@oktis-works/api 0.0.0-stage → 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,170 @@
+#!/usr/bin/env bun
+// @oktis-works/api - Main Entry Point
+import { Hono } from 'hono';
+import { logger } from 'hono/logger';
+import { cors } from 'hono/cors';
+import { prettyJSON } from 'hono/pretty-json';
+import { serve } from '@hono/node-server';
+import { bootstrap, getEventBus, registerEventAuditLog } from '@oktis-works/core';
+import { traceMiddleware } from './middleware/trace.js';
+import { rateLimitMiddleware } from './middleware/rate-limit.js';
+import { csrfMiddleware, issueCsrfToken, CSRF_COOKIE } from './middleware/csrf.js';
+import { establishTenantContext } from '@oktis-works/core';
+import authRouter from './routes/auth/index.js';
+import meRouter from './routes/auth/me.js';
+import contentRouter from './routes/content/index.js';
+import postsRouter from './routes/posts/index.js';
+import pagesRouter from './routes/pages/index.js';
+import healthRouter from './routes/health/index.js';
+import usersRouter from './routes/users/index.js';
+import tenantsRouter from './routes/tenants/index.js';
+import rolesRouter from './routes/roles/index.js';
+import mediaRouter from './routes/media/index.js';
+import categoriesRouter from './routes/categories/index.js';
+import tagsRouter from './routes/tags/index.js';
+import menusRouter from './routes/menus/index.js';
+import settingsRouter from './routes/settings/index.js';
+import pluginsRouter from './routes/plugins/index.js';
+import themesRouter from './routes/themes/index.js';
+import deploymentsRouter from './routes/deployments/index.js';
+import eventsRouter from './routes/events/index.js';
+import webhooksRouter from './routes/webhooks/index.js';
+import contentTypesRouter from './routes/content-types/index.js';
+import taxonomiesRouter from './routes/taxonomies/index.js';
+import fieldGroupsRouter from './routes/field-groups/index.js';
+import fieldTypesRouter from './routes/field-types/index.js';
+import metricsRouter from './routes/metrics/index.js';
+import auditLogsRouter from './routes/audit-logs/index.js';
+import docsRouter from './routes/docs/index.js';
+import hooksCatalogRouter from './routes/hooks/index.js';
+async function main() {
+    // Initialize application
+    const lifecycle = await bootstrap();
+    const app = new Hono();
+    // REQ-event-bus-005: eventos de domínio → AuditLog
+    registerEventAuditLog(getEventBus());
+    // Global middleware
+    app.use('*', traceMiddleware);
+    app.use('*', logger());
+    app.use('*', cors({
+        origin: '*',
+        allowMethods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
+        allowHeaders: ['Content-Type', 'Authorization', 'X-Tenant-ID'],
+    }));
+    app.use('*', prettyJSON());
+    // rest-api-003: rate limiting global (429 + Retry-After); probes isentos
+    app.use('*', rateLimitMiddleware());
+    // security-001: emissão de cookie CSRF + validação double-submit
+    app.use('*', async (c, next) => {
+        if (!c.req.header('Cookie')?.includes(CSRF_COOKIE)) {
+            c.header('Set-Cookie', `${CSRF_COOKIE}=${issueCsrfToken()}; Path=/; SameSite=Lax; Secure`);
+        }
+        await next();
+    });
+    app.use('/api/*', csrfMiddleware);
+    // Tenant context middleware
+    app.use('*', async (c, next) => {
+        const tenantId = c.req.header('X-Tenant-ID') ?? c.req.query('tenantId');
+        if (tenantId) {
+            await establishTenantContext(tenantId);
+        }
+        await next();
+    });
+    // Health routes (no auth required)
+    app.route('/health', healthRouter);
+    // API routes
+    app.route('/api/v1/auth', authRouter);
+    app.route('/api/v1/auth', meRouter);
+    app.route('/api/v1/users', usersRouter);
+    app.route('/api/v1/tenants', tenantsRouter);
+    app.route('/api/v1/roles', rolesRouter);
+    app.route('/api/v1/media', mediaRouter);
+    app.route('/api/v1/content', contentRouter);
+    app.route('/api/v1/posts', postsRouter);
+    app.route('/api/v1/pages', pagesRouter);
