@luckystack/login 0.1.9 → 0.2.1

package/dist/index.js

@@ -1,561 +1,95 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-// src/sessionAdapter.ts
-import { redis, tryCatch, formatKey } from "@luckystack/core";
-var sessionKey, activeUsersKey, redisSessionAdapter, activeAdapter, registerSessionAdapter, getSessionAdapter;
-var init_sessionAdapter = __esm({
-  "src/sessionAdapter.ts"() {
-    "use strict";
-    sessionKey = (token) => formatKey("-session", token);
-    activeUsersKey = (userId) => formatKey("-activeUsers", userId);
-    redisSessionAdapter = {
-      name: "redis",
-      async getRaw(token) {
-        const [error, value] = await tryCatch(async () => await redis.get(sessionKey(token)));
-        if (error) return null;
-        return value ?? null;
-      },
-      async setRaw(token, value, ttlSeconds) {
-        const key = sessionKey(token);
-        await redis.set(key, value);
-        await redis.expire(key, ttlSeconds);
-      },
-      async delete(token) {
-        await redis.del(sessionKey(token));
-      },
-      async expire(token, ttlSeconds) {
-        const result = await redis.expire(sessionKey(token), ttlSeconds);
-        return result === 1;
-      },
-      async ttl(token) {
-        const [error, value] = await tryCatch(async () => await redis.ttl(sessionKey(token)));
-        if (error) return null;
-        return typeof value === "number" ? value : null;
-      },
-      async trackActive(userId, token, ttlSeconds) {
-        const key = activeUsersKey(userId);
-        await redis.sadd(key, token);
-        await redis.expire(key, ttlSeconds);
-      },
-      async untrackActive(userId, token) {
-        await redis.srem(activeUsersKey(userId), token);
-      },
-      async listActive(userId) {
-        const [error, value] = await tryCatch(async () => await redis.smembers(activeUsersKey(userId)));
-        if (error || !Array.isArray(value)) return [];
-        return value;
-      },
-      async listAll() {
-        const pattern = `${formatKey("-session", "")}:*`;
-        const collected = [];
-        let cursor = "0";
-        do {
-          const [scanError, scanResponse] = await tryCatch(
-            async () => await redis.scan(cursor, "MATCH", pattern, "COUNT", 100)
-          );
-          if (scanError || !scanResponse) break;
-          cursor = scanResponse[0];
-          const keys = scanResponse[1];
-          if (Array.isArray(keys) && keys.length > 0) {
-            const values = await Promise.all(keys.map((k) => redis.get(k)));
-            for (const [idx, k] of keys.entries()) {
-              const raw = values[idx];
-              if (raw) {
-                collected.push({
-                  token: k.replace(`${formatKey("-session", "")}:`, ""),
-                  raw
-                });
-              }
-            }
-          }
-        } while (cursor !== "0");
-        return collected;
-      }
-    };
-    activeAdapter = redisSessionAdapter;
-    registerSessionAdapter = (adapter) => {
-      activeAdapter = adapter;
-    };
-    getSessionAdapter = () => activeAdapter;
-  }
-});
+import {
+  asOAuthUserData,
+  credentialsProvider,
+  defaultPrismaUserAdapter,
+  discordProvider,
+  facebookProvider,
+  getOAuthProviders,
+  getUserAdapter,
+  githubProvider,
+  googleProvider,
+  isFullOAuthProvider,
+  isUserAdapterRegistered,
+  microsoftProvider,
+  registerOAuthProviderFactory,
+  registerOAuthProviders,
+  registerUserAdapter
+} from "./chunk-22NFCMM7.js";
+import {
+  activeUsersKeyFor,
+  deleteSession,
+  getAllSessions,
+  getSession,
+  getSessionAdapter,
+  getSessionSanitizer,
+  logout,
+  redisSessionAdapter,
+  registerSessionAdapter,
+  registerSessionSanitizer,
+  revokeUserSessions,
+  saveSession,
+  sessionKeyFor
+} from "./chunk-NXXBZT3I.js";
 
-// src/logout.ts
-var logout_exports = {};
-__export(logout_exports, {
-  logout: () => logout
-});
-import { redis as redisClient, tryCatch as tryCatch2, socketEventNames, dispatchHook, getLogger } from "@luckystack/core";
-var logout;
-var init_logout = __esm({
-  "src/logout.ts"() {
-    "use strict";
-    init_session();
-    logout = async ({ token, socket, userId, skipSessionDelete }) => {
-      const [error, result] = await tryCatch2(async () => {
-        if (!socket) {
-          getLogger().warn("logout: invalid socket");
-          return;
-        }
-        if (!token) {
-          getLogger().warn("logout: no token provided");
-          return;
-        }
-        const preLogoutResult = await dispatchHook("preLogout", { userId, token });
-        if (preLogoutResult.stopped) {
-          getLogger().warn("logout: aborted by preLogout hook", { errorCode: preLogoutResult.signal.errorCode });
-          socket.emit(socketEventNames.logout, "error");
-          return;
-        }
-        getLogger().debug(`logout: user ${userId ?? "?"}`, { token });
-        if (!skipSessionDelete) {
-          await deleteSession(token);
-        }
-        if (userId) {
-          await redisClient.srem(activeUsersKeyFor(userId), token);
-        }
-        socket.leave(token);
-        await dispatchHook("postLogout", { userId, token });
-        return true;
-      });
-      if (error) {
-        if (socket) {
-          socket.emit(socketEventNames.logout, "error");
-        }
-      } else if (result && socket) {
-        if (process.env.LUCKYSTACK_TRACE_SESSION_DELETES === "1") {
-          getLogger().warn("[session] logout success \u2014 emitting logout to socket", {
-            tokenPrefix: token ? token.slice(0, 8) : null,
-            userId,
-            socketId: socket.id,
-            stack: new Error("logout invoked").stack
-          });
-        }
-        socket.emit(socketEventNames.logout, "success");
-      }
-    };
-  }
-});
+// src/index.ts
+import { registerSessionProvider } from "@luckystack/core";
 
-// src/session.ts
-import { randomBytes } from "crypto";
+// src/authLockout.ts
 import {
-  socketEventNames as socketEventNames2,
-  dispatchHook as dispatchHook2,
-  getCsrfConfig,
-  getLogger as getLogger2,
   getProjectConfig,
-  formatKey as formatKey2,
-  tryCatch as tryCatch3
+  checkRateLimit,
+  getRateLimitStatus,
+  clearRateLimit,
+  getLogger,
+  registerHook
 } from "@luckystack/core";
-var getSessionTtl, isSessionLayout, parseSessionLayout, saveSession, getSession, deleteSession, getAllSessions, revokeUserSessions, sessionKeyFor, activeUsersKeyFor;
-var init_session = __esm({
-  "src/session.ts"() {
-    "use strict";
-    init_sessionAdapter();
-    getSessionTtl = () => 60 * 60 * 24 * getProjectConfig().session.expiryDays;
-    isSessionLayout = (value) => {
-      return value !== null && typeof value === "object" && "id" in value;
-    };
-    parseSessionLayout = (value) => {
-      const parsed = JSON.parse(value);
-      return isSessionLayout(parsed) ? parsed : null;
-    };
-    saveSession = async (token, data, newUser, options) => {
-      const [error, outcome] = await tryCatch3(async () => {
-        const adapter = getSessionAdapter();
-        if (newUser) {
-          const preSessionCreateResult = await dispatchHook2("preSessionCreate", {
-            token,
-            user: data,
-            persistent: !getProjectConfig().session.basedToken
-          });
-          if (preSessionCreateResult.stopped) {
-            getLogger2().warn(`session create aborted by preSessionCreate hook`, { errorCode: preSessionCreateResult.signal.errorCode });
-            return { ok: false, errorCode: preSessionCreateResult.signal.errorCode || "api.internalServerError" };
-          }
-        }
-        data.csrfToken ??= randomBytes(getCsrfConfig().tokenLength).toString("hex");
-        const ttl = getSessionTtl();
-        await adapter.setRaw(token, JSON.stringify(data), ttl);
-        const userId = data.id;
-        if (userId) {
-          await adapter.trackActive(userId, token, ttl);
-        }
-        const { getIoInstance } = await import("@luckystack/core");
-        const io = getIoInstance();
-        if (!io) return { ok: true };
-        if (newUser && userId) {
-          const sessionCfg = getProjectConfig().session;
-          const effectivePerUser = sessionCfg.allowMultiple ? "multiple" : sessionCfg.perUser;
-          const cap = sessionCfg.maxConcurrentPerUser;
-          const allTokens = await adapter.listActive(userId);
-          const previousTokens = allTokens.filter(
-            (t) => t !== token && t !== options?.supersedeToken
-          );
-          let tokensToKick = [];
-          if (effectivePerUser === "single") {
-            tokensToKick = previousTokens;
-          } else if (cap !== null && previousTokens.length + 1 > cap && sessionCfg.onConflict === "revokeOld") {
-            const excess = previousTokens.length + 1 - cap;
-            tokensToKick = previousTokens.slice(0, excess);
-          }
-          if (tokensToKick.length > 0) {
-            const { logout: logout2 } = await Promise.resolve().then(() => (init_logout(), logout_exports));
-            await Promise.all(tokensToKick.map(async (previousToken) => {
-              const sockets = io.sockets.adapter.rooms.get(previousToken);
-              if (sockets) {
-                getLogger2().debug(`Kicking previous session for user ${userId}`);
-                if (sessionCfg.notifyOldDeviceOnRevoke) {
-                  io.to(previousToken).emit(socketEventNames2.sessionReplaced, JSON.stringify({
-                    reason: "session-replaced",
-                    userId
