@lastshotlabs/bunshot 0.0.27 → 0.0.28

package/dist/packages/bunshot-core/src/eventBus.d.ts

@@ -0,0 +1,270 @@
+export interface BunshotEventMap {
+    'app:ready': {
+        plugins: string[];
+    };
+    'app:shutdown': {
+        signal: 'SIGTERM' | 'SIGINT';
+    };
+    'security.auth.login.success': {
+        userId: string;
+        sessionId?: string;
+        ip?: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.login.failure': {
+        identifier?: string;
+        reason?: string;
+        ip?: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.login.blocked': {
+        identifier?: string;
+        userId?: string;
+        reason?: 'lockout' | 'stuffing' | 'suspended';
+        ip?: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.register.success': {
+        userId: string;
+        email?: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.register.failure': {
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.register.concealed': {
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.logout': {
+        sessionId?: string;
+        userId?: string;
+    };
+    'security.auth.account.locked': {
+        userId: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.account.suspended': {
+        userId: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.account.unsuspended': {
+        userId: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.account.deleted': {
+        userId: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.session.created': {
+        userId: string;
+        sessionId: string;
+    };
+    'security.auth.session.revoked': {
+        userId: string;
+        sessionId: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.password.reset': {
+        userId?: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.password.change': {
+        userId: string;
+    };
+    'security.auth.mfa.setup': {
+        userId?: string;
+    };
+    'security.auth.mfa.verify.success': {
+        userId?: string;
+    };
+    'security.auth.mfa.verify.failure': {
+        userId?: string;
+        method?: string;
+        ip?: string;
+    };
+    'security.auth.step_up.success': {
+        userId: string;
+    };
+    'security.auth.step_up.failure': {
+        userId: string;
+    };
+    'security.auth.oauth.linked': {
+        userId?: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.oauth.unlinked': {
+        userId?: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.auth.oauth.reauthed': {
+        userId?: string;
+        sessionId?: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.rate_limit.exceeded': {
+        key?: string;
+        ip?: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.credential_stuffing.detected': {
+        type?: 'ip' | 'account';
+        key?: string;
+        count?: number;
+        ip?: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.csrf.failed': {
+        ip?: string;
+        path?: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.breached_password.detected': {
+        meta?: Record<string, unknown>;
+    };
+    'security.breached_password.api_failure': {
+        meta?: Record<string, unknown>;
+    };
+    'security.admin.role.changed': {
+        userId?: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.admin.user.modified': {
+        userId?: string;
+        meta?: Record<string, unknown>;
+    };
+    'security.admin.user.deleted': {
+        userId?: string;
+        meta?: Record<string, unknown>;
+    };
+    'auth:user.created': {
+        userId: string;
+        email?: string;
+        tenantId?: string | null;
+    };
+    'auth:user.deleted': {
+        userId: string;
+        tenantId?: string;
+    };
+    'auth:login': {
+        userId: string;
+        sessionId: string;
+        tenantId?: string;
+    };
+    'auth:logout': {
+        userId: string;
+        sessionId: string;
+    };
+    'auth:email.verified': {
+        userId: string;
+        email: string;
+    };
+    'auth:password.reset.requested': {
+        userId: string;
+        email: string;
+    };
+    'auth:account.deletion.scheduled': {
+        userId: string;
+        cancelToken: string;
+        gracePeriodSeconds: number;
+    };
