@luckystack/core 0.1.9 → 0.2.0

package/dist/index.js

@@ -1,350 +1,156 @@
-// src/sleep.ts
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
+import {
+  DEFAULT_CSRF_CONFIG,
+  DEFAULT_PAGE_ROUTE_RULES,
+  INVALID_ERROR_RESPONSE_CODE,
+  buildApiResponseEventName,
+  buildApiStreamEventName,
+  buildGetJoinedRoomsResponseEventName,
+  buildJoinRoomResponseEventName,
+  buildLeaveRoomResponseEventName,
+  buildSyncProgressEventName,
+  buildSyncResponseEventName,
+  clearCsrfToken,
+  defaultHttpStatusForResponse,
+  enqueueApiRequest,
+  enqueueSyncRequest,
+  flushApiQueue,
+  flushSyncQueue,
+  getApiQueueSize,
+  getCsrfConfig,
+  getCsrfToken,
+  getEffectiveHttpMethod,
+  getNotifier,
+  getRegisteredApiMethod,
+  getSyncQueueSize,
+  httpFetch,
+  incrementResponseIndex,
+  inferHttpMethod,
+  isApiMethodMapRegistered,
+  isErrorParamArray,
+  isGetMethodName,
+  isMethodAllowed,
+  isOnline,
+  normalizeErrorResponseCore,
+  notify,
+  parseServiceRouteName,
+  parseTransportRouteName,
+  registerApiMethodMap,
+  registerCsrfConfig,
+  registerNotifier,
+  removeApiQueueItem,
+  removeApiQueueItemsByKey,
+  removeSyncQueueItem,
+  resetCsrfConfigForTests,
+  setSocket,
+  sleep,
+  socket,
+  socketEventNames,
+  tryCatch,
+  tryCatchSync,
+  validatePagePath,
+  waitForSocket
+} from "./chunk-OZTB2RL2.js";
+import {
+  DEFAULT_PROJECT_CONFIG,
+  deepMerge,
+  getProjectConfig,
+  getProjectName,
+  isPlainObject,
+  isProjectConfigRegistered,
+  registerProjectConfig
+} from "./chunk-W62GGT2P.js";
+import {
+  DEFAULT_REDACTED_LOG_KEYS,
+  DEPTH_TRUNCATED_PLACEHOLDER,
+  REDACTED_PLACEHOLDER,
+  appendErrorTracker,
+  captureException,
+  captureExceptionAcrossTrackers,
+  captureMessage,
+  captureMessageAcrossTrackers,
+  createDevLogger,
+  flushErrorTrackers,
+  getActiveErrorTrackers,
+  getCurrentErrorTrackerIdentity,
+  getLogger,
+  getRedactedLogKeys,
+  initSharedSentry,
+  isLoggerRegistered,
+  isRedactedLogKey,
+  recordMetricAcrossTrackers,
+  registerErrorTracker,
+  registerErrorTrackers,
+  registerLogger,
+  registerPreCaptureFilter,
+  registerRedactedLogKeys,
+  resetLoggerForTests,
+  resetRedactedLogKeysForTests,
+  runWithErrorTrackerIdentity,
+  runWithErrorTrackerIdentityScope,
+  sanitizeErrorString,
+  sanitizeErrorStrings,
+  sanitizeForLog,
+  setCurrentErrorTrackerIdentity,
+  setErrorTrackerUser,
+  setSentryUser,
+  startSpan,
+  startSpanAcrossTrackers,
+  startSpanHandle
+} from "./chunk-V2WKGTZH.js";
+import {
+  createRegistry
+} from "./chunk-USQA6QTX.js";
 
-// src/errorTrackerRegistry.ts
-var activeTrackers = [];
-var registerErrorTracker = (tracker) => {
-  activeTrackers = [tracker];
-};
-var registerErrorTrackers = (trackers) => {
-  activeTrackers = [...trackers];
-};
-var getActiveErrorTrackers = () => activeTrackers;
-var captureExceptionAcrossTrackers = (error, context) => {
-  for (const tracker of activeTrackers) {
-    try {
-      tracker.captureException(error, context);
-    } catch {
-    }
-  }
-};
-var captureMessageAcrossTrackers = (message, level, context) => {
-  for (const tracker of activeTrackers) {
-    try {
-      tracker.captureMessage(message, level, context);
-    } catch {
-    }
-  }
-};
-var setErrorTrackerUser = (user) => {
-  for (const tracker of activeTrackers) {
-    try {
-      tracker.setUser(user);
-    } catch {
-    }
-  }
-};
-var recordMetricAcrossTrackers = (name, value, tags) => {
-  for (const tracker of activeTrackers) {
-    if (tracker.recordMetric) {
-      try {
-        tracker.recordMetric(name, value, tags);
-      } catch {
-      }
-    }
-  }
-};
-var startSpanAcrossTrackers = (name, op, fn) => {
-  const first = activeTrackers.find((t) => t.startSpan);
-  if (!first?.startSpan) return fn();
-  return first.startSpan(name, op, fn);
-};
+// src/escapeHtml.ts
+var HTML_ESCAPE_MAP = {
+  "&": "&",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+var escapeHtml = (str) => str.replaceAll(/[&<>"']/g, (c) => HTML_ESCAPE_MAP[c] ?? c);
 
-// src/sentrySetup.ts
-var sentry;
-var initSharedSentry = (instance) => {
-  sentry = instance;
-};
-var captureException = (error, context) => {
-  if (sentry) {
-    if (context) {
-      sentry.captureException(error, { extra: context });
-    } else {
-      sentry.captureException(error);
-    }
-  }
-  captureExceptionAcrossTrackers(error, context);
-};
-var captureMessage = (message, level = "info", context) => {
-  if (sentry) {
-    if (context) {
-      sentry.captureMessage(message, { level, extra: context });
-    } else {
-      sentry.captureMessage(message, level);
-    }
-  }
-  captureMessageAcrossTrackers(message, level, context);
-};
-var setSentryUser = (user) => {
-  sentry?.setUser(user);
-  setErrorTrackerUser(user);
-};
-var startSpan = (name, op) => {
-  if (sentry?.startInactiveSpan) {
-    return sentry.startInactiveSpan({ name, op });
-  }
-  startSpanAcrossTrackers(name, op, () => {
-  });
-};
-
-// src/tryCatch.ts
-async function tryCatch(func, params, context) {
+// src/peerDeps.ts
+import { createRequire } from "module";
+var defaultRequire = createRequire(import.meta.url);
+var ensurePeerDepInstalled = (packageName, hint, requireFn = defaultRequire) => {
   try {
-    const response = await func(params);
-    return [null, response];
-  } catch (error) {
-    captureException(error, context);
-    return [error, null];
-  }
-}
-
-// src/serviceRoute.ts
-var VERSION_SEGMENT_REGEX = /^v\d+$/;
-var normalizeRawRoute = (value) => {
-  return value.trim().replaceAll("\\", "/").replaceAll(/^\/+/g, "").replaceAll(/\/+$/g, "");
-};
-var hasEmptySegments = (value) => {
-  return value.split("/").some((segment) => segment.length === 0);
-};
-var parseServiceRouteName = (value) => {
-  const normalized = normalizeRawRoute(value);
-  if (!normalized) {
-    return { status: "error", reason: "Route name cannot be empty." };
-  }
-  if (hasEmptySegments(normalized)) {
-    return { status: "error", reason: "Route name cannot contain empty segments." };
-  }
-  const segments = normalized.split("/");
-  if (segments.length < 2) {
-    return { status: "error", reason: "Route name must include service and route segments." };
-  }
-  const [service, ...routeSegments] = segments;
-  const routeName = routeSegments.join("/");
-  if (!service || !routeName) {
-    return { status: "error", reason: "Route name must include service and route segments." };
-  }
-  return {
-    status: "success",
-    normalizedRouteName: `${service}/${routeName}`,
-    service,
-    routeName
-  };
-};
-var parseTransportRouteName = ({
-  value,
-  prefix
-}) => {
-  const normalized = normalizeRawRoute(value);
-  if (!normalized) {
-    return { status: "error", reason: "Transport route cannot be empty." };
-  }
-  if (hasEmptySegments(normalized)) {
-    return { status: "error", reason: "Transport route cannot contain empty segments." };
-  }
-  const segments = normalized.split("/");
-  const routeSegments = segments[0] === prefix ? segments.slice(1) : segments;
-  if (routeSegments.length < 3) {
-    return {
-      status: "error",
-      reason: `Transport route must use ${prefix}/{service}/{name}/{version} format.`
-    };
-  }
-  const version = routeSegments.at(-1);
-  if (!version || !VERSION_SEGMENT_REGEX.test(version)) {
-    return { status: "error", reason: "Route version segment must match v{number}." };
-  }
-  const serviceRouteToken = routeSegments.slice(0, -1).join("/");
-  const serviceRoute = parseServiceRouteName(serviceRouteToken);
-  if (serviceRoute.status === "error") {
-    return {
-      status: "error",
-      reason: serviceRoute.reason
-    };
+    requireFn.resolve(packageName);
+  } catch {
+    throw new Error(
+      `The \`${packageName}\` package is not installed but a feature that needs it was used. ${hint}`
+    );
   }
-  return {
-    status: "success",
-    normalizedFullName: `${prefix}/${serviceRoute.normalizedRouteName}/${version}`,
-    version,
-    serviceRoute
-  };
 };
-
-// src/socketEvents.ts
-var withIndex = (prefix, responseIndex2) => {
-  return `${prefix}${String(responseIndex2)}`;
-};
-var socketEventNames = {
-  apiRequest: "apiRequest",
-  apiCancel: "apiCancel",
-  sync: "sync",
-  syncCancel: "syncCancel",
-  joinRoom: "joinRoom",
-  leaveRoom: "leaveRoom",
-  getJoinedRooms: "getJoinedRooms",
-  updateLocation: "updateLocation",
-  updateSession: "updateSession",
-  sessionReplaced: "sessionReplaced",
-  logout: "logout",
-  intentionalDisconnect: "intentionalDisconnect",
-  intentionalReconnect: "intentionalReconnect",
-  userAfk: "userAfk",
-  userBack: "userBack",
-  connect: "connect",
-  disconnect: "disconnect",
-  reconnectAttempt: "reconnect_attempt",
-  connectError: "connect_error",
-  apiResponsePrefix: "apiResponse-",
-  apiStreamPrefix: "apiStream-",
-  syncResponsePrefix: "sync-",
-  syncProgressPrefix: "sync-progress-",
-  joinRoomResponsePrefix: "joinRoom-",
-  leaveRoomResponsePrefix: "leaveRoom-",
-  getJoinedRoomsResponsePrefix: "getJoinedRooms-"
-};
-var buildApiResponseEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.apiResponsePrefix, responseIndex2);
-};
-var buildApiStreamEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.apiStreamPrefix, responseIndex2);
-};
-var buildSyncResponseEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.syncResponsePrefix, responseIndex2);
-};
-var buildSyncProgressEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.syncProgressPrefix, responseIndex2);
-};
-var buildJoinRoomResponseEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.joinRoomResponsePrefix, responseIndex2);
-};
-var buildLeaveRoomResponseEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.leaveRoomResponsePrefix, responseIndex2);
-};
-var buildGetJoinedRoomsResponseEventName = (responseIndex2) => {
-  return withIndex(socketEventNames.getJoinedRoomsResponsePrefix, responseIndex2);
+var loadPeer = (packageName, hint, requireFn = defaultRequire) => {
+  ensurePeerDepInstalled(packageName, hint, requireFn);
+  return requireFn(packageName);
 };
 
