@oktis-works/cms 0.1.14 → 0.2.1

package/dist/env-schema.js

@@ -0,0 +1,497 @@
+// @oktis-works/cms - Catálogo de variáveis de ambiente do projeto
+//
+// Fonte única de verdade para o wizard `okcms config`: quais chaves existem,
+// em qual seção, o que significam, como validar e qual o default. Não é um
+// "schema" da aplicação — é o contrato do `.env`, que é o que o operador
+// realmente edita.
+//
+// Os defaults aqui batem com `@oktis-works/config loadConfig()` e com o
+// `.env.example` gerado no `okcms init`. Se mudar um default no config, mude
+// aqui também (o teste de catálogo cobre esse vínculo).
+import { parseDatabaseUrl } from './doctor.js';
+export const ENV_SECTIONS = [
+    { id: 'app', title: 'Aplicação', hint: 'NODE_ENV, portas e rate limit' },
+    { id: 'database', title: 'Banco de dados', hint: 'Postgres via DB_* ou DATABASE_URL' },
+    { id: 'redis', title: 'Redis', hint: 'cache e filas do worker' },
+    { id: 'auth', title: 'Autenticação', hint: 'JWT, cookies e CSRF' },
+    { id: 'storage', title: 'Storage', hint: 'local, s3, r2 ou minio' },
+    { id: 'worker', title: 'Worker', hint: 'concorrência e retries das filas' },
+    { id: 'cache', title: 'Cache', hint: 'TTL e prefixo das chaves' },
+    { id: 'ports', title: 'Ports dos apps', hint: 'admin e web' },
+    { id: 'theme', title: 'Tema', hint: 'tema ativo do site' },
+    { id: 'deploy', title: 'Deploy (Docker)', hint: 'imagem blue/green e host do proxy' },
+];
+export const ENV_FIELDS = [
+    // -- Aplicação ------------------------------------------------------------
+    {
+        key: 'NODE_ENV',
+        section: 'app',
+        label: 'NODE_ENV',
+        description: 'development | production | test',
+        type: 'enum',
+        options: ['development', 'production', 'test'],
+        default: 'development',
+    },
+    {
+        key: 'HOST',
+        section: 'app',
+        label: 'HOST',
+        description: 'Interface de bind da API',
+        type: 'string',
+        default: '0.0.0.0',
+        example: '0.0.0.0',
+    },
+    {
+        key: 'PORT',
+        section: 'app',
+        label: 'PORT',
+        description: 'Porta da API',
+        type: 'port',
+        default: '3000',
+    },
+    {
+        key: 'CORS_ORIGINS',
+        section: 'app',
+        label: 'CORS_ORIGINS',
+        description: 'Origens liberadas (separadas por vírgula)',
+        type: 'string',
+        default: 'http://localhost:4321',
+        example: 'https://meusite.com,https://admin.meusite.com',
+    },
+    {
+        key: 'RATE_LIMIT_WINDOW_MS',
+        section: 'app',
+        label: 'RATE_LIMIT_WINDOW_MS',
+        description: 'Janela do rate limit em milissegundos',
+        type: 'number',
+        default: '60000',
+    },
+    {
+        key: 'RATE_LIMIT_MAX',
+        section: 'app',
+        label: 'RATE_LIMIT_MAX',
+        description: 'Requisições máximas por janela',
+        type: 'number',
+        default: '100',
+    },
+    // -- Banco de dados -------------------------------------------------------
+    {
+        key: 'DB_HOST',
+        section: 'database',
+        label: 'DB_HOST',
+        description: 'Ignorado quando DATABASE_URL estiver definida',
+        type: 'string',
+        default: 'localhost',
+        when: (r) => !r['DATABASE_URL'],
+    },
+    {
+        key: 'DB_PORT',
+        section: 'database',
+        label: 'DB_PORT',
+        description: 'Porta do Postgres',
+        type: 'port',
+        default: '5432',
+        when: (r) => !r['DATABASE_URL'],
+    },
+    {
+        key: 'DB_NAME',
+        section: 'database',
+        label: 'DB_NAME',
+        description: 'Nome do banco',
+        type: 'string',
+        default: 'okcms',
+        when: (r) => !r['DATABASE_URL'],
+    },
+    {
+        key: 'DB_USER',
+        section: 'database',
+        label: 'DB_USER',
+        description: 'Usuário do banco',