+    'auth:mfa.enabled': {
+        userId: string;
+        method: 'totp' | 'email-otp' | 'webauthn';
+    };
+    'auth:mfa.disabled': {
+        userId: string;
+        method?: 'totp' | 'email-otp' | 'webauthn';
+    };
+    'auth:delivery.email_verification': {
+        email: string;
+        token: string;
+        userId: string;
+    };
+    'auth:delivery.password_reset': {
+        email: string;
+        token: string;
+    };
+    'auth:delivery.magic_link': {
+        identifier: string;
+        token: string;
+        link: string;
+    };
+    'auth:delivery.email_otp': {
+        email: string;
+        code: string;
+    };
+    'auth:delivery.account_deletion': {
+        userId: string;
+        email: string;
+        cancelToken: string;
+        gracePeriodSeconds: number;
+    };
+    'auth:delivery.welcome': {
+        email: string;
+        identifier: string;
+    };
+    'auth:delivery.org_invitation': {
+        email: string;
+        orgName: string;
+        invitationLink: string;
+        expiryDays: number;
+    };
+}
+export type SecurityEventKey = Extract<keyof BunshotEventMap, `security.${string}`>;
+export declare const SECURITY_EVENT_TYPES: ReadonlyArray<SecurityEventKey>;
+/**
+ * Built-in event keys safe to stream to browser clients via SSE.
+ * Frozen seed — copied into each event bus instance at creation.
+ * Instance-scoped mutable set lives on bus.clientSafeKeys.
+ *
+ * Core seeds an empty set. Plugin packages register their own client-safe
+ * keys at startup via bus.registerClientSafeEvents([...]).
+ *
+ * Never stream (forbidden namespaces enforced by registerClientSafeEvents):
+ * - `security.*`   — internal audit trail
+ * - `auth:*`       — sessionId, email, tokens
+ * - `push:*`       — delivery metadata
+ * - `app:*`        — server lifecycle signals
+ */
+export declare const BUILTIN_CLIENT_SAFE_KEYS: ReadonlySet<string>;
+export type ClientSafeEventKey = string;
+export declare const FORBIDDEN_CLIENT_PREFIXES: readonly ["security.", "auth:", "community:delivery.", "push:", "app:"];
+export interface SubscriptionOpts {
+    durable?: boolean;
+    /** REQUIRED when durable: true — runtime error thrown if missing */
+    name?: string;
+}
+export interface BunshotEventBus {
+    emit<K extends keyof BunshotEventMap>(event: K, payload: BunshotEventMap[K]): void;
+    on<K extends keyof BunshotEventMap>(event: K, listener: (payload: BunshotEventMap[K]) => void | Promise<void>, opts?: SubscriptionOpts): void;
+    off<K extends keyof BunshotEventMap>(event: K, listener: (payload: BunshotEventMap[K]) => void): void;
+    shutdown?(): Promise<void>;
+    /** Instance-scoped set of event keys safe to stream to browser clients via SSE. */
+    readonly clientSafeKeys: ReadonlySet<string>;
+    /**
+     * Register additional event keys as client-safe for SSE streaming.
+     * Keys with forbidden prefixes (security.*, auth:*, community:delivery.*, app:*) are rejected.
+     */
+    registerClientSafeEvents(keys: string[]): void;
+    /**
+     * Validate that a key is registered as client-safe.
+     * Throws on forbidden namespaces or unregistered keys.
+     */
+    ensureClientSafeEventKey(key: string, source?: string): ClientSafeEventKey;
+}
+export declare class InProcessAdapter implements BunshotEventBus {
+    private listeners;
+    private _clientSafeKeys;
+    private pendingHandlers;
+    constructor(initialClientSafeKeys?: Iterable<string>);
+    get clientSafeKeys(): ReadonlySet<string>;
+    registerClientSafeEvents(keys: string[]): void;
+    ensureClientSafeEventKey(key: string, source?: string): ClientSafeEventKey;
+    emit<K extends keyof BunshotEventMap>(event: K, payload: BunshotEventMap[K]): void;
+    /** Wait for all in-flight async event handlers to settle. Useful in tests. */
+    drain(): Promise<void>;
+    on<K extends keyof BunshotEventMap>(event: K, listener: (payload: BunshotEventMap[K]) => void | Promise<void>, opts?: SubscriptionOpts): void;
+    off<K extends keyof BunshotEventMap>(event: K, listener: (payload: BunshotEventMap[K]) => void): void;
+    shutdown(): Promise<void>;
+}
+export declare function createInProcessAdapter(initialClientSafeKeys?: Iterable<string>): BunshotEventBus;