-// src/responseNormalizer.ts
-var INVALID_ERROR_RESPONSE_CODE = "error.invalidResponse";
-var isErrorParamArray = (value) => {
-  return Array.isArray(value) && value.every((item) => {
-    return !!item && typeof item === "object" && typeof item.key === "string" && ["string", "number", "boolean"].includes(typeof item.value);
-  });
-};
-var normalizeErrorResponseCore = ({
-  response,
-  fallbackHttpStatus,
-  fallbackErrorCode,
-  resolveMessage
-}) => {
-  const normalizedParams = isErrorParamArray(response.errorParams) ? response.errorParams : void 0;
-  const errorCodeValue = typeof response.errorCode === "string" ? response.errorCode.trim() : "";
-  const hasErrorCode = errorCodeValue.length > 0;
-  const finalErrorCode = hasErrorCode ? errorCodeValue : fallbackErrorCode ?? INVALID_ERROR_RESPONSE_CODE;
-  const providedHttpStatus = typeof response.httpStatus === "number" ? response.httpStatus : void 0;
-  const message = resolveMessage ? resolveMessage({ errorCode: finalErrorCode, errorParams: normalizedParams }) : finalErrorCode;
-  return {
-    status: "error",
-    message,
-    errorCode: finalErrorCode,
-    errorParams: normalizedParams,
-    httpStatus: providedHttpStatus ?? fallbackHttpStatus
-  };
-};
-var defaultHttpStatusForResponse = ({
-  status,
-  explicitHttpStatus,
-  fallbackErrorStatus = 400
-}) => {
-  if (typeof explicitHttpStatus === "number") return explicitHttpStatus;
-  return status === "success" ? 200 : fallbackErrorStatus;
-};
-
-// src/loggerRegistry.ts
-var defaultLogger = {
-  debug: (message, context) => {
-    if (context === void 0) {
-      console.debug(message);
-    } else {
-      console.debug(message, context);
-    }
-  },
-  info: (message, context) => {
-    if (context === void 0) {
-      console.info(message);
-    } else {
-      console.info(message, context);
-    }
-  },
-  warn: (message, context) => {
-    if (context === void 0) {
-      console.warn(message);
-    } else {
-      console.warn(message, context);
-    }
-  },
-  error: (message, error, context) => {
-    if (error !== void 0 && context !== void 0) console.error(message, error, context);
-    else if (error !== void 0) console.error(message, error);
-    else if (context === void 0) {
-      console.error(message);
-    } else {
-      console.error(message, context);
-    }
-  }
-};
-var createDevLogger = () => ({
-  debug: (message, context) => {
-    if (context === void 0) {
-      console.log(message, "cyan");
-    } else {
-      console.log(message, context, "cyan");
-    }
-  },
-  info: (message, context) => {
-    if (context === void 0) {
-      console.log(message);
-    } else {
-      console.log(message, context);
-    }
-  },
-  warn: (message, context) => {
-    if (context === void 0) {
-      console.log(message, "yellow");
-    } else {
-      console.log(message, context, "yellow");
-    }
-  },
-  error: (message, error, context) => {
-    if (error !== void 0 && context !== void 0) console.log(message, error, context, "red");
-    else if (error !== void 0) console.log(message, error, "red");
-    else if (context === void 0) {
-      console.log(message, "red");
-    } else {
-      console.log(message, context, "red");
-    }
-  }
-});
-var activeLogger = defaultLogger;
-var isRegistered = false;
-var registerLogger = (logger) => {
-  activeLogger = logger;
-  isRegistered = true;
-};
-var getLogger = () => activeLogger;
-var isLoggerRegistered = () => isRegistered;
-var resetLoggerForTests = () => {
-  activeLogger = defaultLogger;
-  isRegistered = false;
-};
+// src/roomNameFormatterRegistry.ts
+var identityFormatter = (rawRoomName) => rawRoomName;
+var registry = createRegistry(identityFormatter);
+var registerRoomNameFormatter = (formatter2) => {
+  registry.register(formatter2);
+};
+var getRoomNameFormatter = () => registry.get();
+var formatRoomName = (rawRoomName, ctx) => registry.get()(rawRoomName, ctx);
+var defaultRoomNameFormatter = identityFormatter;
 
 // src/hooks/registry.ts
 var hookHandlers = /* @__PURE__ */ new Map();
 var registerHook = (name, handler) => {
   const existing = hookHandlers.get(name) ?? [];
-  existing.push(handler);
+  const wrapped = handler;
+  existing.push(wrapped);
   hookHandlers.set(name, existing);
+  return () => {
+    const handlers = hookHandlers.get(name);
+    if (!handlers) return;
+    const index = handlers.indexOf(wrapped);
+    if (index !== -1) handlers.splice(index, 1);
+  };
 };
 var dispatchHook = async (name, payload) => {
   const handlers = hookHandlers.get(name) ?? [];
@@ -353,8 +159,14 @@ var dispatchHook = async (name, payload) => {
     try {
       result = await handler(payload);
     } catch (error) {
-      getLogger().error(`hook: handler for "${name}" threw`, error, { hook: name });
-      captureException(error, { hook: name });
+      try {
+        getLogger().error(`hook: handler for "${name}" threw`, error, { hook: name });
+      } catch {
+      }
+      try {
+        captureException(error, { hook: name });
+      } catch {
+      }
       continue;
     }
     if (result !== void 0) {
@@ -370,8 +182,15 @@ var clearAllHooks = () => {
 var syncHookHandlers = /* @__PURE__ */ new Map();
 var registerSyncHook = (name, handler) => {
   const existing = syncHookHandlers.get(name) ?? [];
-  existing.push(handler);
+  const wrapped = handler;
+  existing.push(wrapped);
   syncHookHandlers.set(name, existing);
+  return () => {
+    const handlers = syncHookHandlers.get(name);
+    if (!handlers) return;
+    const index = handlers.indexOf(wrapped);
+    if (index !== -1) handlers.splice(index, 1);
+  };
 };
 var dispatchSyncHook = (name, payload) => {
   const handlers = syncHookHandlers.get(name) ?? [];
@@ -379,8 +198,14 @@ var dispatchSyncHook = (name, payload) => {
     try {
       handler(payload);
     } catch (error) {
-      getLogger().error(`hook: sync handler for "${name}" threw`, error, { hook: name });
-      captureException(error, { hook: name });
+      try {
+        getLogger().error(`hook: sync handler for "${name}" threw`, error, { hook: name });
+      } catch {
+      }
+      try {
+        captureException(error, { hook: name });
+      } catch {
+      }
     }
   }
 };
@@ -467,81 +292,33 @@ var resolveErrorMessage = (input) => activeNormalizer.resolveErrorMessage(input)
 var extractLanguageFromHeader = (header) => activeNormalizer.extractLanguageFromHeader(header);
 
 // src/errorFormatterRegistry.ts
-var activeFormatter = null;
+var registry2 = createRegistry(null);
 var registerErrorFormatter = (formatter2) => {
-  activeFormatter = formatter2;
+  registry2.register(formatter2);
 };
-var getErrorFormatter = () => activeFormatter;
+var getErrorFormatter = () => registry2.get();
 var applyErrorFormatter = (input) => {
   const { response, routeName, transport, userId, perRouteFormatter } = input;
   if (response.status !== "error") return response;
   const ctx = { routeName, transport, userId };
   const errorEnvelope = response;
   if (perRouteFormatter) {
-    try {
-      return perRouteFormatter(errorEnvelope, ctx);
-    } catch (error) {
+    const [error, formatted] = tryCatchSync(() => perRouteFormatter(errorEnvelope, ctx));
+    if (!error && formatted) return formatted;
+    if (error) {
       console.error(`[errorFormatter] per-route formatter for ${routeName} threw:`, error);
     }
   }
-  const globalFormatter = activeFormatter;
+  const globalFormatter = registry2.get();
   if (globalFormatter) {
-    try {
-      return globalFormatter(errorEnvelope, ctx);
-    } catch (error) {
-      console.error(`[errorFormatter] global formatter threw on ${routeName}:`, error);
-      return response;
-    }
+    const [error, formatted] = tryCatchSync(() => globalFormatter(errorEnvelope, ctx));
+    if (!error && formatted) return formatted;
+    console.error(`[errorFormatter] global formatter threw on ${routeName}:`, error);
+    return response;
   }
   return response;
 };
 
-// src/pageRouteValidation.ts
-var DEFAULT_PAGE_ROUTE_RULES = {
-  privateFolderPrefix: "_",
-  scaffoldIgnoredFolders: [
-    "_api",
-    "_sync",
-    "_function",
-    "_functions",
-    "_component",
-    "_components",
-    "_provider",
-    "_providers",
-    "_locale",
-    "_locales",
-    "_socket",
-    "_sockets",
-    "_shared",
-    "_server"
-  ]
-};
-var validatePagePath = (srcRelativePath, rules = DEFAULT_PAGE_ROUTE_RULES) => {
-  const normalized = srcRelativePath.replaceAll("\\", "/").replace(/^\.\//, "").replace(/^\/+/, "");
-  const segments = normalized.split("/").filter((segment) => segment.length > 0);
-  if (segments.length === 0) {
-    return { valid: false, reason: "empty path" };
-  }
-  const filename = segments.at(-1);
-  if (filename !== "page.tsx" && filename !== "page.jsx") {
-    return { valid: false, reason: "not a page file (expected page.tsx)" };
-  }
-  const folderSegments = segments.slice(0, -1);
-  const prefix = rules.privateFolderPrefix;
-  const reserved = rules.scaffoldIgnoredFolders;
-  for (const reservedName of reserved) {
-    if (folderSegments.includes(reservedName)) {
-      return { valid: false, reason: `page.tsx cannot live inside reserved folder ${reservedName}` };
-    }
-  }
-  const visibleSegments = folderSegments.filter((segment) => !segment.startsWith(prefix));
-  if (folderSegments.length > 0 && visibleSegments.length === 0) {
-    return { valid: false, reason: "no URL segment left after stripping underscore folders" };
-  }
-  const route = visibleSegments.length === 0 ? "/" : `/${visibleSegments.join("/")}`;
-  return { valid: true, route };
-};
-
 // src/socketTypes.ts
 var _ioInstance = null;
 var setIoInstance = (io) => {
@@ -549,288 +326,80 @@ var setIoInstance = (io) => {
 };
 var getIoInstance = () => _ioInstance;
 
-// src/projectConfig.ts
-var DEFAULT_PROJECT_CONFIG = {
-  app: {
-    publicUrl: ""
-  },
-  logging: {
-    devLogs: false,
-    devNotifications: false,
-    socketStatus: false,
-    socketStartup: false,
-    stream: false
-  },
-  rateLimiting: {
-    enabled: true,
-    store: "memory",
-    redisKeyPrefix: "rate-limit",
-    defaultApiLimit: 60,
-    defaultIpLimit: 100,
-    windowMs: 6e4,
-    cleanupIntervalMs: 6e4
-  },
-  session: {
-    basedToken: false,
-    expiryDays: 7,
-    allowMultiple: false,
-    perBrowser: "single",
-    perUser: "single",
-    maxConcurrentPerUser: null,
-    onConflict: "revokeOld",
-    notifyOldDeviceOnRevoke: true,
-    //? Empty default — `getProjectName()` reads `process.env.PROJECT_NAME` at
-    //? call time and falls back to `'luckystack'`. Avoids capturing env at
-    //? module-load before dotenv runs.
-    projectName: ""
-  },
-  http: {
-    sessionCookieName: "token",
-    sessionCookieSameSite: "Strict",
-    sessionCookiePath: "/",
-    requestBodyMaxBytes: 1024 * 1024,
-    healthEndpoint: "/_health",
-    liveEndpoint: "/livez",
-    readyEndpoint: "/readyz",
-    testResetEndpoint: "/_test/reset",
-    stream: {
-      queryParam: "stream",
-      enabledValue: "true",
-      connectedComment: ": connected"
-    },
-    securityHeaders: {
-      frameOptions: "SAMEORIGIN",
-      referrerPolicy: "no-referrer",
-      xssProtection: "1; mode=block",
-      contentTypeOptions: "nosniff"
-    },
-    cors: {
-      allowedMethods: "GET, POST, PUT, DELETE, OPTIONS",
-      allowedHeaders: "Content-Type, Authorization, X-Session-Based-Token, X-CSRF-Token, X-Request-Id",
-      exposedHeaders: "X-Session-Token, X-Request-Id",
-      credentials: true,
-      allowedOrigins: [],
-      allowLocalhost: false
-    }
-  },
-  auth: {
-    oauthStateTtlSeconds: 60 * 10,
-    passwordMinLength: 8,
-    passwordMaxLength: 191,
-    passwordPolicy: {
-      minLength: 8,
-      maxLength: 191,
-      requireUppercase: false,
-      requireLowercase: false,
-      requireNumber: false,
-      requireSpecial: false,
-      forbidCommon: true
-    },
-    emailMaxLength: 191,
-    nameMaxLength: 191,
-    bcryptRounds: 10,
-    providerAccountStrategy: "per-provider",
-    forgotPassword: "disabled",
-    passwordResetTtlSeconds: 60 * 60,
-    emailChangeTtlSeconds: 60 * 60
-  },
-  socket: {
-    maxHttpBufferSize: 5 * 1024 * 1024,
-    pingTimeout: 2e4,
-    pingInterval: 25e3
-  },
-  sync: {
-    streamThrottle: {
-      flushAtChars: 32,
-      flushEveryMs: 50,
-      field: "chunk"
-    },
-    fanoutYieldEvery: 100,
-    fanoutYieldMs: 1
-  },
-  offlineQueue: {
-    maxSize: 200,
-    maxAgeMs: 60 * 60 * 1e3,
-    dropPolicy: "drop-oldest"
-  },
-  dev: {
-    hotReloadDebounceMs: 120,
-    watcherStabilityThresholdMs: 120,
-    watcherPollIntervalMs: 20
-  },
-  paths: {
-    srcDir: "src",
-    serverDir: "server",
-    sharedDir: "shared",
-    uploadsDir: "uploads",
-    publicDir: "public",
-    serverFunctionsDir: "server/functions",
-    serverFunctionDirs: ["functions", "shared"],
-    generatedSocketTypes: "src/_sockets/apiTypes.generated.ts",
-    generatedApiSchemas: "src/_sockets/apiInputSchemas.generated.ts",
-    generatedApiDocs: "src/docs/apiDocs.generated.json"
-  },
-  defaultLanguage: "en",
-  defaultTheme: "light",
-  socketActivityBroadcaster: false,
-  socketStatusIndicator: false,
-  locationProviderEnabled: false,
-  loginRedirectUrl: "/"
-};
-var isPlainObject = (value) => {
-  if (value === null || typeof value !== "object") return false;
-  const proto = Object.getPrototypeOf(value);
-  return proto === Object.prototype || proto === null;
-};
-var deepMerge = (base, override) => {
-  if (override === void 0) return base;
-  if (!isPlainObject(base) || !isPlainObject(override)) {
-    return override ?? base;
-  }
-  const result = { ...base };
-  for (const [key, overrideValue] of Object.entries(override)) {
-    if (overrideValue === void 0) continue;
-    const baseValue = base[key];
-    result[key] = isPlainObject(baseValue) && isPlainObject(overrideValue) ? deepMerge(baseValue, overrideValue) : overrideValue;
-  }
-  return result;
-};
-var activeConfig = DEFAULT_PROJECT_CONFIG;
-var isRegistered2 = false;
-var registerProjectConfig = (config) => {
-  activeConfig = deepMerge(DEFAULT_PROJECT_CONFIG, config);
-  isRegistered2 = true;
-};
-var getProjectConfig = () => activeConfig;
-var getProjectName = () => {
-  const fromConfig = activeConfig.session.projectName;
-  if (fromConfig && fromConfig.length > 0) return fromConfig;
-  const fromEnv = process.env.PROJECT_NAME;
-  if (fromEnv && fromEnv.length > 0) return fromEnv;
-  return "luckystack";
-};
-var isProjectConfigRegistered = () => isRegistered2;
-
 // src/runtimeMapsRegistry.ts
 var emptyApi = { apisObject: {}, functionsObject: {} };
 var emptySync = { syncObject: {}, functionsObject: {} };
-var activeProvider = {
+var registry3 = createRegistry({
   getRuntimeApiMaps: () => Promise.resolve(emptyApi),
   getRuntimeSyncMaps: () => Promise.resolve(emptySync)
+});
+var registerRuntimeMapsProvider = (provider2) => {
+  registry3.register(provider2);
 };
-var providerRegistered = false;
-var registerRuntimeMapsProvider = (provider) => {
-  activeProvider = provider;
-  providerRegistered = true;
-};
-var isRuntimeMapsProviderRegistered = () => providerRegistered;
-var getRuntimeApiMaps = async () => activeProvider.getRuntimeApiMaps();
-var getRuntimeSyncMaps = async () => activeProvider.getRuntimeSyncMaps();
-
-// src/apiMethodMapRegistry.ts
-var activeMap = null;
-var registerApiMethodMap = (map) => {
-  activeMap = map;
-};
-var getRegisteredApiMethod = (pagePath, apiName, version) => {
-  if (!activeMap) return void 0;
-  return activeMap[pagePath]?.[apiName]?.[version];
-};
-var isApiMethodMapRegistered = () => activeMap !== null;
-
-// src/notifier.ts
-var noopNotifier = {
-  success: () => {
-  },
-  error: () => {
-  },
-  info: () => {
-  },
-  warning: () => {
-  }
-};
-var activeNotifier = noopNotifier;
-var registerNotifier = (notifier) => {
-  activeNotifier = notifier;
-};
-var getNotifier = () => activeNotifier;
-var notify = {
-  success: (input) => {
-    activeNotifier.success(input);
-  },
-  error: (input) => {
-    activeNotifier.error(input);
-  },
-  info: (input) => {
-    activeNotifier.info(input);
-  },
-  warning: (input) => {
-    activeNotifier.warning(input);
-  }
-};
+var isRuntimeMapsProviderRegistered = () => registry3.isRegistered();
+var getRuntimeApiMaps = async () => registry3.get().getRuntimeApiMaps();
+var getRuntimeSyncMaps = async () => registry3.get().getRuntimeSyncMaps();
 
