@lastshotlabs/bunshot 0.0.25 → 0.0.28

package/dist/packages/bunshot-auth/src/routes/scim.js

@@ -0,0 +1,588 @@
+import { parseScimFilter, userRecordToScim } from '../lib/scim';
+import { createScimAuth } from '../middleware/scimAuth';
+import { z } from 'zod';
+import { createRoute, registerSchema } from '../../../bunshot-core/src/index.js';
+import { createRouter } from '../../../bunshot-core/src/index.js';
+import { getClientIp } from '../../../bunshot-core/src/index.js';
+const tags = ['SCIM'];
+// Rate limit options for SCIM endpoints
+const scimReadOpts = { windowMs: 60_000, max: 100 }; // 100/min for reads
+const scimWriteOpts = { windowMs: 60_000, max: 30 }; // 30/min for writes
+// ─── Zod Schemas ─────────────────────────────────────────────────────────────
+const scimUserCreateSchema = z
+    .object({
+    userName: z.string().email().optional(),
+    emails: z.array(z.object({ value: z.string().email() })).optional(),
+    name: z
+        .object({
+        givenName: z.string().max(256).optional(),
+        familyName: z.string().max(256).optional(),
+    })
+        .optional(),
+    displayName: z.string().max(256).optional(),
+    externalId: z.string().max(256).optional(),
+    active: z.boolean().optional(),
+})
+    .passthrough();
+const scimUserReplaceSchema = scimUserCreateSchema.extend({
+    id: z.string().max(256).optional(),
+});
+const scimPatchSchema = z
+    .object({
+    schemas: z.array(z.string()).optional(),
+    Operations: z
+        .array(z.object({
+        op: z.string().max(50),
+        path: z.string().max(256).optional(),
+        value: z.unknown(),
+    }))
+        .max(100),
+})
+    .passthrough();
+const scimUserResponseSchema = z
+    .object({
+    schemas: z.array(z.string()),
+    id: z.string(),
+    userName: z.string().optional(),
+    displayName: z.string().optional(),
+    externalId: z.string().optional(),
+    name: z
+        .object({
+        givenName: z.string().optional(),
+        familyName: z.string().optional(),
+        formatted: z.string().optional(),
+    })
+        .optional(),
+    emails: z.array(z.object({ value: z.string(), primary: z.boolean() })).optional(),
+    active: z.boolean(),
+    meta: z
+        .object({
+        resourceType: z.literal('User'),
+        created: z.string().optional(),
+        lastModified: z.string().optional(),
+    })
+        .optional(),
+})
+    .passthrough();
+const scimListResponseSchema = z.object({
+    schemas: z.array(z.string()),
+    totalResults: z.number().int(),
+    startIndex: z.number().int(),
+    itemsPerPage: z.number().int(),
+    Resources: z.array(scimUserResponseSchema),
+});
+const scimErrorSchema = registerSchema('ScimError', z.object({
+    schemas: z.array(z.literal('urn:ietf:params:scim:api:messages:2.0:Error')),
+    status: z.string(),
+    detail: z.string(),
+}));
+const scimListQuerySchema = z.object({
+    filter: z.string().optional(),
+    startIndex: z.coerce.number().int().min(1).default(1),
+    count: z.coerce.number().int().min(1).max(200).default(100),
+});
+const scimUserIdParamSchema = z.object({ id: z.string().max(256) });
+const scimServiceProviderConfigSchema = z.object({
+    schemas: z.array(z.string()),
+    patch: z.object({ supported: z.boolean() }),
+    bulk: z.object({ supported: z.boolean(), maxOperations: z.number(), maxPayloadSize: z.number() }),
+    filter: z.object({ supported: z.boolean(), maxResults: z.number() }),
+    changePassword: z.object({ supported: z.boolean() }),
+    sort: z.object({ supported: z.boolean() }),
+    etag: z.object({ supported: z.boolean() }),
+});
+const scimResourceTypesSchema = z.object({
+    schemas: z.array(z.string()),
+    totalResults: z.number(),
+    Resources: z.array(z.object({
+        schemas: z.array(z.string()),
+        id: z.string(),
+        name: z.string(),
+        endpoint: z.string(),
+        schema: z.string(),
+    })),
+});
+function scimErrorBody(status, detail) {
+    return {
+        schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'],
+        status: String(status),
+        detail,
+    };
+}
+// Shared error response declarations used across all SCIM routes.
