@luckystack/login 0.1.0

package/dist/index.js

@@ -0,0 +1,1497 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/sessionAdapter.ts
+import { redis, tryCatch, formatKey } from "@luckystack/core";
+var sessionKey, activeUsersKey, redisSessionAdapter, activeAdapter, registerSessionAdapter, getSessionAdapter;
+var init_sessionAdapter = __esm({
+  "src/sessionAdapter.ts"() {
+    "use strict";
+    sessionKey = (token) => formatKey("-session", token);
+    activeUsersKey = (userId) => formatKey("-activeUsers", userId);
+    redisSessionAdapter = {
+      name: "redis",
+      async getRaw(token) {
+        const [error, value] = await tryCatch(async () => await redis.get(sessionKey(token)));
+        if (error) return null;
+        return value ?? null;
+      },
+      async setRaw(token, value, ttlSeconds) {
+        const key = sessionKey(token);
+        await redis.set(key, value);
+        await redis.expire(key, ttlSeconds);
+      },
+      async delete(token) {
+        await redis.del(sessionKey(token));
+      },
+      async expire(token, ttlSeconds) {
+        const result = await redis.expire(sessionKey(token), ttlSeconds);
+        return result === 1;
+      },
+      async ttl(token) {
+        const [error, value] = await tryCatch(async () => await redis.ttl(sessionKey(token)));
+        if (error) return null;
+        return typeof value === "number" ? value : null;
+      },
+      async trackActive(userId, token, ttlSeconds) {
+        const key = activeUsersKey(userId);
+        await redis.sadd(key, token);
+        await redis.expire(key, ttlSeconds);
+      },
+      async untrackActive(userId, token) {
+        await redis.srem(activeUsersKey(userId), token);
+      },
+      async listActive(userId) {
+        const [error, value] = await tryCatch(async () => await redis.smembers(activeUsersKey(userId)));
+        if (error || !Array.isArray(value)) return [];
+        return value;
+      },
+      async listAll() {
+        const pattern = `${formatKey("-session", "")}:*`;
+        const collected = [];
+        let cursor = "0";
+        do {
+          const [scanError, scanResponse] = await tryCatch(
+            async () => await redis.scan(cursor, "MATCH", pattern, "COUNT", 100)
+          );
+          if (scanError || !scanResponse) break;
+          cursor = scanResponse[0];
+          const keys = scanResponse[1];
+          if (Array.isArray(keys) && keys.length > 0) {
+            const values = await Promise.all(keys.map((k) => redis.get(k)));
+            for (const [idx, k] of keys.entries()) {
+              const raw = values[idx];
+              if (raw) {
+                collected.push({
+                  token: k.replace(`${formatKey("-session", "")}:`, ""),
+                  raw
+                });
+              }
+            }
+          }
+        } while (cursor !== "0");
+        return collected;
+      }
+    };
+    activeAdapter = redisSessionAdapter;
+    registerSessionAdapter = (adapter) => {
+      activeAdapter = adapter;
+    };
+    getSessionAdapter = () => activeAdapter;
+  }
+});
+
+// src/logout.ts
+var logout_exports = {};
+__export(logout_exports, {
+  logout: () => logout
+});
+import { redis as redisClient, tryCatch as tryCatch2, socketEventNames, dispatchHook, getLogger } from "@luckystack/core";
+var logout;
+var init_logout = __esm({
+  "src/logout.ts"() {
+    "use strict";
+    init_session();
+    logout = async ({ token, socket, userId, skipSessionDelete }) => {
+      const [error, result] = await tryCatch2(async () => {
+        if (!socket) {
+          getLogger().warn("logout: invalid socket");
+          return;
+        }
+        if (!token) {
+          getLogger().warn("logout: no token provided");
+          return;
+        }
+        const preLogoutResult = await dispatchHook("preLogout", { userId, token });
+        if (preLogoutResult.stopped) {
+          getLogger().warn("logout: aborted by preLogout hook", { errorCode: preLogoutResult.signal.errorCode });
+          socket.emit(socketEventNames.logout, "error");
+          return;
+        }
+        getLogger().debug(`logout: user ${userId ?? "?"}`, { token });
+        if (!skipSessionDelete) {
+          await deleteSession(token);
+        }
+        if (userId) {
+          await redisClient.srem(activeUsersKeyFor(userId), token);
+        }
+        socket.leave(token);
+        await dispatchHook("postLogout", { userId, token });
+        return true;
+      });
+      if (error) {
+        if (socket) {
+          socket.emit(socketEventNames.logout, "error");
+        }
+      } else if (result && socket) {
+        if (process.env.LUCKYSTACK_TRACE_SESSION_DELETES === "1") {
+          getLogger().warn("[session] logout success \u2014 emitting logout to socket", {
+            tokenPrefix: token ? token.slice(0, 8) : null,
+            userId,
+            socketId: socket.id,
+            stack: new Error("logout invoked").stack
+          });
+        }
+        socket.emit(socketEventNames.logout, "success");
+      }
+    };
+  }
+});
+
+// src/session.ts
+import { randomBytes } from "crypto";
+import {
+  socketEventNames as socketEventNames2,
+  dispatchHook as dispatchHook2,
+  getCsrfConfig,
+  getLogger as getLogger2,
+  getProjectConfig,
+  formatKey as formatKey2,
+  tryCatch as tryCatch3
+} from "@luckystack/core";
+var getSessionTtl, isSessionLayout, parseSessionLayout, saveSession, getSession, deleteSession, getAllSessions, revokeUserSessions, sessionKeyFor, activeUsersKeyFor;
+var init_session = __esm({
+  "src/session.ts"() {
+    "use strict";
+    init_sessionAdapter();
+    getSessionTtl = () => 60 * 60 * 24 * getProjectConfig().session.expiryDays;
+    isSessionLayout = (value) => {
+      return value !== null && typeof value === "object" && "id" in value;
+    };
+    parseSessionLayout = (value) => {
+      const parsed = JSON.parse(value);
+      return isSessionLayout(parsed) ? parsed : null;
+    };
+    saveSession = async (token, data, newUser) => {
+      const [error] = await tryCatch3(async () => {
+        const adapter = getSessionAdapter();
+        if (newUser) {
+          const preSessionCreateResult = await dispatchHook2("preSessionCreate", {
+            token,
+            user: data,
+            persistent: !getProjectConfig().session.basedToken
+          });
+          if (preSessionCreateResult.stopped) {
+            getLogger2().warn(`session create aborted by preSessionCreate hook`, { errorCode: preSessionCreateResult.signal.errorCode });
+            return;
+          }
+        }
+        data.csrfToken ??= randomBytes(getCsrfConfig().tokenLength).toString("hex");
+        const ttl = getSessionTtl();
+        await adapter.setRaw(token, JSON.stringify(data), ttl);
+        const userId = data.id;
+        if (userId) {
+          await adapter.trackActive(userId, token, ttl);
