@lastshotlabs/bunshot 0.0.8 → 0.0.10

package/dist/app.js

@@ -8,8 +8,9 @@ import { rateLimit } from "./middleware/rateLimit";
 import { bearerAuth } from "./middleware/bearerAuth";
 import { identify } from "./middleware/identify";
 import { HEADER_USER_TOKEN } from "./lib/constants";
-import { setAppName, setAppRoles, setDefaultRole, setPrimaryField, setEmailVerificationConfig } from "./lib/appConfig";
+import { setAppName, setAppRoles, setDefaultRole, setPrimaryField, setEmailVerificationConfig, setPasswordResetConfig, setMaxSessions, setPersistSessionMetadata, setIncludeInactiveSessions, setTrackLastActive } from "./lib/appConfig";
 import { setEmailVerificationStore } from "./lib/emailVerification";
+import { setPasswordResetStore } from "./lib/resetPassword";
 import { setAuthRateLimitStore } from "./lib/authRateLimit";
 import { setAuthAdapter } from "./lib/authAdapter";
 import { mongoAuthAdapter } from "./adapters/mongoAuth";
@@ -39,7 +40,9 @@ export const createApp = async (config) => {
     const defaultRole = authConfig.defaultRole;
     const primaryField = authConfig.primaryField ?? "email";
     const emailVerification = authConfig.emailVerification;
+    const passwordReset = authConfig.passwordReset;
     const authRateLimit = authConfig.rateLimit;
+    const sessionPolicy = authConfig.sessionPolicy ?? {};
     const { sqlite, mongo = "single", redis: enableRedis = true } = db;
     // Smart fallback: pick the best available store rather than blindly defaulting to "redis"
     const defaultStore = enableRedis
@@ -81,16 +84,31 @@ export const createApp = async (config) => {
     else {
         authAdapter = mongoAuthAdapter;
     }
+    if (defaultRole && !authAdapter.setRoles) {
+        throw new Error(`createApp: "defaultRole" is set to "${defaultRole}" but the auth adapter does not implement setRoles. Add setRoles to your adapter or remove defaultRole.`);
+    }
+    if (emailVerification && primaryField !== "email") {
+        throw new Error(`createApp: "emailVerification" is only supported when primaryField is "email". Either set primaryField to "email" or remove emailVerification.`);
+    }
+    if (passwordReset && primaryField !== "email") {
+        throw new Error(`createApp: "passwordReset" is only supported when primaryField is "email". Either set primaryField to "email" or remove passwordReset.`);
+    }
+    if (passwordReset && !authAdapter.setPassword) {
+        throw new Error(`createApp: "passwordReset" is configured but the auth adapter does not implement setPassword. Add setPassword to your adapter or remove passwordReset.`);
+    }
     setAuthAdapter(authAdapter);
     setAppRoles(roles);
     setDefaultRole(defaultRole ?? null);
     setPrimaryField(primaryField);
     setEmailVerificationConfig(emailVerification ?? null);
     setEmailVerificationStore(sessions);
+    setPasswordResetConfig(passwordReset ?? null);
+    setPasswordResetStore(sessions);
     setAuthRateLimitStore(authRateLimit?.store ?? (enableRedis ? "redis" : "memory"));
-    if (defaultRole && !authAdapter.setRoles) {
-        throw new Error(`createApp: "defaultRole" is set to "${defaultRole}" but the auth adapter does not implement setRoles. Add setRoles to your adapter or remove defaultRole.`);
-    }
+    setMaxSessions(sessionPolicy.maxSessions ?? 6);
+    setPersistSessionMetadata(sessionPolicy.persistSessionMetadata ?? true);
+    setIncludeInactiveSessions(sessionPolicy.includeInactiveSessions ?? false);
+    setTrackLastActive(sessionPolicy.trackLastActive ?? false);
     if (oauthProviders)
         initOAuthProviders(oauthProviders);
     const configuredOAuth = getConfiguredOAuthProviders();
@@ -139,7 +157,7 @@ export const createApp = async (config) => {
     }
     if (enableAuthRoutes) {
         const { createAuthRouter } = await import(`${coreRoutesDir}/auth`);
-        app.route("/", createAuthRouter({ primaryField, emailVerification, rateLimit: authRateLimit }));
+        app.route("/", createAuthRouter({ primaryField, emailVerification, passwordReset, rateLimit: authRateLimit }));
     }
     if (configuredOAuth.length > 0) {
         app.route("/", createOAuthRouter(configuredOAuth, postOAuthRedirect));