package/dist/packages/bunshot-core/src/eventBus.js

@@ -0,0 +1,143 @@
+export const SECURITY_EVENT_TYPES = [
+    'security.auth.login.success',
+    'security.auth.login.failure',
+    'security.auth.login.blocked',
+    'security.auth.register.success',
+    'security.auth.register.failure',
+    'security.auth.register.concealed',
+    'security.auth.logout',
+    'security.auth.account.locked',
+    'security.auth.account.suspended',
+    'security.auth.account.unsuspended',
+    'security.auth.account.deleted',
+    'security.auth.session.created',
+    'security.auth.session.revoked',
+    'security.auth.password.reset',
+    'security.auth.password.change',
+    'security.auth.mfa.setup',
+    'security.auth.mfa.verify.success',
+    'security.auth.mfa.verify.failure',
+    'security.auth.step_up.success',
+    'security.auth.step_up.failure',
+    'security.auth.oauth.linked',
+    'security.auth.oauth.unlinked',
+    'security.auth.oauth.reauthed',
+    'security.rate_limit.exceeded',
+    'security.credential_stuffing.detected',
+    'security.csrf.failed',
+    'security.breached_password.detected',
+    'security.breached_password.api_failure',
+    'security.admin.role.changed',
+    'security.admin.user.modified',
+    'security.admin.user.deleted',
+];
+/**
+ * Built-in event keys safe to stream to browser clients via SSE.
+ * Frozen seed — copied into each event bus instance at creation.
+ * Instance-scoped mutable set lives on bus.clientSafeKeys.
+ *
+ * Core seeds an empty set. Plugin packages register their own client-safe
+ * keys at startup via bus.registerClientSafeEvents([...]).
+ *
+ * Never stream (forbidden namespaces enforced by registerClientSafeEvents):
+ * - `security.*`   — internal audit trail
+ * - `auth:*`       — sessionId, email, tokens
+ * - `push:*`       — delivery metadata
+ * - `app:*`        — server lifecycle signals
+ */
+export const BUILTIN_CLIENT_SAFE_KEYS = Object.freeze(new Set());
+export const FORBIDDEN_CLIENT_PREFIXES = [
+    'security.',
+    'auth:',
+    'community:delivery.',
+    'push:',
+    'app:',
+];
+function getForbiddenClientSafePrefix(key) {
+    return FORBIDDEN_CLIENT_PREFIXES.find(prefix => key.startsWith(prefix));
+}
+function getClientSafeRegistrationError(key) {
+    const prefix = getForbiddenClientSafePrefix(key);
+    if (!prefix)
+        return null;
+    return `Cannot register "${key}" as client-safe: "${prefix}" namespace is forbidden`;
+}
+export class InProcessAdapter {
+    listeners = new Map();
+    _clientSafeKeys;
+    pendingHandlers = new Set();
+    constructor(initialClientSafeKeys) {
+        this._clientSafeKeys = new Set(initialClientSafeKeys ?? BUILTIN_CLIENT_SAFE_KEYS);
+    }
+    get clientSafeKeys() {
+        return this._clientSafeKeys;
+    }
+    registerClientSafeEvents(keys) {
+        for (const key of keys) {
+            const error = getClientSafeRegistrationError(key);
+            if (error)
+                throw new Error(error);
+            this._clientSafeKeys.add(key);
+        }
+    }
+    ensureClientSafeEventKey(key, source = 'SSE config') {
+        const forbiddenPrefix = getForbiddenClientSafePrefix(key);
+        if (forbiddenPrefix) {
+            throw new Error(`[bunshot] ${source}: "${key}" cannot be streamed to clients because the "${forbiddenPrefix}" namespace is forbidden`);
+        }
+        if (!this._clientSafeKeys.has(key)) {
+            throw new Error(`[bunshot] ${source}: "${key}" is not registered as client-safe. Call bus.registerClientSafeEvents([...]) before createServer().`);
+        }
+        return key;
+    }
+    emit(event, payload) {
+        const fns = this.listeners.get(event);
+        if (!fns)
+            return;
+        for (const fn of Array.from(fns)) {
+            let result;
+            try {
+                result = fn(payload);
+            }
+            catch (err) {
+                console.error(`[BunshotEventBus] listener error on event "${String(event)}":`, err);
+                continue;
+            }
+            const p = Promise.resolve(result);
+            this.pendingHandlers.add(p);
+            p.catch((err) => {
+                console.error(`[BunshotEventBus] listener error on event "${String(event)}":`, err);
+            }).finally(() => {
+                this.pendingHandlers.delete(p);
+            });
+        }
+    }
+    /** Wait for all in-flight async event handlers to settle. Useful in tests. */
+    async drain() {
+        await Promise.allSettled([...this.pendingHandlers]);
+    }
+    on(event, listener, opts) {
+        if (opts?.durable === true) {
+            if (!opts?.name) {
+                throw new Error('BunshotEventBus: durable subscriptions require a name. Pass opts.name.');
+            }
+            // InProcessAdapter does not support durable subscriptions — degrade gracefully
+            console.warn('[BunshotEventBus] InProcessAdapter does not support durable subscriptions — listener registered as non-durable.');
+        }
+        const key = event; // K extends string — safe cast
+        if (!this.listeners.has(key))
+            this.listeners.set(key, new Set());
+        this.listeners.get(key).add(listener);
+    }
+    off(event, listener) {
+        this.listeners
+            .get(event)
+            ?.delete(listener);
+    }
+    async shutdown() {
+        this.listeners.clear();
+    }
+}
+export function createInProcessAdapter(initialClientSafeKeys) {
+    return new InProcessAdapter(initialClientSafeKeys);
+}

