@mybuildex/pkg 0.2.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gabriel Alencar / MyBuilder
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,49 @@
+# @mybuildex/pkg
+
+Infra comum das APIs MyBuilder (fonte única): multitenancy Prisma com **pool único** compartilhado entre escolas, middleware de tenant (`:id_school` da URL decide o schema) e CORS padrão.
+
+## Módulos
+
+- `createMultitenantPrisma` — fábrica: 1 pool mariadb para a instância inteira; client por escola é leve e só qualifica o database no SQL gerado. Pool **sem database default** (raw sem qualificar falha alto — Error 1046 — em vez de vazar para o tenant errado). Suporta `?socket=/cloudsql/...` (prod) e `host:porta` (dev/túnel).
+- `createTenantMiddleware` — hook `preValidation` que injeta `req.prisma` resolvendo `params.id_school → query.id_school → header x-id-school` (só inteiro positivo; inválido cai no default).
+- `resolveTenantId` — a regra de resolução, exportada para testes/usos avulsos.
+- `createCorsPlugin` — CORS padrão das APIs.
+
+## Uso (numa API)
+
+```ts
+import mariadb from "mariadb";
+import {PrismaMariaDb} from "@prisma/adapter-mariadb";
+import {PrismaClient} from "./generated/client";
+import {createMultitenantPrisma, createTenantMiddleware} from "@mybuildex/pkg";
+
+const mt = createMultitenantPrisma({
+  databaseUrl: process.env.DATABASE_URL!,
+  PrismaClient, PrismaMariaDb, createPool: mariadb.createPool,
+});
+// fastify.register(mt.plugin) + fastify.register(createTenantMiddleware(mt))
+```
+
+A lib **não** depende de `@prisma/client`/`mariadb`: cada API injeta o client gerado e o driver nas versões dela.
+
+## Consumo pelas APIs (npmjs público)
+
+O pacote é publicado **público no npmjs** — só o `dist/` compilado vai no tarball (`files: ["dist"]`); testes e repo continuam privados. Zero token: `npm i` funciona no dev, no Actions e no build do GCP.
+
+```bash
+npm i @mybuildex/pkg
+```
+
+### Release
+
+1. Bump da versão no `package.json` (`npm version patch|minor` local, sem push automático).
+2. Commit + tag `vX.Y.Z` + push da tag → o workflow [publish.yml](.github/workflows/publish.yml) roda testes e publica (secret `NPM_TOKEN`).
+3. Nas APIs: `npm update @mybuildex/pkg` (ou bump da range no package.json).
+
+## Testes
+
+```bash
+npm test
+```
+
+Inclui o teste de isolamento ponta a ponta (`test/isolation.spec.ts`): URL → middleware → prisma, com 50 requests concorrentes intercalando escolas — dados de uma escola **nunca** aparecem na resposta de outra.

package/dist/ai/gemini.d.ts

@@ -0,0 +1,24 @@
+export declare const EMBED_DIM: number;
+export declare const GEMINI_MODEL: string;
+export declare const EMBED_MODEL: string;
+export declare class GeminiHelp {
+    static isConfigured(): boolean;
+    static getClient(): any;
+    static withRetry<T>(fn: () => Promise<T>, tries?: number, baseDelayMs?: number): Promise<T>;
+    static uploadAudio(path: string, mimeType?: string): Promise<any>;
+    static deleteFile(name: string): Promise<void>;
+    static generateJson(parts: any[], config?: any): Promise<any>;
+    /**
+     * Geracao em STREAMING (texto puro, sem responseMimeType JSON — JSON nao
+     * streama bem). Chama onChunk a cada pedaco; para cedo se shouldStop()
+     * (cliente desconectou). Retorna o texto completo + usage do final.
+     */
+    static generateTextStream(parts: any[], config: any, onChunk: (text: string) => void, shouldStop?: () => boolean): Promise<{
+        text: string;
+        usage: any;
+    }>;
+    static filePart(file: any): any;
+    static normalize(vec: number[]): number[];
+    static embed(texts: string[], taskType: string): Promise<number[][]>;
+    static cosine(a: number[], b: number[]): number;
+}

package/dist/ai/gemini.js

@@ -0,0 +1,160 @@
+"use strict";
+// Helper Gemini compartilhado (transcrição, embeddings, chat RAG).
+// `@google/genai` é peer dep, carregado sob demanda — APIs que não usam IA
+// não pagam o import. Chave SEMPRE via env GEMINI_API_KEY.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GeminiHelp = exports.EMBED_MODEL = exports.GEMINI_MODEL = exports.EMBED_DIM = void 0;
+// Dimensão fixa do índice: mudar exige reprocessar todos os cursos.
+exports.EMBED_DIM = parseInt(process.env.AI_EMBED_DIM || "768");
+exports.GEMINI_MODEL = process.env.AI_GEMINI_MODEL || "gemini-2.5-flash";
+exports.EMBED_MODEL = process.env.AI_EMBED_MODEL || "gemini-embedding-001";
+const MAX_EMBED_BATCH = 100;
+let client = null;
+let genaiModule = null;
+/* eslint-disable @typescript-eslint/no-var-requires */
+function genai() {
+    if (!genaiModule)
+        genaiModule = require("@google/genai");
+    return genaiModule;
+}
+class GeminiHelp {
+    // Ambientes sem a chave (ex: so dev configurado) degradam com resposta
+    // amigavel em vez de 500 — checar antes de qualquer chamada ao Gemini.
+    static isConfigured() {
+        return !!process.env.GEMINI_API_KEY;
+    }
+    static getClient() {
+        if (!process.env.GEMINI_API_KEY)
+            throw new Error("GEMINI_API_KEY nao configurada");
+        if (!client)
+            client = new (genai().GoogleGenAI)({ apiKey: process.env.GEMINI_API_KEY });
+        return client;
+    }
+    static async withRetry(fn, tries = 3, baseDelayMs = 1500) {
+        let lastErr;
+        for (let i = 0; i < tries; i++) {
+            try {
+                return await fn();
+            }
+            catch (e) {
+                lastErr = e;
+                const status = e?.status || e?.code;
+                // 4xx (exceto 429) nao adianta repetir
+                if (status && status !== 429 && status < 500)
+                    throw e;
+                await new Promise(r => setTimeout(r, baseDelayMs * (i + 1)));
+            }
+        }
+        throw lastErr;
+    }
+    static async uploadAudio(path, mimeType = "audio/mp3") {
+        const ai = GeminiHelp.getClient();
+        let file = await ai.files.upload({ file: path, config: { mimeType } });
+        const started = Date.now();
+        while (file.state === "PROCESSING" && (Date.now() - started) < 120000) {
+            await new Promise(r => setTimeout(r, 2000));
+            file = await ai.files.get({ name: file.name });
+        }
+        if (file.state !== "ACTIVE")
+            throw new Error(`Gemini file nao ficou ACTIVE (state=${file.state})`);
+        return file;
+    }
+    static async deleteFile(name) {
+        try {
+            await GeminiHelp.getClient().files.delete({ name });
+        }
+        catch (e) {
+            console.log("gemini deleteFile", e);
+        }
+    }
+    static async generateJson(parts, config = {}) {
+        const ai = GeminiHelp.getClient();
+        const call = async () => {
+            const resp = await ai.models.generateContent({
+                model: exports.GEMINI_MODEL,
+                contents: genai().createUserContent(parts),
+                config: { responseMimeType: "application/json", temperature: 0.2, ...config },
+            });
+            const text = (resp.text || "").replace(/^```(json)?/m, "").replace(/```$/m, "").trim();
+            return { json: JSON.parse(text), usage: resp.usageMetadata };
+        };
+        // parse defensivo: 1 retry extra alem dos retries de rede
+        return await GeminiHelp.withRetry(async () => {
+            try {
+                return await call();
+            }
+            catch (e) {
+                if (e instanceof SyntaxError)
+                    return await call();
+                throw e;
+            }
+        });
+    }
+    /**
+     * Geracao em STREAMING (texto puro, sem responseMimeType JSON — JSON nao
+     * streama bem). Chama onChunk a cada pedaco; para cedo se shouldStop()
+     * (cliente desconectou). Retorna o texto completo + usage do final.
+     */
+    static async generateTextStream(parts, config, onChunk, shouldStop) {
+        const ai = GeminiHelp.getClient();
+        const stream = await GeminiHelp.withRetry(() => ai.models.generateContentStream({
+            model: exports.GEMINI_MODEL,
+            contents: genai().createUserContent(parts),
+            config: { temperature: 0.2, ...config },
+        }));
+        let full = "";
+        let usage = null;
+        for await (const chunk of stream) {
+            if (shouldStop?.())
+                break;
+            const text = chunk.text || "";
+            if (text) {
+                full += text;
+                onChunk(text);
+            }
+            if (chunk.usageMetadata)
+                usage = chunk.usageMetadata;
+        }
+        return { text: full, usage };
+    }
+    static filePart(file) {
+        return genai().createPartFromUri(file.uri, file.mimeType);
+    }
+    static normalize(vec) {
+        let norm = 0;
+        for (const v of vec)
+            norm += v * v;
+        norm = Math.sqrt(norm) || 1;
+        return vec.map(v => v / norm);
+    }
+    // Embeddings em lote. taskType: RETRIEVAL_DOCUMENT (indexacao) | RETRIEVAL_QUERY (pergunta).
+    static async embed(texts, taskType) {
+        const ai = GeminiHelp.getClient();
+        const out = [];
+        for (let i = 0; i < texts.length; i += MAX_EMBED_BATCH) {
+            const batch = texts.slice(i, i + MAX_EMBED_BATCH);
+            const resp = await GeminiHelp.withRetry(() => ai.models.embedContent({
+                model: exports.EMBED_MODEL,
+                contents: batch,
+                config: { taskType, outputDimensionality: exports.EMBED_DIM },
+            }));
+            for (const emb of (resp.embeddings || [])) {
+                // com outputDimensionality < 3072 o vetor nao vem normalizado
+                out.push(GeminiHelp.normalize(emb.values));
+            }
+        }
+        if (out.length !== texts.length)
+            throw new Error("embeddings incompletos");
+        return out;
+    }
+    static cosine(a, b) {
+        // vetores ja normalizados -> produto escalar
+        let dot = 0;
+        const n = Math.min(a.length, b.length);
+        for (let i = 0; i < n; i++)
+            dot += a[i] * b[i];
+        return dot;
+    }
+}
+exports.GeminiHelp = GeminiHelp;
+//# sourceMappingURL=gemini.js.map

