@ninenity/neutrun 1.0.0 → 1.9.0

package/dist/Shared/ExpressApi.js

@@ -0,0 +1,1009 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Api = exports.ApiRequestError = void 0;
+const express_1 = __importDefault(require("express"));
+const node_http_1 = require("node:http");
+const node_crypto_1 = require("node:crypto");
+const ConsoleLog_1 = require("./ConsoleLog");
+const ProcessManager_1 = __importDefault(require("./ProcessManager"));
+const TelemetryService_1 = require("./TelemetryService");
+const Observability_1 = __importDefault(require("./Observability"));
+class ApiRequestError extends Error {
+    status;
+    data;
+    response;
+    constructor(message, response, data) {
+        super(message);
+        this.name = 'ApiRequestError';
+        this.status = response.status;
+        this.response = response;
+        this.data = data;
+    }
+}
+exports.ApiRequestError = ApiRequestError;
+const DEFAULT_HOST = '127.0.0.1';
+const DEFAULT_PORT = 3000;
+const DEFAULT_IDLE_TIMEOUT_MS = 5 * 60 * 1000;
+const DEFAULT_REQUEST_TIMEOUT_MS = 30 * 1000;
+const DEFAULT_RATE_LIMIT_WINDOW_MS = 60 * 1000;
+const DEFAULT_RATE_LIMIT_MAX = 60;
+const MAX_RATE_LIMIT_ENTRIES = 10_000;
+const SERVER_CLOSE_TIMEOUT_MS = 5_000;
+const MAX_INTERNAL_RESPONSE_BYTES = 2 * 1024 * 1024;
+const DEFAULT_MAX_HEADER_BYTES = 16 * 1024;
+const DEFAULT_MAX_QUERY_PARAMETERS = 100;
+const DEFAULT_MAX_JSON_DEPTH = 16;
+const DEFAULT_MAX_JSON_KEYS = 1_000;
+const REQUEST_ID_PATTERN = /^[a-zA-Z0-9._:-]{8,100}$/;
+class ExpressApiService {
+    app;
+    settings = normalizeSettings(undefined);
+    configured = false;
+    finalized = false;
+    server = null;
+    startPromise = null;
+    stopPromise = null;
+    idleTimer = null;
+    activeRequests = 0;
+    lastActivityAt = Date.now();
+    resourcesSuspended = false;
+    cleanupRegistered = false;
+    middlewareInstalled = false;
+    rateLimitEntries = new Map();
+    rateLimitLastSweepAt = 0;
+    resourceTransition = null;
+    constructor() {
+        this.app = (0, express_1.default)();
+        this.app.disable('x-powered-by');
+        this.app.configureNeutrun = (options) => this.configure(options);
+        this.app.finalize = () => this.finalize();
+        this.app.start = (options) => this.start(options);
+        this.app.ensureStarted = () => this.ensureStarted();
+        this.app.stop = () => this.stop();
+        this.app.fetch = (path, options) => this.fetch(path, options);
+        this.app.fetchJson = (path, options) => this.fetchJson(path, options);
+        this.app.protect = (options) => this.protectionMiddleware(options);
+        this.app.validate = (options) => this.validationMiddleware(options);
+        this.app.getIdentity = (response) => response.locals.neutrunIdentity;
+        Object.defineProperties(this.app, {
+            isRunning: {
+                enumerable: true,
+                get: () => this.server !== null
+            },
+            isSuspended: {
+                enumerable: true,
+                get: () => this.resourcesSuspended
+            },
+            url: {
+                enumerable: true,
+                get: () => this.url
+            }
+        });
+    }
+    configure(options) {
+        if (this.server) {
+            throw new Error('Api não pode ser reconfigurada enquanto o servidor está ativo.');
+        }
+        const nextSettings = normalizeSettings(options);
+        if (this.middlewareInstalled &&
+            String(nextSettings.security.bodyLimit ?? '1mb') !==
+                String(this.settings.security.bodyLimit ?? '1mb')) {
+            throw new Error('security.bodyLimit não pode mudar depois que os middlewares da Api foram instalados.');
+        }
+        this.settings = nextSettings;
+        this.configured = options !== false && options !== undefined;
+        this.app.set('trust proxy', this.settings.security.trustProxy ?? false);
+        this.app.disable('x-powered-by');
+        if (!this.configured || !this.settings.enabled)
+            return;
+        validateSettings(this.settings);
+        if (this.middlewareInstalled)
+            return;
+        this.installBuiltInMiddleware();
+    }
+    finalize() {
+        if (this.finalized)
+            return;
+        this.finalized = true;
+        this.app.use((_req, res) => {
+            res.status(404).json({
+                success: false,
+                error: 'Not Found'
+            });
+        });
+        this.app.use((error, _req, res, next) => {
+            const message = error instanceof Error ? error.message : String(error);
+            const status = isHttpStatus(error) ? error.status : 500;
+            (0, ConsoleLog_1.logError)(`Erro na mini API: ${message}`, 'Api');
+            if (res.headersSent)
+                return next(error);
+            res.status(status).json({
+                success: false,
+                error: status >= 500 ? 'Internal Server Error' : message
+            });
+        });
+    }
+    async start(options) {
+        if (this.stopPromise)
+            await this.stopPromise;
+        if (options !== undefined)
