@lastshotlabs/bunshot 0.0.6 → 0.0.8

package/dist/middleware/logger.js

@@ -0,0 +1,7 @@
+export const logger = async (req, next) => {
+    const start = performance.now();
+    const res = await next(req);
+    const ms = (performance.now() - start).toFixed(2);
+    console.log(`${req.method} ${new URL(req.url).pathname} ${res.status} ${ms}ms`);
+    return res;
+};

package/dist/middleware/rateLimit.js

@@ -0,0 +1,20 @@
+import { trackAttempt } from "../lib/authRateLimit";
+import { buildFingerprint } from "../lib/fingerprint";
+export const rateLimit = ({ windowMs, max, fingerprintLimit = false, }) => {
+    const opts = { windowMs, max };
+    return async (c, next) => {
+        // Take the leftmost (client) IP from x-forwarded-for
+        const raw = c.req.header("x-forwarded-for") ?? "";
+        const ip = raw.split(",")[0]?.trim() || "unknown";
+        if (await trackAttempt(`ip:${ip}`, opts)) {
+            return c.json({ error: "Too Many Requests" }, 429);
+        }
+        if (fingerprintLimit) {
+            const fp = await buildFingerprint(c.req.raw);
+            if (await trackAttempt(`fp:${fp}`, opts)) {
+                return c.json({ error: "Too Many Requests" }, 429);
+            }
+        }
+        await next();
+    };
+};

package/dist/middleware/requireRole.js

@@ -0,0 +1,36 @@
+import { getAuthAdapter } from "../lib/authAdapter";
+/**
+ * Middleware factory that enforces role-based access.
+ * Requires `identify` to have run first (authUserId must be set).
+ * Roles are fetched lazily on the first role-checked route and cached on the context.
+ *
+ * The adapter must implement `getRoles` for this to work.
+ *
+ * @example
+ * // Allow any authenticated user with the "admin" role
+ * app.get("/admin", userAuth, requireRole("admin"), handler)
+ *
+ * // Allow users with either "admin" or "moderator"
+ * app.get("/mod", userAuth, requireRole("admin", "moderator"), handler)
+ */
+export const requireRole = (...roles) => async (c, next) => {
+    const userId = c.get("authUserId");
+    if (!userId) {
+        return c.json({ error: "Unauthorized" }, 401);
+    }
+    // Lazy-fetch roles and cache on context so multiple requireRole calls in a chain only hit the adapter once
+    let userRoles = c.get("roles");
+    if (userRoles === null) {
+        const adapter = getAuthAdapter();
+        if (!adapter.getRoles) {
+            throw new Error("requireRole used but auth adapter does not implement getRoles");
+        }
+        userRoles = await adapter.getRoles(userId);
+        c.set("roles", userRoles);
+    }
+    const hasRole = roles.some((role) => userRoles.includes(role));
+    if (!hasRole) {
+        return c.json({ error: "Forbidden" }, 403);
+    }
+    await next();
+};

package/dist/middleware/requireVerifiedEmail.js

@@ -0,0 +1,25 @@
+import { getAuthAdapter } from "../lib/authAdapter";
+/**
+ * Middleware that blocks access for users whose email address has not been verified.
+ * Must run after `userAuth` (requires `authUserId` to be set on context).
+ *
+ * The adapter must implement `getEmailVerified` for this to work.
+ *
+ * @example
+ * router.use("/dashboard", userAuth, requireVerifiedEmail);
+ */
+export const requireVerifiedEmail = async (c, next) => {
+    const userId = c.get("authUserId");
+    if (!userId) {
+        return c.json({ error: "Unauthorized" }, 401);
+    }
+    const adapter = getAuthAdapter();
+    if (!adapter.getEmailVerified) {
+        throw new Error("requireVerifiedEmail used but auth adapter does not implement getEmailVerified");
+    }
+    const verified = await adapter.getEmailVerified(userId);
+    if (!verified) {
+        return c.json({ error: "Email not verified" }, 403);
+    }
+    await next();
+};

package/dist/middleware/userAuth.js

@@ -0,0 +1,6 @@
+export const userAuth = async (c, next) => {
+    if (!c.get("authUserId")) {
+        return c.json({ error: "Unauthorized" }, 401);
+    }
+    await next();
+};

