@lastshotlabs/bunshot 0.0.27 → 0.0.28

package/dist/lib/mongo.js

@@ -1,124 +0,0 @@
-import { log } from "./logger";
-const isProd = process.env.NODE_ENV === "production";
-function requireMongoose() {
-    try {
-        // Bun supports require() in ESM; this defers the import to call time
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const mod = require("mongoose");
-        return mod.default ?? mod;
-    }
-    catch {
-        throw new Error("mongoose is not installed. Run: bun add mongoose");
-    }
-}
-function buildUri(user, password, host, db) {
-    const [hostPart, queryPart] = host.split("?");
-    return `mongodb+srv://${encodeURIComponent(user)}:${encodeURIComponent(password)}@${hostPart.replace(/\/$/, "")}/${db}${queryPart ? `?${queryPart}` : ""}`;
-}
-// Internal mutable references — set inside connect functions
-let _authConn = null;
-let _appConn = null;
-let _mongoose = null;
-function makeConnectionProxy(label, getConn, setConn) {
-    return new Proxy({}, {
-        get(_, prop) {
-            let conn = getConn();
-            if (!conn) {
-                // Lazily create a disconnected connection so appConnection.model() works at module
-                // load time. Mongoose buffers queries until openUri() is called by connectMongo().
-                conn = requireMongoose().createConnection();
-                setConn(conn);
-            }
-            const val = conn[prop];
-            return typeof val === "function" ? val.bind(conn) : val;
-        },
-    });
-}
-/**
- * Named connection used exclusively for auth data (AuthUser model).
- * Connected via connectAuthMongo() or connectMongo() (backward compat).
- */
-export const authConnection = makeConnectionProxy("auth", () => _authConn, (c) => { _authConn = c; });
-/**
- * Named connection for app/tenant data.
- * Connected via connectAppMongo() or connectMongo() (backward compat).
- * Use this when registering your own models: appConnection.model("Product", schema).
- */
-export const appConnection = makeConnectionProxy("app", () => _appConn, (c) => { _appConn = c; });
-/**
- * The mongoose instance. Available after connectMongo() / connectAuthMongo() is called.
- */
-export const mongoose = new Proxy({}, {
-    get(_, prop) {
-        const mg = _mongoose ?? requireMongoose();
-        return mg[prop];
-    },
-});
-/**
- * Connect the auth connection to its dedicated MongoDB server.
- * Uses MONGO_AUTH_USER_*, MONGO_AUTH_PW_*, MONGO_AUTH_HOST_*, MONGO_AUTH_DB_* env vars.
- */
-export const connectAuthMongo = async () => {
-    const mg = requireMongoose();
-    _mongoose = mg;
-    if (!_authConn)
-        _authConn = mg.createConnection();
-    const user = isProd ? process.env.MONGO_AUTH_USER_PROD : process.env.MONGO_AUTH_USER_DEV;
-    const password = isProd ? process.env.MONGO_AUTH_PW_PROD : process.env.MONGO_AUTH_PW_DEV;
-    const host = isProd ? process.env.MONGO_AUTH_HOST_PROD : process.env.MONGO_AUTH_HOST_DEV;
-    const db = isProd ? process.env.MONGO_AUTH_DB_PROD : process.env.MONGO_AUTH_DB_DEV;
-    const uri = buildUri(user, password, host, db);
-    await _authConn.openUri(uri);
-    log(`[mongo] auth connected to ${host} as ${user}`);
-};
-/**
- * Connect the app connection to its MongoDB server.
- * Uses MONGO_USER_*, MONGO_PW_*, MONGO_HOST_*, MONGO_DB_* env vars.
- */
-export const connectAppMongo = async () => {
-    const mg = requireMongoose();
-    _mongoose = mg;
-    if (!_appConn)
-        _appConn = mg.createConnection();
-    const user = isProd ? process.env.MONGO_USER_PROD : process.env.MONGO_USER_DEV;
-    const password = isProd ? process.env.MONGO_PW_PROD : process.env.MONGO_PW_DEV;
-    const host = isProd ? process.env.MONGO_HOST_PROD : process.env.MONGO_HOST_DEV;
-    const db = isProd ? process.env.MONGO_DB_PROD : process.env.MONGO_DB_DEV;
-    const uri = buildUri(user, password, host, db);
-    await _appConn.openUri(uri);
-    log(`[mongo] app connected to ${host} as ${user}`);
-};
-/**
- * Connect both auth and app connections to the same MongoDB server.
- * Backward-compatible shorthand for single-DB setups.
- * Uses MONGO_USER_*, MONGO_PW_*, MONGO_HOST_*, MONGO_DB_* env vars.
- */
-export const connectMongo = async () => {
-    const mg = requireMongoose();
-    _mongoose = mg;
-    if (!_authConn)
-        _authConn = mg.createConnection();
-    if (!_appConn)
-        _appConn = mg.createConnection();
-    const user = isProd ? process.env.MONGO_USER_PROD : process.env.MONGO_USER_DEV;
-    const password = isProd ? process.env.MONGO_PW_PROD : process.env.MONGO_PW_DEV;
-    const host = isProd ? process.env.MONGO_HOST_PROD : process.env.MONGO_HOST_DEV;
-    const db = isProd ? process.env.MONGO_DB_PROD : process.env.MONGO_DB_DEV;
-    const uri = buildUri(user, password, host, db);
-    await Promise.all([
-        _authConn.openUri(uri),
-        _appConn.openUri(uri),
-    ]);
-    log(`[mongo] connected to ${host} as ${user}`);
-};
-/**
- * Close both auth and app Mongo connections.
- * Useful for one-off scripts that need a clean exit.
- */
-export const disconnectMongo = async () => {
-    await Promise.all([
-        _authConn && _authConn.readyState !== 0 ? _authConn.close() : Promise.resolve(),
-        _appConn && _appConn.readyState !== 0 ? _appConn.close() : Promise.resolve(),
-    ]);
-    log("[mongo] disconnected");
-};