package/dist/packages/bunshot-core/src/idempotency.d.ts

@@ -0,0 +1,18 @@
+/**
+ * IdempotencyAdapter — storage contract for idempotency key caching.
+ *
+ * Implementations store request responses keyed by idempotency key,
+ * with TTL-based expiration.
+ */
+export interface IdempotencyAdapter {
+    /** Get a cached idempotency record by key. Returns null if not found or expired. */
+    get(key: string): Promise<{
+        response: string;
+        status: number;
+        createdAt: number;
+    } | null>;
+    /** Store an idempotency record. Implementations should respect TTL for automatic expiration. */
+    set(key: string, response: string, status: number, ttlSeconds: number): Promise<void>;
+    /** Optional reset hook used by ctx.clear() for test isolation. */
+    clear?(): Promise<void>;
+}

package/dist/packages/bunshot-core/src/idempotency.js

@@ -0,0 +1 @@
+export {};

package/dist/packages/bunshot-core/src/index.d.ts

@@ -0,0 +1,60 @@
+export type { BunshotPlugin, StandalonePlugin } from './plugin';
+export type { BunshotEventBus, BunshotEventMap, SecurityEventKey, SubscriptionOpts, ClientSafeEventKey, } from './eventBus';
+export { InProcessAdapter, createInProcessAdapter, SECURITY_EVENT_TYPES, BUILTIN_CLIENT_SAFE_KEYS, FORBIDDEN_CLIENT_PREFIXES, } from './eventBus';
+export { createRouterAdapter } from './routerAdapter';
+export type { RouterAdapterOptions } from './routerAdapter';
+export type { SseClientData, SseFilter, SseEndpointConfig } from './sse';
+export type { SubjectType, GrantEffect, SubjectRef, PermissionGrant, EvaluationScope, PermissionsAdapter, TestablePermissionsAdapter, ResourceTypeDefinition, PermissionRegistry, GroupResolver, PermissionEvaluator, } from './permissions';
+export { validateGrant, SUPER_ADMIN_ROLE } from './permissions';
+export type { RenderResult, MailRenderer } from './mail';
+export { TemplateNotFoundError } from './mail';
+export type { IdentityProfile, WebAuthnCredential, M2MClientRecord, UserQuery, UserRecord, GroupRecord, GroupMembershipRecord, PaginationOpts, PaginatedResult, CoreAuthAdapter, OAuthAdapter, MfaAdapter, WebAuthnAdapter, RolesAdapter, GroupsAdapter, SuspensionAdapter, EnterpriseAdapter, AuthAdapter, } from './auth-adapter';
+export { createRoute, withSecurity, registerSchema, registerSchemas, maybeAutoRegister, } from './createRoute';
+export { offsetParams, parseOffsetParams, paginatedResponse } from './pagination';
+export { cursorParams, parseCursorParams, cursorPaginatedResponse } from './pagination';
+export type { OffsetParamDefaults, ParsedOffsetParams } from './pagination';
+export type { CursorParamDefaults, ParsedCursorParams } from './pagination';
+export type { AuditLogEntry, AuditLogQuery, AuditLogProvider } from './auditLog';
+export type { CaptchaProvider, CaptchaConfig } from './captcha';
+export type { CsrfConfig } from './csrf';
+export { HttpError, ValidationError, UnsupportedAdapterFeatureError } from './errors';
+export { sha256, timingSafeEqual, hashToken, encryptField, decryptField, isEncryptedField, } from './crypto';
+export type { DataEncryptionKey } from './crypto';
