@lastshotlabs/bunshot 0.0.25 → 0.0.28

package/dist/packages/bunshot-auth/src/lib/fingerprint.js

@@ -0,0 +1,36 @@
+const BROWSER_HEADERS = [
+    'sec-fetch-site',
+    'sec-fetch-mode',
+    'sec-fetch-dest',
+    'sec-ch-ua',
+    'sec-ch-ua-mobile',
+    'sec-ch-ua-platform',
+    'origin',
+    'referer',
+    'x-requested-with',
+];
+const encoder = new TextEncoder();
+/**
+ * Builds a 12-hex-char fingerprint from stable HTTP headers.
+ * IP-independent: bots that rotate IPs but use the same HTTP client
+ * will produce the same fingerprint and share a rate-limit bucket.
+ */
+export async function buildFingerprint(req) {
+    const h = (name) => req.headers.get(name) ?? '';
+    // Encode which browser-only headers are present as a bitmask string.
+    // Real browsers send most of these; raw HTTP clients send none.
+    const bitmap = BROWSER_HEADERS.map(name => (req.headers.has(name) ? '1' : '0')).join('');
+    const raw = [
+        h('user-agent'),
+        h('accept'),
+        h('accept-language'),
+        h('accept-encoding'),
+        h('connection'),
+        bitmap,
+    ].join('|');
+    const buf = await crypto.subtle.digest('SHA-256', encoder.encode(raw));
+    const bytes = new Uint8Array(buf).slice(0, 6);
+    return Array.from(bytes)
+        .map(b => b.toString(16).padStart(2, '0'))
+        .join('');
+}