package/dist/entrypoints/mongo.d.ts

@@ -0,0 +1,3 @@
+export { connectMongo, connectAuthMongo, connectAppMongo, disconnectMongo, authConnection, appConnection, mongoose } from "../lib/mongo";
+export { mongoAuthAdapter } from "../adapters/mongoAuth";
+export { AuthUser } from "../models/AuthUser";

package/dist/entrypoints/mongo.js

@@ -0,0 +1,3 @@
+export { connectMongo, connectAuthMongo, connectAppMongo, disconnectMongo, authConnection, appConnection, mongoose } from "../lib/mongo";
+export { mongoAuthAdapter } from "../adapters/mongoAuth";
+export { AuthUser } from "../models/AuthUser";

package/dist/entrypoints/queue.d.ts

@@ -0,0 +1,2 @@
+export { createQueue, createWorker } from "../lib/queue";
+export type { Job } from "../lib/queue";

package/dist/entrypoints/queue.js

@@ -0,0 +1 @@
+export { createQueue, createWorker } from "../lib/queue";

package/dist/entrypoints/redis.d.ts

@@ -0,0 +1 @@
+export { connectRedis, disconnectRedis, getRedis } from "../lib/redis";

package/dist/entrypoints/redis.js

@@ -0,0 +1 @@
+export { connectRedis, disconnectRedis, getRedis } from "../lib/redis";

package/dist/index.d.ts

@@ -1,7 +1,9 @@
 export { createApp } from "./app";
 export { createServer } from "./server";
-export type { CreateAppConfig, DbConfig, AppMeta, AuthConfig, AuthRateLimitConfig, OAuthConfig, SecurityConfig, BotProtectionConfig, PrimaryField, EmailVerificationConfig } from "./app";
+export type { CreateAppConfig, DbConfig, AppMeta, AuthConfig, AuthRateLimitConfig, OAuthConfig, SecurityConfig, BotProtectionConfig, PrimaryField, EmailVerificationConfig, PasswordResetConfig } from "./app";
 export type { CreateServerConfig, WsConfig } from "./server";
+export { appConnection, authConnection, mongoose, connectMongo, connectAuthMongo, connectAppMongo, disconnectMongo } from "./lib/mongo";
+export { connectRedis, disconnectRedis, getRedis } from "./lib/redis";
 export { getAppRoles } from "./lib/appConfig";
 export { HttpError } from "./lib/HttpError";
 export { COOKIE_TOKEN, HEADER_USER_TOKEN } from "./lib/constants";
@@ -9,11 +11,9 @@ export { createRouter } from "./lib/context";
 export type { AppEnv, AppVariables } from "./lib/context";
 export { signToken, verifyToken } from "./lib/jwt";
 export { log } from "./lib/logger";
-export { connectMongo, connectAuthMongo, connectAppMongo, disconnectMongo, authConnection, appConnection, mongoose } from "./lib/mongo";
-export { connectRedis, disconnectRedis, getRedis } from "./lib/redis";
-export { createQueue, createWorker } from "./lib/queue";
-export type { Job } from "./lib/queue";
-export { createSession, getSession, deleteSession, setSessionStore } from "./lib/session";
+export { createResetToken, consumeResetToken, setPasswordResetStore } from "./lib/resetPassword";
+export { createSession, getSession, deleteSession, getUserSessions, getActiveSessionCount, evictOldestSession, updateSessionLastActive, setSessionStore } from "./lib/session";
+export type { SessionMetadata, SessionInfo } from "./lib/session";
 export { createVerificationToken, getVerificationToken, deleteVerificationToken } from "./lib/emailVerification";
 export { bustAuthLimit, trackAttempt, isLimited } from "./lib/authRateLimit";
 export type { LimitOpts } from "./lib/authRateLimit";
@@ -29,8 +29,6 @@ export { requireRole } from "./middleware/requireRole";
 export { requireVerifiedEmail } from "./middleware/requireVerifiedEmail";
 export { cacheResponse, bustCache, bustCachePattern, setCacheStore } from "./middleware/cacheResponse";
 export { buildFingerprint } from "./lib/fingerprint";
-export { AuthUser } from "./models/AuthUser";
-export { mongoAuthAdapter } from "./adapters/mongoAuth";
 export { sqliteAuthAdapter, setSqliteDb, startSqliteCleanup } from "./adapters/sqliteAuth";
 export { memoryAuthAdapter, clearMemoryStore } from "./adapters/memoryAuth";
 export { setUserRoles, addUserRole, removeUserRole } from "./lib/roles";

