@fonderie/auth 7.23.0 → 7.24.0

package/dist/index.js

@@ -172,13 +172,16 @@ var schemas_exports = {};
 __export(schemas_exports, {
   appleNativeSchema: () => appleNativeSchema,
   changePasswordSchema: () => changePasswordSchema,
+  confirmDeletionSchema: () => confirmDeletionSchema,
   forgotPasswordSchema: () => forgotPasswordSchema,
   googleNativeSchema: () => googleNativeSchema,
   loginSchema: () => loginSchema,
   mfaTokenSchema: () => mfaTokenSchema,
   refreshSchema: () => refreshSchema,
   registerSchema: () => registerSchema,
+  requestDeletionSchema: () => requestDeletionSchema,
   resetPasswordSchema: () => resetPasswordSchema,
+  restoreAccountSchema: () => restoreAccountSchema,
   updateEmailSchema: () => updateEmailSchema,
   updatePhoneSchema: () => updatePhoneSchema,
   updatePreferencesSchema: () => updatePreferencesSchema,
@@ -258,6 +261,10 @@ var changePasswordSchema = z.object({
   newPassword: password
 });
 var mfaTokenSchema = z.object({ token: z.string().trim().min(6).max(64) });
+var secondFactor = z.string().trim().min(6).max(16).optional();
+var requestDeletionSchema = z.object({ channel: z.enum(["email", "sms"]) });
+var confirmDeletionSchema = z.object({ code: sixDigitPin, mfaCode: secondFactor });
+var restoreAccountSchema = z.object({ restoreToken: z.string().min(20).max(4096), mfaCode: secondFactor });
 
 // src/services/cookies.ts
 function secureAttr(config) {
@@ -323,13 +330,23 @@ var MESSAGE_KEYS = {
   // arrives already verified by the provider and has nothing to confirm.
   oauthRegistration: "oauth-registration",
   oauthLinked: "oauth-linked",
-  oauthUnlinked: "oauth-unlinked"
+  oauthUnlinked: "oauth-unlinked",
+  // Account deletion (docs/ACCOUNT-DELETION-DESIGN.md). Each goes to the ONE
+  // verified channel the person chose — route these types to both 'email'
+  // and 'sms' in courier: auth fills in only the chosen address, and the
+  // other channel skips. SMS sends each template's text.
+  accountDeletionCode: "account-deletion-code",
+  accountDeletionScheduled: "account-deletion-scheduled",
+  accountRestored: "account-restored"
 };
 var EVENT_KEYS = {
   userRegistered: "fonderie.user.registered",
   userDeleted: "fonderie.user.deleted",
   // Emitted by purgeSoftDeletedUsers (given a bus) once the row is hard-deleted.
   userPurged: "fonderie.user.purged",
+  // An archived account was kept: { userId }. Undo what deletion paused
+  // (billing resumes a subscription set to end at the period's end).
+  userRestored: "fonderie.user.restored",
   emailVerified: "fonderie.user.email_verified",
   passwordChanged: "fonderie.user.password_changed",
   // Sessions the server revoked: { userId, sids (null = all), reason }. Reaches
@@ -771,6 +788,14 @@ var UserModel = class {
     );
     return row ?? null;
   }
+  /** An archived account by id (restore). */
+  async findArchivedById(id) {
+    const [row] = await this.store.query(
+      `SELECT ${USER_COLUMNS} FROM fonderie_users WHERE id = $1 AND deleted_at IS NOT NULL`,
+      [id]
+    );
+    return row ?? null;
+  }
   /** As findArchivedByEmail, for a phone number. */
   async findArchivedByPhone(phone2) {
     const [row] = await this.store.query(
@@ -1322,10 +1347,17 @@ var BackupCodeModel = class {
     );
     return rows.map((r) => ({ id: r.id, codeHash: r.code_hash }));
   }
+  /**
+   * Spend a backup code — once. Conditional on still being unused, so two
+   * requests racing with the same code cannot both sign in: the second finds
+   * it spent (false).
+   */
   async consume(id) {
-    await this.store.query(`UPDATE fonderie_mfa_backup_codes SET used_at = now() WHERE id = $1`, [
-      id
-    ]);
+    const rows = await this.store.query(
+      `UPDATE fonderie_mfa_backup_codes SET used_at = now() WHERE id = $1 AND used_at IS NULL RETURNING id`,
+      [id]
+    );
+    return rows.length > 0;
   }
   async deleteByUser(userId) {
     await this.store.query(`DELETE FROM fonderie_mfa_backup_codes WHERE user_id = $1`, [userId]);
@@ -1465,6 +1497,7 @@ function mfaController(store, config, issuer, bus) {
     },
     // ── 2. Verify (setup confirm · TOTP login · backup code login) ──
     verify: async (ctx) => {
+      if (ctx.user.deletedAt) return setApiResponse2(HTTP2.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
       const body = ctx.meta["body"];
       const token = body?.["token"];
       const isLoginCompletion = ctx.user.mfaPending === true;
@@ -1519,7 +1552,10 @@ function mfaController(store, config, issuer, bus) {
           if (isLoginCompletion) await failedMfa();
           return setApiResponse2(HTTP2.UNAUTHORIZED, "INVALID_CODE", "Invalid backup code");
         }
-        await backupCodes.consume(matched.id);
+        if (!await backupCodes.consume(matched.id)) {
+          if (isLoginCompletion) await failedMfa();
+          return setApiResponse2(HTTP2.UNAUTHORIZED, "INVALID_CODE", "Invalid backup code");
+        }
       } else {
         if (!ctx.user.mfaPending) {
           return setApiResponse2(
@@ -1646,16 +1682,39 @@ init_password();
 
 // src/services/pending-deletion.ts
 import { setApiResponse as setApiResponse3, HTTP as HTTP3 } from "@fonderie/core";
+
+// src/services/restore-token.ts
+import jwt2 from "jsonwebtoken";
+var RESTORE_TTL = "10m";
+function issueRestoreToken(userId, deletedAt, loginMethod, config) {
+  return jwt2.sign(
+    { sub: userId, type: "restore", loginMethod, archivedAt: deletedAt.toISOString() },
+    config.jwtSecret,
+    { expiresIn: RESTORE_TTL, keyid: keyIdOf(config.jwtSecret) }
+  );
+}
+function verifyRestoreToken(token, config) {
+  const payload = verifyToken(token, config);
+  if (!payload || payload.type !== "restore" || typeof payload.sub !== "string" || typeof payload.archivedAt !== "string") return null;
+  return payload;
+}
+
+// src/services/pending-deletion.ts
 function deletionDate(deletedAt, config) {
   return new Date(deletedAt.getTime() + deletionGracePeriodDays(config) * 24 * 60 * 60 * 1e3);
 }
-function pendingDeletionResponse(deletedAt, config) {
-  const deleteOn = deletionDate(deletedAt, config);
+function pendingDeletionResponse(user, loginMethod, config) {
+  const deleteOn = deletionDate(user.deletedAt, config);
   return setApiResponse3(
     HTTP3.FORBIDDEN,
     "ACCOUNT_PENDING_DELETION",
     `This account is scheduled for deletion on ${deleteOn.toISOString().slice(0, 10)}.`,
-    { requestedAt: deletedAt.toISOString(), deleteOn: deleteOn.toISOString() }
+    {
+      requestedAt: user.deletedAt.toISOString(),
+      deleteOn: deleteOn.toISOString(),
+      restoreToken: issueRestoreToken(user.id, user.deletedAt, loginMethod, config),
+      mfaRequired: user.mfaEnabled === true
+    }
   );
 }
 function archivedAddressResponse() {
@@ -1666,6 +1725,27 @@ function archivedAddressResponse() {
   );
 }
 
