@nano-app/backend 0.6.4 → 0.7.0

package/package.json

@@ -1,46 +1,90 @@
 {
   "name": "@nano-app/backend",
-  "version": "0.6.4",
-  "description": "Backend for nano-app architecture",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
+  "version": "0.7.0",
+  "description": "Express server with file-convention routes, plugins and an optional PostgreSQL layer",
+  "type": "module",
+  "main": "build/index.js",
+  "types": "build/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./build/index.d.ts",
+      "import": "./build/index.js"
+    }
+  },
   "files": [
-    "dist"
+    "build",
+    "LICENSE"
   ],
   "scripts": {
-    "build": "tsc",
-    "prepublishOnly": "npm run build"
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "tsx --test tests/*.test.ts",
+    "prepublishOnly": "pnpm run build"
   },
   "keywords": [
-    "architecture",
-    "typescript",
-    "framework",
-    "core"
+    "express",
+    "backend",
+    "plugins",
+    "file-based-routing",
+    "postgresql",
+    "prisma"
   ],
   "author": "Cristian Serrano",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Nano-Nathan/nano-app.git",
+    "directory": "backend"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20"
+  },
   "dependencies": {
-    "@prisma/adapter-pg": "^7.4.0",
-    "@prisma/client": "^7.4.0",
-    "bcrypt": "^6.0.0",
     "compression": "^1.8.1",
-    "cors": "^2.8.5",
-    "dotenv": "^17.2.3",
+    "cors": "^2.8.6",
+    "dotenv": "^17.4.2",
     "express": "^5.2.1",
-    "express-rate-limit": "^8.2.1",
-    "helmet": "^8.1.0",
-    "morgan": "^1.10.1",
-    "pg": "^8.20.0"
+    "express-rate-limit": "^8.5.2",
+    "glob": "^13.0.6",
+    "helmet": "^8.2.0",
+    "jiti": "^2.7.0",
+    "morgan": "^1.11.0"
+  },
+  "peerDependencies": {
+    "@prisma/adapter-pg": "^7.8.0",
+    "@prisma/client": "^7.8.0",
+    "pg": "^8.22.0"
+  },
+  "peerDependenciesMeta": {
+    "@prisma/adapter-pg": {
+      "optional": true
+    },
+    "@prisma/client": {
+      "optional": true
+    },
+    "pg": {
+      "optional": true
+    }
   },
   "devDependencies": {
-    "@types/bcrypt": "^6.0.0",
+    "@prisma/adapter-pg": "^7.8.0",
+    "@prisma/client": "^7.8.0",
     "@types/compression": "^1.8.1",
     "@types/cors": "^2.8.19",
-    "@types/express": "^5.0.0",
+    "@types/express": "^5.0.6",
     "@types/morgan": "^1.9.10",
-    "@types/node": "^20.0.0",
-    "@types/pg": "^8.18.0",
-    "tsx": "^4.7.0",
-    "typescript": "^5.3.0"
+    "@types/node": "^22.19.0",
+    "@types/pg": "^8.20.0",
+    "pg": "^8.22.0",
+    "prisma": "^7.8.0",
+    "tsup": "^8.5.1",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3"
+  },
+  "bin": {
+    "nano-app": "build/nano-app.js"
   }
 }

package/dist/app.d.ts

@@ -1,9 +0,0 @@
-import { type NanoAppConfig } from "./index";
-export declare class NanoApp {
-    private app;
-    private router;
-    private config;
-    constructor(config: NanoAppConfig);
-    getApp(): import("express-serve-static-core").Express;
-    start(listener?: () => void): Promise<void>;
-}