package/dist/lib/oauth.d.ts

@@ -1,40 +0,0 @@
-import { Google, Apple, MicrosoftEntraId, GitHub, generateState, generateCodeVerifier } from "arctic";
-export type OAuthProviderConfig = {
-    google?: {
-        clientId: string;
-        clientSecret: string;
-        redirectUri: string;
-    };
-    apple?: {
-        clientId: string;
-        teamId: string;
-        keyId: string;
-        privateKey: string;
-        redirectUri: string;
-    };
-    microsoft?: {
-        tenantId: string;
-        clientId: string;
-        clientSecret: string;
-        redirectUri: string;
-    };
-    github?: {
-        clientId: string;
-        clientSecret: string;
-        redirectUri: string;
-    };
-};
-export declare const initOAuthProviders: (config: OAuthProviderConfig) => void;
-export declare const getGoogle: () => Google;
-export declare const getApple: () => Apple;
-export declare const getMicrosoft: () => MicrosoftEntraId;
-export declare const getGitHub: () => GitHub;
-export declare const getConfiguredOAuthProviders: () => string[];
-type OAuthStateStore = "redis" | "mongo" | "sqlite" | "memory";
-export declare const setOAuthStateStore: (store: OAuthStateStore) => void;
-export declare const storeOAuthState: (state: string, codeVerifier?: string, linkUserId?: string) => Promise<void>;
-export declare const consumeOAuthState: (state: string) => Promise<{
-    codeVerifier?: string;
-    linkUserId?: string;
-} | null>;
-export { generateState, generateCodeVerifier };