+export { COOKIE_TOKEN, HEADER_USER_TOKEN, COOKIE_REFRESH_TOKEN, HEADER_REFRESH_TOKEN, COOKIE_CSRF_TOKEN, HEADER_CSRF_TOKEN, HEADER_REQUEST_ID, HEADER_IDEMPOTENCY_KEY, HEADER_SIGNATURE, HEADER_TIMESTAMP, } from './constants';
+export type { SigningConfig } from './signing';
+export type { RedisLike } from './redis';
+export { getClientIp, setStandaloneTrustProxy } from './clientIp';
+export type { AuthVariables } from './authVariables';
+export type { StorageAdapter, UploadResult } from './storageAdapter';
+export type { IdempotencyAdapter } from './idempotency';
+export type { UploadRecord, UploadRegistryRepository } from './uploadRegistry';
+export type { StoredMessage, WsMessageDefaults, RoomPersistenceConfig, WsMessageRepository, } from './wsMessages';
+export { createRouter, defaultHook, defaultValidationErrorFormatter, getBunshotCtx, } from './context';
+export type { AppEnv, AppVariables, ValidationErrorFormatter, DefaultValidationErrorBody, ValidationErrorDetail, } from './context';
+export { evictOldest, evictExpired, evictOldestArray, DEFAULT_MAX_ENTRIES } from './memoryEviction';
+export type { UserResolver } from './userResolver';
+export { getUserResolver, getUserResolverOrNull } from './userResolver';
+export type { RouteAuthRegistry } from './routeAuth';
+export { getRouteAuth, getRouteAuthOrNull } from './routeAuth';
+export type { RateLimitAdapter, FingerprintBuilder } from './rateLimit';
+export { getRateLimitAdapter, getFingerprintBuilder } from './rateLimit';
+export type { CacheAdapter, CacheStoreName } from './cache';
+export { getCacheAdapter, getCacheAdapterOrNull } from './cache';
+export type { EmailTemplate } from './emailTemplates';
+export { getEmailTemplates, getEmailTemplate } from './emailTemplates';
+export { createMemoryRateLimitAdapter } from './defaults/memoryRateLimit';
+export { createDefaultFingerprintBuilder } from './defaults/defaultFingerprint';
+export { createMemoryCacheAdapter } from './defaults/memoryCacheAdapter';
+export { warnUnknownPluginKeys, validatePluginConfig, disableRoutesSchema, } from './configValidation';
+export type { RouteKey } from './routeOverrides';
+export { routeKey, shouldMountRoute } from './routeOverrides';
+export type { BunshotContext, BunshotResolvedConfig, BunshotFrameworkConfig, ResolvedStores, WsState, WsTransportHandle, UploadRuntimeState, ResolvedPersistence, } from './context/index';
+export { attachContext, getContext, getContextOrNull, resolveContext } from './context/index';
+export type { CoreRegistrar, CoreRegistrarSnapshot } from './coreRegistrar';
+export { createCoreRegistrar } from './coreRegistrar';
+export type { ISecretRepository, SecretStoreType, SecretDefinition, SecretSchema, ResolvedSecrets, } from './secrets';
+export type { StoreType } from './storeType';
+export type { ICronRegistryRepository } from './cronRegistry';
+export type { StoreInfra, RepoFactories, PostgresBundle } from './storeInfra';
+export { resolveRepo, resolveRepoAsync } from './storeInfra';
+export type { AdminPrincipal, AdminAccessProvider, ManagedUserRecord, ListUsersInput, ListUsersResult, SuspendUserInput, UnsuspendUserInput, UpdateUserInput, SessionRecord, ManagedUserCapabilities, ManagedUserProvider, } from './adminProvider';

