tempest-express-sdk 0.10.0 → 0.20.0

package/dist/index.cjs

@@ -4,14 +4,16 @@ var async_hooks = require('async_hooks');
 var zodToOpenapi = require('@asteasolutions/zod-to-openapi');
 var zod = require('zod');
 var tempestDbJs = require('tempest-db-js');
-var crypto = require('crypto');
 var child_process = require('child_process');
-var os = require('os');
-var util = require('util');
 var promises = require('fs/promises');
+var crypto = require('crypto');
+var fs = require('fs');
 var path = require('path');
+var os = require('os');
+var util = require('util');
 var express2 = require('express');
 var swaggerUiDist = require('swagger-ui-dist');
+var migrations = require('tempest-db-js/migrations');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -38,6 +40,14 @@ var LEVEL_ORDER = {
   warning: 30,
   error: 40
 };
+var sinks = [];
+function addLogSink(sink) {
+  sinks.push(sink);
+  return () => {
+    const index = sinks.indexOf(sink);
+    if (index !== -1) sinks.splice(index, 1);
+  };
+}
 var JSONLogger = class {
   /**
    * @param name - Logger name embedded in every record.
@@ -86,6 +96,12 @@ var JSONLogger = class {
 `);
     else process.stdout.write(`${line}
 `);
+    for (const sink of sinks) {
+      try {
+        sink(level, record);
+      } catch {
+      }
+    }
   }
 };
 function configureLogging(name, level = "info") {
@@ -347,6 +363,90 @@ function decodeCursor(cursor) {
   return parsed;
 }
 
+// src/schemas/fields.ts
+var positiveIntField = zod.z.number().int().positive();
+var nonNegativeIntField = zod.z.number().int().min(0);
+var centsField = zod.z.number().int().min(0);
+var portField = zod.z.number().int().min(1).max(65535);
+var ratingField = zod.z.number().int().min(0).max(5);
+var positiveFloatField = zod.z.number().positive();
+var nonNegativeFloatField = zod.z.number().min(0);
+var percentField = zod.z.number().min(0).max(100);
+var ratioField = zod.z.number().min(0).max(1);
+var latitudeField = zod.z.number().min(-90).max(90);
+var longitudeField = zod.z.number().min(-180).max(180);
+var nonEmptyStrField = zod.z.string().transform((value) => value.trim()).pipe(zod.z.string().min(1));
+var slugField = zod.z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, {
+  message: "Must be a lowercase hyphen-separated slug."
+});
+var hexColorField = zod.z.string().regex(/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/, {
+  message: "Must be a #rgb or #rrggbb hex color."
+});
+var priceField = zod.z.string().regex(/^\d+(?:\.\d{1,2})?$/, {
+  message: 'Must be a decimal money string, e.g. "19.90".'
+});
+
+// src/schemas/sync.ts
+var syncFilterSchema = zod.z.object({
+  since: zod.z.coerce.date().optional().openapi({
+    description: "High-water mark; only rows changed after this are returned."
+  }),
+  cursor: zod.z.string().optional().openapi({
+    description: "Opaque cursor from the previous page; omit for the first."
+  }),
+  limit: zod.z.coerce.number().int().min(1).max(1e3).default(100).openapi({ description: "Maximum number of items to return." }),
+  includeDeleted: zod.z.coerce.boolean().default(false).openapi({ description: "Whether soft-deleted rows are included in the delta." })
+});
+function syncPaginationSchema(item) {
+  return zod.z.object({
+    items: zod.z.array(item).openapi({ description: "Changed rows in this page." }),
+    nextCursor: zod.z.string().nullable().openapi({ description: "Cursor for the next page, or null when exhausted." }),
+    hasMore: zod.z.boolean().openapi({ description: "Whether another page is available." }),
+    limit: zod.z.number().int().min(1).openapi({ description: "The page size used." }),
+    serverTime: zod.z.coerce.date().openapi({
+      description: "Server instant to persist as the next `since` watermark."
+    })
+  });
+}
+
+// src/schemas/linkHeaders.ts
+function buildPaginationLinkHeader(options) {
+  const { baseUrl, page: page2, pageSize, pages } = options;
+  if (pages <= 0) return "";
+  const pageParam = options.pageParam ?? "page";
+  const sizeParam = options.sizeParam ?? "pageSize";
+  const [path, existingQuery = ""] = baseUrl.split("?", 2);
+  const params = new URLSearchParams(existingQuery);
+  for (const [key, value] of Object.entries(options.extraParams ?? {})) {
+    if (!params.has(key)) params.set(key, value);
+  }
+  const urlFor = (target) => {
+    const q = new URLSearchParams(params);
+    q.set(pageParam, String(target));
+    q.set(sizeParam, String(pageSize));
+    return `${path}?${q.toString()}`;
+  };
+  const parts = [
+    `<${urlFor(1)}>; rel="first"`,
+    `<${urlFor(pages)}>; rel="last"`
+  ];
+  if (page2 > 1) parts.push(`<${urlFor(page2 - 1)}>; rel="prev"`);
+  if (page2 < pages) parts.push(`<${urlFor(page2 + 1)}>; rel="next"`);
+  return parts.join(", ");
+}
+
+// src/schemas/logs.ts
+var logEntrySchema = zod.z.object({
+  timestamp: zod.z.string().openapi({ description: "ISO-8601 UTC timestamp of the record." }),
+  level: zod.z.string().openapi({ description: "Log level name (INFO, ERROR, \u2026)." }),
+  logger: zod.z.string().openapi({ description: "Name of the emitting logger." }),
+  message: zod.z.string().openapi({ description: "The formatted log message." }),
+  requestId: zod.z.string().nullable().optional().openapi({ description: "Correlation id, when present." }),
+  stack: zod.z.string().nullable().optional().openapi({
+    description: "Formatted stack trace, when the record carries an error."
+  })
+}).passthrough();
+
 // src/settings/base.ts
 var serverSettingsShape = {
   HOST: zod.z.string().default("127.0.0.1"),
@@ -370,6 +470,114 @@ var baseAppSettingsSchema = zod.z.object(baseAppSettingsShape);
 function loadSettings(schema, env = process.env) {
   return Object.freeze(schema.parse(env));
 }
+
+// src/settings/mixins.ts
+function envBoolean(defaultValue) {
+  return zod.z.union([zod.z.boolean(), zod.z.string()]).default(defaultValue).transform((value) => {
+    if (typeof value === "boolean") return value;
+    return ["true", "1", "yes", "on"].includes(value.trim().toLowerCase());
+  });
+}
+function envList(defaultValue = "") {
+  return zod.z.string().default(defaultValue).transform(
+    (value) => value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0)
+  );
+}
+var logSettingsShape = {
+  LOG_LEVEL: zod.z.enum(["DEBUG", "INFO", "WARNING", "ERROR"]).default("INFO"),
+  LOG_JSON: envBoolean(true),
+  LOG_DIR: zod.z.string().default("logs")
+};
+var redisSettingsShape = {
+  REDIS_URL: zod.z.string().default("redis://localhost:6379/0")
+};
+var rabbitmqSettingsShape = {
+  RABBITMQ_URL: zod.z.string().default("amqp://guest:guest@localhost:5672/"),
+  RABBITMQ_PREFETCH_COUNT: zod.z.coerce.number().int().min(1).default(10)
+};
+var jwtSettingsShape = {
+  JWT_SECRET: zod.z.string().default("change-me-change-me-change-me-32"),
+  JWT_ALGORITHM: zod.z.string().default("HS256"),
+  JWT_ACCESS_TTL_SECONDS: zod.z.coerce.number().int().min(1).default(3600),
+  JWT_REFRESH_TTL_SECONDS: zod.z.coerce.number().int().min(1).default(86400 * 7),
+  JWT_ISSUER: zod.z.string().optional()
+};
+var tokenSettingsShape = {
+  TOKEN_SECRET: zod.z.string().default("")
+};
+var emailSettingsShape = {
+  SMTP_HOST: zod.z.string().default("localhost"),
+  SMTP_PORT: zod.z.coerce.number().int().min(1).max(65535).default(587),
+  SMTP_USERNAME: zod.z.string().optional(),
+  SMTP_PASSWORD: zod.z.string().optional(),
+  SMTP_FROM_ADDR: zod.z.string().default("noreply@example.com"),
+  SMTP_USE_TLS: envBoolean(true),
+  SMTP_USE_SSL: envBoolean(false),
+  SMTP_TIMEOUT_SECONDS: zod.z.coerce.number().min(0).default(30)
+};
+var uploadSettingsShape = {
