@hed-hog/core 0.0.390 → 0.0.393

package/dist/user-device/user-device.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-device.controller.js","sourceRoot":"","sources":["../../src/user-device/user-device.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,sCAA0C;AAC1C,4DAAoE;AACpE,2CAOwB;AACxB,+DAA0D;AAInD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAA6B,iBAAoC;QAApC,sBAAiB,GAAjB,iBAAiB,CAAmB;IAAG,CAAC;IAErE;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,IAAI,CACM,gBAA+B,EACrC,EAAE,EAAE,EAAE,EACS,SAAiB,EACf,SAAiB;QAE1C,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,EAAE;YACvD,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,MAAM,CACF,EAAE,EAAE,EAAE,EACmB,QAAgB;QAEjD,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IAEG,AAAN,KAAK,CAAC,WAAW,CACD,gBAA+B,EACd,MAAc;QAE7C,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED;;;OAGG;IAEG,AAAN,KAAK,CAAC,aAAa,CACc,MAAc,EACZ,QAAgB;QAEjD,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;CACF,CAAA;AA9DY,oDAAoB;AAYzB;IADL,IAAA,YAAG,GAAE;IAEH,WAAA,IAAA,2BAAU,GAAE,CAAA;IACZ,WAAA,IAAA,UAAI,GAAE,CAAA;IACN,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;IACrB,WAAA,IAAA,gBAAO,EAAC,cAAc,CAAC,CAAA;;qCAHQ,8BAAa;;gDAS9C;AASK;IADL,IAAA,eAAM,EAAC,WAAW,CAAC;IAEjB,WAAA,IAAA,UAAI,GAAE,CAAA;IACN,WAAA,IAAA,cAAK,EAAC,UAAU,EAAE,qBAAY,CAAC,CAAA;;;;kDAGjC;AAQK;IADL,IAAA,YAAG,EAAC,cAAc,CAAC;IAEjB,WAAA,IAAA,2BAAU,GAAE,CAAA;IACZ,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,qBAAY,CAAC,CAAA;;qCADE,8BAAa;;uDAI9C;AAOK;IADL,IAAA,eAAM,EAAC,wBAAwB,CAAC;IAE9B,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,qBAAY,CAAC,CAAA;IAC7B,WAAA,IAAA,cAAK,EAAC,UAAU,EAAE,qBAAY,CAAC,CAAA;;;;yDAGjC;+BA7DU,oBAAoB;IAFhC,IAAA,UAAI,GAAE;IACN,IAAA,mBAAU,EAAC,aAAa,CAAC;qCAEwB,uCAAiB;GADtD,oBAAoB,CA8DhC"}

package/dist/user-device/user-device.module.d.ts

@@ -0,0 +1,3 @@
+export declare class UserDeviceModule {
+}
+//# sourceMappingURL=user-device.module.d.ts.map

package/dist/user-device/user-device.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-device.module.d.ts","sourceRoot":"","sources":["../../src/user-device/user-device.module.ts"],"names":[],"mappings":"AAMA,qBAMa,gBAAgB;CAAG"}

package/dist/user-device/user-device.module.js

@@ -0,0 +1,26 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserDeviceModule = void 0;
+const api_pagination_1 = require("@hed-hog/api-pagination");
+const api_prisma_1 = require("@hed-hog/api-prisma");
+const common_1 = require("@nestjs/common");
+const user_device_controller_1 = require("./user-device.controller");
+const user_device_service_1 = require("./user-device.service");
+let UserDeviceModule = class UserDeviceModule {
+};
+exports.UserDeviceModule = UserDeviceModule;
+exports.UserDeviceModule = UserDeviceModule = __decorate([
+    (0, common_1.Module)({
+        imports: [(0, common_1.forwardRef)(() => api_prisma_1.PrismaModule), (0, common_1.forwardRef)(() => api_pagination_1.PaginationModule)],
+        controllers: [user_device_controller_1.UserDeviceController],
+        providers: [user_device_service_1.UserDeviceService],
+        exports: [user_device_service_1.UserDeviceService],
+    })
+], UserDeviceModule);
+//# sourceMappingURL=user-device.module.js.map