package/dist/app.js

@@ -1,74 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NanoApp = void 0;
-const express_1 = __importDefault(require("express"));
-const cors_1 = __importDefault(require("cors"));
-const helmet_1 = __importDefault(require("helmet"));
-const compression_1 = __importDefault(require("compression"));
-const morgan_1 = __importDefault(require("morgan"));
-const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
-const index_1 = require("./index");
-const ApiKeys_1 = require("./auth/ApiKeys");
-const ApiKeysEndpoint_1 = require("./auth/ApiKeysEndpoint");
-class NanoApp {
-    app = (0, express_1.default)();
-    router;
-    config = {
-        endpoints: [],
-        enableEntities: true,
-        port: 3000,
-        rateLimit: {
-            windowMs: 15 * 60 * 1000,
-            max: 1000,
-            message: 'Too many requests, please try again later.',
-        },
-        morgan: {
-            format: 'combined',
-        },
-        expressConfig: {
-            limit: '10kb',
-        },
-    };
-    constructor(config) {
-        this.config = { ...this.config, ...config, apiKeys: config.apiKeys };
-        const apiKeysPath = this.config.apiKeys?.path ?? '/api-keys';
-        const apiKeyEndpoints = this.config.apiKeys?.enabled ? [new ApiKeysEndpoint_1.ApiKeysEndpoint(apiKeysPath)] : [];
-        const entityEndpoints = this.config.enableEntities ? [new index_1.Entities('/:endpoint{/:id}')] : [];
-        console.log('Endpoints registered:');
-        this.router = new index_1.Router([...apiKeyEndpoints, ...this.config.endpoints, ...entityEndpoints]);
-        if (this.config.setters) {
-            Object.entries(this.config.setters).forEach(([key, value]) => this.app.set(key, value));
-        }
-        Object.entries(this.config.morgan?.tokens ?? {}).forEach(([key, value]) => morgan_1.default.token(key, value));
-        this.app.use((0, morgan_1.default)(this.config.morgan?.format ?? 'combined'));
-        this.app.use((0, cors_1.default)());
-        this.app.use((0, helmet_1.default)());
-        this.app.use((0, compression_1.default)());
-        this.app.use((0, express_rate_limit_1.default)(this.config.rateLimit));
-        this.app.use(express_1.default.json(this.config.expressConfig));
-        this.app.use(express_1.default.urlencoded({ extended: false }));
-    }
-    getApp() { return this.app; }
-    async start(listener) {
-        if (this.config.apiKeys?.enabled) {
-            await ApiKeys_1.ApiKeys.init();
-            this.app.use(ApiKeys_1.ApiKeys.buildMiddleware(this.config.apiKeys.middleware));
-        }
-        (this.config.middlewares ?? []).forEach(middleware => this.app.use(middleware));
-        this.app.use('/', this.router.getRoutes());
-        this.app.use(this.config.errorMiddleware ?? ((err, _, res, __) => {
-            res.status(err.status || 500).json({
-                success: false,
-                message: err.message || 'Error interno del servidor',
-            });
-        }));
-        this.app.listen(Number(this.config.port), () => {
-            console.log(`Server running on port ${this.config.port}`);
-            listener?.();
-        });
-    }
-}
-exports.NanoApp = NanoApp;

package/dist/auth/ApiKeys.d.ts

@@ -1,25 +0,0 @@
-import type { RequestHandler } from "express";
-export declare class ApiKeys {
-    private static pool;
-    private static initialized;
-    static init(): Promise<void>;
-    /**
-     * Construye el middleware de autenticación:
-     * - Sin customMiddleware → valida solo x-api-key.
-     * - Con customMiddleware → intenta primero el middleware custom.
-     *   Si falla, intenta x-api-key. Si ambos fallan → 401.
-     */
-    static buildMiddleware(customMiddleware?: RequestHandler): RequestHandler;
-    static create(label?: string): Promise<string>;
-    static validate(key: string): Promise<boolean>;
-    static list(): Promise<{
-        id: number;
-        label: string | null;
-        created_at: Date;
-    }[]>;
-    static revoke(id: number): Promise<void>;
-    private static validateApiKey;
-    private static runMiddleware;
-    private static printInitialKey;
-    private static assertInitialized;
-}