package/dist/lib/oauth.js

@@ -1,101 +0,0 @@
-import { Google, Apple, MicrosoftEntraId, GitHub, generateState, generateCodeVerifier } from "arctic";
-import { getRedis } from "./redis";
-import { appConnection, mongoose } from "./mongo";
-import { getAppName } from "./appConfig";
-import { sqliteStoreOAuthState, sqliteConsumeOAuthState } from "../adapters/sqliteAuth";
-import { memoryStoreOAuthState, memoryConsumeOAuthState } from "../adapters/memoryAuth";
-let _providers = {};
-export const initOAuthProviders = (config) => {
-    if (config.google) {
-        const { clientId, clientSecret, redirectUri } = config.google;
-        _providers.google = new Google(clientId, clientSecret, redirectUri);
-    }
-    if (config.apple) {
-        const { clientId, teamId, keyId, privateKey, redirectUri } = config.apple;
-        _providers.apple = new Apple(clientId, teamId, keyId, new TextEncoder().encode(privateKey), redirectUri);
-    }
-    if (config.microsoft) {
-        const { tenantId, clientId, clientSecret, redirectUri } = config.microsoft;
-        _providers.microsoft = new MicrosoftEntraId(tenantId, clientId, clientSecret, redirectUri);
-    }
-    if (config.github) {
-        const { clientId, clientSecret, redirectUri } = config.github;
-        _providers.github = new GitHub(clientId, clientSecret, redirectUri);
-    }
-};
-export const getGoogle = () => {
-    if (!_providers.google)
-        throw new Error("Google OAuth not configured");
-    return _providers.google;
-};
-export const getApple = () => {
-    if (!_providers.apple)
-        throw new Error("Apple OAuth not configured");
-    return _providers.apple;
-};
-export const getMicrosoft = () => {
-    if (!_providers.microsoft)
-        throw new Error("Microsoft Entra ID OAuth not configured");
-    return _providers.microsoft;
-};
-export const getGitHub = () => {
-    if (!_providers.github)
-        throw new Error("GitHub OAuth not configured");
-    return _providers.github;
-};
-export const getConfiguredOAuthProviders = () => Object.entries(_providers)
-    .filter(([, v]) => v != null)
-    .map(([k]) => k);
-function getOAuthStateModel() {
-    if (appConnection.models["OAuthState"])
-        return appConnection.models["OAuthState"];
-    const { Schema } = mongoose;
-    const oauthStateSchema = new Schema({
-        state: { type: String, required: true, unique: true },
-        codeVerifier: { type: String },
-        linkUserId: { type: String },
-        expiresAt: { type: Date, required: true, index: { expireAfterSeconds: 0 } },
-    }, { collection: "oauth_states" });
-    return appConnection.model("OAuthState", oauthStateSchema);
-}
-let _oauthStore = "redis";
-export const setOAuthStateStore = (store) => { _oauthStore = store; };
-// ---------------------------------------------------------------------------
-// State helpers
-// ---------------------------------------------------------------------------
-const STATE_TTL = 300; // 5 minutes
-export const storeOAuthState = async (state, codeVerifier, linkUserId) => {
-    if (_oauthStore === "memory") {
-        memoryStoreOAuthState(state, codeVerifier, linkUserId);
-        return;
-    }
-    if (_oauthStore === "sqlite") {
-        sqliteStoreOAuthState(state, codeVerifier, linkUserId);
-        return;
-    }
-    if (_oauthStore === "mongo") {
-        const expiresAt = new Date(Date.now() + STATE_TTL * 1000);
-        await getOAuthStateModel().create({ state, codeVerifier, linkUserId, expiresAt });
-        return;
-    }
-    await getRedis().set(`oauth:${getAppName()}:state:${state}`, JSON.stringify({ codeVerifier, linkUserId }), "EX", STATE_TTL);
-};
-export const consumeOAuthState = async (state) => {
-    if (_oauthStore === "memory")
-        return memoryConsumeOAuthState(state);
-    if (_oauthStore === "sqlite")
-        return sqliteConsumeOAuthState(state);
-    if (_oauthStore === "mongo") {
-        const doc = await getOAuthStateModel()
-            .findOneAndDelete({ state, expiresAt: { $gt: new Date() } })
-            .lean();
-        return doc ? { codeVerifier: doc.codeVerifier, linkUserId: doc.linkUserId } : null;
-    }
-    const key = `oauth:${getAppName()}:state:${state}`;
-    const value = await getRedis().get(key);
-    if (!value)
-        return null;
-    await getRedis().del(key);
-    return JSON.parse(value);
-};
-export { generateState, generateCodeVerifier };