-                  }));
-                }
-                for (const socketId of sockets) {
-                  const socket = io.sockets.sockets.get(socketId);
-                  if (socket) {
-                    await logout2({ token: previousToken, socket, userId });
-                  }
-                }
-              } else {
-                await adapter.delete(previousToken);
-                await adapter.untrackActive(userId, previousToken);
-              }
-            }));
-          }
-        }
-        if (io.sockets.adapter.rooms.has(token)) {
-          io.to(token).emit(socketEventNames2.updateSession, JSON.stringify(data));
-        }
-        if (newUser) {
-          await dispatchHook2("postSessionCreate", { token, user: data, persistent: !getProjectConfig().session.basedToken });
-        }
-        return { ok: true };
-      }, void 0, { fn: "saveSession", token });
-      if (error) {
-        getLogger2().error("saveSession failed", error, { token });
-        return { ok: false, errorCode: "api.internalServerError" };
-      }
-      return outcome ?? { ok: false, errorCode: "api.internalServerError" };
-    };
-    getSession = async (token) => {
-      if (!token) return null;
-      const [error, value] = await tryCatch3(async () => {
-        const adapter = getSessionAdapter();
-        const raw = await adapter.getRaw(token);
-        if (!raw) return null;
-        const parsed = parseSessionLayout(raw);
-        const userId = parsed?.id ?? null;
-        const newTtl = getSessionTtl();
-        const oldTtl = await adapter.ttl(token);
-        const preRefreshResult = await dispatchHook2("preSessionRefresh", { token, userId, oldTtl, newTtl });
-        let applied = false;
-        if (!preRefreshResult.stopped) {
-          applied = await adapter.expire(token, newTtl);
-        }
-        await dispatchHook2("postSessionRefresh", {
-          token,
-          userId,
-          oldTtl,
-          newTtl,
-          applied
-        });
-        if (!parsed) return null;
-        const merged = { ...parsed, token };
-        return merged;
-      }, void 0, { fn: "getSession", token });
-      if (error) {
-        getLogger2().error("getSession failed", error, { token });
-        return null;
-      }
-      return value;
-    };
-    deleteSession = async (token, options) => {
-      if (process.env.LUCKYSTACK_TRACE_SESSION_DELETES === "1") {
-        getLogger2().warn("[session] deleteSession invoked", {
-          tokenPrefix: token.slice(0, 8),
-          stack: new Error("deleteSession invoked").stack
-        });
-      }
-      const [error, ok] = await tryCatch3(async () => {
-        const adapter = getSessionAdapter();
-        const raw = await adapter.getRaw(token);
-        let resolvedUserId = null;
-        if (raw) {
-          resolvedUserId = parseSessionLayout(raw)?.id ?? null;
-        }
-        const preSessionDeleteResult = await dispatchHook2("preSessionDelete", { token, userId: resolvedUserId });
-        if (preSessionDeleteResult.stopped) {
-          getLogger2().warn(`session delete aborted by preSessionDelete hook`, { errorCode: preSessionDeleteResult.signal.errorCode });
-          return false;
-        }
-        if (raw && resolvedUserId) {
-          const { getIoInstance } = await import("@luckystack/core");
-          const ioInstance = getIoInstance();
-          if (ioInstance && !options?.skipSocketLogout) {
-            const { logout: logout2 } = await Promise.resolve().then(() => (init_logout(), logout_exports));
-            const sockets = ioInstance.sockets.adapter.rooms.get(token);
-            if (sockets) {
-              await Promise.all([...sockets].map(async (socketId) => {
-                const socket = ioInstance.sockets.sockets.get(socketId);
-                if (!socket) return;
-                await logout2({
-                  token,
-                  socket,
-                  userId: resolvedUserId,
-                  skipSessionDelete: true
-                });
-              }));
-            }
-          }
-          await adapter.untrackActive(resolvedUserId, token);
-        }
-        await adapter.delete(token);
-        await dispatchHook2("postSessionDelete", { token, userId: resolvedUserId });
-        return true;
-      }, void 0, { fn: "deleteSession", token });
-      if (error) {
-        getLogger2().error("deleteSession failed", error, { token });
-        return false;
-      }
-      return ok ?? false;
-    };
-    getAllSessions = async () => {
-      const [error, sessions] = await tryCatch3(async () => {
-        const adapter = getSessionAdapter();
-        if (!adapter.listAll) {
-          getLogger2().warn(`[session] getAllSessions: adapter '${adapter.name}' does not implement listAll \u2014 returning empty`);
-          return [];
-        }
-        const rows = await adapter.listAll();
-        const parsedSessions = [];
-        for (const { raw } of rows) {
-          const parsed = parseSessionLayout(raw);
-          if (parsed) parsedSessions.push(parsed);
-        }
-        return parsedSessions;
-      }, void 0, { fn: "getAllSessions" });
-      if (error) {
-        getLogger2().error("getAllSessions failed", error);
-        return [];
-      }
-      return sessions ?? [];
-    };
-    revokeUserSessions = async (userId, exceptToken) => {
-      if (!userId) return 0;
-      const adapter = getSessionAdapter();
-      const tokens = await adapter.listActive(userId);
-      const targets = exceptToken ? tokens.filter((t) => t !== exceptToken) : tokens;
-      await Promise.all(targets.map((token) => deleteSession(token)));
-      return targets.length;
-    };
-    sessionKeyFor = (token) => formatKey2("-session", token);
-    activeUsersKeyFor = (userId) => formatKey2("-activeUsers", userId);
-  }
-});
-
-// src/index.ts
-init_session();
-init_sessionAdapter();
-
-// src/oauthProviders.ts
-import { tryCatch as tryCatch4 } from "@luckystack/core";
-var asOAuthUserData = (value) => {
-  if (value && typeof value === "object") {
-    return value;
-  }
-  return {};
+var lockoutKey = (accountKey, requesterIp) => {
+  const base = `auth:${accountKey.trim().toLowerCase()}`;
+  return requesterIp ? `${base}:${requesterIp}` : base;
 };
-var isFullOAuthProvider = (provider) => provider.name !== "credentials";
-var mergeScopes = (defaults, extra) => {
-  if (!extra || extra.length === 0) return defaults;
-  return [.../* @__PURE__ */ new Set([...defaults, ...extra])];
+var getAuthLockoutConfig = () => {
+  const auth = getProjectConfig().rateLimiting.auth;
+  if (!auth.enabled) return null;
+  return { maxAttempts: auth.maxAttempts, windowMs: auth.windowMs };
 };
-var requireString = (value, label) => {
-  if (!value || value.length === 0) {
-    throw new Error(`OAuth provider configuration error: ${label} is empty.`);
-  }
-  return value;
+var isAccountLocked = async (accountKey, requesterIp) => {
+  const cfg = getAuthLockoutConfig();
+  if (!cfg || !accountKey) return false;
+  const { remaining } = await getRateLimitStatus(lockoutKey(accountKey, requesterIp), cfg.maxAttempts);
+  return remaining <= 0;
 };
-var credentialsProvider = () => ({ name: "credentials" });
-var googleProvider = (input) => ({
-  name: "google",
-  clientID: requireString(input.clientId, "google clientId"),
-  clientSecret: requireString(input.clientSecret, "google clientSecret"),
-  callbackURL: input.callbackUrl,
-  authorizationURL: input.endpoints?.authorizationURL ?? "https://accounts.google.com/o/oauth2/v2/auth",
-  tokenExchangeURL: input.endpoints?.tokenExchangeURL ?? "https://oauth2.googleapis.com/token",
-  tokenExchangeMethod: "json",
-  userInfoURL: input.endpoints?.userInfoURL ?? "https://www.googleapis.com/oauth2/v1/userinfo",
-  scope: mergeScopes([
-    "https://www.googleapis.com/auth/userinfo.profile",
-    "https://www.googleapis.com/auth/userinfo.email"
-  ], input.extraScopes),
-  nameKey: "name",
-  emailKey: "email",
-  avatarKey: "picture",
-  avatarCodeKey: "",
-  extraSessionFields: input.extraSessionFields
-});
-var githubProvider = (input) => ({
-  name: "github",
-  clientID: requireString(input.clientId, "github clientId"),
-  clientSecret: requireString(input.clientSecret, "github clientSecret"),
-  callbackURL: input.callbackUrl,
-  authorizationURL: input.endpoints?.authorizationURL ?? "https://github.com/login/oauth/authorize",
-  tokenExchangeURL: input.endpoints?.tokenExchangeURL ?? "https://github.com/login/oauth/access_token",
-  tokenExchangeMethod: "json",
-  userInfoURL: input.endpoints?.userInfoURL ?? "https://api.github.com/user",
-  scope: mergeScopes(["read:user", "user:email"], input.extraScopes),
-  nameKey: "login",
-  emailKey: "email",
-  avatarKey: "avatar_url",
-  avatarCodeKey: "",
-  extraSessionFields: input.extraSessionFields,
-  getEmail: async (accessToken) => {
-    const fetchEmails = async () => {
-      const response = await fetch("https://api.github.com/user/emails", {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json",
-          Accept: "application/json",
-          Authorization: `Bearer ${accessToken}`
-        }
-      });
-      if (!response.ok) return false;
-      const emails2 = await response.json();
-      if (!Array.isArray(emails2)) return false;
-      return emails2;
-    };
-    const [error, emails] = await tryCatch4(fetchEmails);
-    if (error || !emails) return false;
-    let mainEmail;
-    for (const entry of emails) {
-      if (entry.primary && typeof entry.email === "string") mainEmail = entry.email;