+// src/services/second-factor.ts
+init_password();
+async function verifySecondFactor(store, config, userId, code) {
+  if (typeof code !== "string") return false;
+  const value = code.trim();
+  if (/^\d{6}$/.test(value)) {
+    const stored = await new UserModel(store).getMfaSecret(userId);
+    if (!stored) return false;
+    return verifyTotpToken(value, makeMfaCipher(config.mfaSecretKey).decrypt(stored));
+  }
+  if (/^[A-Z0-9]{8}$/i.test(value)) {
+    const backupCodes = new BackupCodeModel(store);
+    for (const row of await backupCodes.findUnused(userId)) {
+      if (await verifyPassword(value.toUpperCase(), row.codeHash)) {
+        return backupCodes.consume(row.id);
+      }
+    }
+  }
+  return false;
+}
+
 // src/models/password-reset.model.ts
 import { createHash as createHash3 } from "crypto";
 var hashSecret = (value) => createHash3("sha256").update(value).digest("hex");
@@ -2006,7 +2086,7 @@ function authController(store, config, bus, locales = defineLocales()) {
               failureReason: valid2 ? "pending_deletion" : "bad_password",
               ...meta
             });
-            if (valid2) return pendingDeletionResponse(archived.deletedAt, config);
+            if (valid2) return pendingDeletionResponse({ ...archived, deletedAt: archived.deletedAt }, "email", config);
             return setApiResponse4(HTTP4.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
           }
         }
@@ -2084,7 +2164,7 @@ function authController(store, config, bus, locales = defineLocales()) {
       }
       const phone2 = body?.["phone"];
       if (isValidPhone(phone2)) {
-        const user = await users.findByPhone(normalizePhone(phone2));
+        const user = await users.findByPhone(normalizePhone(phone2)) ?? await users.findArchivedByPhone(normalizePhone(phone2));
         if (!user) {
           return setApiResponse4(HTTP4.UNAUTHORIZED, "INVALID_CREDENTIALS", "Invalid credentials");
         }
@@ -2120,6 +2200,65 @@ function authController(store, config, bus, locales = defineLocales()) {
         "Provide email + password or a valid phone number"
       );
     },
+    /**
+     * "Keep my account": the restoreToken from a sign-in to an archived account
+     * (proof already given: password, Google / Apple, phone code), plus a
+     * second factor when two-factor is on. Un-archives in one statement —
+     * only the SAME archive the proof was for — then signs the person in.
+     */
+    restoreAccount: async (ctx) => {
+      const body = ctx.meta["body"];
+      const proof = verifyRestoreToken(String(body?.["restoreToken"] ?? ""), config);
+      const invalid = () => setApiResponse4(HTTP4.UNAUTHORIZED, "RESTORE_TOKEN_INVALID", "Sign in again to keep your account.");
+      if (!proof) return invalid();
+      const archived = await users.findArchivedById(proof.sub);
+      if (!archived?.deletedAt || archived.deletedAt.toISOString() !== proof.archivedAt) return invalid();
+      if (archived.suspended) {
+        return setApiResponse4(HTTP4.FORBIDDEN, "ACCOUNT_SUSPENDED", "Account suspended. Please contact support.");
+      }
+      if (archived.mfaEnabled && !await verifySecondFactor(store, config, archived.id, body?.["mfaCode"])) {
+        return setApiResponse4(HTTP4.UNAUTHORIZED, "MFA_REQUIRED", "Enter a code from your authenticator app (or a backup code) to keep your account.");
+      }
+      const [restored] = await store.query(
+        `UPDATE fonderie_users
+				 SET deleted_at = NULL, deletion_channel = NULL, deletion_reminded_at = NULL, updated_at = now()
+				 -- The SAME archive the proof was for. Postgres keeps microseconds,
+				 -- the proof (a JS date) milliseconds: compare at that precision.
+				 WHERE id = $1 AND date_trunc('milliseconds', deleted_at) = date_trunc('milliseconds', $2::timestamptz)
+				 RETURNING (SELECT deletion_channel FROM fonderie_users WHERE id = $1) AS channel`,
+        [archived.id, proof.archivedAt]
+      );
+      if (!restored) return invalid();
+      const meta = requestMeta(ctx);
+      const method = proof.loginMethod === "google" ? "oauth-google" : proof.loginMethod === "apple" ? "oauth-apple" : proof.loginMethod === "phone" ? "phone" : "password";
+      const { accessToken, refreshToken, sid } = issueTokenPair(archived.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
+        loginMethod: proof.loginMethod,
+        phoneVerified: proof.loginMethod === "phone"
+      });
+      await sessions.create(archived.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+      await loginEvents.recordSafe({ userId: archived.id, emailAttempted: archived.email, method, outcome: "success", ...meta });
+      const reqId = ctx.meta["requestId"];
+      await background3(bus?.emit(EVENT_KEYS.userRestored, { userId: archived.id }, reqId !== void 0 ? { requestId: reqId } : void 0));
+      const viaSms = restored.channel === "sms" || !archived.email && !!archived.phone;
+      const address = viaSms ? archived.phone : archived.email;
+      if (address) {
+        await background3(bus?.emit(NOTIFICATION_EVENT2, {
+          type: MESSAGE_KEYS.accountRestored,
+          locale: archived.locale,
+          data: {},
+          recipient: viaSms ? { email: null, phone: address, deviceToken: null } : { email: address, phone: null, deviceToken: null }
+        }));
+      }
+      const user = await users.findById(archived.id);
+      return Response.json(
+        {
+          reason: "ACCOUNT_RESTORED",
+          explanation: "Your account is active again.",
+          result: { tokens: { access: accessToken, refresh: refreshToken }, user: user ? toUserDTO(user) : null }
+        },
+        { status: 200, headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config)) }
+      );
+    },
     logout: async (ctx) => {
       const sid = ctx.user?.sid;
       if (sid) {
@@ -2258,8 +2397,10 @@ function authController(store, config, bus, locales = defineLocales()) {
         );
       }
       let row;
+      let presented;
       if (typeof rawToken === "string" && rawToken.trim().length >= 32) {
-        row = await passwordReset.findByToken(rawToken.trim());
+        presented = rawToken.trim();
+        row = await passwordReset.findByToken(presented);
       } else {
         if (typeof raw !== "string" || !/^\d{6}$/.test(raw.trim())) {
           return setApiResponse4(
@@ -2268,7 +2409,8 @@ function authController(store, config, bus, locales = defineLocales()) {
             "a 6-digit pin or a reset token is required"
           );
         }
-        row = await passwordReset.findByPin(raw.trim());
+        presented = raw.trim();
+        row = await passwordReset.findByPin(presented);
       }
       if (!row || /* @__PURE__ */ new Date() > row.expiresAt) {
         return setApiResponse4(
@@ -2279,17 +2421,22 @@ function authController(store, config, bus, locales = defineLocales()) {
       }
       const passwordHash = await hashPassword(password2);
       const [changed] = await store.query(
-        `WITH changed AS (
+        `WITH spent AS (
+				   -- The code is spent HERE, and only what this statement spent
+				   -- changes a password: two resets racing with one code \u2014 the
+				   -- second finds it gone and changes nothing.
+				   DELETE FROM fonderie_password_resets
+				   WHERE user_id = $2 AND (pin = $3 OR token = $3) AND expires_at > now()
+				   RETURNING user_id
+				 ), changed AS (
 				   UPDATE fonderie_users SET password_hash = $1, updated_at = now()
-				   WHERE id = $2 AND deleted_at IS NULL
+				   WHERE id IN (SELECT user_id FROM spent) AND deleted_at IS NULL
 				   RETURNING id
-				 ), spent AS (
-				   DELETE FROM fonderie_password_resets WHERE user_id = $2
 				 ), revoked AS (
 				   DELETE FROM fonderie_sessions WHERE user_id IN (SELECT id FROM changed)
 				 )
 				 SELECT id FROM changed`,
-        [passwordHash, row.userId]
+        [passwordHash, row.userId, hashSecret(presented)]
       );
       if (!changed) {
         return setApiResponse4(
@@ -2351,6 +2498,17 @@ function authController(store, config, bus, locales = defineLocales()) {
           );
         }
         await phoneVerif.deleteByUser(ctx.user.id);
+        if (ctx.user.deletedAt) {
+          await loginEvents.recordSafe({
+            userId: ctx.user.id,
+            emailAttempted: null,
+            method: "phone",
+            outcome: "failed",
+            failureReason: "pending_deletion",
+            ...phoneMeta
+          });
+          return pendingDeletionResponse({ ...ctx.user, deletedAt: ctx.user.deletedAt }, "phone", config);
+        }
         const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, configForClient(config, config.resolve?.(ctx), clientKindOf(ctx.request.headers)), {
           loginMethod: "phone",
           phoneVerified: true
@@ -2496,7 +2654,7 @@ function authController(store, config, bus, locales = defineLocales()) {
 