package/dist/lib/oauthCode.d.ts

@@ -1,15 +0,0 @@
-type OAuthCodeStore = "redis" | "mongo" | "sqlite" | "memory";
-export declare const setOAuthCodeStore: (store: OAuthCodeStore) => void;
-export interface OAuthCodePayload {
-    token: string;
-    userId: string;
-    email?: string;
-    refreshToken?: string;
-}
-/** Store a one-time authorization code. Returns the raw code (for the redirect URL).
- *  Only the SHA-256 hash is persisted. */
-export declare const storeOAuthCode: (payload: OAuthCodePayload) => Promise<string>;
-/** Atomically consume an authorization code — returns its payload and deletes it.
- *  Returns null if invalid, expired, or already used. */
-export declare const consumeOAuthCode: (code: string) => Promise<OAuthCodePayload | null>;
-export {};

package/dist/lib/oauthCode.js

@@ -1,95 +0,0 @@
-import { getRedis } from "./redis";
-import { appConnection, mongoose } from "./mongo";
-import { getAppName } from "./appConfig";
-import { sha256 } from "./crypto";
-import { memoryStoreOAuthCode, memoryConsumeOAuthCode, } from "../adapters/memoryAuth";
-import { sqliteStoreOAuthCode, sqliteConsumeOAuthCode, } from "../adapters/sqliteAuth";
-function getOAuthCodeModel() {
-    if (appConnection.models["OAuthCode"])
-        return appConnection.models["OAuthCode"];
-    const { Schema } = mongoose;
-    const schema = new Schema({
-        codeHash: { type: String, required: true, unique: true },
-        token: { type: String, required: true },
-        userId: { type: String, required: true },
-        email: { type: String },
-        refreshToken: { type: String },
-        expiresAt: { type: Date, required: true, index: { expireAfterSeconds: 0 } },
-    }, { collection: "oauth_codes" });
-    return appConnection.model("OAuthCode", schema);
-}
-// ---------------------------------------------------------------------------
-// Redis helpers
-// ---------------------------------------------------------------------------
-/** Atomically GET+DEL a key. Uses native GETDEL (Redis >= 6.2) with a Lua fallback. */
-async function redisGetDel(key) {
-    const redis = getRedis();
-    if (typeof redis.getdel === "function") {
-        try {
-            return await redis.getdel(key);
-        }
-        catch (err) {
-            const msg = err?.message ?? "";
-            if (!/unknown command|ERR unknown command/i.test(msg))
-                throw err;
-        }
-    }
-    const result = await redis.eval("local v = redis.call('GET', KEYS[1])\nif v then redis.call('DEL', KEYS[1]) end\nreturn v", 1, key);
-    return result ?? null;
-}
-let _store = "redis";
-export const setOAuthCodeStore = (store) => { _store = store; };
-const CODE_TTL = 60; // 60 seconds
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-/** Store a one-time authorization code. Returns the raw code (for the redirect URL).
- *  Only the SHA-256 hash is persisted. */
-export const storeOAuthCode = async (payload) => {
-    const bytes = new Uint8Array(32);
-    crypto.getRandomValues(bytes);
-    const code = Buffer.from(bytes).toString("base64url");
-    const hash = sha256(code);
-    if (_store === "memory") {
-        memoryStoreOAuthCode(hash, payload, CODE_TTL);
-        return code;
-    }
-    if (_store === "sqlite") {
-        sqliteStoreOAuthCode(hash, payload, CODE_TTL);
-        return code;
-    }
-    if (_store === "mongo") {
-        await getOAuthCodeModel().create({
-            codeHash: hash,
-            ...payload,
-            expiresAt: new Date(Date.now() + CODE_TTL * 1000),
-        });
-        return code;
-    }
-    // Redis
-    await getRedis().set(`oauthcode:${getAppName()}:${hash}`, JSON.stringify(payload), "EX", CODE_TTL);
-    return code;
-};
-/** Atomically consume an authorization code — returns its payload and deletes it.
- *  Returns null if invalid, expired, or already used. */
-export const consumeOAuthCode = async (code) => {
-    const hash = sha256(code);
-    if (_store === "memory")
-        return memoryConsumeOAuthCode(hash);
-    if (_store === "sqlite")
-        return sqliteConsumeOAuthCode(hash);
-    if (_store === "mongo") {
-        const doc = await getOAuthCodeModel()
-            .findOneAndDelete({ codeHash: hash, expiresAt: { $gt: new Date() } })
-            .lean();
-        if (!doc)
-            return null;
-        return { token: doc.token, userId: doc.userId, email: doc.email, refreshToken: doc.refreshToken };
-    }
-    // Redis
-    const key = `oauthcode:${getAppName()}:${hash}`;
-    const raw = await redisGetDel(key);
-    if (!raw)
-        return null;
-    return JSON.parse(raw);
-};