package/dist/user-device/user-device.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-device.module.js","sourceRoot":"","sources":["../../src/user-device/user-device.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,4DAA2D;AAC3D,oDAAmD;AACnD,2CAAoD;AACpD,qEAAgE;AAChE,+DAA0D;AAQnD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAAG,CAAA;AAAnB,4CAAgB;2BAAhB,gBAAgB;IAN5B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,yBAAY,CAAC,EAAE,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,iCAAgB,CAAC,CAAC;QAC7E,WAAW,EAAE,CAAC,6CAAoB,CAAC;QACnC,SAAS,EAAE,CAAC,uCAAiB,CAAC;QAC9B,OAAO,EAAE,CAAC,uCAAiB,CAAC;KAC7B,CAAC;GACW,gBAAgB,CAAG"}

package/dist/user-device/user-device.service.d.ts

@@ -0,0 +1,71 @@
+import { PaginationDTO, PaginationService } from '@hed-hog/api-pagination';
+import { PrismaService } from '@hed-hog/api-prisma';
+export interface DeviceFingerprint {
+    userAgent?: string | null;
+    browserId?: string | null;
+    ipAddress?: string | null;
+}
+/**
+ * Dispositivos ja vistos por usuario.
+ *
+ * Substitui a heuristica anterior, que procurava no historico de `user_session`
+ * para decidir se um login vinha de um dispositivo novo. Aquilo dependia de
+ * dados que a rotina de limpeza apaga: `clearExpiredSessions` remove sessoes
+ * expiradas com mais de `session-retention-days`, entao um dispositivo parado
+ * alguns meses saia do historico e era anunciado como novo de novo.
+ */
+export declare class UserDeviceService {
+    private readonly prisma;
+    private readonly paginationService;
+    private readonly logger;
+    constructor(prisma: PrismaService, paginationService: PaginationService);
+    /**
+     * `true` quando o usuario ja tem dispositivos registrados e nenhum deles e
+     * este.
+     *
+     * O primeiro login da conta nunca conta como dispositivo novo: nao ha com o
+     * que comparar, e quem acabou de se cadastrar ja recebeu as boas-vindas.
+     *
+     * Tem que rodar ANTES de `remember`, que passa a conhecer o dispositivo atual.
+     */
+    isNewDevice(userId: number, userAgent?: string | null, browserId?: string | null): Promise<boolean>;
+    /**
+     * Registra o dispositivo ou atualiza o ultimo uso.
+     *
+     * Nunca lanca: isto roda dentro do fluxo de login, e falhar em anotar um
+     * dispositivo nao pode impedir alguem de entrar. O custo de engolir o erro e
+     * um alerta repetido no proximo login, nao um login perdido.
+     */
+    remember(userId: number, { userAgent, browserId, ipAddress }: DeviceFingerprint): Promise<void>;
+    /**
+     * Dispositivos de um usuario, do mais recente para o mais antigo.
+     *
+     * Paginado como a lista de sessoes: uma conta antiga acumula dezenas de
+     * dispositivos, e devolver tudo de uma vez entrega uma parede de linhas.
+     *
+     * A `device_key` e lida para marcar qual linha e o aparelho que fez esta
+     * chamada (`current`), mas nunca sai daqui: e derivada do browser_id, entao
+     * devolve-la seria entregar de graca o valor que identifica o dispositivo nas
+     * requisicoes. Sem `fingerprint` — o caso do admin olhando a lista de outra
+     * pessoa — nenhuma linha e a atual.
+     */
+    list(paginationParams: PaginationDTO, userId: number, fingerprint?: DeviceFingerprint): Promise<{
+        data: any;
+        total: any;
+        lastPage: number;
+        page: number;
+        pageSize: number;
+    }>;
+    /**
+     * Esquece um dispositivo. O proximo login vindo dele volta a disparar o
+     * alerta de dispositivo desconhecido — que e a reacao certa para "esse ai nao
+     * fui eu".
+     *
+     * O `user_id` entra no where junto com o id: sem ele, qualquer usuario
+     * autenticado apagaria o dispositivo de qualquer outro so por adivinhar o id.
+     */
+    forget(userId: number, deviceId: number): Promise<{
+        deleted: boolean;
+    }>;
+}
+//# sourceMappingURL=user-device.service.d.ts.map

package/dist/user-device/user-device.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-device.service.d.ts","sourceRoot":"","sources":["../../src/user-device/user-device.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpD,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,qBACa,iBAAiB;IAI1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IALpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;gBAG1C,MAAM,EAAE,aAAa,EAErB,iBAAiB,EAAE,iBAAiB;IAGvD;;;;;;;;OAQG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,OAAO,CAAC;IAiBnB;;;;;;OAMG;IACG,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,iBAAiB,GACrD,OAAO,CAAC,IAAI,CAAC;IA4BhB;;;;;;;;;;;OAWG;IACG,IAAI,CACR,gBAAgB,EAAE,aAAa,EAC/B,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,iBAAiB;;;;;;;IAsCjC;;;;;;;OAOG;IACG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CAO9E"}