package/dist/models/AuthUser.js

@@ -0,0 +1,14 @@
+import mongoose from "mongoose";
+import { authConnection } from "../lib/mongo";
+const AuthUserSchema = new mongoose.Schema({
+    email: { type: String, unique: true, sparse: true, lowercase: true },
+    password: { type: String },
+    /** Compound provider keys: ["google:123456", "apple:000111"] */
+    providerIds: [{ type: String }],
+    /** App-defined roles assigned to this user: ["admin", "editor", ...] */
+    roles: [{ type: String }],
+    /** Whether the user's email address has been verified. */
+    emailVerified: { type: Boolean, default: false },
+}, { timestamps: true });
+AuthUserSchema.index({ providerIds: 1 });
+export const AuthUser = authConnection.model("AuthUser", AuthUserSchema);

package/dist/routes/auth.js

@@ -0,0 +1,207 @@
+import { createRoute } from "@hono/zod-openapi";
+import { z } from "zod";
+import { setCookie, getCookie, deleteCookie } from "hono/cookie";
+import * as AuthService from "../services/auth";
+import { makeRegisterSchema, makeLoginSchema } from "../schemas/auth";
+import { COOKIE_TOKEN, HEADER_USER_TOKEN } from "../lib/constants";
+import { userAuth } from "../middleware/userAuth";
+import { isLimited, trackAttempt, bustAuthLimit } from "../lib/authRateLimit";
+import { getAuthAdapter } from "../lib/authAdapter";
+import { createRouter } from "../lib/context";
+import { getVerificationToken, deleteVerificationToken, createVerificationToken } from "../lib/emailVerification";
+const isProd = process.env.NODE_ENV === "production";
+const TokenResponse = z.object({ token: z.string(), emailVerified: z.boolean().optional() });
+const ErrorResponse = z.object({ error: z.string() });
+const tags = ["Auth"];
+const cookieOptions = {
+    httpOnly: true,
+    secure: isProd,
+    sameSite: "Lax",
+    path: "/",
+    maxAge: 60 * 60 * 24 * 7, // 7 days
+};
+export const createAuthRouter = ({ primaryField, emailVerification, rateLimit }) => {
+    const router = createRouter();
+    const RegisterSchema = makeRegisterSchema(primaryField);
+    const LoginSchema = makeLoginSchema(primaryField);
+    const fieldLabel = primaryField.charAt(0).toUpperCase() + primaryField.slice(1);
+    const alreadyRegisteredMsg = `${fieldLabel} already registered`;
+    // Resolve limits with defaults
+    const loginOpts = { windowMs: rateLimit?.login?.windowMs ?? 15 * 60 * 1000, max: rateLimit?.login?.max ?? 10 };
+    const registerOpts = { windowMs: rateLimit?.register?.windowMs ?? 60 * 60 * 1000, max: rateLimit?.register?.max ?? 5 };
+    const verifyOpts = { windowMs: rateLimit?.verifyEmail?.windowMs ?? 15 * 60 * 1000, max: rateLimit?.verifyEmail?.max ?? 10 };
+    const resendOpts = { windowMs: rateLimit?.resendVerification?.windowMs ?? 60 * 60 * 1000, max: rateLimit?.resendVerification?.max ?? 3 };
+    router.openapi(createRoute({
+        method: "post",
+        path: "/auth/register",
+        tags,
+        request: { body: { content: { "application/json": { schema: RegisterSchema } } } },
+        responses: {
+            201: { content: { "application/json": { schema: TokenResponse } }, description: "Registered" },
+            400: { content: { "application/json": { schema: ErrorResponse } }, description: "Validation error" },
+            409: { content: { "application/json": { schema: ErrorResponse } }, description: alreadyRegisteredMsg },
+            429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many attempts" },
+        },
+    }), async (c) => {
+        const ip = c.req.header("x-forwarded-for") ?? "unknown";
+        if (await trackAttempt(`register:${ip}`, registerOpts)) {
+            return c.json({ error: "Too many registration attempts. Try again later." }, 429);
+        }
+        const body = c.req.valid("json");
+        const identifier = body[primaryField];
+        const token = await AuthService.register(identifier, body.password);
+        setCookie(c, COOKIE_TOKEN, token, cookieOptions);
+        return c.json({ token }, 201);
+    });
+    router.openapi(createRoute({
+        method: "post",
+        path: "/auth/login",
+        tags,
+        request: { body: { content: { "application/json": { schema: LoginSchema } } } },
+        responses: {
+            200: { content: { "application/json": { schema: TokenResponse } }, description: "Logged in" },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Invalid credentials" },
+            403: { content: { "application/json": { schema: ErrorResponse } }, description: "Email not verified" },
+            429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many attempts" },
+        },
+    }), async (c) => {
+        const body = c.req.valid("json");
+        const identifier = body[primaryField];
+        const limitKey = `login:${identifier}`;
+        if (await isLimited(limitKey, loginOpts)) {
+            return c.json({ error: "Too many failed login attempts. Try again later." }, 429);
+        }
+        try {
+            const result = await AuthService.login(identifier, body.password);
+            await bustAuthLimit(limitKey); // success — clear failure count
+            setCookie(c, COOKIE_TOKEN, result.token, cookieOptions);
+            return c.json(result, 200);
+        }
+        catch (err) {
+            await trackAttempt(limitKey, loginOpts); // failure — count it
+            throw err;
+        }
+    });
+    router.use("/auth/me", userAuth);
+    router.openapi(createRoute({
+        method: "get",
+        path: "/auth/me",
+        tags,
+        responses: {
+            200: {
+                content: {
+                    "application/json": {
+                        schema: z.object({
+                            userId: z.string(),
+                            email: z.string().optional(),