+const scimCommonErrors = {
+    400: {
+        content: { 'application/json': { schema: scimErrorSchema } },
+        description: 'Invalid request parameters.',
+    },
+    401: {
+        content: { 'application/json': { schema: scimErrorSchema } },
+        description: 'Unauthorized.',
+    },
+    429: {
+        content: { 'application/json': { schema: scimErrorSchema } },
+        description: 'Rate limit exceeded.',
+    },
+    503: {
+        content: { 'application/json': { schema: scimErrorSchema } },
+        description: 'SCIM not configured.',
+    },
+};
+const scimWriteErrors = {
+    ...scimCommonErrors,
+    501: {
+        content: { 'application/json': { schema: scimErrorSchema } },
+        description: 'Adapter method not supported.',
+    },
+};
+// ─── Route Definitions ───────────────────────────────────────────────────────
+const listUsersRoute = createRoute({
+    method: 'get',
+    path: '/scim/v2/Users',
+    summary: 'List/search SCIM users',
+    tags,
+    request: { query: scimListQuerySchema },
+    responses: {
+        200: {
+            content: { 'application/json': { schema: scimListResponseSchema } },
+            description: 'SCIM user list.',
+        },
+        ...scimCommonErrors,
+        501: {
+            content: { 'application/json': { schema: scimErrorSchema } },
+            description: 'Adapter method not supported.',
+        },
+    },
+});
+const getUserRoute = createRoute({
+    method: 'get',
+    path: '/scim/v2/Users/{id}',
+    summary: 'Get a SCIM user by ID',
+    tags,
+    request: { params: scimUserIdParamSchema },
+    responses: {
+        200: {
+            content: { 'application/json': { schema: scimUserResponseSchema } },
+            description: 'SCIM user.',
+        },
+        404: {
+            content: { 'application/json': { schema: scimErrorSchema } },
+            description: 'User not found.',
+        },
+        ...scimCommonErrors,
+        501: {
+            content: { 'application/json': { schema: scimErrorSchema } },
+            description: 'Adapter method not supported.',
+        },
+    },
+});
+const createUserRoute = createRoute({
+    method: 'post',
+    path: '/scim/v2/Users',
+    summary: 'Create/provision a SCIM user',
+    tags,
+    request: {
+        body: { content: { 'application/json': { schema: scimUserCreateSchema } } },
+    },
+    responses: {
+        201: {
+            content: { 'application/json': { schema: scimUserResponseSchema } },
+            description: 'User created.',
+        },
+        409: {
+            content: { 'application/json': { schema: scimErrorSchema } },
+            description: 'User already exists.',
+        },
+        ...scimWriteErrors,
+    },
+});
+const replaceUserRoute = createRoute({
+    method: 'put',
+    path: '/scim/v2/Users/{id}',
+    summary: 'Replace a SCIM user',
+    tags,
+    request: {
+        params: scimUserIdParamSchema,
+        body: { content: { 'application/json': { schema: scimUserReplaceSchema } } },
+    },
+    responses: {
+        200: {
+            content: { 'application/json': { schema: scimUserResponseSchema } },
+            description: 'User replaced.',
+        },
+        404: {
+            content: { 'application/json': { schema: scimErrorSchema } },
+            description: 'User not found.',
+        },
+        ...scimCommonErrors,
+    },
+});
+const patchUserRoute = createRoute({
+    method: 'patch',
+    path: '/scim/v2/Users/{id}',
+    summary: 'Partially update a SCIM user (PatchOp)',
+    tags,
+    request: {
+        params: scimUserIdParamSchema,
+        body: { content: { 'application/json': { schema: scimPatchSchema } } },
+    },
+    responses: {
+        200: {
+            content: { 'application/json': { schema: scimUserResponseSchema } },
+            description: 'User updated.',
+        },
+        404: {
+            content: { 'application/json': { schema: scimErrorSchema } },
+            description: 'User not found.',
+        },
+        ...scimCommonErrors,
+    },
+});
+const deleteUserRoute = createRoute({
+    method: 'delete',
+    path: '/scim/v2/Users/{id}',
+    summary: 'Deprovision a SCIM user',
+    tags,
+    request: { params: scimUserIdParamSchema },