+        }
+        const { getIoInstance } = await import("@luckystack/core");
+        const io = getIoInstance();
+        if (!io) return;
+        if (newUser && userId) {
+          const sessionCfg = getProjectConfig().session;
+          const effectivePerUser = sessionCfg.allowMultiple ? "multiple" : sessionCfg.perUser;
+          const cap = sessionCfg.maxConcurrentPerUser;
+          const allTokens = await adapter.listActive(userId);
+          const previousTokens = allTokens.filter((t) => t !== token);
+          let tokensToKick = [];
+          if (effectivePerUser === "single") {
+            tokensToKick = previousTokens;
+          } else if (cap !== null && previousTokens.length + 1 > cap && sessionCfg.onConflict === "revokeOld") {
+            const excess = previousTokens.length + 1 - cap;
+            tokensToKick = previousTokens.slice(0, excess);
+          }
+          if (tokensToKick.length > 0) {
+            const { logout: logout2 } = await Promise.resolve().then(() => (init_logout(), logout_exports));
+            await Promise.all(tokensToKick.map(async (previousToken) => {
+              const sockets = io.sockets.adapter.rooms.get(previousToken);
+              if (sockets) {
+                getLogger2().debug(`Kicking previous session for user ${userId}`);
+                if (sessionCfg.notifyOldDeviceOnRevoke) {
+                  io.to(previousToken).emit(socketEventNames2.sessionReplaced, JSON.stringify({
+                    reason: "session-replaced",
+                    userId
+                  }));
+                }
+                for (const socketId of sockets) {
+                  const socket = io.sockets.sockets.get(socketId);
+                  if (socket) {
+                    await logout2({ token: previousToken, socket, userId });
+                  }
+                }
+              } else {
+                await adapter.delete(previousToken);
+                await adapter.untrackActive(userId, previousToken);
+              }
+            }));
+          }
+        }
+        if (io.sockets.adapter.rooms.has(token)) {
+          io.to(token).emit(socketEventNames2.updateSession, JSON.stringify(data));
+        }
+        if (newUser) {
+          await dispatchHook2("postSessionCreate", { token, user: data, persistent: !getProjectConfig().session.basedToken });
+        }
+      }, void 0, { fn: "saveSession", token });
+      if (error) {
+        getLogger2().error("saveSession failed", error, { token });
+      }
+    };
+    getSession = async (token) => {
+      if (!token) return null;
+      const [error, value] = await tryCatch3(async () => {
+        const adapter = getSessionAdapter();
+        const raw = await adapter.getRaw(token);
+        if (!raw) return null;
+        const parsed = parseSessionLayout(raw);
+        const userId = parsed?.id ?? null;
+        const newTtl = getSessionTtl();
+        const oldTtl = await adapter.ttl(token);
+        const preRefreshResult = await dispatchHook2("preSessionRefresh", { token, userId, oldTtl, newTtl });
+        let applied = false;
+        if (!preRefreshResult.stopped) {
+          applied = await adapter.expire(token, newTtl);
+        }
+        await dispatchHook2("postSessionRefresh", {
+          token,
+          userId,
+          oldTtl,
+          newTtl,
+          applied
+        });
+        if (!parsed) return null;
+        const merged = { ...parsed, token };
+        return merged;
+      }, void 0, { fn: "getSession", token });
+      if (error) {
+        getLogger2().error("getSession failed", error, { token });
+        return null;
+      }
+      return value;
+    };
+    deleteSession = async (token) => {
+      if (process.env.LUCKYSTACK_TRACE_SESSION_DELETES === "1") {
+        getLogger2().warn("[session] deleteSession invoked", {
+          tokenPrefix: token.slice(0, 8),
+          stack: new Error("deleteSession invoked").stack
+        });
+      }
+      const [error, ok] = await tryCatch3(async () => {
+        const adapter = getSessionAdapter();
+        const raw = await adapter.getRaw(token);
+        let resolvedUserId = null;
+        if (raw) {
+          resolvedUserId = parseSessionLayout(raw)?.id ?? null;
+        }
+        const preSessionDeleteResult = await dispatchHook2("preSessionDelete", { token, userId: resolvedUserId });
+        if (preSessionDeleteResult.stopped) {
+          getLogger2().warn(`session delete aborted by preSessionDelete hook`, { errorCode: preSessionDeleteResult.signal.errorCode });
+          return false;
+        }
+        if (raw && resolvedUserId) {
+          const { getIoInstance } = await import("@luckystack/core");
+          const ioInstance = getIoInstance();
+          if (ioInstance) {
+            const { logout: logout2 } = await Promise.resolve().then(() => (init_logout(), logout_exports));
+            const sockets = ioInstance.sockets.adapter.rooms.get(token);
+            if (sockets) {
+              await Promise.all([...sockets].map(async (socketId) => {
+                const socket = ioInstance.sockets.sockets.get(socketId);
+                if (!socket) return;
+                await logout2({
+                  token,
+                  socket,
+                  userId: resolvedUserId,
+                  skipSessionDelete: true
+                });
+              }));
+            }
+          }
+          await adapter.untrackActive(resolvedUserId, token);
+        }
+        await adapter.delete(token);
+        await dispatchHook2("postSessionDelete", { token, userId: resolvedUserId });
+        return true;
+      }, void 0, { fn: "deleteSession", token });
+      if (error) {
+        getLogger2().error("deleteSession failed", error, { token });
+        return false;
+      }
+      return ok ?? false;
+    };
+    getAllSessions = async () => {
+      const [error, sessions] = await tryCatch3(async () => {
+        const adapter = getSessionAdapter();
+        if (!adapter.listAll) {
+          getLogger2().warn(`[session] getAllSessions: adapter '${adapter.name}' does not implement listAll \u2014 returning empty`);
+          return [];
+        }
+        const rows = await adapter.listAll();
+        const parsedSessions = [];
+        for (const { raw } of rows) {
+          const parsed = parseSessionLayout(raw);
+          if (parsed) parsedSessions.push(parsed);
+        }
+        return parsedSessions;
+      }, void 0, { fn: "getAllSessions" });
+      if (error) {
+        getLogger2().error("getAllSessions failed", error);
+        return [];
+      }
+      return sessions ?? [];
+    };
+    revokeUserSessions = async (userId, exceptToken) => {
+      if (!userId) return 0;
+      const adapter = getSessionAdapter();
+      const tokens = await adapter.listActive(userId);