+            this.configure(options);
+        if (!this.configured || !this.settings.enabled)
+            return;
+        if (this.server)
+            return;
+        if (this.startPromise)
+            return this.startPromise;
+        validateSettings(this.settings);
+        this.finalize();
+        this.startPromise = new Promise((resolve, reject) => {
+            const server = (0, node_http_1.createServer)({
+                maxHeaderSize: clampInteger(this.settings.security.maxHeaderBytes, 8 * 1024, 64 * 1024, DEFAULT_MAX_HEADER_BYTES)
+            }, this.app);
+            const requestTimeout = this.settings.security.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+            server.requestTimeout = requestTimeout;
+            server.headersTimeout = Math.max(requestTimeout + 1_000, 5_000);
+            server.keepAliveTimeout = Math.min(requestTimeout, 5_000);
+            const onError = (error) => {
+                server.removeListener('listening', onListening);
+                try {
+                    server.close();
+                }
+                catch {
+                    // O servidor ainda pode não ter aberto um handle.
+                }
+                reject(error);
+            };
+            const onListening = () => {
+                server.removeListener('error', onError);
+                this.server = server;
+                this.startPromise = null;
+                this.lastActivityAt = Date.now();
+                this.registerCleanup();
+                this.scheduleIdleCheck();
+                const address = server.address();
+                const actualPort = typeof address === 'object' && address ? address.port : this.settings.port;
+                (0, ConsoleLog_1.logSuccess)(`Mini API Express ativa em ${this.publicUrl(actualPort)}`, 'Api');
+                resolve();
+            };
+            server.once('error', onError);
+            server.once('listening', onListening);
+            server.listen(this.settings.port, this.settings.host);
+        }).catch((error) => {
+            this.startPromise = null;
+            (0, ConsoleLog_1.logError)(`Falha ao iniciar a mini API: ${error instanceof Error ? error.message : error}`, 'Api');
+            throw error;
+        });
+        return this.startPromise;
+    }
+    async ensureStarted() {
+        if (!this.configured || !this.settings.enabled) {
+            throw new Error('A mini API está desativada. Configure settings.api no Neutrun.init().');
+        }
+        if (!this.server)
+            await this.start();
+        await this.wakeResources();
+    }
+    async stop() {
+        if (this.stopPromise)
+            return this.stopPromise;
+        this.clearIdleTimer();
+        if (this.startPromise) {
+            await this.startPromise.catch(() => undefined);
+        }
+        const server = this.server;
+        if (!server)
+            return;
+        this.server = null;
+        this.stopPromise = closeHttpServer(server).finally(() => {
+            this.stopPromise = null;
+        });
+        await this.stopPromise;
+        (0, ConsoleLog_1.logInfo)('Mini API Express encerrada.', 'Api');
+    }
+    async fetch(path, options = {}) {
+        await this.ensureStarted();
+        const url = this.resolveUrl(path);
+        const headers = new Headers(options.headers);
+        const token = this.resolveCredentials()[0]?.token ?? '';
+        const authentication = this.settings.security.authentication;
+        if (token && authentication !== 'none' && !headers.has('authorization') && !headers.has('x-api-key')) {
+            if (authentication === 'api-key')
+                headers.set('x-api-key', token);
+            else
+                headers.set('authorization', `Bearer ${token}`);
+        }
+        if (!headers.has('x-request-id')) {
+            headers.set('x-request-id', Observability_1.default.getCorrelationId() ?? (0, node_crypto_1.randomUUID)());
+        }
+        const body = serializeBody(options.body, headers);
+        const { query, ...init } = options;
+        const requestInit = {
+            ...init,
+            method: options.method ?? (body === undefined ? 'GET' : 'POST'),
+            headers,
+            body
+        };
+        return globalThis.fetch(addQuery(url, query), requestInit);
+    }
+    async fetchJson(path, options = {}) {
+        const response = await this.fetch(path, options);
+        const data = await parseResponse(response);
+        if (!response.ok) {
+            throw new ApiRequestError(`Mini API request failed with HTTP ${response.status}.`, response, data);
+        }
+        return { data, response };
+    }
+    installBuiltInMiddleware() {
+        this.middlewareInstalled = true;
+        this.app.use(this.requestContextMiddleware());
+        this.app.use(this.securityHeaders());
+        this.app.use(this.corsMiddleware());
+        this.app.use(this.requestTrackingMiddleware());
+        this.app.use(this.requestShapeLimitsMiddleware());
+        this.app.use(this.requestTimeoutMiddleware());
