@lastshotlabs/bunshot 0.0.21 → 0.0.27

package/dist/lib/upload.js

@@ -0,0 +1,112 @@
+import { HttpError } from "./HttpError";
+import { extname } from "node:path";
+let _adapter = null;
+let _config = {};
+export const setStorageAdapter = (adapter) => { _adapter = adapter; };
+export const getStorageAdapter = () => _adapter;
+export const setUploadConfig = (config) => { _config = config; };
+export const getUploadConfig = () => _config;
+export const generateUploadKey = (file, ctx, opts) => {
+    const merged = { ..._config, ...opts };
+    if (merged.generateKey)
+        return merged.generateKey(file, ctx);
+    const rawExt = extname(file.name);
+    const ext = /^\.[a-zA-Z0-9]{1,10}$/.test(rawExt) ? rawExt : "";
+    const uuid = crypto.randomUUID();
+    const prefix = merged.keyPrefix ?? "uploads/";
+    const tenantPrefix = merged.tenantScopedKeys && ctx.tenantId ? `${ctx.tenantId}/` : "";
+    return `${prefix}${tenantPrefix}${uuid}${ext}`;
+};
+export const generateUploadKeyFromFilename = (filename, ctx, opts) => {
+    const merged = { ..._config, ...opts };
+    if (merged.generateKey) {
+        // Create minimal File-like for custom generators that expect a File object
+        const stub = new File([], filename ?? "upload");
+        return merged.generateKey(stub, ctx);
+    }
+    const rawExt = filename ? extname(filename) : "";
+    const ext = /^\.[a-zA-Z0-9]{1,10}$/.test(rawExt) ? rawExt : "";
+    const uuid = crypto.randomUUID();
+    const prefix = merged.keyPrefix ?? "uploads/";
+    const tenantPrefix = merged.tenantScopedKeys && ctx.tenantId ? `${ctx.tenantId}/` : "";
+    return `${prefix}${tenantPrefix}${uuid}${ext}`;
+};
+const mimeMatches = (mimeType, pattern) => {
+    if (pattern.endsWith("/*")) {
+        return mimeType.startsWith(pattern.slice(0, -1));
+    }
+    return mimeType === pattern;
+};
+export const validateFile = (file, opts) => {
+    const maxFileSize = opts.maxFileSize ?? _config.maxFileSize ?? 10 * 1024 * 1024;
+    if (file.size > maxFileSize) {
+        return `File "${file.name}" exceeds maximum size of ${maxFileSize} bytes`;
+    }
+    const allowedMimeTypes = opts.allowedMimeTypes ?? _config.allowedMimeTypes;
+    if (allowedMimeTypes && allowedMimeTypes.length > 0) {
+        const allowed = allowedMimeTypes.some((pattern) => mimeMatches(file.type, pattern));
+        if (!allowed) {
+            return `File "${file.name}" has disallowed MIME type "${file.type}"`;
+        }
+    }
+    return null;
+};
+export const processUpload = async (file, opts) => {
+    const adapter = _adapter;
+    if (!adapter)
+        throw new HttpError(500, "No storage adapter configured");
+    const validationError = validateFile(file, opts);
+    if (validationError)
+        throw new HttpError(400, validationError);
+    const key = generateUploadKey(file, opts.ctx ?? {}, opts);
+    const { url } = await adapter.put(key, file, {
+        mimeType: file.type,
+        size: file.size,
+        bucket: opts.bucket,
+    });
+    // Register the upload for ownership tracking
+    const { registerUpload } = await import("./uploadRegistry");
+    await registerUpload({
+        key,
+        ownerUserId: opts.ctx?.userId,
+        tenantId: opts.ctx?.tenantId,
+        mimeType: file.type,
+        bucket: opts.bucket,
+        createdAt: Date.now(),
+    });
+    return {
+        key,
+        originalName: file.name,
+        mimeType: file.type,
+        size: file.size,
+        ...(url !== undefined ? { url } : {}),
+    };
+};
+export const parseUpload = async (c, opts) => {
+    const merged = { ..._config, ...opts };
+    const fields = merged.field
+        ? (Array.isArray(merged.field) ? merged.field : [merged.field])
+        : ["file"];
+    const maxFiles = merged.maxFiles ?? 10;
+    const body = await c.req.parseBody({ all: true });
+    const results = [];
+    const userId = c.get("authUserId") ?? undefined;
+    const tenantId = c.get("tenantId") ?? undefined;
+    const bucket = c.get("uploadBucket");
+    for (const field of fields) {
+        const raw = body[field];
+        if (!raw)
+            continue;
+        const files = Array.isArray(raw) ? raw : [raw];
+        for (const f of files) {
+            if (!(f instanceof File))
+                continue;
+            if (results.length >= maxFiles) {
+                throw new HttpError(400, `Too many files. Maximum is ${maxFiles}`);
+            }
+            const result = await processUpload(f, { ...merged, ctx: { userId, tenantId }, bucket: bucket ?? undefined });
+            results.push(result);
+        }
+    }
+    return results;
+};

