@lastshotlabs/bunshot 0.0.27 → 0.1.0

package/dist/packages/bunshot-auth/src/config/authConfig.d.ts

@@ -0,0 +1,478 @@
+import type { CaptchaConfig } from '../../../bunshot-core/src/index.js';
+import type { EmailTemplate } from '../lib/emailTemplates';
+import type { SamlProfile } from '../types/saml';
+export type PrimaryField = 'email' | 'username' | 'phone';
+export interface ConcealRegistrationConfig {
+    /**
+     * Called when a registration attempt is made for an email that already exists.
+     * Use to notify the existing user (e.g. "Someone tried to register with your email").
+     * Only valid when primaryField === "email" — startup throws otherwise.
+     */
+    onExistingAccount?: (identifier: string) => Promise<void>;
+}
+export interface EmailVerificationConfig {
+    /** Block login until email is verified. Defaults to false (soft gate — emailVerified returned in login response). */
+    required?: boolean;
+    /** Token time-to-live in seconds. Defaults to 86 400 (24 hours). */
+    tokenExpiry?: number;
+}
+export interface PasswordResetConfig {
+    /** Token time-to-live in seconds. Defaults to 3 600 (1 hour). */
+    tokenExpiry?: number;
+}
+export interface MagicLinkConfig {
+    /** Token time-to-live in seconds. Defaults to 900 (15 min). */
+    ttlSeconds?: number;
+    /** Base URL for the magic link (e.g. "https://app.com/auth/magic"). */
+    linkBaseUrl?: string;
+    /** Store backend for magic link tokens. Defaults to the sessions store. */
+    store?: 'memory' | 'redis' | 'sqlite' | 'mongo';
+}
+export interface PasswordPolicyConfig {
+    /** Minimum password length. Defaults to 8. */
+    minLength?: number;
+    /** Require at least one letter (a-z or A-Z). Defaults to true. */
+    requireLetter?: boolean;
+    /** Require at least one digit (0-9). Defaults to true. */
+    requireDigit?: boolean;
+    /** Require at least one special character. Defaults to false. */
+    requireSpecial?: boolean;
+    /** Number of previous password hashes to remember. Prevents password reuse. Default: disabled (0). */
+    preventReuse?: number;
+}
+export interface AuthCookieConfig {
+    sameSite?: 'Strict' | 'Lax' | 'None';
+    secure?: boolean;
+    domain?: string;
+    path?: string;
+    /** Max age in seconds. Default: 604800 (7 days). */
+    maxAge?: number;
+}
+export interface CsrfCookieConfig {
+    sameSite?: 'Strict' | 'Lax' | 'None';
+    secure?: boolean;
+    domain?: string;
+    path?: string;
+    /** Max age in seconds. Default: 31536000 (1 year). */
+    maxAge?: number;
+}
+/** Minimal session policy shape stored in the config. Matches AuthSessionPolicyConfig in app.ts. */
+export interface SessionPolicySnapshot {
+    maxSessions?: number;
+    persistSessionMetadata?: boolean;
+    includeInactiveSessions?: boolean;
+    trackLastActive?: boolean;
+    absoluteTimeout?: number;
+    idleTimeout?: number;
+    onPasswordChange?: 'revoke_others' | 'revoke_all_and_reissue' | 'none';
+}
+export interface RefreshTokenConfig {
+    /** Access token expiry in seconds. Default: 900 (15 min). */
+    accessTokenExpiry?: number;
+    /** Refresh token expiry in seconds. Default: 2_592_000 (30 days). */
+    refreshTokenExpiry?: number;
+    /** Grace window in seconds where the old refresh token still works after rotation.
+     *  Prevents lockout when the client's network drops mid-refresh. Default: 30. */
+    rotationGraceSeconds?: number;
+}
+export interface MfaEmailOtpConfig {
+    /** OTP code length. Default: 6. */
+    codeLength?: number;
+}
+export interface MfaWebAuthnConfig {
+    /** Relying Party ID - typically the domain (e.g. "example.com"). Required. */
+    rpId: string;
+    /** Relying Party name shown in browser prompts. Defaults to app name. */
+    rpName?: string;
+    /** Expected origin(s) - full origin URL(s) like "https://example.com". Required. */
+    origin: string | string[];
+    /** Supported attestation conveyance preference. Default: "none". */
+    attestationType?: 'none' | 'direct' | 'enterprise';