+  UPLOAD_DIR: zod.z.string().default("./var/uploads"),
+  UPLOAD_MAX_SIZE_BYTES: zod.z.coerce.number().int().min(0).default(10 * 1024 * 1024),
+  UPLOAD_ALLOWED_EXTENSIONS: envList(),
+  UPLOAD_ALLOWED_MIMETYPES: envList()
+};
+var minioSettingsShape = {
+  MINIO_ENDPOINT: zod.z.string().default("localhost:9000"),
+  MINIO_ACCESS_KEY: zod.z.string().default("minioadmin"),
+  MINIO_SECRET_KEY: zod.z.string().default("minioadmin"),
+  MINIO_SECURE: envBoolean(false),
+  MINIO_REGION: zod.z.string().default("us-east-1"),
+  MINIO_DEFAULT_BUCKET: zod.z.string().default("uploads"),
+  MINIO_PUBLIC_ENDPOINT: zod.z.string().optional(),
+  MINIO_PUBLIC_SECURE: zod.z.union([zod.z.boolean(), zod.z.string()]).optional().transform(
+    (value) => value === void 0 ? void 0 : typeof value === "boolean" ? value : ["true", "1", "yes", "on"].includes(value.trim().toLowerCase())
+  )
+};
+var webPushSettingsShape = {
+  VAPID_PUBLIC_KEY: zod.z.string().default(""),
+  VAPID_PRIVATE_KEY: zod.z.string().default(""),
+  VAPID_SUBJECT: zod.z.string().default("mailto:admin@example.com"),
+  WEBPUSH_DEFAULT_TTL_SECONDS: zod.z.coerce.number().int().min(0).default(86400)
+};
+var sessionSettingsShape = {
+  SESSION_TTL_SECONDS: zod.z.coerce.number().int().min(1).default(86400),
+  SESSION_SLIDING: envBoolean(true),
+  SESSION_COOKIE_NAME: zod.z.string().default("tempest_session"),
+  SESSION_COOKIE_DOMAIN: zod.z.string().optional(),
+  SESSION_COOKIE_PATH: zod.z.string().default("/"),
+  SESSION_COOKIE_SECURE: envBoolean(true),
+  SESSION_COOKIE_HTTPONLY: envBoolean(true),
+  SESSION_COOKIE_SAMESITE: zod.z.enum(["lax", "strict", "none"]).default("lax"),
+  SESSION_ROTATE_ON_LOGIN: envBoolean(true)
+};
+var webSocketSettingsShape = {
+  WS_HEARTBEAT_SECONDS: zod.z.coerce.number().int().min(1).default(30),
+  WS_HEARTBEAT_TIMEOUT_SECONDS: zod.z.coerce.number().int().min(1).default(60),
+  WS_MAX_CONNECTIONS_PER_USER: zod.z.coerce.number().int().min(1).default(5),
+  WS_MAX_MESSAGE_BYTES: zod.z.coerce.number().int().min(1).default(64 * 1024)
+};
+var authSettingsShape = {
+  AUTH_AUTO_ACTIVATE: envBoolean(false),
+  AUTH_RETURN_TOKEN_IN_RESPONSE: envBoolean(false),
+  AUTH_ACTIVATION_TTL_SECONDS: zod.z.coerce.number().int().min(1).default(86400 * 7),
+  AUTH_PASSWORD_RESET_TTL_SECONDS: zod.z.coerce.number().int().min(1).default(3600),
+  AUTH_ACTIVATION_URL_TEMPLATE: zod.z.string().default("http://localhost:3000/activate?token={token}"),
+  AUTH_PASSWORD_RESET_URL_TEMPLATE: zod.z.string().default("http://localhost:3000/reset-password?token={token}"),
+  AUTH_PASSWORD_MIN_LENGTH: zod.z.coerce.number().int().min(1).default(12),
+  AUTH_PASSWORD_REQUIRE_COMPLEXITY: envBoolean(false),
+  AUTH_DEFAULT_LOCALE: zod.z.string().default("pt-BR"),
+  AUTH_MFA_ENABLED: envBoolean(false),
+  AUTH_MFA_ISSUER: zod.z.string().default("Tempest"),
+  AUTH_MFA_RECOVERY_CODES_COUNT: zod.z.coerce.number().int().min(0).default(10),
+  AUTH_MFA_TOKEN_TTL_SECONDS: zod.z.coerce.number().int().min(1).default(300),
+  AUTH_MFA_VERIFY_WINDOW: zod.z.coerce.number().int().min(0).default(1),
+  AUTH_TOKEN_DELIVERY: zod.z.enum(["bearer", "cookie", "both"]).default("bearer"),
+  AUTH_COOKIE_SECURE: envBoolean(true),
+  AUTH_COOKIE_SAMESITE: zod.z.enum(["lax", "strict", "none"]).default("lax"),
+  AUTH_COOKIE_DOMAIN: zod.z.string().optional(),
+  AUTH_ACCESS_COOKIE_NAME: zod.z.string().default("access_token"),
+  AUTH_REFRESH_COOKIE_NAME: zod.z.string().default("refresh_token")
+};
 function toSnakeCase(name) {
   return name.replace(/(?<!^)(?=[A-Z])/g, "_").toLowerCase();
 }
@@ -395,6 +603,364 @@ function createdByColumn() {
 function updatedByColumn() {
   return tempestDbJs.column.uuid();
 }
+var BaseUserModel = class extends BaseModel {
+  /** Login identifier; enforce uniqueness with a unique index in a migration. */
+  email = tempestDbJs.column.varchar(320).notNull();
+  /** The password hash (never the plaintext) — see `PasswordUtils`. */
+  hashedPassword = tempestDbJs.column.text().notNull();
+  /** Whether the user has administrative privileges. */
+  isAdmin = tempestDbJs.column.boolean().notNull().default(false);
+  /** Timestamp of the last successful login, or `null` if never. */
+  lastLoginAt = tempestDbJs.column.datetime();
+};
+var UserTokenPurpose = {
+  ACTIVATION: "activation",
+  PASSWORD_RESET: "password_reset",
+  EMAIL_VERIFICATION: "email_verification",
+  EMAIL_CHANGE: "email_change"
+};
+var BaseUserTokenModel = class extends BaseModel {
+  /** Owning user id. */
+  userId = tempestDbJs.column.uuid().notNull();
+  /** Hash of the opaque token value. */
+  tokenHash = tempestDbJs.column.text().notNull();
+  /** Purpose discriminator (a {@link UserTokenPurpose} value). */
+  purpose = tempestDbJs.column.varchar(32).notNull();
+  /** When the token stops being valid. */
+  expiresAt = tempestDbJs.column.datetime().notNull();
+  /** When the token was consumed, or `null` while still usable. */
+  usedAt = tempestDbJs.column.datetime();
+  /** Optional JSON payload carried with the token (e.g. the pending email). */
+  payload = tempestDbJs.column.json();
+};
+var BaseUserRefreshTokenModel = class extends BaseModel {
+  /** Owning user id. */
+  userId = tempestDbJs.column.uuid().notNull();
+  /** Hash of the opaque refresh token. */
+  tokenHash = tempestDbJs.column.text().notNull();
+  /** Rotation family — all tokens descended from one login share it. */
+  familyId = tempestDbJs.column.uuid().notNull().default(tempestDbJs.sql.uuidv4());
+  /** When the token expires. */
+  expiresAt = tempestDbJs.column.datetime().notNull();
+  /** When the token was rotated/consumed, or `null`. */
+  usedAt = tempestDbJs.column.datetime();
+  /** When the token was revoked, or `null` while active. */
+  revokedAt = tempestDbJs.column.datetime();
+};
+var AuditAction = {
+  CREATE: "create",
+  UPDATE: "update",
+  DELETE: "delete"
+};
+function snapshot(row, exclude = []) {
+  const skip = new Set(exclude);
+  const out = {};
+  for (const [key, value] of Object.entries(row)) {
+    if (skip.has(key) || typeof value === "function") continue;
+    out[key] = value;
+  }
+  return out;
+}
+function diffSnapshots(before, after) {
+  const changed = {};
+  const keys = /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)]);
+  for (const key of keys) {
+    const oldValue = before[key];
+    const newValue = after[key];
+    if (!Object.is(oldValue, newValue) && JSON.stringify(oldValue) !== JSON.stringify(newValue)) {
+      changed[key] = { before: oldValue, after: newValue };
+    }
+  }
+  return changed;
+}
+var BaseAuditLogModel = class extends BaseModel {
+  /** Changed model name (e.g. `"UserModel"`). */
+  entity = tempestDbJs.column.varchar(128).notNull();
+  /** Changed row id, stored as text. */
+  entityId = tempestDbJs.column.varchar(64).notNull();
+  /** Mutation kind (an {@link AuditAction} value). */
+  action = tempestDbJs.column.varchar(16).notNull();
+  /** Who performed the change, or `null` for system/anonymous. */
+  actor = tempestDbJs.column.varchar(128);
+  /** Before/after diff, serialized as JSON. */
+  changes = tempestDbJs.column.json().notNull();
+  /** Optional extra metadata (request id, ip, reason, …). */
+  context = tempestDbJs.column.json();
+};
+var TenantScopedRepository = class extends tempestDbJs.BaseRepository {
+  tenantId;
+  tenantField;
+  modelClass;
+  /**
+   * @param model - The model class (must have the `tenantField` column).
+   * @param session - The async session.
+   * @param tenantId - The tenant every operation is scoped to.
+   * @param tenantField - Name of the tenant column. Default `"tenantId"`.
