@luckystack/server 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,56 +1,75 @@
-# Changelog
-
-All notable changes to `@luckystack/server` are documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
-## [0.5.0] - 2026-07-11
-
-### Added
-
-- `OVERLAY_ORDER` exported (consumed by the consumer's `bundleServer.mjs` at
-  build time — kills the hardcoded-copy drift that silently dropped overlay
-  slots from prod bundles). New `cron` overlay slot + `@luckystack/cron` in
-  `OPTIONAL_PACKAGES` (boot auto-wiring).
-- `/readyz` database check is pluggable (core `registerDbHealthCheck`):
-  registered probe → built-in Prisma ping (when Prisma is present) →
-  `'skipped'` for deliberately DB-less projects. Response gains the
-  tri-state `checks.database`; `checks.prisma` kept for compatibility.
-
-### Changed
-
-- Overlay files that fail to import abort boot with an actionable error
-  naming the file (was: raw ERR_MODULE_NOT_FOUND).
-- Dev SIGINT/SIGTERM dispatches `preServerStop` (2s cap) before exiting so
-  subscribers (e.g. the cron leader lease) release cleanly.
-- `@prisma/client` peer dependency is now optional (ADR 0020).
-
-## [0.1.5]
-
-### Changed
-
-- **OAuth post-login redirect no longer reads the `DNS` env var.** `authCallbackRoute`
-  now redirects to `projectConfig.app.publicUrl` (the public origin where users
-  browse) after a callback, instead of `process.env.DNS || app.publicUrl`. The
-  callback is handled on the backend origin but must send the browser back to the
-  public origin. Set `app.publicUrl` in your `config.ts` (the scaffold does this).
-
-### Fixed
-
-- **CSRF no longer blocks credentials login/register when a session cookie already
-  exists.** `POST /auth/api/credentials` is the session bootstrap, so requiring a
-  pre-existing session's CSRF token to authenticate is circular and broke
-  legitimate same-site re-login/register (403 `auth.csrfMismatch`). That endpoint
-  is now exempt from CSRF enforcement. This removes no real protection: the session
-  cookie is `SameSite=Strict`, so a cross-site POST never carries it and the guard
-  wouldn't have fired anyway. All other `/auth/api/*`, `/api/*`, and `/sync/*`
-  state-changing routes remain protected.
-
-## [0.1.0]
-
-### Added
-
-- Initial public release as part of the LuckyStack package split.
+# Changelog
+
+All notable changes to `@luckystack/server` are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.6.0] - 2026-07-12
+
+### Added
+
+- **Email-code login + 2FA routes** (ADR 0024, `authSecondFactorRoutes.ts`):
+  POST `/auth/api/email-code/request|verify`, `/auth/api/2fa` (completes a
+  pending challenge through the session-cookie seam), `/auth/api/2fa/email-code`,
+  and the authenticated enrollment routes `/auth/api/2fa/setup|enable|disable|
+  recovery-codes` (fresh user re-read via the UserAdapter — the session copy is
+  sanitized). Registered before the `/auth/api/*` catch-all; per-IP shields.
+- `/auth/providers` now advertises `emailCodeLogin` so the login form can show
+  the passwordless entry point.
+
+### Changed
+
+- `/auth/api/credentials` relays the 2FA challenge envelope
+  (`requiresTwoFactor`, `challengeToken`, `twoFactorMethods` — no session
+  transport) when the account has a second factor enrolled.
+- CSRF middleware: the login-completing email-code/2FA routes joined the
+  auth-bootstrap exemption set; the authed enrollment routes stay enforced.
+
+## [0.5.0] - 2026-07-11
+
+### Added
+
+- `OVERLAY_ORDER` exported (consumed by the consumer's `bundleServer.mjs` at
+  build time — kills the hardcoded-copy drift that silently dropped overlay
+  slots from prod bundles). New `cron` overlay slot + `@luckystack/cron` in
+  `OPTIONAL_PACKAGES` (boot auto-wiring).