+      const targets = exceptToken ? tokens.filter((t) => t !== exceptToken) : tokens;
+      await Promise.all(targets.map((token) => deleteSession(token)));
+      return targets.length;
+    };
+    sessionKeyFor = (token) => formatKey2("-session", token);
+    activeUsersKeyFor = (userId) => formatKey2("-activeUsers", userId);
+  }
+});
+
+// src/index.ts
+init_session();
+init_sessionAdapter();
+
+// src/oauthProviders.ts
+import { tryCatch as tryCatch4 } from "@luckystack/core";
+var asOAuthUserData = (value) => {
+  if (value && typeof value === "object") {
+    return value;
+  }
+  return {};
+};
+var isFullOAuthProvider = (provider) => provider.name !== "credentials";
+var mergeScopes = (defaults, extra) => {
+  if (!extra || extra.length === 0) return defaults;
+  return [.../* @__PURE__ */ new Set([...defaults, ...extra])];
+};
+var requireString = (value, label) => {
+  if (!value || value.length === 0) {
+    throw new Error(`OAuth provider configuration error: ${label} is empty.`);
+  }
+  return value;
+};
+var credentialsProvider = () => ({ name: "credentials" });
+var googleProvider = (input) => ({
+  name: "google",
+  clientID: requireString(input.clientId, "google clientId"),
+  clientSecret: requireString(input.clientSecret, "google clientSecret"),
+  callbackURL: input.callbackUrl,
+  authorizationURL: input.endpoints?.authorizationURL ?? "https://accounts.google.com/o/oauth2/v2/auth",
+  tokenExchangeURL: input.endpoints?.tokenExchangeURL ?? "https://oauth2.googleapis.com/token",
+  tokenExchangeMethod: "json",
+  userInfoURL: input.endpoints?.userInfoURL ?? "https://www.googleapis.com/oauth2/v1/userinfo",
+  scope: mergeScopes([
+    "https://www.googleapis.com/auth/userinfo.profile",
+    "https://www.googleapis.com/auth/userinfo.email"
+  ], input.extraScopes),
+  nameKey: "name",
+  emailKey: "email",
+  avatarKey: "picture",
+  avatarCodeKey: "",
+  extraSessionFields: input.extraSessionFields
+});
+var githubProvider = (input) => ({
+  name: "github",
+  clientID: requireString(input.clientId, "github clientId"),
+  clientSecret: requireString(input.clientSecret, "github clientSecret"),
+  callbackURL: input.callbackUrl,
+  authorizationURL: input.endpoints?.authorizationURL ?? "https://github.com/login/oauth/authorize",
+  tokenExchangeURL: input.endpoints?.tokenExchangeURL ?? "https://github.com/login/oauth/access_token",
+  tokenExchangeMethod: "json",
+  userInfoURL: input.endpoints?.userInfoURL ?? "https://api.github.com/user",
+  scope: mergeScopes(["read:user", "user:email"], input.extraScopes),
+  nameKey: "login",
+  emailKey: "email",
+  avatarKey: "avatar_url",
+  avatarCodeKey: "",
+  extraSessionFields: input.extraSessionFields,
+  getEmail: async (accessToken) => {
+    const fetchEmails = async () => {
+      const response = await fetch("https://api.github.com/user/emails", {
+        method: "GET",
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "application/json",
+          Authorization: `Bearer ${accessToken}`
+        }
+      });
+      if (!response.ok) return false;
+      const emails2 = await response.json();
+      if (!Array.isArray(emails2)) return false;
+      return emails2;
+    };
+    const [error, emails] = await tryCatch4(fetchEmails);
+    if (error || !emails) return false;
+    let mainEmail;
+    for (const entry of emails) {
+      if (entry.primary && typeof entry.email === "string") mainEmail = entry.email;
+    }
+    mainEmail ??= emails[0]?.email;
+    return mainEmail;
+  }
+});
+var discordProvider = (input) => ({
+  name: "discord",
+  clientID: requireString(input.clientId, "discord clientId"),
+  clientSecret: requireString(input.clientSecret, "discord clientSecret"),
+  callbackURL: input.callbackUrl,
+  authorizationURL: input.endpoints?.authorizationURL ?? "https://discord.com/oauth2/authorize",
+  tokenExchangeURL: input.endpoints?.tokenExchangeURL ?? "https://discord.com/api/oauth2/token",
+  tokenExchangeMethod: "form",
+  userInfoURL: input.endpoints?.userInfoURL ?? "https://discord.com/api/users/@me",
+  scope: mergeScopes(["identify", "email"], input.extraScopes),
+  nameKey: "username",
+  emailKey: "email",
+  avatarCodeKey: "avatar",
+  extraSessionFields: input.extraSessionFields,
+  getAvatar: ({ userData, avatarId }) => {
+    if (!avatarId) return;
+    const userId = typeof userData.id === "string" ? userData.id : "";
+    if (!userId) return;
+    const format = avatarId.startsWith("a_") ? "gif" : "png";
+    return `https://cdn.discordapp.com/avatars/${userId}/${avatarId}.${format}`;
+  }
+});
+var facebookProvider = (input) => {
+  const v = input.apiVersion ?? "v18.0";
+  return {
+    name: "facebook",
+    clientID: requireString(input.clientId, "facebook clientId"),
+    clientSecret: requireString(input.clientSecret, "facebook clientSecret"),
+    callbackURL: input.callbackUrl,
+    authorizationURL: input.endpoints?.authorizationURL ?? `https://www.facebook.com/${v}/dialog/oauth`,
+    tokenExchangeURL: input.endpoints?.tokenExchangeURL ?? `https://graph.facebook.com/${v}/oauth/access_token`,
+    tokenExchangeMethod: "form",
+    userInfoURL: input.endpoints?.userInfoURL ?? "https://graph.facebook.com/me?fields=id,name,email,picture.type(large)",
+    scope: mergeScopes(["public_profile", "email"], input.extraScopes),
+    nameKey: "name",
+    emailKey: "email",
+    avatarCodeKey: "",
+    extraSessionFields: input.extraSessionFields,
+    getAvatar: ({ userData }) => {
+      const picture = asOAuthUserData(userData.picture);
+      const pictureData = asOAuthUserData(picture.data);
+      const url = pictureData.url;
+      return typeof url === "string" ? url : void 0;
+    }
+  };
+};
+var microsoftProvider = (input) => {
+  const tenant = input.tenant ?? "common";
+  const oauthVersion = input.apiVersion ?? "v2.0";
+  const graphVersion = input.graphApiVersion ?? "v1.0";
+  return {
+    name: "microsoft",
+    clientID: requireString(input.clientId, "microsoft clientId"),
+    clientSecret: requireString(input.clientSecret, "microsoft clientSecret"),
+    callbackURL: input.callbackUrl,
+    authorizationURL: input.endpoints?.authorizationURL ?? `https://login.microsoftonline.com/${tenant}/oauth2/${oauthVersion}/authorize`,
+    tokenExchangeURL: input.endpoints?.tokenExchangeURL ?? `https://login.microsoftonline.com/${tenant}/oauth2/${oauthVersion}/token`,
+    tokenExchangeMethod: "form",
+    userInfoURL: input.endpoints?.userInfoURL ?? `https://graph.microsoft.com/${graphVersion}/me`,
+    scope: mergeScopes(["openid", "profile", "email", "User.Read"], input.extraScopes),
+    nameKey: "displayName",
+    emailKey: "mail",
+    avatarCodeKey: "id",
+    extraSessionFields: input.extraSessionFields,
+    //? Graph's /photo/$value requires bearer auth, so we can't store the URL —
+    //? a browser <img> would 401. Fetch the bytes and inline as a data URL.