package/dist/user-device/user-device.service.js

@@ -0,0 +1,158 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+var UserDeviceService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserDeviceService = void 0;
+const api_pagination_1 = require("@hed-hog/api-pagination");
+const api_prisma_1 = require("@hed-hog/api-prisma");
+const common_1 = require("@nestjs/common");
+const device_key_1 = require("../utils/device-key");
+const user_agent_1 = require("../utils/user-agent");
+/**
+ * Dispositivos ja vistos por usuario.
+ *
+ * Substitui a heuristica anterior, que procurava no historico de `user_session`
+ * para decidir se um login vinha de um dispositivo novo. Aquilo dependia de
+ * dados que a rotina de limpeza apaga: `clearExpiredSessions` remove sessoes
+ * expiradas com mais de `session-retention-days`, entao um dispositivo parado
+ * alguns meses saia do historico e era anunciado como novo de novo.
+ */
+let UserDeviceService = UserDeviceService_1 = class UserDeviceService {
+    constructor(prisma, paginationService) {
+        this.prisma = prisma;
+        this.paginationService = paginationService;
+        this.logger = new common_1.Logger(UserDeviceService_1.name);
+    }
+    /**
+     * `true` quando o usuario ja tem dispositivos registrados e nenhum deles e
+     * este.
+     *
+     * O primeiro login da conta nunca conta como dispositivo novo: nao ha com o
+     * que comparar, e quem acabou de se cadastrar ja recebeu as boas-vindas.
+     *
+     * Tem que rodar ANTES de `remember`, que passa a conhecer o dispositivo atual.
+     */
+    async isNewDevice(userId, userAgent, browserId) {
+        const device_key = (0, device_key_1.buildDeviceKey)(userAgent, browserId);
+        const [anyDevice, knownDevice] = await Promise.all([
+            this.prisma.user_device.findFirst({
+                where: { user_id: userId },
+                select: { id: true },
+            }),
+            this.prisma.user_device.findUnique({
+                where: { user_id_device_key: { user_id: userId, device_key } },
+                select: { id: true },
+            }),
+        ]);
+        return Boolean(anyDevice) && !knownDevice;
+    }
+    /**
+     * Registra o dispositivo ou atualiza o ultimo uso.
+     *
+     * Nunca lanca: isto roda dentro do fluxo de login, e falhar em anotar um
+     * dispositivo nao pode impedir alguem de entrar. O custo de engolir o erro e
+     * um alerta repetido no proximo login, nao um login perdido.
+     */
+    async remember(userId, { userAgent, browserId, ipAddress }) {
+        var _a, _b;
+        const device_key = (0, device_key_1.buildDeviceKey)(userAgent, browserId);
+        const ua = (0, user_agent_1.parseUserAgent)(userAgent);
+        const seen = {
+            browser_id: (browserId !== null && browserId !== void 0 ? browserId : '').trim() || null,
+            user_agent: (userAgent !== null && userAgent !== void 0 ? userAgent : '').trim() || null,
+            browser_name: (_a = ua === null || ua === void 0 ? void 0 : ua.browser_name) !== null && _a !== void 0 ? _a : null,
+            os_name: (_b = ua === null || ua === void 0 ? void 0 : ua.os_name) !== null && _b !== void 0 ? _b : null,
+            last_ip: (ipAddress !== null && ipAddress !== void 0 ? ipAddress : '').trim() || null,
+            last_seen_at: new Date(),
+        };
+        try {
+            await this.prisma.user_device.upsert({
+                where: { user_id_device_key: { user_id: userId, device_key } },
+                create: Object.assign({ user_id: userId, device_key }, seen),
+                update: seen,
+            });
+        }
+        catch (error) {
+            this.logger.error(`Falha ao registrar dispositivo userId=${userId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Dispositivos de um usuario, do mais recente para o mais antigo.
+     *
+     * Paginado como a lista de sessoes: uma conta antiga acumula dezenas de
+     * dispositivos, e devolver tudo de uma vez entrega uma parede de linhas.
+     *
+     * A `device_key` e lida para marcar qual linha e o aparelho que fez esta
+     * chamada (`current`), mas nunca sai daqui: e derivada do browser_id, entao
+     * devolve-la seria entregar de graca o valor que identifica o dispositivo nas
+     * requisicoes. Sem `fingerprint` — o caso do admin olhando a lista de outra
+     * pessoa — nenhuma linha e a atual.
+     */
+    async list(paginationParams, userId, fingerprint) {
+        var _a;
+        const currentKey = fingerprint
+            ? (0, device_key_1.buildDeviceKey)(fingerprint.userAgent, fingerprint.browserId)
+            : null;
+        const paginate = await this.paginationService.paginatePrismaModel(this.prisma.user_device, Object.assign(Object.assign({}, paginationParams), { where: { user_id: userId }, select: {
+                id: true,
+                device_key: true,
+                browser_name: true,
+                os_name: true,
+                user_agent: true,
+                last_ip: true,
+                last_seen_at: true,
+                created_at: true,
+            }, 
+            // Explicito: sem isto a paginacao ordena crescente e a primeira pagina
+            // mostra os dispositivos mais antigos.
+            orderBy: { last_seen_at: 'desc' } }));
+        return Object.assign(Object.assign({}, paginate), { data: ((_a = paginate.data) !== null && _a !== void 0 ? _a : []).map((_a) => {
+                var { device_key } = _a, device = __rest(_a, ["device_key"]);
+                return (Object.assign(Object.assign({}, device), { current: Boolean(currentKey) && device_key === currentKey }));
+            }) });
+    }
+    /**
+     * Esquece um dispositivo. O proximo login vindo dele volta a disparar o
+     * alerta de dispositivo desconhecido — que e a reacao certa para "esse ai nao
+     * fui eu".
+     *
+     * O `user_id` entra no where junto com o id: sem ele, qualquer usuario
+     * autenticado apagaria o dispositivo de qualquer outro so por adivinhar o id.
+     */
+    async forget(userId, deviceId) {
+        const { count } = await this.prisma.user_device.deleteMany({
+            where: { id: deviceId, user_id: userId },
+        });
+        return { deleted: count > 0 };
+    }
+};
+exports.UserDeviceService = UserDeviceService;
+exports.UserDeviceService = UserDeviceService = UserDeviceService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => api_pagination_1.PaginationService))),
+    __metadata("design:paramtypes", [api_prisma_1.PrismaService,
+        api_pagination_1.PaginationService])
+], UserDeviceService);
+//# sourceMappingURL=user-device.service.js.map