+    /** Authenticator attachment preference. Default: undefined (allows both platform + cross-platform). */
+    authenticatorAttachment?: 'platform' | 'cross-platform';
+    /** User verification requirement. Default: "preferred". */
+    userVerification?: 'required' | 'preferred' | 'discouraged';
+    /** Timeout for ceremonies in milliseconds. Default: 60000 (60s). */
+    timeout?: number;
+    /** Reject authentication when sign count goes backward (cloned key detection). Default: false (accept + warn). */
+    strictSignCount?: boolean;
+    /** Allow passwordless (first-factor) passkey login. When true, mounts POST /auth/passkey/login-options and POST /auth/passkey/login. Default: false. */
+    allowPasswordlessLogin?: boolean;
+    /** When true (default), a verified passkey login satisfies MFA - no subsequent TOTP/OTP prompt even if the user has MFA enabled. Set false to require MFA after passkey login. */
+    passkeyMfaBypass?: boolean;
+}
+export interface MfaConfig {
+    /** Issuer name shown in authenticator apps. Defaults to app name. */
+    issuer?: string;
+    /** TOTP algorithm. Default: "SHA1" (most compatible). */
+    algorithm?: 'SHA1' | 'SHA256' | 'SHA512';
+    /** TOTP digits. Default: 6. */
+    digits?: number;
+    /** TOTP period in seconds. Default: 30. */
+    period?: number;
+    /** Number of recovery codes to generate. Default: 10. */
+    recoveryCodes?: number;
+    /** MFA challenge window in seconds. Default: 300 (5 min). */
+    challengeTtlSeconds?: number;
+    /** Email OTP configuration. When set, enables email-based MFA as an option. */
+    emailOtp?: MfaEmailOtpConfig;
+    /** WebAuthn/FIDO2 configuration. When set, enables security key MFA routes. */
+    webauthn?: MfaWebAuthnConfig;
+    /** When true, authenticated users must complete MFA setup before accessing non-auth endpoints. Default: false. */
+    required?: boolean;
+}
+export interface JwtConfig {
+    /** JWT issuer claim (`iss`). When set, added to all tokens and validated on verify. */
+    issuer?: string;
+    /** JWT audience claim (`aud`). When set, added to all tokens and validated on verify. */
+    audience?: string | string[];
+    /** JWT signing algorithm. Default: "HS256". Use "RS256" for OIDC. Requires OidcConfig when set to "RS256". */
+    algorithm?: 'HS256' | 'RS256';
+}
+export interface BreachedPasswordConfig {
+    /** Block registration/reset when password is breached. Default: true. */
+    block?: boolean;
+    /** Minimum breach count to consider breached. Default: 1. */
+    minBreachCount?: number;
+    /** Request timeout in ms. Default: 3000. */
+    timeout?: number;
+    /**
+     * What to do when the HIBP API is unavailable (timeout, network error, non-2xx).
+     * Default: `"allow"` (fail-open) — the password is accepted without a breach check.
+     *
+     * **Security note:** `"allow"` means an attacker who can block outbound HTTPS to
+     * api.pwnedpasswords.com can bypass this check entirely. Set to `"block"` for
+     * fail-closed behaviour: the registration or password-reset is rejected until the
+     * API is reachable again. Either way, a `security.breached_password.api_failure`
+     * event is emitted on every outage so you have observability regardless of policy.
+     */
+    onApiFailure?: 'allow' | 'block';
+}
+export interface OAuthReauthConfig {
+    /** Enable OAuth provider re-auth endpoints. Default: false. */
+    enabled?: boolean;
+    /**
+     * How to force re-authentication at the provider.
+     * - "login": force the user to re-enter credentials (default)
+     * - "consent": force a full consent screen (useful for Google/Microsoft)
+     * - "select_account": show account picker
+     */
+    promptType?: 'login' | 'consent' | 'select_account';
+}
+export interface StepUpConfig {
+    /** Max age in seconds since last MFA verification. Default: 300 (5 min). */
+    maxAge?: number;
+}
+export interface M2MConfig {
+    enabled?: boolean;
+    /** Access token expiry in seconds. Default: 3600 (1 hour). */
+    tokenExpiry?: number;
+    /** Allowed scopes for M2M clients. */