+                            emailVerified: z.boolean().optional(),
+                            googleLinked: z.boolean().optional(),
+                        }),
+                    },
+                },
+                description: "Current user",
+            },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized" },
+        },
+    }), async (c) => {
+        const authUserId = c.get("authUserId");
+        const adapter = getAuthAdapter();
+        const user = adapter.getUser ? await adapter.getUser(authUserId) : null;
+        const googleLinked = user?.providerIds?.some((id) => id.startsWith("google:")) ?? false;
+        return c.json({ userId: authUserId, email: user?.email, emailVerified: user?.emailVerified, googleLinked }, 200);
+    });
+    router.use("/auth/set-password", userAuth);
+    router.openapi(createRoute({
+        method: "post",
+        path: "/auth/set-password",
+        tags,
+        request: { body: { content: { "application/json": { schema: z.object({ password: z.string().min(8) }) } } } },
+        responses: {
+            200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Password set" },
+            400: { content: { "application/json": { schema: ErrorResponse } }, description: "Validation error" },
+            501: { content: { "application/json": { schema: ErrorResponse } }, description: "Not supported by adapter" },
+        },
+    }), async (c) => {
+        const adapter = getAuthAdapter();
+        if (!adapter.setPassword) {
+            return c.json({ error: "Auth adapter does not support setPassword" }, 501);
+        }
+        const { password } = c.req.valid("json");
+        const authUserId = c.get("authUserId");
+        const passwordHash = await Bun.password.hash(password);
+        await adapter.setPassword(authUserId, passwordHash);
+        return c.json({ message: "Password updated" }, 200);
+    });
+    router.openapi(createRoute({
+        method: "post",
+        path: "/auth/logout",
+        tags,
+        responses: {
+            200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Logged out" },
+        },
+    }), async (c) => {
+        const token = getCookie(c, COOKIE_TOKEN) ?? c.req.header(HEADER_USER_TOKEN) ?? null;
+        await AuthService.logout(token);
+        deleteCookie(c, COOKIE_TOKEN, { path: "/" });
+        return c.json({ message: "Logged out" }, 200);
+    });
+    // Email verification routes — only mounted when emailVerification is configured and primaryField is "email"
+    if (emailVerification && primaryField === "email") {
+        router.openapi(createRoute({
+            method: "post",
+            path: "/auth/verify-email",
+            tags,
+            request: { body: { content: { "application/json": { schema: z.object({ token: z.string() }) } } } },
+            responses: {
+                200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Email verified" },
+                400: { content: { "application/json": { schema: ErrorResponse } }, description: "Invalid or expired token" },
+                429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many attempts" },
+            },
+        }), async (c) => {
+            const ip = c.req.header("x-forwarded-for") ?? "unknown";
+            if (await trackAttempt(`verify:${ip}`, verifyOpts)) {
+                return c.json({ error: "Too many verification attempts. Try again later." }, 429);
+            }
+            const { token } = c.req.valid("json");
+            const adapter = getAuthAdapter();
+            const entry = await getVerificationToken(token);
+            if (!entry)
+                return c.json({ error: "Invalid or expired verification token" }, 400);
+            if (adapter.setEmailVerified)
+                await adapter.setEmailVerified(entry.userId, true);
+            await deleteVerificationToken(token);
+            return c.json({ message: "Email verified" }, 200);
+        });
+        router.use("/auth/resend-verification", userAuth);
+        router.openapi(createRoute({
+            method: "post",
+            path: "/auth/resend-verification",
+            tags,
+            responses: {
+                200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Verification email sent" },
+                400: { content: { "application/json": { schema: ErrorResponse } }, description: "Already verified" },
+                429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many attempts" },
+                501: { content: { "application/json": { schema: ErrorResponse } }, description: "Not supported by adapter" },
+            },
+        }), async (c) => {
+            const adapter = getAuthAdapter();
+            if (!adapter.getEmailVerified || !adapter.getUser) {
+                return c.json({ error: "Auth adapter does not support email verification" }, 501);
+            }
+            const authUserId = c.get("authUserId");
+            if (await trackAttempt(`resend:${authUserId}`, resendOpts)) {
+                return c.json({ error: "Too many resend attempts. Try again later." }, 429);
+            }
+            const alreadyVerified = await adapter.getEmailVerified(authUserId);
+            if (alreadyVerified)
+                return c.json({ error: "Email already verified" }, 400);
+            const user = await adapter.getUser(authUserId);
+            if (!user?.email)
+                return c.json({ error: "No email address on file" }, 400);
+            const verificationToken = await createVerificationToken(authUserId, user.email);
+            await emailVerification.onSend(user.email, verificationToken);
+            return c.json({ message: "Verification email sent" }, 200);
+        });
+    }
+    return router;
+};