 // src/emailRegistry.ts
 var activeSender = null;
-var registry = {};
+var registry4 = {};
 var registerEmailSender = (sender) => {
   activeSender = sender;
-  registry = { ...registry, default: sender };
+  registry4 = { ...registry4, default: sender };
 };
 var registerEmailSenders = (senders) => {
-  registry = { ...senders };
+  registry4 = { ...senders };
   if (senders.default) {
     activeSender = senders.default;
   }
 };
-var getEmailSender = () => activeSender ?? registry.default ?? null;
+var getEmailSender = () => activeSender ?? registry4.default ?? null;
 var getEmailSenderByName = (name) => {
-  if (registry[name]) return registry[name];
+  if (registry4[name]) return registry4[name];
   if (name === "default" && activeSender) return activeSender;
   return null;
 };
-var listEmailSenderNames = () => Object.keys(registry);
-var isEmailSenderRegistered = () => activeSender !== null || Object.keys(registry).length > 0;
+var listEmailSenderNames = () => Object.keys(registry4);
+var isEmailSenderRegistered = () => activeSender !== null || Object.keys(registry4).length > 0;
 
 // src/deployConfigRegistry.ts
 var DEFAULT_DEPLOY_CONFIG = {
   resources: {}
 };
-var activeConfig2 = DEFAULT_DEPLOY_CONFIG;
-var registered = false;
-var registerDeployConfig = (config) => {
-  activeConfig2 = config;
-  registered = true;
-  return activeConfig2;
-};
-var getDeployConfig = () => activeConfig2;
-var isDeployConfigRegistered = () => registered;
+var registry5 = createRegistry(DEFAULT_DEPLOY_CONFIG);
+var registerDeployConfig = (config) => registry5.register(config);
+var getDeployConfig = () => registry5.get();
+var isDeployConfigRegistered = () => registry5.isRegistered();
 
 // src/servicesConfigRegistry.ts
-var activeServicesConfig = null;
-var registerServicesConfig = (config) => {
-  activeServicesConfig = config;
-  return activeServicesConfig;
-};
-var getServicesConfig = () => {
-  if (!activeServicesConfig) {
-    throw new Error(
-      "@luckystack/core: services config has not been registered. Call `registerServicesConfig({...})` from your `services.config.ts` (which should be imported as a side-effect during boot)."
-    );
+var registry6 = createRegistry(
+  //? Unregistered sentinel — `get` never returns this because `resolveDefault`
+  //? throws first. Typed as the real shape so the slot stays well-typed.
+  { services: {}, presets: {} },
+  {
+    resolveDefault: () => {
+      throw new Error(
+        "@luckystack/core: services config has not been registered. Call `registerServicesConfig({...})` from your `services.config.ts` (which should be imported as a side-effect during boot)."
+      );
+    }
   }
-  return activeServicesConfig;
-};
-var isServicesConfigRegistered = () => activeServicesConfig !== null;
+);
+var registerServicesConfig = (config) => registry6.register(config);
+var getServicesConfig = () => registry6.get();
+var isServicesConfigRegistered = () => registry6.isRegistered();
 
 // src/localeReloader.ts
-var activeReloader = null;
+var registry7 = createRegistry(null);
 var registerLocaleReloader = (reloader) => {
-  activeReloader = reloader;
+  registry7.register(reloader);
   return reloader;
 };
-var getLocaleReloader = () => activeReloader;
+var getLocaleReloader = () => registry7.get();
 
 // src/env.ts
-import { config as loadDotenv } from "dotenv";
+import { existsSync, readFileSync } from "fs";
+import path from "path";
+import { config as loadDotenv, parse as parseDotenv } from "dotenv";
 import { z } from "zod";
 var EnvSchema = z.object({
   NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
@@ -851,10 +420,33 @@ var getEnvFiles = () => {
   }
   return DEFAULT_ENV_FILES;
 };
+var reportDuplicateEnvKeys = (files) => {
+  const seenIn = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const filePath = path.resolve(process.cwd(), file);
+    if (!existsSync(filePath)) continue;
+    const parsed = parseDotenv(readFileSync(filePath, "utf8"));
+    for (const key of Object.keys(parsed)) {
+      const list = seenIn.get(key) ?? [];
+      list.push(file);
+      seenIn.set(key, list);
+    }
+  }
+  for (const [key, sources] of seenIn) {
+    if (sources.length > 1) {
+      const winner = sources.at(-1);
+      console.warn(`[env] "${key}" is defined in ${sources.join(" + ")}; "${winner}" wins. Removing it from only one file lets the other file's value resurface.`);
+    }
+  }
+};
 var loadEnvFiles = () => {
-  for (const [index, file] of getEnvFiles().entries()) {
+  const files = getEnvFiles();
+  for (const [index, file] of files.entries()) {
     loadDotenv({ path: file, override: index > 0 });
   }
+  if (process.env.LUCKYSTACK_ENV_DEBUG) {
+    reportDuplicateEnvKeys(files);
+  }
 };
 var applyResolvedDefaultsToProcessEnv = (resolvedEnv) => {
   process.env.NODE_ENV = process.env.NODE_ENV ?? resolvedEnv.NODE_ENV;
@@ -881,6 +473,7 @@ var bootstrapEnv = () => {
 };
 var env = bootstrapEnv();
 var isProduction = env.NODE_ENV === "production";
+var getEnv = () => bootstrapEnv();
 
 // src/db.ts
 import { PrismaClient } from "@prisma/client";
@@ -938,9 +531,6 @@ var buildDefaultPrismaClient = () => {
   return globalThis.__luckystackPrisma;
 };
 setDefaultPrismaResolver(buildDefaultPrismaClient);
-if (process.env.NODE_ENV !== "production") {
-  buildDefaultPrismaClient();
-}
 var prisma = new Proxy({}, {
   //? Bind methods to the real client so a CAPTURED method keeps its `this`.
   //? Without binding, a detached call (`const q = prisma.$queryRaw; q(...)`)
@@ -951,9 +541,9 @@ var prisma = new Proxy({}, {
   //? Mirrors the `redis` proxy. Non-function reads (model delegates like
   //? `prisma.user`) pass through untouched, so their methods bind to the
   //? delegate as before.
-  get: (_target, prop, receiver) => {
+  get: (_target, prop, _receiver) => {
     const real = getPrismaClient();
-    const value = Reflect.get(real, prop, receiver);
+    const value = Reflect.get(real, prop, real);
     if (typeof value !== "function") return value;
     const fn = value;
     return fn.bind(real);
@@ -984,22 +574,31 @@ var applyStrayKeyPrefix = (key) => key.includes(":") ? key : `${getProjectName()
 
 // src/redis.ts
 var cachedDefault = null;
-var MAX_REDIS_RECONNECT_ATTEMPTS = 50;
+var DEFAULT_MAX_REDIS_RECONNECT_ATTEMPTS = 50;
+var DEFAULT_MAX_REDIS_BACKOFF_MS = 2e3;
+var readPositiveIntEnv = (name, fallback) => {
+  const raw = process.env[name];
+  if (!raw) return fallback;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+};
 var buildDefaultRedisClient = () => {
   if (cachedDefault) return cachedDefault;
+  const maxReconnectAttempts = readPositiveIntEnv("LUCKYSTACK_REDIS_MAX_RECONNECTS", DEFAULT_MAX_REDIS_RECONNECT_ATTEMPTS);
+  const maxBackoffMs = readPositiveIntEnv("LUCKYSTACK_REDIS_MAX_BACKOFF_MS", DEFAULT_MAX_REDIS_BACKOFF_MS);
   cachedDefault = new Redis({
     host: env.REDIS_HOST,
     port: Number.parseInt(env.REDIS_PORT, 10),
     ...process.env.REDIS_USER && { username: process.env.REDIS_USER },
     ...process.env.REDIS_PASSWORD && { password: process.env.REDIS_PASSWORD },
     retryStrategy(times) {
-      if (times > MAX_REDIS_RECONNECT_ATTEMPTS) {
+      if (times > maxReconnectAttempts) {
         getLogger().error(
-          `Redis unreachable after ${String(MAX_REDIS_RECONNECT_ATTEMPTS)} reconnect attempts; giving up. Check REDIS_HOST / REDIS_PORT / credentials and that Redis is reachable.`
+          `Redis unreachable after ${String(maxReconnectAttempts)} reconnect attempts; giving up. Check REDIS_HOST / REDIS_PORT / credentials and that Redis is reachable. Raise LUCKYSTACK_REDIS_MAX_RECONNECTS for longer outage tolerance.`
         );
         return null;
       }
-      return Math.min(times * 50, 2e3);
+      return Math.min(times * 50, maxBackoffMs);
     }
   });
   cachedDefault.on("ready", async () => {
@@ -1074,13 +673,32 @@ var STRAY_PREFIX_COMMANDS = /* @__PURE__ */ new Set([
   "setbit",
   "bitcount"
 ]);
+var ALL_ARGS_ARE_KEYS_COMMANDS = /* @__PURE__ */ new Set([
+  "del",
+  "unlink",
+  "exists",
+  "touch",
+  "mget"
+]);
+var registerStrayPrefixCommand = (...commands) => {
+  for (const command of commands) {
+    STRAY_PREFIX_COMMANDS.add(command.toLowerCase());
+  }
+};
 var redisProxy = new Proxy({}, {
-  get: (_target, prop, receiver) => {
+  get: (_target, prop, _receiver) => {
     const real = getRedisClient();
-    const value = Reflect.get(real, prop, receiver);
+    const value = Reflect.get(real, prop, real);
     if (typeof value !== "function") return value;
     const fn = value;
-    if (typeof prop === "string" && STRAY_PREFIX_COMMANDS.has(prop.toLowerCase())) {
+    const command = typeof prop === "string" ? prop.toLowerCase() : "";
+    if (command && ALL_ARGS_ARE_KEYS_COMMANDS.has(command)) {
+      return (...args) => {
+        const prefixed = args.map((arg) => typeof arg === "string" ? applyStrayKeyPrefix(arg) : arg);
+        return fn.apply(real, prefixed);
+      };
+    }
+    if (command && STRAY_PREFIX_COMMANDS.has(command)) {
       return (...args) => {
         if (args.length > 0 && typeof args[0] === "string") {
           args[0] = applyStrayKeyPrefix(args[0]);
@@ -1093,6 +711,7 @@ var redisProxy = new Proxy({}, {
   has: (_target, prop) => Reflect.has(getRedisClient(), prop)
 });
 var redis = redisProxy;
+var redis_default = redisProxy;
 
 // src/lease.ts
 import { randomBytes } from "crypto";
@@ -1136,16 +755,16 @@ var releaseLease = async (name, token) => {
 