+        this.app.use(this.rateLimitMiddleware());
+        this.app.use(this.authenticationMiddleware());
+        this.app.use(this.wakeResourcesMiddleware());
+        this.app.use(express_1.default.json({ limit: this.settings.security.bodyLimit ?? '1mb' }));
+        this.app.use(express_1.default.urlencoded({
+            extended: true,
+            limit: this.settings.security.bodyLimit ?? '1mb'
+        }));
+        this.app.use(this.jsonComplexityMiddleware());
+    }
+    requestContextMiddleware() {
+        return (req, res, next) => {
+            const incoming = req.get('x-request-id')?.trim() || '';
+            const requestId = REQUEST_ID_PATTERN.test(incoming) ? incoming : (0, node_crypto_1.randomUUID)();
+            res.locals.neutrunRequestId = requestId;
+            res.setHeader('X-Request-Id', requestId);
+            Observability_1.default.run({ correlationId: requestId, requestId, source: 'express-api' }, () => next());
+        };
+    }
+    securityHeaders() {
+        return (_req, res, next) => {
+            res.setHeader('X-Content-Type-Options', 'nosniff');
+            res.setHeader('X-Frame-Options', 'DENY');
+            res.setHeader('Referrer-Policy', 'no-referrer');
+            res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+            res.setHeader('Content-Security-Policy', "default-src 'none'; frame-ancestors 'none'; base-uri 'none'");
+            res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=()');
+            res.setHeader('Cache-Control', 'no-store');
+            next();
+        };
+    }
+    corsMiddleware() {
+        return (req, res, next) => {
+            const cors = this.settings.security.cors;
+            if (cors === false || cors === undefined)
+                return next();
+            const origin = req.headers.origin;
+            const allowed = cors === '*'
+                ? '*'
+                : origin && cors.includes(origin)
+                    ? origin
+                    : undefined;
+            if (allowed) {
+                res.setHeader('Access-Control-Allow-Origin', allowed);
+                appendVaryHeader(res, 'Origin');
+                res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type, X-API-Key, X-Request-Id');
+                res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
+            }
+            if (req.method === 'OPTIONS')
+                return res.sendStatus(allowed ? 204 : 403);
+            next();
+        };
+    }
+    requestTrackingMiddleware() {
+        return (req, res, next) => {
+            const startedAt = performance.now();
+            this.lastActivityAt = Date.now();
+            this.activeRequests += 1;
+            let completed = false;
+            const complete = () => {
+                if (completed)
+                    return;
+                completed = true;
+                this.activeRequests = Math.max(0, this.activeRequests - 1);
+                this.lastActivityAt = Date.now();
+                this.scheduleIdleCheck();
+                this.recordRequest(req, res, res.statusCode, performance.now() - startedAt, !res.writableEnded);
+            };
+            res.once('finish', complete);
+            res.once('close', complete);
+            next();
+        };
+    }
+    requestShapeLimitsMiddleware() {
+        return (req, res, next) => {
+            const maximum = clampInteger(this.settings.security.maxQueryParameters, 1, 1_000, DEFAULT_MAX_QUERY_PARAMETERS);
+            if (countObjectKeys(req.query, maximum + 1) > maximum) {
+                this.emitAudit(req, res, {
+                    type: 'validation',
+                    outcome: 'denied',
+                    status: 400,
+                    reason: 'query_limit'
+                });
+                return res.status(400).json({ success: false, error: 'Too many query parameters' });
+            }
+            next();
+        };
+    }
+    jsonComplexityMiddleware() {
+        return (req, res, next) => {
+            if (req.body === undefined || req.body === null || typeof req.body !== 'object')
+                return next();
+            const maxDepth = clampInteger(this.settings.security.maxJsonDepth, 1, 100, DEFAULT_MAX_JSON_DEPTH);
+            const maxKeys = clampInteger(this.settings.security.maxJsonKeys, 1, 100_000, DEFAULT_MAX_JSON_KEYS);
+            const complexity = inspectObjectComplexity(req.body, maxDepth, maxKeys);
+            if (complexity.valid)
+                return next();
+            this.emitAudit(req, res, {
+                type: 'validation',
+                outcome: 'denied',
+                status: 400,
+                reason: complexity.reason
+            });
+            return res.status(400).json({
+                success: false,
+                error: 'Request body is too complex'
+            });
+        };
+    }
+    requestTimeoutMiddleware() {
+        return (_req, res, next) => {
+            const timeoutMs = this.settings.security.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+            res.setTimeout(timeoutMs, () => {