+        type: 'string',
+        default: 'postgres',
+        when: (r) => !r['DATABASE_URL'],
+    },
+    {
+        key: 'DB_PASSWORD',
+        section: 'database',
+        label: 'DB_PASSWORD',
+        description: 'Senha do banco',
+        type: 'secret',
+        required: true,
+        when: (r) => !r['DATABASE_URL'],
+    },
+    {
+        key: 'DB_SSL',
+        section: 'database',
+        label: 'DB_SSL',
+        description: 'TLS no Postgres (true em provedor gerenciado)',
+        type: 'boolean',
+        default: 'false',
+        when: (r) => !r['DATABASE_URL'],
+    },
+    {
+        key: 'DB_MAX_CONNECTIONS',
+        section: 'database',
+        label: 'DB_MAX_CONNECTIONS',
+        description: 'Pool máximo de conexões',
+        type: 'number',
+        default: '20',
+        when: (r) => !r['DATABASE_URL'],
+    },
+    {
+        key: 'DATABASE_URL',
+        section: 'database',
+        label: 'DATABASE_URL',
+        description: 'Formato único — tem precedência sobre DB_* (postgres://user:senha@host:5432/banco)',
+        type: 'database-url',
+        example: 'postgresql://postgres:senha@localhost:5432/okcms',
+    },
+    // -- Redis ----------------------------------------------------------------
+    {
+        key: 'REDIS_HOST',
+        section: 'redis',
+        label: 'REDIS_HOST',
+        description: 'use "disabled" para rodar sem Redis (memória)',
+        type: 'string',
+        default: 'localhost',
+    },
+    {
+        key: 'REDIS_PORT',
+        section: 'redis',
+        label: 'REDIS_PORT',
+        description: 'Porta do Redis',
+        type: 'port',
+        default: '6379',
+    },
+    {
+        key: 'REDIS_PASSWORD',
+        section: 'redis',
+        label: 'REDIS_PASSWORD',
+        description: 'Senha do Redis (vazio se não houver)',
+        type: 'secret',
+    },
+    {
+        key: 'REDIS_DB',
+        section: 'redis',
+        label: 'REDIS_DB',
+        description: 'Índice da database do Redis',
+        type: 'number',
+        default: '0',
+    },
+    // -- Autenticação ---------------------------------------------------------
+    {
+        key: 'JWT_SECRET',
+        section: 'auth',
+        label: 'JWT_SECRET',
+        description: 'Segredo de assinatura dos tokens — mínimo 16 caracteres',
+        type: 'secret',
+        required: true,
+    },
+    {
+        key: 'JWT_EXPIRES_IN',
+        section: 'auth',
+        label: 'JWT_EXPIRES_IN',
+        description: 'Validade do access token',
+        type: 'duration',
+        default: '15m',
+        example: '15m, 2h, 7d',
+    },
+    {
+        key: 'REFRESH_TOKEN_EXPIRES_IN',
+        section: 'auth',
+        label: 'REFRESH_TOKEN_EXPIRES_IN',
+        description: 'Validade do refresh token',
+        type: 'duration',
+        default: '7d',
+        example: '1d, 30d',
+    },
+    {
+        key: 'BCRYPT_ROUNDS',
+        section: 'auth',
+        label: 'BCRYPT_ROUNDS',
+        description: 'Custo do hash de senha (10..15)',
+        type: 'number',
+        default: '12',
+    },
+    {
+        key: 'AUTH_COOKIE_SAMESITE',
+        section: 'auth',
+        label: 'AUTH_COOKIE_SAMESITE',
+        description: 'strict | lax | none (none exige secure=true)',
+        type: 'enum',
+        options: ['strict', 'lax', 'none'],
+        default: 'lax',
+    },
+    {
+        key: 'AUTH_COOKIE_SECURE',
+        section: 'auth',
+        label: 'AUTH_COOKIE_SECURE',
+        description: 'true atrás de TLS',
+        type: 'boolean',
+        default: 'false',
+    },
+    {
+        key: 'AUTH_CSRF_ENABLED',
+        section: 'auth',
+        label: 'AUTH_CSRF_ENABLED',
+        description: 'Proteção CSRF double-submit',
+        type: 'boolean',
+        default: 'true',
+    },
+    // -- Storage --------------------------------------------------------------
+    {
+        key: 'STORAGE_DRIVER',