 // src/socketRedisAdapter.ts
 import { createAdapter } from "@socket.io/redis-adapter";
-var attachSocketRedisAdapter = (io) => {
-  const pubClient = redis.duplicate();
-  const subClient = redis.duplicate();
+var attachSocketRedisAdapter = (io, options = {}) => {
+  const pubClient = options.pubClient ?? redis.duplicate();
+  const subClient = options.subClient ?? redis.duplicate();
   pubClient.on("error", (err) => {
     getLogger().error("[socket-redis-adapter] pub client error", err);
   });
   subClient.on("error", (err) => {
     getLogger().error("[socket-redis-adapter] sub client error", err);
   });
-  io.adapter(createAdapter(pubClient, subClient));
+  io.adapter(createAdapter(pubClient, subClient, options.adapterOptions));
 };
 
 // src/bootUuid.ts
@@ -1168,9 +787,32 @@ var readBootUuid = async (envKey) => {
 };
 
 // src/synchronizedEnvHashes.ts
-import { createHash } from "crypto";
-var hashValue = (value) => {
-  return createHash("sha256").update(value).digest("hex");
+import { createHash, createHmac } from "crypto";
+var plainHash = (value) => createHash("sha256").update(value).digest("hex");
+var hashSynchronizedValueWith = (config, value) => {
+  const { mode, salt } = config;
+  if (mode === "plain" || salt.length === 0) return plainHash(value);
+  if (mode === "salted") return createHash("sha256").update(salt).update(value).digest("hex");
+  return createHmac("sha256", salt).update(value).digest("hex");
+};
+var resolveHealthHashConfig = (bootUuid) => {
+  const { mode, salt } = getProjectConfig().http.healthHash;
+  if (salt === "@bootUuid") {
+    if ((mode === "salted" || mode === "hmac") && bootUuid && bootUuid.length > 0) {
+      return { mode, salt: bootUuid };
+    }
+    return { mode: "plain", salt: "" };
+  }
+  return { mode, salt };
+};
+var describeHealthHashConfig = () => {
+  const { mode, salt } = getProjectConfig().http.healthHash;
+  return { mode, bootUuidSalt: salt === "@bootUuid" };
+};
+var resolveHealthHashConfigFromDescriptor = (descriptor, bootUuid) => {
+  if (descriptor.mode === "plain") return { mode: "plain", salt: "" };
+  if (descriptor.bootUuidSalt) return { mode: descriptor.mode, salt: bootUuid };
+  return null;
 };
 var collectSynchronizedEnvKeys = () => {
   const keys = /* @__PURE__ */ new Set();
@@ -1181,16 +823,17 @@ var collectSynchronizedEnvKeys = () => {
   }
   return [...keys].toSorted();
 };
-var computeSynchronizedEnvHashes = () => {
+var computeSynchronizedEnvHashes = (bootUuid) => {
   const keys = collectSynchronizedEnvKeys();
+  const config = resolveHealthHashConfig(bootUuid);
   const out = {};
   for (const key of keys) {
     const value = process.env[key];
-    out[key] = value === void 0 ? null : hashValue(value);
+    out[key] = value === void 0 ? null : hashSynchronizedValueWith(config, value);
   }
   return out;
 };
-var hashSynchronizedValue = (value) => hashValue(value);
+var hashSynchronizedValue = (value, bootUuid) => hashSynchronizedValueWith(resolveHealthHashConfig(bootUuid), value);
 
 // src/consoleLog.ts
 var COLORS = {
@@ -1226,13 +869,10 @@ var initConsolelog = () => {
     }
     const extractedInfo = extractFrameLabel(frame);
     let colorCode = COLORS.white;
-    for (const key of Object.keys(COLORS)) {
-      const index = args.indexOf(key);
-      if (index !== -1) {
-        colorCode = COLORS[key];
-        args.splice(index, 1);
-        break;
-      }
+    const lastArg = args.at(-1);
+    if (typeof lastArg === "string" && Object.prototype.hasOwnProperty.call(COLORS, lastArg)) {
+      colorCode = COLORS[lastArg];
+      args.pop();
     }
     if (typeof args[0] === "object") {
       originalLog(`${colorCode}${extractedInfo}${COLORS.reset}`);
@@ -1243,33 +883,6 @@ var initConsolelog = () => {
   };
 };
 
-// src/redactedLogKeys.ts
-var DEFAULT_REDACTED_LOG_KEYS = [
-  "password",
-  "confirmpassword",
-  "token",
-  "newtoken",
-  "authorization",
-  "cookie",
-  "set-cookie"
-];
-var redactedKeys = new Set(DEFAULT_REDACTED_LOG_KEYS.map((key) => key.toLowerCase()));
-var registerRedactedLogKeys = (keys) => {
-  for (const key of keys) {
-    redactedKeys.add(key.toLowerCase());
-  }
-};
-var getRedactedLogKeys = () => [...redactedKeys];
-var isRedactedLogKey = (key) => {
-  return redactedKeys.has(key.toLowerCase());
-};
-var resetRedactedLogKeysForTests = () => {
-  redactedKeys.clear();
-  for (const key of DEFAULT_REDACTED_LOG_KEYS) {
-    redactedKeys.add(key.toLowerCase());
-  }
-};
-
 // src/cookies.ts
 var escapeRegExp = (value) => {
   return value.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
@@ -1294,52 +907,38 @@ var getCookieValue = (cookieHeader, cookieName) => {
 var hasCookie = (cookieHeader, cookieName) => {
   return getCookieValue(cookieHeader, cookieName) !== null;
 };
-
-// src/httpApiUtils.ts
-var inferHttpMethod = (apiName) => {
-  const nameParts = apiName.split("/");
-  const lastPart = nameParts.at(-1)?.toLowerCase() ?? "";
-  const methodName = /^v\d+$/.test(lastPart) ? (nameParts.at(-2) ?? "").toLowerCase() : lastPart;
-  if (methodName.startsWith("get") || methodName.startsWith("fetch") || methodName.startsWith("list")) {
-    return "GET";
+var applyCookiePrefixConstraints = (baseName, prefix, secureOverride) => {
+  if (prefix === "__Host-") {
+    return { name: `__Host-${baseName}`, secure: true, forcePathRoot: true, forbidDomain: true };
   }
-  if (methodName.startsWith("delete") || methodName.startsWith("remove")) {
-    return "DELETE";
+  if (prefix === "__Secure-") {
+    return { name: `__Secure-${baseName}`, secure: true, forcePathRoot: false, forbidDomain: false };
   }
-  if (methodName.startsWith("update") || methodName.startsWith("edit") || methodName.startsWith("patch")) {
-    return "PUT";
-  }
-  return "POST";
-};
-var getEffectiveHttpMethod = (apiConfig, apiName) => {
-  return apiConfig.httpMethod ?? inferHttpMethod(apiName);
-};
-var isMethodAllowed = (requestMethod, allowedMethod) => {
-  return requestMethod === allowedMethod || requestMethod === "OPTIONS";
+  return { name: baseName, secure: secureOverride ?? false, forcePathRoot: false, forbidDomain: false };
 };
 
 // src/paths.ts
-import path from "path";
+import path2 from "path";
 import fs from "fs";
 import { fileURLToPath } from "url";
 var __filename = fileURLToPath(import.meta.url);
-var __dirname = path.dirname(__filename);
+var __dirname = path2.dirname(__filename);
 var isWorkspaceRoot = (candidate) => {
-  return fs.existsSync(path.join(candidate, "package.json")) && (fs.existsSync(path.join(candidate, "tsconfig.json")) || fs.existsSync(path.join(candidate, "tsconfig.server.json")));
+  return fs.existsSync(path2.join(candidate, "package.json")) && (fs.existsSync(path2.join(candidate, "tsconfig.json")) || fs.existsSync(path2.join(candidate, "tsconfig.server.json")));
 };
 var findWorkspaceRoot = (startDir) => {
-  let current = path.resolve(startDir);
+  let current = path2.resolve(startDir);
   while (true) {
     if (isWorkspaceRoot(current)) {
       return current;
     }
-    const parent = path.dirname(current);
+    const parent = path2.dirname(current);
     if (parent === current) return null;
     current = parent;
   }
 };
 var ROOT_DIR = findWorkspaceRoot(process.cwd()) ?? findWorkspaceRoot(__dirname) ?? process.cwd();
-var resolveAgainstRoot = (relative) => path.isAbsolute(relative) ? relative : path.join(ROOT_DIR, relative);
+var resolveAgainstRoot = (relative) => path2.isAbsolute(relative) ? relative : path2.join(ROOT_DIR, relative);
 var getSrcDir = () => resolveAgainstRoot(getProjectConfig().paths.srcDir);
 var getServerDir = () => resolveAgainstRoot(getProjectConfig().paths.serverDir);
 var getSharedDir = () => resolveAgainstRoot(getProjectConfig().paths.sharedDir);
@@ -1364,17 +963,17 @@ var getServerFunctionsDir = () => {
 var getGeneratedSocketTypesPath = () => resolveAgainstRoot(getProjectConfig().paths.generatedSocketTypes);
 var getGeneratedApiSchemasPath = () => resolveAgainstRoot(getProjectConfig().paths.generatedApiSchemas);
 var getGeneratedApiDocsPath = () => resolveAgainstRoot(getProjectConfig().paths.generatedApiDocs);
-var SRC_DIR = path.join(ROOT_DIR, "src");
-var SERVER_DIR = path.join(ROOT_DIR, "server");
-var SHARED_DIR = path.join(ROOT_DIR, "shared");
-var UPLOADS_DIR = path.join(ROOT_DIR, "uploads");
-var PUBLIC_DIR = path.join(ROOT_DIR, "public");
-var SERVER_FUNCTIONS_DIR = path.join(SERVER_DIR, "functions");
-var GENERATED_SOCKET_TYPES_PATH = path.join(SRC_DIR, "_sockets", "apiTypes.generated.ts");
-var GENERATED_API_SCHEMAS_PATH = path.join(SRC_DIR, "_sockets", "apiInputSchemas.generated.ts");
-var GENERATED_API_DOCS_PATH = path.join(SRC_DIR, "docs", "apiDocs.generated.json");
+var SRC_DIR = path2.join(ROOT_DIR, "src");
+var SERVER_DIR = path2.join(ROOT_DIR, "server");
+var SHARED_DIR = path2.join(ROOT_DIR, "shared");
+var UPLOADS_DIR = path2.join(ROOT_DIR, "uploads");
+var PUBLIC_DIR = path2.join(ROOT_DIR, "public");
+var SERVER_FUNCTIONS_DIR = path2.join(SERVER_DIR, "functions");
+var GENERATED_SOCKET_TYPES_PATH = path2.join(SRC_DIR, "_sockets", "apiTypes.generated.ts");
+var GENERATED_API_SCHEMAS_PATH = path2.join(SRC_DIR, "_sockets", "apiInputSchemas.generated.ts");
+var GENERATED_API_DOCS_PATH = path2.join(SRC_DIR, "docs", "apiDocs.generated.json");
 var TSCONFIG_ALIAS_FILES = ["tsconfig.server.json", "tsconfig.client.json"];
-var resolveFromRoot = (...segments) => path.join(ROOT_DIR, ...segments);
+var resolveFromRoot = (...segments) => path2.join(ROOT_DIR, ...segments);
 
 // src/socketMiddlewareRegistry.ts
 var middlewares = [];
@@ -1391,50 +990,30 @@ var applySocketMiddlewares = (io) => {
   }
 };
 
-// src/csrfConfig.ts
-var DEFAULT_CSRF_CONFIG = {
-  cookieName: "csrf-token",
-  headerName: "x-csrf-token",
-  tokenLength: 32,
-  cookieOptions: {
-    sameSite: "lax",
-    secure: true,
-    httpOnly: false,
-    path: "/",
-    maxAgeMs: 24 * 60 * 60 * 1e3
-  }
-};
-var active = DEFAULT_CSRF_CONFIG;
-var registerCsrfConfig = (input) => {
-  active = {
-    ...active,
-    ...input,
-    cookieOptions: { ...active.cookieOptions, ...input.cookieOptions }
-  };
-};
-var getCsrfConfig = () => active;
-var resetCsrfConfigForTests = () => {
-  active = DEFAULT_CSRF_CONFIG;
-};
-
 // src/serveAvatars.ts
-import path2 from "path";
+import path3 from "path";
 import { access } from "fs/promises";
 import fs2 from "fs";
+import stream from "stream";
 
 // src/avatarConfig.ts
 var DEFAULT_AVATAR_CONFIG = {
   formats: [{ extension: "webp", contentType: "image/webp" }],
   cacheControl: "public, max-age=86400"
 };
-var activeConfig3 = DEFAULT_AVATAR_CONFIG;
-var registerAvatarConfig = (config) => {
-  activeConfig3 = {
+var registry8 = createRegistry(DEFAULT_AVATAR_CONFIG, {
+  //? Bespoke merge (not a generic deep-merge): an empty `formats` array falls
+  //? back to the default formats rather than wiping serving. Built fresh from
+  //? the defaults each call, matching the historical behaviour.
+  transform: (config) => ({
     formats: config.formats?.length ? config.formats : DEFAULT_AVATAR_CONFIG.formats,
     cacheControl: config.cacheControl ?? DEFAULT_AVATAR_CONFIG.cacheControl
-  };
+  })
+});
+var registerAvatarConfig = (config) => {
+  registry8.register(config);
 };
-var getAvatarConfig = () => activeConfig3;
+var getAvatarConfig = () => registry8.get();
 
