUNT_DELETED",
+      explanation: "Account closed. It will be permanently deleted on the date shown; sign in before then to keep it.",
+      result: { requestedAt: deletedAt.toISOString(), deleteOn: deletionDate(deletedAt, config).toISOString() }
+    },
+    { status: 200, headers: cookieHeaders(clearedTokenCookies(config)) }
+  );
   return {
     me: async (ctx) => {
       const user = await users.findById(ctx.user.id);
       if (!user) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       }
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "USER_ACCOUNT_FETCHED", "User account fetched successful.", {
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "USER_ACCOUNT_FETCHED", "User account fetched successful.", {
         user: toUserDTO(user, ctx.user.phoneVerified)
       });
     },
@@ -2542,14 +2879,14 @@ function userController(store, config, bus) {
       const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50;
       const outcomeParam = params.get("outcome");
       if (outcomeParam !== null && outcomeParam !== "success" && outcomeParam !== "failed") {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "outcome must be 'success' or 'failed'");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "outcome must be 'success' or 'failed'");
       }
       const cursorParam = params.get("cursor");
       let cursor = null;
       if (cursorParam) {
         cursor = decodeLoginCursor(cursorParam);
         if (!cursor) {
-          return (0, import_core8.setApiResponse)(import_core8.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
+          return (0, import_core9.setApiResponse)(import_core9.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
         }
       }
       const query = { userId: ctx.user.id, limit };
@@ -2560,8 +2897,8 @@ function userController(store, config, bus) {
       if (from) query.from = new Date(from);
       if (to) query.to = new Date(to);
       const page = await loginEvents.listByUser(query);
-      return (0, import_core8.setApiResponse)(
-        import_core8.HTTP.OK,
+      return (0, import_core9.setApiResponse)(
+        import_core9.HTTP.OK,
         "LOGIN_HISTORY_FETCHED",
         "Login history retrieved.",
         toLoginHistoryPageDTO(page)
@@ -2571,35 +2908,35 @@ function userController(store, config, bus) {
     listSessions: async (ctx) => {
       const rows = await sessions.listLiveByUser(ctx.user.id);
       const currentSid = ctx.user.sid ?? null;
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "SESSIONS_FETCHED", "Active sessions retrieved.", {
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "SESSIONS_FETCHED", "Active sessions retrieved.", {
         sessions: rows.map((r) => toSessionDTO(r, currentSid))
       });
     },
     terminateSession: async (ctx) => {
       const id = ctx.meta["params"]?.["id"];
       if (!id) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
       }
       const removed = await sessions.terminateByIdReturningSid(ctx.user.id, id);
       if (removed === void 0) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
       }
-      await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: [removed], reason: "terminated" }));
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "SESSION_TERMINATED", "Session terminated.", { id });
+      await (0, import_core9.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: [removed], reason: "terminated" }));
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "SESSION_TERMINATED", "Session terminated.", { id });
     },
     terminateOtherSessions: async (ctx) => {
       const currentSid = ctx.user.sid ?? null;
       if (!currentSid) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.UNPROCESSABLE,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.UNPROCESSABLE,
           "NO_CURRENT_SESSION",
           "Cannot terminate others without a current session context"
         );
       }
       const sids = await sessions.terminateOthersReturningSids(ctx.user.id, currentSid);
       const count = sids.length;
-      if (count) await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids, reason: "terminated" }));
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "SESSIONS_TERMINATED", "Other sessions terminated.", { count });
+      if (count) await (0, import_core9.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids, reason: "terminated" }));
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "SESSIONS_TERMINATED", "Other sessions terminated.", { count });
     },
     updateProfile: async (ctx) => {
       const body = ctx.meta["body"];
@@ -2609,18 +2946,18 @@ function userController(store, config, bus) {
         if (body?.[key] !== void 0) fields[key] = body[key];
       }
       if (Object.keys(fields).length === 0) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.UNPROCESSABLE,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Provide at least one of: firstName, lastName, avatarUrl"
         );
       }
       const row = await users.update(ctx.user.id, fields);
       if (!row) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       }
       const updated = await users.findById(ctx.user.id);
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "PROFILE_UPDATED", "Profile updated.", {
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "PROFILE_UPDATED", "Profile updated.", {
         user: toUserDTO(updated, ctx.user.phoneVerified)
       });
     },
@@ -2637,14 +2974,14 @@ function userController(store, config, bus) {
       if (Object.keys(patch).length > 0) fields.patch = patch;
       const row = await users.updatePreferences(ctx.user.id, fields);
       if (!row) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.UNPROCESSABLE,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Provide at least one preference field"
         );
       }
       const updated = await users.findById(ctx.user.id);
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "PREFERENCES_UPDATED", "Preferences updated.", {
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "PREFERENCES_UPDATED", "Preferences updated.", {
         user: toUserDTO(updated, ctx.user.phoneVerified)
       });
     },
@@ -2653,44 +2990,44 @@ function userController(store, config, bus) {
       const newEmail = body?.["email"];
       const normalised = typeof newEmail === "string" ? normalizeEmailSafe(newEmail) : null;
       if (!normalised) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.UNPROCESSABLE,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "A valid email address is required"
         );
       }
       const oldEmail = ctx.user.email;
       if (normalised === oldEmail) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.UNPROCESSABLE,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "New email must differ from current email"
         );
       }
       const existing = await users.findByEmail(normalised);
       if (existing) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
       }
-      const pin = (0, import_node_crypto7.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto8.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       await users.updateEmail(ctx.user.id, normalised);
-      await (0, import_core8.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+      await (0, import_core9.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.emailVerification,
         locale: ctx.user.locale,
         data: { pin },
         recipient: { email: normalised, phone: null, deviceToken: null }
       }));
       if (oldEmail) {
-        await (0, import_core8.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+        await (0, import_core9.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.emailChanged,
           locale: ctx.user.locale,
           data: { newEmail: normalised },
           recipient: { email: oldEmail, phone: null, deviceToken: null }
         }));
       }
-      return (0, import_core8.setApiResponse)(
-        import_core8.HTTP.OK,
+      return (0, import_core9.setApiResponse)(
+        import_core9.HTTP.OK,
         "EMAIL_UPDATED",
         "Email updated. A verification code has been sent to your new address.",
         {
@@ -2702,8 +3039,8 @@ function userController(store, config, bus) {
       const body = ctx.meta["body"];
       const newPhone = body?.["phone"];
       if (!isValidPhone2(newPhone)) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.UNPROCESSABLE,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "A valid phone number is required"
         );
@@ -2711,28 +3048,28 @@ function userController(store, config, bus) {
       const normalised = normalizePhone2(newPhone);
       const existing = await users.findByPhone(normalised);
       if (existing) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
       }
-      const otp = (0, import_node_crypto7.randomInt)(1e5, 1e6).toString();
+      const otp = (0, import_node_crypto8.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
       await phoneVerif.upsert(ctx.user.id, normalised, otp, expiresAt);
       await users.updatePhone(ctx.user.id, normalised);
-      await (0, import_core8.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+      await (0, import_core9.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
         type: MESSAGE_KEYS.phoneOtp,
         locale: ctx.user.locale,
         data: { otp },
         recipient: { email: null, phone: normalised, deviceToken: null }
       }));
       if (ctx.user.email) {
-        await (0, import_core8.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+        await (0, import_core9.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.phoneChanged,
           locale: ctx.user.locale,
           data: {},
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }));
       }
-      return (0, import_core8.setApiResponse)(
-        import_core8.HTTP.OK,
+      return (0, import_core9.setApiResponse)(
+        import_core9.HTTP.OK,
         "PHONE_UPDATED",
         "Phone number updated. A verification code has been sent to your new number.",
         {
@@ -2745,23 +3082,23 @@ function userController(store, config, bus) {
       const currentPassword = body?.["currentPassword"];
       const newPassword = body?.["newPassword"];
       if (typeof currentPassword !== "string" || !currentPassword) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "currentPassword is required");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "currentPassword is required");
       }
       if (typeof newPassword !== "string" || newPassword.length < 8) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "newPassword must be at least 8 characters");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "newPassword must be at least 8 characters");
       }
       const user = await users.findById(ctx.user.id);
-      if (!user) return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      if (!user) return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       const { hashPassword: hashPassword2, verifyPassword: verifyPassword2 } = await Promise.resolve().then(() => (init_password(), password_exports));
       const valid = await verifyPassword2(currentPassword, user.passwordHash ?? "");
       if (!valid) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.UNPROCESSABLE, "INVALID_CREDENTIAL", "Current password is incorrect");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNPROCESSABLE, "INVALID_CREDENTIAL", "Current password is incorrect");
       }
       const hash = await hashPassword2(newPassword);
       await users.updatePassword(ctx.user.id, hash);
       await sessions.deleteByUser(ctx.user.id);
-      await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: null, reason: "password-changed" }));
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
+      await (0, import_core9.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: null, reason: "password-changed" }));
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
     /**
      * Remove an OAuth provider from the account.
@@ -2780,58 +3117,129 @@ function userController(store, config, bus) {
       const provider = String(ctx.meta["params"]?.["provider"] ?? "");
       const current = await users.findById(ctx.user.id);
       if (!current?.provider) {
-        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_LINKED", "No sign-in provider is linked.");
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_LINKED", "No sign-in provider is linked.");
       }
       if (provider && provider.toLowerCase() !== current.provider.toLowerCase()) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.NOT_FOUND,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.NOT_FOUND,
           "NOT_LINKED",
           `This account is not linked to ${provider}.`
         );
       }
       const removed = await users.clearProvider(ctx.user.id);
       if (!removed) {
-        return (0, import_core8.setApiResponse)(
-          import_core8.HTTP.CONFLICT,
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.CONFLICT,
           "PASSWORD_REQUIRED",
           "Set a password before disconnecting this provider \u2014 it is currently the only way to sign in."
         );
       }
       if (ctx.user.email) {
-        await (0, import_core8.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+        await (0, import_core9.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
           type: MESSAGE_KEYS.oauthUnlinked,
           locale: ctx.user.locale,
           data: { provider: current.provider },
           recipient: { email: ctx.user.email, phone: null, deviceToken: null }
         }));
       }
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "OAUTH_UNLINKED", "Sign-in provider removed.");
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "OAUTH_UNLINKED", "Sign-in provider removed.");
     },
+    // Legacy one-call deletion (no code). Kept so existing apps keep working;
+    // apps move to POST /users/me/deletion + /confirm (proof + notices).
     deleteMe: async (ctx) => {
-      const userId = ctx.user.id;
-      await users.softDelete(userId);
-      await sessions.deleteByUser(userId);
-      const reqId = ctx.meta["requestId"];
-      await (0, import_core8.background)(bus?.emit(
-        EVENT_KEYS.userDeleted,
-        { userId },
-        reqId !== void 0 ? { requestId: reqId } : void 0
-      ));
-      await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId, sids: null, reason: "account-deleted" }));
-      return Response.json(
-        { reason: "ACCOUNT_DELETED", explanation: "Account successfully deleted." },
-        {
-          status: 200,
-          headers: cookieHeaders(clearedTokenCookies(config))
-        }
-      );
+      const deletedAt = await archive(ctx.user.id, null);
+      await announceArchived(ctx, deletedAt);
+      return archivedResponse(deletedAt);
+    },
+    /**
+     * Step 1 of deleting an account: a 6-digit code to the channel the person
+     * picks ('email' | 'sms' — an address on the account; receiving the code
+     * proves they hold it). Refused while a blocker objects (e.g. they own a
+     * team with other members — transfer it first).
+     */
+    requestDeletion: async (ctx) => {
+      const user = ctx.user;
+      const body = ctx.meta["body"];
+      const channel = body?.["channel"] === "sms" ? "sms" : body?.["channel"] === "email" ? "email" : null;
+      if (!channel) {
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "channel must be 'email' or 'sms'");
+      }
+      const address = channel === "email" ? user.email : user.phone;
+      if (!address) {
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.UNPROCESSABLE,
+          channel === "email" ? "NO_EMAIL_ON_ACCOUNT" : "NO_PHONE_ON_ACCOUNT",
+          `There is no ${channel === "email" ? "email address" : "phone number"} on this account to send the code to.`
+        );
+      }
+      const refused = await deletionBlocked(user.id);
+      if (refused) return refused;
+      const remainingMs = checkCooldown(await deletions.lastSentAt(user.id), DELETION_CODE_COOLDOWN_MS);
+      if (remainingMs > 0) {
+        const retryAfter = Math.ceil(remainingMs / 1e3);
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.TOO_MANY_REQUESTS, "VERIFICATION_COOLDOWN", `Wait ${retryAfter}s before requesting a new code.`, { retryAfter });
+      }
+      const code = (0, import_node_crypto8.randomInt)(1e5, 1e6).toString();
+      await deletions.saveCode(user.id, code, channel, new Date(Date.now() + DELETION_CODE_TTL_MS));
+      await (0, import_core9.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+        type: MESSAGE_KEYS.accountDeletionCode,
+        locale: user.locale,
+        data: { code },
+        recipient: channel === "email" ? { email: address, phone: null, deviceToken: null } : { email: null, phone: address, deviceToken: null }
+      }));
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.ACCEPTED, "ACCOUNT_DELETION_CODE_SENT", "A code to confirm the deletion was sent.", {
+        channel,
+        expiresInSeconds: DELETION_CODE_TTL_MS / 1e3,
+        mfaRequired: user.mfaEnabled === true
+      });
+    },
+    /**
+     * Step 2: the code (and, with two-factor on, a second factor) archives the
+     * account — closed at once, restorable at sign-in until the purge date.
+     */
+    confirmDeletion: async (ctx) => {
+      const user = ctx.user;
+      const body = ctx.meta["body"];
+      const code = typeof body?.["code"] === "string" ? body["code"].trim() : "";
+      if (!/^\d{6}$/.test(code)) {
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "code must be the 6-digit code that was sent");
+      }
+      const refused = await deletionBlocked(user.id);
+      if (refused) return refused;
+      if (user.mfaEnabled && !await verifySecondFactor(store, config, user.id, body?.["mfaCode"])) {
+        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNAUTHORIZED, "MFA_REQUIRED", "Enter a code from your authenticator app (or a backup code) to confirm.");
+      }
+      const checked = await deletions.checkCode(user.id, code);
+      if (checked.result !== "ok") {
+        return (0, import_core9.setApiResponse)(
+          import_core9.HTTP.BAD_REQUEST,
+          "VERIFICATION_FAILED",
+          checked.result === "exhausted" || checked.result === "none" || checked.result === "expired" ? "This code can no longer be used. Request a new one." : "That code is incorrect."
+        );
+      }
+      const deletedAt = await archive(user.id, checked.channel ?? null);
+      await announceArchived(ctx, deletedAt);
+      const deleteOn = deletionDate(deletedAt, config);
+      const address = checked.channel === "sms" ? user.phone : user.email;
+      if (address) {
+        await (0, import_core9.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+          type: MESSAGE_KEYS.accountDeletionScheduled,
+          locale: user.locale,
+          data: {
+            deleteOn: deleteOn.toISOString().slice(0, 10),
+            [import_core9.COURIER_FORMAT_KEY]: { deleteOn: { date: deleteOn.toISOString(), style: "long" } }
+          },
+          recipient: checked.channel === "sms" ? { email: null, phone: address, deviceToken: null } : { email: address, phone: null, deviceToken: null }
+        }));
+      }
+      return archivedResponse(deletedAt);
     },
     // Subject Access Request — the authenticated user's own data as a portable
     // JSON bundle. Only auth-owned data, and only safe fields: no password hash,
     // no MFA secret, no session tokens (session metadata only).
     exportMe: async (ctx) => {
       const user = await users.findById(ctx.user.id);
-      if (!user) return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      if (!user) return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
       const sessionRows = await sessions.listByUser(ctx.user.id);
       const bundle = {
         exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2840,8 +3248,8 @@ function userController(store, config, bus) {
           id: s.id,
           userAgent: s.userAgent,
           ipAddress: s.ipAddress,
-          createdAt: (0, import_core8.dateOrEmpty)(s.createdAt),
-          expiresAt: (0, import_core8.dateOrEmpty)(s.expiresAt)
+          createdAt: (0, import_core9.dateOrEmpty)(s.createdAt),
+          expiresAt: (0, import_core9.dateOrEmpty)(s.expiresAt)
         })),
         security: {
           mfaEnabled: user.mfaEnabled === true,
@@ -2860,19 +3268,19 @@ function userController(store, config, bus) {
         }
         bundle["modules"] = modules;
       }
-      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "DATA_EXPORT", "Your account data.", bundle);
+      return (0, import_core9.setApiResponse)(import_core9.HTTP.OK, "DATA_EXPORT", "Your account data.", bundle);
     }
   };
 }
 
