@lastshotlabs/bunshot 0.0.27 → 0.0.28

package/dist/middleware/cacheResponse.js

@@ -1,178 +0,0 @@
-import { getRedis } from "../lib/redis";
-import { getAppName } from "../lib/appConfig";
-import { appConnection, mongoose } from "../lib/mongo";
-import { isSqliteReady, sqliteGetCache, sqliteSetCache, sqliteDelCache, sqliteDelCachePattern } from "../adapters/sqliteAuth";
-import { memoryGetCache, memorySetCache, memoryDelCache, memoryDelCachePattern } from "../adapters/memoryAuth";
-export function getCacheModel() {
-    if (appConnection.models["CacheEntry"])
-        return appConnection.models["CacheEntry"];
-    const { Schema } = mongoose;
-    const cacheSchema = new Schema({
-        key: { type: String, required: true, unique: true },
-        value: { type: String, required: true },
-        expiresAt: { type: Date, index: { expireAfterSeconds: 0 } },
-    }, { collection: "cache_entries" });
-    return appConnection.model("CacheEntry", cacheSchema);
-}
-function isMongoReady() {
-    return appConnection.readyState === 1;
-}
-function isRedisReady() {
-    try {
-        getRedis();
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-let _defaultCacheStore = "redis";
-export const setCacheStore = (store) => { _defaultCacheStore = store; };
-async function storeGet(store, cacheKey) {
-    if (store === "memory")
-        return memoryGetCache(cacheKey);
-    if (store === "sqlite") {
-        if (!isSqliteReady())
-            throw new Error(`cacheResponse: store is "sqlite" but SQLite is not initialized. Call setSqliteDb(path) or pass sqliteDb to createServer.`);
-        return sqliteGetCache(cacheKey);
-    }
-    if (store === "mongo") {
-        if (!isMongoReady())
-            throw new Error(`cacheResponse: store is "mongo" but appConnection is not connected. Ensure connectMongo() or connectAppMongo() is called before handling requests.`);
-        const doc = await getCacheModel().findOne({ key: cacheKey }, "value").lean();
-        return doc ? doc.value : null;
-    }
-    return getRedis().get(cacheKey);
-}
-async function storeSet(store, cacheKey, value, ttl) {
-    if (store === "memory") {
-        memorySetCache(cacheKey, value, ttl);
-        return;
-    }
-    if (store === "sqlite") {
-        if (!isSqliteReady())
-            throw new Error(`cacheResponse: store is "sqlite" but SQLite is not initialized. Call setSqliteDb(path) or pass sqliteDb to createServer.`);
-        sqliteSetCache(cacheKey, value, ttl);
-        return;
-    }
-    if (store === "mongo") {
-        if (!isMongoReady())
-            throw new Error(`cacheResponse: store is "mongo" but appConnection is not connected. Ensure connectMongo() or connectAppMongo() is called before handling requests.`);
-        const expiresAt = ttl ? new Date(Date.now() + ttl * 1000) : undefined;
-        await getCacheModel().updateOne({ key: cacheKey }, { $set: { value, ...(expiresAt ? { expiresAt } : {}) } }, { upsert: true });
-        return;
-    }
-    if (ttl) {
-        await getRedis().setex(cacheKey, ttl, value);
-    }
-    else {
-        await getRedis().set(cacheKey, value);
-    }
-}
-async function storeDel(store, cacheKey) {
-    if (store === "memory") {
-        memoryDelCache(cacheKey);
-        return;
-    }
-    if (store === "sqlite") {
-        if (!isSqliteReady())
-            return;
-        sqliteDelCache(cacheKey);
-        return;
-    }
-    if (store === "mongo") {
-        if (!isMongoReady())
-            return;
-        await getCacheModel().deleteOne({ key: cacheKey });
-        return;
-    }
-    if (!isRedisReady())
-        return;