package/dist/user-device/user-device.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-device.service.js","sourceRoot":"","sources":["../../src/user-device/user-device.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4DAA2E;AAC3E,oDAAoD;AACpD,2CAAwE;AACxE,oDAAqD;AACrD,oDAAqD;AAQrD;;;;;;;;GAQG;AAEI,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAG5B,YACmB,MAAqB,EAEtC,iBAAqD;QAFpC,WAAM,GAAN,MAAM,CAAe;QAErB,sBAAiB,GAAjB,iBAAiB,CAAmB;QALtC,WAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAM1D,CAAC;IAEJ;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CACf,MAAc,EACd,SAAyB,EACzB,SAAyB;QAEzB,MAAM,UAAU,GAAG,IAAA,2BAAc,EAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAExD,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC;gBAChC,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;gBAC1B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;aACrB,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;gBACjC,KAAK,EAAE,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE;gBAC9D,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;aACrB,CAAC;SACH,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAqB;;QAEtD,MAAM,UAAU,GAAG,IAAA,2BAAc,EAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,IAAA,2BAAc,EAAC,SAAS,CAAC,CAAC;QAErC,MAAM,IAAI,GAAG;YACX,UAAU,EAAE,CAAC,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;YAC5C,UAAU,EAAE,CAAC,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;YAC5C,YAAY,EAAE,MAAA,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,YAAY,mCAAI,IAAI;YACtC,OAAO,EAAE,MAAA,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,OAAO,mCAAI,IAAI;YAC5B,OAAO,EAAE,CAAC,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;YACzC,YAAY,EAAE,IAAI,IAAI,EAAE;SACzB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;gBACnC,KAAK,EAAE,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE;gBAC9D,MAAM,kBAAI,OAAO,EAAE,MAAM,EAAE,UAAU,IAAK,IAAI,CAAE;gBAChD,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yCAAyC,MAAM,KAC7C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,IAAI,CACR,gBAA+B,EAC/B,MAAc,EACd,WAA+B;;QAE/B,MAAM,UAAU,GAAG,WAAW;YAC5B,CAAC,CAAC,IAAA,2BAAc,EAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC;YAC9D,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAC/D,IAAI,CAAC,MAAM,CAAC,WAAW,kCAElB,gBAAgB,KACnB,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAC1B,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,UAAU,EAAE,IAAI;gBAChB,YAAY,EAAE,IAAI;gBAClB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,IAAI;gBAChB,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,IAAI;aACjB;YACD,uEAAuE;YACvE,uCAAuC;YACvC,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,IAEpC,CAAC;QAEF,uCACK,QAAQ,KACX,IAAI,EAAE,CAAC,MAAA,QAAQ,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAC,GAAG,CAC7B,CAAC,EAAiD,EAAE,EAAE;oBAArD,EAAE,UAAU,OAAqC,EAAhC,MAAM,cAAvB,cAAyB,CAAF;gBAA+B,OAAA,iCAClD,MAAM,KACT,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,KAAK,UAAU,IACzD,CAAA;aAAA,CACH,IACD;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAAgB;QAC3C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;YACzD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;SACzC,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;IAChC,CAAC;CACF,CAAA;AAjJY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,kCAAiB,CAAC,CAAC,CAAA;qCADnB,0BAAa;QAEF,kCAAiB;GAN5C,iBAAiB,CAiJ7B"}