-    }
-    mainEmail ??= emails[0]?.email;
-    return mainEmail;
-  }
-});
-var discordProvider = (input) => ({
-  name: "discord",
-  clientID: requireString(input.clientId, "discord clientId"),
-  clientSecret: requireString(input.clientSecret, "discord clientSecret"),
-  callbackURL: input.callbackUrl,
-  authorizationURL: input.endpoints?.authorizationURL ?? "https://discord.com/oauth2/authorize",
-  tokenExchangeURL: input.endpoints?.tokenExchangeURL ?? "https://discord.com/api/oauth2/token",
-  tokenExchangeMethod: "form",
-  userInfoURL: input.endpoints?.userInfoURL ?? "https://discord.com/api/users/@me",
-  scope: mergeScopes(["identify", "email"], input.extraScopes),
-  nameKey: "username",
-  emailKey: "email",
-  avatarCodeKey: "avatar",
-  extraSessionFields: input.extraSessionFields,
-  getAvatar: ({ userData, avatarId }) => {
-    if (!avatarId) return;
-    const userId = typeof userData.id === "string" ? userData.id : "";
-    if (!userId) return;
-    const format = avatarId.startsWith("a_") ? "gif" : "png";
-    return `https://cdn.discordapp.com/avatars/${userId}/${avatarId}.${format}`;
+var recordAuthFailure = async (accountKey, requesterIp) => {
+  const cfg = getAuthLockoutConfig();
+  if (!cfg || !accountKey) return;
+  const { allowed, remaining } = await checkRateLimit({
+    key: lockoutKey(accountKey, requesterIp),
+    limit: cfg.maxAttempts,
+    windowMs: cfg.windowMs
+  });
+  if (!allowed) {
+    getLogger().warn("[authLockout] account temporarily locked after repeated failures", {
+      remaining,
+      maxAttempts: cfg.maxAttempts
+    });
   }
-});
-var facebookProvider = (input) => {
-  const v = input.apiVersion ?? "v18.0";
-  return {
-    name: "facebook",
-    clientID: requireString(input.clientId, "facebook clientId"),
-    clientSecret: requireString(input.clientSecret, "facebook clientSecret"),
-    callbackURL: input.callbackUrl,
-    authorizationURL: input.endpoints?.authorizationURL ?? `https://www.facebook.com/${v}/dialog/oauth`,
-    tokenExchangeURL: input.endpoints?.tokenExchangeURL ?? `https://graph.facebook.com/${v}/oauth/access_token`,
-    tokenExchangeMethod: "form",
-    userInfoURL: input.endpoints?.userInfoURL ?? "https://graph.facebook.com/me?fields=id,name,email,picture.type(large)",
-    scope: mergeScopes(["public_profile", "email"], input.extraScopes),
-    nameKey: "name",
-    emailKey: "email",
-    avatarCodeKey: "",
-    extraSessionFields: input.extraSessionFields,
-    getAvatar: ({ userData }) => {
-      const picture = asOAuthUserData(userData.picture);
-      const pictureData = asOAuthUserData(picture.data);
-      const url = pictureData.url;
-      return typeof url === "string" ? url : void 0;
-    }
-  };
 };
-var microsoftProvider = (input) => {
-  const tenant = input.tenant ?? "common";
-  const oauthVersion = input.apiVersion ?? "v2.0";
-  const graphVersion = input.graphApiVersion ?? "v1.0";
-  return {
-    name: "microsoft",
-    clientID: requireString(input.clientId, "microsoft clientId"),
-    clientSecret: requireString(input.clientSecret, "microsoft clientSecret"),
-    callbackURL: input.callbackUrl,
-    authorizationURL: input.endpoints?.authorizationURL ?? `https://login.microsoftonline.com/${tenant}/oauth2/${oauthVersion}/authorize`,
-    tokenExchangeURL: input.endpoints?.tokenExchangeURL ?? `https://login.microsoftonline.com/${tenant}/oauth2/${oauthVersion}/token`,
-    tokenExchangeMethod: "form",
-    userInfoURL: input.endpoints?.userInfoURL ?? `https://graph.microsoft.com/${graphVersion}/me`,
-    scope: mergeScopes(["openid", "profile", "email", "User.Read"], input.extraScopes),
-    nameKey: "displayName",
-    emailKey: "mail",
-    avatarCodeKey: "id",
-    extraSessionFields: input.extraSessionFields,
-    //? Graph's /photo/$value requires bearer auth, so we can't store the URL —
-    //? a browser <img> would 401. Fetch the bytes and inline as a data URL.
-    getAvatar: async ({ avatarId, accessToken }) => {
-      if (!avatarId) return;
-      const fetchPhoto = async () => {
-        const response = await fetch(
-          `https://graph.microsoft.com/${graphVersion}/users/${avatarId}/photo/$value`,
-          { method: "GET", headers: { Authorization: `Bearer ${accessToken}` } }
-        );
-        if (!response.ok) return;
-        const contentType = response.headers.get("content-type") ?? "image/jpeg";
-        const buffer = Buffer.from(await response.arrayBuffer());
-        return `data:${contentType};base64,${buffer.toString("base64")}`;
-      };
-      const [error, dataUrl] = await tryCatch4(fetchPhoto);
-      if (error) return;
-      return dataUrl ?? void 0;
-    },
-    getEmail: async (accessToken) => {
-      const fetchProfile = async () => {
-        const response = await fetch(`https://graph.microsoft.com/${graphVersion}/me`, {
-          method: "GET",
-          headers: {
-            Authorization: `Bearer ${accessToken}`,
-            "Content-Type": "application/json"
-          }
-        });
-        if (!response.ok) return false;
-        const data = await response.json();
-        if (!data || typeof data !== "object") return false;
-        return data;
-      };
-      const [error, profile] = await tryCatch4(fetchProfile);
-      if (error || !profile) return false;
-      const record = asOAuthUserData(profile);
-      const mail = typeof record.mail === "string" ? record.mail : "";
-      const userPrincipalName = typeof record.userPrincipalName === "string" ? record.userPrincipalName : "";
-      return mail || userPrincipalName || false;
-    }
-  };
+var clearAuthFailures = async (accountKey, requesterIp) => {
+  const cfg = getAuthLockoutConfig();
+  if (!cfg || !accountKey) return;
+  await clearRateLimit(lockoutKey(accountKey, requesterIp));
 };
-var registeredProviders = [{ name: "credentials" }];
-var getOAuthProviders = () => registeredProviders;
-var registerOAuthProviders = (providers) => {
-  registeredProviders = providers;
-  return registeredProviders;
+var COUNTING_REASONS = /* @__PURE__ */ new Set([
+  "login.wrongPassword"
+]);
+var lockoutHookRegistered = false;
+var registerAuthLockoutHook = () => {
+  if (lockoutHookRegistered) return;
+  lockoutHookRegistered = true;
+  registerHook("loginFailed", async ({ email, provider, reason, stage, requesterIp }) => {
+    if (stage !== "login" || provider !== "credentials") return;
+    if (!email || !COUNTING_REASONS.has(reason)) return;
+    await recordAuthFailure(email, requesterIp);
+  });
 };
 
 // src/redirectResolver.ts
@@ -567,53 +101,33 @@ var registerPostLoginRedirect = (resolver) => {
 var getPostLoginRedirect = () => activeResolver;
 
 // src/login.ts
-init_session();
 import { URLSearchParams } from "url";
-import { tryCatch as tryCatch5, redis as redisClient2, getUploadsDir, dispatchHook as dispatchHook3, getLogger as getLogger3, formatKey as formatKey3 } from "@luckystack/core";
+import { tryCatch, tryCatchSync, redis as redisClient, getUploadsDir, dispatchHook, getLogger as getLogger3, formatKey, getProjectConfig as getProjectConfig4, getCookieValue } from "@luckystack/core";
 import bcrypt from "bcryptjs";
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes, createHash, timingSafeEqual } from "crypto";
 import validator from "validator";
-import { getProjectConfig as getProjectConfig3 } from "@luckystack/core";
 
-// src/userAdapter.ts
-import { prisma } from "@luckystack/core";
-var registeredAdapter = null;
-var registerUserAdapter = (adapter) => {
-  registeredAdapter = adapter;
-  return registeredAdapter;
-};
-var isUserAdapterRegistered = () => registeredAdapter !== null;
-var getPrismaUser = () => (
-  // eslint-disable-next-line no-restricted-syntax -- structural Prisma boundary
-  prisma.user
-);
-var defaultPrismaUserAdapter = () => {
-  return {
-    findByEmail: async ({ email, provider }) => getPrismaUser().findFirst({ where: { email, provider } }),
-    findById: async (id) => getPrismaUser().findUnique({ where: { id } }),
-    create: async (input) => getPrismaUser().create({
-      data: {
-        email: input.email,
-        provider: input.provider,
-        name: input.name,
-        password: input.password ?? null,
-        avatar: input.avatar ?? "",
-        avatarFallback: input.avatarFallback,
-        language: input.language
-      }
-    }),
-    update: async (id, patch) => getPrismaUser().update({ where: { id }, data: patch })
-  };
-};
-var cachedDefaultAdapter = null;
-var getUserAdapter = () => {
-  if (registeredAdapter) return registeredAdapter;
-  cachedDefaultAdapter ??= defaultPrismaUserAdapter();
-  return cachedDefaultAdapter;
+// src/accountStrategy.ts
+import { getProjectConfig as getProjectConfig2, getLogger as getLogger2 } from "@luckystack/core";
+var warnedMissingAnyProvider = false;
+var resolveUserByEmail = async (adapter, { email, provider }) => {
+  const strategy = getProjectConfig2().auth.providerAccountStrategy;
+  if (strategy === "unified") {
+    if (adapter.findByEmailAnyProvider) {
+      return adapter.findByEmailAnyProvider({ email });
+    }
+    if (!warnedMissingAnyProvider) {
+      warnedMissingAnyProvider = true;
+      getLogger2().warn(
+        '[login] auth.providerAccountStrategy is "unified" but the registered UserAdapter does not implement findByEmailAnyProvider \u2014 falling back to provider-scoped lookup (duplicate accounts per provider are still possible). Implement findByEmailAnyProvider on your adapter to enable unified accounts.'