+    scopes?: string[];
+}
+export interface SamlConfig {
+    /** Service Provider entity ID (e.g. "https://yourapp.com/auth/saml"). */
+    entityId: string;
+    /** Assertion Consumer Service URL. */
+    acsUrl: string;
+    /** IdP metadata - XML string or URL. */
+    idpMetadata: string;
+    /** SP signing private key PEM. Optional. */
+    signingKey?: string;
+    /** SP signing certificate PEM. Optional. */
+    signingCert?: string;
+    /** Map IdP attribute names to profile fields. */
+    attributeMapping?: {
+        email?: string;
+        firstName?: string;
+        lastName?: string;
+        groups?: string;
+    };
+    /** Custom user lookup/creation. When provided, takes precedence over findOrCreateByProvider. */
+    onLogin?: (profile: SamlProfile) => Promise<{
+        userId: string;
+    }>;
+    /** Where to redirect after successful SAML login. Default: "/". */
+    postLoginRedirect?: string;
+}
+export interface OidcConfig {
+    enabled?: boolean;
+    /** JWT issuer - included in all tokens and OIDC discovery doc. Required. */
+    issuer: string;
+    /** RSA signing key. If not provided, a key pair is auto-generated on startup. */
+    signingKey?: {
+        privateKey: string;
+        publicKey: string;
+        kid?: string;
+    };
+    /** Previous signing keys for rotation (verification only). */
+    previousKeys?: Array<{
+        publicKey: string;
+        kid?: string;
+    }>;
+    /** Scopes advertised in the discovery document. Default: ["openid"]. */
+    scopes?: string[];
+    /** Token endpoint URL. Defaults to `${issuer}/oauth/token`. */
+    tokenEndpoint?: string;
+}
+export interface ScimConfig {
+    enabled?: boolean;
+    /** Bearer token(s) for SCIM endpoint authentication. Required. */
+    bearerTokens: string | string[];
+    /** Username mapping strategy. Default: "email". */
+    userMapping?: {
+        userName?: 'email' | 'username';
+    };
+    /** What to do when a user is deleted via SCIM. Default: "suspend". */
+    onDeprovision?: 'suspend' | 'delete' | ((userId: string) => Promise<void>);
+}
+export interface EmailTemplatesConfig {
+    /** App name used in all templates as {{appName}}. Falls back to the configured app name. */
+    appName?: string;
+    emailVerification?: Partial<EmailTemplate>;
+    passwordReset?: Partial<EmailTemplate>;
+    magicLink?: Partial<EmailTemplate>;
+    emailOtp?: Partial<EmailTemplate>;
+    welcomeEmail?: Partial<EmailTemplate>;
+    accountDeletion?: Partial<EmailTemplate>;
+    orgInvitation?: Partial<EmailTemplate>;
+}
+export interface BearerAuthClient {
+    /** Stable identifier for this API client (set on Hono context as `bearerClientId`). */
+    clientId: string;
+    /** The bearer token value. */
+    token: string;
+    /** Optional human-readable label (e.g. "CI/CD pipeline", "Mobile app"). */
+    description?: string;
+    /** When true, the token is rejected even if it matches. Soft-revoke without deletion. */
+    revoked?: boolean;
+}
+/**
+ * Bearer auth token config.
+ * - string: single token (legacy, env-var driven)
+ * - string[]: multiple tokens, no clientId tracking
+ * - BearerAuthClient[]: named clients with revocation and clientId context
+ */
+export type BearerAuthConfig = string | string[] | BearerAuthClient[];
+export interface HookContext {
+    ip?: string;
+    userAgent?: string;
+    requestId?: string;
+}
+export interface PostLoginResult {
+    customClaims?: Record<string, unknown>;
+}
+export interface AuthHooksConfig {
+    preRegister?: (data: {
+        identifier: string;
+    } & HookContext) => Promise<void>;
+    postRegister?: (data: {
+        userId: string;
+        identifier: string;
+    } & HookContext) => Promise<void>;
+    preLogin?: (data: {
+        identifier: string;
+    } & HookContext) => Promise<void>;
+    postLogin?: (data: {
+        userId: string;
+        sessionId: string;
+    } & HookContext) => Promise<PostLoginResult | void>;
+    prePasswordChange?: (data: {
+        userId: string;
+    } & HookContext) => Promise<void>;