+    responses: {
+        204: { description: 'User deprovisioned.' },
+        404: {
+            content: { 'application/json': { schema: scimErrorSchema } },
+            description: 'User not found.',
+        },
+        ...scimCommonErrors,
+    },
+});
+const serviceProviderConfigRoute = createRoute({
+    method: 'get',
+    path: '/scim/v2/ServiceProviderConfig',
+    summary: 'SCIM service provider capabilities',
+    tags,
+    responses: {
+        200: {
+            content: { 'application/json': { schema: scimServiceProviderConfigSchema } },
+            description: 'SCIM service provider configuration.',
+        },
+        401: {
+            content: { 'application/json': { schema: scimErrorSchema } },
+            description: 'Unauthorized.',
+        },
+    },
+});
+const resourceTypesRoute = createRoute({
+    method: 'get',
+    path: '/scim/v2/ResourceTypes',
+    summary: 'SCIM resource type discovery',
+    tags,
+    responses: {
+        200: {
+            content: { 'application/json': { schema: scimResourceTypesSchema } },
+            description: 'SCIM resource types.',
+        },
+        401: {
+            content: { 'application/json': { schema: scimErrorSchema } },
+            description: 'Unauthorized.',
+        },
+    },
+});
+// ─── Router ──────────────────────────────────────────────────────────────────
+export function createScimRouter(runtime) {
+    const { adapter } = runtime;
+    const getConfig = () => runtime.config;
+    const router = createRouter();
+    // All SCIM routes require SCIM bearer auth
+    router.use('/scim/v2/*', createScimAuth(runtime));
+    // GET /scim/v2/Users — list/search users
+    router.openapi(listUsersRoute, async (c) => {
+        const ip = getClientIp(c);
+        if (await runtime.rateLimit.trackAttempt(`scim-read:${ip}`, scimReadOpts)) {
+            return c.json(scimErrorBody(429, 'Too many requests'), 429);
+        }
+        const config = getConfig().scim;
+        if (!config)
+            return c.json(scimErrorBody(503, 'SCIM not configured'), 503);
+        if (!adapter.listUsers)
+            return c.json(scimErrorBody(501, 'Auth adapter does not support listUsers'), 501);
+        const { filter, startIndex, count } = c.req.valid('query');
+        const query = parseScimFilter(filter);
+        query.startIndex = Math.max(0, startIndex - 1); // SCIM is 1-based
+        query.count = Math.min(count, 200);
+        const { users, totalResults } = await adapter.listUsers(query);
+        const response = {
+            schemas: ['urn:ietf:params:scim:api:messages:2.0:ListResponse'],
+            totalResults,
+            startIndex,
+            itemsPerPage: users.length,
+            Resources: users.map(u => userRecordToScim(u, config.userMapping)),
+        };
+        return c.json(response, 200);
+    }, (result, c) => {
+        if (!result.success) {
+            const detail = result.error.issues.map(i => `${i.path.join('.')}: ${i.message}`).join('; ');
+            return c.json(scimErrorBody(400, detail), 400);
+        }
+    });
+    // GET /scim/v2/Users/:id — get a user
+    router.openapi(getUserRoute, async (c) => {
+        const ip = getClientIp(c);
+        if (await runtime.rateLimit.trackAttempt(`scim-read:${ip}`, scimReadOpts)) {
+            return c.json(scimErrorBody(429, 'Too many requests'), 429);
+        }
+        const config = getConfig().scim;
+        if (!config)
+            return c.json(scimErrorBody(503, 'SCIM not configured'), 503);
+        if (!adapter.getUser)
+            return c.json(scimErrorBody(501, 'Auth adapter does not support getUser'), 501);
+        const { id } = c.req.valid('param');
+        const user = await adapter.getUser(id);
+        if (!user)
+            return c.json(scimErrorBody(404, 'User not found'), 404);
+        const scimUser = userRecordToScim({
+            id,
+            email: user.email,
+            displayName: user.displayName,
+            firstName: user.firstName,
+            lastName: user.lastName,
+            externalId: user.externalId,
+            suspended: user.suspended ?? false,
+            suspendedReason: user.suspendedReason,
+        }, config.userMapping);
+        return c.json(scimUser, 200);