package/dist/index.js

@@ -1,6 +1,9 @@
 // App factory
 export { createApp } from "./app";
 export { createServer } from "./server";
+// Database
+export { appConnection, authConnection, mongoose, connectMongo, connectAuthMongo, connectAppMongo, disconnectMongo } from "./lib/mongo";
+export { connectRedis, disconnectRedis, getRedis } from "./lib/redis";
 // Lib utilities
 export { getAppRoles } from "./lib/appConfig";
 export { HttpError } from "./lib/HttpError";
@@ -8,10 +11,8 @@ export { COOKIE_TOKEN, HEADER_USER_TOKEN } from "./lib/constants";
 export { createRouter } from "./lib/context";
 export { signToken, verifyToken } from "./lib/jwt";
 export { log } from "./lib/logger";
-export { connectMongo, connectAuthMongo, connectAppMongo, disconnectMongo, authConnection, appConnection, mongoose } from "./lib/mongo";
-export { connectRedis, disconnectRedis, getRedis } from "./lib/redis";
-export { createQueue, createWorker } from "./lib/queue";
-export { createSession, getSession, deleteSession, setSessionStore } from "./lib/session";
+export { createResetToken, consumeResetToken, setPasswordResetStore } from "./lib/resetPassword";
+export { createSession, getSession, deleteSession, getUserSessions, getActiveSessionCount, evictOldestSession, updateSessionLastActive, setSessionStore } from "./lib/session";
 export { createVerificationToken, getVerificationToken, deleteVerificationToken } from "./lib/emailVerification";
 export { bustAuthLimit, trackAttempt, isLimited } from "./lib/authRateLimit";
 export { validate } from "./lib/validate";
@@ -27,8 +28,6 @@ export { cacheResponse, bustCache, bustCachePattern, setCacheStore } from "./mid
 // Lib utilities (bot protection)
 export { buildFingerprint } from "./lib/fingerprint";
 // Models
-export { AuthUser } from "./models/AuthUser";
-export { mongoAuthAdapter } from "./adapters/mongoAuth";
 export { sqliteAuthAdapter, setSqliteDb, startSqliteCleanup } from "./adapters/sqliteAuth";
 export { memoryAuthAdapter, clearMemoryStore } from "./adapters/memoryAuth";
 export { setUserRoles, addUserRole, removeUserRole } from "./lib/roles";

package/dist/lib/appConfig.d.ts

@@ -7,6 +7,12 @@ export interface EmailVerificationConfig {
     /** Called after registration with the identifier and verification token. Use to send the email. */
     onSend: (email: string, token: string) => Promise<void>;
 }
+export interface PasswordResetConfig {
+    /** Token time-to-live in seconds. Defaults to 3 600 (1 hour). */
+    tokenExpiry?: number;
+    /** Called with the user's email and the reset token. Use to send the reset email. */
+    onSend: (email: string, token: string) => Promise<void>;
+}
 export declare const setAppName: (name: string) => void;
 export declare const getAppName: () => string;
 export declare const setAppRoles: (roles: string[]) => void;
@@ -18,3 +24,14 @@ export declare const getPrimaryField: () => PrimaryField;
 export declare const setEmailVerificationConfig: (config: EmailVerificationConfig | null) => void;
 export declare const getEmailVerificationConfig: () => EmailVerificationConfig | null;
 export declare const getTokenExpiry: () => number;
+export declare const setPasswordResetConfig: (config: PasswordResetConfig | null) => void;
+export declare const getPasswordResetConfig: () => PasswordResetConfig | null;
+export declare const getResetTokenExpiry: () => number;
+export declare const setMaxSessions: (n: number) => void;
+export declare const getMaxSessions: () => number;
+export declare const setPersistSessionMetadata: (v: boolean) => void;
+export declare const getPersistSessionMetadata: () => boolean;
+export declare const setIncludeInactiveSessions: (v: boolean) => void;
+export declare const getIncludeInactiveSessions: () => boolean;
+export declare const setTrackLastActive: (v: boolean) => void;
+export declare const getTrackLastActive: () => boolean;