+                if (!res.headersSent) {
+                    res.status(504).json({ success: false, error: 'Gateway Timeout' });
+                }
+                else {
+                    res.destroy();
+                }
+            });
+            next();
+        };
+    }
+    wakeResourcesMiddleware() {
+        return (_req, _res, next) => {
+            void this.wakeResources().then(() => next()).catch(next);
+        };
+    }
+    rateLimitMiddleware() {
+        return (req, res, next) => {
+            const options = this.settings.security.rateLimit;
+            if (options === false || options === undefined)
+                return next();
+            const now = Date.now();
+            const key = req.ip || req.socket.remoteAddress || 'unknown';
+            const windowMs = Math.max(1_000, options.windowMs ?? DEFAULT_RATE_LIMIT_WINDOW_MS);
+            const max = Math.max(1, options.max ?? DEFAULT_RATE_LIMIT_MAX);
+            this.pruneRateLimits(now, windowMs);
+            const current = this.rateLimitEntries.get(key);
+            if (!current || now - current.startedAt >= windowMs) {
+                this.rateLimitEntries.set(key, { startedAt: now, count: 1 });
+                setRateLimitHeaders(res, max, max - 1, windowMs);
+                return next();
+            }
+            current.count = Math.min(Number.MAX_SAFE_INTEGER, current.count + 1);
+            const remaining = Math.max(0, max - current.count);
+            const resetMs = Math.max(0, windowMs - (now - current.startedAt));
+            setRateLimitHeaders(res, max, remaining, resetMs);
+            if (current.count > max) {
+                res.setHeader('Retry-After', Math.ceil(resetMs / 1_000));
+                Observability_1.default.increment('neutrun_api_rate_limit_total');
+                this.emitAudit(req, res, {
+                    type: 'rate-limit',
+                    outcome: 'denied',
+                    status: 429
+                });
+                return res.status(429).json({
+                    success: false,
+                    error: 'Too Many Requests'
+                });
+            }
+            next();
+        };
+    }
+    authenticationMiddleware() {
+        return (req, res, next) => {
+            const authentication = this.settings.security.authentication;
+            if (authentication === 'none') {
+                res.locals.neutrunIdentity = anonymousIdentity();
+                return next();
+            }
+            if (isPublicPath(req.path, this.settings.security.publicPaths)) {
+                res.locals.neutrunIdentity = anonymousIdentity();
+                return next();
+            }
+            const received = authentication === 'api-key'
+                ? req.get('x-api-key')
+                : extractBearerToken(req.get('authorization'));
+            const credential = received
+                ? this.resolveCredentials().find((entry) => timingSafeEqual(received, entry.token))
+                : undefined;
+            if (!credential) {
+                Observability_1.default.increment('neutrun_api_authentication_total', 1, { outcome: 'denied' });
+                this.emitAudit(req, res, {
+                    type: 'authentication',
+                    outcome: 'denied',
+                    status: 401,
+                    reason: received ? 'invalid_credential' : 'missing_credential'
+                });
+                return res.status(401).json({
+                    success: false,
+                    error: 'Unauthorized'
+                });
+            }
+            const identity = {
+                authentication,
+                credentialId: credential.id,
+                roles: credential.roles,
+                scopes: credential.scopes
+            };
+            res.locals.neutrunIdentity = identity;
+            Observability_1.default.increment('neutrun_api_authentication_total', 1, { outcome: 'allowed' });
+            this.emitAudit(req, res, {
+                type: 'authentication',
+                outcome: 'allowed',
+                credentialId: credential.id
+            });
+            next();
+        };
+    }
+    protectionMiddleware(options = {}) {
+        return (req, res, next) => {
+            const run = async () => {
+                const identity = res.locals.neutrunIdentity;
+                const roles = new Set(identity?.roles ?? []);
+                const scopes = new Set(identity?.scopes ?? []);
+                const hasRoles = (options.roles ?? []).every((role) => roles.has(role));
+                const hasScopes = (options.scopes ?? []).every((scope) => scopes.has(scope));
+                const policyEligible = Boolean(identity && identity.authentication !== 'none' && hasRoles && hasScopes);
+                const customAllowed = policyEligible && options.authorize
+                    ? await options.authorize(req, identity)
+                    : policyEligible;
+                if (policyEligible && identity && customAllowed) {
+                    this.emitAudit(req, res, {
+                        type: 'authorization',