 // src/controllers/oauth.controller.ts
-var import_node_crypto9 = require("crypto");
-var import_jsonwebtoken2 = __toESM(require("jsonwebtoken"), 1);
-var import_core9 = require("@fonderie/core");
+var import_node_crypto10 = require("crypto");
+var import_jsonwebtoken3 = __toESM(require("jsonwebtoken"), 1);
+var import_core10 = require("@fonderie/core");
 var import_events4 = require("@fonderie/events");
 
 // src/services/jwks.ts
-var import_node_crypto8 = require("crypto");
+var import_node_crypto9 = require("crypto");
 var TTL_MS = 60 * 60 * 1e3;
 var MIN_REFETCH_MS = 60 * 1e3;
 var FETCH_TIMEOUT_MS = 5e3;
@@ -2906,7 +3314,7 @@ function createJwksSource(url) {
       }
       if (!jwk) return null;
       try {
-        return (0, import_node_crypto8.createPublicKey)({ key: jwk, format: "jwk" });
+        return (0, import_node_crypto9.createPublicKey)({ key: jwk, format: "jwk" });
       } catch {
         return null;
       }
@@ -2952,7 +3360,7 @@ var APPLE_KEYS_URL = "https://appleid.apple.com/auth/keys";
 var APPLE_ISSUER = "https://appleid.apple.com";
 function mintAppleClientSecret(apple) {
   const now = Math.floor(Date.now() / 1e3);
-  return import_jsonwebtoken2.default.sign(
+  return import_jsonwebtoken3.default.sign(
     { iss: apple.teamId, iat: now, exp: now + 300, aud: APPLE_ISSUER, sub: apple.clientId },
     apple.privateKey,
     { algorithm: "ES256", keyid: apple.keyId }
@@ -2961,14 +3369,14 @@ function mintAppleClientSecret(apple) {
 var appleKeys = createJwksSource(APPLE_KEYS_URL);
 async function verifyAppleIdToken(idToken, opts) {
   if (opts.audiences.length === 0) return null;
-  const decoded = import_jsonwebtoken2.default.decode(idToken, { complete: true });
+  const decoded = import_jsonwebtoken3.default.decode(idToken, { complete: true });
   if (!decoded || typeof decoded === "string") return null;
   const kid = decoded.header.kid;
   if (!kid) return null;
   const key = await appleKeys.getKey(kid);
   if (!key) return null;
   try {
-    const payload = import_jsonwebtoken2.default.verify(idToken, key, {
+    const payload = import_jsonwebtoken3.default.verify(idToken, key, {
       algorithms: ["RS256"],
       issuer: APPLE_ISSUER,
       // jsonwebtoken types `audience` as a non-empty tuple; runtime accepts a
@@ -2988,14 +3396,14 @@ var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
 var googleKeys = createJwksSource(GOOGLE_KEYS_URL);
 async function verifyGoogleIdToken(idToken, opts) {
   if (opts.audiences.length === 0) return null;
-  const decoded = import_jsonwebtoken2.default.decode(idToken, { complete: true });
+  const decoded = import_jsonwebtoken3.default.decode(idToken, { complete: true });
   if (!decoded || typeof decoded === "string") return null;
   const kid = decoded.header.kid;
   if (!kid) return null;
   const key = await googleKeys.getKey(kid);
   if (!key) return null;
   try {
-    const payload = import_jsonwebtoken2.default.verify(idToken, key, {
+    const payload = import_jsonwebtoken3.default.verify(idToken, key, {
       algorithms: ["RS256"],
       issuer: [...GOOGLE_ISSUERS],
       audience: opts.audiences
@@ -3019,7 +3427,7 @@ function oauthController(store, config, bus) {
     const label = provider.charAt(0).toUpperCase() + provider.slice(1);
     const recipient = { email: user.email, phone: null, deviceToken: null };
     if (upserted.clearedUnverifiedPassword && user.email) {
-      await (0, import_core9.background)(bus.emit(
+      await (0, import_core10.background)(bus.emit(
         import_events4.NOTIFICATION_EVENT,
         {
           type: MESSAGE_KEYS.passwordRevoked,
@@ -3031,7 +3439,7 @@ function oauthController(store, config, bus) {
       ));
     }
     if (upserted.inserted) {
-      await (0, import_core9.background)(bus.emit(
+      await (0, import_core10.background)(bus.emit(
         EVENT_KEYS.userRegistered,
         {
           userId: upserted.id,
@@ -3043,7 +3451,7 @@ function oauthController(store, config, bus) {
         reqOpts
       ));
       if (user.email) {
-        await (0, import_core9.background)(bus.emit(
+        await (0, import_core10.background)(bus.emit(
           import_events4.NOTIFICATION_EVENT,
           {
             type: MESSAGE_KEYS.oauthRegistration,
@@ -3057,7 +3465,7 @@ function oauthController(store, config, bus) {
       return;
     }
     if (upserted.previousProvider !== provider && user.email) {
-      await (0, import_core9.background)(bus.emit(
+      await (0, import_core10.background)(bus.emit(
         import_events4.NOTIFICATION_EVENT,
         {
           type: MESSAGE_KEYS.oauthLinked,
@@ -3078,14 +3486,29 @@ function oauthController(store, config, bus) {
     const method = provider === "apple" ? "oauth-apple" : "oauth-google";
     const meta = requestMeta(ctx);
     if (!claims.email) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, p.failed, `No email in ${p.label} identity token`);
+      return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, p.failed, `No email in ${p.label} identity token`);
     }
     if (!claims.emailVerified) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, p.failed, `${p.label} account email is not verified`);
+      return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, p.failed, `${p.label} account email is not verified`);
     }
     const normalizedEmail = normalizeEmailSafe(claims.email);
     if (!normalizedEmail) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, p.failed, `Invalid email in ${p.label} identity token`);
+      return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, p.failed, `Invalid email in ${p.label} identity token`);
+    }
+    const archived = await users.findArchivedByEmail(normalizedEmail);
+    if (archived?.deletedAt) {
+      await loginEvents.recordSafe({
+        userId: archived.id,
+        emailAttempted: normalizedEmail,
+        method,
+        outcome: "failed",
+        failureReason: "pending_deletion",
+        ...meta
+      });
+      const res = pendingDeletionResponse({ ...archived, deletedAt: archived.deletedAt }, provider, config);
+      const headers = cookieHeaders(clearCookies);
+      headers.set("content-type", res.headers.get("content-type") ?? "application/json");
+      return new Response(res.body, { status: res.status, headers });
     }
     const upserted = await users.upsertByProvider(normalizedEmail, provider, claims.sub ?? "");
     if (!upserted) {
@@ -3097,15 +3520,15 @@ function oauthController(store, config, bus) {
         failureReason: "provider_upsert_failed",
         ...meta
       });
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
+      return (0, import_core10.setApiResponse)(import_core10.HTTP.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
     }
     const fullUser = await users.findById(upserted.id);
     if (!fullUser) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
+      return (0, import_core10.setApiResponse)(import_core10.HTTP.SERVER_ERROR, "SERVER_ERROR", `${p.label} login failed`);
     }
     await announceOAuthUpsert(ctx, upserted, provider, fullUser);
     if (fullUser.suspended) {
-      return (0, import_core9.setApiResponse)(import_core9.HTTP.FORBIDDEN, "ACCOUNT_SUSPENDED", "Account suspended. Please contact support.");
+      return (0, import_core10.setApiResponse)(import_core10.HTTP.FORBIDDEN, "ACCOUNT_SUSPENDED", "Account suspended. Please contact support.");
     }
     if (fullUser.mfaEnabled) {
       const mfaToken = issueMfaPendingToken(upserted.id, config, provider);
@@ -3148,13 +3571,13 @@ function oauthController(store, config, bus) {
     googleInit: async (_ctx) => {
       const google = config.google;
       if (!google || !google.clientSecret || !google.redirectUri) {
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.NOT_IMPLEMENTED,
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
           "Google OAuth not configured"
         );
       }
-      const state = (0, import_node_crypto9.randomBytes)(16).toString("hex");
+      const state = (0, import_node_crypto10.randomBytes)(16).toString("hex");
       const params = new URLSearchParams({
         client_id: google.clientId,
         redirect_uri: google.redirectUri,
@@ -3183,8 +3606,8 @@ function oauthController(store, config, bus) {
     googleCallback: async (ctx) => {
       const google = config.google;
       if (!google || !google.clientSecret || !google.redirectUri) {
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.NOT_IMPLEMENTED,
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.NOT_IMPLEMENTED,
           "NOT_CONFIGURED",
           "Google OAuth not configured"
         );
@@ -3192,14 +3615,14 @@ function oauthController(store, config, bus) {
       const url = new URL(ctx.request.url);
       const code = url.searchParams.get("code");
       if (!code) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
       }
       const returnedState = url.searchParams.get("state") ?? "";
       const cookieHeader = ctx.request.headers.get("cookie") ?? "";
       const expectedState = cookieHeader.match(/(?:^|;\s*)oauth_state=([^;]+)/)?.[1] ?? "";
-      if (!returnedState || !expectedState || !(0, import_core9.constantTimeEqual)(Buffer.from(returnedState), Buffer.from(expectedState))) {
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.BAD_REQUEST,
+      if (!returnedState || !expectedState || !(0, import_core10.constantTimeEqual)(Buffer.from(returnedState), Buffer.from(expectedState))) {
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.BAD_REQUEST,
           "GOOGLE_AUTH_FAILED",
           "OAuth state mismatch \u2014 restart the sign-in flow"
         );
@@ -3217,8 +3640,8 @@ function oauthController(store, config, bus) {