package/dist/lib/appConfig.js

@@ -3,6 +3,7 @@ let appRoles = [];
 let defaultRole = null;
 let _primaryField = "email";
 let _emailVerificationConfig = null;
+let _passwordResetConfig = null;
 export const setAppName = (name) => { appName = name; };
 export const getAppName = () => appName;
 export const setAppRoles = (roles) => { appRoles = roles; };
@@ -15,3 +16,22 @@ export const setEmailVerificationConfig = (config) => { _emailVerificationConfig
 export const getEmailVerificationConfig = () => _emailVerificationConfig;
 const DEFAULT_TOKEN_EXPIRY = 60 * 60 * 24; // 24 hours
 export const getTokenExpiry = () => _emailVerificationConfig?.tokenExpiry ?? DEFAULT_TOKEN_EXPIRY;
+export const setPasswordResetConfig = (config) => { _passwordResetConfig = config; };
+export const getPasswordResetConfig = () => _passwordResetConfig;
+const DEFAULT_RESET_TOKEN_EXPIRY = 60 * 60; // 1 hour
+export const getResetTokenExpiry = () => _passwordResetConfig?.tokenExpiry ?? DEFAULT_RESET_TOKEN_EXPIRY;
+// ---------------------------------------------------------------------------
+// Session policy
+// ---------------------------------------------------------------------------
+let _maxSessions = 6;
+let _persistSessionMetadata = true;
+let _includeInactiveSessions = false;
+let _trackLastActive = false;
+export const setMaxSessions = (n) => { _maxSessions = Number.isFinite(n) && n >= 1 ? Math.floor(n) : 1; };
+export const getMaxSessions = () => _maxSessions;
+export const setPersistSessionMetadata = (v) => { _persistSessionMetadata = v; };
+export const getPersistSessionMetadata = () => _persistSessionMetadata;
+export const setIncludeInactiveSessions = (v) => { _includeInactiveSessions = v; };
+export const getIncludeInactiveSessions = () => _includeInactiveSessions;
+export const setTrackLastActive = (v) => { _trackLastActive = v; };
+export const getTrackLastActive = () => _trackLastActive;

package/dist/lib/context.d.ts

@@ -2,6 +2,7 @@ import { OpenAPIHono } from "@hono/zod-openapi";
 export type AppVariables = {
     authUserId: string | null;
     roles: string[] | null;
+    sessionId: string | null;
 };
 export type AppEnv = {
     Variables: AppVariables;

package/dist/lib/emailVerification.js

@@ -1,18 +1,19 @@
 import { getRedis } from "./redis";
-import { appConnection } from "./mongo";
+import { appConnection, mongoose } from "./mongo";
 import { getAppName, getTokenExpiry } from "./appConfig";
-import { Schema } from "mongoose";
 import { sqliteCreateVerificationToken, sqliteGetVerificationToken, sqliteDeleteVerificationToken, } from "../adapters/sqliteAuth";
 import { memoryCreateVerificationToken, memoryGetVerificationToken, memoryDeleteVerificationToken, } from "../adapters/memoryAuth";
-const verificationSchema = new Schema({
-    token: { type: String, required: true, unique: true },
-    userId: { type: String, required: true },
-    email: { type: String, required: true },
-    expiresAt: { type: Date, required: true, index: { expireAfterSeconds: 0 } },
-}, { collection: "email_verifications" });
 function getVerificationModel() {
-    return appConnection.models["EmailVerification"] ??
-        appConnection.model("EmailVerification", verificationSchema);
+    if (appConnection.models["EmailVerification"])
+        return appConnection.models["EmailVerification"];
+    const { Schema } = mongoose;
+    const verificationSchema = new Schema({
+        token: { type: String, required: true, unique: true },
+        userId: { type: String, required: true },
+        email: { type: String, required: true },
+        expiresAt: { type: Date, required: true, index: { expireAfterSeconds: 0 } },
+    }, { collection: "email_verifications" });
+    return appConnection.model("EmailVerification", verificationSchema);
 }
 let _store = "redis";
 export const setEmailVerificationStore = (store) => { _store = store; };