 // src/controllers/user.controller.ts
 import { randomInt as randomInt2 } from "crypto";
-import { setApiResponse as setApiResponse5, HTTP as HTTP5, dateOrEmpty as dateOrEmpty2, background as background4 } from "@fonderie/core";
+import { setApiResponse as setApiResponse5, HTTP as HTTP5, dateOrEmpty as dateOrEmpty2, background as background4, COURIER_FORMAT_KEY } from "@fonderie/core";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT3 } from "@fonderie/events";
 
 // src/dtos/login-activity.ts
@@ -2534,7 +2692,64 @@ function toSessionDTO(row, currentSid) {
   };
 }
 
+// src/models/account-deletion.model.ts
+import { createHash as createHash4 } from "crypto";
+var hashCode = (code) => createHash4("sha256").update(code).digest("hex");
+var DELETION_CODE_MAX_ATTEMPTS = 5;
+var AccountDeletionModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  /** Replace any pending code (a new request supersedes the old one). */
+  async saveCode(userId, code, channel, expiresAt) {
+    await this.store.query(
+      `INSERT INTO fonderie_account_deletion_codes (user_id, code_hash, channel, attempts, expires_at, created_at)
+			 VALUES ($1, $2, $3, 0, $4, now())
+			 ON CONFLICT (user_id) DO UPDATE
+			 SET code_hash = $2, channel = $3, attempts = 0, expires_at = $4, created_at = now()`,
+      [userId, hashCode(code), channel, expiresAt]
+    );
+  }
+  async lastSentAt(userId) {
+    const [row] = await this.store.query(
+      `SELECT created_at AS "createdAt" FROM fonderie_account_deletion_codes WHERE user_id = $1`,
+      [userId]
+    );
+    return row ? new Date(row.createdAt) : null;
+  }
+  /**
+   * Check a code in ONE statement: a wrong code spends an attempt, a right
+   * one is consumed (deleted) — so a code is good once, and a guesser gets
+   * five tries in total however many requests they race.
+   */
+  async checkCode(userId, code) {
+    const [row] = await this.store.query(
+      `WITH current AS (
+			   SELECT user_id, code_hash = $2 AS matched, expires_at <= now() AS expired, attempts, channel
+			   FROM fonderie_account_deletion_codes WHERE user_id = $1
+			   FOR UPDATE
+			 ), spent AS (
+			   DELETE FROM fonderie_account_deletion_codes d USING current c
+			   WHERE d.user_id = c.user_id AND c.matched AND NOT c.expired AND c.attempts < $3
+			 ), missed AS (
+			   UPDATE fonderie_account_deletion_codes d SET attempts = d.attempts + 1
+			   FROM current c
+			   WHERE d.user_id = c.user_id AND NOT (c.matched AND NOT c.expired AND c.attempts < $3)
+			 )
+			 SELECT matched, expired, attempts, channel FROM current`,
+      [userId, hashCode(code), DELETION_CODE_MAX_ATTEMPTS]
+    );
+    if (!row) return { result: "none" };
+    if (row.attempts >= DELETION_CODE_MAX_ATTEMPTS) return { result: "exhausted" };
+    if (row.expired) return { result: "expired" };
+    return { result: row.matched ? "ok" : "invalid", channel: row.channel };
+  }
+};
+
 // src/controllers/user.controller.ts
+var DELETION_CODE_TTL_MS = 15 * 60 * 1e3;
+var DELETION_CODE_COOLDOWN_MS = 60 * 1e3;
 function normalizePhone2(phone2) {
   return phone2.trim().replace(/[\s()\-\.]/g, "");
 }
@@ -2547,6 +2762,55 @@ function userController(store, config, bus) {
   const loginEvents = new LoginEventModel(store, config.location);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
+  const deletions = new AccountDeletionModel(store);
+  const deletionBlocked = async (userId) => {
+    for (const blocker of config.accountDeletion?.blockers ?? []) {
+      const refusal = await blocker(userId);
+      if (refusal) return setApiResponse5(HTTP5.CONFLICT, refusal.reason, refusal.explanation, refusal.details);
+    }
+    return null;
+  };
+  const archive = async (userId, channel) => {
+    const [row] = await store.query(
+      `WITH archived AS (
+			   UPDATE fonderie_users
+			   SET deleted_at = now(), updated_at = now(), deletion_channel = $2, deletion_reminded_at = NULL
+			   WHERE id = $1 AND deleted_at IS NULL
+			   RETURNING id, deleted_at
+			 ), sessions_ended AS (
+			   DELETE FROM fonderie_sessions WHERE user_id = $1
+			 ), resets AS (
+			   DELETE FROM fonderie_password_resets WHERE user_id = $1
+			 ), emails AS (
+			   DELETE FROM fonderie_email_verifications WHERE user_id = $1
+			 ), phones AS (
+			   DELETE FROM fonderie_phone_verifications WHERE user_id = $1
+			 ), codes AS (
+			   DELETE FROM fonderie_account_deletion_codes WHERE user_id = $1
+			 )
+			 SELECT deleted_at AS "deletedAt" FROM archived`,
+      [userId, channel]
+    );
+    return row ? new Date(row.deletedAt) : /* @__PURE__ */ new Date();
+  };
+  const announceArchived = async (ctx, deletedAt) => {
+    const userId = ctx.user.id;
+    const reqId = ctx.meta["requestId"];
+    await background4(bus?.emit(
+      EVENT_KEYS.userDeleted,
+      { userId, deletedAt: deletedAt.toISOString(), deleteOn: deletionDate(deletedAt, config).toISOString() },
+      reqId !== void 0 ? { requestId: reqId } : void 0
+    ));
+    await background4(bus?.emit(EVENT_KEYS.sessionRevoked, { userId, sids: null, reason: "account-deleted" }));
+  };
+  const archivedResponse = (deletedAt) => Response.json(
+    {
+      reason: "ACCOUNT_DELETED",
+      explanation: "Account closed. It will be permanently deleted on the date shown; sign in before then to keep it.",
+      result: { requestedAt: deletedAt.toISOString(), deleteOn: deletionDate(deletedAt, config).toISOString() }
+    },
+    { status: 200, headers: cookieHeaders(clearedTokenCookies(config)) }
+  );
   return {
     me: async (ctx) => {
       const user = await users.findById(ctx.user.id);
@@ -2829,30 +3093,95 @@ function userController(store, config, bus) {
       }
       return setApiResponse5(HTTP5.OK, "OAUTH_UNLINKED", "Sign-in provider removed.");
     },
+    // Legacy one-call deletion (no code). Kept so existing apps keep working;