+    getAvatar: async ({ avatarId, accessToken }) => {
+      if (!avatarId) return;
+      const fetchPhoto = async () => {
+        const response = await fetch(
+          `https://graph.microsoft.com/${graphVersion}/users/${avatarId}/photo/$value`,
+          { method: "GET", headers: { Authorization: `Bearer ${accessToken}` } }
+        );
+        if (!response.ok) return;
+        const contentType = response.headers.get("content-type") ?? "image/jpeg";
+        const buffer = Buffer.from(await response.arrayBuffer());
+        return `data:${contentType};base64,${buffer.toString("base64")}`;
+      };
+      const [error, dataUrl] = await tryCatch4(fetchPhoto);
+      if (error) return;
+      return dataUrl ?? void 0;
+    },
+    getEmail: async (accessToken) => {
+      const fetchProfile = async () => {
+        const response = await fetch(`https://graph.microsoft.com/${graphVersion}/me`, {
+          method: "GET",
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+            "Content-Type": "application/json"
+          }
+        });
+        if (!response.ok) return false;
+        const data = await response.json();
+        if (!data || typeof data !== "object") return false;
+        return data;
+      };
+      const [error, profile] = await tryCatch4(fetchProfile);
+      if (error || !profile) return false;
+      const record = asOAuthUserData(profile);
+      const mail = typeof record.mail === "string" ? record.mail : "";
+      const userPrincipalName = typeof record.userPrincipalName === "string" ? record.userPrincipalName : "";
+      return mail || userPrincipalName || false;
+    }
+  };
+};
+var registeredProviders = [{ name: "credentials" }];
+var getOAuthProviders = () => registeredProviders;
+var registerOAuthProviders = (providers) => {
+  registeredProviders = providers;
+  return registeredProviders;
+};
+
+// src/redirectResolver.ts
+var activeResolver = null;
+var registerPostLoginRedirect = (resolver) => {
+  activeResolver = resolver;
+  return resolver;
+};
+var getPostLoginRedirect = () => activeResolver;
+
+// src/login.ts
+init_session();
+import { URLSearchParams } from "url";
+import { tryCatch as tryCatch5, redis as redisClient2, getUploadsDir, dispatchHook as dispatchHook3, getLogger as getLogger3, formatKey as formatKey3 } from "@luckystack/core";
+import bcrypt from "bcryptjs";
+import { randomBytes as randomBytes2 } from "crypto";
+import validator from "validator";
+import { getProjectConfig as getProjectConfig3 } from "@luckystack/core";
+
+// src/userAdapter.ts
+import { prisma } from "@luckystack/core";
+var registeredAdapter = null;
+var registerUserAdapter = (adapter) => {
+  registeredAdapter = adapter;
+  return registeredAdapter;
+};
+var isUserAdapterRegistered = () => registeredAdapter !== null;
+var getPrismaUser = () => (
+  // eslint-disable-next-line no-restricted-syntax -- structural Prisma boundary
+  prisma.user
+);
+var defaultPrismaUserAdapter = () => {
+  return {
+    findByEmail: async ({ email, provider }) => getPrismaUser().findFirst({ where: { email, provider } }),
+    findById: async (id) => getPrismaUser().findUnique({ where: { id } }),
+    create: async (input) => getPrismaUser().create({
+      data: {
+        email: input.email,
+        provider: input.provider,
+        name: input.name,
+        password: input.password ?? null,
+        avatar: input.avatar ?? "",
+        avatarFallback: input.avatarFallback,
+        language: input.language
+      }
+    }),
+    update: async (id, patch) => getPrismaUser().update({ where: { id }, data: patch })
+  };
+};
+var cachedDefaultAdapter = null;
+var getUserAdapter = () => {
+  if (registeredAdapter) return registeredAdapter;
+  cachedDefaultAdapter ??= defaultPrismaUserAdapter();
+  return cachedDefaultAdapter;
+};
+
+// src/passwordPolicy.ts
+import { getProjectConfig as getProjectConfig2 } from "@luckystack/core";
+
+// src/data/commonPasswords.ts
+var COMMON_PASSWORD_LIST = [
+  "123456",
+  "password",
+  "12345678",
+  "qwerty",
+  "123456789",
+  "12345",
+  "1234",
+  "111111",
+  "1234567",
+  "dragon",
+  "123123",
+  "baseball",
+  "abc123",
+  "football",
+  "monkey",
+  "letmein",
+  "696969",
+  "shadow",
+  "master",
+  "666666",
+  "qwertyuiop",
+  "123321",
+  "mustang",
+  "1234567890",
+  "michael",
+  "654321",
+  "pussy",
+  "superman",
+  "1qaz2wsx",
+  "7777777",
+  "fuckyou",
+  "121212",
+  "000000",
+  "qazwsx",
+  "123qwe",
+  "killer",
+  "trustno1",
+  "jordan",
+  "jennifer",
+  "zxcvbnm",
+  "asdfgh",
+  "hunter",
+  "buster",
+  "soccer",
+  "harley",
+  "batman",
+  "andrew",
+  "tigger",
+  "sunshine",
+  "iloveyou",
+  "fuckme",
+  "2000",
+  "charlie",
+  "robert",
+  "thomas",
+  "hockey",
+  "ranger",
+  "daniel",
+  "starwars",
+  "klaster",
+  "112233",
+  "george",
+  "asshole",
+  "computer",
+  "michelle",
+  "jessica",
+  "pepper",
+  "1111",
+  "zxcvbn",
+  "555555",
+  "11111111",
+  "131313",
+  "freedom",
+  "777777",
+  "pass",
+  "fuck",
+  "maggie",
+  "159753",
+  "aaaaaa",
+  "ginger",
+  "princess",
+  "joshua",
+  "cheese",
+  "amanda",
+  "summer",
+  "love",
+  "ashley",
+  "6969",
+  "nicole",
+  "chelsea",
+  "biteme",
+  "matthew",
+  "access",
+  "yankees",
+  "987654321",
+  "dallas",
+  "austin",
+  "thunder",
+  "taylor",
+  "matrix",
+  "william",
+  "corvette",
+  "hello",
+  "martin",
+  "heather",
+  "secret",
+  "fucker",
+  "merlin",
+  "diamond",
+  "1234qwer",
+  "gfhjkm",
+  "hammer",
+  "silver",
+  "richard",
+  "samantha",
+  "iceman",
+  "tigers",
+  "purple",
+  "andrea",
+  "horney",
+  "dakota",
+  "aaaaa",
+  "player",
+  "sucker",
+  "mercedes",
+  "whatever",
+  "orange",
+  "qweqwe",
+  "mickey",
+  "panties",
+  "hannah",
+  "fucking",
+  "paul",
+  "pakistan",
+  "patrick",
+  "martha",
+  "morgan",
+  "iwantu",
+  "lakers",
+  "rachel",
+  "slayer",
+  "scott",
+  "2112",
+  "fish",
+  "porn",
+  "matt",
+  "qwert",
+  "cookie",
+  "eagle1",
+  "london",
+  "phoenix",
+  "chicago",
+  "badboy",
+  "braves",
+  "yankee",
+  "lover",
+  "barney",
+  "edward",
+  "raiders",
+  "green",
+  "maverick",
+  "rangers",
+  "joseph",
+  "maddog",
+  "mike",
+  "jasmine",
+  "arsenal",
+  "beach",
+  "tiger",
+  "snoopy",
+  "natasha",
+  "matthews",
+  "jackson",
+  "cumshot",
+  "chevy",
+  "gateway",
+  "gators",
+  "angel",
+  "junior",
+  "samson",
+  "6666",
+  "amateur",
+  "gemini",
+  "apples",
+  "august",
+  "biscuit",
+  "5150",
+  "apollo",
+  "parker",
+  "qwerty123",
+  "rabbit",
+  "angela",
+  "love123",
+  "rocket",
+  "scooby",
+  "beaver",
+  "oliver",
+  "walter",
+  "blowme",
+  "spider",
+  "4321",
+  "cumshot1",
+  "lucky",
+  "helpme",
+  "jackie",
+  "monica"
+];
+var COMMON_PASSWORDS = new Set(
+  COMMON_PASSWORD_LIST.map((p) => p.toLowerCase())
+);
+
+// src/passwordPolicy.ts