+      );
+    }
+  }
+  return adapter.findByEmail({ email, provider });
 };
 
 // src/passwordPolicy.ts
-import { getProjectConfig as getProjectConfig2 } from "@luckystack/core";
+import { getProjectConfig as getProjectConfig3 } from "@luckystack/core";
 
 // src/data/commonPasswords.ts
 var COMMON_PASSWORD_LIST = [
@@ -833,9 +347,12 @@ var UPPERCASE_REGEX = /[A-Z]/;
 var LOWERCASE_REGEX = /[a-z]/;
 var NUMBER_REGEX = /\d/;
 var SPECIAL_REGEX = /[^A-Za-z0-9]/;
+var BCRYPT_MAX_BYTES = 72;
 var validatePassword = (password) => {
-  const policy = getProjectConfig2().auth.passwordPolicy;
+  const policy = getProjectConfig3().auth.passwordPolicy;
   if (password.length < policy.minLength) return "login.passwordCharacterMinimum";
+  const byteLength = Buffer.byteLength(password, "utf8");
+  if (byteLength > BCRYPT_MAX_BYTES) return "login.passwordCharacterLimit";
   if (password.length > policy.maxLength) return "login.passwordCharacterLimit";
   if (policy.requireUppercase && !UPPERCASE_REGEX.test(password)) return "login.passwordRequiresUppercase";
   if (policy.requireLowercase && !LOWERCASE_REGEX.test(password)) return "login.passwordRequiresLowercase";
@@ -851,37 +368,85 @@ var validatePassword = (password) => {
 
 // src/login.ts
 import path from "path";
-import { existsSync } from "fs";
+import { promises as fsPromises } from "fs";
 var uploadsFolder = () => getUploadsDir();
-var isDevMode = () => getProjectConfig3().logging.devLogs;
+var isDevMode = () => getProjectConfig4().logging.devLogs;
 var { compare, genSalt, hash } = bcrypt;
+var dummyHashCache = /* @__PURE__ */ new Map();
+var getDummyBcryptHash = async () => {
+  const rounds = getProjectConfig4().auth.bcryptRounds;
+  const cached = dummyHashCache.get(rounds);
+  if (cached) return cached;
+  const salt = await genSalt(rounds);
+  const generated = await hash(randomBytes(16).toString("hex"), salt);
+  dummyHashCache.set(rounds, generated);
+  return generated;
+};
 var { escape, isEmail } = validator;
 var getOAuthStateKey = (providerName, state) => {
-  return formatKey3("-oauth-state", `${providerName}:${state}`);
+  return formatKey("-oauth-state", `${providerName}:${state}`);
 };
-var createOAuthState = async (providerName) => {
-  const state = randomBytes2(32).toString("hex");
+var OAUTH_STATE_COOKIE_NAME = "ls-oauth-state";
+var hashStateNonce = (nonce) => createHash("sha256").update(nonce).digest("hex");
+var base64Url = (buf) => buf.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+var generatePkcePair = () => {
+  const verifier = base64Url(randomBytes(32));
+  const challenge = base64Url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+};
+var createOAuthState = async (providerName, options) => {
+  const state = randomBytes(32).toString("hex");
+  const nonce = randomBytes(32).toString("hex");
   const key = getOAuthStateKey(providerName, state);
-  const result = await redisClient2.set(key, "1", "EX", getProjectConfig3().auth.oauthStateTtlSeconds, "NX");
+  const pkce = options?.usePkce ? generatePkcePair() : null;
+  const entry = {
+    nonceHash: hashStateNonce(nonce),
+    ...pkce ? { codeVerifier: pkce.verifier } : {},
+    ...options?.returnUrl ? { returnUrl: options.returnUrl } : {}
+  };
+  const result = await redisClient.set(
+    key,
+    JSON.stringify(entry),
+    "EX",
+    getProjectConfig4().auth.oauthStateTtlSeconds,
+    "NX"
+  );
   if (result !== "OK") {
     return null;
   }
-  return state;
+  return {
+    state,
+    stateCookie: nonce,
+    ...pkce ? { codeChallenge: pkce.challenge } : {}
+  };
 };
-var consumeOAuthState = async (providerName, state) => {
-  if (!state) {
-    return false;
+var consumeOAuthState = async (providerName, state, cookieNonce) => {
+  if (!state || !cookieNonce) {
+    return null;
   }
   const key = getOAuthStateKey(providerName, state);
-  const txResult = await redisClient2.multi().get(key).del(key).exec();
+  const txResult = await redisClient.multi().get(key).del(key).exec();
   if (!txResult || txResult.length < 2) {
-    return false;
+    return null;
   }
   const getResult = txResult[0];
   if (!getResult || getResult[0]) {
-    return false;
+    return null;
+  }
+  const rawValue = getResult[1];
+  if (typeof rawValue !== "string") {
+    return null;
   }
-  return getResult[1] === "1";
+  const [parseErr, entry] = tryCatchSync(() => JSON.parse(rawValue));
+  if (parseErr || !entry || typeof entry.nonceHash !== "string") {
+    return null;
+  }
+  const incomingHash = Buffer.from(hashStateNonce(cookieNonce));
+  const storedHash = Buffer.from(entry.nonceHash);
+  if (incomingHash.length !== storedHash.length || !timingSafeEqual(incomingHash, storedHash)) {
+    return null;
+  }
+  return entry;
 };
 var asRecord = (value) => {
   if (value && typeof value === "object") {
@@ -889,10 +454,26 @@ var asRecord = (value) => {
   }
   return {};
 };
+var readStringField = (record, key, fallback = "") => {
+  const value = record[key];
+  if (typeof value === "string") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  if (typeof value === "boolean") return String(value);
+  return fallback;
+};
+var generateAvatarFallbackColor = () => `#${Math.floor(Math.random() * 16777215).toString(16).padStart(6, "0")}`;
+var resolveUploadedAvatar = async (userId) => {
+  const filePath = path.join(uploadsFolder(), `${userId}.webp`);
+  const [, avatarStat] = await tryCatch(() => fsPromises.stat(filePath));
+  return avatarStat ? `${userId}.webp` : null;
+};
 var sanitizeUserForSession = (user) => {
   const { password: _password, ...safeUser } = user;
   return safeUser;
 };
+var emitLoginFailed = (payload) => {
+  void dispatchHook("loginFailed", payload);
+};
 var toReasonKey = (error, fallback = "api.internalServerError") => {
   if (typeof error === "string" && error.length > 0) {
     return error;
@@ -913,19 +494,26 @@ var normalizeCredentials = (params) => ({
   //? (regression introduced in pass-1 fix #9 which only un-escaped password).
   //? Email is normalized (lowercase + trim) and validated via `isEmail`;
   //? HTML-escaping it would make legacy raw rows unfindable.
-  email: (params.email || "").trim().toLowerCase(),
-  password: params.password || "",
+  email: (params.email ?? "").trim().toLowerCase(),
+  password: params.password ?? "",
   name: params.name ? escape(params.name) : void 0,
+  //? Empty-string confirmPassword must collapse to `undefined` so the
+  //? register-vs-login dispatcher's truthiness check treats a blank field as
+  //? "absent". `??` would keep the empty string (only nullish collapses), so the
+  //? falsy-coercing `||` is deliberate here.