package/dist/lib/pagination.d.ts

@@ -1,119 +0,0 @@
-import { z } from "zod";
-import type { ZodType } from "zod";
-export type { PaginationOpts, PaginatedResult } from "./groups";
-export interface OffsetParamDefaults {
-    /** Default: 50 */
-    limit?: number;
-    /** Default: 200 */
-    maxLimit?: number;
-    /** Default: 0 */
-    offset?: number;
-}
-export interface ParsedOffsetParams {
-    limit: number;
-    offset: number;
-}
-/**
- * Zod schema for offset pagination query params.
- * Fields are `z.string().optional()` — matches the existing query param
- * convention. Parse the values with `parseOffsetParams`.
- *
- * @example
- * createRoute({ ..., request: { query: offsetParams({ limit: 20 }) }, ... })
- */
-export declare function offsetParams(defaults?: OffsetParamDefaults): z.ZodObject<{
-    limit: z.ZodOptional<z.ZodString>;
-    offset: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-/**
- * Parses raw string query values into clamped integers.
- * - NaN (non-numeric strings) falls back to defaults
- * - limit clamped to [1, maxLimit]
- * - offset clamped to [0, ∞)
- *
- * @example
- * const { limit, offset } = parseOffsetParams(c.req.query(), { maxLimit: 100 });
- */
-export declare function parseOffsetParams(raw: {
-    limit?: string;
-    offset?: string;
-}, defaults?: OffsetParamDefaults): ParsedOffsetParams;
-/**
- * Zod schema factory for paginated offset responses.
- * Wraps `itemSchema` in `{ items, total, limit, offset }` and registers
- * the result as a named OpenAPI component.
- *
- * Throws if `name` was previously registered to a different schema instance.
- * Calling with the same `name` + `schema` pair is idempotent.
- *
- * @example
- * const PaginatedUsersResponse = paginatedResponse(UserSchema, "PaginatedUsers");
- */
-export declare function paginatedResponse<T extends ZodType>(itemSchema: T, name: string): z.ZodObject<{
-    items: z.ZodArray<T>;
-    total: z.ZodNumber;
-    limit: z.ZodNumber;
-    offset: z.ZodNumber;
-}, z.core.$strip>;
-export interface CursorParamDefaults {
-    /** Default: 50 */
-    limit?: number;
-    /** Default: 200 */
-    maxLimit?: number;
-}
-export interface ParsedCursorParams {
-    limit: number;
-    cursor: string | undefined;
-}
-export interface CursorResult<T> {
-    items: T[];
-    nextCursor: string | null;
-    hasMore: boolean;
-}
-/**
- * Zod schema for cursor pagination query params.
- * Fields are `z.string().optional()`. Parse the values with `parseCursorParams`.
- *
- * @example
- * createRoute({ ..., request: { query: cursorParams() }, ... })
- */
-export declare function cursorParams(defaults?: CursorParamDefaults): z.ZodObject<{
-    limit: z.ZodOptional<z.ZodString>;
-    cursor: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-/**
- * Parses raw string query values into typed cursor params.
- * - limit: NaN falls back to default, clamped to [1, maxLimit]
- * - cursor: empty string normalized to `undefined`; non-empty is pass-through
- * - When `signing.cursors: true`, verifies the cursor HMAC — invalid cursor returns null
- *
- * @example
- * const { limit, cursor } = parseCursorParams(c.req.query());
- */
-export declare function parseCursorParams(raw: {
-    limit?: string;
-    cursor?: string;
-}, defaults?: CursorParamDefaults): ParsedCursorParams & {
-    invalidCursor?: true;
-};
-/**
- * Sign a cursor value if `signing.cursors: true`. Otherwise returns the
- * cursor unchanged (current behavior).
- */
-export declare function maybeSignCursor(cursor: string | null): string | null;
-/**
- * Zod schema factory for cursor-paginated responses.
- * Wraps `itemSchema` in `{ items, nextCursor, hasMore }` and registers
- * the result as a named OpenAPI component.
- *
- * Throws if `name` was previously registered to a different schema instance.
- * Calling with the same `name` + `schema` pair is idempotent.
- *
- * @example
- * const PostsPage = cursorResponse(PostSchema, "PostsPage");
- */
-export declare function cursorResponse<T extends ZodType>(itemSchema: T, name: string): z.ZodObject<{
-    items: z.ZodArray<T>;
-    nextCursor: z.ZodNullable<z.ZodString>;
-    hasMore: z.ZodBoolean;
-}, z.core.$strip>;