+var UPPERCASE_REGEX = /[A-Z]/;
+var LOWERCASE_REGEX = /[a-z]/;
+var NUMBER_REGEX = /\d/;
+var SPECIAL_REGEX = /[^A-Za-z0-9]/;
+var validatePassword = (password) => {
+  const policy = getProjectConfig2().auth.passwordPolicy;
+  if (password.length < policy.minLength) return "login.passwordCharacterMinimum";
+  if (password.length > policy.maxLength) return "login.passwordCharacterLimit";
+  if (policy.requireUppercase && !UPPERCASE_REGEX.test(password)) return "login.passwordRequiresUppercase";
+  if (policy.requireLowercase && !LOWERCASE_REGEX.test(password)) return "login.passwordRequiresLowercase";
+  if (policy.requireNumber && !NUMBER_REGEX.test(password)) return "login.passwordRequiresNumber";
+  if (policy.requireSpecial && !SPECIAL_REGEX.test(password)) return "login.passwordRequiresSpecial";
+  if (policy.forbidCommon && COMMON_PASSWORDS.has(password.toLowerCase())) return "login.passwordTooCommon";
+  if (policy.customValidator) {
+    const customReason = policy.customValidator(password);
+    if (customReason) return customReason;
+  }
+  return null;
+};
+
+// src/login.ts
+import path from "path";
+import { existsSync } from "fs";
+var uploadsFolder = () => getUploadsDir();
+var isDevMode = () => getProjectConfig3().logging.devLogs;
+var { compare, genSalt, hash } = bcrypt;
+var { escape, isEmail } = validator;
+var getOAuthStateKey = (providerName, state) => {
+  return formatKey3("-oauth-state", `${providerName}:${state}`);
+};
+var createOAuthState = async (providerName) => {
+  const state = randomBytes2(32).toString("hex");
+  const key = getOAuthStateKey(providerName, state);
+  const result = await redisClient2.set(key, "1", "EX", getProjectConfig3().auth.oauthStateTtlSeconds, "NX");
+  if (result !== "OK") {
+    return null;
+  }
+  return state;
+};
+var consumeOAuthState = async (providerName, state) => {
+  if (!state) {
+    return false;
+  }
+  const key = getOAuthStateKey(providerName, state);
+  const txResult = await redisClient2.multi().get(key).del(key).exec();
+  if (!txResult || txResult.length < 2) {
+    return false;
+  }
+  const getResult = txResult[0];
+  if (!getResult || getResult[0]) {
+    return false;
+  }
+  return getResult[1] === "1";
+};
+var asRecord = (value) => {
+  if (value && typeof value === "object") {
+    return value;
+  }
+  return {};
+};
+var sanitizeUserForSession = (user) => {
+  const { password: _password, ...safeUser } = user;
+  return safeUser;
+};
+var toReasonKey = (error, fallback = "api.internalServerError") => {
+  if (typeof error === "string" && error.length > 0) {
+    return error;
+  }
+  if (error instanceof Error && error.message) {
+    const message = error.message.toLowerCase();
+    if (message.includes("authentication failed") || message.includes("scram failure")) {
+      return "api.internalServerError";
+    }
+  }
+  return fallback;
+};
+var normalizeCredentials = (params) => ({
+  //? Don't HTML-escape password OR confirmPassword before bcrypt — neither
+  //? reaches HTML, and they're memory-compared for equality during register.
+  //? Escaping confirmPassword while leaving password raw made any password
+  //? containing `& < > " '` fail the `password !== confirmPassword` check
+  //? (regression introduced in pass-1 fix #9 which only un-escaped password).
+  //? Email is normalized (lowercase + trim) and validated via `isEmail`;
+  //? HTML-escaping it would make legacy raw rows unfindable.
+  email: (params.email || "").trim().toLowerCase(),
+  password: params.password || "",
+  name: params.name ? escape(params.name) : void 0,
+  confirmPassword: params.confirmPassword || void 0
+});
+var validateCredentialsShape = (creds) => {
+  const authLimits = getProjectConfig3().auth;
+  if (!creds.email || !creds.password) return { status: false, reason: "login.empty" };
+  if (creds.email.length > authLimits.emailMaxLength) return { status: false, reason: "login.emailCharacterLimit" };
+  if (creds.name && creds.name.length > authLimits.nameMaxLength) return { status: false, reason: "login.nameCharacterLimit" };
+  if (!isEmail(creds.email)) return { status: false, reason: "login.invalidEmailFormat" };
+  const passwordReason = validatePassword(creds.password);
+  if (passwordReason) return { status: false, reason: passwordReason };
+  return null;
+};
+var registerWithCredentials = async ({
+  email,
+  password,
+  name,
+  confirmPassword
+}) => {
+  if (password !== confirmPassword) {
+    return { status: false, reason: "login.passwordNotMatch" };
+  }
+  const preRegisterResult = await dispatchHook3("preRegister", { email, provider: "credentials", name });
+  if (preRegisterResult.stopped) {
+    return { status: false, reason: preRegisterResult.signal.errorCode };
+  }
+  const userAdapter = getUserAdapter();
+  const [checkEmailError, checkEmailResponse] = await tryCatch5(
+    () => userAdapter.findByEmail({ email, provider: "credentials" })
+  );
+  if (checkEmailError) {
+    getLogger3().error("login: findByEmail failed during register", checkEmailError);
+    return { status: false, reason: toReasonKey(checkEmailError) };
+  }
+  if (checkEmailResponse) return { status: false, reason: "login.emailExists" };
+  const createNewUser = async () => {
+    const salt = await genSalt(getProjectConfig3().auth.bcryptRounds);
+    const hashedPassword = await hash(password, salt);
+    return await userAdapter.create({
+      email,
+      provider: "credentials",
+      name,
+      password: hashedPassword,
+      avatar: "",
+      avatarFallback: `#${Math.floor(Math.random() * 16777215).toString(16).padStart(6, "0")}`,
+      language: getProjectConfig3().defaultLanguage
+    });
+  };
+  const [createNewUserError, createNewUserResponse] = await tryCatch5(createNewUser);
+  if (createNewUserError) return { status: false, reason: toReasonKey(createNewUserError) };
+  if (!createNewUserResponse) return { status: false, reason: "login.createUserFailed" };
+  await dispatchHook3("postRegister", { userId: createNewUserResponse.id, provider: "credentials" });
+  return {
+    status: true,
+    reason: "login.userCreated",
+    session: sanitizeUserForSession(createNewUserResponse)
+  };
+};
+var loginWithCredentialsCore = async ({ email, password }) => {
+  const preLoginResult = await dispatchHook3("preLogin", { email, provider: "credentials" });
+  if (preLoginResult.stopped) {
+    return { status: false, reason: preLoginResult.signal.errorCode };
+  }
+  const userAdapter = getUserAdapter();
+  const [findUserError, findUserResponse] = await tryCatch5(
+    () => userAdapter.findByEmail({ email, provider: "credentials" })
+  );
+  if (findUserError) {
+    getLogger3().error("login: findByEmail failed", findUserError);
+    return { status: false, reason: toReasonKey(findUserError) };
+  }