+                        outcome: 'allowed',
+                        credentialId: identity.credentialId
+                    });
+                    next();
+                    return;
+                }
+                Observability_1.default.increment('neutrun_api_authorization_total', 1, { outcome: 'denied' });
+                this.emitAudit(req, res, {
+                    type: 'authorization',
+                    outcome: 'denied',
+                    status: identity?.authentication === 'none' ? 401 : 403,
+                    credentialId: identity?.credentialId,
+                    reason: 'policy_denied'
+                });
+                res.status(identity?.authentication === 'none' ? 401 : 403).json({
+                    success: false,
+                    error: identity?.authentication === 'none' ? 'Unauthorized' : 'Forbidden'
+                });
+            };
+            void run().catch(next);
+        };
+    }
+    validationMiddleware(options) {
+        return (req, res, next) => {
+            const run = async () => {
+                const checks = [
+                    ['body', options.body, req.body],
+                    ['query', options.query, req.query],
+                    ['params', options.params, req.params]
+                ];
+                for (const [part, validator, value] of checks) {
+                    if (!validator)
+                        continue;
+                    const result = await validator(value, req);
+                    if (result === false || typeof result === 'string') {
+                        const reason = typeof result === 'string' ? result.slice(0, 200) : `Invalid ${part}`;
+                        Observability_1.default.increment('neutrun_api_validation_total', 1, { outcome: 'denied', part });
+                        this.emitAudit(req, res, {
+                            type: 'validation',
+                            outcome: 'denied',
+                            status: 400,
+                            reason: part
+                        });
+                        res.status(400).json({ success: false, error: reason });
+                        return;
+                    }
+                }
+                next();
+            };
+            void run().catch(next);
+        };
+    }
+    resolveCredentials() {
+        return resolveCredentials(this.settings.security);
+    }
+    scheduleIdleCheck() {
+        this.clearIdleTimer();
+        const lifecycle = this.settings.lifecycle;
+        if (!this.server || lifecycle.mode === 'always')
+            return;
+        const idleTimeoutMs = lifecycle.idleTimeoutMs;
+        this.idleTimer = setTimeout(() => {
+            void this.handleIdle().catch((error) => {
+                (0, ConsoleLog_1.logWarn)(`Falha no ciclo de ociosidade da mini API: ${error instanceof Error ? error.message : error}`, 'Api');
+                this.lastActivityAt = Date.now();
+                this.scheduleIdleCheck();
+            });
+        }, Math.max(1_000, idleTimeoutMs - (Date.now() - this.lastActivityAt)));
+        this.idleTimer.unref?.();
+    }
+    async handleIdle() {
+        if (!this.server || this.activeRequests > 0) {
+            this.scheduleIdleCheck();
+            return;
+        }
+        if (Date.now() - this.lastActivityAt < this.settings.lifecycle.idleTimeoutMs) {
+            this.scheduleIdleCheck();
+            return;
+        }
+        await this.suspendResources();
+        if (this.settings.lifecycle.mode === 'idle') {
+            await this.stop();
+        }
+    }
+    async suspendResources() {
+        if (this.resourceTransition)
+            await this.resourceTransition;
+        if (this.resourcesSuspended)
+            return;
+        const transition = (async () => {
+            await this.settings.lifecycle.onIdle?.();
+            this.resourcesSuspended = true;
+            TelemetryService_1.Telemetry.registerEvent('api:idle');
+        })();
+        this.resourceTransition = transition;
+        try {
+            await transition;
+        }
+        finally {
+            if (this.resourceTransition === transition)
+                this.resourceTransition = null;
+        }
+    }
+    async wakeResources() {
+        if (this.resourceTransition)
+            await this.resourceTransition;
+        if (!this.resourcesSuspended)
+            return;
+        const transition = (async () => {
+            await this.settings.lifecycle.onWake?.();
+            this.resourcesSuspended = false;
+            TelemetryService_1.Telemetry.registerEvent('api:wake');
+        })();
+        this.resourceTransition = transition;
+        try {
+            await transition;
+        }
+        finally {
+            if (this.resourceTransition === transition)
+                this.resourceTransition = null;
+        }
+    }
+    registerCleanup() {
+        if (this.cleanupRegistered)
+            return;
+        this.cleanupRegistered = true;
+        ProcessManager_1.default.registerCleanupTask(() => this.stop(), 'mini API Express');