       });
       const tokenData = await tokenRes.json();
       if (!tokenData.id_token) {
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.BAD_REQUEST,
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.BAD_REQUEST,
           "GOOGLE_AUTH_FAILED",
           "OAuth token exchange failed"
         );
@@ -3227,20 +3650,20 @@ function oauthController(store, config, bus) {
         Buffer.from(tokenData.id_token.split(".")[1] ?? "", "base64url").toString()
       );
       if (payload.aud !== google.clientId) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token audience mismatch");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token audience mismatch");
       }
       if (payload.iss !== "https://accounts.google.com" && payload.iss !== "accounts.google.com") {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token issuer mismatch");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token issuer mismatch");
       }
       if (typeof payload.exp !== "number" || payload.exp * 1e3 < Date.now()) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token expired");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token expired");
       }
       if (!payload.email) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
       }
       if (payload.email_verified !== true) {
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.BAD_REQUEST,
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.BAD_REQUEST,
           "GOOGLE_AUTH_FAILED",
           "Google account email is not verified"
         );
@@ -3254,9 +3677,9 @@ function oauthController(store, config, bus) {
     appleInit: async (_ctx) => {
       const apple = config.apple;
       if (!apple) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
       }
-      const state = (0, import_node_crypto9.randomBytes)(16).toString("hex");
+      const state = (0, import_node_crypto10.randomBytes)(16).toString("hex");
       const params = new URLSearchParams({
         client_id: apple.clientId,
         redirect_uri: apple.redirectUri,
@@ -3285,20 +3708,20 @@ function oauthController(store, config, bus) {
     appleCallback: async (ctx) => {
       const apple = config.apple;
       if (!apple) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
       }
       const pre = ctx.meta["body"];
       const form = pre && typeof pre === "object" ? new URLSearchParams(pre) : new URLSearchParams(await ctx.request.text());
       const code = form.get("code");
       if (!code) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
       }
       const returnedState = form.get("state") ?? "";
       const cookieHeader = ctx.request.headers.get("cookie") ?? "";
       const expectedState = cookieHeader.match(/(?:^|;\s*)oauth_state=([^;]+)/)?.[1] ?? "";
-      if (!returnedState || !expectedState || !(0, import_core9.constantTimeEqual)(Buffer.from(returnedState), Buffer.from(expectedState))) {
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.BAD_REQUEST,
+      if (!returnedState || !expectedState || !(0, import_core10.constantTimeEqual)(Buffer.from(returnedState), Buffer.from(expectedState))) {
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.BAD_REQUEST,
           "APPLE_AUTH_FAILED",
           "OAuth state mismatch \u2014 restart the sign-in flow"
         );
@@ -3316,11 +3739,11 @@ function oauthController(store, config, bus) {
       });
       const tokenData = await tokenRes.json();
       if (!tokenData.id_token) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "OAuth token exchange failed");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "OAuth token exchange failed");
       }
       const claims = await verifyAppleIdToken(tokenData.id_token, { audiences: [apple.clientId] });
       if (!claims) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
       }
       return completeOAuthLogin(ctx, "apple", {
         email: claims.email,
@@ -3331,12 +3754,12 @@ function oauthController(store, config, bus) {
     appleNative: async (ctx) => {
       const apple = config.apple;
       if (!apple) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
       }
       const body = ctx.meta["body"];
       const identityToken = body?.identityToken;
       if (!identityToken) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing identityToken");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing identityToken");
       }
       const audiences = apple.nativeClientIds && apple.nativeClientIds.length ? apple.nativeClientIds : [apple.clientId];
       const claims = await verifyAppleIdToken(identityToken, { audiences, nonce: body?.nonce });
@@ -3350,9 +3773,9 @@ function oauthController(store, config, bus) {
           failureReason: "invalid_identity_token",
           ...meta
         });
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNAUTHORIZED, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.UNAUTHORIZED, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
       }
-      const tokenHash = (0, import_node_crypto9.createHash)("sha256").update(identityToken).digest("hex");
+      const tokenHash = (0, import_node_crypto10.createHash)("sha256").update(identityToken).digest("hex");
       const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
       const firstUse = await consumedTokens.consumeOnce(tokenHash, new Date(expMs));
       if (!firstUse) {
@@ -3365,8 +3788,8 @@ function oauthController(store, config, bus) {
           failureReason: "token_replayed",
           ...meta
         });
-        return (0, import_core9.setApiResponse)(
-          import_core9.HTTP.UNAUTHORIZED,
+        return (0, import_core10.setApiResponse)(
+          import_core10.HTTP.UNAUTHORIZED,
           "APPLE_AUTH_FAILED",
           "This Apple identity token has already been used"
         );
@@ -3383,12 +3806,12 @@ function oauthController(store, config, bus) {
     googleNative: async (ctx) => {
       const audiences = config.google?.nativeClientIds ?? [];
       if (!config.google || audiences.length === 0) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Native Google sign-in not configured");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Native Google sign-in not configured");
       }
       const body = ctx.meta["body"];
       const idToken = body?.idToken;
       if (!idToken) {
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing idToken");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.BAD_REQUEST, "INVALID_PARAMETER", "Missing idToken");
       }
       const claims = await verifyGoogleIdToken(idToken, { audiences, nonce: body?.nonce });
       if (!claims) {
@@ -3400,9 +3823,9 @@ function oauthController(store, config, bus) {
           failureReason: "invalid_identity_token",
           ...requestMeta(ctx)
         });
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "Invalid Google ID token");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "Invalid Google ID token");
       }
-      const tokenHash = (0, import_node_crypto9.createHash)("sha256").update(idToken).digest("hex");
+      const tokenHash = (0, import_node_crypto10.createHash)("sha256").update(idToken).digest("hex");
       const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
       if (!await consumedTokens.consumeOnce(tokenHash, new Date(expMs))) {
         await loginEvents.recordSafe({
@@ -3413,7 +3836,7 @@ function oauthController(store, config, bus) {
           failureReason: "token_replayed",
           ...requestMeta(ctx)
         });
-        return (0, import_core9.setApiResponse)(import_core9.HTTP.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "This Google ID token has already been used");
+        return (0, import_core10.setApiResponse)(import_core10.HTTP.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "This Google ID token has already been used");
       }
       consumedTokens.sweepExpiredSafe();
       return completeOAuthLogin(ctx, "google", {
@@ -3459,7 +3882,7 @@ function buildAuthRoutes(store, config, bus, locales) {
       "providers",
       "GET",
       "/auth/providers",
-      async () => (0, import_core10.setApiResponse)(import_core10.HTTP.OK, "AUTH_PROVIDERS", "Sign-in methods available here", {
+      async () => (0, import_core11.setApiResponse)(import_core11.HTTP.OK, "AUTH_PROVIDERS", "Sign-in methods available here", {
         providers: [...config.providers]
       })
     ),
@@ -3491,6 +3914,11 @@ function buildAuthRoutes(store, config, bus, locales) {
     // refuses when it would leave the account with no way to sign in.
     R("unlinkOauth", "DELETE", "/auth/oauth/:provider", import_middlewares2.requireAuth, user.unlinkOauth),
     R("deleteMe", "DELETE", "/users", import_middlewares2.requireAuth, verifyGate, user.deleteMe),
+    // Deleting with proof: a code to a chosen channel, then confirm. The
+    // account is archived until the purge; signing in offers to keep it.
+    R("requestDeletion", "POST", "/users/me/deletion", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(requestDeletionSchema), user.requestDeletion),
+    R("confirmDeletion", "POST", "/users/me/deletion/confirm", ipLimit("verify"), import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(confirmDeletionSchema), user.confirmDeletion),
+    R("restoreAccount", "POST", "/auth/account/restore", ipLimit("login"), (0, import_middlewares.validate)(restoreAccountSchema), auth.restoreAccount),
     R("exportMe", "GET", "/users/export", import_middlewares2.requireAuth, user.exportMe),
     // Security surfaces (Protected; the caller's own login history + sessions).
     // The literal /others route is registered before /:id so it isn't
@@ -3534,20 +3962,20 @@ function buildAuthRoutes(store, config, bus, locales) {
 }
 