+    // apps move to POST /users/me/deletion + /confirm (proof + notices).
     deleteMe: async (ctx) => {
-      const userId = ctx.user.id;
-      await users.softDelete(userId);
-      await sessions.deleteByUser(userId);
-      await store.query(
-        `WITH resets AS (DELETE FROM fonderie_password_resets WHERE user_id = $1),
-				      emails AS (DELETE FROM fonderie_email_verifications WHERE user_id = $1)
-				 DELETE FROM fonderie_phone_verifications WHERE user_id = $1`,
-        [userId]
-      );
-      const reqId = ctx.meta["requestId"];
-      await background4(bus?.emit(
-        EVENT_KEYS.userDeleted,
-        { userId },
-        reqId !== void 0 ? { requestId: reqId } : void 0
-      ));
-      await background4(bus?.emit(EVENT_KEYS.sessionRevoked, { userId, sids: null, reason: "account-deleted" }));
-      return Response.json(
-        { reason: "ACCOUNT_DELETED", explanation: "Account successfully deleted." },
-        {
-          status: 200,
-          headers: cookieHeaders(clearedTokenCookies(config))
-        }
-      );
+      const deletedAt = await archive(ctx.user.id, null);
+      await announceArchived(ctx, deletedAt);
+      return archivedResponse(deletedAt);
+    },
+    /**
+     * Step 1 of deleting an account: a 6-digit code to the channel the person
+     * picks ('email' | 'sms' — an address on the account; receiving the code
+     * proves they hold it). Refused while a blocker objects (e.g. they own a
+     * team with other members — transfer it first).
+     */
+    requestDeletion: async (ctx) => {
+      const user = ctx.user;
+      const body = ctx.meta["body"];
+      const channel = body?.["channel"] === "sms" ? "sms" : body?.["channel"] === "email" ? "email" : null;
+      if (!channel) {
+        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "channel must be 'email' or 'sms'");
+      }
+      const address = channel === "email" ? user.email : user.phone;
+      if (!address) {
+        return setApiResponse5(
+          HTTP5.UNPROCESSABLE,
+          channel === "email" ? "NO_EMAIL_ON_ACCOUNT" : "NO_PHONE_ON_ACCOUNT",
+          `There is no ${channel === "email" ? "email address" : "phone number"} on this account to send the code to.`
+        );
+      }
+      const refused = await deletionBlocked(user.id);
+      if (refused) return refused;
+      const remainingMs = checkCooldown(await deletions.lastSentAt(user.id), DELETION_CODE_COOLDOWN_MS);
+      if (remainingMs > 0) {
+        const retryAfter = Math.ceil(remainingMs / 1e3);
+        return setApiResponse5(HTTP5.TOO_MANY_REQUESTS, "VERIFICATION_COOLDOWN", `Wait ${retryAfter}s before requesting a new code.`, { retryAfter });
+      }
+      const code = randomInt2(1e5, 1e6).toString();
+      await deletions.saveCode(user.id, code, channel, new Date(Date.now() + DELETION_CODE_TTL_MS));
+      await background4(bus?.emit(NOTIFICATION_EVENT3, {
+        type: MESSAGE_KEYS.accountDeletionCode,
+        locale: user.locale,
+        data: { code },
+        recipient: channel === "email" ? { email: address, phone: null, deviceToken: null } : { email: null, phone: address, deviceToken: null }
+      }));
+      return setApiResponse5(HTTP5.ACCEPTED, "ACCOUNT_DELETION_CODE_SENT", "A code to confirm the deletion was sent.", {
+        channel,
+        expiresInSeconds: DELETION_CODE_TTL_MS / 1e3,
+        mfaRequired: user.mfaEnabled === true
+      });
+    },
+    /**
+     * Step 2: the code (and, with two-factor on, a second factor) archives the
+     * account — closed at once, restorable at sign-in until the purge date.
+     */
+    confirmDeletion: async (ctx) => {
+      const user = ctx.user;
+      const body = ctx.meta["body"];
+      const code = typeof body?.["code"] === "string" ? body["code"].trim() : "";
+      if (!/^\d{6}$/.test(code)) {
+        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "code must be the 6-digit code that was sent");
+      }
+      const refused = await deletionBlocked(user.id);
+      if (refused) return refused;
+      if (user.mfaEnabled && !await verifySecondFactor(store, config, user.id, body?.["mfaCode"])) {
+        return setApiResponse5(HTTP5.UNAUTHORIZED, "MFA_REQUIRED", "Enter a code from your authenticator app (or a backup code) to confirm.");
+      }
+      const checked = await deletions.checkCode(user.id, code);
+      if (checked.result !== "ok") {
+        return setApiResponse5(
+          HTTP5.BAD_REQUEST,
+          "VERIFICATION_FAILED",
+          checked.result === "exhausted" || checked.result === "none" || checked.result === "expired" ? "This code can no longer be used. Request a new one." : "That code is incorrect."
+        );
+      }
+      const deletedAt = await archive(user.id, checked.channel ?? null);
+      await announceArchived(ctx, deletedAt);
+      const deleteOn = deletionDate(deletedAt, config);
+      const address = checked.channel === "sms" ? user.phone : user.email;
+      if (address) {
+        await background4(bus?.emit(NOTIFICATION_EVENT3, {
+          type: MESSAGE_KEYS.accountDeletionScheduled,
+          locale: user.locale,
+          data: {
+            deleteOn: deleteOn.toISOString().slice(0, 10),
+            [COURIER_FORMAT_KEY]: { deleteOn: { date: deleteOn.toISOString(), style: "long" } }
+          },
+          recipient: checked.channel === "sms" ? { email: null, phone: address, deviceToken: null } : { email: address, phone: null, deviceToken: null }
+        }));
+      }
+      return archivedResponse(deletedAt);
     },
     // Subject Access Request — the authenticated user's own data as a portable
     // JSON bundle. Only auth-owned data, and only safe fields: no password hash,
@@ -2894,8 +3223,8 @@ function userController(store, config, bus) {
 }
 