+    }
+    recordRequest(req, res, status, durationMs, error = false) {
+        const path = normalizeTelemetryPath(req.route?.path ?? req.path ?? '/');
+        TelemetryService_1.Telemetry.registerCounter('apiRequests');
+        TelemetryService_1.Telemetry.registerEvent(`api:${req.method}:${path}`.slice(0, 120), {
+            error: error || status >= 400,
+            durationMs
+        });
+        Observability_1.default.increment('neutrun_api_requests_total', 1, {
+            method: req.method,
+            outcome: status >= 400 || error ? 'error' : 'success',
+            status: `${Math.floor(status / 100)}xx`
+        });
+        Observability_1.default.observe('neutrun_api_request_duration_ms', durationMs, {
+            method: req.method
+        });
+        this.emitAudit(req, res, {
+            type: 'request',
+            outcome: status >= 400 || error ? 'error' : 'success',
+            status,
+            durationMs
+        });
+    }
+    emitAudit(req, res, event) {
+        const audit = this.settings.security.audit;
+        if (!audit)
+            return;
+        const payload = {
+            ...event,
+            at: new Date().toISOString(),
+            requestId: String(res.locals.neutrunRequestId || (0, node_crypto_1.randomUUID)()),
+            method: req.method.slice(0, 16),
+            path: normalizeTelemetryPath(req.route?.path ?? req.path ?? '/')
+        };
+        void Promise.resolve(audit(payload)).catch((error) => {
+            (0, ConsoleLog_1.logWarn)(`Falha no destino de auditoria da mini API: ${error instanceof Error ? error.message : error}`, 'Api');
+        });
+    }
+    resolveUrl(path) {
+        const base = this.url;
+        if (!base)
+            throw new Error('A mini API ainda não está ativa.');
+        const resolved = /^https?:\/\//i.test(path)
+            ? new URL(path)
+            : new URL(path.replace(/^\/+/, ''), `${base}/`);
+        if (resolved.origin !== new URL(base).origin) {
+            throw new Error('Api.fetch aceita apenas URLs da própria mini API.');
+        }
+        return resolved.toString();
+    }
+    publicUrl(port) {
+        const host = this.settings.host === '0.0.0.0' || this.settings.host === '::'
+            ? '127.0.0.1'
+            : this.settings.host;
+        return `http://${formatHost(host)}:${port}`;
+    }
+    get url() {
+        if (!this.server)
+            return null;
+        const address = this.server.address();
+        const port = typeof address === 'object' && address ? address.port : this.settings.port;
+        return this.publicUrl(port);
+    }
+    clearIdleTimer() {
+        if (!this.idleTimer)
+            return;
+        clearTimeout(this.idleTimer);
+        this.idleTimer = null;
+    }
+    pruneRateLimits(now, windowMs) {
+        if (this.rateLimitEntries.size < MAX_RATE_LIMIT_ENTRIES &&
+            now - this.rateLimitLastSweepAt < windowMs)
+            return;
+        this.rateLimitLastSweepAt = now;
+        for (const [key, entry] of this.rateLimitEntries) {
+            if (now - entry.startedAt >= windowMs)
+                this.rateLimitEntries.delete(key);
+        }
+        while (this.rateLimitEntries.size >= MAX_RATE_LIMIT_ENTRIES) {
+            const oldest = this.rateLimitEntries.keys().next().value;
+            if (!oldest)
+                break;
+            this.rateLimitEntries.delete(oldest);
+        }
+    }
+}
+const service = new ExpressApiService();
+exports.Api = service.app;
+function normalizeSettings(options) {
+    const api = options === false ? {} : options ?? {};
+    const host = api.host?.trim() || process.env.NEUTRUN_API_HOST?.trim() || DEFAULT_HOST;
+    const serverless = api.serverless;
+    const lifecycle = api.lifecycle ?? {};
+    const serverlessOptions = typeof serverless === 'object' ? serverless : {};
+    const serverlessEnabled = serverless === true || serverlessOptions.enabled === true;
+    const lifecycleMode = serverlessEnabled
+        ? lifecycle.mode ?? 'idle'
+        : lifecycle.mode ?? 'always';
+    const idleTimeoutMs = parseDuration(lifecycle.idleTimeoutMs ?? serverlessOptions.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS);
+    return {
+        enabled: api.enabled ?? (options !== undefined && options !== false),
+        host,
+        port: normalizePort(api.port ?? process.env.NEUTRUN_API_PORT),
+        lifecycle: {
+            mode: lifecycleMode,
+            idleTimeoutMs,
+            onIdle: lifecycle.onIdle ?? serverlessOptions.onIdle,
+            onWake: lifecycle.onWake ?? serverlessOptions.onWake
+        },
+        security: {
+            authentication: api.security?.authentication ?? (resolveCredentials(api.security).length > 0 || isPublicHost(host) ? 'bearer' : 'none'),
+            token: api.security?.token,
+            tokenEnv: api.security?.tokenEnv ?? 'NEUTRUN_API_TOKEN',
+            tokens: api.security?.tokens,
+            tokensEnv: api.security?.tokensEnv ?? 'NEUTRUN_API_TOKENS',
+            credentials: api.security?.credentials,
+            allowInsecurePublic: api.security?.allowInsecurePublic,