package/dist/utils/device-key.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Identidade estavel de um dispositivo para um usuario.
+ *
+ * O `browser_id` (UUID em localStorage, header X-Browser-ID) e o sinal forte e
+ * tem precedencia. Sem ele — app desktop, integracoes, clientes que nao mandam
+ * o header — cai no User-Agent, que erra para menos (nao distingue dois
+ * dispositivos com o mesmo UA) e nunca para mais.
+ *
+ * O resultado e um sha256 hex de largura fixa, e nao o valor cru, para caber
+ * num indice unico junto com o user_id sem depender do tamanho do UA. O
+ * `browser_id` e o `user_agent` continuam gravados em colunas proprias de
+ * `user_device`, entao nada de diagnostico se perde no hash.
+ *
+ * O prefixo `b:`/`u:` impede que um User-Agent que por acaso seja igual a um
+ * browser_id colida com ele.
+ *
+ * IMPORTANTE: a migration 20260808140000_core_user_device reproduz esta mesma
+ * expressao em SQL para popular a tabela a partir do historico de sessoes. Ao
+ * mudar a normalizacao aqui, as chaves ja gravadas deixam de casar e todo
+ * dispositivo conhecido vira "novo" — o que dispara um alerta para cada usuario.
+ */
+export declare function buildDeviceKey(userAgent?: string | null, browserId?: string | null): string;
+//# sourceMappingURL=device-key.d.ts.map

package/dist/utils/device-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-key.d.ts","sourceRoot":"","sources":["../../src/utils/device-key.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,cAAc,CAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,CAKR"}

package/dist/utils/device-key.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildDeviceKey = buildDeviceKey;
+const crypto_1 = require("crypto");
+/**
+ * Identidade estavel de um dispositivo para um usuario.
+ *
+ * O `browser_id` (UUID em localStorage, header X-Browser-ID) e o sinal forte e
+ * tem precedencia. Sem ele — app desktop, integracoes, clientes que nao mandam
+ * o header — cai no User-Agent, que erra para menos (nao distingue dois
+ * dispositivos com o mesmo UA) e nunca para mais.
+ *
+ * O resultado e um sha256 hex de largura fixa, e nao o valor cru, para caber
+ * num indice unico junto com o user_id sem depender do tamanho do UA. O
+ * `browser_id` e o `user_agent` continuam gravados em colunas proprias de
+ * `user_device`, entao nada de diagnostico se perde no hash.
+ *
+ * O prefixo `b:`/`u:` impede que um User-Agent que por acaso seja igual a um
+ * browser_id colida com ele.
+ *
+ * IMPORTANTE: a migration 20260808140000_core_user_device reproduz esta mesma
+ * expressao em SQL para popular a tabela a partir do historico de sessoes. Ao
+ * mudar a normalizacao aqui, as chaves ja gravadas deixam de casar e todo
+ * dispositivo conhecido vira "novo" — o que dispara um alerta para cada usuario.
+ */
+function buildDeviceKey(userAgent, browserId) {
+    const browser = (browserId !== null && browserId !== void 0 ? browserId : '').trim();
+    const source = browser ? `b:${browser}` : `u:${(userAgent !== null && userAgent !== void 0 ? userAgent : '').trim()}`;
+    return (0, crypto_1.createHash)('sha256').update(source, 'utf8').digest('hex');
+}
+//# sourceMappingURL=device-key.js.map