+        section: 'storage',
+        label: 'STORAGE_DRIVER',
+        description: 'Onde a mídia é gravada',
+        type: 'enum',
+        options: ['local', 's3', 'r2', 'minio'],
+        default: 'local',
+    },
+    {
+        key: 'STORAGE_LOCAL_PATH',
+        section: 'storage',
+        label: 'STORAGE_LOCAL_PATH',
+        description: 'Pasta local da mídia (driver=local) — monte como volume no Docker',
+        type: 'path',
+        default: '.data/storage',
+        when: (r) => (r['STORAGE_DRIVER'] ?? 'local') === 'local',
+    },
+    {
+        key: 'STORAGE_PUBLIC_BASE',
+        section: 'storage',
+        label: 'STORAGE_PUBLIC_BASE',
+        description: 'Prefixo público das URLs de mídia',
+        type: 'path',
+        default: '/storage',
+        when: (r) => (r['STORAGE_DRIVER'] ?? 'local') === 'local',
+    },
+    {
+        key: 'STORAGE_BUCKET',
+        section: 'storage',
+        label: 'STORAGE_BUCKET',
+        description: 'Bucket (s3/r2/minio)',
+        type: 'string',
+        when: (r) => (r['STORAGE_DRIVER'] ?? 'local') !== 'local',
+    },
+    {
+        key: 'STORAGE_ENDPOINT',
+        section: 'storage',
+        label: 'STORAGE_ENDPOINT',
+        description: 'Endpoint S3-compatível',
+        type: 'url',
+        example: 'http://localhost:9000',
+        when: (r) => (r['STORAGE_DRIVER'] ?? 'local') !== 'local',
+    },
+    {
+        key: 'STORAGE_ACCESS_KEY',
+        section: 'storage',
+        label: 'STORAGE_ACCESS_KEY',
+        description: 'Chave de acesso do objeto',
+        type: 'secret',
+        when: (r) => (r['STORAGE_DRIVER'] ?? 'local') !== 'local',
+    },
+    {
+        key: 'STORAGE_SECRET_KEY',
+        section: 'storage',
+        label: 'STORAGE_SECRET_KEY',
+        description: 'Chave secreta do objeto',
+        type: 'secret',
+        when: (r) => (r['STORAGE_DRIVER'] ?? 'local') !== 'local',
+    },
+    // -- Worker ---------------------------------------------------------------
+    {
+        key: 'WORKER_MODE',
+        section: 'worker',
+        label: 'WORKER_MODE',
+        description: 'docker | pm2 | k8s',
+        type: 'enum',
+        options: ['docker', 'pm2', 'k8s'],
+        default: 'docker',
+    },
+    {
+        key: 'WORKER_COUNT',
+        section: 'worker',
+        label: 'WORKER_COUNT',
+        description: 'Quantos processos de worker',
+        type: 'number',
+        default: '1',
+    },
+    {
+        key: 'WORKER_CONCURRENCY',
+        section: 'worker',
+        label: 'WORKER_CONCURRENCY',
+        description: 'Jobs simultâneos por processo',
+        type: 'number',
+        default: '5',
+    },
+    {
+        key: 'WORKER_RETRY_ATTEMPTS',
+        section: 'worker',
+        label: 'WORKER_RETRY_ATTEMPTS',
+        description: 'Tentativas de retry por job',
+        type: 'number',
+        default: '3',
+    },
+    {
+        key: 'WORKER_RETRY_DELAY',
+        section: 'worker',
+        label: 'WORKER_RETRY_DELAY',
+        description: 'Delay entre tentativas (ms)',
+        type: 'number',
+        default: '1000',
+    },
+    // -- Cache ----------------------------------------------------------------
+    {
+        key: 'CACHE_TTL',
+        section: 'cache',
+        label: 'CACHE_TTL',
+        description: 'Validade padrão do cache (s)',
+        type: 'number',
+        default: '3600',
+    },
+    {
+        key: 'CACHE_PREFIX',
+        section: 'cache',
+        label: 'CACHE_PREFIX',
+        description: 'Prefixo das chaves no Redis',
+        type: 'string',
+        default: 'bl:',
+    },
+    // -- Ports ----------------------------------------------------------------
+    // Os três defaults são os que os apps leem de verdade (api PORT=3000,
+    // web WEB_PORT=3001, admin PORT/3011). Divergir daqui faz o wizard gravar
+    // uma porta que ninguém escuta e o upstream do nginx apontar pro vazio.