package/dist/ai/gemini.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini.js","sourceRoot":"","sources":["../../src/ai/gemini.ts"],"names":[],"mappings":";AAAA,mEAAmE;AACnE,2EAA2E;AAC3E,2DAA2D;;;AAE3D,oEAAoE;AACvD,QAAA,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC,CAAC;AACxD,QAAA,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,kBAAkB,CAAC;AACjE,QAAA,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,sBAAsB,CAAC;AAEhF,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,IAAI,MAAM,GAAQ,IAAI,CAAC;AACvB,IAAI,WAAW,GAAQ,IAAI,CAAC;AAE5B,uDAAuD;AACvD,SAAS,KAAK;IACV,IAAI,CAAC,WAAW;QAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACzD,OAAO,WAAW,CAAC;AACvB,CAAC;AAED,MAAa,UAAU;IAEnB,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,CAAC,YAAY;QACf,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,SAAS;QACZ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,EAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAC,CAAC,CAAC;QACtF,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,SAAS,CAAI,EAAoB,EAAE,KAAK,GAAG,CAAC,EAAE,WAAW,GAAG,IAAI;QACzE,IAAI,OAAY,CAAC;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACD,OAAO,MAAM,EAAE,EAAE,CAAC;YACtB,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBACd,OAAO,GAAG,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,IAAI,CAAC;gBACpC,uCAAuC;gBACvC,IAAI,MAAM,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,GAAG,GAAG;oBAAE,MAAM,CAAC,CAAC;gBACtD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,CAAC;QACL,CAAC;QACD,MAAM,OAAO,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,QAAQ,GAAG,WAAW;QACzD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;QAClC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAC,QAAQ,EAAC,EAAC,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC;YACpE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAC5C,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,IAAI,CAAC,IAAc,EAAC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACnG,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAY;QAChC,IAAI,CAAC;YACD,MAAM,UAAU,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;QACxC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAY,EAAE,SAAc,EAAE;QACpD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACpB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;gBACzC,KAAK,EAAE,oBAAY;gBACnB,QAAQ,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;gBAC1C,MAAM,EAAE,EAAC,gBAAgB,EAAE,kBAAkB,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,MAAM,EAAC;aAC9E,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACvF,OAAO,EAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAC,CAAC;QAC/D,CAAC,CAAC;QACF,0DAA0D;QAC1D,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YACzC,IAAI,CAAC;gBACD,OAAO,MAAM,IAAI,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBACd,IAAI,CAAC,YAAY,WAAW;oBAAE,OAAO,MAAM,IAAI,EAAE,CAAC;gBAClD,MAAM,CAAC,CAAC;YACZ,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAC3B,KAAY,EACZ,MAAW,EACX,OAA+B,EAC/B,UAA0B;QAE1B,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,GAAQ,MAAM,UAAU,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC;YACjF,KAAK,EAAE,oBAAY;YACnB,QAAQ,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAC1C,MAAM,EAAE,EAAC,WAAW,EAAE,GAAG,EAAE,GAAG,MAAM,EAAC;SACxC,CAAC,CAAC,CAAC;QACJ,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,GAAQ,IAAI,CAAC;QACtB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC/B,IAAI,UAAU,EAAE,EAAE;gBAAE,MAAM;YAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YAC9B,IAAI,IAAI,EAAE,CAAC;gBACP,IAAI,IAAI,IAAI,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,KAAK,CAAC,aAAa;gBAAE,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC;QACzD,CAAC;QACD,OAAO,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAC,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAS;QACrB,OAAO,KAAK,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAa,EAAE,IAAI,CAAC,QAAkB,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,GAAa;QAC1B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,6FAA6F;IAC7F,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAe,EAAE,QAAgB;QAChD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,GAAG,GAAe,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,eAAe,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC;YAClD,MAAM,IAAI,GAAQ,MAAM,UAAU,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;gBACtE,KAAK,EAAE,mBAAW;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,EAAC,QAAQ,EAAE,oBAAoB,EAAE,iBAAS,EAAC;aACtD,CAAC,CAAC,CAAC;YACJ,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;gBACxC,8DAA8D;gBAC9D,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,MAAkB,CAAC,CAAC,CAAC;YAC3D,CAAC;QACL,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,CAAW,EAAE,CAAW;QAClC,6CAA6C;QAC7C,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC;IACf,CAAC;CACJ;AA7ID,gCA6IC"}

package/dist/cors/plugin.d.ts

@@ -0,0 +1,6 @@
+export interface CorsOptions {
+    origin?: string | string[] | boolean;
+    methods?: string[];
+}
+export declare const DEFAULT_CORS: Required<CorsOptions>;
+export declare function createCorsPlugin(options?: CorsOptions): (fastify: any) => Promise<void>;