package/dist/routes/health.js

@@ -0,0 +1,22 @@
+import { createRoute } from "@hono/zod-openapi";
+import { z } from "zod";
+import { createRouter } from "../lib/context";
+export const router = createRouter();
+router.openapi(createRoute({
+    method: "get",
+    path: "/health",
+    tags: ["Core"],
+    responses: {
+        200: {
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        status: z.enum(["ok"]),
+                        timestamp: z.string(),
+                    }),
+                },
+            },
+            description: "Service health check",
+        },
+    },
+}), (c) => c.json({ status: "ok", timestamp: new Date().toISOString() }));

package/dist/routes/home.js

@@ -0,0 +1,16 @@
+import { createRoute } from "@hono/zod-openapi";
+import { z } from "zod";
+import { getAppName } from "../lib/appConfig";
+import { createRouter } from "../lib/context";
+export const router = createRouter();
+router.openapi(createRoute({
+    method: "get",
+    path: "/",
+    tags: ["Core"],
+    responses: {
+        200: {
+            content: { "application/json": { schema: z.object({ message: z.string() }) } },
+            description: "API is running",
+        },
+    },
+}), (c) => c.json({ message: `${getAppName()} is running` }));

package/dist/routes/oauth.js

@@ -0,0 +1,150 @@
+import { createRouter } from "../lib/context";
+import { setCookie } from "hono/cookie";
+import { decodeIdToken } from "arctic";
+import { getGoogle, getApple, storeOAuthState, consumeOAuthState, generateState, generateCodeVerifier, } from "../lib/oauth";
+import { getAuthAdapter } from "../lib/authAdapter";
+import { HttpError } from "../lib/HttpError";
+import { signToken } from "../lib/jwt";
+import { createSession } from "../lib/session";
+import { COOKIE_TOKEN } from "../lib/constants";
+import { userAuth } from "../middleware/userAuth";
+import { getDefaultRole } from "../lib/appConfig";
+const isProd = process.env.NODE_ENV === "production";
+const cookieOptions = {
+    httpOnly: true,
+    secure: isProd,
+    sameSite: "Lax",
+    path: "/",
+    maxAge: 60 * 60 * 24 * 7,
+};
+const finishOAuth = async (c, provider, providerId, profile, postLoginRedirect) => {
+    const adapter = getAuthAdapter();
+    if (!adapter.findOrCreateByProvider) {
+        return c.json({ error: "Auth adapter does not support social login" }, 500);
+    }
+    let user;
+    try {
+        user = await adapter.findOrCreateByProvider(provider, providerId, profile);
+    }
+    catch (err) {
+        const message = err instanceof HttpError ? err.message : "Authentication failed";
+        const sep = postLoginRedirect.includes("?") ? "&" : "?";
+        return c.redirect(`${postLoginRedirect}${sep}error=${encodeURIComponent(message)}`);
+    }
+    if (user.created) {
+        const role = getDefaultRole();
+        if (role && adapter.setRoles)
+            await adapter.setRoles(user.id, [role]);
+    }
+    const token = await signToken(user.id);
+    await createSession(user.id, token);
+    setCookie(c, COOKIE_TOKEN, token, cookieOptions);
+    // Append token to redirect so non-browser clients (mobile deep links) can extract it.
+    // Browser apps can safely ignore the query param.
+    try {
+        const url = new URL(postLoginRedirect);
+        url.searchParams.set("token", token);
+        if (profile.email)
+            url.searchParams.set("user", profile.email);
+        return c.redirect(url.toString());
+    }
+    catch {
+        // Relative path fallback
+        const sep = postLoginRedirect.includes("?") ? "&" : "?";
+        const userParam = profile.email ? `&user=${encodeURIComponent(profile.email)}` : "";
+        return c.redirect(`${postLoginRedirect}${sep}token=${token}${userParam}`);
+    }
+};
+export const createOAuthRouter = (providers, postLoginRedirect) => {
+    const router = createRouter();
+    // ─── Google ───────────────────────────────────────────────────────────────
+    if (providers.includes("google")) {
+        router.get("/auth/google", async (c) => {
+            const state = generateState();
+            const codeVerifier = generateCodeVerifier();
+            await storeOAuthState(state, codeVerifier);
+            const url = getGoogle().createAuthorizationURL(state, codeVerifier, ["openid", "profile", "email"]);
+            return c.redirect(url.toString());
+        });
+        router.get("/auth/google/callback", async (c) => {