+    app.route('/api/v1/categories', categoriesRouter);
+    app.route('/api/v1/tags', tagsRouter);
+    app.route('/api/v1/menus', menusRouter);
+    app.route('/api/v1/settings', settingsRouter);
+    app.route('/api/v1/plugins', pluginsRouter);
+    app.route('/api/v1/themes', themesRouter);
+    app.route('/api/v1/deployments', deploymentsRouter);
+    app.route('/api/v1/events', eventsRouter);
+    app.route('/api/v1/webhooks', webhooksRouter);
+    app.route('/api/v1/content-types', contentTypesRouter);
+    app.route('/api/v1/taxonomies', taxonomiesRouter);
+    app.route('/api/v1/field-groups', fieldGroupsRouter);
+    app.route('/api/v1/field-types', fieldTypesRouter);
+    app.route('/api/v1/health', healthRouter);
+    app.route('/api/v1/metrics', metricsRouter);
+    app.route('/api/v1/audit-logs', auditLogsRouter);
+    // rest-api-004: documento OpenAPI 3.1
+    app.route('/api/v1/docs', docsRouter);
+    // REQU-035-002: catálogo de hooks
+    app.route('/api/v1/hooks/catalog', hooksCatalogRouter);
+    // API info endpoint
+    app.get('/api', (c) => {
+        return c.json({
+            name: 'BlackLotus CMS API',
+            version: '0.1.0',
+            description: 'Hybrid, modular, API-first CMS',
+            endpoints: {
+                health: '/health',
+                auth: '/api/v1/auth',
+                users: '/api/v1/users',
+                tenants: '/api/v1/tenants',
+                roles: '/api/v1/roles',
+                media: '/api/v1/media',
+                content: '/api/v1/content',
+                posts: '/api/v1/posts',
+                pages: '/api/v1/pages',
+                categories: '/api/v1/categories',
+                tags: '/api/v1/tags',
+                menus: '/api/v1/menus',
+                settings: '/api/v1/settings',
+                plugins: '/api/v1/plugins',
+                themes: '/api/v1/themes',
+                deployments: '/api/v1/deployments',
+                events: '/api/v1/events',
+                webhooks: '/api/v1/webhooks',
+                contentTypes: '/api/v1/content-types',
+                taxonomies: '/api/v1/taxonomies',
+                fieldGroups: '/api/v1/field-groups',
+                fieldTypes: '/api/v1/field-types',
+            },
+        });
+    });
+    // 404 handler
+    app.notFound((c) => {
+        return c.json({ error: 'Not found' }, 404);
+    });
+    // Error handler
+    app.onError((err, c) => {
+        console.error('Server error:', err);
+        return c.json({ error: 'Internal server error' }, 500);
+    });
+    // Start server
+    const port = Number(process.env['PORT'] ?? 3000);
+    serve({
+        fetch: app.fetch,
+        port,
+    }, (info) => {
+        console.log(`BlackLotus CMS API running on http://localhost:${info.port}`);
+    });
+    // Graceful shutdown
+    process.on('SIGTERM', async () => {
+        console.log('SIGTERM received, shutting down...');
+        await lifecycle.stop();
+        process.exit(0);
+    });
+    process.on('SIGINT', async () => {
+        console.log('SIGINT received, shutting down...');
+        await lifecycle.stop();
+        process.exit(0);
+    });
+}
+main().catch((error) => {
+    console.error('Failed to start server:', error);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,sCAAsC;AAEtC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAChD,OAAO,QAAQ,MAAM,qBAAqB,CAAC;AAC3C,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACpD,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAChD,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACpD,OAAO,iBAAiB,MAAM,+BAA+B,CAAC;AAC9D,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACpD,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,kBAAkB,MAAM,iCAAiC,CAAC;AACjE,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,iBAAiB,MAAM,gCAAgC,CAAC;AAC/D,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAC7D,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,eAAe,MAAM,8BAA8B,CAAC;AAC3D,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAChD,OAAO,kBAAkB,MAAM,yBAAyB,CAAC;AAEzD,KAAK,UAAU,IAAI;IACjB,yBAAyB;IACzB,MAAM,SAAS,GAAG,MAAM,SAAS,EAAE,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,mDAAmD;IACnD,qBAAqB,CAAC,WAAW,EAAE,CAAC,CAAC;IAErC,oBAAoB;IACpB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;QAChB,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAClE,YAAY,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,aAAa,CAAC;KAC/D,CAAC,CAAC,CAAC;IACJ,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3B,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAEpC,iEAAiE;IACjE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,WAAW,IAAI,cAAc,EAAE,gCAAgC,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAElC,4BAA4B;IAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAExE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,mCAAmC;IACnC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAEnC,aAAa;IACb,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACtC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IACpC,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC5C,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC5C,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;IAClD,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACtC,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC9C,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC5C,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IAC1C,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;IACpD,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IAC1C,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC9C,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,CAAC;IACvD,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;IAClD,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,CAAC;IACrD,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;IACnD,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IAC1C,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC5C,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;IAEjD,sCAAsC;IACtC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAEtC,kCAAkC;IAClC,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,CAAC;IAEvD,oBAAoB;IACpB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;QACpB,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,gCAAgC;YAC7C,SAAS,EAAE;gBACT,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,cAAc;gBACpB,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,iBAAiB;gBAC1B,KAAK,EAAE,eAAe;gBACtB,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,iBAAiB;gBAC1B,KAAK,EAAE,eAAe;gBACtB,KAAK,EAAE,eAAe;gBACtB,UAAU,EAAE,oBAAoB;gBAChC,IAAI,EAAE,cAAc;gBACpB,KAAK,EAAE,eAAe;gBACtB,QAAQ,EAAE,kBAAkB;gBAC5B,OAAO,EAAE,iBAAiB;gBAC1B,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,qBAAqB;gBAClC,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,kBAAkB;gBAC5B,YAAY,EAAE,uBAAuB;gBACrC,UAAU,EAAE,oBAAoB;gBAChC,WAAW,EAAE,sBAAsB;gBACnC,UAAU,EAAE,qBAAqB;aAClC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,cAAc;IACd,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,gBAAgB;IAChB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IAEjD,KAAK,CAAC;QACJ,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI;KACL,EAAE,CAAC,IAAI,EAAE,EAAE;QACV,OAAO,CAAC,GAAG,CAAC,kDAAkD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,oBAAoB;IACpB,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9B,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACjD,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,8 @@
+import type { Context, Next } from 'hono';
+export declare const authMiddleware: (c: Context, next: Next) => Promise<(Response & import("hono").TypedResponse<{
+    error: string;
+}>) | undefined>;
+export declare const requirePermission: (action: string, resource: string) => (c: Context, next: Next) => Promise<(Response & import("hono").TypedResponse<{
+    error: string;
+}>) | undefined>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO1C,eAAO,MAAM,cAAc,MAAa,OAAO,QAAQ,IAAI;;gBAqB1D,CAAC;AAEF,eAAO,MAAM,iBAAiB,WAAY,MAAM,YAAY,MAAM,SAC/C,OAAO,QAAQ,IAAI;;gBASrC,CAAC"}