package/dist/cors/plugin.js

@@ -0,0 +1,51 @@
+"use strict";
+// CORS padrão das APIs MyBuilder. Centralizado para que um ajuste de política
+// (ex: restringir origin por ambiente) seja feito UMA vez.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CORS = void 0;
+exports.createCorsPlugin = createCorsPlugin;
+exports.DEFAULT_CORS = {
+    origin: "*",
+    methods: ["GET", "PUT", "POST", "DELETE", "PATCH", "OPTIONS"],
+};
+function createCorsPlugin(options) {
+    return async function pluginCors(fastify) {
+        // import dinâmico: @fastify/cors é peer dependency opcional
+        const cors = (await Promise.resolve().then(() => __importStar(require("@fastify/cors")))).default;
+        await fastify.register(cors, { ...exports.DEFAULT_CORS, ...options });
+    };
+}
+//# sourceMappingURL=plugin.js.map

package/dist/cors/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/cors/plugin.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,2DAA2D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAY3D,4CAMC;AAXY,QAAA,YAAY,GAA0B;IAC/C,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;CAChE,CAAC;AAEF,SAAgB,gBAAgB,CAAC,OAAqB;IAClD,OAAO,KAAK,UAAU,UAAU,CAAC,OAAY;QACzC,4DAA4D;QAC5D,MAAM,IAAI,GAAG,CAAC,wDAAa,eAAe,GAAC,CAAC,CAAC,OAAO,CAAC;QACrD,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAC,GAAG,oBAAY,EAAE,GAAG,OAAO,EAAC,CAAC,CAAC;IAChE,CAAC,CAAC;AACN,CAAC"}

package/dist/firebase/admin.d.ts

@@ -0,0 +1,7 @@
+export interface FirebaseAdminOptions {
+    /** Caminho do arquivo de service account para dev local (fallback:
+     *  env FIREBASE_CREDENTIALS_FILE). Ignorado quando ADC está disponível. */
+    credentialsFile?: string;
+}
+export declare function initFirebaseAdmin(options?: FirebaseAdminOptions): any;
+export declare function getTenantAuth(tenantId: string | undefined): any;

package/dist/firebase/admin.js

@@ -0,0 +1,50 @@
+"use strict";
+// Firebase ADMIN SDK, ADC-first (padrão em produção no GCP — nenhum arquivo
+// de credencial no bundle). Para dev local SEM ADC, o caminho do arquivo de
+// service account vem de env (FIREBASE_CREDENTIALS_FILE) ou de opção — a lib
+// NUNCA embute credencial. `firebase-admin` é peer dep.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initFirebaseAdmin = initFirebaseAdmin;
+exports.getTenantAuth = getTenantAuth;
+let adminInstance = null;
+function initFirebaseAdmin(options = {}) {
+    if (adminInstance)
+        return adminInstance;
+    /* eslint-disable @typescript-eslint/no-var-requires */
+    const admin = require("firebase-admin");
+    if (!admin.apps.length) {
+        const useADC = process.env.USE_ADC === "true" ||
+            !!process.env.GOOGLE_APPLICATION_CREDENTIALS;
+        if (useADC) {
+            admin.initializeApp(); // ADC: credencial do ambiente
+        }
+        else {
+            const file = options.credentialsFile || process.env.FIREBASE_CREDENTIALS_FILE;
+            if (!file) {
+                // Sem ADC e sem arquivo: inicializa via ADC mesmo assim — em
+                // ambientes GCP funciona; fora, falha alto na primeira chamada
+                // (melhor que embutir credencial).
+                admin.initializeApp();
+            }
+            else {
+                const serviceAccount = require(file);
+                admin.initializeApp({ credential: admin.credential.cert(serviceAccount) });
+            }
+        }
+    }
+    adminInstance = admin;
+    return admin;
+}
+// --- helper multi-tenant cacheado (Firebase Auth: 1 tenant por escola) ---
+const tenantAuthCache = new Map();
+function getTenantAuth(tenantId) {
+    if (!tenantId)
+        throw new Error("Token sem claim de tenant Firebase");
+    let a = tenantAuthCache.get(tenantId);
+    if (!a) {
+        a = initFirebaseAdmin().auth().tenantManager().authForTenant(tenantId);
+        tenantAuthCache.set(tenantId, a);
+    }
+    return a;
+}
+//# sourceMappingURL=admin.js.map

package/dist/firebase/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/firebase/admin.ts"],"names":[],"mappings":";AAAA,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,wDAAwD;;AAUxD,8CA2BC;AAKD,sCAQC;AAhDD,IAAI,aAAa,GAAQ,IAAI,CAAC;AAQ9B,SAAgB,iBAAiB,CAAC,UAAgC,EAAE;IAChE,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,uDAAuD;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAExC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,MAAM,GACR,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,MAAM;YAC9B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAEjD,IAAI,MAAM,EAAE,CAAC;YACT,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,8BAA8B;QACzD,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,GAAG,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;YAC9E,IAAI,CAAC,IAAI,EAAE,CAAC;gBACR,6DAA6D;gBAC7D,+DAA+D;gBAC/D,mCAAmC;gBACnC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACJ,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;gBACrC,KAAK,CAAC,aAAa,CAAC,EAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,EAAC,CAAC,CAAC;YAC7E,CAAC;QACL,CAAC;IACL,CAAC;IACD,aAAa,GAAG,KAAK,CAAC;IACtB,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,4EAA4E;AAC5E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAe,CAAC;AAE/C,SAAgB,aAAa,CAAC,QAA4B;IACtD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrE,IAAI,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,EAAE,CAAC;QACL,CAAC,GAAG,iBAAiB,EAAE,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvE,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACb,CAAC"}

package/dist/firebase/client-plugin.d.ts

@@ -0,0 +1,5 @@
+export interface FirebaseClientPluginOptions {
+    initializeApp?: (config: any) => any;
+    getStorage?: (app: any) => any;
+}
+export declare function createFirebaseClientPlugin(options?: FirebaseClientPluginOptions): (fastify: any) => Promise<void>;

package/dist/firebase/client-plugin.js

@@ -0,0 +1,27 @@
+"use strict";
+// Firebase CLIENT SDK (storage) das APIs. Config 100% via env — as chaves de
+// client do Firebase (apiKey etc.) não são segredo, mas nada fica hardcoded.
+// `firebase` é peer dep; injeção opcional dos módulos para teste.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFirebaseClientPlugin = createFirebaseClientPlugin;
+function createFirebaseClientPlugin(options = {}) {
+    return async function pluginFirebase(fastify) {
+        /* eslint-disable @typescript-eslint/no-var-requires */
+        const initializeApp = options.initializeApp ?? require("firebase/app").initializeApp;
+        const getStorage = options.getStorage ?? require("firebase/storage").getStorage;
+        const firebaseConfig = {
+            apiKey: process.env.APIKEY,
+            authDomain: process.env.AUTHDOMAIN,
+            projectId: process.env.PROJECTID,
+            storageBucket: process.env.STORAGEBUCKET,
+            messagingSenderId: process.env.MESSAGINGSENDERID,
+            appId: process.env.APPID,
+            measurementId: process.env.MEASUREMENTID,
+        };
+        const appFirebase = initializeApp(firebaseConfig);
+        const storageFirebase = getStorage(appFirebase);
+        fastify.decorate("firebase", appFirebase);
+        fastify.decorate("storage", storageFirebase);
+    };
+}
+//# sourceMappingURL=client-plugin.js.map