package/dist/lib/jwt.d.ts

@@ -1,2 +1,2 @@
-export declare const signToken: (userId: string) => Promise<string>;
+export declare const signToken: (userId: string, sessionId: string) => Promise<string>;
 export declare const verifyToken: (token: string) => Promise<import("jose").JWTPayload>;

package/dist/lib/jwt.js

@@ -1,7 +1,7 @@
 import { SignJWT, jwtVerify } from "jose";
 const isProd = process.env.NODE_ENV === "production";
 const secret = new TextEncoder().encode(isProd ? process.env.JWT_SECRET_PROD : process.env.JWT_SECRET_DEV);
-export const signToken = async (userId) => new SignJWT({ sub: userId })
+export const signToken = async (userId, sessionId) => new SignJWT({ sub: userId, sid: sessionId })
     .setProtectedHeader({ alg: "HS256" })
     .setExpirationTime("7d")
     .sign(secret);

package/dist/lib/mongo.d.ts

@@ -1,15 +1,20 @@
-import mongoose from "mongoose";
+import type { Connection, Mongoose } from "mongoose";
+type MongooseModule = Mongoose;
 /**
  * Named connection used exclusively for auth data (AuthUser model).
  * Connected via connectAuthMongo() or connectMongo() (backward compat).
  */
-export declare const authConnection: mongoose.Connection;
+export declare const authConnection: Connection;
 /**
  * Named connection for app/tenant data.
  * Connected via connectAppMongo() or connectMongo() (backward compat).
  * Use this when registering your own models: appConnection.model("Product", schema).
  */
-export declare const appConnection: mongoose.Connection;
+export declare const appConnection: Connection;
+/**
+ * The mongoose instance. Available after connectMongo() / connectAuthMongo() is called.
+ */
+export declare const mongoose: MongooseModule;
 /**
  * Connect the auth connection to its dedicated MongoDB server.
  * Uses MONGO_AUTH_USER_*, MONGO_AUTH_PW_*, MONGO_AUTH_HOST_*, MONGO_AUTH_DB_* env vars.
@@ -31,4 +36,4 @@ export declare const connectMongo: () => Promise<void>;
  * Useful for one-off scripts that need a clean exit.
  */
 export declare const disconnectMongo: () => Promise<void>;
-export { mongoose };
+export {};