package/dist/middleware/auth.js

@@ -0,0 +1,32 @@
+// @oktis-works/api - Authentication Middleware
+import { AuthService } from '@oktis-works/auth';
+import { loadConfig } from '@oktis-works/config';
+const config = loadConfig();
+const authService = new AuthService(config.auth);
+export const authMiddleware = async (c, next) => {
+    const authHeader = c.req.header('Authorization');
+    if (!authHeader?.startsWith('Bearer ')) {
+        return c.json({ error: 'Missing or invalid authorization header' }, 401);
+    }
+    const token = authHeader.slice(7);
+    const payload = await authService.verifyToken(token);
+    if (!payload) {
+        return c.json({ error: 'Invalid or expired token' }, 401);
+    }
+    // Set user context
+    c.set('userId', payload.sub);
+    c.set('userEmail', payload.email);
+    c.set('tenantId', payload.tenantId);
+    c.set('userRoles', payload.roles);
+    await next();
+};
+export const requirePermission = (action, resource) => {
+    return async (c, next) => {
+        const userRoles = c.get('userRoles');
+        if (!authService.hasPermission(userRoles, action, resource)) {
+            return c.json({ error: 'Insufficient permissions' }, 403);
+        }
+        await next();
+    };
+};
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAC5B,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;IAC7D,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAEjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAErD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,mBAAmB;IACnB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAElC,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,EAAE;IACpE,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAa,CAAC;QAEjD,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/middleware/csrf.d.ts

@@ -0,0 +1,13 @@
+import type { Context, Next } from 'hono';
+export declare const CSRF_COOKIE = "bl_csrf";
+export declare const CSRF_HEADER = "X-CSRF-Token";
+export declare function issueCsrfToken(): string;
+/** Origem esperada: mesma do Host da requisição (ou configurada em TRUSTED_ORIGINS). */
+export declare function isSameOrigin(c: Context): boolean;
+/**
+ * Double-submit cookie: emite cookie bl_csrf para navegadores e valida que
+ * header X-CSRF-Token === cookie em requisições state-changing com cookie de sessão.
+ * Clientes não-navegador (Authorization Bearer) ficam isentos.
+ */
+export declare function csrfMiddleware(c: Context, next: Next): Promise<Response | undefined>;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/middleware/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK1C,eAAO,MAAM,WAAW,YAAY,CAAC;AACrC,eAAO,MAAM,WAAW,iBAAiB,CAAC;AAE1C,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAoBhD;AAWD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAyB1F"}

package/dist/middleware/csrf.js

@@ -0,0 +1,64 @@
+// @oktis-works/api - CSRF via double-submit cookie + verificação de Origin (security-001)
+import { randomUUID } from 'node:crypto';
+const STATE_CHANGING = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+export const CSRF_COOKIE = 'bl_csrf';
+export const CSRF_HEADER = 'X-CSRF-Token';
+export function issueCsrfToken() {
+    return randomUUID();
+}
+/** Origem esperada: mesma do Host da requisição (ou configurada em TRUSTED_ORIGINS). */
+export function isSameOrigin(c) {
+    const origin = c.req.header('Origin') ?? c.req.header('Referer');
+    if (!origin)
+        return false;
+    let originHost;
+    try {
+        originHost = new URL(origin).host;
+    }
+    catch {
+        return false;
+    }
+    const trusted = (process.env['TRUSTED_ORIGINS'] ?? '')
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    if (trusted.includes(originHost))
+        return true;
+    const host = c.req.header('X-Forwarded-Host') ?? c.req.header('Host');
+    return Boolean(host) && originHost === host;
+}
+function readCookie(cookieHeader, name) {
+    if (!cookieHeader)
+        return null;
+    for (const part of cookieHeader.split(';')) {
+        const [key, ...rest] = part.trim().split('=');
+        if (key === name)
+            return decodeURIComponent(rest.join('='));
+    }
+    return null;
+}
+/**
+ * Double-submit cookie: emite cookie bl_csrf para navegadores e valida que
+ * header X-CSRF-Token === cookie em requisições state-changing com cookie de sessão.
+ * Clientes não-navegador (Authorization Bearer) ficam isentos.
+ */
+export async function csrfMiddleware(c, next) {
+    const method = c.req.method.toUpperCase();
+    if (!STATE_CHANGING.has(method)) {
+        await next();
+        return;
+    }
+    // Autenticação por token (API-first) não é vulnerável a CSRF
+    const hasBearer = Boolean(c.req.header('Authorization')?.startsWith('Bearer '));
+    const cookieHeader = c.req.header('Cookie');
+    if (!hasBearer && cookieHeader?.includes(CSRF_COOKIE)) {
+        const cookieToken = readCookie(cookieHeader, CSRF_COOKIE);
+        const headerToken = c.req.header(CSRF_HEADER);
+        if (!cookieToken || !headerToken || cookieToken !== headerToken || !isSameOrigin(c)) {
+            return c.json({ error: 'CSRF_TOKEN_INVALID', message: 'CSRF validation failed.' }, 403);
+        }
+    }
+    await next();
+    return;
+}
+//# sourceMappingURL=csrf.js.map