package/dist/lib/uploadRegistry.d.ts

@@ -0,0 +1,18 @@
+export interface UploadRecord {
+    key: string;
+    ownerUserId?: string;
+    tenantId?: string;
+    mimeType?: string;
+    bucket?: string;
+    createdAt: number;
+}
+type UploadRegistryStore = "redis" | "mongo" | "sqlite" | "memory";
+export declare const setUploadRegistryStore: (store: UploadRegistryStore) => void;
+export declare const clearUploadRegistry: () => void;
+/** Store a new upload record. Keyed by the storage key. */
+export declare const registerUpload: (record: UploadRecord) => Promise<void>;
+/** Retrieve an upload record by key. Returns null if not found. */
+export declare const getUploadRecord: (key: string) => Promise<UploadRecord | null>;
+/** Delete an upload record by key. Returns true if it existed. */
+export declare const deleteUploadRecord: (key: string) => Promise<boolean>;
+export {};

package/dist/lib/uploadRegistry.js

@@ -0,0 +1,83 @@
+import { getRedis } from "./redis";
+import { appConnection, mongoose } from "./mongo";
+import { getAppName } from "./appConfig";
+let _store = "memory";
+export const setUploadRegistryStore = (store) => { _store = store; };
+// ---------------------------------------------------------------------------
+// Memory backend
+// ---------------------------------------------------------------------------
+const _memoryRegistry = new Map();
+export const clearUploadRegistry = () => { _memoryRegistry.clear(); };
+function getUploadRegistryModel() {
+    if (appConnection.models["UploadRegistry"])
+        return appConnection.models["UploadRegistry"];
+    const { Schema } = mongoose;
+    const schema = new Schema({
+        key: { type: String, required: true, unique: true },
+        ownerUserId: { type: String },
+        tenantId: { type: String },
+        mimeType: { type: String },
+        bucket: { type: String },
+        createdAt: { type: Number, required: true },
+    }, { collection: "upload_registry" });
+    return appConnection.model("UploadRegistry", schema);
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/** Store a new upload record. Keyed by the storage key. */
+export const registerUpload = async (record) => {
+    if (_store === "memory") {
+        _memoryRegistry.set(record.key, record);
+        return;
+    }
+    if (_store === "sqlite") {
+        const { sqliteRegisterUpload } = await import("../adapters/sqliteAuth");
+        sqliteRegisterUpload(record);
+        return;
+    }
+    if (_store === "mongo") {
+        await getUploadRegistryModel().updateOne({ key: record.key }, { $set: record }, { upsert: true });
+        return;
+    }
+    // Redis — no TTL (upload records are permanent until deleted)
+    await getRedis().set(`ur:${getAppName()}:${record.key}`, JSON.stringify(record));
+};
+/** Retrieve an upload record by key. Returns null if not found. */
+export const getUploadRecord = async (key) => {
+    if (_store === "memory") {
+        return _memoryRegistry.get(key) ?? null;
+    }
+    if (_store === "sqlite") {
+        const { sqliteGetUploadRecord } = await import("../adapters/sqliteAuth");
+        return sqliteGetUploadRecord(key);
+    }
+    if (_store === "mongo") {
+        const doc = await getUploadRegistryModel().findOne({ key }).lean();
+        if (!doc)
+            return null;
+        return { key: doc.key, ownerUserId: doc.ownerUserId, tenantId: doc.tenantId, mimeType: doc.mimeType, bucket: doc.bucket, createdAt: doc.createdAt };
+    }
+    // Redis
+    const raw = await getRedis().get(`ur:${getAppName()}:${key}`);
+    if (!raw)
+        return null;
+    return JSON.parse(raw);
+};
+/** Delete an upload record by key. Returns true if it existed. */
+export const deleteUploadRecord = async (key) => {
+    if (_store === "memory") {
+        return _memoryRegistry.delete(key);
+    }
+    if (_store === "sqlite") {
+        const { sqliteDeleteUploadRecord } = await import("../adapters/sqliteAuth");
+        return sqliteDeleteUploadRecord(key);
+    }
+    if (_store === "mongo") {
+        const result = await getUploadRegistryModel().deleteOne({ key });
+        return result.deletedCount > 0;
+    }
+    // Redis
+    const deleted = await getRedis().del(`ur:${getAppName()}:${key}`);
+    return deleted > 0;
+};