+            const { code, state } = c.req.query();
+            if (!code || !state)
+                return c.json({ error: "Invalid callback" }, 400);
+            const stored = await consumeOAuthState(state);
+            if (!stored?.codeVerifier)
+                return c.json({ error: "Invalid or expired state" }, 400);
+            const tokens = await getGoogle().validateAuthorizationCode(code, stored.codeVerifier);
+            const info = await fetch("https://openidconnect.googleapis.com/v1/userinfo", {
+                headers: { Authorization: `Bearer ${tokens.accessToken()}` },
+            }).then((r) => r.json());
+            if (stored.linkUserId) {
+                const adapter = getAuthAdapter();
+                if (!adapter.linkProvider)
+                    return c.json({ error: "Auth adapter does not support linkProvider" }, 500);
+                await adapter.linkProvider(stored.linkUserId, "google", info.sub);
+                const sep = postLoginRedirect.includes("?") ? "&" : "?";
+                return c.redirect(`${postLoginRedirect}${sep}linked=google`);
+            }
+            return finishOAuth(c, "google", info.sub, { email: info.email, name: info.name, avatarUrl: info.picture }, postLoginRedirect);
+        });
+        router.get("/auth/google/link", userAuth, async (c) => {
+            const state = generateState();
+            const codeVerifier = generateCodeVerifier();
+            await storeOAuthState(state, codeVerifier, c.get("authUserId"));
+            const url = getGoogle().createAuthorizationURL(state, codeVerifier, ["openid", "profile", "email"]);
+            return c.redirect(url.toString());
+        });
+        router.delete("/auth/google/link", userAuth, async (c) => {
+            const adapter = getAuthAdapter();
+            if (!adapter.unlinkProvider) {
+                return c.json({ error: "Auth adapter does not support unlinkProvider" }, 500);
+            }
+            await adapter.unlinkProvider(c.get("authUserId"), "google");
+            return c.body(null, 204);
+        });
+    }
+    // ─── Apple ────────────────────────────────────────────────────────────────
+    if (providers.includes("apple")) {
+        router.get("/auth/apple", async (c) => {
+            const state = generateState();
+            await storeOAuthState(state);
+            const url = getApple().createAuthorizationURL(state, ["name", "email"]);
+            return c.redirect(url.toString());
+        });
+        // Apple sends a POST with form data to the callback URL
+        router.post("/auth/apple/callback", async (c) => {
+            const form = await c.req.formData();
+            const code = form.get("code");
+            const state = form.get("state");
+            if (!code || !state)
+                return c.json({ error: "Invalid callback" }, 400);
+            const stored = await consumeOAuthState(state);
+            if (!stored)
+                return c.json({ error: "Invalid or expired state" }, 400);
+            const tokens = await getApple().validateAuthorizationCode(code);
+            const claims = decodeIdToken(tokens.idToken());
+            if (stored.linkUserId) {
+                const adapter = getAuthAdapter();
+                if (!adapter.linkProvider)
+                    return c.json({ error: "Auth adapter does not support linkProvider" }, 500);
+                await adapter.linkProvider(stored.linkUserId, "apple", claims.sub);
+                const sep = postLoginRedirect.includes("?") ? "&" : "?";
+                return c.redirect(`${postLoginRedirect}${sep}linked=apple`);
+            }
+            // Apple only sends name on the very first sign-in
+            const userJSON = form.get("user");
+            const userInfo = userJSON ? JSON.parse(userJSON) : {};
+            const name = userInfo.name
+                ? `${userInfo.name.firstName ?? ""} ${userInfo.name.lastName ?? ""}`.trim() || undefined
+                : undefined;
+            return finishOAuth(c, "apple", claims.sub, { email: claims.email, name }, postLoginRedirect);
+        });
+        router.get("/auth/apple/link", userAuth, async (c) => {
+            const state = generateState();
+            await storeOAuthState(state, undefined, c.get("authUserId"));
+            const url = getApple().createAuthorizationURL(state, ["name", "email"]);
+            return c.redirect(url.toString());
+        });
+    }
+    return router;
+};