-    await getRedis().del(cacheKey);
-}
-async function storeDelPattern(store, fullPattern) {
-    if (store === "memory") {
-        memoryDelCachePattern(fullPattern);
-        return;
-    }
-    if (store === "sqlite") {
-        if (!isSqliteReady())
-            return;
-        sqliteDelCachePattern(fullPattern);
-        return;
-    }
-    if (store === "mongo") {
-        if (!isMongoReady())
-            return;
-        // Escape all regex metacharacters in the full pattern (including the cache:{appName}: prefix,
-        // which may itself contain dots or other metacharacters). Then restore * as a glob wildcard.
-        // Order matters: escape first, then replace the now-escaped \* with .* for glob semantics.
-        const escaped = fullPattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
-        const regex = new RegExp("^" + escaped.replace(/\*/g, ".*") + "$");
-        await getCacheModel().deleteMany({ key: regex });
-        return;
-    }
-    if (!isRedisReady())
-        return;
-    const redis = getRedis();
-    let cursor = "0";
-    do {
-        const [next, keys] = await redis.scan(cursor, "MATCH", fullPattern, "COUNT", 100);
-        cursor = next;
-        if (keys.length > 0)
-            await redis.del(...keys);
-    } while (cursor !== "0");
-}
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-export const bustCache = async (key) => {
-    const cacheKey = `cache:${getAppName()}:${key}`;
-    await Promise.all([storeDel("redis", cacheKey), storeDel("mongo", cacheKey), storeDel("sqlite", cacheKey), storeDel("memory", cacheKey)]);
-};
-export const bustCachePattern = async (pattern) => {
-    const fullPattern = `cache:${getAppName()}:${pattern}`;
-    await Promise.all([storeDelPattern("redis", fullPattern), storeDelPattern("mongo", fullPattern), storeDelPattern("sqlite", fullPattern), storeDelPattern("memory", fullPattern)]);
-};
-/** Headers that must never be cached — storing these can cause session fixation or auth bypass. */
-const UNCACHEABLE_HEADERS = new Set([
-    "set-cookie",
-    "www-authenticate",
-    "authorization",
-    "x-csrf-token",
-    "proxy-authenticate",
-]);
-export const cacheResponse = ({ ttl, key, store = _defaultCacheStore }) => {
-    return async (c, next) => {
-        const appName = getAppName();
-        const rawKey = typeof key === "function" ? key(c) : key;
-        // Per-tenant namespacing: prevents two tenants caching the same key from colliding
-        const tenantId = c.get("tenantId");
-        const tenantSegment = tenantId ? `${tenantId}:` : "";
-        const cacheKey = `cache:${appName}:${tenantSegment}${rawKey}`;
-        const cached = await storeGet(store, cacheKey);
-        if (cached) {
-            const { status, headers, body } = JSON.parse(cached);
-            return new Response(body, {
-                status,
-                headers: { ...headers, "x-cache": "HIT" },
-            });
-        }
-        await next();
-        const res = c.res;
-        if (res.status >= 200 && res.status < 300) {
-            const body = await res.text();
-            const headers = {};
-            res.headers.forEach((value, name) => {
-                if (!UNCACHEABLE_HEADERS.has(name.toLowerCase())) {
-                    headers[name] = value;
-                }
-            });
-            await storeSet(store, cacheKey, JSON.stringify({ status: res.status, headers, body }), ttl);
-            c.res = new Response(body, {
-                status: res.status,
-                headers: { ...headers, "x-cache": "MISS" },
-            });
-        }
-    };
-};