+    postPasswordChange?: (data: {
+        userId: string;
+    } & HookContext) => Promise<void>;
+    preDeleteAccount?: (data: {
+        userId: string;
+    } & HookContext) => Promise<void>;
+    postDeleteAccount?: (data: {
+        userId: string;
+    } & HookContext) => Promise<void>;
+}
+export interface AuthRateLimitConfig {
+    /** Max login failures per window before the account is locked. Default: 10 per 15 min. */
+    login?: {
+        windowMs?: number;
+        max?: number;
+    };
+    /** Max registration attempts per IP per window. Default: 5 per hour. */
+    register?: {
+        windowMs?: number;
+        max?: number;
+    };
+    /** Max email verification attempts per IP per window. Default: 10 per 15 min. */
+    verifyEmail?: {
+        windowMs?: number;
+        max?: number;
+    };
+    /** Max resend-verification attempts per user per window. Default: 3 per hour. */
+    resendVerification?: {
+        windowMs?: number;
+        max?: number;
+    };
+    /** Max forgot-password requests per IP per window. Default: 5 per 15 min. */
+    forgotPassword?: {
+        windowMs?: number;
+        max?: number;
+    };
+    /** Max reset-password attempts per IP per window. Default: 10 per 15 min. */
+    resetPassword?: {
+        windowMs?: number;
+        max?: number;
+    };
+    /** Max account deletion attempts per user per window. Default: 3 per hour. */
+    deleteAccount?: {
+        windowMs?: number;
+        max?: number;
+    };
+    /** Max MFA verification attempts per IP per window. Default: 10 per 15 min. */
+    mfaVerify?: {
+        windowMs?: number;
+        max?: number;
+    };
+    /** Max email OTP initiation attempts per user per window. Default: 3 per 15 min. */
+    mfaEmailOtpInitiate?: {
+        windowMs?: number;
+        max?: number;
+    };
+    /** Max MFA email OTP resend attempts per IP per window. Default: 5 per minute. */
+    mfaResend?: {
+        windowMs?: number;
+        max?: number;
+    };
+    /** Max set-password (change password) attempts per user per window. Default: 5 per 15 min. */
+    setPassword?: {
+        windowMs?: number;
+        max?: number;
+    };
+    /** Max MFA disable attempts per user per window. Default: 5 per 15 min. */
+    mfaDisable?: {
+        windowMs?: number;
+        max?: number;
+    };
+    /** Max OAuth provider unlink attempts per user per window. Default: 5 per hour. */
+    oauthUnlink?: {
+        windowMs?: number;
+        max?: number;
+    };
+    /**
+     * Store backend for auth rate limit counters.
+     * Defaults to "redis" when Redis is enabled, otherwise "memory".
+     * Use "redis" for multi-instance deployments so limits are shared across servers.
+     */
+    store?: 'memory' | 'redis';
+    /** Credential stuffing detection. Tracks distinct accounts per IP and IPs per account. */
+    credentialStuffing?: {
+        maxAccountsPerIp?: {
+            count: number;
+            windowMs: number;
+        };
+        maxIpsPerAccount?: {
+            count: number;
+            windowMs: number;
+        };
+        onDetected?: (signal: {
+            type: 'ip' | 'account';
+            key: string;
+            count: number;
+        }) => void;
+    };
+}
+export interface AccountDeletionConfig {
+    /** Called before deletion. Throw to abort (e.g., active subscription check). */
+    onBeforeDelete?: (userId: string) => Promise<void>;
+    /** Called after auth data is deleted. Runs at execution time — query current state, not a snapshot. */
+    onAfterDelete?: (userId: string) => Promise<void>;
+    /** When true, deletion is queued as a BullMQ job instead of running synchronously. Requires Redis + BullMQ. */
+    queued?: boolean;
+    /** Grace period in seconds before queued deletion executes. Default: 0 (immediate). */
+    gracePeriod?: number;
+    /**
+     * When true, OAuth-only accounts (no password, no MFA) cannot delete their account via DELETE /auth/me
+     * because there is no verifiable factor. They must set a password or enable MFA first.