package/dist/utils/device-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-key.js","sourceRoot":"","sources":["../../src/utils/device-key.ts"],"names":[],"mappings":";;AAuBA,wCAQC;AA/BD,mCAAoC;AAEpC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,cAAc,CAC5B,SAAyB,EACzB,SAAyB;IAEzB,MAAM,OAAO,GAAG,CAAC,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAE1E,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC"}

package/dist/utils/geo-ip.d.ts

@@ -0,0 +1,38 @@
+export interface GeoLocation {
+    /** ISO 3166-1 alpha-2, e.g. 'BR'. */
+    country: string | null;
+    /** Subdivision code, e.g. 'SP'. */
+    region: string | null;
+    city: string | null;
+    /** IANA timezone, e.g. 'America/Sao_Paulo'. */
+    timezone: string | null;
+}
+/**
+ * Strips the IPv4-mapped IPv6 prefix and any trailing port, and unwraps the
+ * bracket notation used for IPv6 hosts.
+ *
+ * Without this, `::ffff:189.1.2.3` — what a dual-stack socket reports — is
+ * looked up in the IPv6 database and always misses.
+ */
+export declare function normalizeIp(ip?: string | null): string | null;
+/**
+ * Loopback, private, link-local and CGNAT ranges — plus the placeholders the
+ * callers use when they could not resolve anything.
+ *
+ * The cluster pod CIDR (10.244.x.x) falls here, which is exactly what every
+ * ticket created before the client IP started being forwarded has stored.
+ *
+ * Careful with 172: only 172.16.0.0/12 is private, so the second octet has to
+ * be between 16 and 31. Blocking the whole `172.` prefix — as the copy in
+ * lms/platforma/handlers/lesson-heartbeat.handler.ts does — silently discards
+ * public addresses such as 172.32.5.9.
+ */
+export declare function isPrivateIp(ip?: string | null): boolean;
+/**
+ * Offline lookup against the MaxMind-lite database bundled with geoip-lite.
+ *
+ * Returns null for empty, private or unknown addresses — never an invented
+ * country, which is what makes it safe to render the result directly.
+ */
+export declare function lookupGeo(ip?: string | null): GeoLocation | null;
+//# sourceMappingURL=geo-ip.d.ts.map

package/dist/utils/geo-ip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"geo-ip.d.ts","sourceRoot":"","sources":["../../src/utils/geo-ip.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,WAAW;IAC1B,qCAAqC;IACrC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mCAAmC;IACnC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAc7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAwBvD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,GAAG,IAAI,CAahE"}

package/dist/utils/geo-ip.js

@@ -0,0 +1,122 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeIp = normalizeIp;
+exports.isPrivateIp = isPrivateIp;
+exports.lookupGeo = lookupGeo;
+const geoip = __importStar(require("geoip-lite"));
+/**
+ * Strips the IPv4-mapped IPv6 prefix and any trailing port, and unwraps the
+ * bracket notation used for IPv6 hosts.
+ *
+ * Without this, `::ffff:189.1.2.3` — what a dual-stack socket reports — is
+ * looked up in the IPv6 database and always misses.
+ */
+function normalizeIp(ip) {
+    const raw = (ip !== null && ip !== void 0 ? ip : '').trim();
+    if (!raw)
+        return null;
+    // `[2001:db8::1]:443` -> `2001:db8::1`
+    const bracketed = raw.match(/^\[(.+)\](?::\d+)?$/);
+    const value = bracketed ? bracketed[1] : raw;
+    const unmapped = value.replace(/^::ffff:/i, '');
+    // `189.1.2.3:51000` -> `189.1.2.3` (only for IPv4; a bare IPv6 has many colons)
+    const withoutPort = unmapped.match(/^(\d{1,3}(?:\.\d{1,3}){3}):\d+$/);
+    return (withoutPort ? withoutPort[1] : unmapped) || null;
+}
+/**
+ * Loopback, private, link-local and CGNAT ranges — plus the placeholders the
+ * callers use when they could not resolve anything.
+ *
+ * The cluster pod CIDR (10.244.x.x) falls here, which is exactly what every
+ * ticket created before the client IP started being forwarded has stored.
+ *
+ * Careful with 172: only 172.16.0.0/12 is private, so the second octet has to
+ * be between 16 and 31. Blocking the whole `172.` prefix — as the copy in
+ * lms/platforma/handlers/lesson-heartbeat.handler.ts does — silently discards
+ * public addresses such as 172.32.5.9.
+ */
+function isPrivateIp(ip) {
+    const value = normalizeIp(ip);
+    if (!value)
+        return true;
+    const lower = value.toLowerCase();
+    if (lower === 'unknown' || lower === '::' || lower === '0.0.0.0')
+        return true;
+    // IPv6: loopback, unique local (fc00::/7) and link-local (fe80::/10).
+    if (lower === '::1')
+        return true;
+    if (/^f[cd]/.test(lower) && lower.includes(':'))
+        return true;
+    if (/^fe[89ab]/.test(lower) && lower.includes(':'))
+        return true;
+    const v4 = lower.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (!v4)
+        return false;
+    const [a, b] = [Number(v4[1]), Number(v4[2])];
+    if (a === 0 || a === 10 || a === 127)
+        return true;
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    if (a === 192 && b === 168)
+        return true;
+    if (a === 169 && b === 254)
+        return true;
+    // CGNAT 100.64.0.0/10
+    if (a === 100 && b >= 64 && b <= 127)
+        return true;
+    return false;
+}
+/**
+ * Offline lookup against the MaxMind-lite database bundled with geoip-lite.
+ *
+ * Returns null for empty, private or unknown addresses — never an invented
+ * country, which is what makes it safe to render the result directly.
+ */
+function lookupGeo(ip) {
+    const value = normalizeIp(ip);
+    if (!value || isPrivateIp(value))
+        return null;
+    const geo = geoip.lookup(value);
+    if (!geo)
+        return null;
+    return {
+        country: geo.country || null,
+        region: geo.region || null,
+        city: geo.city || null,
+        timezone: geo.timezone || null,
+    };
+}
+//# sourceMappingURL=geo-ip.js.map