package/dist/firebase/client-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-plugin.js","sourceRoot":"","sources":["../../src/firebase/client-plugin.ts"],"names":[],"mappings":";AAAA,6EAA6E;AAC7E,6EAA6E;AAC7E,kEAAkE;;AAOlE,gEAoBC;AApBD,SAAgB,0BAA0B,CAAC,UAAuC,EAAE;IAChF,OAAO,KAAK,UAAU,cAAc,CAAC,OAAY;QAC7C,uDAAuD;QACvD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC,aAAa,CAAC;QACrF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC;QAEhF,MAAM,cAAc,GAAG;YACnB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;YAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAChC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;YACxC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAChD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK;YACxB,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;SAC3C,CAAC;QACF,MAAM,WAAW,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACjD,CAAC,CAAC;AACN,CAAC"}

package/dist/http/error-handler.d.ts

@@ -0,0 +1,8 @@
+export interface ErrorHandlerOptions {
+    /** Mensagem genérica para erros internos (default pt-BR) */
+    genericMessage?: string;
+    /** Força expor mensagens cruas (ex: dev local). Default: false */
+    exposeInternal?: boolean;
+}
+export declare function isInternalError(error: any): boolean;
+export declare function createErrorHandler(options?: ErrorHandlerOptions): (fastify: any) => Promise<void>;

package/dist/http/error-handler.js

@@ -0,0 +1,33 @@
+"use strict";
+// Error handler padrão das APIs. Corrige o vazamento de internals: erros de
+// infra (Prisma/banco/rede) NUNCA chegam ao cliente com a mensagem crua —
+// "Can't reach database server at /cloudsql/..." no browser do aluno é
+// exposição de infraestrutura. Log completo sempre; resposta sanitizada.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isInternalError = isInternalError;
+exports.createErrorHandler = createErrorHandler;
+// Padrões que denunciam erro de infraestrutura — nunca expor ao cliente.
+const INTERNAL_PATTERNS = /prisma|cloudsql|can't reach database|pool timeout|econnrefused|etimedout|enotfound|getaddrinfo|socket|connection/i;
+function isInternalError(error) {
+    if (error?.name?.startsWith?.("PrismaClient"))
+        return true;
+    if (typeof error?.code === "string" && /^P\d{4}$/.test(error.code))
+        return true;
+    if ((error?.statusCode ?? 0) >= 500)
+        return true;
+    return INTERNAL_PATTERNS.test(String(error?.message ?? ""));
+}
+function createErrorHandler(options = {}) {
+    const generic = options.genericMessage ?? "Erro interno no processamento";
+    return async function onErrorMiddleware(fastify) {
+        fastify.setErrorHandler(async (error, request, reply) => {
+            console.error(error);
+            const expose = options.exposeInternal || !isInternalError(error);
+            reply.code(400).send({
+                statusCode: 400,
+                message: expose ? error.message : generic,
+            });
+        });
+    };
+}
+//# sourceMappingURL=error-handler.js.map

package/dist/http/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/http/error-handler.ts"],"names":[],"mappings":";AAAA,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,yEAAyE;;AAYzE,0CAKC;AAED,gDAYC;AAtBD,yEAAyE;AACzE,MAAM,iBAAiB,GAAG,mHAAmH,CAAC;AAE9I,SAAgB,eAAe,CAAC,KAAU;IACtC,IAAI,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,CAAC,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAgB,kBAAkB,CAAC,UAA+B,EAAE;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,+BAA+B,CAAC;IAC1E,OAAO,KAAK,UAAU,iBAAiB,CAAC,OAAY;QAChD,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,KAAU,EAAE,OAAY,EAAE,KAAU,EAAE,EAAE;YACnE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACjE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;aAC5C,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;AACN,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+export { resolveTenantId } from "./tenant/resolve";
+export type { TenantRequestLike } from "./tenant/resolve";
+export { createTenantMiddleware } from "./tenant/middleware";
+export type { TenantMiddlewareOptions } from "./tenant/middleware";
+export { createAuthMiddleware } from "./tenant/auth";
+export type { AuthMiddlewareOptions, TenantAuthLike } from "./tenant/auth";
+export { createMultitenantPrisma } from "./prisma/multitenant";
+export { createMultitenantPrismaMariaDb } from "./prisma/mariadb-factory";
+export type { MariaDbMultitenantOptions } from "./prisma/mariadb-factory";
+export type { TenantClient, Multitenant, MultitenantOptions, PoolConfigLike, PoolLike, } from "./prisma/multitenant";
+export { createCorsPlugin, DEFAULT_CORS } from "./cors/plugin";
+export type { CorsOptions } from "./cors/plugin";
+export { createSwaggerPlugin } from "./swagger/plugin";
+export type { SwaggerPluginOptions } from "./swagger/plugin";
+export { createFirebaseClientPlugin } from "./firebase/client-plugin";
+export type { FirebaseClientPluginOptions } from "./firebase/client-plugin";
+export { initFirebaseAdmin, getTenantAuth } from "./firebase/admin";
+export type { FirebaseAdminOptions } from "./firebase/admin";
+export { createErrorHandler, isInternalError } from "./http/error-handler";
+export type { ErrorHandlerOptions } from "./http/error-handler";
+export { GeminiHelp, EMBED_DIM, GEMINI_MODEL, EMBED_MODEL } from "./ai/gemini";