package/dist/lib/pagination.js

@@ -1,166 +0,0 @@
-import { z } from "zod";
-import { registerSchema } from "./createRoute";
-import { getSigningConfig, getSigningSecret } from "./appConfig";
-import { signCursor, verifyCursor } from "./signing";
-const _registered = new Map();
-function guardedRegister(name, itemSchema, buildWrapper) {
-    const existing = _registered.get(name);
-    if (existing !== undefined) {
-        if (existing.itemSchema !== itemSchema) {
-            throw new Error(`Pagination schema name "${name}" is already registered to a different schema`);
-        }
-        // Same item schema → idempotent, return the cached wrapper
-        return existing.wrapper;
-    }
-    const wrapper = buildWrapper();
-    _registered.set(name, { itemSchema, wrapper });
-    registerSchema(name, wrapper);
-    return wrapper;
-}
-/**
- * Zod schema for offset pagination query params.
- * Fields are `z.string().optional()` — matches the existing query param
- * convention. Parse the values with `parseOffsetParams`.
- *
- * @example
- * createRoute({ ..., request: { query: offsetParams({ limit: 20 }) }, ... })
- */
-export function offsetParams(defaults) {
-    const defaultLimit = defaults?.limit ?? 50;
-    const defaultOffset = defaults?.offset ?? 0;
-    const maxLimit = defaults?.maxLimit ?? 200;
-    return z.object({
-        limit: z
-            .string()
-            .optional()
-            .describe(`Number of items to return (1–${maxLimit}, default ${defaultLimit})`),
-        offset: z
-            .string()
-            .optional()
-            .describe(`Number of items to skip (default ${defaultOffset})`),
-    });
-}
-/**
- * Parses raw string query values into clamped integers.
- * - NaN (non-numeric strings) falls back to defaults
- * - limit clamped to [1, maxLimit]
- * - offset clamped to [0, ∞)
- *
- * @example
- * const { limit, offset } = parseOffsetParams(c.req.query(), { maxLimit: 100 });
- */
-export function parseOffsetParams(raw, defaults) {
-    const defaultLimit = defaults?.limit ?? 50;
-    const maxLimit = defaults?.maxLimit ?? 200;
-    const defaultOffset = defaults?.offset ?? 0;
-    const rawLimit = parseInt(raw.limit ?? "", 10);
-    const rawOffset = parseInt(raw.offset ?? "", 10);
-    const limit = isNaN(rawLimit)
-        ? defaultLimit
-        : Math.min(Math.max(rawLimit, 1), maxLimit);
-    const offset = isNaN(rawOffset) ? defaultOffset : Math.max(rawOffset, 0);
-    return { limit, offset };
-}
-/**
- * Zod schema factory for paginated offset responses.
- * Wraps `itemSchema` in `{ items, total, limit, offset }` and registers
- * the result as a named OpenAPI component.
- *
- * Throws if `name` was previously registered to a different schema instance.
- * Calling with the same `name` + `schema` pair is idempotent.
- *
- * @example
- * const PaginatedUsersResponse = paginatedResponse(UserSchema, "PaginatedUsers");
- */
-export function paginatedResponse(itemSchema, name) {
-    return guardedRegister(name, itemSchema, () => z.object({
-        items: z.array(itemSchema),