package/dist/lib/validate.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { HttpError } from "./HttpError";
+import { ValidationError } from "./HttpError";
 export const validate = async (schema, req) => {
     try {
         const body = await req.json();
@@ -7,7 +7,7 @@ export const validate = async (schema, req) => {
     }
     catch (err) {
         if (err instanceof z.ZodError) {
-            throw new HttpError(400, err.issues.map((i) => i.message).join(", "));
+            throw new ValidationError(err.issues);
         }
         throw err;
     }

package/dist/lib/ws.d.ts

@@ -6,6 +6,7 @@ type WithSocketId = {
     id: string;
 } & WithRooms;
 export declare const setWsServer: (server: Server<any>) => void;
+export declare const setPresenceEnabled: (enabled: boolean) => void;
 export declare const publish: (topic: string, data: unknown) => void;
 /** All rooms that currently have at least one subscriber */
 export declare const getRooms: () => string[];

package/dist/lib/ws.js

@@ -1,7 +1,10 @@
+import { addPresence, removePresence, cleanupPresence } from "./wsPresence";
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 let _server = null;
+let _presenceEnabled = false;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export const setWsServer = (server) => { _server = server; };
+export const setPresenceEnabled = (enabled) => { _presenceEnabled = enabled; };
 export const publish = (topic, data) => {
     _server?.publish(topic, JSON.stringify(data));
 };
@@ -12,6 +15,9 @@ export const getRooms = () => [..._roomRegistry.keys()];
 /** Socket IDs subscribed to a given room */
 export const getRoomSubscribers = (room) => [...(_roomRegistry.get(room) ?? [])];
 const MAX_ROOM_ACTION_SIZE = 4096; // 4 KB — room actions are small JSON payloads
+function isValidRoomName(room) {
+    return typeof room === "string" && /^[a-zA-Z0-9_:./\-]{1,128}$/.test(room);
+}
 export const handleRoomActions = async (ws, message, onSubscribe) => {
     try {
         const raw = typeof message === "string" ? message : Buffer.from(message).toString();
@@ -19,6 +25,8 @@ export const handleRoomActions = async (ws, message, onSubscribe) => {
             return false; // not a room action
         const data = JSON.parse(raw);
         if (data.action === "subscribe" && typeof data.room === "string") {
+            if (!isValidRoomName(data.room))
+                return true; // silently drop invalid room names
             if (onSubscribe && !(await onSubscribe(ws, data.room))) {
                 ws.send(JSON.stringify({ event: "subscribe_denied", room: data.room }));
             }
@@ -29,6 +37,8 @@ export const handleRoomActions = async (ws, message, onSubscribe) => {
             return true;
         }
         if (data.action === "unsubscribe" && typeof data.room === "string") {
+            if (!isValidRoomName(data.room))
+                return true; // silently drop invalid room names
             unsubscribe(ws, data.room);
             ws.send(JSON.stringify({ event: "unsubscribed", room: data.room }));
             return true;
@@ -43,6 +53,12 @@ export const subscribe = (ws, room) => {
     if (!_roomRegistry.has(room))
         _roomRegistry.set(room, new Set());
     _roomRegistry.get(room).add(ws.data.id);
+    if (_presenceEnabled) {
+        const result = addPresence(ws.data.id, room);
+        if (result?.isNewUser) {
+            publish(room, { event: "presence_join", room, userId: result.userId });
+        }
+    }
 };
 export const unsubscribe = (ws, room) => {
     ws.unsubscribe(room);
@@ -53,10 +69,22 @@ export const unsubscribe = (ws, room) => {
         if (ids.size === 0)
             _roomRegistry.delete(room);
     }
+    if (_presenceEnabled) {
+        const result = removePresence(ws.data.id, room);
+        if (result?.isLastSocket) {
+            publish(room, { event: "presence_leave", room, userId: result.userId });
+        }
+    }
 };
 export const getSubscriptions = (ws) => [...ws.data.rooms];
 /** Called on socket close to prune the registry. Internal use only. */
 export const cleanupSocket = (socketId, rooms) => {
+    if (_presenceEnabled) {
+        const departed = cleanupPresence(socketId, rooms);
+        for (const { room, userId } of departed) {
+            publish(room, { event: "presence_leave", room, userId });
+        }
+    }
     for (const room of rooms) {
         const ids = _roomRegistry.get(room);
         if (ids) {