+   */
+  constructor(model, session, tenantId, tenantField = "tenantId") {
+    super(model, session);
+    this.modelClass = model;
+    this.tenantId = tenantId;
+    this.tenantField = tenantField;
+  }
+  /** Merge the tenant predicate into a filter object. */
+  scoped(filters) {
+    return { ...filters ?? {}, [this.tenantField]: this.tenantId };
+  }
+  /** Stamp the tenant id onto an insert payload. */
+  stamped(data) {
+    return { ...data, [this.tenantField]: this.tenantId };
+  }
+  list(filters) {
+    return super.list(this.scoped(filters));
+  }
+  first(filters) {
+    return super.first(this.scoped(filters));
+  }
+  exists(filters) {
+    return super.exists(this.scoped(filters));
+  }
+  count(filters) {
+    return super.count(this.scoped(filters));
+  }
+  /** Fetch by id **within the tenant**; throws `RecordNotFound` across tenants. */
+  async getById(id) {
+    const row = await super.first(this.scoped({ id }));
+    if (row === null) {
+      throw new tempestDbJs.RecordNotFound(
+        this.modelClass.tablename ?? "row",
+        id
+      );
+    }
+    return row;
+  }
+  getByIdOrNull(id) {
+    return super.first(this.scoped({ id }));
+  }
+  /** Insert one row; the tenant id is stamped for you (don't pass it). */
+  create(data) {
+    return super.create(this.stamped(data));
+  }
+  /** Insert many rows; the tenant id is stamped onto each. */
+  createMany(data) {
+    return super.createMany(
+      data.map((d) => this.stamped(d))
+    );
+  }
+  update(filters, set) {
+    const { [this.tenantField]: _drop, ...safeSet } = set;
+    return super.update(this.scoped(filters), safeSet);
+  }
+  delete(filters) {
+    return super.delete(this.scoped(filters));
+  }
+  paginate(filter = {}) {
+    return super.paginate({ ...filter, filters: this.scoped(filter.filters) });
+  }
+};
+var OutboxStatus = {
+  PENDING: "pending",
+  SENT: "sent",
+  FAILED: "failed"
+};
+var BaseOutboxModel = class extends BaseModel {
+  /** Destination topic / routing key. */
+  topic = tempestDbJs.column.varchar(255).notNull();
+  /** The event body, serialized as JSON. */
+  payload = tempestDbJs.column.json().notNull();
+  /** Delivery state (an {@link OutboxStatus} value). */
+  status = tempestDbJs.column.varchar(16).notNull().default(OutboxStatus.PENDING);
+  /** How many delivery attempts have been made. */
+  attempts = tempestDbJs.column.integer().notNull().default(0);
+  /** Give up (mark `failed`) after this many attempts. */
+  maxAttempts = tempestDbJs.column.integer().notNull().default(5);
+  /** Earliest time the row may be delivered (drives retry backoff). */
+  availableAt = tempestDbJs.column.datetime().notNull().default(tempestDbJs.sql.now());
+  /** When the row was successfully delivered, or `null`. */
+  sentAt = tempestDbJs.column.datetime();
+  /** The last delivery error message, or `null`. */
+  lastError = tempestDbJs.column.text();
+};
+var OutboxRelay = class {
+  /**
+   * @param repository - Repository over the outbox model.
+   * @param publish - Callback that delivers one event to the broker.
+   * @param options - Batch size and retry backoff.
+   */
+  constructor(repository, publish, options = {}) {
+    this.repository = repository;
+    this.publish = publish;
+    this.batchSize = options.batchSize ?? 100;
+    this.retryBackoffSeconds = options.retryBackoffSeconds ?? 30;
+  }
+  repository;
+  publish;
+  logger = new JSONLogger("tempest_express_sdk.db.outbox");
+  batchSize;
+  retryBackoffSeconds;
+  running = false;
+  /**
+   * Deliver one batch of due pending events.
+   *
+   * @param now - The current time (injectable for tests). Defaults to `new Date()`.
+   * @returns The number of events successfully delivered.
+   */
+  async drainOnce(now = /* @__PURE__ */ new Date()) {
+    const due = await this.repository.list({
+      status: OutboxStatus.PENDING,
+      availableAt: { lte: now }
+    });
+    let delivered = 0;
+    for (const event of due.slice(0, this.batchSize)) {
+      try {
+        await this.publish(
+          event.topic,
+          event.payload
+        );
+        await this.repository.update(
+          { id: event.id },
+          {
+            status: OutboxStatus.SENT,
+            sentAt: now,
+            lastError: null
+          }
+        );
+        delivered += 1;
+      } catch (error) {
+        await this.markFailure(event, error, now);
+      }
+    }
+    return delivered;
+  }
+  async markFailure(event, error, now) {
+    const attempts = event.attempts + 1;
+    const maxAttempts = event.maxAttempts;
+    const message = error instanceof Error ? error.message : String(error);
+    const exhausted = attempts >= maxAttempts;
+    const nextAvailable = new Date(
+      now.getTime() + attempts * this.retryBackoffSeconds * 1e3
+    );
+    await this.repository.update(
+      { id: event.id },
+      {
+        attempts,
+        status: exhausted ? OutboxStatus.FAILED : OutboxStatus.PENDING,
+        availableAt: exhausted ? event.availableAt : nextAvailable,
+        lastError: message
+      }
+    );
+    this.logger.warning("outbox delivery failed", {
+      id: String(event.id),
+      topic: String(event.topic),
+      attempts,
+      exhausted
+    });
+  }
+  /**
+   * Run `drainOnce` on an interval until {@link stop} is called.
+   *
+   * @param intervalMs - Delay between passes in milliseconds. Default `1000`.
+   */
+  async run(intervalMs = 1e3) {
+    this.running = true;
+    while (this.running) {
+      try {
+        await this.drainOnce();
+      } catch (error) {
+        this.logger.error("outbox relay pass failed", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+      await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    }
+  }
+  /** Stop the {@link run} loop after the current pass. */
+  stop() {
+    this.running = false;
+  }
+};
+
+// src/db/slowQuery.ts
+function wrapWithSlowQueryLog(driver, options = {}) {
+  const thresholdMs = options.thresholdMs ?? 500;
+  const level = options.level ?? "warning";
+  const logParameters = options.logParameters ?? false;
+  const logger4 = new JSONLogger(
+    options.loggerName ?? "tempest_express_sdk.db.slow_query"
+  );
+  const timed = (exec) => {
+    return async (sql5, params) => {
+      const start = process.hrtime.bigint();
+      try {
+        return await exec(sql5, params);
+      } finally {
+        const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
+        if (durationMs >= thresholdMs) {
+          logger4.log(level, "slow query", {
+            sql: sql5,
+            durationMs: Math.round(durationMs * 1e3) / 1e3,
+            ...logParameters ? { params } : {}
+          });
+        }
+      }
+    };
+  };
+  const wrapped = {
+    execute: timed(driver.execute.bind(driver)),
+    close: () => driver.close()
+  };
+  if (driver.iterate) {
+    wrapped.iterate = (sql5, params) => driver.iterate?.(sql5, params);
+  }
+  if (driver.reserve) {
+    wrapped.reserve = async () => {
+      const reserved = await driver.reserve?.();
+      if (!reserved) throw new Error("driver.reserve() returned nothing");
+      return {
+        execute: timed(reserved.execute.bind(reserved)),
+        close: () => reserved.close(),
+        release: () => reserved.release(),
+        ...reserved.iterate ? { iterate: (sql5, params) => reserved.iterate?.(sql5, params) } : {}
+      };
+    };
+  }
+  return wrapped;
+}
+function sqlitePath(url) {
+  const withoutScheme = url.replace(/^sqlite:\/\//, "");
+  if (withoutScheme === ":memory:" || withoutScheme === "") {
+    throw new Error("Cannot back up an in-memory SQLite database");
+  }
+  return withoutScheme.startsWith("/") ? withoutScheme : withoutScheme.replace(/^\.?\//, "./");
+}
+async function backupDatabase(databaseUrl, destPath, options = {}) {
+  const dialect = tempestDbJs.detectDialect(databaseUrl);
+  if (dialect === "sqlite") {
+    await promises.copyFile(sqlitePath(databaseUrl), destPath);
+    return destPath;
+  }
+  if (dialect === "postgresql") {
+    const bin = options.pgDumpPath ?? "pg_dump";
+    const args = [...options.pgDumpArgs ?? [], "-f", destPath, databaseUrl];
+    await runPgDump(bin, args);
+    return destPath;
+  }
+  throw new Error(`backupDatabase does not support the '${dialect}' dialect`);
+}
+function runPgDump(bin, args) {
+  return new Promise((resolve, reject) => {
+    const child = child_process.spawn(bin, args, { stdio: ["ignore", "ignore", "pipe"] });
+    let stderr = "";
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code === 0) resolve();
+      else reject(new Error(`pg_dump exited with code ${code}: ${stderr.trim()}`));
+    });
+  });
+}
 
 // src/services/base.ts
 var BaseService = class {
@@ -475,8 +1041,8 @@ var BaseService = class {
    * @returns The page envelope with mapped items.
    */
   async paginate(filter = {}) {
-    const page = await this.repository.paginate(filter);
-    return { ...page, items: await this.mapMany(page.items) };
+    const page2 = await this.repository.paginate(filter);
+    return { ...page2, items: await this.mapMany(page2.items) };
   }
 };
 
@@ -6767,6 +7333,133 @@ function getClientIp(req, options = {}) {
   }
   return req.socket?.remoteAddress ?? req.ip ?? UNKNOWN;
 }
+var LocalUploadStorage = class {
+  root;
+  baseUrl;
+  /**
+   * @param options - Filesystem root and public base URL.