+  if (!findUserResponse) return { status: false, reason: "login.userNotFound" };
+  const [checkPasswordError, checkPasswordResponse] = await tryCatch5(
+    () => compare(password, findUserResponse.password)
+  );
+  if (checkPasswordError) {
+    getLogger3().error("login: bcrypt compare failed", checkPasswordError);
+    return { status: false, reason: checkPasswordError };
+  }
+  if (!checkPasswordResponse) return { status: false, reason: "login.wrongPassword" };
+  const newToken = randomBytes2(32).toString("hex");
+  const previousLogin = findUserResponse.lastLogin ?? null;
+  const nowLogin = /* @__PURE__ */ new Date();
+  await tryCatch5(() => userAdapter.update(findUserResponse.id, { lastLogin: nowLogin }));
+  const newUser = {
+    ...sanitizeUserForSession(findUserResponse),
+    token: newToken,
+    lastLogin: nowLogin,
+    previousLogin
+  };
+  const filePath = path.join(uploadsFolder(), `${newUser.id}.webp`);
+  if (existsSync(filePath)) {
+    newUser.avatar = `${newUser.id}.webp`;
+  }
+  await saveSession(newToken, newUser, true);
+  await dispatchHook3("postLogin", { userId: newUser.id, provider: "credentials", isNewUser: false, token: newToken });
+  if (isDevMode()) {
+    getLogger3().debug(`credentials login success for user ${newUser.id}`);
+  }
+  return { status: true, reason: "login.loggedIn", newToken, session: newUser };
+};
+var loginWithCredentials = async (params) => {
+  const creds = normalizeCredentials(params);
+  if (isDevMode()) {
+    getLogger3().debug(`credentials auth attempt for ${creds.email || "unknown-email"}`);
+  }
+  const validationError = validateCredentialsShape(creds);
+  if (validationError) return validationError;
+  if (creds.name && creds.confirmPassword) {
+    return registerWithCredentials({
+      email: creds.email,
+      password: creds.password,
+      name: creds.name,
+      confirmPassword: creds.confirmPassword
+    });
+  }
+  return loginWithCredentialsCore({ email: creds.email, password: creds.password });
+};
+var isAllowedRedirectUrl = (url) => {
+  if (!URL.canParse(url, "http://placeholder")) return false;
+  const parsed = new URL(url, "http://placeholder");
+  if (parsed.origin === "http://placeholder") {
+    return true;
+  }
+  const allowed = getProjectConfig3().http.cors.allowedOrigins ?? [];
+  if (typeof allowed === "function") {
+    return allowed(parsed.origin);
+  }
+  return allowed.some((origin) => {
+    if (!URL.canParse(origin)) return false;
+    return new URL(origin).origin === parsed.origin;
+  });
+};
+var exchangeOAuthToken = async (provider, code) => {
+  const values = {
+    code,
+    client_id: provider.clientID,
+    client_secret: provider.clientSecret,
+    redirect_uri: provider.callbackURL,
+    grant_type: "authorization_code"
+  };
+  const getToken = async () => {
+    if (provider.tokenExchangeMethod === "json") {
+      const response2 = await fetch(provider.tokenExchangeURL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "Accept": "application/json" },
+        body: JSON.stringify(values)
+      });
+      return await response2.json();
+    }
+    if (provider.tokenExchangeMethod === "form") {
+      const formParams = new URLSearchParams();
+      formParams.append("client_id", provider.clientID);
+      formParams.append("client_secret", provider.clientSecret);
+      formParams.append("code", values.code);
+      formParams.append("grant_type", "authorization_code");
+      formParams.append("redirect_uri", provider.callbackURL);
+      if (isDevMode()) {
+        getLogger3().debug("oauth: token-exchange form params", { params: formParams.toString() });
+      }
+      const response2 = await fetch(provider.tokenExchangeURL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json" },
+        body: formParams.toString()
+      });
+      return await response2.json();
+    }
+    return null;
+  };
+  const [error, response] = await tryCatch5(getToken);
+  if (error) {
+    getLogger3().error("oauth: token exchange failed", error);
+    return null;
+  }
+  const tokenData = asRecord(response);
+  const accessToken = typeof tokenData.access_token === "string" ? tokenData.access_token : "";
+  if (!accessToken) {
+    getLogger3().warn("oauth: no access_token in token response", { provider: provider.name });
+    return null;
+  }
+  return accessToken;
+};
+var fetchOAuthProfile = async (provider, accessToken) => {
+  const getUserData = async () => {
+    const response2 = await fetch(provider.userInfoURL, {
+      method: "GET",
+      headers: {
+        "Content-Type": "application/json",
+        "Accept": "application/json",
+        "Authorization": `Bearer ${accessToken}`
+      }
+    });
+    return await response2.json();
+  };
+  const [error, response] = await tryCatch5(getUserData);
+  if (error) {
+    getLogger3().error("oauth: userInfo fetch failed", error);
+    return null;
+  }
+  const userData = asRecord(response);
+  const name = String(userData[provider.nameKey] || "didnt find a name");
+  const emailValue = userData[provider.emailKey];
+  let email = typeof emailValue === "string" ? emailValue : void 0;
+  const avatarId = provider.avatarCodeKey ? userData[provider.avatarCodeKey] : void 0;
+  const avatarValue = provider?.avatarKey ? String(userData[provider.avatarKey] || "") : provider.getAvatar ? await provider.getAvatar({ userData, avatarId: typeof avatarId === "string" ? avatarId : "", accessToken }) : "";
+  const avatar = typeof avatarValue === "string" ? avatarValue : "";
+  if (!email && provider.getEmail) {
+    const selectedEmail = await provider.getEmail(accessToken);
+    if (!selectedEmail) {
+      getLogger3().warn("oauth: no email found via provider.getEmail", { provider: provider.name });
+      return null;
+    }
+    email = selectedEmail;
+  }
+  return { email, name, avatar };
+};
+var findOrCreateOAuthUser = async (provider, profile) => {
+  const { email, name, avatar } = profile;
+  if (!email) return null;
+  const preLoginResult = await dispatchHook3("preLogin", { email, provider: provider.name });
+  if (preLoginResult.stopped) {
+    getLogger3().warn(`oauth login aborted by preLogin hook`, { errorCode: preLoginResult.signal.errorCode });
+    return null;
+  }
+  const userAdapter = getUserAdapter();
+  const [findError, findResponse] = await tryCatch5(
+    () => userAdapter.findByEmail({ email, provider: provider.name })
+  );
+  if (findError) {
+    getLogger3().error("oauth: findByEmail failed", findError);
+    return null;
+  }
+  if (findResponse?.id) {
+    const filePath = path.join(uploadsFolder(), `${findResponse.id}.webp`);
+    if (existsSync(filePath)) {
+      findResponse.avatar = `${findResponse.id}.webp`;
+    }
+    const previousLogin = findResponse.lastLogin ?? null;
+    const nowLogin = /* @__PURE__ */ new Date();