 // src/serveAvatars.ts
 var FILE_ID_REGEX = /^[A-Za-z0-9_-]{1,128}$/;
@@ -1443,22 +1022,33 @@ var serveAvatar = async ({
   res
 }) => {
   const uploadsFolder = getUploadsDir();
-  const fileId = path2.basename(routePath, path2.extname(routePath));
+  const fileId = path3.basename(routePath, path3.extname(routePath));
   if (!fileId || !FILE_ID_REGEX.test(fileId)) {
     res.writeHead(404, { "Content-Type": "text/plain" });
     res.end("File not found");
     return;
   }
+  const preDispatch = await dispatchHook("preAvatarServe", { routePath, fileId });
+  if (preDispatch.stopped) {
+    res.writeHead(404, { "Content-Type": "text/plain" });
+    res.end("File not found");
+    return;
+  }
   const { formats, cacheControl } = getAvatarConfig();
   for (const { extension, contentType } of formats) {
-    const filePath = path2.join(uploadsFolder, `${fileId}.${extension}`);
+    const filePath = path3.join(uploadsFolder, `${fileId}.${extension}`);
     const [accessError] = await tryCatch(() => access(filePath));
     if (accessError) continue;
     res.writeHead(200, {
       "Content-Type": contentType,
       "Cache-Control": cacheControl
     });
-    fs2.createReadStream(filePath).pipe(res);
+    stream.pipeline(fs2.createReadStream(filePath), res, (pipelineError) => {
+      if (pipelineError) {
+        getLogger().debug("avatar: stream pipeline failed", { routePath, fileId, error: pipelineError });
+      }
+    });
+    void dispatchHook("postAvatarServe", { routePath, fileId, extension, contentType });
     return;
   }
   getLogger().debug("avatar: file not found", { routePath, fileId });
@@ -1493,13 +1083,13 @@ var processUpload = async (input) => {
 };
 
 // src/bindAddress.ts
-var registered2 = null;
+var registered = null;
 var registerBindAddress = (address) => {
-  registered2 = address;
+  registered = address;
 };
 var getBindAddress = () => {
-  if (registered2) {
-    return { ip: registered2.ip, port: String(registered2.port) };
+  if (registered) {
+    return { ip: registered.ip, port: String(registered.port) };
   }
   return {
     ip: process.env.SERVER_IP ?? "127.0.0.1",
@@ -1508,124 +1098,177 @@ var getBindAddress = () => {
 };
 
 // src/getParams.ts
+var writeJsonErrorAndResolve = (res, status, errorCode, resolve) => {
+  res.setHeader("Content-Type", "application/json");
+  res.writeHead(status);
+  res.end(JSON.stringify({
+    status: "error",
+    httpStatus: status,
+    message: errorCode,
+    errorCode
+  }));
+  resolve(null);
+};
 async function getParams({ method, req, res: _res, queryString }) {
-  if (method == "GET") {
-    return Object.fromEntries(new URLSearchParams(queryString || ""));
+  if (method === "GET") {
+    return Object.fromEntries(new URLSearchParams(queryString ?? ""));
   }
-  return new Promise((resolve, reject) => {
-    const contentType = req.headers["content-type"] || "";
+  return new Promise((resolve) => {
+    const contentType = req.headers["content-type"] ?? "";
     const contentLengthHeader = req.headers["content-length"];
     const declaredLength = typeof contentLengthHeader === "string" ? Number(contentLengthHeader) : Number.NaN;
     const maxBodyBytes = getProjectConfig().http.requestBodyMaxBytes;
     if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
-      _res.setHeader("Content-Type", "application/json");
-      _res.writeHead(413);
-      _res.end(JSON.stringify({
-        status: "error",
-        httpStatus: 413,
-        message: "api.payloadTooLarge",
-        errorCode: "api.payloadTooLarge"
-      }));
-      resolve(null);
+      writeJsonErrorAndResolve(_res, 413, "api.payloadTooLarge", resolve);
+      req.destroy();
       return;
     }
-    let body = "";
+    const chunks = [];
     let bodySize = 0;
     req.on("data", (chunk) => {
+      if (_res.headersSent) return;
       bodySize += chunk.length;
       if (bodySize > maxBodyBytes) {
-        _res.setHeader("Content-Type", "application/json");
-        _res.writeHead(413);
-        _res.end(JSON.stringify({
-          status: "error",
-          httpStatus: 413,
-          message: "api.payloadTooLarge",
-          errorCode: "api.payloadTooLarge"
-        }));
+        writeJsonErrorAndResolve(_res, 413, "api.payloadTooLarge", resolve);
         req.destroy();
-        resolve(null);
         return;
       }
-      body += chunk.toString();
+      chunks.push(chunk);
     });
-    req.on("end", async () => {
-      if (contentType.startsWith("application/x-www-form-urlencoded")) {
-        const parseData = () => {
-          const data = new URLSearchParams(body);
-          return Object.fromEntries(data);
-        };
-        const [, response] = await tryCatch(parseData);
-        if (response) {
-          resolve(response);
+    req.on("end", () => {
+      void (async () => {
+        const body = Buffer.concat(chunks).toString("utf8");
+        if (contentType.startsWith("application/x-www-form-urlencoded")) {
+          const parseData = () => {
+            const data = new URLSearchParams(body);
+            return Object.fromEntries(data);
+          };
+          const [, response] = await tryCatch(parseData);
+          if (response) {
+            resolve(response);
+            return;
+          }
+          writeJsonErrorAndResolve(_res, 400, "api.invalidRequestFormat", resolve);
           return;
         }
-        _res.setHeader("Content-Type", "application/json");
-        _res.writeHead(400);
-        _res.end(JSON.stringify({
-          status: "error",
-          httpStatus: 400,
-          message: "api.invalidRequestFormat",
-          errorCode: "api.invalidRequestFormat"
-        }));
-        resolve(null);
-        return;
-      }
-      if (contentType.startsWith("application/json")) {
-        const parseData = () => {
-          return JSON.parse(body || "{}");
-        };
-        const [, response] = await tryCatch(parseData);
-        if (response && typeof response === "object" && !Array.isArray(response)) {
-          resolve(response);
+        if (contentType.startsWith("application/json")) {
+          const parseData = () => {
+            return JSON.parse(body || "{}");
+          };
+          const [, response] = await tryCatch(parseData);
+          if (response && typeof response === "object" && !Array.isArray(response)) {
+            resolve(response);
+            return;
+          }
+          writeJsonErrorAndResolve(_res, 400, "api.invalidRequestFormat", resolve);
           return;
         }
-        _res.setHeader("Content-Type", "application/json");
-        _res.writeHead(400);
-        _res.end(JSON.stringify({
-          status: "error",
-          httpStatus: 400,
-          message: "api.invalidRequestFormat",
-          errorCode: "api.invalidRequestFormat"
-        }));
-        resolve(null);
-        return;
-      }
-      _res.setHeader("Content-Type", "application/json");
-      _res.writeHead(415);
-      _res.end(JSON.stringify({
-        status: "error",
-        httpStatus: 415,
-        message: "api.unsupportedMediaType",
-        errorCode: "api.unsupportedMediaType"
-      }));
-      resolve(null);
+        writeJsonErrorAndResolve(_res, 415, "api.unsupportedMediaType", resolve);
+      })();
     });
-    req.on("error", (error) => {
-      reject(error);
+    req.on("error", () => {
+      resolve(null);
     });
   });
 }
 
 // src/extractToken.ts
 var extractTokenFromSocket = (socket2) => {
+  const config = getProjectConfig();
   const cookie = socket2.handshake.headers.cookie;
-  const sessionToken = typeof socket2.handshake.auth?.token === "string" ? socket2.handshake.auth.token : null;
-  const cookieToken = getCookieValue(cookie, getProjectConfig().http.sessionCookieName);
-  if (getProjectConfig().session.basedToken) {
+  const sessionToken = typeof socket2.handshake.auth.token === "string" ? socket2.handshake.auth.token : null;
+  const cookieToken = getCookieValue(cookie, config.http.sessionCookieName);
+  if (config.session.basedToken) {
     return sessionToken ?? cookieToken;
   }
-  return cookieToken ?? sessionToken;
+  if (config.http.acceptBearerInCookieMode) {
+    return cookieToken ?? sessionToken;
+  }
+  return cookieToken;
 };
 
 // src/extractTokenFromRequest.ts
 var extractTokenFromRequest = (req) => {
-  const authHeader = req.headers.authorization;
+  const rawAuthHeader = req.headers.authorization;
+  const authHeader = typeof rawAuthHeader === "string" ? rawAuthHeader : Array.isArray(rawAuthHeader) && typeof rawAuthHeader[0] === "string" ? rawAuthHeader[0] : void 0;
   const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
-  const cookieToken = getCookieValue(req.headers.cookie, getProjectConfig().http.sessionCookieName);
-  if (getProjectConfig().session.basedToken) {
+  const config = getProjectConfig();
+  const cookieToken = getCookieValue(req.headers.cookie, config.http.sessionCookieName);
+  if (config.session.basedToken) {
     return bearerToken ?? cookieToken;
   }
-  return cookieToken ?? bearerToken;
+  if (config.http.acceptBearerInCookieMode) {
+    return cookieToken ?? bearerToken;
+  }
+  return cookieToken;
+};
+
+// src/resolveClientIp.ts
+import { createHash as createHash2 } from "crypto";
+var UNKNOWN_CLIENT_IP = "unknown";
+var canonicalizeIp = (value) => {
+  let ip = value.startsWith("::ffff:") ? value.slice("::ffff:".length) : value;
+  const zoneIdx = ip.indexOf("%");
+  if (zoneIdx !== -1) ip = ip.slice(0, zoneIdx);
+  return ip.includes(":") ? ip.toLowerCase() : ip;
+};
+var firstHeaderValue = (raw) => {
+  if (raw === void 0) return void 0;
+  const single = Array.isArray(raw) ? raw[0] : raw;
+  if (typeof single !== "string") return void 0;
+  const trimmed = single.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+};
+var forwardedForHops = (raw) => {
+  if (raw === void 0) return [];
+  const parts = Array.isArray(raw) ? raw : [raw];
+  return parts.flatMap((part) => typeof part === "string" ? part.split(",") : []).map((hop) => hop.trim()).filter((hop) => hop.length > 0);
+};
+var resolveRaw = ({ rawAddress, headers, trustProxy, trustedProxyHopCount }) => {
+  const rawFallback = rawAddress && rawAddress.length > 0 ? canonicalizeIp(rawAddress) : UNKNOWN_CLIENT_IP;
+  if (!trustProxy) return rawFallback;
+  const hops = forwardedForHops(headers["x-forwarded-for"]);
+  if (hops.length > 0) {
+    const skip = Math.max(1, Math.floor(trustedProxyHopCount));
+    const index = Math.max(0, hops.length - skip);
+    const chosen = hops[index];
+    if (chosen && chosen.length > 0) return canonicalizeIp(chosen);
+  }
+  const realIp = firstHeaderValue(headers["x-real-ip"]);
+  if (realIp) return canonicalizeIp(realIp);
+  return rawFallback;
+};
+var isLoopbackIp = (ip) => {
+  if (ip === UNKNOWN_CLIENT_IP) return true;
+  const canonical = ip.startsWith("::ffff:") ? ip.slice("::ffff:".length) : ip;
+  if (canonical === "::1") return true;
+  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(canonical);
+};
+var TOKEN_HASH_LENGTH = 32;
+var deriveTokenBucketId = (token) => createHash2("sha256").update(token).digest("hex").slice(0, TOKEN_HASH_LENGTH);
+var resolveClientIp = ({ rawAddress, headers, trustProxy = false, trustedProxyHopCount = 1 }) => {
+  const resolved = resolveRaw({ rawAddress, headers, trustProxy, trustedProxyHopCount });
+  if (resolved === UNKNOWN_CLIENT_IP) {
+    getLogger().warn('rate-limit: client IP unresolved \u2014 keyed into the shared "unknown" bucket', { trustProxy });
+  }
+  return resolved;
+};
+
+// src/sessionProviderRegistry.ts
+var provider = null;
+var registerSessionProvider = (next) => {
+  provider = next;
+};
+var getRegisteredSessionProvider = () => provider;
+var isSessionProviderRegistered = () => provider !== null;
+var resetSessionProviderForTests = () => {
+  provider = null;
+};
+var readSession = async (token) => provider ? provider.getSession(token) : null;
+var writeSession = async (token, data, newUser, options) => provider ? provider.saveSession(token, data, newUser, options) : { ok: true };
+var removeSession = async (token, options) => provider ? provider.deleteSession(token, options) : false;
+var performLogout = async (input) => {
+  if (provider) await provider.logout(input);
 };
 
 // src/validateRequest.ts
@@ -1636,7 +1279,7 @@ var validateRequest = ({
   auth,
   user
 }) => {
-  if (!auth.additional) {
+  if (!auth.additional || auth.additional.length === 0) {
     return { status: "success" };
   }
   const forbid = (key) => ({
@@ -1645,6 +1288,9 @@ var validateRequest = ({
     errorParams: [{ key: "key", value: key }],
     httpStatus: 403
   });
+  if (user === null || user === void 0) {
+    return forbid(auth.additional[0]?.key ?? "");
+  }
   for (const condition of auth.additional) {
     if (!(condition.key in user)) {
       return {
@@ -1673,6 +1319,7 @@ var validateRequest = ({
 };
 