package/dist/auth/ApiKeys.js

@@ -1,146 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ApiKeys = void 0;
-const bcrypt = __importStar(require("bcrypt"));
-const pg_1 = require("pg");
-const crypto_1 = require("crypto");
-const SCHEMA = "nano_auth";
-const TABLE = `${SCHEMA}.api_keys`;
-class ApiKeys {
-    static pool;
-    static initialized = false;
-    static async init() {
-        if (ApiKeys.initialized)
-            return;
-        const connectionString = process.env.DATABASE_URL;
-        if (!connectionString)
-            throw new Error("DATABASE_URL no está configurada");
-        ApiKeys.pool = new pg_1.Pool({ connectionString });
-        ApiKeys.initialized = true;
-        await ApiKeys.pool.query(`CREATE SCHEMA IF NOT EXISTS ${SCHEMA}`);
-        await ApiKeys.pool.query(`
-      CREATE TABLE IF NOT EXISTS ${TABLE} (
-        id         SERIAL PRIMARY KEY,
-        label      TEXT,
-        key_hash   TEXT NOT NULL,
-        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
-      )
-    `);
-        await ApiKeys.printInitialKey();
-    }
-    /**
-     * Construye el middleware de autenticación:
-     * - Sin customMiddleware → valida solo x-api-key.
-     * - Con customMiddleware → intenta primero el middleware custom.
-     *   Si falla, intenta x-api-key. Si ambos fallan → 401.
-     */
-    static buildMiddleware(customMiddleware) {
-        return async (req, res, next) => {
-            if (!customMiddleware) {
-                return ApiKeys.validateApiKey(req, res, next);
-            }
-            const customResult = await ApiKeys.runMiddleware(customMiddleware, req, res);
-            if (customResult.passed)
-                return next();
-            const key = req.headers['x-api-key'];
-            if (key && await ApiKeys.validate(key).catch(() => false)) {
-                req.apiKeyAuth = true;
-                return next();
-            }
-            return next(customResult.error ?? { status: 401, message: "No autorizado" });
-        };
-    }
-    static async create(label) {
-        ApiKeys.assertInitialized();
-        const key = `nk_${(0, crypto_1.randomBytes)(32).toString("hex")}`;
-        await ApiKeys.pool.query(`INSERT INTO ${TABLE} (label, key_hash) VALUES ($1, $2)`, [label ?? null, await bcrypt.hash(key, 10)]);
-        return key;
-    }
-    static async validate(key) {
-        ApiKeys.assertInitialized();
-        if (!key?.startsWith("nk_"))
-            return false;
-        const { rows } = await ApiKeys.pool.query(`SELECT key_hash FROM ${TABLE}`);
-        for (const row of rows) {
-            if (await bcrypt.compare(key, row.key_hash))
-                return true;
-        }
-        return false;
-    }
-    static async list() {
-        ApiKeys.assertInitialized();
-        const { rows } = await ApiKeys.pool.query(`SELECT id, label, created_at FROM ${TABLE} ORDER BY created_at DESC`);
-        return rows;
-    }
-    static async revoke(id) {
-        ApiKeys.assertInitialized();
-        await ApiKeys.pool.query(`DELETE FROM ${TABLE} WHERE id = $1`, [id]);
-    }
-    static async validateApiKey(req, _res, next) {
-        const key = req.headers['x-api-key'];
-        if (!key)
-            return next({ status: 401, message: "No autorizado" });
-        const valid = await ApiKeys.validate(key).catch(() => false);
-        if (valid) {
-            req.apiKeyAuth = true;
-            return next();
-        }
-        return next({ status: 401, message: "API key inválida" });
-    }
-    static async runMiddleware(middleware, req, res) {
-        return new Promise((resolve) => {
-            middleware(req, res, (err) => {
-                resolve(err ? { passed: false, error: err } : { passed: true });
-            });
-        });
-    }
-    static async printInitialKey() {
-        const { rows } = await ApiKeys.pool.query(`SELECT id FROM ${TABLE} LIMIT 1`);
-        if (rows.length > 0)
-            return;
-        const key = await ApiKeys.create('default');
-        console.log("\n══════════════════════════════════════════════════════");
-        console.log("           NANO-APP: API Key inicial generada          ");
-        console.log("    Guarda esta key, no se volverá a mostrar.          ");
-        console.log("══════════════════════════════════════════════════════");
-        console.log(`\n   x-api-key: ${key}\n`);
-    }
-    static assertInitialized() {
-        if (!ApiKeys.initialized)
-            throw new Error("ApiKeys no inicializado.");
-    }
-}
-exports.ApiKeys = ApiKeys;