+- `/readyz` database check is pluggable (core `registerDbHealthCheck`):
+  registered probe → built-in Prisma ping (when Prisma is present) →
+  `'skipped'` for deliberately DB-less projects. Response gains the
+  tri-state `checks.database`; `checks.prisma` kept for compatibility.
+
+### Changed
+
+- Overlay files that fail to import abort boot with an actionable error
+  naming the file (was: raw ERR_MODULE_NOT_FOUND).
+- Dev SIGINT/SIGTERM dispatches `preServerStop` (2s cap) before exiting so
+  subscribers (e.g. the cron leader lease) release cleanly.
+- `@prisma/client` peer dependency is now optional (ADR 0020).
+
+## [0.1.5]
+
+### Changed
+
+- **OAuth post-login redirect no longer reads the `DNS` env var.** `authCallbackRoute`
+  now redirects to `projectConfig.app.publicUrl` (the public origin where users
+  browse) after a callback, instead of `process.env.DNS || app.publicUrl`. The
+  callback is handled on the backend origin but must send the browser back to the
+  public origin. Set `app.publicUrl` in your `config.ts` (the scaffold does this).
+
+### Fixed
+
+- **CSRF no longer blocks credentials login/register when a session cookie already
+  exists.** `POST /auth/api/credentials` is the session bootstrap, so requiring a
+  pre-existing session's CSRF token to authenticate is circular and broke
+  legitimate same-site re-login/register (403 `auth.csrfMismatch`). That endpoint
+  is now exempt from CSRF enforcement. This removes no real protection: the session
+  cookie is `SameSite=Strict`, so a cross-site POST never carries it and the guard
+  wouldn't have fired anyway. All other `/auth/api/*`, `/api/*`, and `/sync/*`
+  state-changing routes remain protected.
+
+## [0.1.0]
+
+### Added
+
+- Initial public release as part of the LuckyStack package split.

package/dist/index.js

@@ -7,7 +7,7 @@ import {
 
 // src/createServer.ts
 import http from "http";
-import { registerBindAddress, writeBootUuid, getLogger as getLogger13, getProjectConfig as getProjectConfig13, tryCatch as tryCatch10, isProduction as isProduction2, resolveEnvKey as resolveEnvKey5, dispatchHook as dispatchHook8 } from "@luckystack/core";
+import { registerBindAddress, writeBootUuid, getLogger as getLogger13, getProjectConfig as getProjectConfig15, tryCatch as tryCatch10, isProduction as isProduction2, resolveEnvKey as resolveEnvKey5, dispatchHook as dispatchHook8 } from "@luckystack/core";
 
 // src/httpHandler.ts
 import { randomUUID } from "crypto";
@@ -17,7 +17,7 @@ import {
   extractTokenFromRequest as extractTokenFromRequest3,
   getLogger as getLogger7,
   getParams,
-  getProjectConfig as getProjectConfig10,
+  getProjectConfig as getProjectConfig12,
   hasCookie,
   normalizeOrigin,
   readSession as readSession3,
@@ -167,7 +167,14 @@ var enforceCsrfOnStateChangingRequest = async ({
   const isCookieMode = !config.session.basedToken;
   const isStateChanging = req.method !== "GET" && req.method !== "HEAD" && req.method !== "OPTIONS";
   const isCallbackPath = routePath.startsWith("/auth/callback");
-  const isAuthBootstrap = routePath === "/auth/api/credentials";
+  const AUTH_BOOTSTRAP_PATHS = /* @__PURE__ */ new Set([
+    "/auth/api/credentials",
+    "/auth/api/email-code/request",
+    "/auth/api/email-code/verify",
+    "/auth/api/2fa",
+    "/auth/api/2fa/email-code"
+  ]);
+  const isAuthBootstrap = AUTH_BOOTSTRAP_PATHS.has(routePath);