+   */
+  constructor(options) {
+    this.root = options.root;
+    this.baseUrl = options.baseUrl ?? "";
+  }
+  async save(key, data, options = {}) {
+    const target = path.join(this.root, key);
+    await promises.mkdir(path.dirname(target), { recursive: true });
+    await promises.writeFile(target, data);
+    return {
+      key,
+      url: this.url(key),
+      size: data.byteLength,
+      ...options.contentType !== void 0 ? { contentType: options.contentType } : {}
+    };
+  }
+  async read(key) {
+    return promises.readFile(path.join(this.root, key));
+  }
+  async delete(key) {
+    await promises.rm(path.join(this.root, key), { force: true });
+  }
+  url(key) {
+    const base = this.baseUrl.replace(/\/$/, "");
+    return base ? `${base}/${key}` : `/${key}`;
+  }
+};
+function buildContentDisposition(filename, inline = false) {
+  const disposition = inline ? "inline" : "attachment";
+  const encoded = encodeURIComponent(filename);
+  return `${disposition}; filename*=UTF-8''${encoded}`;
+}
+
+// src/utils/download.ts
+function resolveDownloadPath(root, relativePath, subdir = "") {
+  const base = path.normalize(path.join(root, subdir));
+  const target = path.normalize(path.join(base, relativePath));
+  const rel = path.relative(base, target);
+  if (rel.startsWith("..") || path.isAbsolute(rel)) {
+    throw new Error("Resolved path escapes the download root");
+  }
+  return target;
+}
+function parseRange(header, size) {
+  if (!header) return null;
+  const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+  if (!match) return null;
+  const [, rawStart, rawEnd] = match;
+  if (rawStart === "" && rawEnd === "") return null;
+  let start;
+  let end;
+  if (rawStart === "") {
+    const suffix = Number(rawEnd);
+    start = Math.max(0, size - suffix);
+    end = size - 1;
+  } else {
+    start = Number(rawStart);
+    end = rawEnd === "" ? size - 1 : Math.min(Number(rawEnd), size - 1);
+  }
+  if (Number.isNaN(start) || Number.isNaN(end) || start > end || start >= size)
+    return null;
+  return { start, end };
+}
+async function sendFileDownload(req, res, absolutePath, options = {}) {
+  const info = await promises.stat(absolutePath);
+  const filename = options.filename ?? absolutePath.split(/[/\\]/).pop() ?? "download";
+  res.setHeader("Content-Type", options.contentType ?? "application/octet-stream");
+  res.setHeader("Content-Disposition", buildContentDisposition(filename, options.inline));
+  res.setHeader("Accept-Ranges", "bytes");
+  const range = parseRange(req.header("range"), info.size);
+  if (range) {
+    res.status(206);
+    res.setHeader("Content-Range", `bytes ${range.start}-${range.end}/${info.size}`);
+    res.setHeader("Content-Length", String(range.end - range.start + 1));
+    fs.createReadStream(absolutePath, { start: range.start, end: range.end }).pipe(res);
+    return;
+  }
+  res.status(200);
+  res.setHeader("Content-Length", String(info.size));
+  fs.createReadStream(absolutePath).pipe(res);
+}
+function sendBytesDownload(res, data, options = {}) {
+  const filename = options.filename ?? "download";
+  res.setHeader("Content-Type", options.contentType ?? "application/octet-stream");
+  res.setHeader("Content-Disposition", buildContentDisposition(filename, options.inline));
+  res.setHeader("Content-Length", String(data.byteLength));
+  res.status(200).end(Buffer.from(data));
+}
+var LEVEL_LOG_FILES = {
+  debug: "debug.log",
+  info: "info.log",
+  warning: "warning.log",
+  error: "error.log"
+};
+var HTTP_500_LOG_FILE = "500.log";
+function configureFileLogging(options) {
+  const { dir } = options;
+  fs.mkdirSync(dir, { recursive: true });
+  const streams = /* @__PURE__ */ new Map();
+  const streamFor = (filename) => {
+    let stream = streams.get(filename);
+    if (!stream) {
+      stream = fs.createWriteStream(path.join(dir, filename), { flags: "a" });
+      streams.set(filename, stream);
+    }
+    return stream;
+  };
+  const sink = (level, record) => {
+    const line = `${JSON.stringify(record)}
+`;
+    streamFor(LEVEL_LOG_FILES[level]).write(line);
+    if (record[HTTP_500_MARKER]) streamFor(HTTP_500_LOG_FILE).write(line);
+  };
+  const detach = addLogSink(sink);
+  return {
+    close() {
+      detach();
+      for (const stream of streams.values()) stream.end();
+      streams.clear();
+    }
+  };
+}
 var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
 function base32Encode(bytes) {
   let bits = 0;
@@ -7062,20 +7755,20 @@ async function readGpus() {
     return [];
   }
 }
-function toPrometheus(snapshot = readSystem(), gpus = []) {
+function toPrometheus(snapshot2 = readSystem(), gpus = []) {
   const lines = [
     "# HELP process_cpu_load_percent 1-minute load average as percent of cores",
     "# TYPE process_cpu_load_percent gauge",
-    `process_cpu_load_percent ${snapshot.cpu.loadPercent}`,
+    `process_cpu_load_percent ${snapshot2.cpu.loadPercent}`,
     "# HELP process_memory_used_percent System memory used percent",
     "# TYPE process_memory_used_percent gauge",
-    `process_memory_used_percent ${snapshot.memory.usedPercent}`,
+    `process_memory_used_percent ${snapshot2.memory.usedPercent}`,
     "# HELP process_memory_rss_bytes Resident set size of the process",
     "# TYPE process_memory_rss_bytes gauge",
-    `process_memory_rss_bytes ${snapshot.memory.processRss}`,
+    `process_memory_rss_bytes ${snapshot2.memory.processRss}`,
     "# HELP process_uptime_seconds Process uptime in seconds",
     "# TYPE process_uptime_seconds counter",
-    `process_uptime_seconds ${snapshot.uptimeSeconds}`
+    `process_uptime_seconds ${snapshot2.uptimeSeconds}`
   ];
   if (gpus.length > 0) {
     lines.push(
@@ -8116,43 +8809,76 @@ function makeFlagGuard(flags, flag) {
     }).catch(next);
   };
 }
-var LocalUploadStorage = class {
-  root;
-  baseUrl;
+
+// src/storage/s3.ts
+async function streamToBuffer(stream) {
+  const chunks = [];
+  for await (const chunk of stream) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks);
+}
+var S3UploadStorage = class {
+  bucket;
+  publicBaseUrl;
+  client;
+  options;
   /**
-   * @param options - Filesystem root and public base URL.
+   * @param options - Bucket, public URL and either a client or connection config.
    */
   constructor(options) {
-    this.root = options.root;
-    this.baseUrl = options.baseUrl ?? "";
+    this.bucket = options.bucket;
+    this.publicBaseUrl = options.publicBaseUrl ?? "";
+    this.client = options.client;
+    this.options = options;
+  }
+  /** Resolve the client, lazy-loading `minio` when one wasn't injected. */
+  async getClient() {
+    if (this.client) return this.client;
+    const specifier = "minio";
+    let mod;
+    try {
+      mod = await import(specifier);
+    } catch {
+      throw new Error(
+        "S3UploadStorage requires the 'minio' peer dependency. Install with `npm i minio`."
+      );
+    }
+    this.client = new mod.Client({
+      endPoint: this.options.endPoint,
+      port: this.options.port,
+      useSSL: this.options.useSSL,
+      accessKey: this.options.accessKey,
+      secretKey: this.options.secretKey,
+      region: this.options.region
+    });
+    return this.client;
   }
   async save(key, data, options = {}) {
-    const target = path.join(this.root, key);
-    await promises.mkdir(path.dirname(target), { recursive: true });
-    await promises.writeFile(target, data);
+    const client = await this.getClient();
+    const buffer = Buffer.from(data);
+    const metaData = options.contentType ? { "Content-Type": options.contentType } : void 0;
+    await client.putObject(this.bucket, key, buffer, buffer.byteLength, metaData);
     return {
       key,
       url: this.url(key),
-      size: data.byteLength,
+      size: buffer.byteLength,
       ...options.contentType !== void 0 ? { contentType: options.contentType } : {}
     };
   }
   async read(key) {
-    return promises.readFile(path.join(this.root, key));
+    const client = await this.getClient();
+    return streamToBuffer(await client.getObject(this.bucket, key));
   }
   async delete(key) {
-    await promises.rm(path.join(this.root, key), { force: true });
+    const client = await this.getClient();
+    await client.removeObject(this.bucket, key);
   }
   url(key) {
-    const base = this.baseUrl.replace(/\/$/, "");
-    return base ? `${base}/${key}` : `/${key}`;
+    const base = this.publicBaseUrl.replace(/\/$/, "");
+    return base ? `${base}/${this.bucket}/${key}` : `/${this.bucket}/${key}`;
   }
 };
-function buildContentDisposition(filename, inline = false) {
-  const disposition = inline ? "inline" : "attachment";
-  const encoded = encodeURIComponent(filename);
-  return `${disposition}; filename*=UTF-8''${encoded}`;
-}
 
 // src/webpush/schemas.ts
 var webPushKeysSchema = zod.z.object({
@@ -8628,29 +9354,112 @@ var EmailProvider = class {
   }
 };
 
-// src/admin/site.ts
-var AdminSite = class {
+// src/integrations/broadcast.ts
+async function pool(items, limit, worker) {
+  const results = new Array(items.length);
+  let cursor = 0;
+  const runners = Array.from({ length: Math.min(limit, items.length) }, async () => {
+    while (cursor < items.length) {
+      const index = cursor++;
+      results[index] = await worker(items[index], index);
+    }
+  });
+  await Promise.all(runners);
+  return results;
+}
+function broadcastText(provider, recipients, text, options = {}) {
+  const { concurrency = 10, ...sendOptions } = options;
+  return pool(recipients, concurrency, async (to) => {
+    try {
+      const result = await provider.sendText(to, text, sendOptions);
+      return { to, ok: true, result };
+    } catch (error) {
+      return {
+        to,
+        ok: false,
+        error: error instanceof Error ? error.message : String(error)
+      };
+    }
+  });
+}
+var MessagingHub = class {
+  channels = /* @__PURE__ */ new Map();
   /**
-   * @param brand - Display name surfaced under `GET {prefix}/`.