 // src/rateLimiter.ts
+var MAX_MEMORY_STORE_SIZE = 5e4;
 var rateLimitStore = /* @__PURE__ */ new Map();
 var getRedisPrefix = () => formatKey(`:${getProjectConfig().rateLimiting.redisKeyPrefix}`, "");
 var isRedisMode = () => getProjectConfig().rateLimiting.store === "redis";
@@ -1682,7 +1329,8 @@ var buildAllowedResult = (limit) => ({
   remaining: Math.max(0, limit),
   resetIn: 0
 });
-var redisFallbackLogged = false;
+var REDIS_FALLBACK_LOG_COOLDOWN_MS = 6e4;
+var redisFallbackLastLoggedAt = 0;
 var RATE_LIMIT_INCREMENT_SCRIPT = `
 local current = redis.call('INCR', KEYS[1])
 if current == 1 then
@@ -1692,7 +1340,7 @@ local ttl = redis.call('PTTL', KEYS[1])
 return { current, ttl }
 `;
 var normalizeWindowMs = (windowMs) => {
-  if (!Number.isFinite(windowMs) || windowMs <= 0) {
+  if (windowMs === void 0 || !Number.isFinite(windowMs) || windowMs <= 0) {
     return getProjectConfig().rateLimiting.windowMs;
   }
   return windowMs;
@@ -1701,12 +1349,19 @@ var getRedisRateLimitKey = (key) => `${getRedisPrefix()}:${key}`;
 var checkRateLimitInMemory = ({
   key,
   limit,
-  windowMs = 6e4
+  //? No default here — `normalizeWindowMs` reads `projectConfig.rateLimiting.windowMs`
+  //? when `windowMs` is undefined or non-finite, so a hardcoded `60_000` would
+  //? shadow the configured value (CORE-N6).
+  windowMs
 }) => {
   const safeWindowMs = normalizeWindowMs(windowMs);
   const now = Date.now();
   const entry = rateLimitStore.get(key);
   if (!entry || entry.resetAt < now) {
+    if (rateLimitStore.size >= MAX_MEMORY_STORE_SIZE) {
+      const oldest = rateLimitStore.keys().next().value;
+      if (oldest !== void 0) rateLimitStore.delete(oldest);
+    }
     rateLimitStore.set(key, { count: 1, resetAt: now + safeWindowMs });
     return { allowed: true, remaining: limit - 1, resetIn: Math.ceil(safeWindowMs / 1e3) };
   }
@@ -1720,7 +1375,8 @@ var checkRateLimitInMemory = ({
 var checkRateLimitInRedis = async ({
   key,
   limit,
-  windowMs = 6e4
+  //? No default — same reasoning as `checkRateLimitInMemory` (CORE-N6).
+  windowMs
 }) => {
   const safeWindowMs = normalizeWindowMs(windowMs);
   const redisKey = getRedisRateLimitKey(key);
@@ -1772,11 +1428,20 @@ var getRateLimitStatusInRedis = async (key, limit) => {
     resetIn: Math.ceil(ttlMs / 1e3)
   };
 };
+var getOnStoreError = () => getProjectConfig().rateLimiting.onStoreError;
 var logRedisFallback = () => {
-  if (redisFallbackLogged) return;
-  redisFallbackLogged = true;
-  getLogger().warn("[RateLimiter] Redis mode unavailable, falling back to in-memory mode");
+  const now = Date.now();
+  if (now - redisFallbackLastLoggedAt < REDIS_FALLBACK_LOG_COOLDOWN_MS) return;
+  redisFallbackLastLoggedAt = now;
+  getLogger().warn(
+    getOnStoreError() === "deny" ? "[RateLimiter] Redis mode unavailable \u2014 denying request (onStoreError=deny)" : "[RateLimiter] Redis mode unavailable, falling back to in-memory mode (onStoreError=memory)"
+  );
 };
+var buildDeniedResult = () => ({
+  allowed: false,
+  remaining: 0,
+  resetIn: Math.ceil(getProjectConfig().rateLimiting.windowMs / 1e3)
+});
 var defaultRateLimitStrategy = {
   name: "default-memory-redis",
   async check(params) {
@@ -1785,6 +1450,7 @@ var defaultRateLimitStrategy = {
       const redisResult = await checkRateLimitInRedis(params);
       if (redisResult) return redisResult;
       logRedisFallback();
+      if (getOnStoreError() === "deny") return buildDeniedResult();
     }
     return checkRateLimitInMemory(params);
   },
@@ -1794,6 +1460,7 @@ var defaultRateLimitStrategy = {
       const redisResult = await getRateLimitStatusInRedis(key, limit);
       if (redisResult) return redisResult;
       logRedisFallback();
+      if (getOnStoreError() === "deny") return buildDeniedResult();
     }
     return getRateLimitStatusInMemory(key, limit);
   },
@@ -1821,16 +1488,32 @@ var defaultRateLimitStrategy = {
     rateLimitStore.clear();
   }
 };
-var activeStrategy = defaultRateLimitStrategy;
+var strategyRegistry = createRegistry(defaultRateLimitStrategy, {
+  onRegister: (strategy) => {
+    getLogger().debug(`[RateLimiter] active strategy \u2192 ${strategy.name}`);
+  }
+});
 var registerRateLimitStrategy = (strategy) => {
-  activeStrategy = strategy;
-  getLogger().debug(`[RateLimiter] active strategy \u2192 ${strategy.name}`);
-};
-var getRateLimitStrategy = () => activeStrategy;
-var checkRateLimit = async (params) => activeStrategy.check(params);
-var getRateLimitStatus = async (key, limit) => activeStrategy.getStatus(key, limit);
-var clearRateLimit = async (key) => activeStrategy.clear(key);
-var clearAllRateLimits = async () => activeStrategy.clearAll();
+  strategyRegistry.register(strategy);
+};
+var getRateLimitStrategy = () => strategyRegistry.get();
+var checkRateLimit = async (params) => {
+  ensureCleanupScheduled();
+  return strategyRegistry.get().check(params);
+};
+var getRateLimitStatus = async (key, limit) => {
+  ensureCleanupScheduled();
+  return strategyRegistry.get().getStatus(key, limit);
+};
+var clearRateLimit = async (key) => strategyRegistry.get().clear(key);
+var clearAllRateLimits = async () => {
+  if (process.env.NODE_ENV === "production") {
+    getLogger().warn("[RateLimiter] clearAllRateLimits() called in production \u2014 ignored. Use clearRateLimit(key) for scoped resets.");
+    return;
+  }
+  return strategyRegistry.get().clearAll();
+};
+var cleanupStarted = false;
 var scheduleCleanup = () => {
   const intervalMs = getProjectConfig().rateLimiting.cleanupIntervalMs;
   const timer = setTimeout(() => {
@@ -1849,7 +1532,16 @@ var scheduleCleanup = () => {
   }, intervalMs);
   timer.unref();
 };
-scheduleCleanup();
+var ensureCleanupScheduled = () => {
+  if (cleanupStarted) return;
+  cleanupStarted = true;
+  if (!isRedisMode() && getOnStoreError() === "deny") {
+    getLogger().warn(
+      '[RateLimiter] onStoreError="deny" has no effect in memory mode (only Redis mode has a fallback path). Switch to store:"redis" or remove the setting.'
+    );
+  }
+  scheduleCleanup();
+};
 