package/dist/middleware/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAG1F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AACrC,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAE1C,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;SACnD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,KAAK,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,YAAgC,EAAE,IAAY;IAChE,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,CAAU,EAAE,IAAU;IACzD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,6DAA6D;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,IAAI,CAAC,SAAS,IAAI,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAE9C,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,WAAW,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,yBAAyB,EAAE,EACnE,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;IACb,OAAO;AACT,CAAC"}

package/dist/middleware/csrf.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=csrf.test.d.ts.map

package/dist/middleware/csrf.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.test.d.ts","sourceRoot":"","sources":["../../src/middleware/csrf.test.ts"],"names":[],"mappings":""}

package/dist/middleware/csrf.test.js

@@ -0,0 +1,94 @@
+// @oktis-works/api - CSRF double-submit (security-001)
+import { describe, it, expect, vi } from 'vitest';
+vi.mock('@oktis-works/core', () => ({
+    establishTenantContext: vi.fn(async () => undefined),
+}));
+import { Hono } from 'hono';
+import { csrfMiddleware, issueCsrfToken, CSRF_COOKIE, CSRF_HEADER, isSameOrigin } from './csrf.js';
+function buildApp() {
+    const app = new Hono();
+    app.use('*', csrfMiddleware);
+    app.post('/api/v1/things', (c) => c.json({ ok: true }));
+    app.get('/api/v1/things', (c) => c.json({ ok: true }));
+    return app;
+}
+describe('csrfMiddleware', () => {
+    it('GET passa sem validação', async () => {
+        const res = await buildApp().request('/api/v1/things');
+        expect(res.status).toBe(200);
+    });
+    it('POST com Bearer token fica isento (API-first)', async () => {
+        const res = await buildApp().request('/api/v1/things', {
+            method: 'POST',
+            headers: { Authorization: 'Bearer abc' },
+        });
+        expect(res.status).toBe(200);
+    });
+    it('POST com cookie de sessão sem header CSRF é bloqueado', async () => {
+        const res = await buildApp().request('/api/v1/things', {
+            method: 'POST',
+            headers: { Cookie: `session=abc; ${CSRF_COOKIE}=tok-1` },
+        });
+        expect(res.status).toBe(403);
+        const body = (await res.json());
+        expect(body.error).toBe('CSRF_TOKEN_INVALID');
+    });
+    it('POST com cookie + header iguais e mesma origem passa', async () => {
+        const res = await buildApp().request('/api/v1/things', {
+            method: 'POST',
+            headers: {
+                Host: 'cms.local',
+                Origin: 'https://cms.local',
+                Cookie: `session=abc; ${CSRF_COOKIE}=tok-1`,
+                [CSRF_HEADER]: 'tok-1',
+            },
+        });
+        expect(res.status).toBe(200);
+    });
+    it('token divergente ou origem cruzada é rejeitado', async () => {
+        const app = buildApp();
+        const mismatch = await app.request('/api/v1/things', {
+            method: 'POST',
+            headers: {
+                Host: 'cms.local',
+                Origin: 'https://cms.local',
+                Cookie: `${CSRF_COOKIE}=tok-1`,
+                [CSRF_HEADER]: 'tok-other',
+            },
+        });
+        expect(mismatch.status).toBe(403);
+        const crossOrigin = await app.request('/api/v1/things', {
+            method: 'POST',
+            headers: {
+                Host: 'cms.local',
+                Origin: 'https://evil.example',
+                Cookie: `${CSRF_COOKIE}=tok-1`,
+                [CSRF_HEADER]: 'tok-1',
+            },
+        });
+        expect(crossOrigin.status).toBe(403);
+    });
+    it('issueCsrfToken gera tokens únicos', () => {
+        expect(issueCsrfToken()).not.toBe(issueCsrfToken());
+    });
+});
+describe('isSameOrigin', () => {
+    it('aceita host igual e TRUSTED_ORIGINS', () => {
+        const ctx = (origin, host = 'cms.local') => ({
+            req: {
+                header: (name) => name === 'Origin' ? origin : name === 'Host' ? host : undefined,
+            },
+        });
+        process.env['TRUSTED_ORIGINS'] = 'app.blacklotus.dev';
+        try {
+            expect(isSameOrigin(ctx('https://cms.local'))).toBe(true);
+            expect(isSameOrigin(ctx('https://app.blacklotus.dev'))).toBe(true);
+            expect(isSameOrigin(ctx(undefined))).toBe(false);
+            expect(isSameOrigin(ctx('https://evil.example'))).toBe(false);
+        }
+        finally {
+            delete process.env['TRUSTED_ORIGINS'];
+        }
+    });
+});
+//# sourceMappingURL=csrf.test.js.map