+  // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- intentional empty-string → undefined collapse
   confirmPassword: params.confirmPassword || void 0
 });
-var validateCredentialsShape = (creds) => {
-  const authLimits = getProjectConfig3().auth;
+var validateCredentialsShape = (creds, mode) => {
+  const authLimits = getProjectConfig4().auth;
   if (!creds.email || !creds.password) return { status: false, reason: "login.empty" };
   if (creds.email.length > authLimits.emailMaxLength) return { status: false, reason: "login.emailCharacterLimit" };
   if (creds.name && creds.name.length > authLimits.nameMaxLength) return { status: false, reason: "login.nameCharacterLimit" };
   if (!isEmail(creds.email)) return { status: false, reason: "login.invalidEmailFormat" };
-  const passwordReason = validatePassword(creds.password);
-  if (passwordReason) return { status: false, reason: passwordReason };
+  if (mode === "register") {
+    const passwordReason = validatePassword(creds.password);
+    if (passwordReason) return { status: false, reason: passwordReason };
+  }
   return null;
 };
 var registerWithCredentials = async ({
@@ -933,25 +521,36 @@ var registerWithCredentials = async ({
   password,
   name,
   confirmPassword
-}) => {
+}, options) => {
   if (password !== confirmPassword) {
+    emitLoginFailed({ email, provider: "credentials", reason: "login.passwordNotMatch", stage: "register" });
     return { status: false, reason: "login.passwordNotMatch" };
   }
-  const preRegisterResult = await dispatchHook3("preRegister", { email, provider: "credentials", name });
+  const preRegisterResult = await dispatchHook("preRegister", { email, provider: "credentials", name });
   if (preRegisterResult.stopped) {
+    emitLoginFailed({ email, provider: "credentials", reason: preRegisterResult.signal.errorCode, stage: "register" });
     return { status: false, reason: preRegisterResult.signal.errorCode };
   }
+  if (await isAccountLocked(email)) {
+    emitLoginFailed({ email, provider: "credentials", reason: "login.accountLocked", stage: "register" });
+    return { status: false, reason: "login.accountLocked" };
+  }
   const userAdapter = getUserAdapter();
-  const [checkEmailError, checkEmailResponse] = await tryCatch5(
-    () => userAdapter.findByEmail({ email, provider: "credentials" })
+  const [checkEmailError, checkEmailResponse] = await tryCatch(
+    () => resolveUserByEmail(userAdapter, { email, provider: "credentials" })
   );
   if (checkEmailError) {
     getLogger3().error("login: findByEmail failed during register", checkEmailError);
-    return { status: false, reason: toReasonKey(checkEmailError) };
+    const reason = toReasonKey(checkEmailError);
+    emitLoginFailed({ email, provider: "credentials", reason, stage: "register" });
+    return { status: false, reason };
+  }
+  if (checkEmailResponse) {
+    emitLoginFailed({ email, provider: "credentials", reason: "login.emailExists", stage: "register" });
+    return { status: false, reason: "login.emailExists" };
   }
-  if (checkEmailResponse) return { status: false, reason: "login.emailExists" };
   const createNewUser = async () => {
-    const salt = await genSalt(getProjectConfig3().auth.bcryptRounds);
+    const salt = await genSalt(getProjectConfig4().auth.bcryptRounds);
     const hashedPassword = await hash(password, salt);
     return await userAdapter.create({
       email,
@@ -959,61 +558,111 @@ var registerWithCredentials = async ({
       name,
       password: hashedPassword,
       avatar: "",
-      avatarFallback: `#${Math.floor(Math.random() * 16777215).toString(16).padStart(6, "0")}`,
-      language: getProjectConfig3().defaultLanguage
+      avatarFallback: generateAvatarFallbackColor(),
+      language: getProjectConfig4().defaultLanguage
     });
   };
-  const [createNewUserError, createNewUserResponse] = await tryCatch5(createNewUser);
-  if (createNewUserError) return { status: false, reason: toReasonKey(createNewUserError) };
-  if (!createNewUserResponse) return { status: false, reason: "login.createUserFailed" };
-  await dispatchHook3("postRegister", { userId: createNewUserResponse.id, provider: "credentials" });
+  const [createNewUserError, createNewUserResponse] = await tryCatch(createNewUser);
+  if (createNewUserError) {
+    const errorMessage = createNewUserError instanceof Error ? createNewUserError.message : String(createNewUserError);
+    const isUniqueViolation = errorMessage.includes("Unique constraint") || errorMessage.includes("unique constraint") || // Prisma error code P2002 covers all DB engines
+    createNewUserError.code === "P2002";
+    if (isUniqueViolation) {
+      emitLoginFailed({ email, provider: "credentials", reason: "login.emailExists", stage: "register" });
+      return { status: false, reason: "login.emailExists" };
+    }
+    const reason = toReasonKey(createNewUserError);
+    emitLoginFailed({ email, provider: "credentials", reason, stage: "register" });
+    return { status: false, reason };
+  }
+  if (!createNewUserResponse) {
+    emitLoginFailed({ email, provider: "credentials", reason: "login.createUserFailed", stage: "register" });
+    return { status: false, reason: "login.createUserFailed" };
+  }
+  await dispatchHook("postRegister", { userId: createNewUserResponse.id, provider: "credentials" });
+  const newToken = randomBytes(32).toString("hex");
+  const nowLogin = /* @__PURE__ */ new Date();
+  const newUser = {
+    ...sanitizeUserForSession(createNewUserResponse),
+    token: newToken,
+    lastLogin: nowLogin,
+    previousLogin: null
+  };
+  const saved = await saveSession(newToken, newUser, true, { supersedeToken: options?.supersedeToken });
+  if (!saved.ok) {
+    emitLoginFailed({ email, userId: newUser.id, provider: "credentials", reason: saved.errorCode, stage: "register" });
+    return { status: false, reason: saved.errorCode };
+  }
+  await dispatchHook("postLogin", { userId: newUser.id, provider: "credentials", isNewUser: true, token: newToken });
   return {
     status: true,
     reason: "login.userCreated",
-    session: sanitizeUserForSession(createNewUserResponse)
+    newToken,
+    session: newUser
   };
 };
 var loginWithCredentialsCore = async ({ email, password }, options) => {
-  const preLoginResult = await dispatchHook3("preLogin", { email, provider: "credentials" });
+  const requesterIp = options?.requesterIp;
+  const preLoginResult = await dispatchHook("preLogin", { email, provider: "credentials" });
   if (preLoginResult.stopped) {
+    emitLoginFailed({ email, provider: "credentials", reason: preLoginResult.signal.errorCode, stage: "login", requesterIp });
     return { status: false, reason: preLoginResult.signal.errorCode };
   }
+  if (await isAccountLocked(email, requesterIp)) {
+    emitLoginFailed({ email, provider: "credentials", reason: "login.accountLocked", stage: "login", requesterIp });
+    return { status: false, reason: "login.accountLocked" };
+  }
   const userAdapter = getUserAdapter();
-  const [findUserError, findUserResponse] = await tryCatch5(
-    () => userAdapter.findByEmail({ email, provider: "credentials" })
+  const [findUserError, findUserResponse] = await tryCatch(
+    () => resolveUserByEmail(userAdapter, { email, provider: "credentials" })
   );
   if (findUserError) {
     getLogger3().error("login: findByEmail failed", findUserError);
-    return { status: false, reason: toReasonKey(findUserError) };
+    const reason = toReasonKey(findUserError);
+    emitLoginFailed({ email, provider: "credentials", reason, stage: "login", requesterIp });
+    return { status: false, reason };
   }
-  if (!findUserResponse) return { status: false, reason: "login.userNotFound" };
-  const [checkPasswordError, checkPasswordResponse] = await tryCatch5(
-    () => compare(password, findUserResponse.password)
+  const passwordHash = findUserResponse?.password ?? null;
+  if (!findUserResponse || !passwordHash) {
+    const dummyHash = await getDummyBcryptHash();
+    await tryCatch(() => compare(password, dummyHash));
+    emitLoginFailed({ email, userId: findUserResponse?.id, provider: "credentials", reason: "login.wrongPassword", stage: "login", requesterIp });
+    return { status: false, reason: "login.wrongPassword" };
+  }
+  const [checkPasswordError, checkPasswordResponse] = await tryCatch(
+    () => compare(password, passwordHash)
   );
   if (checkPasswordError) {
     getLogger3().error("login: bcrypt compare failed", checkPasswordError);
-    return { status: false, reason: checkPasswordError };
+    const reason = toReasonKey(checkPasswordError);
+    emitLoginFailed({ email, userId: findUserResponse.id, provider: "credentials", reason, stage: "login", requesterIp });
+    return { status: false, reason };
+  }
+  if (!checkPasswordResponse) {
+    emitLoginFailed({ email, userId: findUserResponse.id, provider: "credentials", reason: "login.wrongPassword", stage: "login", requesterIp });
+    return { status: false, reason: "login.wrongPassword" };
   }
-  if (!checkPasswordResponse) return { status: false, reason: "login.wrongPassword" };
-  const newToken = randomBytes2(32).toString("hex");
+  const newToken = randomBytes(32).toString("hex");
   const previousLogin = findUserResponse.lastLogin ?? null;
   const nowLogin = /* @__PURE__ */ new Date();
-  await tryCatch5(() => userAdapter.update(findUserResponse.id, { lastLogin: nowLogin }));
+  await tryCatch(() => userAdapter.update(findUserResponse.id, { lastLogin: nowLogin }));
   const newUser = {
     ...sanitizeUserForSession(findUserResponse),
     token: newToken,
     lastLogin: nowLogin,
     previousLogin
   };
-  const filePath = path.join(uploadsFolder(), `${newUser.id}.webp`);
-  if (existsSync(filePath)) {
-    newUser.avatar = `${newUser.id}.webp`;
+  const uploadedAvatar = await resolveUploadedAvatar(newUser.id);
+  if (uploadedAvatar) {
+    newUser.avatar = uploadedAvatar;
   }
   const saved = await saveSession(newToken, newUser, true, { supersedeToken: options?.supersedeToken });