   const isExemptFromCsrf = isAuthBootstrap || isCallbackPath || isOriginExemptPath(routePath);
   const isCsrfCandidate = routePath.startsWith("/api/") || routePath.startsWith("/sync/") || routePath.startsWith("/auth/api/") || !routePath.startsWith("/auth/") && !routePath.startsWith("/assets/");
   if (!(isCookieMode && isStateChanging && isCsrfCandidate && !isExemptFromCsrf)) {
@@ -615,6 +622,18 @@ var handleAuthApiRoute = async ({
     res.end(JSON.stringify({ status: false, reason: reasonKey }));
     return true;
   }
+  if (result.requiresTwoFactor) {
+    res.setHeader("content-type", "application/json; charset=utf-8");
+    res.end(JSON.stringify({
+      status: true,
+      reason: result.reason,
+      requiresTwoFactor: true,
+      challengeToken: result.challengeToken,
+      twoFactorMethods: result.twoFactorMethods,
+      authenticated: false
+    }));
+    return true;
+  }
   if (result.newToken) {
     if (token) await login.deleteSession(token, { skipSocketLogout: true });
     const requestedSessionMode = parseSessionBasedTokenHeader(req.headers["x-session-based-token"]);
@@ -636,8 +655,150 @@ var handleAuthApiRoute = async ({
   return true;
 };
 
+// src/httpRoutes/authSecondFactorRoutes.ts
+import { checkRateLimit as checkRateLimit2, getProjectConfig as getProjectConfig6, resolveClientIp as resolveClientIp2 } from "@luckystack/core";
+var json = (ctx, statusCode, body) => {
+  ctx.res.statusCode = statusCode;
+  ctx.res.setHeader("content-type", "application/json; charset=utf-8");
+  ctx.res.end(JSON.stringify(body));
+  return true;
+};
+var methodNotAllowed = (ctx) => {
+  ctx.res.statusCode = 405;
+  ctx.res.setHeader("Allow", "POST");
+  ctx.res.end();
+  return true;
+};
+var requesterIpOf = (ctx) => {
+  const config = getProjectConfig6();
+  return resolveClientIp2({
+    rawAddress: ctx.req.socket.remoteAddress,
+    headers: ctx.req.headers,
+    trustProxy: config.http.trustProxy,
+    trustedProxyHopCount: config.http.trustedProxyHopCount
+  });
+};
+var ipThrottled = async (ctx, bucket, limit) => {
+  const { allowed } = await checkRateLimit2({
+    key: `ip:${requesterIpOf(ctx)}:auth:${bucket}`,
+    limit,
+    windowMs: 15 * 60 * 1e3
+  });
+  return !allowed;
+};
+var str = (value) => typeof value === "string" ? value : "";
+var sendLoginResult = async (ctx, login, result) => {
+  if (!result.status) return json(ctx, 200, { status: false, reason: result.reason });
+  if (result.requiresTwoFactor) {
+    return json(ctx, 200, {
+      status: true,
+      reason: result.reason,
+      requiresTwoFactor: true,
+      challengeToken: result.challengeToken,
+      twoFactorMethods: result.twoFactorMethods,
+      authenticated: false
+    });
+  }
+  if (result.newToken) {
+    if (ctx.token) await login.deleteSession(ctx.token, { skipSocketLogout: true });
+    const config = getProjectConfig6();
+    const headerValue = ctx.req.headers["x-session-based-token"];
+    const raw = Array.isArray(headerValue) ? headerValue[0] : headerValue;
+    const requestedSessionMode = raw === "true" ? true : raw === "false" ? false : null;
+    const useSessionBasedToken = requestedSessionMode ?? config.session.basedToken;
+    if (useSessionBasedToken) {
+      ctx.res.setHeader("X-Session-Token", result.newToken);
+    } else {
+      ctx.res.setHeader("Set-Cookie", `${config.http.sessionCookieName}=${result.newToken}; ${ctx.sessionCookieOptions}`);
+    }
+  }