+    }, (result, c) => {
+        if (!result.success) {
+            const detail = result.error.issues.map(i => `${i.path.join('.')}: ${i.message}`).join('; ');
+            return c.json(scimErrorBody(400, detail), 400);
+        }
+    });
+    // POST /scim/v2/Users — create a user (provision)
+    router.openapi(createUserRoute, async (c) => {
+        const ip = getClientIp(c);
+        if (await runtime.rateLimit.trackAttempt(`scim-write:${ip}`, scimWriteOpts)) {
+            return c.json(scimErrorBody(429, 'Too many requests'), 429);
+        }
+        const config = getConfig().scim;
+        if (!config)
+            return c.json(scimErrorBody(503, 'SCIM not configured'), 503);
+        if (!adapter.create)
+            return c.json(scimErrorBody(501, 'Auth adapter does not support create'), 501);
+        const body = c.req.valid('json');
+        const email = body.userName ?? body.emails?.[0]?.value;
+        if (!email)
+            return c.json(scimErrorBody(400, 'userName is required'), 400);
+        const existingByEmail = await adapter.findByEmail?.(email);
+        if (existingByEmail)
+            return c.json(scimErrorBody(409, 'User already exists'), 409);
+        // Create user with a random placeholder password (SCIM users authenticate via SSO)
+        const placeholderHash = await Bun.password.hash(crypto.randomUUID());
+        const { id } = await adapter.create(email, placeholderHash);
+        // Set profile fields
+        if (adapter.updateProfile) {
+            const fields = {};
+            if (body.name?.givenName)
+                fields.firstName = body.name.givenName;
+            if (body.name?.familyName)
+                fields.lastName = body.name.familyName;
+            if (body.displayName)
+                fields.displayName = body.displayName;
+            if (body.externalId)
+                fields.externalId = body.externalId;
+            if (Object.keys(fields).length > 0)
+                await adapter.updateProfile(id, fields);
+        }
+        const scimUser = userRecordToScim({
+            id,
+            email,
+            displayName: body.displayName,
+            firstName: body.name?.givenName,
+            lastName: body.name?.familyName,
+            externalId: body.externalId,
+            suspended: body.active === false,
+        }, config.userMapping);
+        return c.json(scimUser, 201);
+    }, (result, c) => {
+        if (!result.success) {
+            const detail = result.error.issues.map(i => `${i.path.join('.')}: ${i.message}`).join('; ');
+            return c.json(scimErrorBody(400, detail), 400);
+        }
+    });
+    // PUT /scim/v2/Users/:id — replace a user
+    router.openapi(replaceUserRoute, async (c) => {
+        const ip = getClientIp(c);
+        if (await runtime.rateLimit.trackAttempt(`scim-write:${ip}`, scimWriteOpts)) {
+            return c.json(scimErrorBody(429, 'Too many requests'), 429);
+        }
+        const config = getConfig().scim;
+        if (!config)
+            return c.json(scimErrorBody(503, 'SCIM not configured'), 503);
+        const { id: userId } = c.req.valid('param');
+        const body = c.req.valid('json');
+        // Validate id in body matches path param if provided
+        if (body.id && body.id !== userId) {
+            return c.json(scimErrorBody(400, 'id in body does not match path parameter'), 400);
+        }
+        if (adapter.updateProfile) {
+            const fields = {};
+            if (body.name?.givenName !== undefined)
+                fields.firstName = body.name.givenName;
+            if (body.name?.familyName !== undefined)
+                fields.lastName = body.name.familyName;
+            if (body.displayName !== undefined)
+                fields.displayName = body.displayName;
+            if (body.externalId !== undefined)
+                fields.externalId = body.externalId;
+            if (Object.keys(fields).length > 0)
+                await adapter.updateProfile(userId, fields);
+        }
+        if (adapter.setSuspended && body.active !== undefined) {
+            await adapter.setSuspended(userId, !body.active);
+        }
+        const user = await adapter.getUser?.(userId);
+        if (!user)