 // src/services/config-guard.ts
-var import_core11 = require("@fonderie/core");
+var import_core12 = require("@fonderie/core");
 var MODULE = "@fonderie/auth";
 function collectAuthConfigProblems(config) {
   const problems = [];
   const secret = config.jwtSecret ?? "";
-  const secretProblem = (0, import_core11.secretStrengthProblem)(secret);
+  const secretProblem = (0, import_core12.secretStrengthProblem)(secret);
   if (secretProblem === "too-short") {
     problems.push({
       module: MODULE,
       severity: "error",
-      message: `jwtSecret must be at least ${import_core11.MIN_SECRET_LENGTH} characters (got ${secret.length})`,
+      message: `jwtSecret must be at least ${import_core12.MIN_SECRET_LENGTH} characters (got ${secret.length})`,
       domain: "auth",
       reason: "JWT_SECRET_TOO_SHORT",
-      metadata: { min: import_core11.MIN_SECRET_LENGTH, got: secret.length }
+      metadata: { min: import_core12.MIN_SECRET_LENGTH, got: secret.length }
     });
   } else if (secretProblem === "placeholder") {
     problems.push({
@@ -3559,7 +3987,7 @@ function collectAuthConfigProblems(config) {
     });
   }
   (config.jwtPreviousSecrets ?? []).forEach((previous, index) => {
-    if ((0, import_core11.secretStrengthProblem)(previous ?? "")) {
+    if ((0, import_core12.secretStrengthProblem)(previous ?? "")) {
       problems.push({
         module: MODULE,
         severity: "error",
@@ -3592,7 +4020,7 @@ function collectAuthConfigProblems(config) {
         domain: "auth",
         reason: "GOOGLE_INCOMPLETE"
       });
-    } else if (clientSecret && import_core11.PLACEHOLDER_SECRET.test(clientSecret)) {
+    } else if (clientSecret && import_core12.PLACEHOLDER_SECRET.test(clientSecret)) {
       problems.push({
         module: MODULE,
         severity: "error",
@@ -3694,8 +4122,11 @@ function withSession(store, config) {
     if (payload.sid && !await sessions.aliveBySid(payload.sid)) {
       return next();
     }
-    const user = await users.findById(payload.sub);
-    if (!user || user.suspended || user.deletedAt) {
+    let user = await users.findById(payload.sub);
+    if (!user && payload.mfaPending && payload.loginMethod === "phone") {
+      user = await users.findArchivedById(payload.sub);
+    }
+    if (!user || user.suspended || user.deletedAt && !payload.mfaPending) {
       return next();
     }
     Object.assign(ctx, {
@@ -3723,8 +4154,8 @@ function extractToken(request) {
 }
 