package/dist/{lib → packages/bunshot-auth/src/lib}/groups.d.ts

@@ -1,3 +1,4 @@
+import type { AuthAdapter } from './authAdapter';
 export interface GroupRecord {
     id: string;
     /** Machine-readable slug: /^[a-z0-9_-]+$/, unique within scope (app-wide or per-tenant). */
@@ -26,41 +27,39 @@ export interface GroupMembershipRecord {
 export interface PaginationOpts {
     /** Default: 50, max: 200 */
     limit?: number;
-    /** Default: 0 */
-    offset?: number;
+    /** Opaque pagination cursor from a previous response */
+    cursor?: string;
 }
 export interface PaginatedResult<T> {
     items: T[];
-    total: number;
-    limit: number;
-    offset: number;
+    nextCursor?: string;
 }
 /**
  * Create a new group. tenantId null = app-wide, string = tenant-scoped.
  * The group name must be a slug (/^[a-z0-9_-]+$/) and unique within its scope.
  * Returns the new group's id.
  */
-export declare const createGroup: (group: Omit<GroupRecord, "id" | "createdAt" | "updatedAt">) => Promise<{
+export declare const createGroup: (adapter: AuthAdapter, group: Omit<GroupRecord, "id" | "createdAt" | "updatedAt">) => Promise<{
     id: string;
 }>;
 /**
  * Delete a group by ID. All memberships are cascade-deleted by the adapter.
  */
-export declare const deleteGroup: (groupId: string) => Promise<void>;
+export declare const deleteGroup: (adapter: AuthAdapter, groupId: string) => Promise<void>;
 /**
  * Get a group by ID. Returns null if not found.
  */
-export declare const getGroup: (groupId: string) => Promise<GroupRecord | null>;
+export declare const getGroup: (adapter: AuthAdapter, groupId: string) => Promise<GroupRecord | null>;
 /**
  * List groups scoped to a tenant (tenantId string) or app-wide (tenantId null).
  * Results are paginated.
  */
-export declare const listGroups: (tenantId: string | null, opts?: PaginationOpts) => Promise<PaginatedResult<GroupRecord>>;
+export declare const listGroups: (adapter: AuthAdapter, tenantId: string | null, opts?: PaginationOpts) => Promise<PaginatedResult<GroupRecord>>;
 /**
  * Update a group's mutable fields: name, displayName, description, roles.
  * tenantId is NOT in the update type — it is immutable after creation.
  */
-export declare const updateGroup: (groupId: string, updates: Partial<Pick<GroupRecord, "roles" | "name" | "displayName" | "description">>) => Promise<void>;
+export declare const updateGroup: (adapter: AuthAdapter, groupId: string, updates: Partial<Pick<GroupRecord, "roles" | "name" | "displayName" | "description">>) => Promise<void>;
 /**
  * Add a user to a group. Optionally supply per-membership roles (extras on top of group.roles).
  *
@@ -68,20 +67,20 @@ export declare const updateGroup: (groupId: string, updates: Partial<Pick<GroupR
  * Use updateGroupMembership to change roles on an existing membership.
  * All adapters surface this as a thrown error, not a silent no-op.
  */
-export declare const addGroupMember: (groupId: string, userId: string, roles?: string[]) => Promise<void>;
+export declare const addGroupMember: (adapter: AuthAdapter, groupId: string, userId: string, roles?: string[]) => Promise<void>;
 /**
  * Update the per-membership roles for an existing member.
  * This replaces the member's roles[] entirely (not an additive operation).
  */
-export declare const updateGroupMembership: (groupId: string, userId: string, roles: string[]) => Promise<void>;
+export declare const updateGroupMembership: (adapter: AuthAdapter, groupId: string, userId: string, roles: string[]) => Promise<void>;
 /**
  * Remove a user from a group. No-op if the user is not a member.
  */
-export declare const removeGroupMember: (groupId: string, userId: string) => Promise<void>;
+export declare const removeGroupMember: (adapter: AuthAdapter, groupId: string, userId: string) => Promise<void>;
 /**
  * List members of a group, with their per-membership roles. Paginated.
  */
-export declare const getGroupMembers: (groupId: string, opts?: PaginationOpts) => Promise<PaginatedResult<{
+export declare const getGroupMembers: (adapter: AuthAdapter, groupId: string, opts?: PaginationOpts) => Promise<PaginatedResult<{
     userId: string;
     roles: string[];
 }>>;
@@ -89,7 +88,7 @@ export declare const getGroupMembers: (groupId: string, opts?: PaginationOpts) =
  * List all groups a user belongs to, with their per-membership roles.
  * Pass tenantId=null for app-wide groups, tenantId=string for tenant-scoped groups.
  */
-export declare const getUserGroups: (userId: string, tenantId: string | null) => Promise<Array<{
+export declare const getUserGroups: (adapter: AuthAdapter, userId: string, tenantId: string | null) => Promise<Array<{
     group: GroupRecord;
     membershipRoles: string[];
 }>>;
@@ -110,4 +109,4 @@ export declare const getUserGroups: (userId: string, tenantId: string | null) =>
  * Used internally by requireRole and requireRole.global. Also exported for use in
  * custom middleware, route handlers, or GET /auth/me enrichment.
  */
-export declare const getEffectiveRoles: (userId: string, tenantId: string | null) => Promise<string[]>;
+export declare const getEffectiveRoles: (adapter: AuthAdapter, userId: string, tenantId: string | null) => Promise<string[]>;