package/dist/schemas/auth.js

@@ -0,0 +1,9 @@
+import { z } from "zod";
+export const makeRegisterSchema = (primaryField) => z.object({
+    [primaryField]: primaryField === "email" ? z.string().email() : z.string().min(3),
+    password: z.string().min(8),
+});
+export const makeLoginSchema = (primaryField) => z.object({
+    [primaryField]: primaryField === "email" ? z.string().email() : z.string().min(1),
+    password: z.string().min(1),
+});

package/dist/server.js

@@ -0,0 +1,53 @@
+import { createApp } from "./app";
+import { websocket as defaultWebsocket, createWsUpgradeHandler } from "./ws/index";
+import { setWsServer, handleRoomActions, cleanupSocket } from "./lib/ws";
+import { log } from "./lib/logger";
+export const createServer = async (config) => {
+    const app = await createApp(config);
+    const port = Number(process.env.PORT ?? config.port ?? 3000);
+    const { workersDir, enableWorkers = true, ws: wsConfig = {} } = config;
+    const { handler: userWs, upgradeHandler: wsUpgradeHandler, onRoomSubscribe } = wsConfig;
+    const defaultOpen = defaultWebsocket.open;
+    const defaultMessage = defaultWebsocket.message;
+    const defaultClose = defaultWebsocket.close;
+    const defaultDrain = defaultWebsocket.drain;
+    const ws = {
+        open: userWs?.open ?? defaultOpen,
+        async message(socket, message) {
+            if (!await handleRoomActions(socket, message, onRoomSubscribe)) {
+                (userWs?.message ?? defaultMessage)(socket, message);
+            }
+        },
+        close(socket, code, reason) {
+            cleanupSocket(socket.data.id, socket.data.rooms);
+            socket.data.rooms.clear();
+            (userWs?.close ?? defaultClose)(socket, code, reason);
+        },
+        drain: userWs?.drain ?? defaultDrain,
+    };
+    let server;
+    server = Bun.serve({
+        port,
+        routes: {
+            "/ws": (req) => wsUpgradeHandler
+                ? wsUpgradeHandler(req, server)
+                : createWsUpgradeHandler(server)(req),
+        },
+        fetch: app.fetch,
+        websocket: ws,
+        error(err) {
+            console.error(err);
+            return Response.json({ error: "Internal Server Error" }, { status: 500 });
+        },
+    });
+    setWsServer(server);
+    if (enableWorkers && workersDir) {
+        const glob = new Bun.Glob("**/*.ts");
+        for await (const file of glob.scan({ cwd: workersDir })) {
+            await import(`${workersDir}/${file}`);
+        }
+    }
+    log(`[server] running at http://localhost:${server.port}`);
+    log(`[server] API docs at http://localhost:${server.port}/docs`);
+    return server;
+};