   if (!saved.ok) {
+    emitLoginFailed({ email, userId: newUser.id, provider: "credentials", reason: saved.errorCode, stage: "login", requesterIp });
     return { status: false, reason: saved.errorCode };
   }
-  await dispatchHook3("postLogin", { userId: newUser.id, provider: "credentials", isNewUser: false, token: newToken });
+  await dispatchHook("postLogin", { userId: newUser.id, provider: "credentials", isNewUser: false, token: newToken });
+  void clearAuthFailures(email, requesterIp);
   if (isDevMode()) {
     getLogger3().debug(`credentials login success for user ${newUser.id}`);
   }
@@ -1024,25 +673,35 @@ var loginWithCredentials = async (params, options) => {
   if (isDevMode()) {
     getLogger3().debug(`credentials auth attempt for ${creds.email || "unknown-email"}`);
   }
-  const validationError = validateCredentialsShape(creds);
-  if (validationError) return validationError;
-  if (creds.name && creds.confirmPassword) {
+  const { name, confirmPassword } = creds;
+  if (name && confirmPassword) {
+    const validationError2 = validateCredentialsShape(creds, "register");
+    if (validationError2) return validationError2;
+    if (!getProjectConfig4().auth.allowRegistration) {
+      emitLoginFailed({ email: creds.email, provider: "credentials", reason: "auth.registrationDisabled", stage: "register" });
+      return { status: false, reason: "auth.registrationDisabled" };
+    }
     return registerWithCredentials({
       email: creds.email,
       password: creds.password,
-      name: creds.name,
-      confirmPassword: creds.confirmPassword
-    });
+      name,
+      confirmPassword
+    }, options);
   }
+  const validationError = validateCredentialsShape(creds, "login");
+  if (validationError) return validationError;
   return loginWithCredentialsCore({ email: creds.email, password: creds.password }, options);
 };
 var isAllowedRedirectUrl = (url) => {
   if (!URL.canParse(url, "http://placeholder")) return false;
+  if (url.includes("\\")) return false;
   const parsed = new URL(url, "http://placeholder");
   if (parsed.origin === "http://placeholder") {
     return true;
   }
-  const allowed = getProjectConfig3().http.cors.allowedOrigins ?? [];
+  const cfg = getProjectConfig4();
+  if (cfg.http.cors.allowLocalhost && parsed.hostname === "localhost") return true;
+  const allowed = cfg.http.cors.allowedOrigins ?? [];
   if (typeof allowed === "function") {
     return allowed(parsed.origin);
   }
@@ -1051,43 +710,52 @@ var isAllowedRedirectUrl = (url) => {
     return new URL(origin).origin === parsed.origin;
   });
 };
-var exchangeOAuthToken = async (provider, code) => {
+var exchangeOAuthToken = async (provider, code, codeVerifier) => {
   const values = {
     code,
     client_id: provider.clientID,
     client_secret: provider.clientSecret,
     redirect_uri: provider.callbackURL,
-    grant_type: "authorization_code"
+    grant_type: "authorization_code",
+    ...codeVerifier ? { code_verifier: codeVerifier } : {}
   };
   const getToken = async () => {
     if (provider.tokenExchangeMethod === "json") {
-      const response2 = await fetch(provider.tokenExchangeURL, {
+      const response3 = await fetch(provider.tokenExchangeURL, {
         method: "POST",
         headers: { "Content-Type": "application/json", "Accept": "application/json" },
         body: JSON.stringify(values)
       });
-      return await response2.json();
-    }
-    if (provider.tokenExchangeMethod === "form") {
-      const formParams = new URLSearchParams();
-      formParams.append("client_id", provider.clientID);
-      formParams.append("client_secret", provider.clientSecret);
-      formParams.append("code", values.code);
-      formParams.append("grant_type", "authorization_code");
-      formParams.append("redirect_uri", provider.callbackURL);
-      if (isDevMode()) {
-        getLogger3().debug("oauth: token-exchange form params", { params: formParams.toString() });
+      if (!response3.ok) {
+        getLogger3().warn("oauth: token exchange returned non-OK status", { provider: provider.name, status: response3.status });
+        return null;
       }
-      const response2 = await fetch(provider.tokenExchangeURL, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json" },
-        body: formParams.toString()
-      });
-      return await response2.json();
+      return await response3.json();
     }
-    return null;
+    const formParams = new URLSearchParams();
+    formParams.append("client_id", provider.clientID);
+    formParams.append("client_secret", provider.clientSecret);
+    formParams.append("code", values.code);
+    formParams.append("grant_type", "authorization_code");
+    formParams.append("redirect_uri", provider.callbackURL);
+    if (codeVerifier) {
+      formParams.append("code_verifier", codeVerifier);
+    }
+    if (isDevMode()) {
+      getLogger3().debug("oauth: token-exchange form params", { paramNames: [...formParams.keys()] });
+    }
+    const response2 = await fetch(provider.tokenExchangeURL, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json" },
+      body: formParams.toString()
+    });
+    if (!response2.ok) {
+      getLogger3().warn("oauth: token exchange returned non-OK status", { provider: provider.name, status: response2.status });
+      return null;
+    }
+    return await response2.json();
   };
-  const [error, response] = await tryCatch5(getToken);
+  const [error, response] = await tryCatch(getToken);
   if (error) {
     getLogger3().error("oauth: token exchange failed", error);
     return null;
@@ -1110,19 +778,33 @@ var fetchOAuthProfile = async (provider, accessToken) => {
         "Authorization": `Bearer ${accessToken}`
       }
     });
+    if (!response2.ok) {
+      getLogger3().warn("oauth: userInfo fetch returned non-OK status", { provider: provider.name, status: response2.status });
+      return null;
+    }
     return await response2.json();
   };
-  const [error, response] = await tryCatch5(getUserData);
+  const [error, response] = await tryCatch(getUserData);
   if (error) {
     getLogger3().error("oauth: userInfo fetch failed", error);
     return null;
   }
   const userData = asRecord(response);
-  const name = String(userData[provider.nameKey] || "didnt find a name");
+  const resolvedName = readStringField(userData, provider.nameKey);
+  const name = resolvedName === "" ? "didnt find a name" : resolvedName;
   const emailValue = userData[provider.emailKey];
   let email = typeof emailValue === "string" ? emailValue : void 0;
+  let emailVerified = false;
+  if (email && provider.emailVerifiedKey) {
+    const verifiedFlag = userData[provider.emailVerifiedKey];
+    if (verifiedFlag === false) {
+      getLogger3().warn("oauth: provider email is not verified \u2014 rejecting", { provider: provider.name });
+      return null;
+    }
+    if (verifiedFlag !== void 0) emailVerified = true;
+  }
   const avatarId = provider.avatarCodeKey ? userData[provider.avatarCodeKey] : void 0;
-  const avatarValue = provider?.avatarKey ? String(userData[provider.avatarKey] || "") : provider.getAvatar ? await provider.getAvatar({ userData, avatarId: typeof avatarId === "string" ? avatarId : "", accessToken }) : "";
+  const avatarValue = provider.avatarKey ? readStringField(userData, provider.avatarKey) : provider.getAvatar ? await provider.getAvatar({ userData, avatarId: typeof avatarId === "string" ? avatarId : "", accessToken }) : "";
   const avatar = typeof avatarValue === "string" ? avatarValue : "";
   if (!email && provider.getEmail) {
     const selectedEmail = await provider.getEmail(accessToken);
@@ -1131,33 +813,51 @@ var fetchOAuthProfile = async (provider, accessToken) => {
       return null;
     }
     email = selectedEmail;
+    emailVerified = true;
+  }
+  if (email !== void 0) {
+    const normalizedEmail = email.trim().toLowerCase();
+    if (!isEmail(normalizedEmail)) {
+      getLogger3().warn("oauth: provider returned a malformed email", { provider: provider.name });
+      return null;
+    }
+    email = normalizedEmail;
   }
-  return { email, name, avatar };
+  return { email, name, avatar, emailVerified, rawUserData: userData };
 };
 var findOrCreateOAuthUser = async (provider, profile) => {
-  const { email, name, avatar } = profile;
+  const { email, name, avatar, emailVerified } = profile;
   if (!email) return null;
-  const preLoginResult = await dispatchHook3("preLogin", { email, provider: provider.name });
+  const preLoginResult = await dispatchHook("preLogin", { email, provider: provider.name });
   if (preLoginResult.stopped) {
     getLogger3().warn(`oauth login aborted by preLogin hook`, { errorCode: preLoginResult.signal.errorCode });
     return null;
   }
   const userAdapter = getUserAdapter();
-  const [findError, findResponse] = await tryCatch5(
-    () => userAdapter.findByEmail({ email, provider: provider.name })
+  const [findError, findResponse] = await tryCatch(
+    () => resolveUserByEmail(userAdapter, { email, provider: provider.name })
   );
   if (findError) {
     getLogger3().error("oauth: findByEmail failed", findError);
     return null;
   }
   if (findResponse?.id) {
-    const filePath = path.join(uploadsFolder(), `${findResponse.id}.webp`);
-    if (existsSync(filePath)) {
-      findResponse.avatar = `${findResponse.id}.webp`;
+    const existingProvider = findResponse.provider ?? null;
+    const isCrossProviderLink = existingProvider !== null && existingProvider !== provider.name;
+    if (isCrossProviderLink && !emailVerified) {
+      getLogger3().warn(
+        "oauth: refusing to link an unverified provider email to an existing account created by a different provider (account-takeover guard)",
+        { provider: provider.name, existingProvider }
+      );
+      return null;
+    }
+    const uploadedAvatar = await resolveUploadedAvatar(findResponse.id);
+    if (uploadedAvatar) {
+      findResponse.avatar = uploadedAvatar;