package/dist/index.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMBED_MODEL = exports.GEMINI_MODEL = exports.EMBED_DIM = exports.GeminiHelp = exports.isInternalError = exports.createErrorHandler = exports.getTenantAuth = exports.initFirebaseAdmin = exports.createFirebaseClientPlugin = exports.createSwaggerPlugin = exports.DEFAULT_CORS = exports.createCorsPlugin = exports.createMultitenantPrismaMariaDb = exports.createMultitenantPrisma = exports.createAuthMiddleware = exports.createTenantMiddleware = exports.resolveTenantId = void 0;
+var resolve_1 = require("./tenant/resolve");
+Object.defineProperty(exports, "resolveTenantId", { enumerable: true, get: function () { return resolve_1.resolveTenantId; } });
+var middleware_1 = require("./tenant/middleware");
+Object.defineProperty(exports, "createTenantMiddleware", { enumerable: true, get: function () { return middleware_1.createTenantMiddleware; } });
+var auth_1 = require("./tenant/auth");
+Object.defineProperty(exports, "createAuthMiddleware", { enumerable: true, get: function () { return auth_1.createAuthMiddleware; } });
+var multitenant_1 = require("./prisma/multitenant");
+Object.defineProperty(exports, "createMultitenantPrisma", { enumerable: true, get: function () { return multitenant_1.createMultitenantPrisma; } });
+var mariadb_factory_1 = require("./prisma/mariadb-factory");
+Object.defineProperty(exports, "createMultitenantPrismaMariaDb", { enumerable: true, get: function () { return mariadb_factory_1.createMultitenantPrismaMariaDb; } });
+var plugin_1 = require("./cors/plugin");
+Object.defineProperty(exports, "createCorsPlugin", { enumerable: true, get: function () { return plugin_1.createCorsPlugin; } });
+Object.defineProperty(exports, "DEFAULT_CORS", { enumerable: true, get: function () { return plugin_1.DEFAULT_CORS; } });
+var plugin_2 = require("./swagger/plugin");
+Object.defineProperty(exports, "createSwaggerPlugin", { enumerable: true, get: function () { return plugin_2.createSwaggerPlugin; } });
+var client_plugin_1 = require("./firebase/client-plugin");
+Object.defineProperty(exports, "createFirebaseClientPlugin", { enumerable: true, get: function () { return client_plugin_1.createFirebaseClientPlugin; } });
+var admin_1 = require("./firebase/admin");
+Object.defineProperty(exports, "initFirebaseAdmin", { enumerable: true, get: function () { return admin_1.initFirebaseAdmin; } });
+Object.defineProperty(exports, "getTenantAuth", { enumerable: true, get: function () { return admin_1.getTenantAuth; } });
+var error_handler_1 = require("./http/error-handler");
+Object.defineProperty(exports, "createErrorHandler", { enumerable: true, get: function () { return error_handler_1.createErrorHandler; } });
+Object.defineProperty(exports, "isInternalError", { enumerable: true, get: function () { return error_handler_1.isInternalError; } });
+var gemini_1 = require("./ai/gemini");
+Object.defineProperty(exports, "GeminiHelp", { enumerable: true, get: function () { return gemini_1.GeminiHelp; } });
+Object.defineProperty(exports, "EMBED_DIM", { enumerable: true, get: function () { return gemini_1.EMBED_DIM; } });
+Object.defineProperty(exports, "GEMINI_MODEL", { enumerable: true, get: function () { return gemini_1.GEMINI_MODEL; } });
+Object.defineProperty(exports, "EMBED_MODEL", { enumerable: true, get: function () { return gemini_1.EMBED_MODEL; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,4CAAiD;AAAzC,0GAAA,eAAe,OAAA;AAGvB,kDAA2D;AAAnD,oHAAA,sBAAsB,OAAA;AAG9B,sCAAmD;AAA3C,4GAAA,oBAAoB,OAAA;AAG5B,oDAA6D;AAArD,sHAAA,uBAAuB,OAAA;AAC/B,4DAAwE;AAAhE,iIAAA,8BAA8B,OAAA;AAUtC,wCAA6D;AAArD,0GAAA,gBAAgB,OAAA;AAAE,sGAAA,YAAY,OAAA;AAGtC,2CAAqD;AAA7C,6GAAA,mBAAmB,OAAA;AAG3B,0DAAoE;AAA5D,2HAAA,0BAA0B,OAAA;AAGlC,0CAAkE;AAA1D,0GAAA,iBAAiB,OAAA;AAAE,sGAAA,aAAa,OAAA;AAGxC,sDAAyE;AAAjE,mHAAA,kBAAkB,OAAA;AAAE,gHAAA,eAAe,OAAA;AAG3C,sCAA6E;AAArE,oGAAA,UAAU,OAAA;AAAE,mGAAA,SAAS,OAAA;AAAE,sGAAA,YAAY,OAAA;AAAE,qGAAA,WAAW,OAAA"}

package/dist/prisma/mariadb-factory.d.ts

@@ -0,0 +1,4 @@
+import mariadb from "mariadb";
+import { Multitenant, MultitenantOptions } from "./multitenant";
+export type MariaDbMultitenantOptions<TClient> = Omit<MultitenantOptions<TClient, mariadb.Pool>, "PrismaMariaDb" | "createPool">;
+export declare function createMultitenantPrismaMariaDb<TClient>(options: MariaDbMultitenantOptions<TClient>): Multitenant<TClient>;

package/dist/prisma/mariadb-factory.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMultitenantPrismaMariaDb = createMultitenantPrismaMariaDb;
+// Fábrica "baterias inclusas": o pkg é o dono das versões do driver mariadb e
+// do @prisma/adapter-mariadb (fonte única — as APIs não declaram essas libs).
+// A API só injeta o PrismaClient GERADO dela.
+const mariadb_1 = __importDefault(require("mariadb"));
+const adapter_mariadb_1 = require("@prisma/adapter-mariadb");
+const multitenant_1 = require("./multitenant");
+function createMultitenantPrismaMariaDb(options) {
+    return (0, multitenant_1.createMultitenantPrisma)({
+        ...options,
+        PrismaMariaDb: adapter_mariadb_1.PrismaMariaDb,
+        createPool: mariadb_1.default.createPool,
+    });
+}
+//# sourceMappingURL=mariadb-factory.js.map

package/dist/prisma/mariadb-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-factory.js","sourceRoot":"","sources":["../../src/prisma/mariadb-factory.ts"],"names":[],"mappings":";;;;;AAYA,wEAQC;AApBD,8EAA8E;AAC9E,8EAA8E;AAC9E,8CAA8C;AAC9C,sDAA8B;AAC9B,6DAAsD;AACtD,+CAAuF;AAOvF,SAAgB,8BAA8B,CAC1C,OAA2C;IAE3C,OAAO,IAAA,qCAAuB,EAAwB;QAClD,GAAG,OAAO;QACV,aAAa,EAAE,+BAAoB;QACnC,UAAU,EAAE,iBAAO,CAAC,UAAU;KACjC,CAAC,CAAC;AACP,CAAC"}

package/dist/prisma/multitenant.d.ts

@@ -0,0 +1,55 @@
+export type TenantClient<T> = T & {
+    $schema: string;
+};
+export interface PoolConfigLike {
+    host?: string;
+    port?: number;
+    socketPath?: string;
+    user?: string;
+    password?: string;
+    connectionLimit?: number;
+    connectTimeout?: number;
+    acquireTimeout?: number;
+    prepareCacheLength?: number;
+}
+export interface PoolLike {
+    end(): Promise<void>;
+}
+export interface MultitenantOptions<TClient, TPool extends PoolLike> {
+    /** DATABASE_URL no formato mysql://user:pass@host:porta/db_school_1?connection_limit=N
+     *  ou, em prod, mysql://user:pass@localhost/db_school_1?socket=/cloudsql/proj:region:inst */
+    databaseUrl: string;
+    /** Construtor do PrismaClient GERADO da API (src/config/prisma/generated).
+     *  args tipado como any de propósito: o construtor real exige o tipo
+     *  concreto do adapter (SqlDriverAdapterFactory) e a contravariância de
+     *  parâmetros rejeitaria unknown. */
+    PrismaClient: new (args: any) => TClient;
+    /** Construtor PrismaMariaDb de @prisma/adapter-mariadb */
+    PrismaMariaDb: new (pool: TPool, opts?: {
+        database?: string;
+    }) => unknown;
+    /** mariadb.createPool do driver mariadb */
+    createPool: (config: PoolConfigLike) => TPool;
+    /** Limite de conexões do pool (default: connection_limit da URL, PRISMA_POOL_LIMIT, ou 5) */
+    poolLimit?: number;
+    connectTimeout?: number;
+    acquireTimeout?: number;
+    /** Deriva o nome do database do tenant (default: troca "school_1" por "school_{id}") */
+    tenantDbName?: (baseDbName: string, idSchool: string) => string;
+    log?: unknown;
+    errorFormat?: string;
+}
+export interface Multitenant<TClient> {
+    pool: PoolLike;
+    /** Client do db "base" (o da própria DATABASE_URL) */
+    defaultClient: TenantClient<TClient>;
+    /** Client leve do tenant; id inválido cai no defaultClient */
+    getTenantClient: (idSchool: string) => TenantClient<TClient>;
+    /** Nome do database para um tenant (para raws construídos fora do client) */
+    dbNameFor: (idSchool: string) => string;
+    /** Desconecta todos os clients e encerra o pool (shutdown) */
+    disconnectAll: () => Promise<void>;
+    /** Plugin Fastify: decora fastify.defaultPrisma e desconecta tudo no onClose */
+    plugin: (fastify: any) => Promise<void>;
+}
+export declare function createMultitenantPrisma<TClient, TPool extends PoolLike>(options: MultitenantOptions<TClient, TPool>): Multitenant<TClient>;