+   * Register a provider under a channel name.
+   *
+   * @param name - The channel name (e.g. `"whatsapp"`, `"sms"`).
+   * @param provider - The provider implementation.
+   * @returns The hub (chainable).
    */
-  constructor(brand = "Admin") {
-    this.brand = brand;
+  register(name, provider) {
+    this.channels.set(name, provider);
+    return this;
   }
-  brand;
-  resources = /* @__PURE__ */ new Map();
   /**
-   * Register a resource.
+   * Get a registered provider, throwing when the channel is unknown.
    *
-   * @param resource - The resource config.
-   * @returns The same resource (for chaining).
+   * @param name - The channel name.
+   * @returns The provider.
+   * @throws {Error} When no provider is registered under `name`.
    */
-  register(resource) {
-    this.resources.set(resource.name, resource);
-    return resource;
-  }
-  /** Look up a resource by slug, or `null`. */
   get(name) {
-    return this.resources.get(name) ?? null;
+    const provider = this.channels.get(name);
+    if (!provider) throw new Error(`Unknown messaging channel: ${name}`);
+    return provider;
+  }
+  /** The registered channel names. */
+  channelNames() {
+    return [...this.channels.keys()];
+  }
+  /**
+   * Send text through a named channel.
+   *
+   * @param channel - The channel name.
+   * @param to - The recipient.
+   * @param text - The message body.
+   * @param options - Send options.
+   * @returns The provider result.
+   */
+  send(channel, to, text, options) {
+    return this.get(channel).sendText(to, text, options);
+  }
+  /**
+   * Broadcast text to many recipients on a named channel.
+   *
+   * @param channel - The channel name.
+   * @param recipients - Recipient addresses/handles.
+   * @param text - The message body.
+   * @param options - Broadcast + send options.
+   * @returns One result per recipient.
+   */
+  broadcast(channel, recipients, text, options) {
+    return broadcastText(this.get(channel), recipients, text, options);
+  }
+};
+
+// src/admin/site.ts
+var AdminSite = class {
+  /**
+   * @param brand - Display name surfaced under `GET {prefix}/`.
+   */
+  constructor(brand = "Admin") {
+    this.brand = brand;
+  }
+  brand;
+  resources = /* @__PURE__ */ new Map();
+  /**
+   * Register a resource.
+   *
+   * @param resource - The resource config.
+   * @returns The same resource (for chaining).
+   */
+  register(resource) {
+    this.resources.set(resource.name, resource);
+    return resource;
+  }
+  /** Look up a resource by slug, or `null`. */
+  get(name) {
+    return this.resources.get(name) ?? null;
   }
   /** Every registered resource. */
   list() {
@@ -8698,12 +9507,12 @@ function makeAdminRouter(site, options = {}) {
     for (const [key, value] of Object.entries(req.query)) {
       if (!PAGINATION_KEYS2.has(key) && typeof value === "string") filters[key] = value;
     }
-    const page = Math.max(1, Number.parseInt(String(req.query.page ?? "1"), 10) || 1);
+    const page2 = Math.max(1, Number.parseInt(String(req.query.page ?? "1"), 10) || 1);
     const pageSize = Math.max(
       1,
       Number.parseInt(String(req.query.pageSize ?? "20"), 10) || 20
     );
-    res.json(await resource.list({ page, pageSize, filters }));
+    res.json(await resource.list({ page: page2, pageSize, filters }));
   });
   router.get(`${prefix}/:resource/:id`, async (req, res) => {
     const resource = requireResource(site, req.params.resource);
@@ -9260,12 +10069,62 @@ function makeAuthRouter(options) {
   }
   return router;
 }
+
+// src/auth/htmlPages.ts
+function esc(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+var STYLE = `
+  :root { color-scheme: light dark; }
+  body { font: 16px/1.5 system-ui, sans-serif; margin: 0; display: grid; min-height: 100vh; place-items: center; background: #f6f7f9; color: #1a1a1a; }
+  @media (prefers-color-scheme: dark) { body { background: #16181d; color: #e8e8e8; } .card { background: #1f2229 !important; } input { background: #16181d !important; color: inherit !important; border-color: #3a3f4b !important; } }
+  .card { background: #fff; max-width: 26rem; width: calc(100% - 3rem); padding: 2rem; border-radius: 14px; box-shadow: 0 6px 30px rgba(0,0,0,.08); text-align: center; }
+  h1 { font-size: 1.4rem; margin: 0 0 .5rem; }
+  p { margin: .25rem 0 1rem; opacity: .85; }
+  .ico { font-size: 2.5rem; }
+  a.btn, button.btn { display: inline-block; margin-top: .5rem; padding: .6rem 1.2rem; border-radius: 9px; border: 0; background: #4f46e5; color: #fff; text-decoration: none; font-weight: 600; cursor: pointer; }
+  form { text-align: left; margin-top: 1rem; }
+  label { display: block; font-size: .85rem; font-weight: 600; margin-bottom: .3rem; }
+  input { width: 100%; box-sizing: border-box; padding: .6rem .7rem; border: 1px solid #d0d3d9; border-radius: 9px; font: inherit; }
+`;
+function page(title, body) {
+  return `<!doctype html>
+<html lang="pt-BR">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${esc(title)}</title><style>${STYLE}</style></head>
+<body><main class="card">${body}</main></body>
+</html>`;
+}
+function renderAuthResultPage(options) {
+  const icon = options.ok ? "\u2705" : "\u26A0\uFE0F";
+  const cta = options.cta ? `<a class="btn" href="${esc(options.cta.href)}">${esc(options.cta.label)}</a>` : "";
+  return page(
+    options.title,
+    `<div class="ico">${icon}</div><h1>${esc(options.title)}</h1><p>${esc(options.message)}</p>${cta}`
+  );
+}
+function renderPasswordResetFormPage(options) {
+  const title = options.title ?? "Redefinir senha";
+  const tokenField = options.tokenField ?? "token";
+  const passwordField = options.passwordField ?? "password";
+  const submitLabel = options.submitLabel ?? "Redefinir senha";
+  return page(
+    title,
+    `<h1>${esc(title)}</h1>
+     <form method="post" action="${esc(options.action)}">
+       <input type="hidden" name="${esc(tokenField)}" value="${esc(options.token)}">
+       <label for="pw">Nova senha</label>
+       <input id="pw" type="password" name="${esc(passwordField)}" required minlength="8" autocomplete="new-password">
+       <button class="btn" type="submit" style="margin-top:1rem;width:100%">${esc(submitLabel)}</button>
+     </form>`
+  );
+}
 var logger2 = new JSONLogger("tempest_express_sdk.api.handlers");
 var REQUEST_ID_HEADER = "X-Request-ID";
+var VALID_REQUEST_ID = /^[A-Za-z0-9._\-:+/=]{1,128}$/;
 function requestIdMiddleware() {
   return (req, res, next) => {
     const inbound = req.header(REQUEST_ID_HEADER);
-    const requestId = inbound && inbound.length > 0 ? inbound : crypto.randomUUID();
+    const requestId = inbound && VALID_REQUEST_ID.test(inbound) ? inbound : crypto.randomUUID();
     res.setHeader(REQUEST_ID_HEADER, requestId);
     runWithRequestContext({ requestId }, () => next());
   };
@@ -9535,8 +10394,935 @@ function runServer(app, options = {}) {
   });
 }
 
+// src/api/middlewares/bodySize.ts
+function bodySizeLimitMiddleware(options) {
+  const { maxBytes } = options;
+  const excludePaths = options.excludePaths ?? [];
+  const reject = (res) => {
+    res.status(413).json({
+      detail: "Request body too large.",
+      code: "REQUEST_BODY_TOO_LARGE",
+      details: { maxBytes }
+    });
+  };
+  return (req, res, next) => {
+    if (maxBytes <= 0 || excludePaths.some((prefix) => req.path.startsWith(prefix))) {
+      next();
+      return;
+    }
+    const declared = Number.parseInt(req.header("content-length") ?? "", 10);
+    if (Number.isFinite(declared) && declared > maxBytes) {
+      reject(res);
+      return;
+    }
+    let seen = 0;
+    let aborted = false;
+    const onData = (chunk) => {
+      if (aborted) return;
+      seen += Buffer.byteLength(chunk);
+      if (seen > maxBytes) {
+        aborted = true;
+        req.removeListener("data", onData);
+        if (!res.headersSent) reject(res);
+        req.destroy();
+      }
+    };
+    req.on("data", onData);
+    req.on("end", () => req.removeListener("data", onData));
+    next();
+  };
+}
+var CSRF_COOKIE_NAME = "csrf_token";
+var CSRF_HEADER_NAME = "X-CSRF-Token";
+var UNSAFE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function generateCsrfToken(nBytes = 32) {
+  return crypto.randomBytes(nBytes).toString("base64url");
+}
+function readCookie(req, name) {
+  const parsed = req.cookies;
+  if (parsed && typeof parsed[name] === "string") return parsed[name];
+  const header = req.header("cookie");
+  if (!header) return void 0;
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1) continue;
+    if (part.slice(0, idx).trim() === name) return part.slice(idx + 1).trim();
+  }
+  return void 0;
+}
+function safeEqual2(a, b) {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+function csrfMiddleware(options = {}) {