package/dist/lib/mongo.js

@@ -1,32 +1,74 @@
-import mongoose from "mongoose";
 import { log } from "./logger";
 const isProd = process.env.NODE_ENV === "production";
+function requireMongoose() {
+    try {
+        // Bun supports require() in ESM; this defers the import to call time
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const mod = require("mongoose");
+        return mod.default ?? mod;
+    }
+    catch {
+        throw new Error("mongoose is not installed. Run: bun add mongoose");
+    }
+}
 function buildUri(user, password, host, db) {
     const [hostPart, queryPart] = host.split("?");
     return `mongodb+srv://${user}:${password}@${hostPart.replace(/\/$/, "")}/${db}${queryPart ? `?${queryPart}` : ""}`;
 }
+// Internal mutable references — set inside connect functions
+let _authConn = null;
+let _appConn = null;
+let _mongoose = null;
+function makeConnectionProxy(label, getConn, setConn) {
+    return new Proxy({}, {
+        get(_, prop) {
+            let conn = getConn();
+            if (!conn) {
+                // Lazily create a disconnected connection so appConnection.model() works at module
+                // load time. Mongoose buffers queries until openUri() is called by connectMongo().
+                conn = requireMongoose().createConnection();
+                setConn(conn);
+            }
+            const val = conn[prop];
+            return typeof val === "function" ? val.bind(conn) : val;
+        },
+    });
+}
 /**
  * Named connection used exclusively for auth data (AuthUser model).
  * Connected via connectAuthMongo() or connectMongo() (backward compat).
  */
-export const authConnection = mongoose.createConnection();
+export const authConnection = makeConnectionProxy("auth", () => _authConn, (c) => { _authConn = c; });
 /**
  * Named connection for app/tenant data.
  * Connected via connectAppMongo() or connectMongo() (backward compat).
  * Use this when registering your own models: appConnection.model("Product", schema).
  */
-export const appConnection = mongoose.createConnection();
+export const appConnection = makeConnectionProxy("app", () => _appConn, (c) => { _appConn = c; });
+/**
+ * The mongoose instance. Available after connectMongo() / connectAuthMongo() is called.
+ */
+export const mongoose = new Proxy({}, {
+    get(_, prop) {
+        const mg = _mongoose ?? requireMongoose();
+        return mg[prop];
+    },
+});
 /**
  * Connect the auth connection to its dedicated MongoDB server.
  * Uses MONGO_AUTH_USER_*, MONGO_AUTH_PW_*, MONGO_AUTH_HOST_*, MONGO_AUTH_DB_* env vars.
  */
 export const connectAuthMongo = async () => {
+    const mg = requireMongoose();
+    _mongoose = mg;
+    if (!_authConn)
+        _authConn = mg.createConnection();
     const user = isProd ? process.env.MONGO_AUTH_USER_PROD : process.env.MONGO_AUTH_USER_DEV;
     const password = isProd ? process.env.MONGO_AUTH_PW_PROD : process.env.MONGO_AUTH_PW_DEV;
     const host = isProd ? process.env.MONGO_AUTH_HOST_PROD : process.env.MONGO_AUTH_HOST_DEV;
     const db = isProd ? process.env.MONGO_AUTH_DB_PROD : process.env.MONGO_AUTH_DB_DEV;
     const uri = buildUri(user, password, host, db);
-    await authConnection.openUri(uri);
+    await _authConn.openUri(uri);
     log(`[mongo] auth connected to ${host} as ${user}`);
 };
 /**
@@ -34,12 +76,16 @@ export const connectAuthMongo = async () => {
  * Uses MONGO_USER_*, MONGO_PW_*, MONGO_HOST_*, MONGO_DB_* env vars.
  */
 export const connectAppMongo = async () => {
+    const mg = requireMongoose();
+    _mongoose = mg;
+    if (!_appConn)
+        _appConn = mg.createConnection();
     const user = isProd ? process.env.MONGO_USER_PROD : process.env.MONGO_USER_DEV;
     const password = isProd ? process.env.MONGO_PW_PROD : process.env.MONGO_PW_DEV;
     const host = isProd ? process.env.MONGO_HOST_PROD : process.env.MONGO_HOST_DEV;
     const db = isProd ? process.env.MONGO_DB_PROD : process.env.MONGO_DB_DEV;
     const uri = buildUri(user, password, host, db);
-    await appConnection.openUri(uri);
+    await _appConn.openUri(uri);
     log(`[mongo] app connected to ${host} as ${user}`);
 };
 /**
@@ -48,14 +94,20 @@ export const connectAppMongo = async () => {
  * Uses MONGO_USER_*, MONGO_PW_*, MONGO_HOST_*, MONGO_DB_* env vars.
  */
 export const connectMongo = async () => {
+    const mg = requireMongoose();
+    _mongoose = mg;
+    if (!_authConn)
+        _authConn = mg.createConnection();
+    if (!_appConn)
+        _appConn = mg.createConnection();
     const user = isProd ? process.env.MONGO_USER_PROD : process.env.MONGO_USER_DEV;
     const password = isProd ? process.env.MONGO_PW_PROD : process.env.MONGO_PW_DEV;
     const host = isProd ? process.env.MONGO_HOST_PROD : process.env.MONGO_HOST_DEV;
     const db = isProd ? process.env.MONGO_DB_PROD : process.env.MONGO_DB_DEV;
     const uri = buildUri(user, password, host, db);
     await Promise.all([
-        authConnection.openUri(uri),
-        appConnection.openUri(uri),
+        _authConn.openUri(uri),
+        _appConn.openUri(uri),
     ]);
     log(`[mongo] connected to ${host} as ${user}`);
 };
@@ -65,9 +117,8 @@ export const connectMongo = async () => {
  */
 export const disconnectMongo = async () => {
     await Promise.all([
-        authConnection.readyState !== 0 ? authConnection.close() : Promise.resolve(),
-        appConnection.readyState !== 0 ? appConnection.close() : Promise.resolve(),
+        _authConn && _authConn.readyState !== 0 ? _authConn.close() : Promise.resolve(),
+        _appConn && _appConn.readyState !== 0 ? _appConn.close() : Promise.resolve(),
     ]);
     log("[mongo] disconnected");
 };
-export { mongoose };