+            publicPaths: api.security?.publicPaths ?? [],
+            cors: api.security?.cors,
+            bodyLimit: api.security?.bodyLimit,
+            rateLimit: api.security?.rateLimit,
+            requestTimeoutMs: api.security?.requestTimeoutMs,
+            trustProxy: api.security?.trustProxy,
+            maxHeaderBytes: api.security?.maxHeaderBytes,
+            maxQueryParameters: api.security?.maxQueryParameters,
+            maxJsonDepth: api.security?.maxJsonDepth,
+            maxJsonKeys: api.security?.maxJsonKeys,
+            audit: api.security?.audit
+        }
+    };
+}
+function validateSettings(settings) {
+    const credentials = resolveCredentials(settings.security);
+    if (settings.security.authentication !== 'none' && credentials.length === 0) {
+        throw new Error('A mini API autenticada precisa de security.token ou NEUTRUN_API_TOKEN configurado.');
+    }
+    if (settings.security.authentication === 'none' &&
+        isPublicHost(settings.host) &&
+        settings.security.allowInsecurePublic !== true) {
+        throw new Error('A mini API pública não pode desativar autenticação sem security.allowInsecurePublic=true.');
+    }
+    if (settings.security.cors === '*' &&
+        settings.security.authentication !== 'none') {
+        throw new Error('A mini API autenticada exige uma lista explícita de origens CORS.');
+    }
+    if (isPublicHost(settings.host) &&
+        credentials.some((credential) => Buffer.byteLength(credential.token, 'utf8') < 16)) {
+        throw new Error('Credenciais da mini API precisam ter pelo menos 16 bytes.');
+    }
+}
+function isPublicHost(host) {
+    return !['127.0.0.1', 'localhost', '::1'].includes(host);
+}
+function resolveCredentials(security) {
+    const values = [];
+    for (const credential of security?.credentials ?? [])
+        values.push(credential);
+    for (const token of security?.tokens ?? [])
+        values.push({ token });
+    const tokensEnvironment = process.env[security?.tokensEnv ?? 'NEUTRUN_API_TOKENS'];
+    for (const token of tokensEnvironment?.split(/[\r\n,]+/) ?? [])
+        values.push({ token });
+    const directToken = security?.token?.trim();
+    if (directToken)
+        values.push({ token: directToken });
+    const environmentToken = process.env[security?.tokenEnv ?? 'NEUTRUN_API_TOKEN']?.trim();
+    if (environmentToken)
+        values.push({ token: environmentToken });
+    const seen = new Set();
+    const output = [];
+    for (const value of values) {
+        const token = value.token?.trim();
+        if (!token || seen.has(token))
+            continue;
+        seen.add(token);
+        output.push({
+            token,
+            id: sanitizeCredentialId(value.id) ?? createCredentialId(token),
+            roles: sanitizePolicyValues(value.roles),
+            scopes: sanitizePolicyValues(value.scopes)
+        });
+    }
+    return output;
+}
+function anonymousIdentity() {
+    return { authentication: 'none', roles: [], scopes: [] };
+}
+function sanitizeCredentialId(value) {
+    const normalized = value?.trim();
+    if (!normalized)
+        return undefined;
+    return normalized.replace(/[^a-zA-Z0-9._:-]+/g, '_').slice(0, 100);
+}
+function createCredentialId(token) {
+    return `key_${(0, node_crypto_1.createHash)('sha256').update(token).digest('hex').slice(0, 12)}`;
+}
+function sanitizePolicyValues(values) {
+    return Array.from(new Set((values ?? [])
+        .map((value) => String(value).trim().slice(0, 100))
+        .filter(Boolean)))
+        .slice(0, 100);
+}
+function appendVaryHeader(response, value) {
+    const current = response.getHeader('Vary');
+    const entries = String(current ?? '')
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    if (!entries.some((entry) => entry.toLowerCase() === value.toLowerCase())) {
+        entries.push(value);
+    }
+    response.setHeader('Vary', entries.join(', '));
+}
+function setRateLimitHeaders(response, limit, remaining, resetMs) {
+    response.setHeader('RateLimit-Limit', limit);
+    response.setHeader('RateLimit-Remaining', remaining);
+    response.setHeader('RateLimit-Reset', Math.ceil(resetMs / 1_000));
+}
+function countObjectKeys(value, stopAfter) {
+    if (!value || typeof value !== 'object')
+        return 0;
+    let count = 0;
+    const stack = [value];
+    const seen = new WeakSet();
+    while (stack.length > 0 && count < stopAfter) {
+        const current = stack.pop();
+        if (seen.has(current))
+            continue;
+        seen.add(current);
+        for (const entry of Object.values(current)) {
+            count += 1;
+            if (entry && typeof entry === 'object')
+                stack.push(entry);
+            if (count >= stopAfter)
+                break;
+        }
+    }
+    return count;
+}
+function inspectObjectComplexity(value, maxDepth, maxKeys) {
+    const stack = [{ value, depth: 1 }];
+    const seen = new WeakSet();
+    let keys = 0;
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (seen.has(current.value))
+            continue;