package/dist/auth/ApiKeysEndpoint.d.ts

@@ -1,19 +0,0 @@
-import type { Request, Response } from "express";
-import { Endpoint } from "../http/Endpoint";
-import type { ApiResponse } from "../types/api";
-/**
- * Endpoint predefinido para gestión de API keys.
- * Registrado automáticamente por NanoApp en /api-keys.
- *
- * GET    /api-keys        — lista todas las keys (id, label, created_at)
- * POST   /api-keys        — crea una nueva key { label?: string }
- * DELETE /api-keys        — revoca una key por { id: number }
- *
- * Para deshabilitar estos endpoints, usa apiKeys: { enabled: false } en NanoAppConfig.
- * Para protegerlos con tu propia lógica, subclasifica y sobreescribe VALIDATE o BEFORE.
- */
-export declare class ApiKeysEndpoint extends Endpoint {
-    protected GET(_req: Request, _res: Response): Promise<ApiResponse>;
-    protected POST(req: Request, _res: Response): Promise<ApiResponse>;
-    protected DELETE(req: Request, _res: Response): Promise<ApiResponse>;
-}

package/dist/auth/ApiKeysEndpoint.js

@@ -1,36 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ApiKeysEndpoint = void 0;
-const Endpoint_1 = require("../http/Endpoint");
-const ApiKeys_1 = require("./ApiKeys");
-/**
- * Endpoint predefinido para gestión de API keys.
- * Registrado automáticamente por NanoApp en /api-keys.
- *
- * GET    /api-keys        — lista todas las keys (id, label, created_at)
- * POST   /api-keys        — crea una nueva key { label?: string }
- * DELETE /api-keys        — revoca una key por { id: number }
- *
- * Para deshabilitar estos endpoints, usa apiKeys: { enabled: false } en NanoAppConfig.
- * Para protegerlos con tu propia lógica, subclasifica y sobreescribe VALIDATE o BEFORE.
- */
-class ApiKeysEndpoint extends Endpoint_1.Endpoint {
-    async GET(_req, _res) {
-        const keys = await ApiKeys_1.ApiKeys.list();
-        return { result: keys };
-    }
-    async POST(req, _res) {
-        const { label } = req.body ?? {};
-        const key = await ApiKeys_1.ApiKeys.create(label);
-        return { result: { api_key: key } };
-    }
-    async DELETE(req, _res) {
-        const { id } = req.body ?? {};
-        if (!id || typeof id !== "number") {
-            throw { status: 400, message: "El campo id es requerido y debe ser un número" };
-        }
-        await ApiKeys_1.ApiKeys.revoke(id);
-        return { result: { revoked: id } };
-    }
-}
-exports.ApiKeysEndpoint = ApiKeysEndpoint;

package/dist/auth/ClientCredentials.d.ts

@@ -1,15 +0,0 @@
-import type { RequestHandler } from "express";
-import type { NanoAppAuthConfig } from "../index";
-export declare class ClientCredentials {
-    private static config;
-    private static oauthSecret;
-    private static pool;
-    static init(config: NanoAppAuthConfig): Promise<void>;
-    static middleware: RequestHandler;
-    static generateToken(clientId: string, clientSecret: string): Promise<{
-        access_token: string;
-        token_type: string;
-        expires_in: number;
-    }>;
-    private static parseExpiry;
-}