 // src/controllers/oauth.controller.ts
-import { randomBytes as randomBytes4, createHash as createHash4 } from "crypto";
-import jwt2 from "jsonwebtoken";
+import { randomBytes as randomBytes4, createHash as createHash5 } from "crypto";
+import jwt3 from "jsonwebtoken";
 import { setApiResponse as setApiResponse6, HTTP as HTTP6, constantTimeEqual as constantTimeEqual2, background as background5 } from "@fonderie/core";
 import { NOTIFICATION_EVENT as NOTIFICATION_EVENT4 } from "@fonderie/events";
 
@@ -2980,7 +3309,7 @@ var APPLE_KEYS_URL = "https://appleid.apple.com/auth/keys";
 var APPLE_ISSUER = "https://appleid.apple.com";
 function mintAppleClientSecret(apple) {
   const now = Math.floor(Date.now() / 1e3);
-  return jwt2.sign(
+  return jwt3.sign(
     { iss: apple.teamId, iat: now, exp: now + 300, aud: APPLE_ISSUER, sub: apple.clientId },
     apple.privateKey,
     { algorithm: "ES256", keyid: apple.keyId }
@@ -2989,14 +3318,14 @@ function mintAppleClientSecret(apple) {
 var appleKeys = createJwksSource(APPLE_KEYS_URL);
 async function verifyAppleIdToken(idToken, opts) {
   if (opts.audiences.length === 0) return null;
-  const decoded = jwt2.decode(idToken, { complete: true });
+  const decoded = jwt3.decode(idToken, { complete: true });
   if (!decoded || typeof decoded === "string") return null;
   const kid = decoded.header.kid;
   if (!kid) return null;
   const key = await appleKeys.getKey(kid);
   if (!key) return null;
   try {
-    const payload = jwt2.verify(idToken, key, {
+    const payload = jwt3.verify(idToken, key, {
       algorithms: ["RS256"],
       issuer: APPLE_ISSUER,
       // jsonwebtoken types `audience` as a non-empty tuple; runtime accepts a
@@ -3016,14 +3345,14 @@ var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
 var googleKeys = createJwksSource(GOOGLE_KEYS_URL);
 async function verifyGoogleIdToken(idToken, opts) {
   if (opts.audiences.length === 0) return null;
-  const decoded = jwt2.decode(idToken, { complete: true });
+  const decoded = jwt3.decode(idToken, { complete: true });
   if (!decoded || typeof decoded === "string") return null;
   const kid = decoded.header.kid;
   if (!kid) return null;
   const key = await googleKeys.getKey(kid);
   if (!key) return null;
   try {
-    const payload = jwt2.verify(idToken, key, {
+    const payload = jwt3.verify(idToken, key, {
       algorithms: ["RS256"],
       issuer: [...GOOGLE_ISSUERS],
       audience: opts.audiences
@@ -3125,7 +3454,7 @@ function oauthController(store, config, bus) {
         failureReason: "pending_deletion",
         ...meta
       });
-      const res = pendingDeletionResponse(archived.deletedAt, config);
+      const res = pendingDeletionResponse({ ...archived, deletedAt: archived.deletedAt }, provider, config);
       const headers = cookieHeaders(clearCookies);
       headers.set("content-type", res.headers.get("content-type") ?? "application/json");
       return new Response(res.body, { status: res.status, headers });
@@ -3395,7 +3724,7 @@ function oauthController(store, config, bus) {
         });
         return setApiResponse6(HTTP6.UNAUTHORIZED, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
       }
-      const tokenHash = createHash4("sha256").update(identityToken).digest("hex");
+      const tokenHash = createHash5("sha256").update(identityToken).digest("hex");
       const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
       const firstUse = await consumedTokens.consumeOnce(tokenHash, new Date(expMs));
       if (!firstUse) {
@@ -3445,7 +3774,7 @@ function oauthController(store, config, bus) {
         });
         return setApiResponse6(HTTP6.UNAUTHORIZED, "GOOGLE_AUTH_FAILED", "Invalid Google ID token");
       }
-      const tokenHash = createHash4("sha256").update(idToken).digest("hex");
+      const tokenHash = createHash5("sha256").update(idToken).digest("hex");
       const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
       if (!await consumedTokens.consumeOnce(tokenHash, new Date(expMs))) {
         await loginEvents.recordSafe({
@@ -3534,6 +3863,11 @@ function buildAuthRoutes(store, config, bus, locales) {
     // refuses when it would leave the account with no way to sign in.
     R("unlinkOauth", "DELETE", "/auth/oauth/:provider", requireAuth, user.unlinkOauth),
     R("deleteMe", "DELETE", "/users", requireAuth, verifyGate, user.deleteMe),
+    // Deleting with proof: a code to a chosen channel, then confirm. The
+    // account is archived until the purge; signing in offers to keep it.
+    R("requestDeletion", "POST", "/users/me/deletion", requireAuth, verifyGate, validate(requestDeletionSchema), user.requestDeletion),
+    R("confirmDeletion", "POST", "/users/me/deletion/confirm", ipLimit("verify"), requireAuth, verifyGate, validate(confirmDeletionSchema), user.confirmDeletion),
+    R("restoreAccount", "POST", "/auth/account/restore", ipLimit("login"), validate(restoreAccountSchema), auth.restoreAccount),
     R("exportMe", "GET", "/users/export", requireAuth, user.exportMe),
     // Security surfaces (Protected; the caller's own login history + sessions).
     // The literal /others route is registered before /:id so it isn't
@@ -3737,8 +4071,11 @@ function withSession(store, config) {
     if (payload.sid && !await sessions.aliveBySid(payload.sid)) {
       return next();
     }
-    const user = await users.findById(payload.sub);
-    if (!user || user.suspended || user.deletedAt) {
+    let user = await users.findById(payload.sub);
+    if (!user && payload.mfaPending && payload.loginMethod === "phone") {
+      user = await users.findArchivedById(payload.sub);
+    }
+    if (!user || user.suspended || user.deletedAt && !payload.mfaPending) {
       return next();
     }
     Object.assign(ctx, {
@@ -3913,7 +4250,7 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.23.0";
+  version = "7.24.0";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
     return { routes: describeAuthAdminRoutes(this.store, this.bus) };
@@ -4101,6 +4438,29 @@ inmediato y cambia tu contrase\xF1a \u2014 otra persona podr\xEDa iniciar sesi\x
 {{provider}} ya no se puede usar para iniciar sesi\xF3n. Tu correo electr\xF3nico y tu contrase\xF1a siguen funcionando.
 