+    await tryCatch5(() => userAdapter.update(findResponse.id, { lastLogin: nowLogin }));
+    return {
+      user: {
+        ...sanitizeUserForSession(findResponse),
+        token: "",
+        lastLogin: nowLogin,
+        previousLogin
+      },
+      isNewUser: false
+    };
+  }
+  const preRegisterResult = await dispatchHook3("preRegister", { email, provider: provider.name, name });
+  if (preRegisterResult.stopped) {
+    getLogger3().warn(`oauth register aborted by preRegister hook`, { errorCode: preRegisterResult.signal.errorCode });
+    return null;
+  }
+  const createNewUser = async () => userAdapter.create({
+    email,
+    provider: provider.name,
+    name,
+    avatar,
+    avatarFallback: `#${Math.floor(Math.random() * 16777215).toString(16).padStart(6, "0")}`,
+    language: getProjectConfig3().defaultLanguage
+  });
+  const [createError, createResponse] = await tryCatch5(createNewUser);
+  if (createError) {
+    getLogger3().error("oauth: user create failed", createError);
+    return null;
+  }
+  if (!createResponse) return null;
+  return {
+    user: { ...sanitizeUserForSession(createResponse), token: "" },
+    isNewUser: true
+  };
+};
+var resolvePostLoginRedirect = async ({
+  fallbackUrl,
+  userId,
+  providerName,
+  isNewUser
+}) => {
+  const resolver = getPostLoginRedirect();
+  if (!resolver) return fallbackUrl;
+  const [resolverError, resolved] = await tryCatch5(() => resolver({
+    userId,
+    provider: providerName,
+    isNewUser,
+    defaultUrl: fallbackUrl
+  }));
+  if (resolverError) {
+    getLogger3().warn(`[oauth] postLoginRedirect resolver threw`, { message: resolverError.message });
+    return fallbackUrl;
+  }
+  if (resolved && isAllowedRedirectUrl(resolved)) return resolved;
+  if (resolved) {
+    getLogger3().warn(
+      `[oauth] postLoginRedirect returned a URL not in allowed origins \u2014 falling back`,
+      { resolved, fallbackUrl }
+    );
+  }
+  return fallbackUrl;
+};
+var loginCallback = async (pathname, req, _res, options = {}) => {
+  const providerName = pathname.split("/")[3];
+  if (!providerName) return false;
+  const provider = getOAuthProviders().find((p) => p.name === providerName);
+  if (!provider || !req.url) return false;
+  if (!isFullOAuthProvider(provider)) return false;
+  const queryString = req.url.split("?")[1] ?? "";
+  const params = new URLSearchParams(queryString);
+  const code = params.get("code");
+  const state = params.get("state");
+  const stateIsValid = await consumeOAuthState(provider.name, state || "");
+  if (!stateIsValid) {
+    getLogger3().warn("oauth: invalid or missing state", { provider: provider.name });
+    return false;
+  }
+  if (!code) {
+    getLogger3().warn("oauth: no code provided in callback url", { provider: provider.name });
+    return false;
+  }
+  const accessToken = await exchangeOAuthToken(provider, code);
+  if (!accessToken) return false;
+  const profile = await fetchOAuthProfile(provider, accessToken);
+  if (!profile) return false;
+  const resolved = await findOrCreateOAuthUser(provider, profile);
+  if (!resolved) return false;
+  const newToken = randomBytes2(32).toString("hex");
+  resolved.user.token = newToken;
+  const extraSessionFields = provider.extraSessionFields;
+  if (extraSessionFields) {
+    const [extraErr, extra] = await tryCatch5(
+      async () => extraSessionFields({ userData: asOAuthUserData(profile), accessToken })
+    );
+    if (extraErr) {
+      getLogger3().warn(`[oauth:${providerName}] extraSessionFields hook threw \u2014 continuing without extras`, { err: extraErr });
+    } else if (extra) {
+      Object.assign(resolved.user, extra);
+    }
+  }
+  await saveSession(newToken, resolved.user, true);
+  if (resolved.isNewUser) {
+    await dispatchHook3("postRegister", { userId: resolved.user.id, provider: providerName });
+  }
+  await dispatchHook3("postLogin", {
+    userId: resolved.user.id,
+    provider: providerName,
+    isNewUser: resolved.isNewUser,
+    token: newToken
+  });
+  if (isDevMode()) {
+    getLogger3().debug(`oauth login success for user ${resolved.user.id}`);
+  }
+  const fallbackUrl = options.defaultRedirectUrl ?? getProjectConfig3().loginRedirectUrl ?? "/";
+  const redirectUrl = await resolvePostLoginRedirect({
+    fallbackUrl,
+    userId: resolved.user.id,
+    providerName,
+    isNewUser: resolved.isNewUser
+  });
+  return {
+    token: newToken,
+    redirectUrl,
+    userId: resolved.user.id,
+    provider: providerName,
+    isNewUser: resolved.isNewUser
+  };
+};
+
+// src/index.ts
+init_logout();
+
+// src/passwordReset.ts
+import bcrypt2 from "bcryptjs";
+import { randomBytes as randomBytes3 } from "crypto";
+import { getProjectConfig as getProjectConfig4, formatKey as formatKey4, redis as redis2 } from "@luckystack/core";
+var tokenKey = (token) => formatKey4("-pwreset", token);
+var createPasswordResetToken = async (userId) => {
+  const token = randomBytes3(32).toString("hex");
+  const ttl = getProjectConfig4().auth.passwordResetTtlSeconds;
+  await redis2.set(tokenKey(token), userId, "EX", ttl);
+  return token;
+};
+var consumePasswordResetToken = async (token) => {
+  if (!token || typeof token !== "string") return null;
+  const key = tokenKey(token);
+  const txResult = await redis2.multi().get(key).del(key).exec();
+  if (!txResult || txResult.length === 0) return null;
+  const first = txResult[0];
+  if (!first) return null;
+  const [getErr, value] = first;
+  if (getErr) return null;
+  return typeof value === "string" && value.length > 0 ? value : null;
+};
+var updatePasswordHash = async (userId, plaintext) => {
+  const reason = validatePassword(plaintext);
+  if (reason) {
+    throw new PasswordPolicyError(reason);
+  }
+  const salt = await bcrypt2.genSalt(getProjectConfig4().auth.bcryptRounds);
+  const hashedPassword = await bcrypt2.hash(plaintext, salt);
+  const patch = { password: hashedPassword };
+  await getUserAdapter().update(userId, patch);
+};
+var PasswordPolicyError = class extends Error {
+  errorCode;
+  constructor(errorCode) {
+    super(`Password policy violation: ${errorCode}`);
+    this.name = "PasswordPolicyError";
+    this.errorCode = errorCode;
+  }
+};
+var verifyPassword = async (plaintext, hash2) => {
+  return bcrypt2.compare(plaintext, hash2);
+};
+
+// src/forgotPassword.ts
+import { getProjectConfig as getProjectConfig5, dispatchHook as dispatchHook4, getLogger as getLogger4 } from "@luckystack/core";
+var sendPasswordResetEmail = async ({ email, brand }) => {
+  const config = getProjectConfig5();
+  getLogger4().info("[forgotPassword] start", { email, forgotPasswordMode: config.auth.forgotPassword });
+  if (config.auth.forgotPassword !== "framework") {
+    getLogger4().warn('[forgotPassword] auth.forgotPassword is not "framework" \u2014 nothing sent', { mode: config.auth.forgotPassword });