package/dist/utils/geo-ip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"geo-ip.js","sourceRoot":"","sources":["../../src/utils/geo-ip.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,kCAcC;AAcD,kCAwBC;AAQD,8BAaC;AA5FD,kDAAoC;AAYpC;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,EAAkB;IAC5C,MAAM,GAAG,GAAG,CAAC,EAAE,aAAF,EAAE,cAAF,EAAE,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,uCAAuC;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAE7C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAEhD,gFAAgF;IAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAEtE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,WAAW,CAAC,EAAkB;IAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAE9E,sEAAsE;IACtE,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhE,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACvE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAEtB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,sBAAsB;IACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAElD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,EAAkB;IAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QAC1B,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;KAC/B,CAAC;AACJ,CAAC"}

package/dist/utils/locale-context.d.ts

@@ -1,8 +1,11 @@
-import { AsyncLocalStorage } from 'async_hooks';
-interface LocaleContext {
-    locale: string;
-}
-export declare const localeStorage: AsyncLocalStorage<LocaleContext>;
-export declare function getLocaleFromContext(): string;
-export {};
+/**
+ * O contexto de locale mora em `@hed-hog/api-locale`, junto do middleware que o
+ * popula. Este arquivo continua existindo como reexport porque `@hed-hog/core`
+ * e a fachada que as outras libraries importam (`operations`, validators).
+ *
+ * Manter uma copia do `AsyncLocalStorage` aqui criaria DOIS storages: o
+ * middleware escreveria num e `getLocaleFromContext()` leria o outro, sempre
+ * vazio.
+ */
+export { getLocaleFromContext, isLocaleDetectedFromContext, localeStorage, type LocaleContext, } from '@hed-hog/api-locale';
 //# sourceMappingURL=locale-context.d.ts.map

package/dist/utils/locale-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"locale-context.d.ts","sourceRoot":"","sources":["../../src/utils/locale-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,aAAa,kCAAyC,CAAC;AAEpE,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C"}
+{"version":3,"file":"locale-context.d.ts","sourceRoot":"","sources":["../../src/utils/locale-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,aAAa,EACb,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC"}