package/dist/{lib → packages/bunshot-auth/src/lib}/groups.js

@@ -1,4 +1,3 @@
-import { getAuthAdapter } from "./authAdapter";
 // ---------------------------------------------------------------------------
 // Group CRUD
 // ---------------------------------------------------------------------------
@@ -7,48 +6,43 @@ import { getAuthAdapter } from "./authAdapter";
  * The group name must be a slug (/^[a-z0-9_-]+$/) and unique within its scope.
  * Returns the new group's id.
  */
-export const createGroup = async (group) => {
-    const adapter = getAuthAdapter();
+export const createGroup = async (adapter, group) => {
     if (!adapter.createGroup)
-        throw new Error("Auth adapter does not implement createGroup");
+        throw new Error('Auth adapter does not implement createGroup');
     return adapter.createGroup(group);
 };
 /**
  * Delete a group by ID. All memberships are cascade-deleted by the adapter.
  */
-export const deleteGroup = async (groupId) => {
-    const adapter = getAuthAdapter();
+export const deleteGroup = async (adapter, groupId) => {
     if (!adapter.deleteGroup)
-        throw new Error("Auth adapter does not implement deleteGroup");
+        throw new Error('Auth adapter does not implement deleteGroup');
     return adapter.deleteGroup(groupId);
 };
 /**
  * Get a group by ID. Returns null if not found.
  */
-export const getGroup = async (groupId) => {
-    const adapter = getAuthAdapter();
+export const getGroup = async (adapter, groupId) => {
     if (!adapter.getGroup)
-        throw new Error("Auth adapter does not implement getGroup");
+        throw new Error('Auth adapter does not implement getGroup');
     return adapter.getGroup(groupId);
 };
 /**
  * List groups scoped to a tenant (tenantId string) or app-wide (tenantId null).
  * Results are paginated.
  */
-export const listGroups = async (tenantId, opts) => {
-    const adapter = getAuthAdapter();
+export const listGroups = async (adapter, tenantId, opts) => {
     if (!adapter.listGroups)
-        throw new Error("Auth adapter does not implement listGroups");
+        throw new Error('Auth adapter does not implement listGroups');
     return adapter.listGroups(tenantId, opts);
 };
 /**
  * Update a group's mutable fields: name, displayName, description, roles.
  * tenantId is NOT in the update type — it is immutable after creation.
  */
-export const updateGroup = async (groupId, updates) => {
-    const adapter = getAuthAdapter();
+export const updateGroup = async (adapter, groupId, updates) => {
     if (!adapter.updateGroup)
-        throw new Error("Auth adapter does not implement updateGroup");
+        throw new Error('Auth adapter does not implement updateGroup');
     return adapter.updateGroup(groupId, updates);
 };
 // ---------------------------------------------------------------------------
@@ -61,48 +55,43 @@ export const updateGroup = async (groupId, updates) => {
  * Use updateGroupMembership to change roles on an existing membership.
  * All adapters surface this as a thrown error, not a silent no-op.
  */
-export const addGroupMember = async (groupId, userId, roles) => {
-    const adapter = getAuthAdapter();
+export const addGroupMember = async (adapter, groupId, userId, roles) => {
     if (!adapter.addGroupMember)
-        throw new Error("Auth adapter does not implement addGroupMember");
+        throw new Error('Auth adapter does not implement addGroupMember');
     return adapter.addGroupMember(groupId, userId, roles);
 };
 /**
  * Update the per-membership roles for an existing member.
  * This replaces the member's roles[] entirely (not an additive operation).
  */
-export const updateGroupMembership = async (groupId, userId, roles) => {
-    const adapter = getAuthAdapter();
+export const updateGroupMembership = async (adapter, groupId, userId, roles) => {
     if (!adapter.updateGroupMembership)
-        throw new Error("Auth adapter does not implement updateGroupMembership");
+        throw new Error('Auth adapter does not implement updateGroupMembership');
     return adapter.updateGroupMembership(groupId, userId, roles);
 };
 /**
  * Remove a user from a group. No-op if the user is not a member.
  */
-export const removeGroupMember = async (groupId, userId) => {
-    const adapter = getAuthAdapter();
+export const removeGroupMember = async (adapter, groupId, userId) => {
     if (!adapter.removeGroupMember)
-        throw new Error("Auth adapter does not implement removeGroupMember");
+        throw new Error('Auth adapter does not implement removeGroupMember');
     return adapter.removeGroupMember(groupId, userId);
 };
 /**
  * List members of a group, with their per-membership roles. Paginated.
  */
-export const getGroupMembers = async (groupId, opts) => {
-    const adapter = getAuthAdapter();
+export const getGroupMembers = async (adapter, groupId, opts) => {
     if (!adapter.getGroupMembers)
-        throw new Error("Auth adapter does not implement getGroupMembers");
+        throw new Error('Auth adapter does not implement getGroupMembers');
     return adapter.getGroupMembers(groupId, opts);
 };
 /**
  * List all groups a user belongs to, with their per-membership roles.
  * Pass tenantId=null for app-wide groups, tenantId=string for tenant-scoped groups.
  */
-export const getUserGroups = async (userId, tenantId) => {
-    const adapter = getAuthAdapter();
+export const getUserGroups = async (adapter, userId, tenantId) => {
     if (!adapter.getUserGroups)
-        throw new Error("Auth adapter does not implement getUserGroups");
+        throw new Error('Auth adapter does not implement getUserGroups');
     return adapter.getUserGroups(userId, tenantId);
 };
 // ---------------------------------------------------------------------------
@@ -125,9 +114,8 @@ export const getUserGroups = async (userId, tenantId) => {
  * Used internally by requireRole and requireRole.global. Also exported for use in
  * custom middleware, route handlers, or GET /auth/me enrichment.
  */
-export const getEffectiveRoles = async (userId, tenantId) => {
-    const adapter = getAuthAdapter();
+export const getEffectiveRoles = async (adapter, userId, tenantId) => {
     if (!adapter.getEffectiveRoles)
-        throw new Error("Auth adapter does not implement getEffectiveRoles");
+        throw new Error('Auth adapter does not implement getEffectiveRoles');
     return adapter.getEffectiveRoles(userId, tenantId);
 };