     }
     const previousLogin = findResponse.lastLogin ?? null;
     const nowLogin = /* @__PURE__ */ new Date();
-    await tryCatch5(() => userAdapter.update(findResponse.id, { lastLogin: nowLogin }));
+    await tryCatch(() => userAdapter.update(findResponse.id, { lastLogin: nowLogin }));
     return {
       user: {
         ...sanitizeUserForSession(findResponse),
@@ -1168,7 +868,7 @@ var findOrCreateOAuthUser = async (provider, profile) => {
       isNewUser: false
     };
   }
-  const preRegisterResult = await dispatchHook3("preRegister", { email, provider: provider.name, name });
+  const preRegisterResult = await dispatchHook("preRegister", { email, provider: provider.name, name });
   if (preRegisterResult.stopped) {
     getLogger3().warn(`oauth register aborted by preRegister hook`, { errorCode: preRegisterResult.signal.errorCode });
     return null;
@@ -1178,10 +878,10 @@ var findOrCreateOAuthUser = async (provider, profile) => {
     provider: provider.name,
     name,
     avatar,
-    avatarFallback: `#${Math.floor(Math.random() * 16777215).toString(16).padStart(6, "0")}`,
-    language: getProjectConfig3().defaultLanguage
+    avatarFallback: generateAvatarFallbackColor(),
+    language: getProjectConfig4().defaultLanguage
   });
-  const [createError, createResponse] = await tryCatch5(createNewUser);
+  const [createError, createResponse] = await tryCatch(createNewUser);
   if (createError) {
     getLogger3().error("oauth: user create failed", createError);
     return null;
@@ -1200,7 +900,7 @@ var resolvePostLoginRedirect = async ({
 }) => {
   const resolver = getPostLoginRedirect();
   if (!resolver) return fallbackUrl;
-  const [resolverError, resolved] = await tryCatch5(() => resolver({
+  const [resolverError, resolved] = await tryCatch(() => resolver({
     userId,
     provider: providerName,
     isNewUser,
@@ -1219,53 +919,84 @@ var resolvePostLoginRedirect = async ({
   }
   return fallbackUrl;
 };
+var resolveProviderFromCallback = (pathname, url) => {
+  const rawProviderSegment = pathname.split("/")[3];
+  if (!rawProviderSegment || !url) return null;
+  const found = getOAuthProviders().find((p) => p.name === rawProviderSegment);
+  if (!found || !isFullOAuthProvider(found)) return null;
+  return { provider: found, providerName: found.name };
+};
+var applyExtraSessionFields = async (user, provider, profile, accessToken) => {
+  const { extraSessionFields } = provider;
+  if (!extraSessionFields) return;
+  const [extraErr, extra] = await tryCatch(
+    async () => extraSessionFields({ userData: profile.rawUserData, accessToken })
+  );
+  if (extraErr) {
+    getLogger3().warn(`[oauth:${provider.name}] extraSessionFields hook threw \u2014 continuing without extras`, { err: extraErr });
+    return;
+  }
+  if (!extra) return;
+  const { id, token, csrfToken, password, ...safeExtra } = extra;
+  if (id !== void 0 || token !== void 0 || csrfToken !== void 0 || password !== void 0) {
+    getLogger3().warn(
+      `[oauth:${provider.name}] extraSessionFields returned framework-owned key(s) (id/token/csrfToken/password) \u2014 dropped`
+    );
+  }
+  Object.assign(user, safeExtra);
+};
+var resolveOAuthFallbackUrl = (stateEntry, options) => {
+  const stateReturnUrl = stateEntry.returnUrl && isAllowedRedirectUrl(stateEntry.returnUrl) ? stateEntry.returnUrl : void 0;
+  return stateReturnUrl ?? options.defaultRedirectUrl ?? getProjectConfig4().loginRedirectUrl ?? "/";
+};
 var loginCallback = async (pathname, req, _res, options = {}) => {
-  const providerName = pathname.split("/")[3];
-  if (!providerName) return false;
-  const provider = getOAuthProviders().find((p) => p.name === providerName);
-  if (!provider || !req.url) return false;
-  if (!isFullOAuthProvider(provider)) return false;
-  const queryString = req.url.split("?")[1] ?? "";
+  const providerResolution = resolveProviderFromCallback(pathname, req.url);
+  if (!providerResolution) return false;
+  const { provider, providerName } = providerResolution;
+  const queryString = (req.url ?? "").split("?")[1] ?? "";
   const params = new URLSearchParams(queryString);
   const code = params.get("code");
   const state = params.get("state");
-  const stateIsValid = await consumeOAuthState(provider.name, state || "");
-  if (!stateIsValid) {
-    getLogger3().warn("oauth: invalid or missing state", { provider: provider.name });
+  const cookieNonce = getCookieValue(req.headers.cookie, OAUTH_STATE_COOKIE_NAME) ?? "";
+  const stateEntry = await consumeOAuthState(provider.name, state ?? "", cookieNonce);
+  if (!stateEntry) {
+    getLogger3().warn("oauth: invalid, missing, or unbound state", { provider: provider.name });
+    emitLoginFailed({ provider: providerName, reason: "oauth.invalidState", stage: "oauth" });
     return false;
   }
   if (!code) {
     getLogger3().warn("oauth: no code provided in callback url", { provider: provider.name });
+    emitLoginFailed({ provider: providerName, reason: "oauth.noCode", stage: "oauth" });
+    return false;
+  }
+  const accessToken = await exchangeOAuthToken(provider, code, stateEntry.codeVerifier);
+  if (!accessToken) {
+    emitLoginFailed({ provider: providerName, reason: "oauth.tokenExchangeFailed", stage: "oauth" });
     return false;
   }
-  const accessToken = await exchangeOAuthToken(provider, code);
-  if (!accessToken) return false;
   const profile = await fetchOAuthProfile(provider, accessToken);
-  if (!profile) return false;
+  if (!profile) {
+    emitLoginFailed({ provider: providerName, reason: "oauth.profileFetchFailed", stage: "oauth" });
+    return false;
+  }
   const resolved = await findOrCreateOAuthUser(provider, profile);
-  if (!resolved) return false;
-  const newToken = randomBytes2(32).toString("hex");
-  resolved.user.token = newToken;
-  const extraSessionFields = provider.extraSessionFields;
-  if (extraSessionFields) {
-    const [extraErr, extra] = await tryCatch5(
-      async () => extraSessionFields({ userData: asOAuthUserData(profile), accessToken })
-    );
-    if (extraErr) {
-      getLogger3().warn(`[oauth:${providerName}] extraSessionFields hook threw \u2014 continuing without extras`, { err: extraErr });
-    } else if (extra) {
-      Object.assign(resolved.user, extra);
-    }
+  if (!resolved) {
+    emitLoginFailed({ provider: providerName, email: profile.email, reason: "oauth.userResolveFailed", stage: "oauth" });
+    return false;
   }
+  const newToken = randomBytes(32).toString("hex");
+  resolved.user.token = newToken;
+  await applyExtraSessionFields(resolved.user, provider, profile, accessToken);
   const saved = await saveSession(newToken, resolved.user, true, { supersedeToken: options.supersedeToken });
   if (!saved.ok) {
     getLogger3().error(`[oauth:${providerName}] saveSession failed \u2014 aborting callback`, { errorCode: saved.errorCode });
+    emitLoginFailed({ provider: providerName, userId: resolved.user.id, reason: saved.errorCode, stage: "oauth" });
     return false;
   }
   if (resolved.isNewUser) {
-    await dispatchHook3("postRegister", { userId: resolved.user.id, provider: providerName });
+    await dispatchHook("postRegister", { userId: resolved.user.id, provider: providerName });
   }
-  await dispatchHook3("postLogin", {
+  await dispatchHook("postLogin", {
     userId: resolved.user.id,
     provider: providerName,
     isNewUser: resolved.isNewUser,
@@ -1274,7 +1005,7 @@ var loginCallback = async (pathname, req, _res, options = {}) => {
   if (isDevMode()) {
     getLogger3().debug(`oauth login success for user ${resolved.user.id}`);
   }
-  const fallbackUrl = options.defaultRedirectUrl ?? getProjectConfig3().loginRedirectUrl ?? "/";
+  const fallbackUrl = resolveOAuthFallbackUrl(stateEntry, options);
   const redirectUrl = await resolvePostLoginRedirect({
     fallbackUrl,
     userId: resolved.user.id,
@@ -1290,37 +1021,32 @@ var loginCallback = async (pathname, req, _res, options = {}) => {
   };
 };
 
-// src/index.ts
-init_logout();
-
 // src/passwordReset.ts
 import bcrypt2 from "bcryptjs";
-import { randomBytes as randomBytes3 } from "crypto";
-import { getProjectConfig as getProjectConfig4, formatKey as formatKey4, redis as redis2 } from "@luckystack/core";
-var tokenKey = (token) => formatKey4("-pwreset", token);
+import { getProjectConfig as getProjectConfig5, issueOneTimeToken, consumeOneTimeToken, formatKey as formatKey2, redis, oneTimeTokenKey } from "@luckystack/core";
+var PWRESET_NAMESPACE = "-pwreset";
+var pwresetUserKey = (userId) => formatKey2("-pwreset-user", userId);
 var createPasswordResetToken = async (userId) => {
-  const token = randomBytes3(32).toString("hex");
-  const ttl = getProjectConfig4().auth.passwordResetTtlSeconds;
-  await redis2.set(tokenKey(token), userId, "EX", ttl);
-  return token;
+  const ttl = getProjectConfig5().auth.passwordResetTtlSeconds;
+  const priorKey = await redis.get(pwresetUserKey(userId));
+  if (priorKey) {
+    await redis.del(priorKey);
+  }
+  const handle = issueOneTimeToken(PWRESET_NAMESPACE, ttl, userId);
+  await handle.store();
+  const newHashKey = oneTimeTokenKey(PWRESET_NAMESPACE, handle.token);
+  await redis.set(pwresetUserKey(userId), newHashKey, "EX", ttl);
+  return handle.token;
 };
 var consumePasswordResetToken = async (token) => {
-  if (!token || typeof token !== "string") return null;
-  const key = tokenKey(token);
-  const txResult = await redis2.multi().get(key).del(key).exec();
-  if (!txResult || txResult.length === 0) return null;
-  const first = txResult[0];
-  if (!first) return null;
-  const [getErr, value] = first;
-  if (getErr) return null;
-  return typeof value === "string" && value.length > 0 ? value : null;
+  return consumeOneTimeToken(PWRESET_NAMESPACE, token);
 };
 var updatePasswordHash = async (userId, plaintext) => {
   const reason = validatePassword(plaintext);
   if (reason) {
     throw new PasswordPolicyError(reason);
   }
-  const salt = await bcrypt2.genSalt(getProjectConfig4().auth.bcryptRounds);