 Si fuiste t\xFA, todo est\xE1 en orden. Si no, contacta con soporte de inmediato.`
+  },
+  [MESSAGE_KEYS.accountDeletionCode]: {
+    subject: `Confirma la eliminaci\xF3n de tu cuenta`,
+    html: `<h1>Confirmar la eliminaci\xF3n de la cuenta</h1>
+<p>Usa este c\xF3digo para confirmar que quieres eliminar tu cuenta:</p>
+<p><span class="pin-code">{{code}}</span></p>
+<p class="muted">Este c\xF3digo vence en 15 minutos. Si no pediste eliminar tu cuenta, ignora este mensaje y cambia tu contrase\xF1a: tu cuenta seguir\xE1 igual.</p>`,
+    text: `Tu c\xF3digo para confirmar la eliminaci\xF3n de tu cuenta: {{code}}. Vence en 15 minutos. \xBFNo fuiste t\xFA? Ignora esto y cambia tu contrase\xF1a.`
+  },
+  [MESSAGE_KEYS.accountDeletionScheduled]: {
+    subject: `Tu cuenta se eliminar\xE1 el {{deleteOn}}`,
+    html: `<h1>Tu cuenta est\xE1 programada para eliminarse</h1>
+<p>Recibimos tu solicitud. Tu cuenta est\xE1 cerrada y se eliminar\xE1 de forma permanente el <strong>{{deleteOn}}</strong>.</p>
+<p>\xBFCambiaste de opini\xF3n? Inicia sesi\xF3n antes de esa fecha y elige <strong>Conservar mi cuenta</strong>.</p>
+<p class="muted">Si no lo pediste, inicia sesi\xF3n ahora para conservar tu cuenta y cambia tu contrase\xF1a.</p>`,
+    text: `Tu cuenta se eliminar\xE1 de forma permanente el {{deleteOn}}. \xBFCambiaste de opini\xF3n? Inicia sesi\xF3n antes y elige Conservar mi cuenta.`
+  },
+  [MESSAGE_KEYS.accountRestored]: {
+    subject: `Tu cuenta fue restablecida`,
+    html: `<h1>Bienvenido de nuevo</h1>
+<p>Se cancel\xF3 la eliminaci\xF3n de tu cuenta y tu cuenta vuelve a estar activa.</p>
+<p class="muted">Si no fuiste t\xFA, cambia tu contrase\xF1a de inmediato.</p>`,
+    text: `Se cancel\xF3 la eliminaci\xF3n de tu cuenta; tu cuenta vuelve a estar activa. \xBFNo fuiste t\xFA? Cambia tu contrase\xF1a ahora.`
   }
 };
 
@@ -4261,6 +4621,29 @@ pourrait se connecter \xE0 votre place.`
 {{provider}} ne peut plus \xEAtre utilis\xE9 pour vous connecter. Votre adresse e-mail et votre mot de passe fonctionnent toujours.
 
 Si c'est bien vous, tout est en ordre. Sinon, contactez imm\xE9diatement le support.`
+  },
+  [MESSAGE_KEYS.accountDeletionCode]: {
+    subject: `Confirmez la suppression de votre compte`,
+    html: `<h1>Confirmer la suppression du compte</h1>
+<p>Utilisez ce code pour confirmer que vous souhaitez supprimer votre compte :</p>
+<p><span class="pin-code">{{code}}</span></p>
+<p class="muted">Ce code expire dans 15 minutes. Si vous n&rsquo;avez pas demand\xE9 la suppression de votre compte, ignorez ce message et changez votre mot de passe &mdash; votre compte reste tel quel.</p>`,
+    text: `Votre code pour confirmer la suppression de votre compte : {{code}}. Il expire dans 15 minutes. Ce n'est pas vous ? Ignorez ce message et changez votre mot de passe.`
+  },
+  [MESSAGE_KEYS.accountDeletionScheduled]: {
+    subject: `Votre compte sera supprim\xE9 le {{deleteOn}}`,
+    html: `<h1>Votre compte sera supprim\xE9</h1>
+<p>Nous avons bien re\xE7u votre demande. Votre compte est ferm\xE9 et sera supprim\xE9 d\xE9finitivement le <strong>{{deleteOn}}</strong>.</p>
+<p>Vous avez chang\xE9 d&rsquo;avis ? Connectez-vous avant cette date et choisissez <strong>Conserver mon compte</strong>.</p>
+<p class="muted">Si vous n&rsquo;\xEAtes pas \xE0 l&rsquo;origine de cette demande, connectez-vous maintenant pour conserver votre compte et changez votre mot de passe.</p>`,
+    text: `Votre compte sera supprim\xE9 d\xE9finitivement le {{deleteOn}}. Vous avez chang\xE9 d'avis ? Connectez-vous avant cette date et choisissez Conserver mon compte.`
+  },
+  [MESSAGE_KEYS.accountRestored]: {
+    subject: `Votre compte a \xE9t\xE9 r\xE9tabli`,
+    html: `<h1>Bon retour</h1>
+<p>La suppression de votre compte a \xE9t\xE9 annul\xE9e et votre compte est de nouveau actif.</p>
+<p class="muted">Si ce n&rsquo;est pas vous, changez votre mot de passe imm\xE9diatement.</p>`,
+    text: `La suppression de votre compte a \xE9t\xE9 annul\xE9e ; votre compte est de nouveau actif. Ce n'est pas vous ? Changez votre mot de passe maintenant.`
   }
 };
 