 // src/runtimeTypeValidation.ts
 var splitTopLevel = (value, splitter) => {
@@ -1857,24 +1549,78 @@ var splitTopLevel = (value, splitter) => {
   let depthParen = 0;
   let depthBrace = 0;
   let depthBracket = 0;
+  let inString = null;
   let token = "";
-  for (const char of value) {
-    if (char === "(") depthParen += 1;
-    if (char === ")") depthParen -= 1;
-    if (char === "{") depthBrace += 1;
-    if (char === "}") depthBrace -= 1;
-    if (char === "[") depthBracket += 1;
-    if (char === "]") depthBracket -= 1;
-    if (char === splitter && depthParen === 0 && depthBrace === 0 && depthBracket === 0) {
-      items.push(token.trim());
-      token = "";
+  const codePoints = [...value];
+  let i = 0;
+  while (i < codePoints.length) {
+    const char = codePoints[i] ?? "";
+    i += 1;
+    if (inString && char === "\\") {
+      token += char;
+      const next = codePoints[i] ?? "";
+      token += next;
+      i += 1;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      if (inString === char) {
+        inString = null;
+      } else {
+        inString ??= char;
+      }
+      token += char;
       continue;
     }
+    if (!inString) {
+      if (char === "(") depthParen += 1;
+      if (char === ")") depthParen -= 1;
+      if (char === "{") depthBrace += 1;
+      if (char === "}") depthBrace -= 1;
+      if (char === "[") depthBracket += 1;
+      if (char === "]") depthBracket -= 1;
+      if (char === splitter && depthParen === 0 && depthBrace === 0 && depthBracket === 0) {
+        items.push(token.trim());
+        token = "";
+        continue;
+      }
+    }
     token += char;
   }
   if (token.trim()) items.push(token.trim());
   return items;
 };
+var QUOTED_FIELD_RE = /^("|')((?:[^\\]|\\.)*?)\1(\?)?\s*:\s*([\s\S]+)$/;
+var PLAIN_FIELD_RE = /^([A-Za-z_][A-Za-z0-9_]*)(\?)?\s*:\s*([\s\S]+)$/;
+var INDEX_SIG_RE = /^\[\s*([A-Za-z_][A-Za-z0-9_]*)\s*:\s*([^\]]+)\]\s*:\s*([\s\S]+)$/;
+var parseFieldOrIndex = (trimmed, fields, indexSignatures) => {
+  const quotedMatch = QUOTED_FIELD_RE.exec(trimmed);
+  if (quotedMatch) {
+    fields.push({
+      key: (quotedMatch[2] ?? "").replaceAll(String.raw`\'`, "'").replaceAll(String.raw`\"`, '"'),
+      optional: Boolean(quotedMatch[3]),
+      type: (quotedMatch[4] ?? "").trim()
+    });
+    return;
+  }
+  const plainMatch = PLAIN_FIELD_RE.exec(trimmed);
+  if (plainMatch) {
+    fields.push({
+      key: plainMatch[1] ?? "",
+      optional: Boolean(plainMatch[2]),
+      type: (plainMatch[3] ?? "").trim()
+    });
+    return;
+  }
+  const indexMatch = INDEX_SIG_RE.exec(trimmed);
+  if (indexMatch) {
+    indexSignatures.push({
+      keyName: (indexMatch[1] ?? "").trim(),
+      keyType: (indexMatch[2] ?? "").trim(),
+      type: (indexMatch[3] ?? "").trim()
+    });
+  }
+};
 var parseObjectFields = (typeText) => {
   const clean = typeText.trim();
   if (!clean.startsWith("{") || !clean.endsWith("}")) {
@@ -1891,25 +1637,7 @@ var parseObjectFields = (typeText) => {
     if (char === ";" && depth === 0) {
       const trimmed = part.trim();
       if (trimmed) {
-        const fieldMatch = /^("|')?[A-Za-z_][A-Za-z0-9_]*("|')?(\?)?\s*:\s*([\s\S]+)$/.exec(trimmed);
-        if (fieldMatch) {
-          const keyMatch = /^("|')?[A-Za-z_][A-Za-z0-9_]*("|')?/.exec(trimmed);
-          const rawKey = keyMatch?.[0] ?? "";
-          fields.push({
-            key: rawKey.replaceAll(/^['"]|['"]$/g, ""),
-            optional: Boolean(fieldMatch[3]),
-            type: (fieldMatch[4] ?? "").trim()
-          });
-        } else {
-          const indexMatch = /^\[\s*([A-Za-z_][A-Za-z0-9_]*)\s*:\s*([^\]]+)\]\s*:\s*([\s\S]+)$/.exec(trimmed);
-          if (indexMatch) {
-            indexSignatures.push({
-              keyName: (indexMatch[1] ?? "").trim(),
-              keyType: (indexMatch[2] ?? "").trim(),
-              type: (indexMatch[3] ?? "").trim()
-            });
-          }
-        }
+        parseFieldOrIndex(trimmed, fields, indexSignatures);
       }
       part = "";
       continue;
@@ -1918,25 +1646,7 @@ var parseObjectFields = (typeText) => {
   }
   const final = part.trim();
   if (final) {
-    const fieldMatch = /^("|')?[A-Za-z_][A-Za-z0-9_]*("|')?(\?)?\s*:\s*([\s\S]+)$/.exec(final);
-    if (fieldMatch) {
-      const keyMatch = /^("|')?[A-Za-z_][A-Za-z0-9_]*("|')?/.exec(final);
-      const rawKey = keyMatch?.[0] ?? "";
-      fields.push({
-        key: rawKey.replaceAll(/^['"]|['"]$/g, ""),
-        optional: Boolean(fieldMatch[3]),
-        type: (fieldMatch[4] ?? "").trim()
-      });
-    } else {
-      const indexMatch = /^\[\s*([A-Za-z_][A-Za-z0-9_]*)\s*:\s*([^\]]+)\]\s*:\s*([\s\S]+)$/.exec(final);
-      if (indexMatch) {
-        indexSignatures.push({
-          keyName: (indexMatch[1] ?? "").trim(),
-          keyType: (indexMatch[2] ?? "").trim(),
-          type: (indexMatch[3] ?? "").trim()
-        });
-      }
-    }
+    parseFieldOrIndex(final, fields, indexSignatures);
   }
   return { fields, indexSignatures };
 };
@@ -1961,78 +1671,120 @@ var isPrimitiveMatch = (type, value) => {
   if (type === "false") return value === false;
   if (type === "null") return value === null;
   if (type === "undefined") return value === void 0;
-  if (type === "Date") return typeof value === "string" || value instanceof Date;
+  if (type === "Date") return value instanceof Date || typeof value === "string" && !Number.isNaN(Date.parse(value));
   return false;
 };
 var isPrimitiveType = (type) => {
   return ["string", "number", "boolean", "true", "false", "null", "undefined", "Date"].includes(type);
 };
-var validateType = (typeText, value, path3) => {
+var PROTO_POLLUTION_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var parseRecordParts = (type) => {
+  const inner = type.slice("Record<".length, -1);
+  let depth = 0;
+  for (let index = 0; index < inner.length; index += 1) {
+    const char = inner[index];
+    if (char === "<" || char === "{" || char === "[" || char === "(") depth += 1;
+    else if (char === ">" || char === "}" || char === "]" || char === ")") depth -= 1;
+    else if (char === "," && depth === 0) {
+      return {
+        keyType: inner.slice(0, index).trim(),
+        valueType: inner.slice(index + 1).trim()
+      };
+    }
+  }
+  return null;
+};
+var MAX_VALIDATION_DEPTH = 64;
+var validateType = (typeText, value, path4, depth = 0) => {
+  if (depth > MAX_VALIDATION_DEPTH) {
+    return { status: "error", message: `${path4}: input nesting exceeds the maximum depth of ${String(MAX_VALIDATION_DEPTH)}` };
+  }
   const type = typeText.trim();
   if (type.startsWith("__RUNTIME_UNRESOLVED__::")) {
     const unresolvedMessage = type.replace("__RUNTIME_UNRESOLVED__::", "").trim();
-    return { status: "error", message: `${path3}: ${unresolvedMessage}` };
+    return { status: "error", message: `${path4}: ${unresolvedMessage}` };
   }
   if (type.startsWith("(") && type.endsWith(")")) {
-    return validateType(type.slice(1, -1), value, path3);
+    return validateType(type.slice(1, -1), value, path4, depth + 1);
   }
   if (type.includes("|")) {
     const unionParts = splitTopLevel(type, "|").filter(Boolean);
     if (unionParts.length > 1) {
       for (const unionType of unionParts) {
-        const result = validateType(unionType, value, path3);
+        const result = validateType(unionType, value, path4, depth + 1);
         if (result.status === "success") return result;
       }
-      return { status: "error", message: `${path3} does not match union type ${type}` };
+      return { status: "error", message: `${path4} does not match union type ${type}` };
+    }
+    if (unionParts.length === 1) {
+      return validateType(unionParts[0] ?? type, value, path4, depth + 1);
     }
   }
   if (type.includes("&")) {
     const intersectionParts = splitTopLevel(type, "&").filter(Boolean);
     if (intersectionParts.length > 1) {
       for (const intersectionType of intersectionParts) {
-        const result = validateType(intersectionType, value, path3);
+        const result = validateType(intersectionType, value, path4, depth + 1);
         if (result.status === "error") return result;
       }
       return { status: "success" };
     }
+    if (intersectionParts.length === 1) {
+      return validateType(intersectionParts[0] ?? type, value, path4, depth + 1);
+    }
   }
   if (type.endsWith("[]")) {
     if (!Array.isArray(value)) {
-      return { status: "error", message: `${path3} should be an array` };
+      return { status: "error", message: `${path4} should be an array` };
     }
     const itemType = type.slice(0, -2).trim();
-    if (itemType === type) {
-      return { status: "success" };
+    if (itemType === "" || itemType === type) {
+      return { status: "error", message: `${path4}: unvalidatable array element type for ${type}` };
     }
     for (const [index, element] of value.entries()) {
-      const result = validateType(itemType, element, `${path3}[${String(index)}]`);
+      const result = validateType(itemType, element, `${path4}[${String(index)}]`, depth + 1);
       if (result.status === "error") return result;
     }
     return { status: "success" };
   }
   if (type.startsWith("'") && type.endsWith("'") || type.startsWith('"') && type.endsWith('"')) {
     const literal = type.slice(1, -1);
-    return value === literal ? { status: "success" } : { status: "error", message: `${path3} should equal ${literal}` };
+    return value === literal ? { status: "success" } : { status: "error", message: `${path4} should equal ${literal}` };
   }
   if (isPrimitiveMatch(type, value)) {
     return { status: "success" };
   }
   if (isPrimitiveType(type)) {
     const expectedType = type === "Date" ? "Date (ISO string or Date)" : type;
-    return { status: "error", message: `${path3} should be ${expectedType}` };
+    return { status: "error", message: `${path4} should be ${expectedType}` };
   }
   if (type === "any" || type === "unknown") {
     return { status: "success" };
   }
   if (/^Record<.+>$/.test(type)) {
-    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
-      return { status: "success" };
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+      return { status: "error", message: `${path4} should be an object` };
     }
-    return { status: "error", message: `${path3} should be an object` };
+    const record = value;
+    const recordParts = parseRecordParts(type);
+    if (!recordParts) {
+      return { status: "error", message: `${path4}: unvalidatable Record type ${type} \u2014 model it explicitly` };
+    }
+    for (const key of Object.keys(record)) {
+      if (PROTO_POLLUTION_KEYS.has(key)) {
+        return { status: "error", message: `${path4}.${key} is not allowed` };
+      }
+      if ((recordParts.keyType === "number" || recordParts.keyType.includes("|") || recordParts.keyType.startsWith("'") || recordParts.keyType.startsWith('"')) && !matchesIndexKeyType({ keyType: recordParts.keyType, key })) {
+        return { status: "error", message: `${path4}.${key} is not allowed` };
+      }
+      const valueResult = validateType(recordParts.valueType, record[key], `${path4}.${key}`, depth + 1);
+      if (valueResult.status === "error") return valueResult;
+    }
+    return { status: "success" };
   }
   if (type.startsWith("{") && type.endsWith("}")) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
-      return { status: "error", message: `${path3} should be an object` };
+      return { status: "error", message: `${path4} should be an object` };
     }
     const { fields, indexSignatures } = parseObjectFields(type);
     const input = value;
@@ -2040,9 +1792,9 @@ var validateType = (typeText, value, path3) => {
       const fieldValue = input[field.key];
       if (fieldValue === void 0) {
         if (field.optional) continue;
-        return { status: "error", message: `${path3}.${field.key} is required` };
+        return { status: "error", message: `${path4}.${field.key} is required` };
       }
-      const result = validateType(field.type, fieldValue, `${path3}.${field.key}`);
+      const result = validateType(field.type, fieldValue, `${path4}.${field.key}`, depth + 1);
       if (result.status === "error") return result;
     }
     const allowedKeys = new Set(fields.map((field) => field.key));
@@ -2050,8 +1802,11 @@ var validateType = (typeText, value, path3) => {
       if (allowedKeys.has(key)) {
         continue;
       }
+      if (PROTO_POLLUTION_KEYS.has(key)) {
+        return { status: "error", message: `${path4}.${key} is not allowed` };
+      }
       if (indexSignatures.length === 0) {
-        return { status: "error", message: `${path3}.${key} is not allowed` };
+        return { status: "error", message: `${path4}.${key} is not allowed` };
       }
       const indexValue = input[key];
       let matched = false;
@@ -2059,25 +1814,32 @@ var validateType = (typeText, value, path3) => {
         if (!matchesIndexKeyType({ keyType: indexSignature.keyType, key })) {
           continue;
         }
-        const indexResult = validateType(indexSignature.type, indexValue, `${path3}.${key}`);
+        const indexResult = validateType(indexSignature.type, indexValue, `${path4}.${key}`, depth + 1);
         if (indexResult.status === "success") {
           matched = true;
           break;
         }
       }
       if (!matched) {
-        return { status: "error", message: `${path3}.${key} is not allowed` };
+        return { status: "error", message: `${path4}.${key} is not allowed` };
       }
     }
     return { status: "success" };
   }
   if (/^[A-Za-z_][A-Za-z0-9_]*(?:<.+>)?$/.test(type)) {
     if (/^[A-Za-z_][A-Za-z0-9_]*<.+>$/.test(type)) {
-      return { status: "error", message: `${path3}: unresolved utility ${type}` };
+      return { status: "error", message: `${path4}: unresolved utility ${type}` };
     }
-    return { status: "error", message: `${path3}: unresolved type ${type}` };
+    return { status: "error", message: `${path4}: unresolved type ${type}` };
   }
-  return { status: "success" };
+  return { status: "error", message: `${path4}: unvalidatable type ${type} \u2014 model it explicitly or set validation: 'relaxed' on the route` };
+};
+var safeValidateType = (typeText, value, path4) => {
+  const [error, result] = tryCatchSync(() => validateType(typeText, value, path4));
+  if (error || !result) {
+    return { status: "error", message: `${path4}: input validation failed` };
+  }
+  return result;
 };
 var validateInputByType = async ({
   typeText,
@@ -2089,7 +1851,11 @@ var validateInputByType = async ({
     return { status: "success" };
   }
   if (process.env.NODE_ENV === "production") {
-    return { status: "success" };
+    const { getProjectConfig: getProjectConfig2 } = await import("./projectConfig-JX563K43.js");
+    if (getProjectConfig2().validation.runtimeMode === "off") {
+      return { status: "success" };
+    }
+    return safeValidateType(typeText, value, rootKey);
   }
   const devkitModuleId = "@luckystack/devkit";
   const devkit = await import(devkitModuleId);
@@ -2097,7 +1863,7 @@ var validateInputByType = async ({
   if (resolvedType.status === "error") {
     return { status: "error", message: `${rootKey}: ${resolvedType.message}` };
   }
-  return validateType(resolvedType.typeText, value, rootKey);
+  return safeValidateType(resolvedType.typeText, value, rootKey);
 };
 
 // src/checkOrigin.ts
@@ -2114,24 +1880,25 @@ var normalizeOrigin = ({ value, secure }) => {
   return extractedOrigin.replace(/^http:\/\/(.+):80$/i, "http://$1").replace(/^https:\/\/(.+):443$/i, "https://$1");
 };
 var isLocalhostOrigin = (normalized) => {
-  return /^https?:\/\/localhost(:\d+)?$/i.test(normalized);
+  return /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/i.test(normalized);
 };
 var allowedOrigin = (origin) => {
   const secure = process.env.SECURE === "true";
   const cors = getProjectConfig().http.cors;
   const configured = cors.allowedOrigins;
   const { ip: bindIp, port: bindPort } = getBindAddress();
-  const location = bindPort ? `http${secure ? "s" : ""}://${bindIp}:${bindPort}` : `http${secure ? "s" : ""}://${bindIp}`;
+  const rawLocation = bindPort ? `http${secure ? "s" : ""}://${bindIp}:${bindPort}` : `http${secure ? "s" : ""}://${bindIp}`;
+  const location = normalizeOrigin({ value: rawLocation, secure });
   const normalizedOrigin = normalizeOrigin({ value: origin, secure });
   if (cors.allowLocalhost && normalizedOrigin && isLocalhostOrigin(normalizedOrigin)) {
     return true;
   }
   if (typeof configured === "function") {
-    if (normalizedOrigin === location) return true;
-    if (configured(origin)) return true;
+    if (normalizedOrigin && normalizedOrigin === location) return true;
+    if (configured(normalizedOrigin)) return true;
   } else {
     const normalizedAllowedOrigins = new Set(
-      [location, ...configured].map((value) => normalizeOrigin({ value, secure })).filter(Boolean)
+      [location, ...configured.map((value) => normalizeOrigin({ value, secure }))].filter(Boolean)
     );
     if (normalizedOrigin && normalizedAllowedOrigins.has(normalizedOrigin)) {
       return true;
@@ -2156,121 +1923,6 @@ var allowedOrigin = (origin) => {
 };
 var checkOrigin_default = allowedOrigin;
 