package/dist/middleware/captcha.js

@@ -1,36 +0,0 @@
-import { verifyCaptcha } from "../lib/captcha";
-import { HttpError } from "../lib/HttpError";
-import { getClientIp } from "../lib/clientIp";
-/**
- * Middleware factory that verifies a CAPTCHA token from the request body.
- *
- * @example
- * router.post("/contact", requireCaptcha({ provider: "turnstile", secretKey: "..." }), handler);
- */
-export const requireCaptcha = (config) => async (c, next) => {
-    // Get effective config: param takes precedence, then global config
-    const { getCaptchaConfig } = await import("../lib/appConfig");
-    const effectiveConfig = config ?? getCaptchaConfig();
-    if (!effectiveConfig) {
-        await next();
-        return;
-    }
-    const tokenField = effectiveConfig.tokenField ?? "captcha-token";
-    let body;
-    try {
-        body = await c.req.json();
-    }
-    catch {
-        body = {};
-    }
-    const token = body[tokenField];
-    if (!token) {
-        throw new HttpError(400, "CAPTCHA token is required", "CAPTCHA_MISSING");
-    }
-    const ip = getClientIp(c) ?? undefined;
-    const result = await verifyCaptcha(token, effectiveConfig, ip);
-    if (!result.success) {
-        throw new HttpError(400, "CAPTCHA verification failed", "CAPTCHA_FAILED");
-    }
-    await next();
-};