package/dist/auth/ClientCredentials.js

@@ -1,132 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ClientCredentials = void 0;
-const jwt = __importStar(require("jsonwebtoken"));
-const bcrypt = __importStar(require("bcrypt"));
-const pg_1 = require("pg");
-const crypto_1 = require("crypto");
-const SCHEMA = "nano_auth";
-const TABLE = `${SCHEMA}.oauth_client`;
-class ClientCredentials {
-    static config = {};
-    static oauthSecret;
-    static pool;
-    static async init(config) {
-        // Inicializar la configuración
-        const connectionString = process.env.DATABASE_URL ?? '';
-        ClientCredentials.config = config;
-        ClientCredentials.oauthSecret = process.env.OAUTH_SECRET ?? '';
-        // Crear el pool de conexiones
-        ClientCredentials.pool = new pg_1.Pool({ connectionString });
-        // Crear el schema si no existe
-        await ClientCredentials.pool.query(`CREATE SCHEMA IF NOT EXISTS ${SCHEMA}`);
-        await ClientCredentials.pool.query(`
-      CREATE TABLE IF NOT EXISTS ${TABLE} (
-        id           SERIAL PRIMARY KEY,
-        client_id    TEXT NOT NULL UNIQUE,
-        client_secret TEXT NOT NULL,
-        created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW()
-      )
-    `);
-        // Verificar si existen credenciales
-        const { rows } = await ClientCredentials.pool.query(`SELECT id FROM ${TABLE} LIMIT 1`);
-        if (rows.length === 0) {
-            // Generar credenciales
-            const clientId = (0, crypto_1.randomBytes)(16).toString("hex");
-            const clientSecret = (0, crypto_1.randomBytes)(32).toString("hex");
-            const hashed = await bcrypt.hash(clientSecret, 10);
-            // Insertar credenciales
-            await ClientCredentials.pool.query(`INSERT INTO ${TABLE} (client_id, client_secret) VALUES ($1, $2)`, [clientId, hashed]);
-            // Mostrar credenciales
-            console.log("\n══════════════════════════════════════════════════════");
-            console.log("          NANO-APP: OAuth Client Credentials          ");
-            console.log("   Guarda estas credenciales, no se mostrarán más.    ");
-            console.log("══════════════════════════════════════════════════════\n");
-            console.log(`client_id:     ${clientId}`);
-            console.log(`client_secret: ${clientSecret}\n\n`);
-        }
-    }
-    static middleware = async (req, res, next) => {
-        const publicRoutes = ["/oauth/token", ...(ClientCredentials.config.publicRoutes ?? [])];
-        // Si la ruta es pública, continuar
-        if (publicRoutes.includes(req.path)) {
-            return next();
-        }
-        // Validar que el header de autenticación sea válido
-        const authHeader = req.headers.authorization;
-        if (!authHeader?.startsWith("Bearer ")) {
-            return next({ status: 401, message: "Header de autenticación inválido" });
-        }
-        // Obtener el token y secret
-        const token = authHeader.slice(7);
-        // Verificar que el token sea válido
-        try {
-            const payload = jwt.verify(token, ClientCredentials.oauthSecret);
-            req.oauthClient = { clientId: payload.sub };
-            return next();
-        }
-        catch {
-            return next({ status: 401, message: "Sesión expirada" });
-        }
-    };
-    static async generateToken(clientId, clientSecret) {
-        if (!ClientCredentials.pool) {
-            throw { status: 500, message: "ClientCredentials no inicializado" };
-        }
-        const { rows } = await ClientCredentials.pool.query(`SELECT client_id, client_secret FROM ${TABLE} WHERE client_id = $1 LIMIT 1`, [clientId]);
-        if (rows.length === 0) {
-            throw { status: 401, message: "Credenciales de cliente inválidas" };
-        }
-        const valid = await bcrypt.compare(clientSecret, rows[0].client_secret);
-        if (!valid) {
-            throw { status: 401, message: "Credenciales de cliente inválidas" };
-        }
-        const expiry = ClientCredentials.config.tokenExpiry ?? '1h';
-        const expiresInSeconds = ClientCredentials.parseExpiry(expiry);
-        const access_token = jwt.sign({ sub: rows[0].client_id }, ClientCredentials.oauthSecret, { expiresIn: expiry });
-        return { access_token, token_type: "Bearer", expires_in: expiresInSeconds };
-    }
-    static parseExpiry(expiry) {
-        const match = expiry.match(/^(\d+)(s|m|h|d)$/);
-        if (!match)
-            return 3600;
-        const value = parseInt(match[1], 10);
-        const unit = match[2];
-        const multipliers = { s: 1, m: 60, h: 3600, d: 86400 };
-        return value * (multipliers[unit] ?? 3600);
-    }
-}
-exports.ClientCredentials = ClientCredentials;