package/dist/packages/bunshot-core/src/index.js

@@ -0,0 +1,34 @@
+export { InProcessAdapter, createInProcessAdapter, SECURITY_EVENT_TYPES, BUILTIN_CLIENT_SAFE_KEYS, FORBIDDEN_CLIENT_PREFIXES, } from './eventBus';
+export { createRouterAdapter } from './routerAdapter';
+export { validateGrant, SUPER_ADMIN_ROLE } from './permissions';
+export { TemplateNotFoundError } from './mail';
+export { createRoute, withSecurity, registerSchema, registerSchemas, maybeAutoRegister, } from './createRoute';
+export { offsetParams, parseOffsetParams, paginatedResponse } from './pagination';
+export { cursorParams, parseCursorParams, cursorPaginatedResponse } from './pagination';
+// --- errors ---
+export { HttpError, ValidationError, UnsupportedAdapterFeatureError } from './errors';
+// --- crypto ---
+export { sha256, timingSafeEqual, hashToken, encryptField, decryptField, isEncryptedField, } from './crypto';
+// --- constants ---
+export { COOKIE_TOKEN, HEADER_USER_TOKEN, COOKIE_REFRESH_TOKEN, HEADER_REFRESH_TOKEN, COOKIE_CSRF_TOKEN, HEADER_CSRF_TOKEN, HEADER_REQUEST_ID, HEADER_IDEMPOTENCY_KEY, HEADER_SIGNATURE, HEADER_TIMESTAMP, } from './constants';
+// --- clientIp ---
+export { getClientIp, setStandaloneTrustProxy } from './clientIp';
+// --- context (AppEnv, createRouter, validation) ---
+export { createRouter, defaultHook, defaultValidationErrorFormatter, getBunshotCtx, } from './context';
+// --- memoryEviction ---
+export { evictOldest, evictExpired, evictOldestArray, DEFAULT_MAX_ENTRIES } from './memoryEviction';
+export { getUserResolver, getUserResolverOrNull } from './userResolver';
+export { getRouteAuth, getRouteAuthOrNull } from './routeAuth';
+export { getRateLimitAdapter, getFingerprintBuilder } from './rateLimit';
+export { getCacheAdapter, getCacheAdapterOrNull } from './cache';
+export { getEmailTemplates, getEmailTemplate } from './emailTemplates';
+// --- Auth boundary defaults ---
+export { createMemoryRateLimitAdapter } from './defaults/memoryRateLimit';
+export { createDefaultFingerprintBuilder } from './defaults/defaultFingerprint';
+export { createMemoryCacheAdapter } from './defaults/memoryCacheAdapter';
+// --- configValidation ---
+export { warnUnknownPluginKeys, validatePluginConfig, disableRoutesSchema, } from './configValidation';
+export { routeKey, shouldMountRoute } from './routeOverrides';
+export { attachContext, getContext, getContextOrNull, resolveContext } from './context/index';
+export { createCoreRegistrar } from './coreRegistrar';
+export { resolveRepo, resolveRepoAsync } from './storeInfra';

package/dist/packages/bunshot-core/src/mail.d.ts

@@ -0,0 +1,14 @@
+export interface RenderResult {
+    subject?: string;
+    html: string;
+    text?: string;
+}
+export declare class TemplateNotFoundError extends Error {
+    readonly templateName: string;
+    constructor(templateName: string);
+}
+export interface MailRenderer {
+    name: string;
+    render(template: string, data: Record<string, unknown>): Promise<RenderResult>;
+    listTemplates?(): Promise<string[]>;
+}

package/dist/packages/bunshot-core/src/mail.js

@@ -0,0 +1,8 @@
+export class TemplateNotFoundError extends Error {
+    templateName;
+    constructor(templateName) {
+        super(`Template not found: ${templateName}`);
+        this.templateName = templateName;
+        this.name = 'TemplateNotFoundError';
+    }
+}

package/dist/packages/bunshot-core/src/memoryEviction.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Evict oldest entries from a Map when it exceeds maxEntries.
+ * Maps iterate in insertion order, so deleting from the start removes oldest.
+ */
+export declare function evictOldest<K, V>(map: Map<K, V>, maxEntries: number): void;
+/**
+ * Evict entries with expired TTL from a Map.
+ * Entries must have an `expiresAt` field (epoch ms).
+ *
+ * The full scan is throttled to at most once per EVICTION_INTERVAL_MS per store,
+ * so it does not run on every write for high-frequency callers.
+ * Individual get() calls still do point-in-time checks — entries are never
+ * served after their TTL regardless of when the next full scan runs.
+ */
+export declare function evictExpired<K, V extends {
+    expiresAt?: number;
+}>(map: Map<K, V>, intervalMs?: number): void;
+/**
+ * Evict oldest entries from an Array when it exceeds maxEntries.
+ * Splices from the front (oldest-first assumption).
+ */
+export declare function evictOldestArray<T>(arr: T[], maxEntries: number): void;
+/** Default max entries for dev/test memory stores. */
+export declare const DEFAULT_MAX_ENTRIES = 10000;