package/dist/middleware/csrf.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.test.js","sourceRoot":"","sources":["../../src/middleware/csrf.test.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAEvD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAElD,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;CACrD,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEnG,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC7B,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,WAAW,QAAQ,EAAE;SACzD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,gBAAgB,WAAW,QAAQ;gBAC3C,CAAC,WAAW,CAAC,EAAE,OAAO;aACvB;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;QAEvB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,GAAG,WAAW,QAAQ;gBAC9B,CAAC,WAAW,CAAC,EAAE,WAAW;aAC3B;SACF,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAElC,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,sBAAsB;gBAC9B,MAAM,EAAE,GAAG,WAAW,QAAQ;gBAC9B,CAAC,WAAW,CAAC,EAAE,OAAO;aACvB;SACF,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,GAAG,GAAG,CAAC,MAA0B,EAAE,IAAI,GAAG,WAAW,EAAE,EAAE,CAC7D,CAAC;YACC,GAAG,EAAE;gBACH,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CACvB,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAClE;SACF,CAAU,CAAC;QAEd,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,oBAAoB,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC;gBAAS,CAAC;YACT,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/middleware/rate-limit.d.ts

@@ -0,0 +1,18 @@
+import type { Context, Next } from 'hono';
+export interface RateLimitOptions {
+    max?: number;
+    windowMs?: number;
+}
+export declare function parseRateLimitEnv(env?: Record<string, string | undefined>): {
+    max: number;
+    windowMs: number;
+};
+export declare function clientKey(c: Context): string;
+/** Reseta os buckets (uso em testes). */
+export declare function resetRateLimiter(): void;
+/**
+ * Janela deslizante simples: 429 + Retry-After quando excede o limite.
+ * /health e /metrics ficam de fora (probes não devem ser limitados).
+ */
+export declare function rateLimitMiddleware(options?: RateLimitOptions): (c: Context, next: Next) => Promise<Response | undefined>;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/middleware/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS1C,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG;IACxF,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB,CAOA;AAED,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAO5C;AAED,yCAAyC;AACzC,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,gBAAqB,OAG/C,OAAO,QAAQ,IAAI,KAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAqCrE"}