+     * When false (default), OAuth-only accounts can delete without verification.
+     */
+    requireVerification?: boolean;
+}
+export interface AuthSessionPolicyConfig {
+    /** Max simultaneous active sessions per user. Oldest is evicted when exceeded. Default: 6. */
+    maxSessions?: number;
+    /**
+     * Retain session metadata (IP, user-agent, timestamps) after a session expires or is deleted.
+     * Enables future novel-device/location detection. Default: true.
+     */
+    persistSessionMetadata?: boolean;
+    /**
+     * Include inactive (expired/deleted) sessions in GET /auth/sessions.
+     * Only meaningful when persistSessionMetadata is true. Default: false.
+     */
+    includeInactiveSessions?: boolean;
+    /**
+     * Update lastActiveAt on every authenticated request.
+     * Adds one DB write per auth'd request. Default: false.
+     * Automatically enabled when idleTimeout is set.
+     */
+    trackLastActive?: boolean;
+    /**
+     * Absolute session TTL in seconds. Sessions expire this long after creation regardless of activity.
+     * Default: 604800 (7 days). Also controls the auth cookie maxAge when not overridden by cookieConfig.
+     */
+    absoluteTimeout?: number;
+    /**
+     * Idle timeout in seconds. Sessions are revoked when lastActiveAt is older than this value.
+     * Requires trackLastActive to be meaningful — automatically enables it when set.
+     * Refresh token rotation counts as activity (rotateRefreshToken updates lastActiveAt).
+     */
+    idleTimeout?: number;
+    /**
+     * What to do with sessions after a successful password change via POST /auth/set-password.
+     * - "revoke_others" (default): revoke all sessions except the current one
+     * - "revoke_all_and_reissue": revoke all sessions, create a new session, return new token
+     * - "none": do nothing (not recommended)
+     */
+    onPasswordChange?: 'revoke_others' | 'revoke_all_and_reissue' | 'none';
+}
+/**
+ * Read-only snapshot of all auth config values. Built once during bootstrap,
+ * deep-frozen and attached to the runtime context.
+ */
+export interface AuthResolvedConfig {
+    readonly appName: string;
+    readonly appRoles: readonly string[];
+    readonly defaultRole: string | null;
+    readonly primaryField: PrimaryField;
+    readonly concealRegistration: Readonly<ConcealRegistrationConfig> | null;
+    readonly emailVerification: Readonly<EmailVerificationConfig> | null;
+    readonly passwordReset: Readonly<PasswordResetConfig> | null;
+    readonly magicLink: Readonly<MagicLinkConfig> | null;
+    readonly passwordPolicy: Readonly<PasswordPolicyConfig>;
+    readonly authCookie: Readonly<AuthCookieConfig>;
+    readonly csrfCookie: Readonly<CsrfCookieConfig>;
+    readonly maxSessions: number;
+    readonly persistSessionMetadata: boolean;
+    readonly includeInactiveSessions: boolean;
+    readonly trackLastActive: boolean;
+    readonly sessionPolicy: Readonly<SessionPolicySnapshot>;
+    readonly refreshToken: Readonly<RefreshTokenConfig> | null;
+    readonly mfa: Readonly<MfaConfig> | null;
+    readonly csrfEnabled: boolean;
+    readonly jwt: Readonly<JwtConfig> | null;
+    readonly breachedPassword: Readonly<BreachedPasswordConfig> | null;
+    readonly oauthReauth: Readonly<OAuthReauthConfig> | null;
+    readonly stepUp: Readonly<StepUpConfig> | null;
+    readonly checkSuspensionOnIdentify: boolean;
+    readonly captcha: Readonly<CaptchaConfig> | null;
+    readonly m2m: Readonly<M2MConfig> | null;
+    readonly saml: Readonly<SamlConfig> | null;
+    readonly oidc: Readonly<OidcConfig> | null;
+    readonly scim: Readonly<ScimConfig> | null;
+    readonly emailTemplates: Readonly<EmailTemplatesConfig> | null;
+    readonly hooks: Readonly<AuthHooksConfig>;
+}
+export declare const DEFAULT_AUTH_CONFIG: AuthResolvedConfig;
+/**
+ * Build a resolved auth config by merging partial overrides onto defaults.
+ * The returned config is deep-frozen.
+ */
+export declare function buildAuthResolvedConfig(overrides: Partial<AuthResolvedConfig>): AuthResolvedConfig;