-// src/offlineQueue.ts
-var apiQueue = [];
-var syncQueue = [];
-var isFlushingApi = false;
-var isFlushingSync = false;
-var isOnline = () => {
-  if (typeof navigator === "undefined") return true;
-  return navigator.onLine;
-};
-var evictExpired = (queue) => {
-  const maxAgeMs = getProjectConfig().offlineQueue.maxAgeMs;
-  if (maxAgeMs <= 0) return;
-  const cutoff = Date.now() - maxAgeMs;
-  for (let i = queue.length - 1; i >= 0; i -= 1) {
-    const item = queue[i];
-    if (item && item.createdAt < cutoff) {
-      queue.splice(i, 1);
-    }
-  }
-};
-var enqueueWithPolicy = (queue, item, label) => {
-  evictExpired(queue);
-  const { maxSize, dropPolicy: globalPolicy } = getProjectConfig().offlineQueue;
-  const effectivePolicy = item.dropPolicy ?? globalPolicy;
-  if (queue.length < maxSize) {
-    queue.push(item);
-    return true;
-  }
-  if (effectivePolicy === "drop-oldest") {
-    queue.shift();
-    queue.push(item);
-    getLogger().debug(`offlineQueue:${label} full \u2014 dropped oldest item (policy=${effectivePolicy})`);
-    return true;
-  }
-  if (effectivePolicy === "drop-newest") {
-    getLogger().debug(`offlineQueue:${label} full \u2014 dropped newest item (policy=${effectivePolicy})`);
-    return false;
-  }
-  getLogger().warn(`offlineQueue:${label} full \u2014 rejecting enqueue (policy=${effectivePolicy})`);
-  return false;
-};
-var enqueueApiRequest = (item) => enqueueWithPolicy(apiQueue, item, "api");
-var enqueueSyncRequest = (item) => enqueueWithPolicy(syncQueue, item, "sync");
-var removeApiQueueItem = (id) => {
-  const index = apiQueue.findIndex((item) => item.id === id);
-  if (index !== -1) {
-    apiQueue.splice(index, 1);
-  }
-};
-var removeSyncQueueItem = (id) => {
-  const index = syncQueue.findIndex((item) => item.id === id);
-  if (index !== -1) {
-    syncQueue.splice(index, 1);
-  }
-};
-var removeApiQueueItemsByKey = (key) => {
-  for (let i = apiQueue.length - 1; i >= 0; i -= 1) {
-    if (apiQueue[i]?.key === key) {
-      apiQueue.splice(i, 1);
-    }
-  }
-};
-var flushApiQueue = (canRun, socketInstance) => {
-  if (isFlushingApi) return;
-  evictExpired(apiQueue);
-  if (apiQueue.length === 0) return;
-  if (!canRun()) return;
-  isFlushingApi = true;
-  while (apiQueue.length > 0) {
-    if (!canRun()) break;
-    const item = apiQueue.shift();
-    item?.run(socketInstance);
-  }
-  isFlushingApi = false;
-};
-var flushSyncQueue = (canRun, socketInstance) => {
-  if (isFlushingSync) return;
-  evictExpired(syncQueue);
-  if (syncQueue.length === 0) return;
-  if (!canRun()) return;
-  isFlushingSync = true;
-  while (syncQueue.length > 0) {
-    if (!canRun()) break;
-    const item = syncQueue.shift();
-    item?.run(socketInstance);
-  }
-  isFlushingSync = false;
-};
-var getApiQueueSize = () => apiQueue.length;
-var getSyncQueueSize = () => syncQueue.length;
-
-// src/socketState.ts
-var socket = null;
-var setSocket = (next) => {
-  socket = next;
-};
-var responseIndex = 0;
-var WAIT_FOR_SOCKET_INTERVAL_MS = 10;
-var WAIT_FOR_SOCKET_MAX_ITERATIONS = 500;
-var incrementResponseIndex = () => {
-  responseIndex = responseIndex + 1;
-  return responseIndex;
-};
-var waitForSocket = async () => {
-  let i = 0;
-  while (!socket) {
-    await new Promise((resolve) => setTimeout(resolve, WAIT_FOR_SOCKET_INTERVAL_MS));
-    i++;
-    if (i > WAIT_FOR_SOCKET_MAX_ITERATIONS) {
-      return null;
-    }
-  }
-  return socket;
-};
-
 // src/cancelRegistry.ts
 var syncControllers = /* @__PURE__ */ new Map();
 var apiControllers = /* @__PURE__ */ new Map();
@@ -2291,16 +1943,16 @@ var abortSyncByCb = (socketId, cb) => {
   syncControllers.delete(key);
   return true;
 };
-var registerApiAbortController = (socketId, responseIndex2, controller) => {
-  const key = buildKey(socketId, responseIndex2);
+var registerApiAbortController = (socketId, responseIndex, controller) => {
+  const key = buildKey(socketId, responseIndex);
   apiControllers.set(key, controller);
   return key;
 };
 var unregisterApiAbortController = (key) => {
   apiControllers.delete(key);
 };
-var abortApiByResponseIndex = (socketId, responseIndex2) => {
-  const key = buildKey(socketId, responseIndex2);
+var abortApiByResponseIndex = (socketId, responseIndex) => {
+  const key = buildKey(socketId, responseIndex);
   const controller = apiControllers.get(key);
   if (!controller) return false;
   controller.abort();
@@ -2323,90 +1975,40 @@ var abortAllForSocket = (socketId) => {
   }
 };
 
-// src/csrf.ts
-var cachedToken = null;
-var inflightFetch = null;
-var resolveBackendUrl = () => {
-  if (globalThis.window !== void 0 && globalThis.location?.origin) {
-    return globalThis.location.origin;
-  }
-  return "";
-};
-var fetchCsrfToken = async () => {
-  const base = resolveBackendUrl();
-  const [error, token] = await tryCatch(async () => {
-    const response = await fetch(`${base}/auth/csrf`, {
-      method: "GET",
-      credentials: "include"
-    });
-    if (!response.ok) return null;
-    const body = await response.json();
-    return body.csrfToken ?? null;
-  });
-  if (error) return null;
-  return token ?? null;
-};
-var getCsrfToken = async () => {
-  if (getProjectConfig().session.basedToken) {
-    return null;
-  }
-  if (cachedToken) return cachedToken;
-  if (inflightFetch) return inflightFetch;
-  inflightFetch = fetchCsrfToken().then((token) => {
-    cachedToken = token;
-    inflightFetch = null;
-    return token;
-  });
-  return inflightFetch;
-};
-var clearCsrfToken = () => {
-  cachedToken = null;
-  inflightFetch = null;
-};
-var STATE_CHANGING = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
-var isCsrfMismatchResponse = async (response) => {
-  if (response.status !== 403) return false;
-  const [error, isMismatch] = await tryCatch(async () => {
-    const cloned = response.clone();
-    const body = await cloned.json();
-    return body.errorCode === "auth.csrfMismatch";
-  });
-  if (error) return false;
-  return isMismatch ?? false;
-};
-var httpFetch = async (input, init = {}) => {
-  const method = (init.method ?? "GET").toUpperCase();
-  const headers = new Headers(init.headers);
-  if (!headers.has("Content-Type") && init.body && typeof init.body === "string") {
-    headers.set("Content-Type", "application/json");
-  }
-  const csrfHeaderName = getCsrfConfig().headerName;
-  const send = async (csrfToken) => {
-    const finalHeaders = new Headers(headers);
-    if (csrfToken && STATE_CHANGING.has(method) && !finalHeaders.has(csrfHeaderName)) {
-      finalHeaders.set(csrfHeaderName, csrfToken);
+// src/oneTimeToken.ts
+import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
+var TOKEN_BYTES = 32;
+var hashToken = (token) => createHash3("sha256").update(token).digest("hex");
+var tokenKey = (namespace, token) => formatKey(namespace, hashToken(token));
+var issueOneTimeToken = (namespace, ttlSeconds, payload) => {
+  const token = randomBytes2(TOKEN_BYTES).toString("hex");
+  const value = typeof payload === "string" ? payload : JSON.stringify(payload);
+  return {
+    token,
+    store: async () => {
+      await redis_default.set(tokenKey(namespace, token), value, "EX", ttlSeconds);
     }
-    return fetch(input, {
-      ...init,
-      method,
-      headers: finalHeaders,
-      credentials: init.credentials ?? "include"
-    });
   };
-  if (!STATE_CHANGING.has(method) || getProjectConfig().session.basedToken) {
-    return send(null);
-  }
-  const token = await getCsrfToken();
-  let response = await send(token);
-  if (await isCsrfMismatchResponse(response)) {
-    clearCsrfToken();
-    const refreshed = await getCsrfToken();
-    if (refreshed) {
-      response = await send(refreshed);
-    }
-  }
-  return response;
 };
+var consumeOneTimeToken = async (namespace, token) => {
+  if (!token || typeof token !== "string") return null;
+  const key = tokenKey(namespace, token);
+  const txResult = await redis_default.multi().get(key).del(key).exec();
+  if (!txResult || txResult.length === 0) return null;
+  const first = txResult[0];
+  if (!first) return null;
+  const [getErr, value] = first;
+  if (getErr) return null;
+  return typeof value === "string" && value.length > 0 ? value : null;
+};
+var consumeOneTimeTokenJson = async (namespace, token) => {
+  const raw = await consumeOneTimeToken(namespace, token);
+  if (raw === null) return null;
+  const [parseErr, parsed] = tryCatchSync(() => JSON.parse(raw));
+  if (parseErr) return null;
+  return parsed;
+};
+var oneTimeTokenKey = tokenKey;
 export {
   BOOT_KEY_PREFIX,
   DEFAULT_AVATAR_CONFIG,
@@ -2415,23 +2017,29 @@ export {
   DEFAULT_ENV_FILES,
   DEFAULT_PAGE_ROUTE_RULES,
   DEFAULT_PROJECT_CONFIG,
+  DEFAULT_REDACTED_LOG_KEYS,
+  DEPTH_TRUNCATED_PLACEHOLDER,
   GENERATED_API_DOCS_PATH,
   GENERATED_API_SCHEMAS_PATH,
   GENERATED_SOCKET_TYPES_PATH,
   INVALID_ERROR_RESPONSE_CODE,
   PUBLIC_DIR,
+  REDACTED_PLACEHOLDER,
   ROOT_DIR,
   SERVER_DIR,
   SERVER_FUNCTIONS_DIR,
   SHARED_DIR,
   SRC_DIR,
   TSCONFIG_ALIAS_FILES,
+  UNKNOWN_CLIENT_IP,
   UPLOADS_DIR,
   abortAllForSocket,
   abortApiByResponseIndex,
   abortSyncByCb,
   acquireLease,
   checkOrigin_default as allowedOrigin,
+  appendErrorTracker,
+  applyCookiePrefixConstraints,
   applyErrorFormatter,
   applySocketMiddlewares,
   applyStrayKeyPrefix,
@@ -2456,22 +2064,33 @@ export {
   clearSocketMiddlewares,
   collectSynchronizedEnvKeys,
   computeSynchronizedEnvHashes,
+  consumeOneTimeToken,
+  consumeOneTimeTokenJson,
   createDevLogger,
   createLocalizedNormalizer,
+  createRegistry,
+  deepMerge,
   defaultHttpStatusForResponse,
   defaultRateLimitStrategy,
   defaultRedisKeyFormatter,
+  defaultRoomNameFormatter,
+  deriveTokenBucketId,
+  describeHealthHashConfig,
   dispatchHook,
   dispatchSyncHook,
   enqueueApiRequest,
   enqueueSyncRequest,
+  ensurePeerDepInstalled,
   env,
+  escapeHtml,
   extractLanguageFromHeader,
   extractTokenFromRequest,
   extractTokenFromSocket,
   flushApiQueue,
+  flushErrorTrackers,
   flushSyncQueue,
   formatKey,
+  formatRoomName,
   getActiveErrorTrackers,
   getApiQueueSize,
   getAvatarConfig,
@@ -2479,10 +2098,12 @@ export {
   getCookieValue,
   getCsrfConfig,
   getCsrfToken,
+  getCurrentErrorTrackerIdentity,
   getDeployConfig,
   getEffectiveHttpMethod,
   getEmailSender,
   getEmailSenderByName,
+  getEnv,
   getEnvFiles,
   getErrorFormatter,
   getGeneratedApiDocsPath,
@@ -2509,6 +2130,8 @@ export {
   getRedisConnectionOptions,
   getRedisKeyFormatter,
   getRegisteredApiMethod,
+  getRegisteredSessionProvider,
+  getRoomNameFormatter,
   getRuntimeApiMaps,
   getRuntimeSyncMaps,
   getServerDir,
@@ -2522,6 +2145,7 @@ export {
   getUploadsDir,
   hasCookie,
   hashSynchronizedValue,
+  hashSynchronizedValueWith,
   httpFetch,
   incrementResponseIndex,
   inferHttpMethod,
@@ -2532,10 +2156,13 @@ export {
   isEmailSenderRegistered,
   isErrorParamArray,
   isFalsy,
+  isGetMethodName,
   isLocalizedNormalizerRegistered,
   isLoggerRegistered,
+  isLoopbackIp,
   isMethodAllowed,
   isOnline,
+  isPlainObject,
   isPrismaClientRegistered,
   isProduction,
   isProjectConfigRegistered,
@@ -2543,16 +2170,23 @@ export {
   isRedisClientRegistered,
   isRuntimeMapsProviderRegistered,
   isServicesConfigRegistered,
+  isSessionProviderRegistered,
+  issueOneTimeToken,
   listEmailSenderNames,
   loadEnvFiles,
+  loadPeer,
   normalizeErrorResponse,
   normalizeErrorResponseCore,
+  normalizeOrigin,
   notify,
+  oneTimeTokenKey,
   parseServiceRouteName,
   parseTransportRouteName,
+  performLogout,
   prisma,
   processUpload,
   readBootUuid,
+  readSession,
   recordMetricAcrossTrackers,
   redis,
   registerApiAbortController,
@@ -2571,20 +2205,25 @@ export {
   registerLocalizedNormalizer,
   registerLogger,
   registerNotifier,
+  registerPreCaptureFilter,
   registerPrismaClient,
   registerProjectConfig,
   registerRateLimitStrategy,
   registerRedactedLogKeys,
   registerRedisClient,
   registerRedisKeyFormatter,
+  registerRoomNameFormatter,
   registerRuntimeMapsProvider,
   registerServicesConfig,
+  registerSessionProvider,
   registerSocketMiddleware,
+  registerStrayPrefixCommand,
   registerSyncAbortController,
   registerSyncHook,
   releaseLease,
   removeApiQueueItem,
   removeApiQueueItemsByKey,
+  removeSession,
   removeSyncQueueItem,
   renewLease,
   resetClientsForTests,
@@ -2592,10 +2231,20 @@ export {
   resetLoggerForTests,
   resetRedactedLogKeysForTests,
   resetRedisKeyFormatterForTests,
+  resetSessionProviderForTests,
+  resolveClientIp,
   resolveEnvKey,
   resolveErrorMessage,
   resolveFromRoot,
+  resolveHealthHashConfig,
+  resolveHealthHashConfigFromDescriptor,
+  runWithErrorTrackerIdentity,
+  runWithErrorTrackerIdentityScope,
+  sanitizeErrorString,
+  sanitizeErrorStrings,
+  sanitizeForLog,
   serveAvatar,
+  setCurrentErrorTrackerIdentity,
   setErrorTrackerUser,
   setIoInstance,
   setSentryUser,
@@ -2605,13 +2254,16 @@ export {
   socketEventNames,
   startSpan,
   startSpanAcrossTrackers,
+  startSpanHandle,
   tryCatch,
+  tryCatchSync,
   unregisterApiAbortController,
   unregisterSyncAbortController,
   validateInputByType,
   validatePagePath,
   validateRequest,
   waitForSocket,
-  writeBootUuid
+  writeBootUuid,
+  writeSession
 };
 //# sourceMappingURL=index.js.map