package/dist/middleware/rate-limit.js

@@ -0,0 +1,58 @@
+// @oktis-works/api - Rate limiting por janela deslizante in-memory (REQU-020/rest-api-003)
+const buckets = new Map();
+export function parseRateLimitEnv(env = process.env) {
+    const max = Number(env['RATE_LIMIT_MAX'] ?? 300);
+    const windowSeconds = Number(env['RATE_LIMIT_WINDOW_SECONDS'] ?? 60);
+    return {
+        max: Number.isFinite(max) && max > 0 ? Math.floor(max) : 300,
+        windowMs: Number.isFinite(windowSeconds) && windowSeconds > 0 ? windowSeconds * 1000 : 60_000,
+    };
+}
+export function clientKey(c) {
+    const tenant = c.req.header('X-Tenant-ID') ?? 'platform';
+    const ip = c.req.header('X-Forwarded-For')?.split(',')[0]?.trim() ??
+        c.req.header('X-Real-IP') ??
+        'unknown';
+    return `${tenant}:${ip}`;
+}
+/** Reseta os buckets (uso em testes). */
+export function resetRateLimiter() {
+    buckets.clear();
+}
+/**
+ * Janela deslizante simples: 429 + Retry-After quando excede o limite.
+ * /health e /metrics ficam de fora (probes não devem ser limitados).
+ */
+export function rateLimitMiddleware(options = {}) {
+    const { max, windowMs } = { ...parseRateLimitEnv(), ...options };
+    return async (c, next) => {
+        const path = new URL(c.req.url).pathname;
+        if (path === '/health' || path.startsWith('/api/v1/health') || path.startsWith('/metrics')) {
+            await next();
+            return;
+        }
+        const key = clientKey(c);
+        const now = Date.now();
+        const bucket = buckets.get(key);
+        if (!bucket || bucket.resetAt <= now) {
+            buckets.set(key, { count: 1, resetAt: now + windowMs });
+            c.header('X-RateLimit-Limit', String(max));
+            c.header('X-RateLimit-Remaining', String(max - 1));
+            await next();
+            return;
+        }
+        bucket.count += 1;
+        if (bucket.count > max) {
+            const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));
+            c.header('Retry-After', String(retryAfter));
+            c.header('X-RateLimit-Limit', String(max));
+            c.header('X-RateLimit-Remaining', '0');
+            return c.json({ error: 'TOO_MANY_REQUESTS', message: `Rate limit exceeded. Retry after ${retryAfter}s.` }, 429);
+        }
+        c.header('X-RateLimit-Limit', String(max));
+        c.header('X-RateLimit-Remaining', String(Math.max(0, max - bucket.count)));
+        await next();
+        return;
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/middleware/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAS3F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;AAO1C,MAAM,UAAU,iBAAiB,CAAC,MAA0C,OAAO,CAAC,GAAG;IAIrF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG;QAC5D,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM;KAC9F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAU;IAClC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC;IACzD,MAAM,EAAE,GACN,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACtD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;QACzB,SAAS,CAAC;IACZ,OAAO,GAAG,MAAM,IAAI,EAAE,EAAE,CAAC;AAC3B,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,gBAAgB;IAC9B,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA4B,EAAE;IAChE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,iBAAiB,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC;IAEjE,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAiC,EAAE;QACrE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACzC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC;YACxD,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAElB,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACzE,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5C,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,oCAAoC,UAAU,IAAI,EAAE,EAC3F,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/rate-limit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rate-limit.test.d.ts.map

package/dist/middleware/rate-limit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.test.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.test.ts"],"names":[],"mappings":""}