 // src/admin.ts
-var import_core12 = require("@fonderie/core");
 var import_core13 = require("@fonderie/core");
+var import_core14 = require("@fonderie/core");
 function toAdminUserDTO(user) {
   return {
     ...toUserDTO(user),
@@ -3735,12 +4166,12 @@ function toAdminUserDTO(user) {
 }
 function toAdminUserPageDTO(page) {
   const last = page.users[page.users.length - 1];
-  const nextCursor = page.hasMore && last ? (0, import_core12.encodeKeysetCursor)(last.createdAtRaw ?? last.createdAt.toISOString(), last.id) : null;
+  const nextCursor = page.hasMore && last ? (0, import_core13.encodeKeysetCursor)(last.createdAtRaw ?? last.createdAt.toISOString(), last.id) : null;
   return { users: page.users.map(toAdminUserDTO), nextCursor };
 }
 var ADMIN_PREFIX = "/_admin";
 var idOf = (ctx) => ctx.meta.params?.["id"] ?? "";
-var NOT_FOUND = () => (0, import_core12.setApiResponse)(import_core12.HTTP.NOT_FOUND, "NOT_FOUND", "No such user");
+var NOT_FOUND = () => (0, import_core13.setApiResponse)(import_core13.HTTP.NOT_FOUND, "NOT_FOUND", "No such user");
 function adminRouteTable(store, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
@@ -3749,8 +4180,8 @@ function adminRouteTable(store, bus) {
     const ok = await users.setSuspended(idOf(ctx), suspended);
     if (!ok) return NOT_FOUND();
     const user = await users.findById(idOf(ctx));
-    return user ? (0, import_core12.setApiResponse)(
-      import_core12.HTTP.OK,
+    return user ? (0, import_core13.setApiResponse)(
+      import_core13.HTTP.OK,
       suspended ? "USER_SUSPENDED" : "USER_UNSUSPENDED",
       suspended ? "User suspended" : "User unsuspended",
       toAdminUserDTO(user)
@@ -3769,21 +4200,21 @@ function adminRouteTable(store, bus) {
         const email2 = raw ? normalizeEmailSafe(raw) ?? raw.toLowerCase() : void 0;
         if (email2) {
           const user = await users.findByEmail(email2);
-          return user ? (0, import_core12.setApiResponse)(import_core12.HTTP.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
+          return user ? (0, import_core13.setApiResponse)(import_core13.HTTP.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
         }
         const rawLimit = Number(params.get("limit") ?? 50);
         const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50;
         const cursorParam = params.get("cursor");
         const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null;
         if (cursorParam && !cursor)
-          return (0, import_core12.setApiResponse)(import_core12.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
+          return (0, import_core13.setApiResponse)(import_core13.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
         const deleted = params.get("deleted") === "1" || params.get("deleted") === "true";
         const page = await users.list({
           limit,
           ...cursor ? { cursor } : {},
           ...deleted ? { deleted } : {}
         });
-        return (0, import_core12.setApiResponse)(import_core12.HTTP.OK, "USERS", "Users", toAdminUserPageDTO(page));
+        return (0, import_core13.setApiResponse)(import_core13.HTTP.OK, "USERS", "Users", toAdminUserPageDTO(page));
       }
     ],
     [
@@ -3791,7 +4222,7 @@ function adminRouteTable(store, bus) {
       "/_admin/users/:id",
       async (ctx) => {
         const user = await users.findByIdIncludingDeleted(idOf(ctx));
-        return user ? (0, import_core12.setApiResponse)(import_core12.HTTP.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
+        return user ? (0, import_core13.setApiResponse)(import_core13.HTTP.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
       }
     ],
     [
@@ -3800,8 +4231,8 @@ function adminRouteTable(store, bus) {
       async (ctx) => {
         if (!await users.findById(idOf(ctx))) return NOT_FOUND();
         const rows = await sessions.listLiveByUser(idOf(ctx));
-        return (0, import_core12.setApiResponse)(
-          import_core12.HTTP.OK,
+        return (0, import_core13.setApiResponse)(
+          import_core13.HTTP.OK,
           "SESSIONS",
           "Live sessions",
           rows.map((r) => toSessionDTO(r, null))
@@ -3815,8 +4246,8 @@ function adminRouteTable(store, bus) {
       async (ctx) => {
         if (!await users.findById(idOf(ctx))) return NOT_FOUND();
         await sessions.deleteByUser(idOf(ctx));
-        await (0, import_core13.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: idOf(ctx), sids: null, reason: "admin" }));
-        return (0, import_core12.setApiResponse)(import_core12.HTTP.OK, "SESSIONS_REVOKED", "All sessions revoked");
+        await (0, import_core14.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: idOf(ctx), sids: null, reason: "admin" }));
+        return (0, import_core13.setApiResponse)(import_core13.HTTP.OK, "SESSIONS_REVOKED", "All sessions revoked");
       }
     ],
     [
@@ -3830,14 +4261,14 @@ function adminRouteTable(store, bus) {
         const cursorParam = params.get("cursor");
         const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null;
         if (cursorParam && !cursor)
-          return (0, import_core12.setApiResponse)(import_core12.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
+          return (0, import_core13.setApiResponse)(import_core13.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
         const page = await events.listByUser({
           userId: idOf(ctx),
           limit,
           ...cursor ? { cursor } : {}
         });
-        return (0, import_core12.setApiResponse)(
-          import_core12.HTTP.OK,
+        return (0, import_core13.setApiResponse)(
+          import_core13.HTTP.OK,
           "LOGIN_HISTORY",
           "Login history",
           toLoginHistoryPageDTO(page)
@@ -3870,7 +4301,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.22.1";
+  version = "7.24.0";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store, this.bus) };
@@ -3901,7 +4332,7 @@ var AuthModule = class {
 };
 