+    return { ok: false, reason: "forgotPassword-not-framework" };
+  }
+  const resolvedBrand = brand ?? config.auth.passwordResetBrand ?? "LuckyStack";
+  const emailModule = await // @ts-expect-error optional peer dep — installed only when forgotPassword === 'framework'
+  import("@luckystack/email").catch((error) => {
+    getLogger4().warn("[forgotPassword] failed to load @luckystack/email \u2014 is it installed?", { error: String(error) });
+    return null;
+  });
+  if (!emailModule) {
+    return { ok: false, reason: "email-module-load-failed" };
+  }
+  const { sendEmail, renderEmailLayout } = emailModule;
+  const userAdapter = getUserAdapter();
+  const user = await userAdapter.findByEmail({ email, provider: "credentials" });
+  getLogger4().info("[forgotPassword] credentials user lookup", { email, found: Boolean(user), userId: user?.id ?? null });
+  if (!user) {
+    getLogger4().warn("[forgotPassword] no credentials account for this email \u2014 nothing sent. Use the email+password account you registered with.", { email });
+    void dispatchHook4("passwordResetRequested", {
+      email,
+      matched: false
+    });
+    return { ok: true };
+  }
+  const token = await createPasswordResetToken(user.id);
+  void dispatchHook4("passwordResetRequested", {
+    email,
+    matched: true,
+    userId: user.id,
+    token,
+    ttlSeconds: config.auth.passwordResetTtlSeconds
+  });
+  const baseUrl = (config.app.publicUrl || "").replace(/\/+$/, "");
+  const resetUrl = `${baseUrl}/reset-password?token=${encodeURIComponent(token)}`;
+  const ttlMinutes = Math.round(config.auth.passwordResetTtlSeconds / 60);
+  const { html, text } = renderEmailLayout({
+    brand: resolvedBrand,
+    title: "Reset your password",
+    intro: `Hi ${user.name ?? "there"}, we received a request to reset the password on your ${resolvedBrand} account. Click the button below to choose a new one. The link expires in ${String(ttlMinutes)} minutes.`,
+    ctaLabel: "Reset password",
+    ctaUrl: resetUrl,
+    outro: `If you didn't request this, you can safely ignore this email \u2014 your password will stay the same. The link: ${resetUrl}`,
+    footer: `Sent by ${resolvedBrand}. If you have questions, reply to this email.`
+  });
+  const result = await sendEmail({
+    to: user.email,
+    subject: `Reset your ${resolvedBrand} password`,
+    html,
+    text,
+    adapterHint: "transactional"
+  });
+  if (result.ok) {
+    getLogger4().info("[forgotPassword] reset email dispatched", { userId: user.id, to: user.email });
+  } else {
+    getLogger4().warn("[forgotPassword] reset email send FAILED", { userId: user.id, reason: result.reason });
+  }
+  return result.ok ? { ok: true } : { ok: false, reason: result.reason };
+};
+
+// src/emailChange.ts
+import { randomBytes as randomBytes4 } from "crypto";
+import { getProjectConfig as getProjectConfig6, formatKey as formatKey5, redis as redis3 } from "@luckystack/core";
+var tokenKey2 = (token) => formatKey5("-email-change", token);
+var createEmailChangeToken = async (userId, newEmail) => {
+  const token = randomBytes4(32).toString("hex");
+  const ttl = getProjectConfig6().auth.emailChangeTtlSeconds;
+  const payload = JSON.stringify({ userId, newEmail });
+  await redis3.set(tokenKey2(token), payload, "EX", ttl);
+  return token;
+};
+var consumeEmailChangeToken = async (token) => {
+  if (!token || typeof token !== "string") return null;
+  const key = tokenKey2(token);
+  const txResult = await redis3.multi().get(key).del(key).exec();
+  if (!txResult || txResult.length === 0) return null;
+  const first = txResult[0];
+  if (!first) return null;
+  const [getErr, value] = first;
+  if (getErr) return null;
+  if (typeof value !== "string" || value.length === 0) return null;
+  try {
+    const parsed = JSON.parse(value);
+    if (!parsed || typeof parsed !== "object" || typeof parsed.userId !== "string" || typeof parsed.newEmail !== "string") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+};
+
+// src/emailChangeNotification.ts
+import { getProjectConfig as getProjectConfig7 } from "@luckystack/core";
+var sendEmailChangeConfirmation = async ({ userId, newEmail, userName, brand }) => {
+  const config = getProjectConfig7();
+  const resolvedBrand = brand ?? config.auth.passwordResetBrand ?? "LuckyStack";
+  const { sendEmail, renderEmailLayout } = await // @ts-expect-error optional peer dep — installed only when the consumer wires email sending
+  import("@luckystack/email");
+  const token = await createEmailChangeToken(userId, newEmail);
+  const baseUrl = (config.app.publicUrl || "").replace(/\/+$/, "");
+  const confirmUrl = `${baseUrl}/settings/confirm-email?token=${encodeURIComponent(token)}`;
+  const ttlMinutes = Math.round(config.auth.emailChangeTtlSeconds / 60);
+  const { html, text } = renderEmailLayout({
+    brand: resolvedBrand,
+    title: "Confirm your new email address",
+    intro: `Hi ${userName ?? "there"}, you (or someone using your ${resolvedBrand} account) asked to change the account email to this address. Click the button below to confirm \u2014 the link expires in ${String(ttlMinutes)} minutes. If you confirm, all of your active sessions will be signed out as a security precaution.`,
+    ctaLabel: "Confirm new email",
+    ctaUrl: confirmUrl,
+    outro: `If you didn't request this, you can safely ignore this email \u2014 nothing will change. The link: ${confirmUrl}`,
+    footer: `Sent by ${resolvedBrand}. If you have questions, reply to this email.`
+  });
+  const result = await sendEmail({
+    to: newEmail,
+    subject: `Confirm your new ${resolvedBrand} email address`,
+    html,
+    text,
+    adapterHint: "transactional"
+  });
+  return result.ok ? { ok: true, token } : { ok: false, reason: result.reason, token };
+};
+export {
+  PasswordPolicyError,
+  activeUsersKeyFor,
+  consumeEmailChangeToken,
+  consumePasswordResetToken,
+  createEmailChangeToken,
+  createOAuthState,
+  createPasswordResetToken,
+  credentialsProvider,
+  defaultPrismaUserAdapter,
+  deleteSession,
+  discordProvider,
+  facebookProvider,
+  getAllSessions,
+  getOAuthProviders,
+  getPostLoginRedirect,
+  getSession,
+  getSessionAdapter,
+  getUserAdapter,
+  githubProvider,
+  googleProvider,
+  isFullOAuthProvider,
+  isUserAdapterRegistered,
+  loginCallback,
+  loginWithCredentials,
+  loginWithCredentialsCore,
+  logout,
+  microsoftProvider,
+  redisSessionAdapter,
+  registerOAuthProviders,
+  registerPostLoginRedirect,
+  registerSessionAdapter,
+  registerUserAdapter,
+  registerWithCredentials,
+  revokeUserSessions,
+  saveSession,
+  sendEmailChangeConfirmation,
+  sendPasswordResetEmail,
+  sessionKeyFor,
+  updatePasswordHash,
+  validatePassword,
+  verifyPassword
+};
+//# sourceMappingURL=index.js.map