package/dist/middleware/rate-limit.test.js

@@ -0,0 +1,58 @@
+// @oktis-works/api - Rate limit (rest-api-003)
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+vi.mock('@oktis-works/core', () => ({
+    establishTenantContext: vi.fn(async () => undefined),
+}));
+import { Hono } from 'hono';
+import { rateLimitMiddleware, resetRateLimiter, parseRateLimitEnv } from './rate-limit.js';
+function buildApp(max) {
+    const app = new Hono();
+    app.use('*', rateLimitMiddleware({ max, windowMs: 60_000 }));
+    app.get('/api/v1/things', (c) => c.json({ ok: true }));
+    app.get('/health', (c) => c.json({ status: 'ok' }));
+    return app;
+}
+beforeEach(() => {
+    resetRateLimiter();
+});
+describe('parseRateLimitEnv', () => {
+    it('lê env com defaults sensatos', () => {
+        expect(parseRateLimitEnv({})).toEqual({ max: 300, windowMs: 60_000 });
+        expect(parseRateLimitEnv({ RATE_LIMIT_MAX: '10', RATE_LIMIT_WINDOW_SECONDS: '30' })).toEqual({
+            max: 10,
+            windowMs: 30_000,
+        });
+        expect(parseRateLimitEnv({ RATE_LIMIT_MAX: 'abc' })).toEqual({ max: 300, windowMs: 60_000 });
+    });
+});
+describe('rateLimitMiddleware', () => {
+    it('permite até max requisições e devolve 429 + Retry-After na excedente', async () => {
+        const app = buildApp(3);
+        const headers = { 'X-Tenant-ID': 't1', 'X-Forwarded-For': '10.0.0.1' };
+        for (let i = 0; i < 3; i++) {
+            const res = await app.request('/api/v1/things', { headers });
+            expect(res.status).toBe(200);
+        }
+        const blocked = await app.request('/api/v1/things', { headers });
+        expect(blocked.status).toBe(429);
+        expect(Number(blocked.headers.get('Retry-After'))).toBeGreaterThan(0);
+        expect(blocked.headers.get('X-RateLimit-Limit')).toBe('3');
+        const body = (await blocked.json());
+        expect(body.error).toBe('TOO_MANY_REQUESTS');
+    });
+    it('buckets separados por tenant+IP', async () => {
+        const app = buildApp(1);
+        const h1 = { 'X-Tenant-ID': 't1', 'X-Forwarded-For': '10.0.0.1' };
+        const h2 = { 'X-Tenant-ID': 't2', 'X-Forwarded-For': '10.0.0.2' };
+        expect((await app.request('/api/v1/things', { headers: h1 })).status).toBe(200);
+        expect((await app.request('/api/v1/things', { headers: h1 })).status).toBe(429);
+        expect((await app.request('/api/v1/things', { headers: h2 })).status).toBe(200);
+    });
+    it('health fica isento do limite', async () => {
+        const app = buildApp(1);
+        expect((await app.request('/health')).status).toBe(200);
+        expect((await app.request('/health')).status).toBe(200);
+        expect((await app.request('/health')).status).toBe(200);
+    });
+});
+//# sourceMappingURL=rate-limit.test.js.map

package/dist/middleware/rate-limit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.test.js","sourceRoot":"","sources":["../../src/middleware/rate-limit.test.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAE/C,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9D,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;CACrD,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE3F,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7D,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,gBAAgB,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3F,GAAG,EAAE,EAAE;YACP,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;QAEvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAsB,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;QAClE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;QAElE,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChF,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChF,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/middleware/trace.d.ts

@@ -0,0 +1,7 @@
+import type { Context, Next } from 'hono';
+/**
+ * REQ-observability-005: todo request pode ser rastreado via trace ID.
+ * Propaga X-Trace-ID recebido ou gera um novo; devolve na resposta.
+ */
+export declare function traceMiddleware(c: Context, next: Next): Promise<Response | void>;
+//# sourceMappingURL=trace.d.ts.map

package/dist/middleware/trace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace.d.ts","sourceRoot":"","sources":["../../src/middleware/trace.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG1C;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAOtF"}