package/dist/prisma/multitenant.js

@@ -0,0 +1,76 @@
+"use strict";
+// Multitenancy Prisma 7 com POOL ÚNICO compartilhado entre todas as escolas.
+// O client de cada tenant é um objeto leve cujo adapter apenas qualifica o
+// database no SQL gerado (`school_N`.`tabela`) — trocar de escola NÃO abre
+// conexão nova. O pool é criado SEM database default: raw sem qualificação
+// falha alto (Error 1046) em vez de cair silenciosamente no tenant errado.
+//
+// A lib não depende de @prisma/client, @prisma/adapter-mariadb nem mariadb:
+// cada API injeta o SEU client gerado e as suas versões do adapter/driver.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMultitenantPrisma = createMultitenantPrisma;
+function defaultTenantDbName(baseDbName, idSchool) {
+    return baseDbName.replace("school_1", `school_${idSchool}`);
+}
+function createMultitenantPrisma(options) {
+    const parsed = new URL(options.databaseUrl);
+    const socketPath = parsed.searchParams.get("socket") || undefined;
+    const baseDbName = parsed.pathname.replace(/^\//, "").split("?")[0];
+    const poolLimit = options.poolLimit ??
+        Number(process.env.PRISMA_POOL_LIMIT ||
+            parsed.searchParams.get("connection_limit") ||
+            5);
+    const pool = options.createPool({
+        ...(socketPath
+            ? { socketPath }
+            : { host: parsed.hostname, port: Number(parsed.port || 3306) }),
+        user: decodeURIComponent(parsed.username),
+        password: decodeURIComponent(parsed.password),
+        connectionLimit: poolLimit,
+        connectTimeout: options.connectTimeout ?? 15000,
+        acquireTimeout: options.acquireTimeout ?? 20000,
+        // workaround do leak de prepared statements com pool externo
+        // (https://github.com/prisma/prisma/issues/29364)
+        prepareCacheLength: 0,
+    });
+    const tenantDbName = options.tenantDbName ?? defaultTenantDbName;
+    const clients = new Map();
+    function clientFor(dbName) {
+        let client = clients.get(dbName);
+        if (!client) {
+            const adapter = new options.PrismaMariaDb(pool, { database: dbName });
+            client = new options.PrismaClient({
+                adapter,
+                log: options.log,
+                errorFormat: options.errorFormat,
+            });
+            client.$schema = dbName;
+            clients.set(dbName, client);
+        }
+        return client;
+    }
+    const defaultClient = clientFor(baseDbName);
+    function dbNameFor(idSchool) {
+        if (!/^\d+$/.test(idSchool) || Number(idSchool) <= 0)
+            return baseDbName;
+        return tenantDbName(baseDbName, idSchool);
+    }
+    function getTenantClient(idSchool) {
+        // defesa extra: o nome entra em SQL qualificado, só aceita dígitos
+        if (!/^\d+$/.test(idSchool) || Number(idSchool) <= 0)
+            return defaultClient;
+        return clientFor(tenantDbName(baseDbName, idSchool));
+    }
+    async function disconnectAll() {
+        await Promise.all(Array.from(clients.values()).map(c => c.$disconnect?.().catch(() => {
+        })));
+        await pool.end().catch(() => {
+        });
+    }
+    const plugin = async (fastify) => {
+        fastify.decorate("defaultPrisma", defaultClient);
+        fastify.addHook("onClose", disconnectAll);
+    };
+    return { pool, defaultClient, getTenantClient, dbNameFor, disconnectAll, plugin };
+}
+//# sourceMappingURL=multitenant.js.map

package/dist/prisma/multitenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multitenant.js","sourceRoot":"","sources":["../../src/prisma/multitenant.ts"],"names":[],"mappings":";AAAA,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;;AA6D3E,0DA4EC;AAhFD,SAAS,mBAAmB,CAAC,UAAkB,EAAE,QAAgB;IAC7D,OAAO,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAgB,uBAAuB,CACnC,OAA2C;IAE3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,SAAS,GACX,OAAO,CAAC,SAAS;QACjB,MAAM,CACF,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC7B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC3C,CAAC,CACJ,CAAC;IAEN,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;QAC5B,GAAG,CAAC,UAAU;YACV,CAAC,CAAC,EAAC,UAAU,EAAC;YACd,CAAC,CAAC,EAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,EAAC,CAAC;QACjE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;QACzC,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7C,eAAe,EAAE,SAAS;QAC1B,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,KAAK;QAC/C,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,KAAK;QAC/C,6DAA6D;QAC7D,kDAAkD;QAClD,kBAAkB,EAAE,CAAC;KACxB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzD,SAAS,SAAS,CAAC,MAAc;QAC7B,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,EAAC,QAAQ,EAAE,MAAM,EAAC,CAAC,CAAC;YACpE,MAAM,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC;gBAC9B,OAAO;gBACP,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,WAAW,EAAE,OAAO,CAAC,WAAW;aACnC,CAA0B,CAAC;YAC3B,MAAc,CAAC,OAAO,GAAG,MAAM,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,aAAa,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAE5C,SAAS,SAAS,CAAC,QAAgB;QAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,UAAU,CAAC;QACxE,OAAO,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,SAAS,eAAe,CAAC,QAAgB;QACrC,mEAAmE;QACnE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,aAAa,CAAC;QAC3E,OAAO,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,UAAU,aAAa;QACxB,MAAM,OAAO,CAAC,GAAG,CACb,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAChC,CAAS,CAAC,WAAW,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QACtC,CAAC,CAAC,CACL,CACJ,CAAC;QACF,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QAC5B,CAAC,CAAC,CAAC;IACP,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,EAAE,OAAY,EAAE,EAAE;QAClC,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;QACjD,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,OAAO,EAAC,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAC,CAAC;AACpF,CAAC"}

package/dist/swagger/plugin.d.ts

@@ -0,0 +1,7 @@
+export interface SwaggerPluginOptions {
+    title: string;
+    description: string;
+    version?: string;
+    routePrefix?: string;
+}
+export declare function createSwaggerPlugin(options: SwaggerPluginOptions): (fastify: any) => Promise<void>;

package/dist/swagger/plugin.js

@@ -0,0 +1,56 @@
+"use strict";
+// Swagger padrão das APIs MyBuilder. A API só informa title/description
+// (e opcionalmente version/routePrefix); o resto da configuração é único.
+// @fastify/swagger e @fastify/swagger-ui são peer deps (as APIs já têm).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSwaggerPlugin = createSwaggerPlugin;
+// BigInt não serializa em JSON — os CRUDs devolvem ids BigInt do Prisma.
+// Patch global (efeito colateral consciente, documentado no README).
+// @ts-ignore
+if (!BigInt.prototype.toJSON) {
+    // @ts-ignore
+    BigInt.prototype.toJSON = function () {
+        const int = Number.parseInt(this.toString());
+        return int ?? this.toString();
+    };
+}
+function createSwaggerPlugin(options) {
+    return async function pluginSwagger(fastify) {
+        /* eslint-disable @typescript-eslint/no-var-requires */
+        const Swagger = require("@fastify/swagger");
+        const SwaggerUi = require("@fastify/swagger-ui");
+        await fastify.register(Swagger, {
+            staticCSP: true,
+            exposeRoute: true,
+            swagger: {
+                info: {
+                    title: options.title,
+                    description: options.description,
+                    version: options.version ?? "0.1.0",
+                },
+                host: process.env.DOMAIN,
+                schemes: [process.env.HTTP],
+                securityDefinitions: {
+                    bearerAuth: {
+                        type: "apiKey",
+                        name: "Authorization",
+                        in: "header",
+                        description: "Insira o token Firebase JWT no formato: Bearer {token}",
+                    },
+                },
+                security: [{ bearerAuth: [] }],
+            },
+        });
+        await fastify.register(SwaggerUi, {
+            routePrefix: options.routePrefix ?? "/documentation",
+            uiConfig: {
+                docExpansion: "none",
+                deepLinking: false,
+            },
+            staticCSP: true,
+            exposeRoute: true,
+            transformStaticCSP: (header) => header,
+        });
+    };
+}
+//# sourceMappingURL=plugin.js.map