package/dist/packages/bunshot-auth/src/lib/jwks.d.ts

@@ -0,0 +1,28 @@
+import { type JWK } from 'jose';
+import type { AuthResolvedConfig, OidcConfig } from '../config/authConfig';
+export interface JwksKeyConfig {
+    privateKey: string;
+    publicKey: string;
+    kid?: string;
+}
+type KeyMaterial = CryptoKey;
+export type PublicJwk = JWK & {
+    kty: string;
+};
+export declare function loadJwksKey(oidc: OidcConfig, config: JwksKeyConfig): OidcConfig;
+export declare function loadPreviousKey(oidc: OidcConfig, config: {
+    publicKey: string;
+    kid?: string;
+}): OidcConfig;
+export declare function generateAndLoadKeyPair(oidc: OidcConfig): Promise<{
+    oidc: OidcConfig;
+    privateKey: string;
+    publicKey: string;
+}>;
+export declare function getSigningPrivateKey(config?: AuthResolvedConfig): Promise<KeyMaterial>;
+export declare function getVerifyPublicKeys(config?: AuthResolvedConfig): Promise<KeyMaterial[]>;
+export declare function getJwks(config?: AuthResolvedConfig): Promise<{
+    keys: PublicJwk[];
+}>;
+export declare function isJwksLoaded(config?: AuthResolvedConfig): boolean;
+export {};