package/dist/middleware/csrf.js

@@ -1,129 +0,0 @@
-import { getCookie, setCookie, deleteCookie } from "hono/cookie";
-import { timingSafeEqual } from "../lib/crypto";
-import { COOKIE_TOKEN, COOKIE_CSRF_TOKEN, HEADER_CSRF_TOKEN } from "../lib/constants";
-import { createHmac, randomBytes } from "crypto";
-const isProd = process.env.NODE_ENV === "production";
-const STATE_CHANGING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
-let _csrfSecret = null;
-function getCsrfSecret() {
-    if (_csrfSecret)
-        return _csrfSecret;
-    const secret = isProd ? process.env.JWT_SECRET_PROD : process.env.JWT_SECRET_DEV;
-    if (!secret)
-        throw new Error("CSRF middleware requires JWT_SECRET_DEV/JWT_SECRET_PROD to be set");
-    _csrfSecret = secret;
-    return _csrfSecret;
-}
-function generateCsrfToken(secret) {
-    const token = randomBytes(32).toString("hex");
-    const sig = createHmac("sha256", secret).update(token).digest("hex");
-    return `${token}.${sig}`;
-}
-function verifyCsrfSignature(cookieValue, secret) {
-    const dotIdx = cookieValue.indexOf(".");
-    if (dotIdx === -1)
-        return false;
-    const token = cookieValue.substring(0, dotIdx);
-    const sig = cookieValue.substring(dotIdx + 1);
-    const expected = createHmac("sha256", secret).update(token).digest("hex");
-    return timingSafeEqual(sig, expected);
-}
-const csrfCookieOptions = {
-    httpOnly: false,
-    secure: isProd,
-    sameSite: "Lax",
-    path: "/",
-    maxAge: 60 * 60 * 24 * 365, // 1 year — tied to browser, not session
-};
-/**
- * Refreshes the CSRF token cookie — call on login/register to prevent
- * session fixation-adjacent attacks.
- */
-export function refreshCsrfToken(c) {
-    const secret = getCsrfSecret();
-    const token = generateCsrfToken(secret);
-    setCookie(c, COOKIE_CSRF_TOKEN, token, csrfCookieOptions);
-}
-/**
- * Clears the CSRF token cookie — call on logout.
- */
-export function clearCsrfToken(c) {
-    deleteCookie(c, COOKIE_CSRF_TOKEN, { path: "/" });
-}
-export const csrfProtection = (options = {}) => {
-    const { exemptPaths = [], checkOrigin = true, allowedOrigins } = options;
-    // Normalize allowed origins for origin validation
-    const originSet = new Set();
-    if (allowedOrigins) {
-        const origins = Array.isArray(allowedOrigins) ? allowedOrigins : [allowedOrigins];
-        for (const o of origins) {
-            // "*" is intentionally excluded: validating against a wildcard would accept any origin,
-            // defeating the check. When CORS is open, origin validation is meaningless.
-            if (o !== "*")
-                originSet.add(o.replace(/\/$/, ""));
-        }
-    }
-    if (checkOrigin && originSet.size === 0) {
-        // Warn in all environments — this is a one-time startup message, not per-request noise,
-        // and a misconfigured production deployment should surface it.
-        console.warn("[bunshot] csrfProtection: checkOrigin is enabled but no specific allowed origins are " +
-            "configured (CORS is \"*\" or allowedOrigins is unset). Origin validation is disabled — " +
-            "only the HMAC double-submit cookie check is active. Set security.cors to specific " +
-            "origins to enable origin validation.");
-    }
-    return async (c, next) => {
-        const secret = getCsrfSecret();
-        // Set CSRF cookie on every response if not already present
-        const existingCsrf = getCookie(c, COOKIE_CSRF_TOKEN);
-        if (!existingCsrf) {
-            const token = generateCsrfToken(secret);
-            setCookie(c, COOKIE_CSRF_TOKEN, token, csrfCookieOptions);
-        }
-        // Only validate state-changing methods
-        if (!STATE_CHANGING_METHODS.has(c.req.method)) {
-            return next();
-        }
-        // Skip if no auth cookie present — not vulnerable to CSRF
-        const authCookie = getCookie(c, COOKIE_TOKEN);
-        if (!authCookie) {
-            return next();
-        }
-        // Skip exempt paths
-        const path = c.req.path;
-        for (const exempt of exemptPaths) {
-            if (exempt.endsWith("*")) {
-                if (path.startsWith(exempt.slice(0, -1)))
-                    return next();
-            }
-            else {
-                if (path === exempt)
-                    return next();
-            }
-        }
-        // Origin validation (secondary layer)
-        if (checkOrigin && originSet.size > 0) {
-            const origin = c.req.header("origin");
-            if (origin) {
-                const normalized = origin.replace(/\/$/, "");
-                if (!originSet.has(normalized)) {
-                    return c.json({ error: "CSRF origin mismatch" }, 403);
-                }
-            }
-        }
-        // Double submit cookie validation
-        const csrfCookie = getCookie(c, COOKIE_CSRF_TOKEN);
-        const csrfHeader = c.req.header(HEADER_CSRF_TOKEN);
-        if (!csrfCookie || !csrfHeader) {
-            return c.json({ error: "CSRF token missing" }, 403);
-        }
-        // Verify the cookie's HMAC signature (prevents cookie injection)
-        if (!verifyCsrfSignature(csrfCookie, secret)) {
-            return c.json({ error: "CSRF token invalid" }, 403);
-        }
-        // Compare header value to cookie value
-        if (!timingSafeEqual(csrfHeader, csrfCookie)) {
-            return c.json({ error: "CSRF token mismatch" }, 403);
-        }
-        return next();
-    };
-};

package/dist/middleware/identify.d.ts

@@ -1,3 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import type { AppEnv } from "../lib/context";
-export declare const identify: MiddlewareHandler<AppEnv>;