package/dist/auth/TokenEndpoint.d.ts

@@ -1,5 +0,0 @@
-import { Endpoint, type ApiResponse } from "../index";
-import type { Request, Response } from "express";
-export declare class TokenEndpoint extends Endpoint {
-    protected POST(req: Request, res: Response): Promise<ApiResponse>;
-}

package/dist/auth/TokenEndpoint.js

@@ -1,33 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenEndpoint = void 0;
-const index_1 = require("../index");
-class TokenEndpoint extends index_1.Endpoint {
-    async POST(req, res) {
-        let clientId;
-        let clientSecret;
-        // Authorization: Basic <base64(clientId:clientSecret)>
-        const authHeader = req.headers.authorization;
-        if (authHeader?.startsWith("Basic ")) {
-            const decoded = Buffer.from(authHeader.slice(6), "base64").toString("utf-8");
-            const colon = decoded.indexOf(":");
-            if (colon !== -1) {
-                clientId = decoded.slice(0, colon);
-                clientSecret = decoded.slice(colon + 1);
-            }
-        }
-        // Body: client_id y client_secret (JSON o form-urlencoded)
-        if (!clientId || !clientSecret) {
-            clientId = req.body?.client_id;
-            clientSecret = req.body?.client_secret;
-        }
-        if (!clientId || !clientSecret) {
-            throw { status: 400, message: "client_id y client_secret son campos requeridos" };
-        }
-        const tokenData = await index_1.ClientCredentials.generateToken(clientId, clientSecret);
-        // RFC 6749 §5.1: la respuesta del token endpoint debe ser plana, sin wrappers
-        res.json(tokenData);
-        return {};
-    }
-}
-exports.TokenEndpoint = TokenEndpoint;

package/dist/http/Endpoint.d.ts

@@ -1,17 +0,0 @@
-import { Request, Response } from "express";
-import { PrismaClient } from "../prisma/Client";
-import type { ApiResponse } from "../types/api";
-export declare abstract class Endpoint<BeforeResult = any> {
-    protected prismaClient: PrismaClient;
-    path: string;
-    private methodMap;
-    constructor(path?: string);
-    protected VALIDATE(_req: Request): Promise<void>;
-    protected BEFORE(_req: Request): Promise<BeforeResult>;
-    protected AFTER(_req: Request, result: ApiResponse): Promise<ApiResponse>;
-    protected GET(_req: Request, _res: Response, _before: BeforeResult): Promise<ApiResponse>;
-    protected POST(_req: Request, _res: Response, _before: BeforeResult): Promise<ApiResponse>;
-    protected PUT(_req: Request, _res: Response, _before: BeforeResult): Promise<ApiResponse>;
-    protected DELETE(_req: Request, _res: Response, _before: BeforeResult): Promise<ApiResponse>;
-    execute(req: Request, res: Response): void;
-}