package/dist/packages/bunshot-auth/src/lib/jwks.js

@@ -0,0 +1,79 @@
+import { exportJWK, generateKeyPair, importPKCS8, importSPKI } from 'jose';
+function requirePublicJwk(jwk, context) {
+    if (!jwk.kty) {
+        throw new Error(`[bunshot-auth] ${context} produced a JWK without kty`);
+    }
+    return jwk;
+}
+async function loadPrimaryKey(config) {
+    if (!config)
+        return null;
+    const kid = config.kid ?? 'key-1';
+    const privateKey = await importPKCS8(config.privateKey, 'RS256');
+    const publicKey = await importSPKI(config.publicKey, 'RS256');
+    const jwk = requirePublicJwk(await exportJWK(publicKey), 'Primary signing key');
+    return { privateKey, publicKey, jwk: { ...jwk, kid, alg: 'RS256', use: 'sig' }, kid };
+}
+async function loadPreviousKeys(configs) {
+    if (!configs?.length)
+        return [];
+    return Promise.all(configs.map(async (config, index) => {
+        const kid = config.kid ?? `key-prev-${index + 1}`;
+        const publicKey = await importSPKI(config.publicKey, 'RS256');
+        const jwk = requirePublicJwk(await exportJWK(publicKey), `Previous signing key ${kid}`);
+        return { publicKey, jwk: { ...jwk, kid, alg: 'RS256', use: 'sig' }, kid };
+    }));
+}
+export function loadJwksKey(oidc, config) {
+    return { ...oidc, signingKey: config };
+}
+export function loadPreviousKey(oidc, config) {
+    return {
+        ...oidc,
+        previousKeys: [...(oidc.previousKeys ?? []), config],
+    };
+}
+export async function generateAndLoadKeyPair(oidc) {
+    const { privateKey: pk, publicKey: pubk } = await generateKeyPair('RS256', {
+        modulusLength: 2048,
+        extractable: true,
+    });
+    const { exportSPKI, exportPKCS8 } = await import('jose');
+    const privatePem = await exportPKCS8(pk);
+    const publicPem = await exportSPKI(pubk);
+    return {
+        oidc: loadJwksKey(oidc, { privateKey: privatePem, publicKey: publicPem, kid: 'key-1' }),
+        privateKey: privatePem,
+        publicKey: publicPem,
+    };
+}
+export async function getSigningPrivateKey(config) {
+    const primary = await loadPrimaryKey(config?.oidc?.signingKey);
+    if (!primary?.privateKey) {
+        throw new Error('RS256 requires OIDC key configuration — call loadJwksKey() first');
+    }
+    return primary.privateKey;
+}
+export async function getVerifyPublicKeys(config) {
+    const oidc = config?.oidc;
+    const primary = await loadPrimaryKey(oidc?.signingKey);
+    const previous = await loadPreviousKeys(oidc?.previousKeys);
+    const keys = [];
+    if (primary)
+        keys.push(primary.publicKey);
+    keys.push(...previous.map(key => key.publicKey));
+    return keys;
+}
+export async function getJwks(config) {
+    const oidc = config?.oidc;
+    const primary = await loadPrimaryKey(oidc?.signingKey);
+    const previous = await loadPreviousKeys(oidc?.previousKeys);
+    const keys = [];
+    if (primary)
+        keys.push(primary.jwk);
+    keys.push(...previous.map(key => key.jwk));
+    return { keys };
+}
+export function isJwksLoaded(config) {
+    return !!config?.oidc?.signingKey;
+}

package/dist/packages/bunshot-auth/src/lib/jwt.d.ts

@@ -0,0 +1,12 @@
+import type { JWTPayload } from 'jose';
+import type { SigningConfig } from '../../../bunshot-core/src/index.js';
+import type { AuthResolvedConfig } from '../config/authConfig';
+export declare function validateJwtSecrets(config: AuthResolvedConfig, signing?: SigningConfig | null): void;
+export type TokenClaims = {
+    sub: string;
+    sid?: string;
+    scope?: string;
+    [key: string]: unknown;
+};
+export declare function signToken(claims: TokenClaims, expirySeconds: number | undefined, config: AuthResolvedConfig, signing?: SigningConfig | null): Promise<string>;
+export declare const verifyToken: (token: string, config: AuthResolvedConfig, signing?: SigningConfig | null) => Promise<JWTPayload>;