package/dist/swagger/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/swagger/plugin.ts"],"names":[],"mappings":";AAAA,wEAAwE;AACxE,0EAA0E;AAC1E,yEAAyE;;AAoBzE,kDAwCC;AAnDD,yEAAyE;AACzE,qEAAqE;AACrE,aAAa;AACb,IAAI,CAAE,MAAM,CAAC,SAAiB,CAAC,MAAM,EAAE,CAAC;IACpC,aAAa;IACb,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG;QACtB,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,OAAO,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC,CAAC;AACN,CAAC;AAED,SAAgB,mBAAmB,CAAC,OAA6B;IAC7D,OAAO,KAAK,UAAU,aAAa,CAAC,OAAY;QAC5C,uDAAuD;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAEjD,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE;YAC5B,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE;gBACL,IAAI,EAAE;oBACF,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO;iBACtC;gBACD,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;gBACxB,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC3B,mBAAmB,EAAE;oBACjB,UAAU,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,eAAe;wBACrB,EAAE,EAAE,QAAQ;wBACZ,WAAW,EAAE,wDAAwD;qBACxE;iBACJ;gBACD,QAAQ,EAAE,CAAC,EAAC,UAAU,EAAE,EAAE,EAAC,CAAC;aAC/B;SACJ,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,gBAAgB;YACpD,QAAQ,EAAE;gBACN,YAAY,EAAE,MAAM;gBACpB,WAAW,EAAE,KAAK;aACrB;YACD,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,IAAI;YACjB,kBAAkB,EAAE,CAAC,MAAW,EAAE,EAAE,CAAC,MAAM;SAC9C,CAAC,CAAC;IACP,CAAC,CAAC;AACN,CAAC"}

package/dist/tenant/auth.d.ts

@@ -0,0 +1,21 @@
+export interface TenantAuthLike {
+    verifyIdToken(token: string, checkRevoked?: boolean): Promise<any>;
+}
+export interface AuthMiddlewareOptions {
+    /** Rotas públicas (regex sobre a URL crua) — dispensam token */
+    publicRoutes: RegExp[];
+    /** Resolve o Auth do tenant Firebase (ex: getTenantAuth do pkg) */
+    getTenantAuth: (tenantId: string | undefined) => TenantAuthLike;
+    /** Aceitar token via ?token= (default: false — vaza em logs) */
+    allowQueryToken?: boolean;
+    /** Bypass SEM token (dev local). NUNCA ligar em produção. Default: false */
+    devBypass?: boolean;
+    /** Vínculo tenant↔recurso: lança para negar (vira 403). Recebe o token
+     *  decodificado e o request (com params/query/headers). */
+    assertTenant?: (decodedToken: any, request: any) => void | Promise<void>;
+    /** TTL máximo do cache de tokens verificados, em ms (default 120s) */
+    cacheTtlMs?: number;
+    /** Tamanho máximo do cache (default 2000) */
+    cacheMaxSize?: number;
+}
+export declare function createAuthMiddleware(options: AuthMiddlewareOptions): (fastify: any) => Promise<void>;

package/dist/tenant/auth.js

@@ -0,0 +1,107 @@
+"use strict";
+// Autenticação Firebase multi-tenant — fonte única e testada.
+//
+// Correções de segurança em relação ao middleware original das APIs:
+// 1. SEM bypass por hostname: "localhost" vinha do header Host (controlável
+//    pelo cliente) — bypass de dev agora é OPT-IN explícito via option
+//    `devBypass` (ligado por env da API, morto em produção por padrão).
+// 2. Token via query string (?token=) é OPT-IN (`allowQueryToken`) — URLs
+//    vazam em logs/histórico; só habilitar para fluxos que precisam (mídia).
+// 3. Gancho `assertTenant` para amarrar o tenant do token ao id_school da
+//    URL (falha => 403) — o isolamento de dados exige esse vínculo.
+//
+// O tenant Firebase vem do claim `firebase.tenant` do próprio token; a
+// VALIDAÇÃO criptográfica é do verifyIdToken do tenant correspondente —
+// um token forjado para outro tenant não verifica.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthMiddleware = createAuthMiddleware;
+function createAuthMiddleware(options) {
+    const TOKEN_CACHE = new Map();
+    const MAX_CACHE_SIZE = options.cacheMaxSize ?? 2000;
+    const MAX_TTL_MS = options.cacheTtlMs ?? 120 * 1000;
+    function getCached(token) {
+        const hit = TOKEN_CACHE.get(token);
+        if (!hit)
+            return null;
+        if (hit.expMs <= Date.now()) {
+            TOKEN_CACHE.delete(token);
+            return null;
+        }
+        return hit.user;
+    }
+    function setCached(token, user, expSeconds) {
+        const now = Date.now();
+        const expMs = Math.min(expSeconds * 1000, now + MAX_TTL_MS);
+        TOKEN_CACHE.set(token, { expMs, user });
+        if (TOKEN_CACHE.size > MAX_CACHE_SIZE) {
+            const it = TOKEN_CACHE.keys();
+            for (let i = 0; i < 100 && TOKEN_CACHE.size > MAX_CACHE_SIZE; i++) {
+                const k = it.next().value;
+                if (!k)
+                    break;
+                TOKEN_CACHE.delete(k);
+            }
+        }
+    }
+    return async function authMiddleware(fastify) {
+        fastify.decorate("authenticate", async (request, reply) => {
+            try {
+                const url = request.raw?.url || "";
+                if (options.publicRoutes.some(regex => regex.test(url)) || url === "" || url === "/") {
+                    return;
+                }
+                let authHeader = request.headers?.authorization;
+                if (options.allowQueryToken && request.query?.token) {
+                    authHeader = request.query.token;
+                }
+                if (!authHeader) {
+                    // bypass de dev: só por opção explícita, nunca por hostname
+                    if (options.devBypass)
+                        return;
+                    return reply.status(401).send({ message: "Token ausente ou inválido" });
+                }
+                authHeader = authHeader.replace("Bearer ", "");
+                const parts = authHeader.split(".");
+                if (parts.length !== 3) {
+                    return reply.status(401).send({ message: "Token inválido" });
+                }
+                const cached = getCached(authHeader);
+                if (cached) {
+                    if (options.assertTenant) {
+                        try {
+                            await options.assertTenant(cached, request);
+                        }
+                        catch {
+                            return reply.status(403).send({ message: "Acesso negado para esta escola" });
+                        }
+                    }
+                    request.user = cached;
+                    request.authToken = authHeader;
+                    return;
+                }
+                // o claim de tenant orienta QUAL Auth valida; a prova é criptográfica
+                const payload = JSON.parse(Buffer.from(parts[1], "base64").toString("utf-8"));
+                const tenantId = payload?.firebase?.tenant;
+                const auth = options.getTenantAuth(tenantId);
+                const decodedToken = await auth.verifyIdToken(authHeader, true);
+                setCached(authHeader, decodedToken, decodedToken.exp);
+                if (options.assertTenant) {
+                    try {
+                        await options.assertTenant(decodedToken, request);
+                    }
+                    catch {
+                        return reply.status(403).send({ message: "Acesso negado para esta escola" });
+                    }
+                }
+                request.user = decodedToken;
+                request.authToken = authHeader;
+            }
+            catch (err) {
+                console.error("Authentication error:", err);
+                return reply.status(401).send({ message: "Token inválido" });
+            }
+        });
+        fastify.addHook("onRequest", fastify.authenticate);
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/tenant/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tenant/auth.ts"],"names":[],"mappings":";AAAA,8DAA8D;AAC9D,EAAE;AACF,qEAAqE;AACrE,4EAA4E;AAC5E,uEAAuE;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,mDAAmD;;AA0BnD,oDA8FC;AA9FD,SAAgB,oBAAoB,CAAC,OAA8B;IAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC;IAEpD,SAAS,SAAS,CAAC,KAAa;QAC5B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1B,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,SAAS,SAAS,CAAC,KAAa,EAAE,IAAS,EAAE,UAAkB;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,EAAE,GAAG,GAAG,UAAU,CAAC,CAAC;QAC5D,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAC,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC;QACtC,IAAI,WAAW,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YACpC,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBAC1B,IAAI,CAAC,CAAC;oBAAE,MAAM;gBACd,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,KAAK,UAAU,cAAc,CAAC,OAAY;QAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,EAAE,OAAY,EAAE,KAAU,EAAE,EAAE;YAChE,IAAI,CAAC;gBACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;oBACnF,OAAO;gBACX,CAAC;gBAED,IAAI,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC;gBAChD,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;oBAClD,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBACrC,CAAC;gBAED,IAAI,CAAC,UAAU,EAAE,CAAC;oBACd,4DAA4D;oBAC5D,IAAI,OAAO,CAAC,SAAS;wBAAE,OAAO;oBAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,2BAA2B,EAAC,CAAC,CAAC;gBAC1E,CAAC;gBAED,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gBAAgB,EAAC,CAAC,CAAC;gBAC/D,CAAC;gBAED,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;gBACrC,IAAI,MAAM,EAAE,CAAC;oBACT,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;wBACvB,IAAI,CAAC;4BACD,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;wBAChD,CAAC;wBAAC,MAAM,CAAC;4BACL,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gCAAgC,EAAC,CAAC,CAAC;wBAC/E,CAAC;oBACL,CAAC;oBACD,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC;oBACtB,OAAO,CAAC,SAAS,GAAG,UAAU,CAAC;oBAC/B,OAAO;gBACX,CAAC;gBAED,sEAAsE;gBACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC9E,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC;gBAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC7C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAEhE,SAAS,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;gBAEtD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;oBACvB,IAAI,CAAC;wBACD,MAAM,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;oBACtD,CAAC;oBAAC,MAAM,CAAC;wBACL,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gCAAgC,EAAC,CAAC,CAAC;oBAC/E,CAAC;gBACL,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;gBAC5B,OAAO,CAAC,SAAS,GAAG,UAAU,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;gBAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gBAAgB,EAAC,CAAC,CAAC;YAC/D,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC,CAAC;AACN,CAAC"}