+  return json(ctx, 200, {
+    status: true,
+    reason: result.reason,
+    session: result.session,
+    authenticated: Boolean(result.newToken)
+  });
+};
+var requireUser = async (ctx, login) => {
+  if (!ctx.token) return null;
+  const session = await login.getSession(ctx.token);
+  const userId = session?.id;
+  if (!userId) return null;
+  return login.getUserAdapter().findById(userId);
+};
+var handleAuthEmailCodeRoute = async (ctx) => {
+  if (ctx.routePath !== "/auth/api/email-code/request" && ctx.routePath !== "/auth/api/email-code/verify") return false;
+  if (ctx.method !== "POST") return methodNotAllowed(ctx);
+  const login = await getLogin();
+  if (!login) return json(ctx, 200, { status: false, reason: "auth.disabled" });
+  const params = ctx.params;
+  const requesterIp = requesterIpOf(ctx);
+  if (ctx.routePath === "/auth/api/email-code/request") {
+    if (await ipThrottled(ctx, "email-code-request", 10)) return json(ctx, 429, { status: false, reason: "api.rateLimitExceeded" });
+    const result2 = await login.requestEmailLoginCode({ email: str(params.email), requesterIp });
+    return json(ctx, 200, result2.ok ? { status: true } : { status: false, reason: result2.reason });
+  }
+  if (await ipThrottled(ctx, "email-code-verify", 20)) return json(ctx, 429, { status: false, reason: "api.rateLimitExceeded" });
+  const result = await login.verifyEmailLoginCode({
+    email: str(params.email),
+    code: str(params.code),
+    supersedeToken: ctx.token ?? void 0,
+    requesterIp
+  });
+  return sendLoginResult(ctx, login, result);
+};
+var handleAuthTwoFactorRoute = async (ctx) => {
+  if (ctx.routePath !== "/auth/api/2fa" && !ctx.routePath.startsWith("/auth/api/2fa/")) return false;
+  if (ctx.method !== "POST") return methodNotAllowed(ctx);
+  const login = await getLogin();
+  if (!login) return json(ctx, 200, { status: false, reason: "auth.disabled" });
+  const params = ctx.params;
+  const requesterIp = requesterIpOf(ctx);
+  if (ctx.routePath === "/auth/api/2fa") {
+    if (await ipThrottled(ctx, "2fa-verify", 20)) return json(ctx, 429, { status: false, reason: "api.rateLimitExceeded" });
+    const method = str(params.method);
+    const result = await login.verifyTwoFactorChallenge({
+      challengeToken: str(params.challengeToken),
+      code: str(params.code),
+      method: method === "email-code" || method === "recovery-code" ? method : "totp",
+      supersedeToken: ctx.token ?? void 0,
+      requesterIp
+    });
+    return sendLoginResult(ctx, login, result);
+  }
+  if (ctx.routePath === "/auth/api/2fa/email-code") {
+    if (await ipThrottled(ctx, "2fa-email-code", 5)) return json(ctx, 429, { status: false, reason: "api.rateLimitExceeded" });
+    const result = await login.requestTwoFactorEmailCode(str(params.challengeToken));
+    return json(ctx, 200, result.ok ? { status: true } : { status: false, reason: result.reason });
+  }
+  if (await ipThrottled(ctx, "2fa-manage", 15)) return json(ctx, 429, { status: false, reason: "api.rateLimitExceeded" });
+  const user = await requireUser(ctx, login);
+  if (!user) return json(ctx, 401, { status: false, reason: "api.unauthorized" });
+  switch (ctx.routePath) {
+    case "/auth/api/2fa/setup": {
+      const start = await login.beginTotpEnrollment(user);
+      return start.ok ? json(ctx, 200, { status: true, secret: start.secret, otpauthUri: start.otpauthUri }) : json(ctx, 200, { status: false, reason: start.reason });