package/dist/utils/locale-context.js

@@ -1,11 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.localeStorage = void 0;
-exports.getLocaleFromContext = getLocaleFromContext;
-const async_hooks_1 = require("async_hooks");
-exports.localeStorage = new async_hooks_1.AsyncLocalStorage();
-function getLocaleFromContext() {
-    const context = exports.localeStorage.getStore();
-    return (context === null || context === void 0 ? void 0 : context.locale) || 'en';
-}
+exports.localeStorage = exports.isLocaleDetectedFromContext = exports.getLocaleFromContext = void 0;
+/**
+ * O contexto de locale mora em `@hed-hog/api-locale`, junto do middleware que o
+ * popula. Este arquivo continua existindo como reexport porque `@hed-hog/core`
+ * e a fachada que as outras libraries importam (`operations`, validators).
+ *
+ * Manter uma copia do `AsyncLocalStorage` aqui criaria DOIS storages: o
+ * middleware escreveria num e `getLocaleFromContext()` leria o outro, sempre
+ * vazio.
+ */
+var api_locale_1 = require("@hed-hog/api-locale");
+Object.defineProperty(exports, "getLocaleFromContext", { enumerable: true, get: function () { return api_locale_1.getLocaleFromContext; } });
+Object.defineProperty(exports, "isLocaleDetectedFromContext", { enumerable: true, get: function () { return api_locale_1.isLocaleDetectedFromContext; } });
+Object.defineProperty(exports, "localeStorage", { enumerable: true, get: function () { return api_locale_1.localeStorage; } });
 //# sourceMappingURL=locale-context.js.map

package/dist/utils/locale-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"locale-context.js","sourceRoot":"","sources":["../../src/utils/locale-context.ts"],"names":[],"mappings":";;;AAQA,oDAGC;AAXD,6CAAgD;AAMnC,QAAA,aAAa,GAAG,IAAI,+BAAiB,EAAiB,CAAC;AAEpE,SAAgB,oBAAoB;IAClC,MAAM,OAAO,GAAG,qBAAa,CAAC,QAAQ,EAAE,CAAC;IACzC,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,KAAI,IAAI,CAAC;AACjC,CAAC"}
+{"version":3,"file":"locale-context.js","sourceRoot":"","sources":["../../src/utils/locale-context.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACH,kDAK6B;AAJ3B,kHAAA,oBAAoB,OAAA;AACpB,yHAAA,2BAA2B,OAAA;AAC3B,2GAAA,aAAa,OAAA"}

package/dist/utils/security-event-vars.d.ts

@@ -0,0 +1,56 @@
+export interface SecurityEventContext {
+    ipAddress?: string | null;
+    userAgent?: string | null;
+    /** Codigo da tabela `locale` ('pt' | 'en' | 'es'), como chega do LocaleMiddleware. */
+    locale?: string | null;
+    /** Momento do evento. Default: agora. */
+    at?: Date;
+    /** Fuso quando o geoip nao resolve. Default: DEFAULT_TIME_ZONE. */
+    fallbackTimeZone?: string;
+}
+/**
+ * Variaveis prontas para os templates de e-mail de seguranca
+ * (`auth-login-new-device`, `auth-change-password-notification`).
+ *
+ * Todo campo e string, nunca null: `sendTemplatedMail` recebe um
+ * Record<string, string> e os templates usam `{{#if}}` para esconder a linha
+ * do cartao — string vazia e o que faz a linha sumir.
+ */
+export interface SecurityEventVars {
+    ipAddress: string;
+    /** UA cru; o template so imprime quando nao conseguiu identificar navegador nem SO. */
+    userAgent: string;
+    /** "Chrome 151" */
+    browser: string;
+    /** "Windows 10" */
+    os: string;
+    /** "Sao Paulo, Brasil" */
+    location: string;
+    /** "🇧🇷" */
+    countryFlag: string;
+    /** "8 de agosto de 2026 as 12:04" */
+    datetime: string;
+}
+/**
+ * Par de regional indicators para um ISO 3166-1 alpha-2.
+ *
+ * Mesma conta do countryFlag() em apps/admin/src/components/browser-os-icon.tsx,
+ * reimplementada aqui porque aquele arquivo e 'use client' e vive no app.
+ *
+ * Emoji e a unica forma de bandeira que renderiza nos tres clientes que
+ * importam: o Gmail remove <svg> inline e bloqueia data: URI, e o Outlook
+ * desktop nao renderiza SVG de jeito nenhum.
+ */
+export declare function countryFlagEmoji(code?: string | null): string;
+export declare function formatEventDateTime(at: Date, locale?: string | null, timeZone?: string | null): string;
+/**
+ * Traduz IP + User-Agent crus nas variaveis que o template de seguranca
+ * imprime, resolvendo geolocalizacao e navegador/SO pelos utilitarios que o
+ * access-log ja usa.
+ *
+ * O que nao foi possivel resolver volta como string vazia, e nao como um
+ * "Unknown" literal: o template esconde a linha inteira em vez de anunciar
+ * que o sistema nao sabe.
+ */
+export declare function buildSecurityEventVars(ctx: SecurityEventContext): SecurityEventVars;
+//# sourceMappingURL=security-event-vars.d.ts.map