+            return c.json(scimErrorBody(404, 'User not found'), 404);
+        return c.json(userRecordToScim({
+            id: userId,
+            email: user.email,
+            displayName: user.displayName,
+            firstName: user.firstName,
+            lastName: user.lastName,
+            externalId: user.externalId,
+            suspended: user.suspended ?? false,
+        }, config.userMapping), 200);
+    }, (result, c) => {
+        if (!result.success) {
+            const detail = result.error.issues.map(i => `${i.path.join('.')}: ${i.message}`).join('; ');
+            return c.json(scimErrorBody(400, detail), 400);
+        }
+    });
+    // PATCH /scim/v2/Users/:id — partial update
+    router.openapi(patchUserRoute, async (c) => {
+        const ip = getClientIp(c);
+        if (await runtime.rateLimit.trackAttempt(`scim-write:${ip}`, scimWriteOpts)) {
+            return c.json(scimErrorBody(429, 'Too many requests'), 429);
+        }
+        const config = getConfig().scim;
+        if (!config)
+            return c.json(scimErrorBody(503, 'SCIM not configured'), 503);
+        const { id: userId } = c.req.valid('param');
+        const body = c.req.valid('json');
+        const operations = body.Operations ?? [];
+        for (const op of operations) {
+            const opType = op.op?.toLowerCase();
+            if (opType === 'replace' || opType === 'add') {
+                const value = op.value;
+                if (op.path === 'active' && adapter.setSuspended) {
+                    await adapter.setSuspended(userId, !value);
+                }
+                else if (!op.path &&
+                    typeof value === 'object' &&
+                    value !== null &&
+                    adapter.updateProfile) {
+                    // Bulk replace — map SCIM fields to profile fields
+                    const v = value;
+                    const fields = {};
+                    if (typeof v.displayName === 'string')
+                        fields.displayName = v.displayName;
+                    if (typeof v['name.givenName'] === 'string')
+                        fields.firstName = v['name.givenName'];
+                    if (typeof v['name.familyName'] === 'string')
+                        fields.lastName = v['name.familyName'];
+                    if (typeof v.externalId === 'string')
+                        fields.externalId = v.externalId;
+                    if (v.active !== undefined && adapter.setSuspended) {
+                        await adapter.setSuspended(userId, !v.active);
+                    }
+                    if (Object.keys(fields).length > 0)
+                        await adapter.updateProfile(userId, fields);
+                }
+            }
+            else if (opType === 'remove' && op.path === 'active' && adapter.setSuspended) {
+                await adapter.setSuspended(userId, true);
+            }
+        }
+        const user = await adapter.getUser?.(userId);
+        if (!user)
+            return c.json(scimErrorBody(404, 'User not found'), 404);
+        return c.json(userRecordToScim({
+            id: userId,
+            email: user.email,
+            displayName: user.displayName,
+            firstName: user.firstName,
+            lastName: user.lastName,
+            externalId: user.externalId,
+            suspended: user.suspended ?? false,
+        }, config.userMapping), 200);
+    }, (result, c) => {
+        if (!result.success) {
+            const detail = result.error.issues.map(i => `${i.path.join('.')}: ${i.message}`).join('; ');
+            return c.json(scimErrorBody(400, detail), 400);
+        }
+    });
+    // DELETE /scim/v2/Users/:id — deprovision
+    router.openapi(deleteUserRoute, async (c) => {
+        const ip = getClientIp(c);
+        if (await runtime.rateLimit.trackAttempt(`scim-write:${ip}`, scimWriteOpts)) {
+            return c.json(scimErrorBody(429, 'Too many requests'), 429);
+        }
+        const config = getConfig().scim;
+        if (!config)
+            return c.json(scimErrorBody(503, 'SCIM not configured'), 503);
+        const { id: userId } = c.req.valid('param');
+        // Check user exists before deprovisioning (RFC 7644 section 3.6 requires 404 for unknown resources).