package/dist/packages/bunshot-auth/src/config/authConfig.js

@@ -0,0 +1,46 @@
+import { deepFreeze } from './configLock';
+// ---------------------------------------------------------------------------
+// Default config — immutable baseline
+// ---------------------------------------------------------------------------
+export const DEFAULT_AUTH_CONFIG = Object.freeze({
+    appName: 'Core API',
+    appRoles: [],
+    defaultRole: null,
+    primaryField: 'email',
+    concealRegistration: null,
+    emailVerification: null,
+    passwordReset: null,
+    magicLink: null,
+    passwordPolicy: {},
+    authCookie: {},
+    csrfCookie: {},
+    maxSessions: 6,
+    persistSessionMetadata: true,
+    includeInactiveSessions: false,
+    trackLastActive: false,
+    sessionPolicy: {},
+    refreshToken: null,
+    mfa: null,
+    csrfEnabled: false,
+    jwt: null,
+    breachedPassword: null,
+    oauthReauth: null,
+    stepUp: null,
+    checkSuspensionOnIdentify: false,
+    captcha: null,
+    m2m: null,
+    saml: null,
+    oidc: null,
+    scim: null,
+    emailTemplates: null,
+    hooks: {},
+});
+/**
+ * Build a resolved auth config by merging partial overrides onto defaults.
+ * The returned config is deep-frozen.
+ */
+export function buildAuthResolvedConfig(overrides) {
+    const config = { ...DEFAULT_AUTH_CONFIG, ...overrides };
+    deepFreeze(config);
+    return config;
+}

package/dist/packages/bunshot-auth/src/config/configLock.d.ts

@@ -0,0 +1,2 @@
+/** Deep-freeze an object and all nested objects. */
+export declare function deepFreeze<T extends object>(obj: T): Readonly<T>;