@@ -4415,6 +4798,29 @@ var ZH_HANS_TEMPLATES = {
 \u5DF2\u65E0\u6CD5\u518D\u4F7F\u7528 {{provider}} \u767B\u5F55\u3002\u60A8\u7684\u7535\u5B50\u90AE\u7BB1\u548C\u5BC6\u7801\u4ECD\u7136\u53EF\u7528\u3002
 
 \u5982\u679C\u662F\u60A8\u672C\u4EBA\u79FB\u9664\u7684\uFF0C\u65E0\u9700\u4EFB\u4F55\u64CD\u4F5C\u3002\u5982\u679C\u4E0D\u662F\uFF0C\u8BF7\u7ACB\u5373\u8054\u7CFB\u5BA2\u670D\u3002`
+  },
+  [MESSAGE_KEYS.accountDeletionCode]: {
+    subject: `\u786E\u8BA4\u5220\u9664\u60A8\u7684\u8D26\u6237`,
+    html: `<h1>\u786E\u8BA4\u5220\u9664\u8D26\u6237</h1>
+<p>\u8BF7\u4F7F\u7528\u6B64\u9A8C\u8BC1\u7801\u786E\u8BA4\u60A8\u8981\u5220\u9664\u8D26\u6237\uFF1A</p>
+<p><span class="pin-code">{{code}}</span></p>
+<p class="muted">\u6B64\u9A8C\u8BC1\u7801\u5C06\u5728 15 \u5206\u949F\u540E\u5931\u6548\u3002\u5982\u679C\u60A8\u6CA1\u6709\u7533\u8BF7\u5220\u9664\u8D26\u6237\uFF0C\u8BF7\u5FFD\u7565\u6B64\u6D88\u606F\u5E76\u66F4\u6539\u5BC6\u7801\uFF0C\u60A8\u7684\u8D26\u6237\u5C06\u4FDD\u6301\u4E0D\u53D8\u3002</p>`,
+    text: `\u786E\u8BA4\u5220\u9664\u8D26\u6237\u7684\u9A8C\u8BC1\u7801\uFF1A{{code}}\uFF0C15 \u5206\u949F\u5185\u6709\u6548\u3002\u4E0D\u662F\u60A8\u672C\u4EBA\u64CD\u4F5C\uFF1F\u8BF7\u5FFD\u7565\u5E76\u66F4\u6539\u5BC6\u7801\u3002`
+  },
+  [MESSAGE_KEYS.accountDeletionScheduled]: {
+    subject: `\u60A8\u7684\u8D26\u6237\u5C06\u4E8E {{deleteOn}} \u5220\u9664`,
+    html: `<h1>\u60A8\u7684\u8D26\u6237\u5DF2\u5B89\u6392\u5220\u9664</h1>
+<p>\u6211\u4EEC\u5DF2\u6536\u5230\u60A8\u7684\u7533\u8BF7\u3002\u60A8\u7684\u8D26\u6237\u5DF2\u5173\u95ED\uFF0C\u5E76\u5C06\u4E8E <strong>{{deleteOn}}</strong> \u6C38\u4E45\u5220\u9664\u3002</p>
+<p>\u6539\u53D8\u4E3B\u610F\u4E86\uFF1F\u8BF7\u5728\u8BE5\u65E5\u671F\u524D\u767B\u5F55\u5E76\u9009\u62E9<strong>\u4FDD\u7559\u6211\u7684\u8D26\u6237</strong>\u3002</p>
+<p class="muted">\u5982\u679C\u8FD9\u4E0D\u662F\u60A8\u672C\u4EBA\u7684\u7533\u8BF7\uFF0C\u8BF7\u7ACB\u5373\u767B\u5F55\u4EE5\u4FDD\u7559\u8D26\u6237\u5E76\u66F4\u6539\u5BC6\u7801\u3002</p>`,
+    text: `\u60A8\u7684\u8D26\u6237\u5C06\u4E8E {{deleteOn}} \u6C38\u4E45\u5220\u9664\u3002\u6539\u53D8\u4E3B\u610F\u4E86\uFF1F\u8BF7\u5728\u6B64\u524D\u767B\u5F55\u5E76\u9009\u62E9\u201C\u4FDD\u7559\u6211\u7684\u8D26\u6237\u201D\u3002`
+  },
+  [MESSAGE_KEYS.accountRestored]: {
+    subject: `\u60A8\u7684\u8D26\u6237\u5DF2\u6062\u590D`,
+    html: `<h1>\u6B22\u8FCE\u56DE\u6765</h1>
+<p>\u60A8\u7684\u8D26\u6237\u5220\u9664\u5DF2\u53D6\u6D88\uFF0C\u8D26\u6237\u5DF2\u91CD\u65B0\u542F\u7528\u3002</p>
+<p class="muted">\u5982\u679C\u4E0D\u662F\u60A8\u672C\u4EBA\u64CD\u4F5C\uFF0C\u8BF7\u7ACB\u5373\u66F4\u6539\u5BC6\u7801\u3002</p>`,
+    text: `\u60A8\u7684\u8D26\u6237\u5220\u9664\u5DF2\u53D6\u6D88\uFF0C\u8D26\u6237\u5DF2\u91CD\u65B0\u542F\u7528\u3002\u4E0D\u662F\u60A8\u672C\u4EBA\u64CD\u4F5C\uFF1F\u8BF7\u7ACB\u5373\u66F4\u6539\u5BC6\u7801\u3002`
   }
 };
 
@@ -4569,6 +4975,29 @@ var ZH_HANT_TEMPLATES = {
 \u5DF2\u7121\u6CD5\u518D\u4F7F\u7528 {{provider}} \u767B\u5165\u3002\u60A8\u7684\u96FB\u5B50\u90F5\u4EF6\u548C\u5BC6\u78BC\u4ECD\u53EF\u4F7F\u7528\u3002
 