+    }
+    case "/auth/api/2fa/enable": {
+      const confirmed = await login.confirmTotpEnrollment(user, str(params.code));
+      return confirmed.ok ? json(ctx, 200, { status: true, recoveryCodes: confirmed.recoveryCodes }) : json(ctx, 200, { status: false, reason: confirmed.reason });
+    }
+    case "/auth/api/2fa/disable": {
+      const disabled = await login.disableTwoFactor(user, str(params.code));
+      return json(ctx, 200, disabled.ok ? { status: true } : { status: false, reason: disabled.reason ?? "login.twoFactorInvalidCode" });
+    }
+    case "/auth/api/2fa/recovery-codes": {
+      const regenerated = await login.regenerateRecoveryCodes(user, str(params.code));
+      return regenerated.ok ? json(ctx, 200, { status: true, recoveryCodes: regenerated.recoveryCodes }) : json(ctx, 200, { status: false, reason: regenerated.reason });
+    }
+    default: {
+      return json(ctx, 404, { status: false, reason: "common.404" });
+    }
+  }
+};
+
 // src/httpRoutes/authLogoutRoute.ts
-import { getLogger as getLogger2, getProjectConfig as getProjectConfig6, tryCatch as tryCatch3 } from "@luckystack/core";
+import { getLogger as getLogger2, getProjectConfig as getProjectConfig7, tryCatch as tryCatch3 } from "@luckystack/core";
 var warnedNonStrictSameSite = false;
 var handleAuthLogoutRoute = async ({ res, routePath, method, token }) => {
   if (routePath !== "/auth/logout") return false;
@@ -657,7 +818,7 @@ var handleAuthLogoutRoute = async ({ res, routePath, method, token }) => {
       }
     }
   }
-  const http2 = getProjectConfig6().http;
+  const http2 = getProjectConfig7().http;
   if (http2.sessionCookieSameSite !== "Strict" && !warnedNonStrictSameSite) {
     warnedNonStrictSameSite = true;
     getLogger2().warn(
@@ -676,17 +837,19 @@ var handleAuthLogoutRoute = async ({ res, routePath, method, token }) => {
 };
 
 // src/httpRoutes/authProvidersRoute.ts
+import { getProjectConfig as getProjectConfig8 } from "@luckystack/core";
 var handleAuthProvidersRoute = async ({ req, res, routePath }) => {
   if (routePath !== "/auth/providers" || req.method !== "GET") return false;
   const login = await getLogin();
   const providers = login ? login.getOAuthProviders().map((provider) => provider.name) : [];
+  const emailCodeLogin = Boolean(login) && getProjectConfig8().auth.emailCodeLogin;
   res.setHeader("Content-Type", "application/json");
-  res.end(JSON.stringify({ providers }));
+  res.end(JSON.stringify({ providers, emailCodeLogin }));
   return true;
 };
 
 // src/httpRoutes/authCallbackRoute.ts
-import { getLogger as getLogger3, getProjectConfig as getProjectConfig7 } from "@luckystack/core";
+import { getLogger as getLogger3, getProjectConfig as getProjectConfig9 } from "@luckystack/core";
 var handleAuthCallbackRoute = async ({
   req,
   res,
@@ -701,7 +864,7 @@ var handleAuthCallbackRoute = async ({
     res.end("Auth is not enabled");
     return true;
   }
-  const config = getProjectConfig7();
+  const config = getProjectConfig9();
   const sessionCookieName = config.http.sessionCookieName;
   const shouldLogDev = config.logging.devLogs;
   const publicOrigin = (config.app.publicUrl || "").replace(/\/+$/, "");
@@ -745,7 +908,7 @@ import {
 import { handleHttpApiRequest } from "@luckystack/api";
 
 // src/sse.ts
-import { getProjectConfig as getProjectConfig8 } from "@luckystack/core";