+        // The startup validator ensures getUser is present when SCIM is enabled.
+        const user = await adapter.getUser(userId);
+        if (!user)
+            return c.json(scimErrorBody(404, 'User not found'), 404);
+        const onDeprovision = config.onDeprovision ?? 'suspend';
+        if (typeof onDeprovision === 'function') {
+            await onDeprovision(userId);
+        }
+        else if (onDeprovision === 'delete') {
+            {
+                const sr = runtime.repos.session;
+                const ss = await sr.getUserSessions(userId, runtime.config);
+                await Promise.all(ss.map(s => sr.deleteSession(s.sessionId, runtime.config)));
+            }
+            if (adapter.deleteUser)
+                await adapter.deleteUser(userId);
+        }
+        else {
+            // Default: suspend
+            if (adapter.setSuspended)
+                await adapter.setSuspended(userId, true, 'SCIM deprovisioned');
+        }
+        return c.body(null, 204);
+    }, (result, c) => {
+        if (!result.success) {
+            const detail = result.error.issues.map(i => `${i.path.join('.')}: ${i.message}`).join('; ');
+            return c.json(scimErrorBody(400, detail), 400);
+        }
+    });
+    // Discovery endpoints
+    router.openapi(serviceProviderConfigRoute, c => {
+        return c.json({
+            schemas: ['urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig'],
+            patch: { supported: true },
+            bulk: { supported: false, maxOperations: 0, maxPayloadSize: 0 },
+            filter: { supported: true, maxResults: 200 },
+            changePassword: { supported: false },
+            sort: { supported: false },
+            etag: { supported: false },
+        }, 200);
+    });
+    router.openapi(resourceTypesRoute, c => {
+        return c.json({
+            schemas: ['urn:ietf:params:scim:api:messages:2.0:ListResponse'],
+            totalResults: 1,
+            Resources: [
+                {
+                    schemas: ['urn:ietf:params:scim:schemas:core:2.0:ResourceType'],
+                    id: 'User',
+                    name: 'User',
+                    endpoint: '/scim/v2/Users',
+                    schema: 'urn:ietf:params:scim:schemas:core:2.0:User',
+                },
+            ],
+        }, 200);
+    });
+    return router;
+}

package/dist/packages/bunshot-auth/src/runtime.d.ts

@@ -0,0 +1,52 @@
+import type { BunshotContext, BunshotEventBus, DataEncryptionKey, SigningConfig } from '../../bunshot-core/src/index.js';
+import type { AuthResolvedConfig } from './config/authConfig';
+import type { AuthQueueFactory } from './infra/queue';
+import type { LockoutService } from './lib/accountLockout';
+import type { AuthAdapter } from './lib/authAdapter';
+import type { AuthRateLimitService } from './lib/authRateLimit';
+import type { CredentialStuffingService } from './lib/credentialStuffing';
+import type { IDeletionCancelTokenRepository } from './lib/deletionCancelToken';
+import type { IVerificationTokenRepository } from './lib/emailVerification';
+import type { IMagicLinkRepository } from './lib/magicLink';
+import type { IMfaChallengeRepository } from './lib/mfaChallenge';
+import type { OAuthProviders, OAuthStateStore } from './lib/oauth';
+import type { IOAuthCodeRepository } from './lib/oauthCode';