package/dist/packages/bunshot-core/src/memoryEviction.js

@@ -0,0 +1,52 @@
+// ---------------------------------------------------------------------------
+// Memory store eviction utilities
+// ---------------------------------------------------------------------------
+/**
+ * Evict oldest entries from a Map when it exceeds maxEntries.
+ * Maps iterate in insertion order, so deleting from the start removes oldest.
+ */
+export function evictOldest(map, maxEntries) {
+    if (map.size <= maxEntries)
+        return;
+    const excess = map.size - maxEntries;
+    let i = 0;
+    for (const key of map.keys()) {
+        if (i++ >= excess)
+            break;
+        map.delete(key);
+    }
+}
+const lastEvictionTime = new WeakMap();
+/** How often the full O(n) expired-entry scan runs per store. */
+const EVICTION_INTERVAL_MS = 5_000;
+/**
+ * Evict entries with expired TTL from a Map.
+ * Entries must have an `expiresAt` field (epoch ms).
+ *
+ * The full scan is throttled to at most once per EVICTION_INTERVAL_MS per store,
+ * so it does not run on every write for high-frequency callers.
+ * Individual get() calls still do point-in-time checks — entries are never
+ * served after their TTL regardless of when the next full scan runs.
+ */
+export function evictExpired(map, intervalMs = EVICTION_INTERVAL_MS) {
+    const now = Date.now();
+    const last = lastEvictionTime.get(map) ?? 0;
+    if (now - last < intervalMs)
+        return;
+    lastEvictionTime.set(map, now);
+    for (const [key, val] of map) {
+        if (val.expiresAt && val.expiresAt <= now)
+            map.delete(key);
+    }
+}
+/**
+ * Evict oldest entries from an Array when it exceeds maxEntries.
+ * Splices from the front (oldest-first assumption).
+ */
+export function evictOldestArray(arr, maxEntries) {
+    if (arr.length <= maxEntries)
+        return;
+    arr.splice(0, arr.length - maxEntries);
+}
+/** Default max entries for dev/test memory stores. */
+export const DEFAULT_MAX_ENTRIES = 10_000;

package/dist/packages/bunshot-core/src/pagination.d.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+import type { ZodType } from 'zod';
+export interface OffsetParamDefaults {
+    limit?: number;
+    maxLimit?: number;
+    offset?: number;
+}
+export interface ParsedOffsetParams {
+    limit: number;
+    offset: number;
+}
+export declare function offsetParams(defaults?: OffsetParamDefaults): z.ZodObject<{
+    limit: z.ZodOptional<z.ZodString>;
+    offset: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare function parseOffsetParams(raw: {
+    limit?: string;
+    offset?: string;
+}, defaults?: OffsetParamDefaults): ParsedOffsetParams;
+export declare function paginatedResponse<T extends ZodType>(itemSchema: T, name: string): z.ZodObject<{
+    items: z.ZodArray<T>;
+    total: z.ZodNumber;
+    limit: z.ZodNumber;
+    offset: z.ZodNumber;
+}, z.core.$strip>;
+export interface CursorParamDefaults {
+    limit?: number;
+    maxLimit?: number;
+}
+export interface ParsedCursorParams {
+    limit: number;
+    cursor: string | undefined;
+}
+export declare function cursorParams(defaults?: CursorParamDefaults): z.ZodObject<{
+    limit: z.ZodOptional<z.ZodString>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare function parseCursorParams(raw: {
+    limit?: string;
+    cursor?: string;
+}, defaults?: CursorParamDefaults): ParsedCursorParams;
+export declare function cursorPaginatedResponse<T extends ZodType>(itemSchema: T, name: string): z.ZodObject<{
+    items: z.ZodArray<T>;
+    nextCursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;