+  const cookieName = options.cookieName ?? CSRF_COOKIE_NAME;
+  const headerName = options.headerName ?? CSRF_HEADER_NAME;
+  const excludePaths = options.excludePaths ?? [];
+  const reject = (res, message) => {
+    res.status(403).json({ detail: message, code: "CSRF_FAILED", details: {} });
+  };
+  return (req, res, next) => {
+    if (!UNSAFE_METHODS.has(req.method)) {
+      next();
+      return;
+    }
+    if (excludePaths.some((prefix) => req.path.startsWith(prefix))) {
+      next();
+      return;
+    }
+    const cookieToken = readCookie(req, cookieName);
+    const headerToken = req.header(headerName);
+    if (!cookieToken || !headerToken) {
+      reject(res, "CSRF token missing.");
+      return;
+    }
+    if (!safeEqual2(cookieToken, headerToken)) {
+      reject(res, "CSRF token mismatch.");
+      return;
+    }
+    next();
+  };
+}
+
+// src/api/middlewares/graceful.ts
+var GracefulShutdown = class {
+  drainTimeoutSeconds;
+  retryAfterSeconds;
+  exempt;
+  inFlightCount = 0;
+  draining = false;
+  idleResolvers = [];
+  constructor(options = {}) {
+    this.drainTimeoutSeconds = options.drainTimeoutSeconds ?? 30;
+    this.retryAfterSeconds = options.retryAfterSeconds ?? 5;
+    this.exempt = new Set(options.exemptPaths ?? []);
+  }
+  /** Number of requests currently being served. */
+  get inFlight() {
+    return this.inFlightCount;
+  }
+  /** Whether draining has begun. */
+  get isDraining() {
+    return this.draining;
+  }
+  /** The Express middleware: counts in-flight requests, 503s while draining. */
+  middleware() {
+    return (req, res, next) => {
+      if (this.draining && !this.exempt.has(req.path)) {
+        res.setHeader("Retry-After", String(this.retryAfterSeconds));
+        res.setHeader("Connection", "close");
+        res.status(503).json({
+          detail: "Server is shutting down.",
+          code: "SERVICE_UNAVAILABLE",
+          details: {}
+        });
+        return;
+      }
+      this.inFlightCount += 1;
+      let settled = false;
+      const settle = () => {
+        if (settled) return;
+        settled = true;
+        this.release();
+      };
+      res.on("finish", settle);
+      res.on("close", settle);
+      next();
+    };
+  }
+  release() {
+    this.inFlightCount -= 1;
+    if (this.inFlightCount === 0) {
+      const resolvers = this.idleResolvers;
+      this.idleResolvers = [];
+      for (const resolve of resolvers) resolve();
+    }
+  }
+  /** Flip into draining mode (idempotent). New non-exempt requests get 503. */
+  beginDrain() {
+    this.draining = true;
+  }
+  /**
+   * Wait until in-flight requests finish or the drain timeout elapses.
+   *
+   * @returns `true` if everything drained in time, `false` on timeout.
+   */
+  waitDrained() {
+    if (this.inFlightCount === 0) return Promise.resolve(true);
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        this.idleResolvers = this.idleResolvers.filter((r) => r !== onIdle);
+        resolve(false);
+      }, this.drainTimeoutSeconds * 1e3);
+      const onIdle = () => {
+        clearTimeout(timer);
+        resolve(true);
+      };
+      this.idleResolvers.push(onIdle);
+    });
+  }
+};
+
+// src/api/middlewares/idempotency.ts
+var IDEMPOTENCY_HEADER = "Idempotency-Key";
+var MUTATING_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var MemoryIdempotencyStore = class {
+  store = /* @__PURE__ */ new Map();
+  async get(key) {
+    const entry = this.store.get(key);
+    if (!entry) return null;
+    if (entry.expiresAt < Date.now()) {
+      this.store.delete(key);
+      return null;
+    }
+    return entry.response;
+  }
+  async set(key, response, ttlSeconds) {
+    this.store.set(key, { expiresAt: Date.now() + ttlSeconds * 1e3, response });
+  }
+};
+var RedisIdempotencyStore = class {
+  constructor(client, options = {}) {
+    this.client = client;
+    this.prefix = options.prefix ?? "idem:";
+  }
+  client;
+  prefix;
+  async get(key) {
+    const raw = await this.client.get(this.prefix + key);
+    return raw === null ? null : JSON.parse(raw);
+  }
+  async set(key, response, ttlSeconds) {
+    await this.client.set(this.prefix + key, JSON.stringify(response), {
+      EX: ttlSeconds
+    });
+  }
+};
+function idempotencyMiddleware(options) {
+  const { store } = options;
+  const ttlSeconds = options.ttlSeconds ?? 24 * 3600;
+  const headerName = options.headerName ?? IDEMPOTENCY_HEADER;
+  return (req, res, next) => {
+    if (!MUTATING_METHODS.has(req.method)) {
+      next();
+      return;
+    }
+    const rawKey = req.header(headerName);
+    if (!rawKey) {
+      next();
+      return;
+    }
+    const scoped = `${req.method}:${req.path}:${rawKey}`;
+    store.get(scoped).then((cached5) => {
+      if (cached5) {
+        for (const [name, value] of cached5.headers) res.setHeader(name, value);
+        res.setHeader("Idempotent-Replayed", "true");
+        if (cached5.contentType) res.type(cached5.contentType);
+        res.status(cached5.statusCode).send(cached5.body);
+        return;
+      }
+      captureAndForward(res, scoped, store, ttlSeconds);
+      next();
+    }).catch(next);
+  };
+}
+function captureAndForward(res, key, store, ttlSeconds) {
+  const originalSend = res.send.bind(res);
+  let capturedBody = "";
+  res.send = ((body) => {
+    if (typeof body === "string") capturedBody = body;
+    else if (body !== void 0) capturedBody = JSON.stringify(body);
+    return originalSend(body);
+  });
+  res.on("finish", () => {
+    if (res.statusCode < 200 || res.statusCode >= 300) return;
+    const contentType = res.getHeader("content-type");
+    void store.set(
+      key,
+      {
+        statusCode: res.statusCode,
+        headers: [],
+        body: capturedBody,
+        contentType: typeof contentType === "string" ? contentType : null
+      },
+      ttlSeconds
+    ).catch(() => {
+    });
+  });
+}
+
+// src/api/middlewares/prometheus.ts
+var DEFAULT_BUCKETS = [
+  5e-3,
+  0.01,
+  0.025,
+  0.05,
+  0.1,
+  0.25,
+  0.5,
+  1,
+  2.5,
+  5,
+  10
+];
+var HttpMetrics = class {
+  buckets;
+  /** `method|status` → count. */
+  requestTotals = /* @__PURE__ */ new Map();
+  /** `method|route` → histogram. */
+  durations = /* @__PURE__ */ new Map();
+  constructor(options = {}) {
+    this.buckets = [...options.buckets ?? DEFAULT_BUCKETS].sort((a, b) => a - b);
+  }
+  /**
+   * Record one completed request.
+   *
+   * @param method - HTTP method.
+   * @param route - The route pattern (or path) — keep cardinality bounded.
+   * @param status - Response status code.
+   * @param durationSeconds - Wall-clock request duration in seconds.
+   */
+  observe(method, route, status, durationSeconds) {
+    const totalKey = `${method}|${status}`;
+    this.requestTotals.set(totalKey, (this.requestTotals.get(totalKey) ?? 0) + 1);
+    const durKey = `${method}|${route}`;
+    let hist = this.durations.get(durKey);
+    if (!hist) {
+      hist = { bucketCounts: new Array(this.buckets.length).fill(0), sum: 0, count: 0 };
+      this.durations.set(durKey, hist);
+    }
+    hist.sum += durationSeconds;
+    hist.count += 1;
+    for (let i = 0; i < this.buckets.length; i += 1) {
+      const upper = this.buckets[i];
+      if (upper !== void 0 && durationSeconds <= upper) {
+        hist.bucketCounts[i] = (hist.bucketCounts[i] ?? 0) + 1;
+      }
+    }
+  }
+  /** Render the collected metrics as Prometheus exposition text. */
+  render() {
+    const lines = [];
+    lines.push("# HELP http_requests_total Total HTTP requests.");
+    lines.push("# TYPE http_requests_total counter");
+    for (const [key, value] of this.requestTotals) {
+      const [method = "", status = ""] = key.split("|");
+      lines.push(
+        `http_requests_total{method="${esc2(method)}",status="${esc2(status)}"} ${value}`
+      );
+    }
+    lines.push("# HELP http_request_duration_seconds HTTP request latency.");
+    lines.push("# TYPE http_request_duration_seconds histogram");
+    for (const [key, hist] of this.durations) {
+      const [method = "", route = ""] = key.split("|");
+      const labels = `method="${esc2(method)}",route="${esc2(route)}"`;
+      for (let i = 0; i < this.buckets.length; i += 1) {
+        lines.push(
+          `http_request_duration_seconds_bucket{${labels},le="${this.buckets[i]}"} ${hist.bucketCounts[i] ?? 0}`
+        );
+      }
+      lines.push(
+        `http_request_duration_seconds_bucket{${labels},le="+Inf"} ${hist.count}`
+      );
+      lines.push(`http_request_duration_seconds_sum{${labels}} ${hist.sum}`);
+      lines.push(`http_request_duration_seconds_count{${labels}} ${hist.count}`);
+    }
+    return `${lines.join("\n")}
+`;
+  }
+  /**
+   * Build the middleware that records each request into this collector.