package/dist/lib/oauth.js

@@ -1,8 +1,7 @@
 import { Google, Apple, generateState, generateCodeVerifier } from "arctic";
 import { getRedis } from "./redis";
-import { appConnection } from "./mongo";
+import { appConnection, mongoose } from "./mongo";
 import { getAppName } from "./appConfig";
-import { Schema } from "mongoose";
 import { sqliteStoreOAuthState, sqliteConsumeOAuthState } from "../adapters/sqliteAuth";
 import { memoryStoreOAuthState, memoryConsumeOAuthState } from "../adapters/memoryAuth";
 let _providers = {};
@@ -29,15 +28,17 @@ export const getApple = () => {
 export const getConfiguredOAuthProviders = () => Object.entries(_providers)
     .filter(([, v]) => v != null)
     .map(([k]) => k);
-const oauthStateSchema = new Schema({
-    state: { type: String, required: true, unique: true },
-    codeVerifier: { type: String },
-    linkUserId: { type: String },
-    expiresAt: { type: Date, required: true, index: { expireAfterSeconds: 0 } },
-}, { collection: "oauth_states" });
 function getOAuthStateModel() {
-    return appConnection.models["OAuthState"] ??
-        appConnection.model("OAuthState", oauthStateSchema);
+    if (appConnection.models["OAuthState"])
+        return appConnection.models["OAuthState"];
+    const { Schema } = mongoose;
+    const oauthStateSchema = new Schema({
+        state: { type: String, required: true, unique: true },
+        codeVerifier: { type: String },
+        linkUserId: { type: String },
+        expiresAt: { type: Date, required: true, index: { expireAfterSeconds: 0 } },
+    }, { collection: "oauth_states" });
+    return appConnection.model("OAuthState", oauthStateSchema);
 }
 let _oauthStore = "redis";
 export const setOAuthStateStore = (store) => { _oauthStore = store; };

package/dist/lib/queue.d.ts

@@ -1,5 +1,4 @@
-import { Queue, Worker } from "bullmq";
-import type { Processor, QueueOptions, WorkerOptions, Job } from "bullmq";
-export declare const createQueue: <T = unknown, R = unknown>(name: string, options?: Omit<QueueOptions, "connection">) => Queue<T, R>;
-export declare const createWorker: <T = unknown, R = unknown>(name: string, processor: Processor<T, R>, options?: Omit<WorkerOptions, "connection">) => Worker<T, R>;
+import type { Queue as QueueType, Worker as WorkerType, Processor, QueueOptions, WorkerOptions, Job } from "bullmq";
+export declare const createQueue: <T = unknown, R = unknown>(name: string, options?: Omit<QueueOptions, "connection">) => QueueType<T, R>;
+export declare const createWorker: <T = unknown, R = unknown>(name: string, processor: Processor<T, R>, options?: Omit<WorkerOptions, "connection">) => WorkerType<T, R>;
 export type { Job };