package/dist/tenant/middleware.d.ts

@@ -0,0 +1,5 @@
+export interface TenantMiddlewareOptions<TClient> {
+    getTenantClient: (idSchool: string) => TClient;
+    defaultClient: TClient;
+}
+export declare function createTenantMiddleware<TClient>(options: TenantMiddlewareOptions<TClient>): (fastify: any) => Promise<void>;

package/dist/tenant/middleware.js

@@ -0,0 +1,20 @@
+"use strict";
+// Middleware de tenant: injeta req.prisma com o client da escola do request
+// (params.id_school -> query.id_school -> header x-id-school), com fallback
+// para o client default quando não há id válido. É a ÚNICA porta de entrada
+// oficial do Prisma nos handlers — garante que o :id_school da URL decide o
+// schema, nunca o handler.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTenantMiddleware = createTenantMiddleware;
+const resolve_1 = require("./resolve");
+function createTenantMiddleware(options) {
+    return async function tenantMiddleware(fastify) {
+        fastify.addHook("preValidation", async (req) => {
+            const idSchool = (0, resolve_1.resolveTenantId)(req);
+            req.prisma = idSchool
+                ? options.getTenantClient(idSchool)
+                : options.defaultClient;
+        });
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/tenant/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/tenant/middleware.ts"],"names":[],"mappings":";AAAA,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,2BAA2B;;AAS3B,wDASC;AAhBD,uCAA6D;AAO7D,SAAgB,sBAAsB,CAAU,OAAyC;IACrF,OAAO,KAAK,UAAU,gBAAgB,CAAC,OAAY;QAC/C,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,GAA6C,EAAE,EAAE;YACrF,MAAM,QAAQ,GAAG,IAAA,yBAAe,EAAC,GAAG,CAAC,CAAC;YACtC,GAAG,CAAC,MAAM,GAAG,QAAQ;gBACjB,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC;gBACnC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QAChC,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;AACN,CAAC"}

package/dist/tenant/resolve.d.ts

@@ -0,0 +1,6 @@
+export interface TenantRequestLike {
+    params?: Record<string, unknown> | null;
+    query?: Record<string, unknown> | null;
+    headers?: Record<string, unknown> | null;
+}
+export declare function resolveTenantId(req: TenantRequestLike): string | null;

package/dist/tenant/resolve.js

@@ -0,0 +1,17 @@
+"use strict";
+// Resolução do tenant a partir do request.
+// Ordem oficial (a mesma das APIs desde sempre): params.id_school -> query.id_school -> header x-id-school.
+// Só aceita inteiro positivo em string de dígitos — qualquer outra coisa é
+// tratada como "sem tenant" (o chamador decide o fallback), nunca interpolada em SQL.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveTenantId = resolveTenantId;
+function resolveTenantId(req) {
+    const raw = req.params?.id_school ??
+        req.query?.id_school ??
+        req.headers?.["x-id-school"];
+    const idStr = typeof raw === "string" ? raw : raw != null ? String(raw) : "";
+    if (idStr && /^\d+$/.test(idStr) && Number(idStr) > 0)
+        return idStr;
+    return null;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/tenant/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/tenant/resolve.ts"],"names":[],"mappings":";AAAA,2CAA2C;AAC3C,4GAA4G;AAC5G,2EAA2E;AAC3E,sFAAsF;;AAQtF,0CASC;AATD,SAAgB,eAAe,CAAC,GAAsB;IAClD,MAAM,GAAG,GACJ,GAAG,CAAC,MAAc,EAAE,SAAS;QAC7B,GAAG,CAAC,KAAa,EAAE,SAAS;QAC5B,GAAG,CAAC,OAAe,EAAE,CAAC,aAAa,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@mybuildex/pkg",
+  "version": "0.2.1",
+  "description": "Infra comum das APIs MyBuilder: multitenancy Prisma (pool único), middleware de tenant e CORS",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/my-build-ead/mybuilder-typescript-pkg.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "fastify",
+    "prisma",
+    "multitenant",
+    "mariadb"
+  ],
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "@fastify/cors": "^8.4.1",
+    "@fastify/swagger": "^8.12.0",
+    "@fastify/swagger-ui": "^1.10.1",
+    "@google/genai": "^2.13.0",
+    "@prisma/adapter-mariadb": "7.10.0",
+    "@prisma/client": "7.10.0",
+    "firebase": "^10.6.0",
+    "firebase-admin": "^11.11.0",
+    "mariadb": "3.4.5",
+    "prisma": "7.10.0"
+  },
+  "peerDependencies": {
+    "fastify": ">=4"
+  },
+  "peerDependenciesMeta": {
+    "fastify": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "fastify": "^4.26.2",
+    "typescript": "^5.5.0",
+    "vitest": "^3.0.0"
+  }
+}