package/dist/packages/bunshot-auth/src/config/configLock.js

@@ -0,0 +1,10 @@
+/** Deep-freeze an object and all nested objects. */
+export function deepFreeze(obj) {
+    Object.freeze(obj);
+    for (const value of Object.values(obj)) {
+        if (value !== null && typeof value === 'object' && !Object.isFrozen(value)) {
+            deepFreeze(value);
+        }
+    }
+    return obj;
+}

package/dist/packages/bunshot-auth/src/index.d.ts

@@ -0,0 +1,25 @@
+export { createAuthPlugin } from './plugin';
+export type { ResolvedStores } from './types/adapter';
+export { authPluginConfigSchema } from './types/config';
+export type { AuthPluginConfig, AuthDbConfig, AuthSecurityConfig, StoreType, AuthConfig, OAuthConfig, } from './types/config';
+export { signToken, verifyToken } from './lib/jwt';
+export { createSession, getSession, deleteSession, getUserSessions, getActiveSessionCount, evictOldestSession, updateSessionLastActive, setRefreshToken, getSessionByRefreshToken, rotateRefreshToken, getSessionFingerprint, setSessionFingerprint, setMfaVerifiedAt, getMfaVerifiedAt, sessionFactories, createSqliteSessionRepository, createRedisSessionRepository, createMongoSessionRepository, } from './lib/session';
+export type { SessionStore } from './lib/session';
+export type { AuthAdapter, IdentityProfile, UserRecord, UserQuery, WebAuthnCredential, } from './lib/authAdapter';
+export type { CoreAuthAdapter, OAuthAdapter, MfaAdapter, WebAuthnAdapter, RolesAdapter, GroupsAdapter, SuspensionAdapter, EnterpriseAdapter, } from './lib/adapterTiers';
+export { validateAdapterCapabilities } from './lib/validateAdapter';
+export type { AdapterValidationConfig } from './lib/validateAdapter';
+export { createMemoryAuthAdapter } from './adapters/memoryAuth';
+export type { MemoryAuthStores } from './adapters/memoryAuth';
+export { createMongoAuthAdapter } from './adapters/mongoAuth';
+export { createSqliteAuthAdapter } from './adapters/sqliteAuth';
+export { renderTemplate, templates } from './lib/emailTemplates';
+export type { EmailTemplate, TemplateVariables } from './lib/emailTemplates';
+export { buildAuthResolvedConfig } from './config/authConfig';
+export type { AuthResolvedConfig } from './config/authConfig';
+export { wireSecurityEventConfig } from './lib/securityEventWiring';
+export type { SecurityEventsConfig, SecurityEvent } from './lib/securityEventWiring';
+export { getAuthRuntimeContext, getAuthRuntimeFromRequest } from './runtime';
+export type { AuthRuntimeContext } from './runtime';
+export { createBunshotAuthAccessProvider } from './admin/bunshotAccess';
+export { createBunshotManagedUserProvider } from './admin/bunshotUsers';

package/dist/packages/bunshot-auth/src/index.js

@@ -0,0 +1,23 @@
+// packages/bunshot-auth/src/index.ts — Public API for @lastshotlabs/bunshot-auth
+// Plugin factory
+export { createAuthPlugin } from './plugin';
+export { authPluginConfigSchema } from './types/config';
+// Session / JWT
+export { signToken, verifyToken } from './lib/jwt';
+export { createSession, getSession, deleteSession, getUserSessions, getActiveSessionCount, evictOldestSession, updateSessionLastActive, setRefreshToken, getSessionByRefreshToken, rotateRefreshToken, getSessionFingerprint, setSessionFingerprint, setMfaVerifiedAt, getMfaVerifiedAt, sessionFactories, createSqliteSessionRepository, createRedisSessionRepository, createMongoSessionRepository, } from './lib/session';
+export { validateAdapterCapabilities } from './lib/validateAdapter';
+// Built-in adapters
+export { createMemoryAuthAdapter } from './adapters/memoryAuth';
+export { createMongoAuthAdapter } from './adapters/mongoAuth';
+export { createSqliteAuthAdapter } from './adapters/sqliteAuth';
+// Email templates
+export { renderTemplate, templates } from './lib/emailTemplates';
+// Config
+export { buildAuthResolvedConfig } from './config/authConfig';
+// Event bus utilities
+export { wireSecurityEventConfig } from './lib/securityEventWiring';
+// Runtime context
+export { getAuthRuntimeContext, getAuthRuntimeFromRequest } from './runtime';
+// Admin providers (moved from framework root)
+export { createBunshotAuthAccessProvider } from './admin/bunshotAccess';
+export { createBunshotManagedUserProvider } from './admin/bunshotUsers';