package/dist/middleware/identify.js

@@ -1,122 +0,0 @@
-import { getCookie } from "hono/cookie";
-import { verifyToken } from "../lib/jwt";
-import { getSession, updateSessionLastActive, getSessionFingerprint, setSessionFingerprint } from "../lib/session";
-import { COOKIE_TOKEN, HEADER_USER_TOKEN } from "../lib/constants";
-import { log, authTrace } from "../lib/logger";
-import { getTrackLastActive, getSigningConfig, getCheckSuspensionOnIdentify } from "../lib/appConfig";
-import { getSuspended } from "../lib/suspension";
-import { getClientIp } from "../lib/clientIp";
-import { sha256, timingSafeEqual } from "../lib/crypto";
-import { HttpError } from "../lib/HttpError";
-function computeFingerprint(c, fields) {
-    const parts = fields.map((f) => {
-        if (f === "ip")
-            return getClientIp(c) ?? "";
-        if (f === "ua")
-            return c.req.header("user-agent") ?? "";
-        return c.req.header("accept-language") ?? "";
-    });
-    return sha256(parts.join(":"));
-}
-export const identify = async (c, next) => {
-    c.set("authUserId", null);
-    c.set("roles", null);
-    c.set("sessionId", null);
-    c.set("authClientId", null);
-    c.set("tokenPayload", null);
-    // cookie for browsers, x-user-token header for non-browser clients
-    const token = getCookie(c, COOKIE_TOKEN) ?? c.req.header(HEADER_USER_TOKEN) ?? null;
-    log(`[identify] token=${token ? "present" : "absent"}`);
-    if (token) {
-        try {
-            const payload = await verifyToken(token);
-            c.set("tokenPayload", payload);
-            const sessionId = payload.sid;
-            if (!sessionId) {
-                // Check for M2M token (scope present, no sid)
-                if (payload.scope && payload.sub) {
-                    c.set("authClientId", payload.sub);
-                    log(`[identify] M2M token for clientId=${payload.sub}`);
-                }
-                else {
-                    log("[identify] token missing sid claim — unauthenticated");
-                }
-            }
-            else {
-                const stored = await getSession(sessionId);
-                log("[identify] token verified, checking session...");
-                authTrace(`[identify] authUserId=${payload.sub}`);
-                if (timingSafeEqual(stored ?? "", token)) {
-                    const signingCfg = getSigningConfig();
-                    const bindingCfg = signingCfg?.sessionBinding;
-                    if (bindingCfg) {
-                        const bindingOpts = typeof bindingCfg === "object" ? bindingCfg : {};
-                        const fields = bindingOpts.fields ?? ["ip", "ua"];
-                        const onMismatch = bindingOpts.onMismatch ?? "unauthenticate";
-                        const current = computeFingerprint(c, fields);
-                        const storedFp = await getSessionFingerprint(sessionId);
-                        if (storedFp === null) {
-                            // First authenticated request — store the fingerprint
-                            setSessionFingerprint(sessionId, current).catch(() => {
-                                log("[identify] failed to store session fingerprint");
-                            });
-                            c.set("authUserId", payload.sub);
-                            c.set("sessionId", sessionId);
-                        }
-                        else if (timingSafeEqual(storedFp, current)) {
-                            c.set("authUserId", payload.sub);
-                            c.set("sessionId", sessionId);
-                        }
-                        else {
-                            log(`[identify] fingerprint mismatch, onMismatch=${onMismatch}`);
-                            authTrace(`[identify] sessionId=${sessionId}`);
-                            if (onMismatch === "reject") {
-                                throw new HttpError(401, "Unauthorized", "FINGERPRINT_MISMATCH");
-                            }
-                            else if (onMismatch === "log-only") {
-                                c.set("authUserId", payload.sub);
-                                c.set("sessionId", sessionId);
-                            }
-                            // onMismatch === "unauthenticate" — leave authUserId null (already null)
-                        }
-                    }
-                    else {
-                        c.set("authUserId", payload.sub);
-                        c.set("sessionId", sessionId);
-                    }
-                    if (c.get("authUserId")) {
-                        if (getCheckSuspensionOnIdentify()) {
-                            const suspensionStatus = await getSuspended(payload.sub).catch(() => ({ suspended: false }));
-                            if (suspensionStatus.suspended) {
-                                c.set("authUserId", null);
-                                c.set("sessionId", null);
-                                c.set("roles", null);
-                                log(`[identify] userId=${payload.sub} is suspended — unauthenticated`);
-                            }
-                        }
-                    }
-                    if (c.get("authUserId")) {
-                        authTrace(`[identify] authUserId=${payload.sub} sessionId=${sessionId}`);
-                        if (getTrackLastActive()) {
-                            updateSessionLastActive(sessionId).catch(() => {
-                                log("[identify] failed to update session lastActiveAt");
-                            });
-                        }
-                    }
-                }
-                else {
-                    log("[identify] token/session mismatch — unauthenticated");
-                }
-            }
-        }
-        catch (err) {
-            if (err instanceof HttpError)
-                throw err;
-            log("[identify] invalid token — unauthenticated");
-        }
-    }
-    else {
-        log("[identify] no token — unauthenticated");
-    }
-    await next();
-};