 // src/templates.ts
-var import_core14 = require("@fonderie/core");
+var import_core15 = require("@fonderie/core");
 
 // src/templates.es.ts
 var ES_TEMPLATES = {
@@ -4058,6 +4489,29 @@ inmediato y cambia tu contrase\xF1a \u2014 otra persona podr\xEDa iniciar sesi\x
 {{provider}} ya no se puede usar para iniciar sesi\xF3n. Tu correo electr\xF3nico y tu contrase\xF1a siguen funcionando.
 
 Si fuiste t\xFA, todo est\xE1 en orden. Si no, contacta con soporte de inmediato.`
+  },
+  [MESSAGE_KEYS.accountDeletionCode]: {
+    subject: `Confirma la eliminaci\xF3n de tu cuenta`,
+    html: `<h1>Confirmar la eliminaci\xF3n de la cuenta</h1>
+<p>Usa este c\xF3digo para confirmar que quieres eliminar tu cuenta:</p>
+<p><span class="pin-code">{{code}}</span></p>
+<p class="muted">Este c\xF3digo vence en 15 minutos. Si no pediste eliminar tu cuenta, ignora este mensaje y cambia tu contrase\xF1a: tu cuenta seguir\xE1 igual.</p>`,
+    text: `Tu c\xF3digo para confirmar la eliminaci\xF3n de tu cuenta: {{code}}. Vence en 15 minutos. \xBFNo fuiste t\xFA? Ignora esto y cambia tu contrase\xF1a.`
+  },
+  [MESSAGE_KEYS.accountDeletionScheduled]: {
+    subject: `Tu cuenta se eliminar\xE1 el {{deleteOn}}`,
+    html: `<h1>Tu cuenta est\xE1 programada para eliminarse</h1>
+<p>Recibimos tu solicitud. Tu cuenta est\xE1 cerrada y se eliminar\xE1 de forma permanente el <strong>{{deleteOn}}</strong>.</p>
+<p>\xBFCambiaste de opini\xF3n? Inicia sesi\xF3n antes de esa fecha y elige <strong>Conservar mi cuenta</strong>.</p>
+<p class="muted">Si no lo pediste, inicia sesi\xF3n ahora para conservar tu cuenta y cambia tu contrase\xF1a.</p>`,
+    text: `Tu cuenta se eliminar\xE1 de forma permanente el {{deleteOn}}. \xBFCambiaste de opini\xF3n? Inicia sesi\xF3n antes y elige Conservar mi cuenta.`
+  },
+  [MESSAGE_KEYS.accountRestored]: {
+    subject: `Tu cuenta fue restablecida`,
+    html: `<h1>Bienvenido de nuevo</h1>
+<p>Se cancel\xF3 la eliminaci\xF3n de tu cuenta y tu cuenta vuelve a estar activa.</p>
+<p class="muted">Si no fuiste t\xFA, cambia tu contrase\xF1a de inmediato.</p>`,
+    text: `Se cancel\xF3 la eliminaci\xF3n de tu cuenta; tu cuenta vuelve a estar activa. \xBFNo fuiste t\xFA? Cambia tu contrase\xF1a ahora.`
   }
 };
 
@@ -4218,6 +4672,29 @@ pourrait se connecter \xE0 votre place.`
 {{provider}} ne peut plus \xEAtre utilis\xE9 pour vous connecter. Votre adresse e-mail et votre mot de passe fonctionnent toujours.
 