+   *
+   * @param options - Optional exempt paths (e.g. the metrics route itself).
+   * @returns An Express middleware.
+   */
+  middleware(options = {}) {
+    const exempt = new Set(options.exemptPaths ?? []);
+    return (req, res, next) => {
+      if (exempt.has(req.path)) {
+        next();
+        return;
+      }
+      const start = process.hrtime.bigint();
+      res.on("finish", () => {
+        const durationSeconds = Number(process.hrtime.bigint() - start) / 1e9;
+        const route = req.route?.path ?? req.path;
+        this.observe(req.method, route, res.statusCode, durationSeconds);
+      });
+      next();
+    };
+  }
+};
+function esc2(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n");
+}
+function prometheusMiddleware(options = {}) {
+  const metrics = new HttpMetrics(
+    options.buckets !== void 0 ? { buckets: options.buckets } : {}
+  );
+  return {
+    metrics,
+    middleware: metrics.middleware(
+      options.exemptPaths !== void 0 ? { exemptPaths: options.exemptPaths } : {}
+    )
+  };
+}
+var MemoryRateLimitStore = class {
+  buckets = /* @__PURE__ */ new Map();
+  async hit(key, maxRequests, windowSeconds) {
+    const now = Date.now();
+    const windowMs = windowSeconds * 1e3;
+    const cutoff = now - windowMs;
+    const bucket = this.buckets.get(key) ?? [];
+    let start = 0;
+    while (start < bucket.length) {
+      const ts = bucket[start];
+      if (ts === void 0 || ts >= cutoff) break;
+      start += 1;
+    }
+    const live = start > 0 ? bucket.slice(start) : bucket;
+    if (live.length >= maxRequests) {
+      this.buckets.set(key, live);
+      const oldest = live[0] ?? now;
+      const retryAfter = Math.max(1, Math.ceil((oldest + windowMs - now) / 1e3));
+      return { allowed: false, remaining: 0, retryAfter };
+    }
+    live.push(now);
+    this.buckets.set(key, live);
+    return { allowed: true, remaining: maxRequests - live.length, retryAfter: 0 };
+  }
+};
+var SLIDING_WINDOW_LUA = `
+local key = KEYS[1]
+local now = tonumber(ARGV[1])
+local window = tonumber(ARGV[2])
+local limit = tonumber(ARGV[3])
+local member = ARGV[4]
+redis.call('ZREMRANGEBYSCORE', key, 0, now - window)
+local count = redis.call('ZCARD', key)
+if count < limit then
+  redis.call('ZADD', key, now, member)
+  redis.call('PEXPIRE', key, window)
+  return {1, limit - count - 1, 0}
+end
+local oldest = redis.call('ZRANGE', key, 0, 0, 'WITHSCORES')
+local retry = window
+if oldest[2] then
+  retry = (tonumber(oldest[2]) + window) - now
+end
+if retry < 1 then retry = 1 end
+return {0, 0, retry}
+`;
+var RedisRateLimitStore = class {
+  /**
+   * @param redis - Async Redis client exposing `eval({ keys, arguments })`.
+   * @param options - Key namespace and fail-open behavior.
+   */
+  constructor(redis, options = {}) {
+    this.redis = redis;
+    this.namespace = options.namespace ?? "ratelimit";
+    this.failOpen = options.failOpen ?? true;
+  }
+  redis;
+  namespace;
+  failOpen;
+  async hit(key, maxRequests, windowSeconds) {
+    const nowMs = Date.now();
+    const windowMs = Math.round(windowSeconds * 1e3);
+    const member = crypto.randomUUID();
+    try {
+      const raw = await this.redis.eval(SLIDING_WINDOW_LUA, {
+        keys: [`${this.namespace}:${key}`],
+        arguments: [String(nowMs), String(windowMs), String(maxRequests), member]
+      });
+      const [allowedFlag, remaining, retryMs] = raw;
+      const allowed = Boolean(allowedFlag);
+      return {
+        allowed,
+        remaining: Number(remaining),
+        retryAfter: allowed ? 0 : Math.max(1, Math.ceil(Number(retryMs) / 1e3))
+      };
+    } catch (error) {
+      if (this.failOpen) {
+        return { allowed: true, remaining: maxRequests - 1, retryAfter: 0 };
+      }
+      throw error;
+    }
+  }
+};
+function ipOpts(trustedHeader) {
+  return trustedHeader !== void 0 ? { trustedHeader } : {};
+}
+function bearerToken2(req) {
+  const header = req.header("authorization");
+  if (!header) return null;
+  const parts = header.split(/\s+/, 2);
+  const [scheme, token] = parts;
+  if (scheme?.toLowerCase() === "bearer" && token) return token.trim();
+  return null;
+}
+function keyByIp(options = {}) {
+  return (req) => `ip:${getClientIp(req, options)}`;
+}
+function keyByHeader(headerName, options = {}) {
+  const scope = options.scope ?? "key";
+  const fallbackToIp = options.fallbackToIp ?? true;
+  return (req) => {
+    const value = req.header(headerName);
+    if (value) return `${scope}:${value.trim()}`;
+    if (fallbackToIp) return `ip:${getClientIp(req, ipOpts(options.trustedIpHeader))}`;
+    return `${scope}:anonymous`;
+  };
+}
+function keyByJwtClaim(jwt, claim, options = {}) {
+  const label = options.scope ?? claim;
+  const fallbackToIp = options.fallbackToIp ?? true;
+  return async (req) => {
+    const token = bearerToken2(req);
+    if (token) {
+      try {
+        const claims = await jwt.decode(token);
+        const value = claims[claim];
+        if (value !== void 0 && value !== null) return `${label}:${String(value)}`;
+      } catch {
+      }
+    }
+    if (fallbackToIp) return `ip:${getClientIp(req, ipOpts(options.trustedIpHeader))}`;
+    return `${label}:anonymous`;
+  };
+}
+function keyByJwtSubject(jwt, options = {}) {
+  return keyByJwtClaim(jwt, "sub", { scope: "user", ...options });
+}
+function rateLimitMiddleware(options = {}) {
+  const maxRequests = options.maxRequests ?? 60;
+  const windowSeconds = options.windowSeconds ?? 60;
+  if (maxRequests < 1) throw new RangeError("maxRequests must be >= 1");
+  if (windowSeconds <= 0) throw new RangeError("windowSeconds must be > 0");
+  const store = options.store ?? new MemoryRateLimitStore();
+  const keyFunc = options.keyFunc ?? keyByIp(ipOpts(options.trustedIpHeader));
+  const exempt = new Set(options.exemptPaths ?? []);
+  const retryAfterHeader = options.retryAfterHeader ?? true;
+  const errorMessage = options.errorMessage ?? "Too many requests";
+  return (req, res, next) => {
+    if (exempt.has(req.path)) {
+      next();
+      return;
+    }
+    Promise.resolve(keyFunc(req)).then((key) => store.hit(key, maxRequests, windowSeconds)).then((result) => {
+      res.setHeader("X-RateLimit-Limit", String(maxRequests));
+      res.setHeader("X-RateLimit-Remaining", String(Math.max(0, result.remaining)));
+      if (!result.allowed) {
+        if (retryAfterHeader) res.setHeader("Retry-After", String(result.retryAfter));
+        res.status(429).json({
+          detail: errorMessage,
+          code: "TOO_MANY_REQUESTS",
+          details: { retryAfterSeconds: result.retryAfter }
+        });
+        return;
+      }
+      next();
+    }).catch(next);
+  };
+}
+
+// src/api/middlewares/tracing.ts
+function requestTracingMiddleware(options = {}) {
+  const logger4 = new JSONLogger(options.loggerName ?? "tempest_express_sdk.api.tracing");
+  const level = options.level ?? "info";
+  const exempt = new Set(options.exemptPaths ?? []);
+  return (req, res, next) => {
+    if (exempt.has(req.path)) {
+      next();
+      return;
+    }
+    const start = process.hrtime.bigint();
+    res.on("finish", () => {
+      const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
+      logger4.log(level, "request", {
+        method: req.method,
+        path: req.path,
+        statusCode: res.statusCode,
+        durationMs: Math.round(durationMs * 1e3) / 1e3,
+        requestId: getRequestId()
+      });
+    });
+    next();
+  };
+}
+var OAuthError = class extends AppException {
+  static statusCode = 502;
+  static code = "OAUTH_ERROR";
+};
+function generateOAuthState(nBytes = 32) {
+  return crypto.randomBytes(nBytes).toString("base64url");
+}
+var BaseOAuthClient = class {
+  clientId;
+  clientSecret;
+  redirectUri;
+  scopes;
+  http;
+  constructor(options) {
+    this.clientId = options.clientId;
+    this.clientSecret = options.clientSecret;
+    this.redirectUri = options.redirectUri;
+    this.scopes = options.scopes ?? this.defaultScopes();
+    this.http = options.httpClient ?? new HTTPClient({ timeoutMs: 1e4 });
+  }
+  defaultScopes() {
+    return [];
+  }
+  /** The provider's userinfo endpoint, or `null` when unavailable. */
+  userinfoUrl() {
+    return null;
+  }
+  /**
+   * Build the fully-formed authorize URL to redirect the user to.