package/dist/packages/bunshot-auth/src/infra/mongo.d.ts

@@ -0,0 +1,15 @@
+import type { Connection, Mongoose } from 'mongoose';
+/**
+ * Lazily require mongoose if not provided explicitly.
+ */
+export declare function resolveMongoose(mg?: Mongoose): Mongoose;
+/**
+ * Create a proxy-based connection accessor that lazily resolves to the actual connection.
+ * Returns a Proxy that allows model registration at module load time before connections
+ * are established.
+ */
+export declare function makeConnectionProxy(label: string, getConn: () => Connection | null, mongooseInstance?: Mongoose): Connection;
+/**
+ * Create a mongoose proxy that lazily resolves the mongoose instance.
+ */
+export declare function makeMongooseProxy(getMongoose: () => Mongoose): Mongoose;

package/dist/packages/bunshot-auth/src/infra/mongo.js

@@ -0,0 +1,44 @@
+/**
+ * Lazily require mongoose if not provided explicitly.
+ */
+export function resolveMongoose(mg) {
+    if (mg)
+        return mg;
+    try {
+        const mod = require('mongoose');
+        return mod.default ?? mod;
+    }
+    catch {
+        throw new Error('mongoose is not installed. Run: bun add mongoose');
+    }
+}
+/**
+ * Create a proxy-based connection accessor that lazily resolves to the actual connection.
+ * Returns a Proxy that allows model registration at module load time before connections
+ * are established.
+ */
+export function makeConnectionProxy(label, getConn, mongooseInstance) {
+    return new Proxy({}, {
+        get(_, prop) {
+            let conn = getConn();
+            if (!conn) {
+                // Lazily create a disconnected connection so .model() works at import time
+                const mg = resolveMongoose(mongooseInstance);
+                conn = mg.createConnection();
+            }
+            const val = conn[prop];
+            return typeof val === 'function' ? val.bind(conn) : val;
+        },
+    });
+}
+/**
+ * Create a mongoose proxy that lazily resolves the mongoose instance.
+ */
+export function makeMongooseProxy(getMongoose) {
+    return new Proxy({}, {
+        get(_, prop) {
+            const mg = getMongoose();
+            return mg[prop];
+        },
+    });
+}

package/dist/packages/bunshot-auth/src/infra/queue.d.ts

@@ -0,0 +1,14 @@
+import type { ConnectionOptions, Job, Processor, QueueOptions, Queue as QueueType, WorkerOptions, Worker as WorkerType } from 'bullmq';
+import type * as IORedis from 'ioredis';
+export interface AuthQueueFactory {
+    createQueue<T = unknown, R = unknown>(name: string, options?: Omit<QueueOptions, 'connection'>): AuthQueue<T, R>;
+    createWorker<T = unknown, R = unknown>(name: string, processor: Processor<T, R>, options?: Omit<WorkerOptions, 'connection'>): WorkerType<T, R>;
+}
+type BullMQRedisConnection = ConnectionOptions & IORedis.Redis;
+type AuthQueue<T, R> = QueueType<T, R, string, T, R, string>;
+/**
+ * Create a queue factory that captures Redis connection info once.
+ * All queues and workers created from this factory share the same connection.
+ */
+export declare function createQueueFactory(getRedis: () => BullMQRedisConnection): AuthQueueFactory;
+export type { Job };