 Si c'est bien vous, tout est en ordre. Sinon, contactez imm\xE9diatement le support.`
+  },
+  [MESSAGE_KEYS.accountDeletionCode]: {
+    subject: `Confirmez la suppression de votre compte`,
+    html: `<h1>Confirmer la suppression du compte</h1>
+<p>Utilisez ce code pour confirmer que vous souhaitez supprimer votre compte :</p>
+<p><span class="pin-code">{{code}}</span></p>
+<p class="muted">Ce code expire dans 15 minutes. Si vous n&rsquo;avez pas demand\xE9 la suppression de votre compte, ignorez ce message et changez votre mot de passe &mdash; votre compte reste tel quel.</p>`,
+    text: `Votre code pour confirmer la suppression de votre compte : {{code}}. Il expire dans 15 minutes. Ce n'est pas vous ? Ignorez ce message et changez votre mot de passe.`
+  },
+  [MESSAGE_KEYS.accountDeletionScheduled]: {
+    subject: `Votre compte sera supprim\xE9 le {{deleteOn}}`,
+    html: `<h1>Votre compte sera supprim\xE9</h1>
+<p>Nous avons bien re\xE7u votre demande. Votre compte est ferm\xE9 et sera supprim\xE9 d\xE9finitivement le <strong>{{deleteOn}}</strong>.</p>
+<p>Vous avez chang\xE9 d&rsquo;avis ? Connectez-vous avant cette date et choisissez <strong>Conserver mon compte</strong>.</p>
+<p class="muted">Si vous n&rsquo;\xEAtes pas \xE0 l&rsquo;origine de cette demande, connectez-vous maintenant pour conserver votre compte et changez votre mot de passe.</p>`,
+    text: `Votre compte sera supprim\xE9 d\xE9finitivement le {{deleteOn}}. Vous avez chang\xE9 d'avis ? Connectez-vous avant cette date et choisissez Conserver mon compte.`
+  },
+  [MESSAGE_KEYS.accountRestored]: {
+    subject: `Votre compte a \xE9t\xE9 r\xE9tabli`,
+    html: `<h1>Bon retour</h1>
+<p>La suppression de votre compte a \xE9t\xE9 annul\xE9e et votre compte est de nouveau actif.</p>
+<p class="muted">Si ce n&rsquo;est pas vous, changez votre mot de passe imm\xE9diatement.</p>`,
+    text: `La suppression de votre compte a \xE9t\xE9 annul\xE9e ; votre compte est de nouveau actif. Ce n'est pas vous ? Changez votre mot de passe maintenant.`
   }
 };
 
@@ -4372,6 +4849,29 @@ var ZH_HANS_TEMPLATES = {
 \u5DF2\u65E0\u6CD5\u518D\u4F7F\u7528 {{provider}} \u767B\u5F55\u3002\u60A8\u7684\u7535\u5B50\u90AE\u7BB1\u548C\u5BC6\u7801\u4ECD\u7136\u53EF\u7528\u3002
 
 \u5982\u679C\u662F\u60A8\u672C\u4EBA\u79FB\u9664\u7684\uFF0C\u65E0\u9700\u4EFB\u4F55\u64CD\u4F5C\u3002\u5982\u679C\u4E0D\u662F\uFF0C\u8BF7\u7ACB\u5373\u8054\u7CFB\u5BA2\u670D\u3002`
+  },
+  [MESSAGE_KEYS.accountDeletionCode]: {
+    subject: `\u786E\u8BA4\u5220\u9664\u60A8\u7684\u8D26\u6237`,
+    html: `<h1>\u786E\u8BA4\u5220\u9664\u8D26\u6237</h1>
+<p>\u8BF7\u4F7F\u7528\u6B64\u9A8C\u8BC1\u7801\u786E\u8BA4\u60A8\u8981\u5220\u9664\u8D26\u6237\uFF1A</p>
+<p><span class="pin-code">{{code}}</span></p>
+<p class="muted">\u6B64\u9A8C\u8BC1\u7801\u5C06\u5728 15 \u5206\u949F\u540E\u5931\u6548\u3002\u5982\u679C\u60A8\u6CA1\u6709\u7533\u8BF7\u5220\u9664\u8D26\u6237\uFF0C\u8BF7\u5FFD\u7565\u6B64\u6D88\u606F\u5E76\u66F4\u6539\u5BC6\u7801\uFF0C\u60A8\u7684\u8D26\u6237\u5C06\u4FDD\u6301\u4E0D\u53D8\u3002</p>`,
+    text: `\u786E\u8BA4\u5220\u9664\u8D26\u6237\u7684\u9A8C\u8BC1\u7801\uFF1A{{code}}\uFF0C15 \u5206\u949F\u5185\u6709\u6548\u3002\u4E0D\u662F\u60A8\u672C\u4EBA\u64CD\u4F5C\uFF1F\u8BF7\u5FFD\u7565\u5E76\u66F4\u6539\u5BC6\u7801\u3002`
+  },
+  [MESSAGE_KEYS.accountDeletionScheduled]: {
+    subject: `\u60A8\u7684\u8D26\u6237\u5C06\u4E8E {{deleteOn}} \u5220\u9664`,
+    html: `<h1>\u60A8\u7684\u8D26\u6237\u5DF2\u5B89\u6392\u5220\u9664</h1>
+<p>\u6211\u4EEC\u5DF2\u6536\u5230\u60A8\u7684\u7533\u8BF7\u3002\u60A8\u7684\u8D26\u6237\u5DF2\u5173\u95ED\uFF0C\u5E76\u5C06\u4E8E <strong>{{deleteOn}}</strong> \u6C38\u4E45\u5220\u9664\u3002</p>
+<p>\u6539\u53D8\u4E3B\u610F\u4E86\uFF1F\u8BF7\u5728\u8BE5\u65E5\u671F\u524D\u767B\u5F55\u5E76\u9009\u62E9<strong>\u4FDD\u7559\u6211\u7684\u8D26\u6237</strong>\u3002</p>
+<p class="muted">\u5982\u679C\u8FD9\u4E0D\u662F\u60A8\u672C\u4EBA\u7684\u7533\u8BF7\uFF0C\u8BF7\u7ACB\u5373\u767B\u5F55\u4EE5\u4FDD\u7559\u8D26\u6237\u5E76\u66F4\u6539\u5BC6\u7801\u3002</p>`,
+    text: `\u60A8\u7684\u8D26\u6237\u5C06\u4E8E {{deleteOn}} \u6C38\u4E45\u5220\u9664\u3002\u6539\u53D8\u4E3B\u610F\u4E86\uFF1F\u8BF7\u5728\u6B64\u524D\u767B\u5F55\u5E76\u9009\u62E9\u201C\u4FDD\u7559\u6211\u7684\u8D26\u6237\u201D\u3002`
+  },
+  [MESSAGE_KEYS.accountRestored]: {
+    subject: `\u60A8\u7684\u8D26\u6237\u5DF2\u6062\u590D`,
+    html: `<h1>\u6B22\u8FCE\u56DE\u6765</h1>
+<p>\u60A8\u7684\u8D26\u6237\u5220\u9664\u5DF2\u53D6\u6D88\uFF0C\u8D26\u6237\u5DF2\u91CD\u65B0\u542F\u7528\u3002</p>
+<p class="muted">\u5982\u679C\u4E0D\u662F\u60A8\u672C\u4EBA\u64CD\u4F5C\uFF0C\u8BF7\u7ACB\u5373\u66F4\u6539\u5BC6\u7801\u3002</p>`,
+    text: `\u60A8\u7684\u8D26\u6237\u5220\u9664\u5DF2\u53D6\u6D88\uFF0C\u8D26\u6237\u5DF2\u91CD\u65B0\u542F\u7528\u3002\u4E0D\u662F\u60A8\u672C\u4EBA\u64CD\u4F5C\uFF1F\u8BF7\u7ACB\u5373\u66F4\u6539\u5BC6\u7801\u3002`
   }
 };
 
@@ -4526,6 +5026,29 @@ var ZH_HANT_TEMPLATES = {
 \u5DF2\u7121\u6CD5\u518D\u4F7F\u7528 {{provider}} \u767B\u5165\u3002\u60A8\u7684\u96FB\u5B50\u90F5\u4EF6\u548C\u5BC6\u78BC\u4ECD\u53EF\u4F7F\u7528\u3002
 