package/dist/lib/queue.js

@@ -1,4 +1,19 @@
-import { Queue, Worker } from "bullmq";
 import { getRedisConnectionOptions } from "./redis";
-export const createQueue = (name, options) => new Queue(name, { connection: getRedisConnectionOptions(), ...options });
-export const createWorker = (name, processor, options) => new Worker(name, processor, { connection: getRedisConnectionOptions(), ...options });
+function requireBullMQ() {
+    try {
+        // Bun supports require() in ESM; this defers the import to call time
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        return require("bullmq");
+    }
+    catch {
+        throw new Error("bullmq is not installed. Run: bun add bullmq");
+    }
+}
+export const createQueue = (name, options) => {
+    const { Queue } = requireBullMQ();
+    return new Queue(name, { connection: getRedisConnectionOptions(), ...options });
+};
+export const createWorker = (name, processor, options) => {
+    const { Worker } = requireBullMQ();
+    return new Worker(name, processor, { connection: getRedisConnectionOptions(), ...options });
+};

package/dist/lib/redis.d.ts

@@ -1,14 +1,9 @@
-import Redis from "ioredis";
-export declare const getRedisConnectionOptions: () => {
-    password?: string | undefined;
-    username?: string | undefined;
-    host: string;
-    port: number;
-};
+import type { default as RedisClass, RedisOptions } from "ioredis";
+export declare const getRedisConnectionOptions: () => RedisOptions;
 export declare const connectRedis: () => Promise<void>;
 /**
  * Gracefully close the Redis connection.
  * Useful for one-off scripts that need a clean exit.
  */
 export declare const disconnectRedis: () => Promise<void>;
-export declare const getRedis: () => Redis;
+export declare const getRedis: () => RedisClass;

package/dist/lib/redis.js

@@ -1,6 +1,16 @@
-import Redis from "ioredis";
 import { log } from "./logger";
 const isProd = process.env.NODE_ENV === "production";
+function requireIoredis() {
+    try {
+        // Bun supports require() in ESM; this defers the import to call time
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const mod = require("ioredis");
+        return mod.default ?? mod;
+    }
+    catch {
+        throw new Error("ioredis is not installed. Run: bun add ioredis");
+    }
+}
 export const getRedisConnectionOptions = () => {
     const host_port = isProd ? process.env.REDIS_HOST_PROD : process.env.REDIS_HOST_DEV;
     if (!host_port)
@@ -18,17 +28,18 @@ export const getRedisConnectionOptions = () => {
     };
 };
 let client = null;
-const createClient = () => {
-    const redis = new Redis(getRedisConnectionOptions());
-    redis.on("error", (err) => log(`[redis] error: ${err.message}`));
-    return redis;
-};
 export const connectRedis = () => {
     if (client)
         return Promise.resolve();
-    client = createClient();
+    const Redis = requireIoredis();
+    client = new Redis(getRedisConnectionOptions());
+    client.on("error", (err) => log(`[redis] error: ${err.message}`));
     return new Promise((resolve, reject) => {
-        client.once("ready", () => { log(`[redis] connected to ${getRedisConnectionOptions().host}:${getRedisConnectionOptions().port} as ${getRedisConnectionOptions().username || "default user"}`); resolve(); });
+        client.once("ready", () => {
+            const opts = getRedisConnectionOptions();
+            log(`[redis] connected to ${opts.host}:${opts.port} as ${opts.username || "default user"}`);
+            resolve();
+        });
         client.once("error", reject);
     });
 };

package/dist/lib/resetPassword.d.ts

@@ -0,0 +1,12 @@
+type ResetStore = "redis" | "mongo" | "sqlite" | "memory";
+export declare const setPasswordResetStore: (store: ResetStore) => void;
+/** Create a reset token. Returns the raw token (to embed in the email link).
+ *  Only the SHA-256 hash is persisted in the store. */
+export declare const createResetToken: (userId: string, email: string) => Promise<string>;
+/** Atomically consume a reset token — returns its payload and deletes it in one operation.
+ *  Returns null if the token is invalid, expired, or already used. */
+export declare const consumeResetToken: (token: string) => Promise<{
+    userId: string;
+    email: string;
+} | null>;
+export {};