-        total: z.number().int().nonnegative(),
-        limit: z.number().int().positive(),
-        offset: z.number().int().nonnegative(),
-    }));
-}
-/**
- * Zod schema for cursor pagination query params.
- * Fields are `z.string().optional()`. Parse the values with `parseCursorParams`.
- *
- * @example
- * createRoute({ ..., request: { query: cursorParams() }, ... })
- */
-export function cursorParams(defaults) {
-    const defaultLimit = defaults?.limit ?? 50;
-    const maxLimit = defaults?.maxLimit ?? 200;
-    return z.object({
-        limit: z
-            .string()
-            .optional()
-            .describe(`Number of items to return (1–${maxLimit}, default ${defaultLimit})`),
-        cursor: z
-            .string()
-            .optional()
-            .describe("Opaque cursor from a previous response's nextCursor field"),
-    });
-}
-/**
- * Parses raw string query values into typed cursor params.
- * - limit: NaN falls back to default, clamped to [1, maxLimit]
- * - cursor: empty string normalized to `undefined`; non-empty is pass-through
- * - When `signing.cursors: true`, verifies the cursor HMAC — invalid cursor returns null
- *
- * @example
- * const { limit, cursor } = parseCursorParams(c.req.query());
- */
-export function parseCursorParams(raw, defaults) {
-    const defaultLimit = defaults?.limit ?? 50;
-    const maxLimit = defaults?.maxLimit ?? 200;
-    const rawLimit = parseInt(raw.limit ?? "", 10);
-    const limit = isNaN(rawLimit)
-        ? defaultLimit
-        : Math.min(Math.max(rawLimit, 1), maxLimit);
-    if (!raw.cursor)
-        return { limit, cursor: undefined };
-    const cfg = getSigningConfig();
-    if (cfg?.cursors) {
-        const secret = getSigningSecret();
-        if (secret) {
-            const verified = verifyCursor(raw.cursor, secret);
-            if (verified === null)
-                return { limit, cursor: undefined, invalidCursor: true };
-            return { limit, cursor: verified };
-        }
-    }
-    return { limit, cursor: raw.cursor };
-}
-/**
- * Sign a cursor value if `signing.cursors: true`. Otherwise returns the
- * cursor unchanged (current behavior).
- */
-export function maybeSignCursor(cursor) {
-    if (!cursor)
-        return cursor;
-    const cfg = getSigningConfig();
-    if (cfg?.cursors) {
-        const secret = getSigningSecret();
-        if (secret)
-            return signCursor(cursor, secret);
-    }
-    return cursor;
-}
-/**
- * Zod schema factory for cursor-paginated responses.
- * Wraps `itemSchema` in `{ items, nextCursor, hasMore }` and registers
- * the result as a named OpenAPI component.
- *
- * Throws if `name` was previously registered to a different schema instance.
- * Calling with the same `name` + `schema` pair is idempotent.
- *
- * @example
- * const PostsPage = cursorResponse(PostSchema, "PostsPage");
- */
-export function cursorResponse(itemSchema, name) {
-    return guardedRegister(name, itemSchema, () => z.object({
-        items: z.array(itemSchema),
-        nextCursor: z.string().nullable(),
-        hasMore: z.boolean(),
-    }));
-}