package/dist/middleware/index.js

@@ -1 +0,0 @@
-export const applyMiddleware = (handler, ...middleware) => middleware.reduceRight((next, mw) => (req) => mw(req, next), handler);

package/dist/middleware/metrics.d.ts

@@ -1,9 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import type { AppEnv } from "../lib/context";
-export interface MetricsMiddlewareOptions {
-    /** Paths to exclude from metrics collection. Strings use prefix matching. */
-    excludePaths?: (string | RegExp)[];
-    /** Custom path normalizer to prevent cardinality explosion. */
-    normalizePath?: (path: string) => string;
-}
-export declare const metricsCollector: (options?: MetricsMiddlewareOptions) => MiddlewareHandler<AppEnv>;

package/dist/middleware/metrics.js

@@ -1,26 +0,0 @@
-import { incrementCounter, observeHistogram, defaultNormalizePath } from "../lib/metrics";
-const DEFAULT_EXCLUDE = ["/metrics", "/health", "/docs", "/openapi.json"];
-export const metricsCollector = (options = {}) => {
-    const { excludePaths = DEFAULT_EXCLUDE, normalizePath = defaultNormalizePath, } = options;
-    return async (c, next) => {
-        const rawPath = c.req.path;
-        const excluded = excludePaths.some(p => typeof p === "string" ? rawPath.startsWith(p) : p.test(rawPath));
-        if (excluded)
-            return next();
-        const start = performance.now();
-        await next();
-        const duration = (performance.now() - start) / 1000; // seconds
-        const method = c.req.method;
-        const path = normalizePath(rawPath);
-        const status = String(c.res.status);
-        const tenantId = c.get("tenantId") ?? undefined;
-        const labels = { method, path, status };
-        const durationLabels = { method, path };
-        if (tenantId) {
-            labels.tenant = tenantId;
-            durationLabels.tenant = tenantId;
-        }
-        incrementCounter("http_requests_total", labels);
-        observeHistogram("http_request_duration_seconds", durationLabels, duration);
-    };
-};

package/dist/middleware/rateLimit.js

@@ -1,22 +0,0 @@
-import { trackAttempt } from "../lib/authRateLimit";
-import { buildFingerprint } from "../lib/fingerprint";
-import { getClientIp } from "../lib/clientIp";
-export const rateLimit = ({ windowMs, max, fingerprintLimit = false, }) => {
-    const opts = { windowMs, max };
-    return async (c, next) => {
-        const ip = getClientIp(c);
-        // Per-tenant namespacing: each tenant gets independent rate limit buckets
-        const tenantId = c.get("tenantId");
-        const prefix = tenantId ? `t:${tenantId}:` : "";
-        if (await trackAttempt(`${prefix}ip:${ip}`, opts)) {
-            return c.json({ error: "Too Many Requests" }, 429);
-        }
-        if (fingerprintLimit) {
-            const fp = await buildFingerprint(c.req.raw);
-            if (await trackAttempt(`${prefix}fp:${fp}`, opts)) {
-                return c.json({ error: "Too Many Requests" }, 429);
-            }
-        }
-        await next();
-    };
-};

package/dist/middleware/requestId.d.ts

@@ -1,3 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import type { AppEnv } from "../lib/context";
-export declare const requestId: MiddlewareHandler<AppEnv>;