+import type { IOAuthReauthRepository } from './lib/oauthReauth';
+import type { OrgService } from './lib/organization';
+import type { IResetTokenRepository } from './lib/resetPassword';
+import type { ISamlRequestIdRepository } from './lib/samlRequestId';
+import type { ISessionRepository } from './lib/session';
+import type { ResolvedStores } from './types/adapter';
+export interface AuthRuntimeContext {
+    readonly adapter: AuthAdapter;
+    readonly eventBus: BunshotEventBus;
+    readonly config: AuthResolvedConfig;
+    readonly stores: Readonly<ResolvedStores>;
+    readonly signing: SigningConfig | null;
+    readonly dataEncryptionKeys: readonly DataEncryptionKey[];
+    readonly oauth: {
+        readonly providers: OAuthProviders;
+        readonly stateStore: OAuthStateStore;
+    };
+    readonly lockout: LockoutService | null;
+    readonly rateLimit: AuthRateLimitService;
+    readonly credentialStuffing: CredentialStuffingService | null;
+    readonly orgService: OrgService | null;
+    readonly queueFactory: AuthQueueFactory | null;
+    readonly repos: {
+        readonly oauthCode: IOAuthCodeRepository;
+        readonly oauthReauth: IOAuthReauthRepository;
+        readonly magicLink: IMagicLinkRepository;
+        readonly deletionCancelToken: IDeletionCancelTokenRepository;
+        readonly mfaChallenge: IMfaChallengeRepository;
+        readonly samlRequestId: ISamlRequestIdRepository | null;
+        readonly verificationToken: IVerificationTokenRepository;
+        readonly resetToken: IResetTokenRepository;
+        readonly session: ISessionRepository;
+    };
+}
+export declare const AUTH_RUNTIME_KEY = "bunshot-auth";
+export declare function getAuthRuntimeContext(ctx: BunshotContext | null | undefined): AuthRuntimeContext;
+export declare function getAuthRuntimeFromRequest(c: {
+    get(key: string): unknown;
+}): AuthRuntimeContext;

package/dist/packages/bunshot-auth/src/runtime.js

@@ -0,0 +1,11 @@
+export const AUTH_RUNTIME_KEY = 'bunshot-auth';
+export function getAuthRuntimeContext(ctx) {
+    const runtime = ctx?.pluginState.get(AUTH_RUNTIME_KEY);
+    if (!runtime?.adapter) {
+        throw new Error('[bunshot-auth] auth runtime context is not available on BunshotContext');
+    }
+    return runtime;
+}
+export function getAuthRuntimeFromRequest(c) {
+    return getAuthRuntimeContext(c.get('bunshotCtx'));
+}

package/dist/{schemas → packages/bunshot-auth/src/schemas}/auth.d.ts

@@ -1,6 +1,6 @@
-import { z } from "zod";
-import type { PrimaryField } from "../lib/appConfig";
-export declare const makeRegisterSchema: (primaryField: PrimaryField) => z.ZodObject<{
+import { z } from 'zod';
+import type { PasswordPolicyConfig, PrimaryField } from '../config/authConfig';
+export declare const makeRegisterSchema: (primaryField: PrimaryField, policy: PasswordPolicyConfig) => z.ZodObject<{
     [x: string]: z.ZodString;
     password: z.ZodString;
 }, z.core.$strip>;
@@ -8,5 +8,4 @@ export declare const makeLoginSchema: (primaryField: PrimaryField) => z.ZodObjec
     [x: string]: z.ZodString;
     password: z.ZodString;
 }, z.core.$strip>;
-/** Password schema for reset-password — same policy as registration. */
-export declare const resetPasswordSchema: () => z.ZodString;
+export declare const resetPasswordSchema: (policy: PasswordPolicyConfig) => z.ZodString;