+        seen.add(current.value);
+        if (current.depth > maxDepth)
+            return { valid: false, reason: 'json_depth' };
+        for (const entry of Object.values(current.value)) {
+            keys += 1;
+            if (keys > maxKeys)
+                return { valid: false, reason: 'json_keys' };
+            if (entry && typeof entry === 'object') {
+                stack.push({ value: entry, depth: current.depth + 1 });
+            }
+        }
+    }
+    return { valid: true };
+}
+function normalizeTelemetryPath(value) {
+    const raw = String(value || '/').split('?')[0] || '/';
+    return raw
+        .replace(/\b\d{6,}\b/g, ':id')
+        .replace(/\b[0-9a-f]{8}-[0-9a-f-]{27,}\b/gi, ':id')
+        .slice(0, 120);
+}
+function clampInteger(value, minimum, maximum, fallback) {
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed))
+        return fallback;
+    return Math.max(minimum, Math.min(maximum, Math.floor(parsed)));
+}
+function normalizePort(value) {
+    const parsed = Number(value ?? DEFAULT_PORT);
+    if (!Number.isInteger(parsed) || parsed < 0 || parsed > 65_535) {
+        throw new TypeError('A porta da mini API deve ser um inteiro entre 0 e 65535.');
+    }
+    return parsed;
+}
+function parseDuration(value) {
+    if (typeof value === 'number')
+        return Math.max(1_000, value);
+    const normalized = value.trim().toLowerCase();
+    const match = normalized.match(/^(\d+(?:\.\d+)?)\s*(ms|s|m|h)?$/);
+    if (!match)
+        throw new TypeError(`Duração inválida para a mini API: ${value}`);
+    const amount = Number(match[1]);
+    const multiplier = match[2] === 'h'
+        ? 60 * 60 * 1_000
+        : match[2] === 'm'
+            ? 60 * 1_000
+            : match[2] === 's'
+                ? 1_000
+                : 1;
+    return Math.max(1_000, Math.round(amount * multiplier));
+}
+function isPublicPath(path, paths) {
+    return (paths ?? []).some((entry) => {
+        const normalized = entry.trim();
+        if (!normalized)
+            return false;
+        if (normalized.endsWith('*'))
+            return path.startsWith(normalized.slice(0, -1));
+        return path === normalized;
+    });
+}
+function extractBearerToken(header) {
+    const match = header?.match(/^Bearer\s+(.+)$/i);
+    return match?.[1]?.trim() || '';
+}
+function timingSafeEqual(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    if (leftBuffer.length !== rightBuffer.length)
+        return false;
+    return (0, node_crypto_1.timingSafeEqual)(leftBuffer, rightBuffer);
+}
+function serializeBody(body, headers) {
+    if (body === undefined)
+        return undefined;
+    if (typeof body === 'string')
+        return body;
+    if (body instanceof URLSearchParams || body instanceof FormData || body instanceof Blob) {
+        return body;
+    }
+    if (body instanceof ArrayBuffer || ArrayBuffer.isView(body))
+        return body;
+    if (!headers.has('Content-Type'))
+        headers.set('Content-Type', 'application/json');
+    return JSON.stringify(body);
+}
+function addQuery(url, query) {
+    if (!query)
+        return url;
+    const parsed = new URL(url);
+    for (const [key, value] of Object.entries(query)) {
+        if (value !== undefined && value !== null)
+            parsed.searchParams.set(key, String(value));
+    }
+    return parsed.toString();
+}
+async function parseResponse(response) {
+    const text = await readResponseText(response, MAX_INTERNAL_RESPONSE_BYTES);
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+async function readResponseText(response, maxBytes) {
+    const contentLength = Number(response.headers.get('content-length'));
+    if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+        throw new RangeError(`Resposta da mini API excedeu ${maxBytes} bytes.`);
+    }
+    if (!response.body)
+        return '';
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                throw new RangeError(`Resposta da mini API excedeu ${maxBytes} bytes.`);
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk))).toString('utf8');
+}
+async function closeHttpServer(server) {
+    await new Promise((resolve) => {
+        let finished = false;
+        const finish = () => {
+            if (finished)
+                return;
+            finished = true;
+            clearTimeout(timeout);
+            resolve();
+        };
+        const timeout = setTimeout(() => {
+            server.closeAllConnections?.();
+            (0, ConsoleLog_1.logWarn)(`Encerramento da mini API excedeu ${SERVER_CLOSE_TIMEOUT_MS}ms; conexões restantes foram finalizadas.`, 'Api');
+            finish();
+        }, SERVER_CLOSE_TIMEOUT_MS);
+        server.close(() => finish());
+        server.closeIdleConnections?.();
+    });
+}
+function isHttpStatus(error) {
+    return typeof error === 'object' && error !== null &&
+        'status' in error && typeof error.status === 'number' &&
+        error.status >= 400 && error.status <= 599;
+}
+function formatHost(host) {
+    return host.includes(':') && !host.startsWith('[') ? `[${host}]` : host;
+}
+//# sourceMappingURL=ExpressApi.js.map