package/dist/packages/bunshot-auth/src/lib/jwt.js

@@ -0,0 +1,86 @@
+import { getSigningPrivateKey, getVerifyPublicKeys, isJwksLoaded } from '../lib/jwks';
+import { SignJWT, jwtVerify } from 'jose';
+import { getSigningSecret } from '../infra/signing';
+function getSecret(signing) {
+    const raw = getSigningSecret(signing);
+    if (!raw) {
+        throw new Error(`[security] No JWT secret configured. Provide a signing config via createApp({ security: { signing: { secret: "..." } } }) or configure a ISecretRepository with JWT_SECRET.`);
+    }
+    const key = Array.isArray(raw) ? raw[0] : raw;
+    if (key.length < 32) {
+        throw new Error(`[security] JWT secret is too short (${key.length} chars). Must be at least 32 characters. ` +
+            `Generate one with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"`);
+    }
+    return new TextEncoder().encode(key);
+}
+function getAlgorithm(config) {
+    return config?.jwt?.algorithm ?? 'HS256';
+}
+export function validateJwtSecrets(config, signing) {
+    if (getAlgorithm(config) !== 'RS256') {
+        getSecret(signing);
+    }
+}
+export async function signToken(claims, expirySeconds, config, signing) {
+    const expiry = expirySeconds;
+    const algorithm = getAlgorithm(config);
+    if (algorithm === 'RS256') {
+        if (!isJwksLoaded(config)) {
+            throw new Error('RS256 requires OIDC key configuration — call loadJwksKey() first');
+        }
+        const privateKey = await getSigningPrivateKey(config);
+        const jwt = new SignJWT(claims)
+            .setProtectedHeader({ alg: 'RS256', kid: 'key-1' })
+            .setIssuedAt()
+            .setExpirationTime(expiry ? `${expiry}s` : '1h');
+        const { issuer: rs256Issuer, audience: rs256Audience } = config.jwt ?? {};
+        if (rs256Issuer)
+            jwt.setIssuer(rs256Issuer);
+        if (rs256Audience)
+            jwt.setAudience(rs256Audience);
+        return jwt.sign(privateKey);
+    }
+    const jwt = new SignJWT(claims)
+        .setProtectedHeader({ alg: algorithm })
+        .setIssuedAt()
+        .setExpirationTime(expiry ? `${expiry}s` : '1h');
+    const { issuer, audience } = config.jwt ?? {};
+    if (issuer)
+        jwt.setIssuer(issuer);
+    if (audience)
+        jwt.setAudience(audience);
+    return jwt.sign(getSecret(signing));
+}
+export const verifyToken = async (token, config, signing) => {
+    const algorithm = getAlgorithm(config);
+    if (algorithm === 'RS256') {
+        if (!isJwksLoaded(config)) {
+            throw new Error('RS256 requires OIDC key configuration');
+        }
+        const publicKeys = await getVerifyPublicKeys(config);
+        const opts = { algorithms: ['RS256'] };
+        const { issuer: rs256VerifyIssuer, audience: rs256VerifyAudience } = config.jwt ?? {};
+        if (rs256VerifyIssuer)
+            opts.issuer = rs256VerifyIssuer;
+        if (rs256VerifyAudience)
+            opts.audience = rs256VerifyAudience;
+        for (const key of publicKeys) {
+            try {
+                const { payload } = await jwtVerify(token, key, opts);
+                return payload;
+            }
+            catch {
+                continue;
+            }
+        }
+        throw new Error('JWT verification failed with all available keys');
+    }
+    const { issuer: verifyIssuer, audience: verifyAudience } = config.jwt ?? {};
+    const opts = { algorithms: [algorithm] };
+    if (verifyIssuer)
+        opts.issuer = verifyIssuer;
+    if (verifyAudience)
+        opts.audience = verifyAudience;
+    const { payload } = await jwtVerify(token, getSecret(signing), opts);
+    return payload;
+};

package/dist/packages/bunshot-auth/src/lib/logger.d.ts

@@ -0,0 +1,3 @@
+export declare const log: (...args: unknown[]) => void;
+/** Like log(), but also requires LOGGING_AUTH_TRACE=true. Use for lines that include user/session IDs. */
+export declare const authTrace: (...args: unknown[]) => void;

package/dist/packages/bunshot-auth/src/lib/logger.js

@@ -0,0 +1,13 @@
+const isDev = process.env.NODE_ENV !== 'production';
+const verboseEnv = process.env.LOGGING_VERBOSE;
+const verbose = verboseEnv !== undefined ? verboseEnv === 'true' : isDev;
+export const log = (...args) => {
+    if (verbose)
+        console.log(...args);
+};
+const authTraceEnabled = process.env.LOGGING_AUTH_TRACE === 'true';
+/** Like log(), but also requires LOGGING_AUTH_TRACE=true. Use for lines that include user/session IDs. */
+export const authTrace = (...args) => {
+    if (authTraceEnabled)
+        log(...args);
+};