+import { getProjectConfig as getProjectConfig10 } from "@luckystack/core";
 var isExpectingEventStream = (acceptHeader) => {
   if (!acceptHeader) return false;
   const value = Array.isArray(acceptHeader) ? acceptHeader.join(",") : acceptHeader;
@@ -753,7 +916,7 @@ var isExpectingEventStream = (acceptHeader) => {
 };
 var queryRequestsStream = (queryString) => {
   if (!queryString) return false;
-  const { queryParam, enabledValue } = getProjectConfig8().http.stream;
+  const { queryParam, enabledValue } = getProjectConfig10().http.stream;
   const params = new URLSearchParams(queryString);
   const value = params.get(queryParam);
   return value === enabledValue || value === "1";
@@ -769,7 +932,7 @@ var initSseResponse = (res) => {
     Connection: "keep-alive",
     "X-Accel-Buffering": "no"
   });
-  const connectedComment = getProjectConfig8().http.stream.connectedComment;
+  const connectedComment = getProjectConfig10().http.stream.connectedComment;
   if (connectedComment) {
     res.write(`${connectedComment}
 
@@ -792,12 +955,12 @@ var sendSseEvent = ({
 };
 
 // src/httpRoutes/resolveRequesterIp.ts
-import { getProjectConfig as getProjectConfig9, resolveClientIp as resolveClientIp2 } from "@luckystack/core";
+import { getProjectConfig as getProjectConfig11, resolveClientIp as resolveClientIp3 } from "@luckystack/core";
 var resolveRequesterIp = (req) => {
-  const trustProxy = getProjectConfig9().http.trustProxy;
-  const trustedProxyHopCount = getProjectConfig9().http.trustedProxyHopCount;
+  const trustProxy = getProjectConfig11().http.trustProxy;
+  const trustedProxyHopCount = getProjectConfig11().http.trustedProxyHopCount;
   const rawRemoteAddress = req.socket.remoteAddress;
-  return rawRemoteAddress || trustProxy && (req.headers["x-forwarded-for"] || req.headers["x-real-ip"]) ? resolveClientIp2({ rawAddress: rawRemoteAddress, headers: req.headers, trustProxy, trustedProxyHopCount }) : void 0;
+  return rawRemoteAddress || trustProxy && (req.headers["x-forwarded-for"] || req.headers["x-real-ip"]) ? resolveClientIp3({ rawAddress: rawRemoteAddress, headers: req.headers, trustProxy, trustedProxyHopCount }) : void 0;
 };
 
 // src/httpRoutes/apiRoute.ts
@@ -1168,7 +1331,7 @@ var handleStaticAndSpaFallback = async ({
 // src/httpHandler.ts
 var buildSessionCookieOptions = (sessionExpiryDays, secure, http2) => `HttpOnly; SameSite=${http2.sessionCookieSameSite}; Path=${http2.sessionCookiePath}; Max-Age=${60 * 60 * 24 * sessionExpiryDays}; ${secure ? "Secure;" : ""}`;
 var setSecurityHeaders = (req, res, origin) => {
-  const { cors, securityHeaders } = getProjectConfig10().http;
+  const { cors, securityHeaders } = getProjectConfig12().http;
   res.setHeader("Access-Control-Allow-Origin", origin);
   res.setHeader("Access-Control-Allow-Methods", cors.allowedMethods);
   res.setHeader("Access-Control-Allow-Headers", cors.allowedHeaders);
@@ -1208,6 +1371,8 @@ var PRE_PARAMS_ROUTES = [
 ];
 var POST_PARAMS_ROUTES = [
   handleUploadsRoute,
+  handleAuthEmailCodeRoute,
+  handleAuthTwoFactorRoute,
   handleAuthApiRoute,
   handleAuthCallbackRoute,
   handleApiRoute,
@@ -1286,7 +1451,7 @@ var parseRequestParams = async ({
   return params;
 };
 var handleHttpRequestInner = async (req, res, options) => {
-  const config = getProjectConfig10();
+  const config = getProjectConfig12();
   const shouldLogDev = config.logging.devLogs;
   const sessionCookieName = config.http.sessionCookieName;