+    {
+        key: 'ADMIN_PORT',
+        section: 'ports',
+        label: 'ADMIN_PORT',
+        description: 'Porta do admin',
+        type: 'port',
+        default: '3011',
+    },
+    {
+        key: 'WEB_PORT',
+        section: 'ports',
+        label: 'WEB_PORT',
+        description: 'Porta do site público',
+        type: 'port',
+        default: '3001',
+    },
+    // -- Tema -----------------------------------------------------------------
+    {
+        key: 'ACTIVE_THEME',
+        section: 'theme',
+        label: 'ACTIVE_THEME',
+        description: 'Nome da pasta em themes/ (vazio = tema default)',
+        type: 'string',
+        example: 'default',
+    },
+    // -- Deploy ---------------------------------------------------------------
+    {
+        key: 'OKCMS_VERSION',
+        section: 'deploy',
+        label: 'OKCMS_VERSION',
+        description: 'Tag da imagem okcms/app usada no compose de deploy blue/green',
+        type: 'string',
+        default: 'latest',
+        example: '0.2.0',
+    },
+    {
+        key: 'SERVER_NAME',
+        section: 'deploy',
+        label: 'SERVER_NAME',
+        description: 'server_name do nginx (site público)',
+        type: 'string',
+        default: '_',
+        example: 'meusite.com',
+    },
+    {
+        key: 'ADMIN_SERVER_NAME',
+        section: 'deploy',
+        label: 'ADMIN_SERVER_NAME',
+        description: 'server_name do admin no proxy (deve ser um host separado)',
+        type: 'string',
+        default: 'admin.localhost',
+        example: 'admin.meusite.com',
+    },
+];
+// ---------------------------------------------------------------------------
+// Validação
+// ---------------------------------------------------------------------------
+const DURATION_RE = /^\d+(ms|s|m|h|d)$/;
+const PORT_RE = /^\d+$/;
+/** Mensagem de erro para o prompt, ou null quando o valor é válido. */
+export function validateField(field, value) {
+    const trimmed = value.trim();
+    if (trimmed === '') {
+        if (field.required)
+            return `${field.key} é obrigatório`;
+        return null;
+    }
+    switch (field.type) {
+        case 'port': {
+            if (!PORT_RE.test(trimmed))
+                return 'precisa ser um número de porta';
+            const port = Number(trimmed);
+            if (port < 1 || port > 65535)
+                return 'fora da faixa 1..65535';
+            return null;
+        }
+        case 'number': {
+            if (!/^-?\d+$/.test(trimmed))
+                return 'precisa ser um inteiro';
+            return null;
+        }
+        case 'boolean': {
+            if (!['true', 'false', '1', '0'].includes(trimmed.toLowerCase())) {
+                return 'use true ou false';
+            }
+            return null;
+        }
+        case 'enum': {
+            const options = field.options ?? [];
+            if (!options.includes(trimmed))
+                return `use uma de: ${options.join(' | ')}`;
+            return null;
+        }
+        case 'duration': {
+            if (!DURATION_RE.test(trimmed))
+                return 'use um formato como 15m, 2h ou 7d';
+            return null;
+        }
+        case 'url': {
+            try {
+                const parsed = new URL(trimmed);
+                if (!['http:', 'https:'].includes(parsed.protocol))
+                    return 'use http:// ou https://';
+                return null;
+            }
+            catch {
+                return 'URL inválida';
+            }
+        }
+        case 'database-url': {
+            if (!parseDatabaseUrl(trimmed)) {
+                return 'use postgres:// ou mysql:// com host e banco (ex.: postgres://user:senha@host:5432/okcms)';
+            }
+            return null;
+        }
+        case 'secret': {
+            if (field.key === 'JWT_SECRET' && trimmed.length < 16) {
+                return 'JWT_SECRET precisa de pelo menos 16 caracteres';
+            }
+            return null;
+        }
+        default:
+            return null;
+    }
+}
+/** Campos de uma seção, já filtrados por dependência (`when`). */
+export function fieldsForSection(sectionId, record) {
+    return ENV_FIELDS.filter((field) => field.section === sectionId && (!field.when || field.when(record)));
+}
+export function sectionById(sectionId) {
+    return ENV_SECTIONS.find((section) => section.id === sectionId);
+}
+//# sourceMappingURL=env-schema.js.map

package/dist/env-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-schema.js","sourceRoot":"","sources":["../src/env-schema.