package/dist/middleware/scimAuth.d.ts

@@ -1,8 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import type { AppEnv } from "../lib/context";
-export declare function setScimTokens(tokens: string | string[]): void;
-/**
- * Middleware that validates SCIM bearer tokens.
- * Tokens are checked with timingSafeEqual to prevent timing attacks.
- */
-export declare const scimAuth: MiddlewareHandler<AppEnv>;

package/dist/middleware/scimAuth.js

@@ -1,29 +0,0 @@
-import { timingSafeEqual } from "../lib/crypto";
-import { HttpError } from "../lib/HttpError";
-let _scimTokens = [];
-export function setScimTokens(tokens) {
-    _scimTokens = Array.isArray(tokens) ? tokens : [tokens];
-}
-/**
- * Middleware that validates SCIM bearer tokens.
- * Tokens are checked with timingSafeEqual to prevent timing attacks.
- */
-export const scimAuth = async (c, next) => {
-    const authHeader = c.req.header("authorization") ?? "";
-    if (!authHeader.startsWith("Bearer ")) {
-        throw new HttpError(401, "SCIM bearer token required");
-    }
-    const provided = authHeader.slice(7);
-    const valid = _scimTokens.some((token) => {
-        try {
-            return timingSafeEqual(provided, token);
-        }
-        catch {
-            return false;
-        }
-    });
-    if (!valid) {
-        throw new HttpError(401, "Invalid SCIM token");
-    }
-    await next();
-};

package/dist/middleware/tenant.d.ts

@@ -1,5 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import type { AppEnv } from "../lib/context";
-import type { TenancyConfig } from "../app";
-export declare const invalidateTenantCache: (tenantId: string) => void;
-export declare const createTenantMiddleware: (config: TenancyConfig) => MiddlewareHandler<AppEnv>;

package/dist/middleware/upload.d.ts

@@ -1,5 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import type { AppEnv } from "../lib/context";
-import type { UploadOpts } from "../lib/upload";
-export type UploadMiddlewareOptions = UploadOpts;
-export declare const handleUpload: (opts?: UploadMiddlewareOptions) => MiddlewareHandler<AppEnv>;

package/dist/middleware/userAuth.d.ts

@@ -1,3 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import type { AppEnv } from "../lib/context";
-export declare const userAuth: MiddlewareHandler<AppEnv>;

package/dist/middleware/userAuth.js

@@ -1,6 +0,0 @@
-export const userAuth = async (c, next) => {
-    if (!c.get("authUserId")) {
-        return c.json({ error: "Unauthorized" }, 401);
-    }
-    await next();
-};

package/dist/models/AuditLog.d.ts

@@ -1,30 +0,0 @@
-import type { Document, Model } from "mongoose";
-interface IAuditLog {
-    /** UUID assigned by the caller — stable cross-store identifier. */
-    id: string;
-    userId: string | null;
-    sessionId: string | null;
-    tenantId: string | null;
-    method: string;
-    path: string;
-    status: number;
-    ip: string | null;
-    userAgent: string | null;
-    action?: string;
-    resource?: string;
-    resourceId?: string;
-    meta?: Record<string, unknown>;
-    createdAt: Date;
-    /**
-     * Optional TTL field. MongoDB will automatically delete the document
-     * once this date is in the past (via `expireAfterSeconds: 0` index).
-     */
-    expiresAt?: Date;
-}
-type AuditLogDocument = IAuditLog & Document;
-export declare const AuditLog: Model<AuditLogDocument, {}, {}, {}, Document<unknown, {}, AuditLogDocument, {}, import("mongoose").DefaultSchemaOptions> & IAuditLog & Document<import("mongoose").Types.ObjectId, any, any, Record<string, any>, {}> & Required<{
-    _id: import("mongoose").Types.ObjectId;
-}> & {
-    __v: number;
-}, any, AuditLogDocument>;
-export {};