 \u5982\u679C\u662F\u60A8\u672C\u4EBA\u79FB\u9664\u7684\uFF0C\u7121\u9808\u63A1\u53D6\u4EFB\u4F55\u884C\u52D5\u3002\u5982\u679C\u4E0D\u662F\uFF0C\u8ACB\u7ACB\u5373\u806F\u7D61\u5BA2\u670D\u3002`
+  },
+  [MESSAGE_KEYS.accountDeletionCode]: {
+    subject: `\u78BA\u8A8D\u522A\u9664\u60A8\u7684\u5E33\u6236`,
+    html: `<h1>\u78BA\u8A8D\u522A\u9664\u5E33\u6236</h1>
+<p>\u8ACB\u4F7F\u7528\u6B64\u9A57\u8B49\u78BC\u78BA\u8A8D\u60A8\u8981\u522A\u9664\u5E33\u6236\uFF1A</p>
+<p><span class="pin-code">{{code}}</span></p>
+<p class="muted">\u6B64\u9A57\u8B49\u78BC\u5C07\u5728 15 \u5206\u9418\u5F8C\u5931\u6548\u3002\u5982\u679C\u60A8\u6C92\u6709\u7533\u8ACB\u522A\u9664\u5E33\u6236\uFF0C\u8ACB\u5FFD\u7565\u6B64\u8A0A\u606F\u4E26\u66F4\u6539\u5BC6\u78BC\uFF0C\u60A8\u7684\u5E33\u6236\u5C07\u4FDD\u6301\u4E0D\u8B8A\u3002</p>`,
+    text: `\u78BA\u8A8D\u522A\u9664\u5E33\u6236\u7684\u9A57\u8B49\u78BC\uFF1A{{code}}\uFF0C15 \u5206\u9418\u5167\u6709\u6548\u3002\u4E0D\u662F\u60A8\u672C\u4EBA\u64CD\u4F5C\uFF1F\u8ACB\u5FFD\u7565\u4E26\u66F4\u6539\u5BC6\u78BC\u3002`
+  },
+  [MESSAGE_KEYS.accountDeletionScheduled]: {
+    subject: `\u60A8\u7684\u5E33\u6236\u5C07\u65BC {{deleteOn}} \u522A\u9664`,
+    html: `<h1>\u60A8\u7684\u5E33\u6236\u5DF2\u6392\u5B9A\u522A\u9664</h1>
+<p>\u6211\u5011\u5DF2\u6536\u5230\u60A8\u7684\u7533\u8ACB\u3002\u60A8\u7684\u5E33\u6236\u5DF2\u95DC\u9589\uFF0C\u4E26\u5C07\u65BC <strong>{{deleteOn}}</strong> \u6C38\u4E45\u522A\u9664\u3002</p>
+<p>\u6539\u8B8A\u4E3B\u610F\u4E86\uFF1F\u8ACB\u5728\u8A72\u65E5\u671F\u524D\u767B\u5165\u4E26\u9078\u64C7<strong>\u4FDD\u7559\u6211\u7684\u5E33\u6236</strong>\u3002</p>
+<p class="muted">\u5982\u679C\u9019\u4E0D\u662F\u60A8\u672C\u4EBA\u7684\u7533\u8ACB\uFF0C\u8ACB\u7ACB\u5373\u767B\u5165\u4EE5\u4FDD\u7559\u5E33\u6236\u4E26\u66F4\u6539\u5BC6\u78BC\u3002</p>`,
+    text: `\u60A8\u7684\u5E33\u6236\u5C07\u65BC {{deleteOn}} \u6C38\u4E45\u522A\u9664\u3002\u6539\u8B8A\u4E3B\u610F\u4E86\uFF1F\u8ACB\u5728\u6B64\u524D\u767B\u5165\u4E26\u9078\u64C7\u300C\u4FDD\u7559\u6211\u7684\u5E33\u6236\u300D\u3002`
+  },
+  [MESSAGE_KEYS.accountRestored]: {
+    subject: `\u60A8\u7684\u5E33\u6236\u5DF2\u6062\u5FA9`,
+    html: `<h1>\u6B61\u8FCE\u56DE\u4F86</h1>
+<p>\u60A8\u7684\u5E33\u6236\u522A\u9664\u5DF2\u53D6\u6D88\uFF0C\u5E33\u6236\u5DF2\u91CD\u65B0\u555F\u7528\u3002</p>
+<p class="muted">\u5982\u679C\u4E0D\u662F\u60A8\u672C\u4EBA\u64CD\u4F5C\uFF0C\u8ACB\u7ACB\u5373\u66F4\u6539\u5BC6\u78BC\u3002</p>`,
+    text: `\u60A8\u7684\u5E33\u6236\u522A\u9664\u5DF2\u53D6\u6D88\uFF0C\u5E33\u6236\u5DF2\u91CD\u65B0\u555F\u7528\u3002\u4E0D\u662F\u60A8\u672C\u4EBA\u64CD\u4F5C\uFF1F\u8ACB\u7ACB\u5373\u66F4\u6539\u5BC6\u78BC\u3002`
   }
 };
 
@@ -4727,6 +5156,29 @@ change your password \u2014 someone else may be able to sign in as you.`
 {{provider}} can no longer be used to sign in. Your email and password still work.
 
 If you did this, you're all set. If not, contact support right away.`
+  },
+  [MESSAGE_KEYS.accountDeletionCode]: {
+    subject: `Confirm your account deletion`,
+    html: `<h1>Confirm account deletion</h1>
+<p>Use this code to confirm that you want to delete your account:</p>
+<p><span class="pin-code">{{code}}</span></p>
+<p class="muted">This code expires in 15 minutes. If you didn&rsquo;t ask to delete your account, ignore this message and change your password &mdash; your account stays as it is.</p>`,
+    text: `Your code to confirm deleting your account: {{code}}. It expires in 15 minutes. Didn't ask? Ignore this and change your password.`
+  },
+  [MESSAGE_KEYS.accountDeletionScheduled]: {
+    subject: `Your account will be deleted on {{deleteOn}}`,
+    html: `<h1>Your account is scheduled for deletion</h1>
+<p>We received your request. Your account is closed and will be permanently deleted on <strong>{{deleteOn}}</strong>.</p>
+<p>Changed your mind? Sign in before that date and choose <strong>Keep my account</strong>.</p>
+<p class="muted">If you didn&rsquo;t ask for this, sign in now to keep your account and change your password.</p>`,
+    text: `Your account will be permanently deleted on {{deleteOn}}. Changed your mind? Sign in before then and choose Keep my account.`
+  },
+  [MESSAGE_KEYS.accountRestored]: {
+    subject: `Your account was restored`,
+    html: `<h1>Welcome back</h1>
+<p>Your account deletion was cancelled and your account is active again.</p>
+<p class="muted">If you didn&rsquo;t do this, change your password right away.</p>`,
+    text: `Your account deletion was cancelled; your account is active again. Didn't do this? Change your password now.`
   }
 };
 var DEFAULT_TEMPLATES = withTranslations(EN_TEMPLATES, {
@@ -4752,7 +5204,10 @@ var SAMPLE_PAYLOADS = {
   [MESSAGE_KEYS.mfaDisabled]: {},
   [MESSAGE_KEYS.mfaBackupCodesRegenerated]: {},
   [MESSAGE_KEYS.emailChanged]: { newEmail: "new@example.com" },
-  [MESSAGE_KEYS.phoneChanged]: {}
+  [MESSAGE_KEYS.phoneChanged]: {},
+  [MESSAGE_KEYS.accountDeletionCode]: { code: "123456" },
+  [MESSAGE_KEYS.accountDeletionScheduled]: { deleteOn: "November 3, 2026" },
+  [MESSAGE_KEYS.accountRestored]: {}
 };
 
 // src/middlewares/require-auth.ts