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,yEAAyE;AACzE,mBAAmB;AACnB,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,wDAAwD;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAmC/C,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,+BAA+B,EAAE;IACxE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,mCAAmC,EAAE;IACtF,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAChE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAClE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,wBAAwB,EAAE;IACnE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE;IAC3E,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE;IACjE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE;IAC7D,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC1D,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,mCAAmC,EAAE;CACtF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,4EAA4E;IAC5E;QACE,GAAG,EAAE,UAAU;QACf,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,UAAU;QACjB,WAAW,EAAE,iCAAiC;QAC9C,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,MAAM,CAAC;QAC9C,OAAO,EAAE,aAAa;KACvB;IACD;QACE,GAAG,EAAE,MAAM;QACX,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,0BAA0B;QACvC,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,SAAS;KACnB;IACD;QACE,GAAG,EAAE,MAAM;QACX,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,cAAc;QAC3B,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,MAAM;KAChB;IACD;QACE,GAAG,EAAE,cAAc;QACnB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,2CAA2C;QACxD,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,uBAAuB;QAChC,OAAO,EAAE,+CAA+C;KACzD;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,uCAAuC;QACpD,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;KACjB;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,gCAAgC;QAC7C,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,KAAK;KACf;IAED,4EAA4E;IAC5E;QACE,GAAG,EAAE,SAAS;QACd,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,+CAA+C;QAC5D,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;KAChC;IACD;QACE,GAAG,EAAE,SAAS;QACd,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,mBAAmB;QAChC,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;KAChC;IACD;QACE,GAAG,EAAE,SAAS;QACd,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,eAAe;QAC5B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;KAChC;IACD;QACE,GAAG,EAAE,SAAS;QACd,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,UAAU;QACnB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;KAChC;IACD;QACE,GAAG,EAAE,aAAa;QAClB,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,gBAAgB;QAC7B,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;KAChC;IACD;QACE,GAAG,EAAE,QAAQ;QACb,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,+CAA+C;QAC5D,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;KAChC;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,yBAAyB;QACtC,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;KAChC;IACD;QACE,GAAG,EAAE,cAAc;QACnB,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,oFAAoF;QACtF,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,kDAAkD;KAC5D;IAED,4EAA4E;IAC5E;QACE,GAAG,EAAE,YAAY;QACjB,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,+CAA+C;QAC5D,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,WAAW;KACrB;IACD;QACE,GAAG,EAAE,YAAY;QACjB,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,gBAAgB;QAC7B,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,MAAM;KAChB;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,QAAQ;KACf;IACD;QACE,GAAG,EAAE,UAAU;QACf,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,UAAU;QACjB,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,GAAG;KACb;IAED,4EAA4E;IAC5E;QACE,GAAG,EAAE,YAAY;QACjB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,yDAAyD;QACtE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,0BAA0B;QACvC,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,aAAa;KACvB;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,2BAA2B;QACxC,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,SAAS;KACnB;IACD;QACE,GAAG,EAAE,eAAe;QACpB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,iCAAiC;QAC9C,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;KACd;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,8CAA8C;QAC3D,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC;QAClC,OAAO,EAAE,KAAK;KACf;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,mBAAmB;QAChC,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,OAAO;KACjB;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,MAAM;KAChB;IAED,4EAA4E;IAC5E;QACE,GAAG,EAAE,gBAAgB;QACrB,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,wBAAwB;QACrC,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;QACvC,OAAO,EAAE,OAAO;KACjB;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,mEAAmE;QAChF,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,KAAK,OAAO;KAC1D;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,mCAAmC;QAChD,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,UAAU;QACnB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,KAAK,OAAO;KAC1D;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,sBAAsB;QACnC,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,KAAK,OAAO;KAC1D;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,wBAAwB;QACrC,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,KAAK,OAAO;KAC1D;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,2BAA2B;QACxC,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,KAAK,OAAO;KAC1D;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,yBAAyB;QACtC,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,KAAK,OAAO;KAC1D;IAED,4EAA4E;IAC5E;QACE,GAAG,EAAE,aAAa;QAClB,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,oBAAoB;QACjC,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC;QACjC,OAAO,EAAE,QAAQ;KAClB;IACD;QACE,GAAG,EAAE,cAAc;QACnB,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,GAAG;KACb;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,GAAG;KACb;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,GAAG;KACb;