package/dist/packages/bunshot-auth/src/lib/m2m.d.ts

@@ -0,0 +1,30 @@
+import type { AuthAdapter, M2MClientRecord } from '../lib/authAdapter';
+/**
+ * Look up an M2M client by clientId (active only).
+ * Returns the client record including clientSecretHash for verification.
+ */
+export declare function getM2MClient(adapter: AuthAdapter, clientId: string): Promise<(M2MClientRecord & {
+    clientSecretHash: string;
+}) | null>;
+/**
+ * Create a new M2M client. Returns the client ID and a plaintext secret (shown once).
+ * The secret is hashed with Bun.password before storage.
+ */
+export declare function createM2MClient(opts: {
+    clientId: string;
+    name: string;
+    scopes?: string[];
+    adapter: AuthAdapter;
+}): Promise<{
+    id: string;
+    clientId: string;
+    clientSecret: string;
+}>;
+/**
+ * Delete an M2M client by clientId.
+ */
+export declare function deleteM2MClient(adapter: AuthAdapter, clientId: string): Promise<void>;
+/**
+ * List all M2M clients (secrets not included).
+ */
+export declare function listM2MClients(adapter: AuthAdapter): Promise<M2MClientRecord[]>;

package/dist/packages/bunshot-auth/src/lib/m2m.js

@@ -0,0 +1,44 @@
+/**
+ * Look up an M2M client by clientId (active only).
+ * Returns the client record including clientSecretHash for verification.
+ */
+export async function getM2MClient(adapter, clientId) {
+    if (!adapter.getM2MClient)
+        return null;
+    return adapter.getM2MClient(clientId);
+}
+/**
+ * Create a new M2M client. Returns the client ID and a plaintext secret (shown once).
+ * The secret is hashed with Bun.password before storage.
+ */
+export async function createM2MClient(opts) {
+    const { adapter } = opts;
+    if (!adapter.createM2MClient) {
+        throw new Error('Auth adapter does not support M2M clients');
+    }
+    const clientSecret = crypto.randomUUID() + '-' + crypto.randomUUID();
+    const clientSecretHash = await Bun.password.hash(clientSecret);
+    const { id } = await adapter.createM2MClient({
+        clientId: opts.clientId,
+        clientSecretHash,
+        name: opts.name,
+        scopes: opts.scopes ?? [],
+    });
+    return { id, clientId: opts.clientId, clientSecret };
+}
+/**
+ * Delete an M2M client by clientId.
+ */
+export async function deleteM2MClient(adapter, clientId) {
+    if (adapter.deleteM2MClient) {
+        await adapter.deleteM2MClient(clientId);
+    }
+}
+/**
+ * List all M2M clients (secrets not included).
+ */
+export async function listM2MClients(adapter) {
+    if (!adapter.listM2MClients)
+        return [];
+    return adapter.listM2MClients();
+}

package/dist/packages/bunshot-auth/src/lib/magicLink.d.ts

@@ -0,0 +1,13 @@
+import type { RepoFactories } from '../../../bunshot-core/src/index.js';
+import type { RedisLike } from '../types/redis';
+export interface IMagicLinkRepository {
+    store(hash: string, userId: string, ttl: number): Promise<void>;
+    consume(hash: string): Promise<string | null>;
+}
+export declare function createMemoryMagicLinkRepository(): IMagicLinkRepository;
+export declare function createSqliteMagicLinkRepository(db: import('bun:sqlite').Database): IMagicLinkRepository;
+export declare function createRedisMagicLinkRepository(getRedis: () => RedisLike, appName: string): IMagicLinkRepository;
+export declare function createMongoMagicLinkRepository(conn: import('mongoose').Connection, mg: typeof import('mongoose')): IMagicLinkRepository;
+export declare const magicLinkFactories: RepoFactories<IMagicLinkRepository>;
+export declare const createMagicLinkToken: (repo: IMagicLinkRepository, userId: string, ttlSeconds?: number) => Promise<string>;
+export declare const consumeMagicLinkToken: (repo: IMagicLinkRepository, token: string) => Promise<string | null>;