package/dist/services/auth.js

@@ -0,0 +1,54 @@
+import { getAuthAdapter } from "../lib/authAdapter";
+import { HttpError } from "../lib/HttpError";
+import { signToken, verifyToken } from "../lib/jwt";
+import { createSession, deleteSession } from "../lib/session";
+import { getDefaultRole, getPrimaryField, getEmailVerificationConfig } from "../lib/appConfig";
+import { createVerificationToken } from "../lib/emailVerification";
+export const register = async (identifier, password) => {
+    const hashed = await Bun.password.hash(password);
+    const adapter = getAuthAdapter();
+    const user = await adapter.create(identifier, hashed);
+    const role = getDefaultRole();
+    if (role)
+        await adapter.setRoles(user.id, [role]);
+    const token = await signToken(user.id);
+    await createSession(user.id, token);
+    const evConfig = getEmailVerificationConfig();
+    if (evConfig && getPrimaryField() === "email") {
+        try {
+            const verificationToken = await createVerificationToken(user.id, identifier);
+            await evConfig.onSend(identifier, verificationToken);
+        }
+        catch (e) {
+            console.error("[email-verification] Failed to send verification email:", e);
+        }
+    }
+    return token;
+};
+export const login = async (identifier, password) => {
+    const adapter = getAuthAdapter();
+    const findFn = adapter.findByIdentifier ?? adapter.findByEmail.bind(adapter);
+    const user = await findFn(identifier);
+    if (!user || !(await Bun.password.verify(password, user.passwordHash))) {
+        throw new HttpError(401, "Invalid credentials");
+    }
+    const evConfig = getEmailVerificationConfig();
+    if (evConfig && getPrimaryField() === "email" && adapter.getEmailVerified) {
+        const verified = await adapter.getEmailVerified(user.id);
+        if (evConfig.required && !verified) {
+            throw new HttpError(403, "Email not verified");
+        }
+        const token = await signToken(user.id);
+        await createSession(user.id, token);
+        return { token, emailVerified: verified };
+    }
+    const token = await signToken(user.id);
+    await createSession(user.id, token);
+    return { token };
+};
+export const logout = async (token) => {
+    if (token) {
+        const payload = await verifyToken(token);
+        await deleteSession(payload.sub);
+    }
+};

package/dist/ws/index.js

@@ -0,0 +1,31 @@
+import { verifyToken } from "../lib/jwt";
+import { getSession } from "../lib/session";
+import { COOKIE_TOKEN } from "../lib/constants";
+export const createWsUpgradeHandler = (server) => async (req) => {
+    let userId = null;
+    try {
+        const token = req.headers.get("cookie")
+            ?.match(new RegExp(`(?:^|;\\s*)${COOKIE_TOKEN}=([^;]+)`))?.[1] ?? null;
+        if (token) {
+            const payload = await verifyToken(token);
+            const stored = await getSession(payload.sub);
+            if (stored === token)
+                userId = payload.sub;
+        }
+    }
+    catch { /* unauthenticated — userId stays null */ }
+    const upgraded = server.upgrade(req, { data: { id: crypto.randomUUID(), userId, rooms: new Set() } });
+    return upgraded ? undefined : Response.json({ error: "Upgrade failed" }, { status: 400 });
+};
+export const websocket = {
+    open(ws) {
+        console.log(`[ws] connected: ${ws.data.id}`);
+        ws.send(JSON.stringify({ event: "connected", id: ws.data.id }));
+    },
+    message(ws, message) {
+        ws.send(message);
+    },
+    close(ws) {
+        console.log(`[ws] disconnected: ${ws.data.id}`);
+    },
+};