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,MAAM;KAChB;IAED,4EAA4E;IAC5E;QACE,GAAG,EAAE,WAAW;QAChB,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,WAAW;QAClB,WAAW,EAAE,8BAA8B;QAC3C,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,MAAM;KAChB;IACD;QACE,GAAG,EAAE,cAAc;QACnB,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,KAAK;KACf;IAED,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE;QACE,GAAG,EAAE,YAAY;QACjB,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,gBAAgB;QAC7B,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,MAAM;KAChB;IACD;QACE,GAAG,EAAE,UAAU;QACf,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,UAAU;QACjB,WAAW,EAAE,uBAAuB;QACpC,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,MAAM;KAChB;IAED,4EAA4E;IAC5E;QACE,GAAG,EAAE,cAAc;QACnB,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,iDAAiD;QAC9D,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,SAAS;KACnB;IAED,4EAA4E;IAC5E;QACE,GAAG,EAAE,eAAe;QACpB,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,+DAA+D;QAC5E,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,OAAO;KACjB;IACD;QACE,GAAG,EAAE,aAAa;QAClB,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,qCAAqC;QAClD,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,aAAa;KACvB;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,2DAA2D;QACxE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,mBAAmB;KAC7B;CACF,CAAC;AAEF,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,KAAe,EAAE,KAAa;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO,GAAG,KAAK,CAAC,GAAG,gBAAgB,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,gCAAgC,CAAC;YACpE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;gBAAE,OAAO,wBAAwB,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,wBAAwB,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACjE,OAAO,mBAAmB,CAAC;YAC7B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,eAAe,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,mCAAmC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAAE,OAAO,yBAAyB,CAAC;gBACrF,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,cAAc,CAAC;YACxB,CAAC;QACH,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,OAAO,2FAA2F,CAAC;YACrG,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,KAAK,CAAC,GAAG,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACtD,OAAO,gDAAgD,CAAC;YAC1D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAA8B;IAChF,OAAO,UAAU,CAAC,MAAM,CACtB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAC9E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;AAClE,CAAC"}

package/dist/guards.d.ts

@@ -0,0 +1,40 @@
+export interface ContainerProbe {
+    /** Existência de arquivo (padrão: fs.existsSync). */
+    exists?: (path: string) => boolean;
+    env?: NodeJS.ProcessEnv;
+    /** Conteúdo de /proc/1/cgroup (padrão: fs.readFileSync). */
+    cgroup?: string | null;
+}
+export declare function isInContainer(probe?: ContainerProbe): boolean;
+export interface GuardResult {
+    ok: boolean;
+    /** Mensagem pronta para `console.error` quando `ok === false`. */
+    message: string;
+}
+/**
+ * Bloqueia comandos que alteram estado fora do host quando a CLI roda dentro
+ * de um container. `force` (=`--force`) é o escape consciente — registrado em
+ * log para auditoria.
+ */
+export declare function assertHostOnly(command: string, opts?: {
+    force?: boolean;
+    probe?: ContainerProbe;
+}): GuardResult;
+/** Único destino que a CLI fala sem configuração explícita. */
+export declare const DEFAULT_REGISTRY = "https://registry.npmjs.org";
+export declare function registryAllowlist(env?: NodeJS.ProcessEnv): string[];
+export declare function isUrlAllowed(url: string, allowlist?: string[]): boolean;
+export declare function assertUrlAllowed(url: string, allowlist?: string[]): GuardResult;
+/** true se algum serviço monta o socket do Docker (via short ou long syntax). */
+export declare function hasDockerSocketMount(composeText: string): boolean;
+export declare function assertNoDockerSocket(composeText: string): GuardResult;
+/**
+ * Aplica redação a QUALQUER texto de log da CLI. Chamado pelas mensagens de
+ * erro de `update`/`config` para nunca vazar senha em CI ou em issue de suporte.
+ */
+export declare function redact(text: string): string;
+/** true se o valor parece um segredo de verdade (não vazio, não placeholder). */
+export declare function looksLikeSecret(value: string): boolean;
+/** Gera um segredo forte (JWT_SECRET / cookie key) sem dependência externa. */
+export declare function generateSecret(length?: number): string;
+//# sourceMappingURL=guards.d.ts.map

package/dist/guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../src/guards.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAeD,wBAAgB,aAAa,CAAC,KAAK,GAAE,cAAmB,GAAG,OAAO,CAsBjE;AAYD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,cAAc,CAAA;CAAO,GACrD,WAAW,CAYb;AAMD,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CAGhF;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,EAAwB,GAAG,OAAO,CAE5F;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,MAAM,EAAwB,GACxC,WAAW,CAMb;AAQD,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CASrE;AA4BD;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAItD;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,MAAM,SAAK,GAAG,MAAM,CAOlD"}