 \u5982\u679C\u662F\u60A8\u672C\u4EBA\u79FB\u9664\u7684\uFF0C\u7121\u9808\u63A1\u53D6\u4EFB\u4F55\u884C\u52D5\u3002\u5982\u679C\u4E0D\u662F\uFF0C\u8ACB\u7ACB\u5373\u806F\u7D61\u5BA2\u670D\u3002`
+  },
+  [MESSAGE_KEYS.accountDeletionCode]: {
+    subject: `\u78BA\u8A8D\u522A\u9664\u60A8\u7684\u5E33\u6236`,
+    html: `<h1>\u78BA\u8A8D\u522A\u9664\u5E33\u6236</h1>
+<p>\u8ACB\u4F7F\u7528\u6B64\u9A57\u8B49\u78BC\u78BA\u8A8D\u60A8\u8981\u522A\u9664\u5E33\u6236\uFF1A</p>
+<p><span class="pin-code">{{code}}</span></p>
+<p class="muted">\u6B64\u9A57\u8B49\u78BC\u5C07\u5728 15 \u5206\u9418\u5F8C\u5931\u6548\u3002\u5982\u679C\u60A8\u6C92\u6709\u7533\u8ACB\u522A\u9664\u5E33\u6236\uFF0C\u8ACB\u5FFD\u7565\u6B64\u8A0A\u606F\u4E26\u66F4\u6539\u5BC6\u78BC\uFF0C\u60A8\u7684\u5E33\u6236\u5C07\u4FDD\u6301\u4E0D\u8B8A\u3002</p>`,
+    text: `\u78BA\u8A8D\u522A\u9664\u5E33\u6236\u7684\u9A57\u8B49\u78BC\uFF1A{{code}}\uFF0C15 \u5206\u9418\u5167\u6709\u6548\u3002\u4E0D\u662F\u60A8\u672C\u4EBA\u64CD\u4F5C\uFF1F\u8ACB\u5FFD\u7565\u4E26\u66F4\u6539\u5BC6\u78BC\u3002`
+  },
+  [MESSAGE_KEYS.accountDeletionScheduled]: {
+    subject: `\u60A8\u7684\u5E33\u6236\u5C07\u65BC {{deleteOn}} \u522A\u9664`,
+    html: `<h1>\u60A8\u7684\u5E33\u6236\u5DF2\u6392\u5B9A\u522A\u9664</h1>
+<p>\u6211\u5011\u5DF2\u6536\u5230\u60A8\u7684\u7533\u8ACB\u3002\u60A8\u7684\u5E33\u6236\u5DF2\u95DC\u9589\uFF0C\u4E26\u5C07\u65BC <strong>{{deleteOn}}</strong> \u6C38\u4E45\u522A\u9664\u3002</p>
+<p>\u6539\u8B8A\u4E3B\u610F\u4E86\uFF1F\u8ACB\u5728\u8A72\u65E5\u671F\u524D\u767B\u5165\u4E26\u9078\u64C7<strong>\u4FDD\u7559\u6211\u7684\u5E33\u6236</strong>\u3002</p>
+<p class="muted">\u5982\u679C\u9019\u4E0D\u662F\u60A8\u672C\u4EBA\u7684\u7533\u8ACB\uFF0C\u8ACB\u7ACB\u5373\u767B\u5165\u4EE5\u4FDD\u7559\u5E33\u6236\u4E26\u66F4\u6539\u5BC6\u78BC\u3002</p>`,
+    text: `\u60A8\u7684\u5E33\u6236\u5C07\u65BC {{deleteOn}} \u6C38\u4E45\u522A\u9664\u3002\u6539\u8B8A\u4E3B\u610F\u4E86\uFF1F\u8ACB\u5728\u6B64\u524D\u767B\u5165\u4E26\u9078\u64C7\u300C\u4FDD\u7559\u6211\u7684\u5E33\u6236\u300D\u3002`
+  },
+  [MESSAGE_KEYS.accountRestored]: {
+    subject: `\u60A8\u7684\u5E33\u6236\u5DF2\u6062\u5FA9`,
+    html: `<h1>\u6B61\u8FCE\u56DE\u4F86</h1>
+<p>\u60A8\u7684\u5E33\u6236\u522A\u9664\u5DF2\u53D6\u6D88\uFF0C\u5E33\u6236\u5DF2\u91CD\u65B0\u555F\u7528\u3002</p>
+<p class="muted">\u5982\u679C\u4E0D\u662F\u60A8\u672C\u4EBA\u64CD\u4F5C\uFF0C\u8ACB\u7ACB\u5373\u66F4\u6539\u5BC6\u78BC\u3002</p>`,
+    text: `\u60A8\u7684\u5E33\u6236\u522A\u9664\u5DF2\u53D6\u6D88\uFF0C\u5E33\u6236\u5DF2\u91CD\u65B0\u555F\u7528\u3002\u4E0D\u662F\u60A8\u672C\u4EBA\u64CD\u4F5C\uFF1F\u8ACB\u7ACB\u5373\u66F4\u6539\u5BC6\u78BC\u3002`
   }
 };
 
@@ -4684,9 +5207,32 @@ change your password \u2014 someone else may be able to sign in as you.`
 {{provider}} can no longer be used to sign in. Your email and password still work.
 
 If you did this, you're all set. If not, contact support right away.`
+  },
+  [MESSAGE_KEYS.accountDeletionCode]: {
+    subject: `Confirm your account deletion`,
+    html: `<h1>Confirm account deletion</h1>
+<p>Use this code to confirm that you want to delete your account:</p>
+<p><span class="pin-code">{{code}}</span></p>
+<p class="muted">This code expires in 15 minutes. If you didn&rsquo;t ask to delete your account, ignore this message and change your password &mdash; your account stays as it is.</p>`,
+    text: `Your code to confirm deleting your account: {{code}}. It expires in 15 minutes. Didn't ask? Ignore this and change your password.`
+  },
+  [MESSAGE_KEYS.accountDeletionScheduled]: {
+    subject: `Your account will be deleted on {{deleteOn}}`,
+    html: `<h1>Your account is scheduled for deletion</h1>
+<p>We received your request. Your account is closed and will be permanently deleted on <strong>{{deleteOn}}</strong>.</p>
+<p>Changed your mind? Sign in before that date and choose <strong>Keep my account</strong>.</p>
+<p class="muted">If you didn&rsquo;t ask for this, sign in now to keep your account and change your password.</p>`,
+    text: `Your account will be permanently deleted on {{deleteOn}}. Changed your mind? Sign in before then and choose Keep my account.`
+  },
+  [MESSAGE_KEYS.accountRestored]: {
+    subject: `Your account was restored`,
+    html: `<h1>Welcome back</h1>
+<p>Your account deletion was cancelled and your account is active again.</p>
+<p class="muted">If you didn&rsquo;t do this, change your password right away.</p>`,
+    text: `Your account deletion was cancelled; your account is active again. Didn't do this? Change your password now.`
   }
 };
-var DEFAULT_TEMPLATES = (0, import_core14.withTranslations)(EN_TEMPLATES, {
+var DEFAULT_TEMPLATES = (0, import_core15.withTranslations)(EN_TEMPLATES, {
   fr: FR_TEMPLATES,
   es: ES_TEMPLATES,
   "zh-Hans": ZH_HANS_TEMPLATES,
@@ -4709,7 +5255,10 @@ var SAMPLE_PAYLOADS = {
   [MESSAGE_KEYS.mfaDisabled]: {},
   [MESSAGE_KEYS.mfaBackupCodesRegenerated]: {},
   [MESSAGE_KEYS.emailChanged]: { newEmail: "new@example.com" },
-  [MESSAGE_KEYS.phoneChanged]: {}
+  [MESSAGE_KEYS.phoneChanged]: {},
+  [MESSAGE_KEYS.accountDeletionCode]: { code: "123456" },
+  [MESSAGE_KEYS.accountDeletionScheduled]: { deleteOn: "November 3, 2026" },
+  [MESSAGE_KEYS.accountRestored]: {}
 };
 
 // src/middlewares/require-auth.ts