+  const salt = await bcrypt2.genSalt(getProjectConfig5().auth.bcryptRounds);
   const hashedPassword = await bcrypt2.hash(plaintext, salt);
   const patch = { password: hashedPassword };
   await getUserAdapter().update(userId, patch);
@@ -1338,37 +1064,44 @@ var verifyPassword = async (plaintext, hash2) => {
 };
 
 // src/forgotPassword.ts
-import { getProjectConfig as getProjectConfig5, dispatchHook as dispatchHook4, getLogger as getLogger4 } from "@luckystack/core";
+import { getProjectConfig as getProjectConfig6, dispatchHook as dispatchHook2, getLogger as getLogger4 } from "@luckystack/core";
+
+// src/emailModuleLoader.ts
+var loadEmailModule = () => (
+  // @ts-expect-error optional peer dep — installed only when the consumer wires email sending
+  import("@luckystack/email")
+);
+
+// src/forgotPassword.ts
 var sendPasswordResetEmail = async ({ email, brand }) => {
-  const config = getProjectConfig5();
-  getLogger4().info("[forgotPassword] start", { email, forgotPasswordMode: config.auth.forgotPassword });
+  const config = getProjectConfig6();
+  getLogger4().info("[forgotPassword] start", { forgotPasswordMode: config.auth.forgotPassword });
   if (config.auth.forgotPassword !== "framework") {
     getLogger4().warn('[forgotPassword] auth.forgotPassword is not "framework" \u2014 nothing sent', { mode: config.auth.forgotPassword });
     return { ok: false, reason: "forgotPassword-not-framework" };
   }
   const resolvedBrand = brand ?? config.auth.passwordResetBrand ?? "LuckyStack";
-  const emailModule = await // @ts-expect-error optional peer dep — installed only when forgotPassword === 'framework'
-  import("@luckystack/email").catch((error) => {
+  const emailModule = await loadEmailModule().catch((error) => {
     getLogger4().warn("[forgotPassword] failed to load @luckystack/email \u2014 is it installed?", { error: String(error) });
     return null;
   });
   if (!emailModule) {
     return { ok: false, reason: "email-module-load-failed" };
   }
-  const { sendEmail, renderEmailLayout } = emailModule;
+  const { sendEmail } = emailModule;
   const userAdapter = getUserAdapter();
   const user = await userAdapter.findByEmail({ email, provider: "credentials" });
-  getLogger4().info("[forgotPassword] credentials user lookup", { email, found: Boolean(user), userId: user?.id ?? null });
+  getLogger4().info("[forgotPassword] credentials user lookup", { found: Boolean(user), userId: user?.id ?? null });
   if (!user) {
-    getLogger4().warn("[forgotPassword] no credentials account for this email \u2014 nothing sent. Use the email+password account you registered with.", { email });
-    void dispatchHook4("passwordResetRequested", {
+    getLogger4().warn("[forgotPassword] no credentials account for this email \u2014 nothing sent. Use the email+password account you registered with.");
+    void dispatchHook2("passwordResetRequested", {
       email,
       matched: false
     });
     return { ok: true };
   }
   const token = await createPasswordResetToken(user.id);
-  void dispatchHook4("passwordResetRequested", {
+  void dispatchHook2("passwordResetRequested", {
     email,
     matched: true,
     userId: user.id,
@@ -1378,20 +1111,10 @@ var sendPasswordResetEmail = async ({ email, brand }) => {
   const baseUrl = (config.app.publicUrl || "").replace(/\/+$/, "");
   const resetUrl = `${baseUrl}/reset-password?token=${encodeURIComponent(token)}`;
   const ttlMinutes = Math.round(config.auth.passwordResetTtlSeconds / 60);
-  const { html, text } = renderEmailLayout({
-    brand: resolvedBrand,
-    title: "Reset your password",
-    intro: `Hi ${user.name ?? "there"}, we received a request to reset the password on your ${resolvedBrand} account. Click the button below to choose a new one. The link expires in ${String(ttlMinutes)} minutes.`,
-    ctaLabel: "Reset password",
-    ctaUrl: resetUrl,
-    outro: `If you didn't request this, you can safely ignore this email \u2014 your password will stay the same. The link: ${resetUrl}`,
-    footer: `Sent by ${resolvedBrand}. If you have questions, reply to this email.`
-  });
   const result = await sendEmail({
     to: user.email,
-    subject: `Reset your ${resolvedBrand} password`,
-    html,
-    text,
+    template: "password-reset",
+    data: { resetUrl, userName: user.name, brand: resolvedBrand, ttlMinutes },
     adapterHint: "transactional"
   });
   if (result.ok) {
@@ -1403,69 +1126,66 @@ var sendPasswordResetEmail = async ({ email, brand }) => {
 };
 
 // src/emailChange.ts
-import { randomBytes as randomBytes4 } from "crypto";
-import { getProjectConfig as getProjectConfig6, formatKey as formatKey5, redis as redis3 } from "@luckystack/core";
-var tokenKey2 = (token) => formatKey5("-email-change", token);
+import { getProjectConfig as getProjectConfig7, issueOneTimeToken as issueOneTimeToken2, consumeOneTimeTokenJson, formatKey as formatKey3, redis as redis2, oneTimeTokenKey as oneTimeTokenKey2 } from "@luckystack/core";
+var EMAIL_CHANGE_NAMESPACE = "-email-change";
+var emailChangeUserKey = (userId) => formatKey3("-email-change-user", userId);
 var createEmailChangeToken = async (userId, newEmail) => {
-  const token = randomBytes4(32).toString("hex");
-  const ttl = getProjectConfig6().auth.emailChangeTtlSeconds;
-  const payload = JSON.stringify({ userId, newEmail });
-  await redis3.set(tokenKey2(token), payload, "EX", ttl);
-  return token;
+  const ttl = getProjectConfig7().auth.emailChangeTtlSeconds;
+  const priorKey = await redis2.get(emailChangeUserKey(userId));
+  if (priorKey) {
+    await redis2.del(priorKey);
+  }
+  const handle = issueOneTimeToken2(
+    EMAIL_CHANGE_NAMESPACE,
+    ttl,
+    { userId, newEmail }
+  );
+  await handle.store();
+  const newHashKey = oneTimeTokenKey2(EMAIL_CHANGE_NAMESPACE, handle.token);
+  await redis2.set(emailChangeUserKey(userId), newHashKey, "EX", ttl);
+  return handle.token;
 };
 var consumeEmailChangeToken = async (token) => {
-  if (!token || typeof token !== "string") return null;
-  const key = tokenKey2(token);
-  const txResult = await redis3.multi().get(key).del(key).exec();
-  if (!txResult || txResult.length === 0) return null;
-  const first = txResult[0];
-  if (!first) return null;
-  const [getErr, value] = first;
-  if (getErr) return null;
-  if (typeof value !== "string" || value.length === 0) return null;
-  try {
-    const parsed = JSON.parse(value);
-    if (!parsed || typeof parsed !== "object" || typeof parsed.userId !== "string" || typeof parsed.newEmail !== "string") {
-      return null;
-    }
-    return parsed;
-  } catch {
+  const parsed = await consumeOneTimeTokenJson(EMAIL_CHANGE_NAMESPACE, token);
+  if (!parsed || typeof parsed !== "object" || typeof parsed.userId !== "string" || typeof parsed.newEmail !== "string") {
     return null;
   }
+  return parsed;
 };
 
 // src/emailChangeNotification.ts
-import { getProjectConfig as getProjectConfig7 } from "@luckystack/core";
+import { getProjectConfig as getProjectConfig8 } from "@luckystack/core";
 var sendEmailChangeConfirmation = async ({ userId, newEmail, userName, brand }) => {
-  const config = getProjectConfig7();
+  const config = getProjectConfig8();
   const resolvedBrand = brand ?? config.auth.passwordResetBrand ?? "LuckyStack";
-  const { sendEmail, renderEmailLayout } = await // @ts-expect-error optional peer dep — installed only when the consumer wires email sending
-  import("@luckystack/email");
+  const { sendEmail } = await loadEmailModule();
   const token = await createEmailChangeToken(userId, newEmail);
   const baseUrl = (config.app.publicUrl || "").replace(/\/+$/, "");
   const confirmUrl = `${baseUrl}/settings/confirm-email?token=${encodeURIComponent(token)}`;
   const ttlMinutes = Math.round(config.auth.emailChangeTtlSeconds / 60);
-  const { html, text } = renderEmailLayout({
-    brand: resolvedBrand,
-    title: "Confirm your new email address",
-    intro: `Hi ${userName ?? "there"}, you (or someone using your ${resolvedBrand} account) asked to change the account email to this address. Click the button below to confirm \u2014 the link expires in ${String(ttlMinutes)} minutes. If you confirm, all of your active sessions will be signed out as a security precaution.`,
-    ctaLabel: "Confirm new email",
-    ctaUrl: confirmUrl,
-    outro: `If you didn't request this, you can safely ignore this email \u2014 nothing will change. The link: ${confirmUrl}`,
-    footer: `Sent by ${resolvedBrand}. If you have questions, reply to this email.`
-  });
   const result = await sendEmail({
     to: newEmail,
-    subject: `Confirm your new ${resolvedBrand} email address`,
-    html,
-    text,
+    template: "email-change",
+    data: { confirmUrl, userName, brand: resolvedBrand, ttlMinutes },
     adapterHint: "transactional"
   });
   return result.ok ? { ok: true, token } : { ok: false, reason: result.reason, token };
 };
+
+// src/index.ts
+registerSessionProvider({
+  getSession,
+  saveSession,
+  deleteSession,
+  logout: ({ token, socket, userId, skipSessionDelete }) => logout({ token, socket, userId: userId ?? null, skipSessionDelete })
+});
+registerAuthLockoutHook();
 export {
+  OAUTH_STATE_COOKIE_NAME,
   PasswordPolicyError,
   activeUsersKeyFor,
+  asOAuthUserData,
+  clearAuthFailures,
   consumeEmailChangeToken,
   consumePasswordResetToken,
   createEmailChangeToken,
@@ -1481,9 +1201,11 @@ export {
   getPostLoginRedirect,
   getSession,
   getSessionAdapter,
+  getSessionSanitizer,
   getUserAdapter,
   githubProvider,
   googleProvider,
+  isAccountLocked,
   isFullOAuthProvider,
   isUserAdapterRegistered,
   loginCallback,
@@ -1491,10 +1213,13 @@ export {
   loginWithCredentialsCore,
   logout,
   microsoftProvider,
+  recordAuthFailure,
   redisSessionAdapter,
+  registerOAuthProviderFactory,
   registerOAuthProviders,
   registerPostLoginRedirect,
   registerSessionAdapter,
+  registerSessionSanitizer,
   registerUserAdapter,
   registerWithCredentials,
   revokeUserSessions,