   const sessionCookieOptions = buildSessionCookieOptions(
@@ -1402,7 +1567,7 @@ import {
   extractLanguageFromHeader,
   extractTokenFromSocket,
   getLogger as getLogger8,
-  getProjectConfig as getProjectConfig11,
+  getProjectConfig as getProjectConfig13,
   dispatchHook as dispatchHook6,
   normalizeErrorResponse,
   readSession as readSession4,
@@ -1544,7 +1709,7 @@ var registerRoomEvents = (ctx) => {
         blockedErrorCode: "room.joinBlocked",
         logVerb: "joined",
         mutate: async (sock, physicalRoom, rawGroup, existingCodes, userId) => {
-          const maxRooms = getProjectConfig11().socket.maxRoomsPerSession;
+          const maxRooms = getProjectConfig13().socket.maxRoomsPerSession;
           let kept = existingCodes;
           if (maxRooms !== false && maxRooms > 0 && !existingCodes.includes(rawGroup)) {
             while (kept.length >= maxRooms) {
@@ -1716,7 +1881,7 @@ var rejoinPersistedRooms = (ctx) => {
   })();
 };
 var loadSocket = (httpServer, options = {}) => {
-  const config = getProjectConfig11();
+  const config = getProjectConfig13();
   const shouldLogDev = config.logging.devLogs;
   const shouldLogSocketStartup = config.logging.socketStartup;
   const io = new SocketIOServer(httpServer, {
@@ -1787,7 +1952,7 @@ var loadSocket = (httpServer, options = {}) => {
 import {
   collectSynchronizedEnvKeys,
   getLogger as getLogger9,
-  getProjectConfig as getProjectConfig12,
+  getProjectConfig as getProjectConfig14,
   isDeployConfigRegistered,
   isLocalizedNormalizerRegistered,
   isProjectConfigRegistered,
@@ -1854,7 +2019,7 @@ var verifyBootstrap = async (requirements = {}) => {
   }
   if (isProjectConfigRegistered()) {
     const synchronizedKeyCount = collectSynchronizedEnvKeys().length;
-    const healthHashMode = getProjectConfig12().http.healthHash.mode;
+    const healthHashMode = getProjectConfig14().http.healthHash.mode;
     if (synchronizedKeyCount > 0 && healthHashMode === "plain") {
       getLogger9().warn(
         `[LuckyStack] SECURITY: /_health exposes UNSALTED sha256 fingerprints of ${String(synchronizedKeyCount)} synchronized env secret(s) by default. Set \`http.healthHash.mode\` to 'hmac' (or 'salted' with salt '@bootUuid') to stop publishing brute-forceable secret fingerprints to unauthenticated callers.`
@@ -1862,7 +2027,7 @@ var verifyBootstrap = async (requirements = {}) => {
     }
   }
   if (isProjectConfigRegistered()) {
-    const cfg = getProjectConfig12();
+    const cfg = getProjectConfig14();
     if (!cfg.session.basedToken && cfg.http.sessionCookieSameSite !== "Strict") {
       getLogger9().warn(
         `[LuckyStack] SECURITY: http.sessionCookieSameSite is '${cfg.http.sessionCookieSameSite}', not 'Strict', but the CSRF-exempt auth-bootstrap endpoints (/auth/api/credentials, /auth/callback/*) rely on SameSite=Strict to block cross-site login-CSRF. Use 'Strict', or add your own CSRF/origin check on those routes.`
@@ -2166,7 +2331,7 @@ var listenLuckyStackServer = (httpServer, ip, port, callback) => new Promise((re
         writeDevServerInfo(ip, attemptPort);
         process.once("exit", clearDevServerInfo);
       }
-      const config = getProjectConfig13();
+      const config = getProjectConfig15();
       if (config.logging.socketStartup || config.logging.devLogs) {
         getLogger13().info(`Server is running on http://${ip}:${String(attemptPort)}/`);
       }