package/dist/lib/wsHeartbeat.d.ts

@@ -0,0 +1,12 @@
+import type { ServerWebSocket } from "bun";
+export interface HeartbeatConfig {
+    intervalMs?: number;
+    timeoutMs?: number;
+}
+export declare const registerSocket: (ws: ServerWebSocket<any>, id: string) => void;
+export declare const deregisterSocket: (id: string) => void;
+export declare const handlePong: (id: string) => void;
+export declare const startHeartbeat: (config?: HeartbeatConfig | boolean) => void;
+export declare const stopHeartbeat: () => void;
+/** Reset all heartbeat state. Useful for test isolation. */
+export declare const clearHeartbeatState: () => void;

package/dist/lib/wsHeartbeat.js

@@ -0,0 +1,57 @@
+// ---------------------------------------------------------------------------
+// State
+// ---------------------------------------------------------------------------
+/** All live sockets — socketId → ServerWebSocket */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const _activeSockets = new Map();
+/** socketId → last pong timestamp (epoch ms) */
+const _lastPong = new Map();
+let _pingInterval = null;
+const DEFAULT_INTERVAL_MS = 30_000;
+const DEFAULT_TIMEOUT_MS = 10_000;
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+export const registerSocket = (ws, id) => {
+    _activeSockets.set(id, ws);
+    _lastPong.set(id, Date.now());
+};
+export const deregisterSocket = (id) => {
+    _activeSockets.delete(id);
+    _lastPong.delete(id);
+};
+export const handlePong = (id) => {
+    _lastPong.set(id, Date.now());
+};
+export const startHeartbeat = (config) => {
+    if (_pingInterval)
+        return; // already running
+    const opts = typeof config === "object" ? config : {};
+    const intervalMs = opts.intervalMs ?? DEFAULT_INTERVAL_MS;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    _pingInterval = setInterval(() => {
+        const now = Date.now();
+        for (const [id, ws] of _activeSockets) {
+            const lastPong = _lastPong.get(id) ?? 0;
+            if (now - lastPong > timeoutMs) {
+                ws.close(1001, "Heartbeat timeout");
+                // deregisterSocket will be called by the close handler
+            }
+            else {
+                ws.ping();
+            }
+        }
+    }, intervalMs);
+};
+export const stopHeartbeat = () => {
+    if (_pingInterval) {
+        clearInterval(_pingInterval);
+        _pingInterval = null;
+    }
+};
+/** Reset all heartbeat state. Useful for test isolation. */
+export const clearHeartbeatState = () => {
+    stopHeartbeat();
+    _activeSockets.clear();
+    _lastPong.clear();
+};

package/dist/lib/wsMessages.d.ts

@@ -0,0 +1,40 @@
+export interface StoredMessage {
+    id: string;
+    room: string;
+    senderId: string | null;
+    payload: unknown;
+    createdAt: number;
+}
+export type WsMessageStore = "redis" | "mongo" | "sqlite" | "memory";
+export interface WsMessageDefaults {
+    maxCount?: number;
+    ttlSeconds?: number;
+}
+export interface RoomPersistenceConfig {
+    persist: boolean;
+    maxCount?: number;
+    ttlSeconds?: number;
+}
+export declare const setWsMessageStore: (store: WsMessageStore) => void;
+export declare const setWsMessageDefaults: (defaults: WsMessageDefaults) => void;
+/** Opt a room into message persistence. */
+export declare const configureRoom: (room: string, options: RoomPersistenceConfig) => void;
+/**
+ * Persist a message to a room. Returns null if room is not configured for persistence.
+ * On store errors, logs a warning and returns null (non-blocking).
+ */
+export declare const persistMessage: (room: string, data: {
+    senderId?: string | null;
+    payload: unknown;
+}) => Promise<StoredMessage | null>;
+/**
+ * Get message history for a room.
+ * Cursor-based pagination using message `id` as cursor.
+ */
+export declare const getMessageHistory: (room: string, opts?: {
+    limit?: number;
+    before?: string;
+    after?: string;
+}) => Promise<StoredMessage[]>;
+/** Reset memory store. Useful for test isolation. */
+export declare const clearWsMessageMemoryStore: () => void;