+   *
+   * @param state - A value from {@link generateOAuthState}, saved server-side.
+   * @param extra - Extra query params (e.g. `{ access_type: "offline" }`).
+   * @returns The authorize URL.
+   */
+  buildAuthorizeUrl(state, extra = {}) {
+    const params = new URLSearchParams({
+      client_id: this.clientId,
+      redirect_uri: this.redirectUri,
+      response_type: "code",
+      scope: this.scopes.join(" "),
+      state,
+      ...extra
+    });
+    return `${this.authorizeUrl()}?${params.toString()}`;
+  }
+  /**
+   * Exchange an authorization code for tokens.
+   *
+   * @param code - The `code` query param from the callback.
+   * @returns The parsed token bundle.
+   * @throws {OAuthError} When the provider rejects the exchange.
+   */
+  async exchangeCode(code) {
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: this.redirectUri,
+      client_id: this.clientId,
+      client_secret: this.clientSecret
+    });
+    const response = await this.http.request("POST", this.tokenUrl(), {
+      body: body.toString(),
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json"
+      }
+    });
+    if (response.status >= 400) {
+      throw new OAuthError({
+        message: `token exchange failed (${response.status})`,
+        details: { body: await safeText(response) }
+      });
+    }
+    const payload = await response.json();
+    return {
+      accessToken: String(payload.access_token),
+      tokenType: payload.token_type ?? "Bearer",
+      refreshToken: payload.refresh_token ?? null,
+      idToken: payload.id_token ?? null,
+      expiresIn: payload.expires_in ?? null,
+      scope: payload.scope ?? null,
+      raw: payload
+    };
+  }
+  /**
+   * Fetch the normalized user identity for a token bundle.
+   *
+   * @param tokens - The tokens from {@link exchangeCode}.
+   * @returns The normalized user.
+   * @throws {OAuthError} When userinfo is unconfigured or the call fails.
+   */
+  async fetchUser(tokens) {
+    const url = this.userinfoUrl();
+    if (url === null) {
+      throw new OAuthError({
+        message: `${this.providerName}: userinfo endpoint not configured`
+      });
+    }
+    const response = await this.http.request("GET", url, {
+      headers: {
+        authorization: `${tokens.tokenType} ${tokens.accessToken}`,
+        accept: "application/json",
+        "user-agent": "tempest-express-sdk"
+      }
+    });
+    if (response.status >= 400) {
+      throw new OAuthError({
+        message: `userinfo failed (${response.status})`,
+        details: { body: await safeText(response) }
+      });
+    }
+    return this.parseUser(await response.json());
+  }
+};
+async function safeText(response) {
+  try {
+    return await response.text();
+  } catch {
+    return "";
+  }
+}
+var GoogleOAuthClient = class extends BaseOAuthClient {
+  providerName = "google";
+  defaultScopes() {
+    return ["openid", "email", "profile"];
+  }
+  authorizeUrl() {
+    return "https://accounts.google.com/o/oauth2/v2/auth";
+  }
+  tokenUrl() {
+    return "https://oauth2.googleapis.com/token";
+  }
+  userinfoUrl() {
+    return "https://openidconnect.googleapis.com/v1/userinfo";
+  }
+  parseUser(payload) {
+    return {
+      provider: this.providerName,
+      subject: String(payload.sub),
+      email: payload.email ?? null,
+      name: payload.name ?? null,
+      picture: payload.picture ?? null,
+      raw: payload
+    };
+  }
+};
+var GitHubOAuthClient = class extends BaseOAuthClient {
+  providerName = "github";
+  defaultScopes() {
+    return ["read:user", "user:email"];
+  }
+  authorizeUrl() {
+    return "https://github.com/login/oauth/authorize";
+  }
+  tokenUrl() {
+    return "https://github.com/login/oauth/access_token";
+  }
+  userinfoUrl() {
+    return "https://api.github.com/user";
+  }
+  parseUser(payload) {
+    return {
+      provider: this.providerName,
+      subject: String(payload.id),
+      email: payload.email ?? null,
+      name: payload.name ?? payload.login ?? null,
+      picture: payload.avatar_url ?? null,
+      raw: payload
+    };
+  }
+};
+var OIDCProvider = class extends BaseOAuthClient {
+  providerName;
+  _authorizeUrl;
+  _tokenUrl;
+  _userinfoUrl;
+  constructor(options) {
+    super(options);
+    this.providerName = options.providerName ?? "oidc";
+    this._authorizeUrl = options.authorizeUrl;
+    this._tokenUrl = options.tokenUrl;
+    this._userinfoUrl = options.userinfoUrl ?? null;
+  }
+  defaultScopes() {
+    return ["openid", "email", "profile"];
+  }
+  authorizeUrl() {
+    return this._authorizeUrl;
+  }
+  tokenUrl() {
+    return this._tokenUrl;
+  }
+  userinfoUrl() {
+    return this._userinfoUrl;
+  }
+  parseUser(payload) {
+    return {
+      provider: this.providerName,
+      subject: String(payload.sub ?? payload.id),
+      email: payload.email ?? null,
+      name: payload.name ?? null,
+      picture: payload.picture ?? null,
+      raw: payload
+    };
+  }
+};
+var WebhookSignatureVerifier = class {
+  secret;
+  algorithm;
+  headerName;
+  encoding;
+  prefix;
+  /**
+   * @param secret - The shared signing secret.
+   * @param options - Algorithm, header name, encoding and optional prefix.
+   */
+  constructor(secret, options = {}) {
+    this.secret = secret;
+    this.algorithm = options.algorithm ?? "sha256";
+    this.headerName = options.headerName ?? "X-Signature";
+    this.encoding = options.encoding ?? "hex";
+    this.prefix = options.prefix ?? "";
+  }
+  /** The header name this verifier reads. */
+  get header() {
+    return this.headerName;
+  }
+  /**
+   * Compute the expected signature for a raw body.
+   *
+   * @param body - The raw request body.
+   * @returns The signature in the configured encoding.
+   */
+  expected(body) {
+    return crypto.createHmac(this.algorithm, this.secret).update(body).digest(this.encoding);
+  }
+  /**
+   * Verify a signature against a raw body (constant time).
+   *
+   * @param body - The raw request body.
+   * @param signature - The header value (including any configured prefix).
+   * @returns `true` when it matches.
+   */
+  verify(body, signature) {
+    let candidate = signature;
+    if (this.prefix && candidate.startsWith(this.prefix)) {
+      candidate = candidate.slice(this.prefix.length);
+    }
+    const expected = Buffer.from(this.expected(body));
+    const provided = Buffer.from(candidate);
+    if (expected.length !== provided.length) return false;
+    return crypto.timingSafeEqual(expected, provided);
+  }
+  /**
+   * Build an Express middleware that rejects requests with a bad signature.
+   *
+   * The route **must** receive the raw body as a `Buffer` — mount
+   * `express.raw({ type: "..." })` (matching every content type) before this
+   * middleware so `req.body` is the raw bytes. On success the request proceeds
+   * (parse `req.body` yourself).
+   *
+   * @param options - Custom error message.
+   * @returns An Express middleware.
+   */
+  middleware(options = {}) {
+    const errorMessage = options.errorMessage ?? "Invalid webhook signature";
+    return (req, res, next) => {
+      const signature = req.header(this.headerName) ?? "";
+      const body = Buffer.isBuffer(req.body) ? req.body : Buffer.from(typeof req.body === "string" ? req.body : "");
+      if (!signature || !this.verify(body, signature)) {
+        res.status(401).json({ detail: errorMessage, code: "UNAUTHORIZED", details: {} });
+        return;
+      }
+      next();
+    };
+  }
+};
+function makeToolSpecRouter(spec, options = {}) {
+  const router = express2.Router();
+  const path = options.path ?? "/tool-spec";
+  router.get(path, (_req, res, next) => {
+    Promise.resolve(typeof spec === "function" ? spec() : spec).then((result) => res.json(result)).catch(next);
+  });
+  return router;
+}
+function filesFor(dir, source) {
+  if (source === "500") return [path.join(dir, HTTP_500_LOG_FILE)];
+  if (source === "all") return Object.values(LEVEL_LOG_FILES).map((f) => path.join(dir, f));
+  return [path.join(dir, LEVEL_LOG_FILES[source])];
+}
+async function readEntries(files) {
+  const entries = [];
+  for (const file of files) {
+    let content;
+    try {
+      content = await promises.readFile(file, "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of content.split("\n")) {
+      if (!line.trim()) continue;
+      try {
+        entries.push(JSON.parse(line));
+      } catch {
+      }
+    }
+  }
+  return entries;
+}
+function makeLogsRouter(options) {
+  const router = express2.Router();
+  const path = options.path ?? "/logs";
+  const guards = options.guards ?? [];
+  const handler = (req, res, next) => {
+    const source = req.query.source ?? "all";
+    const validSources = ["all", "debug", "info", "warning", "error", "500"];
+    if (!validSources.includes(source)) {
+      res.status(422).json({ detail: "Invalid log source", code: "VALIDATION_ERROR", details: {} });
+      return;
+    }
+    const page2 = Math.max(1, Number(req.query.page) || 1);
+    const pageSize = Math.min(500, Math.max(1, Number(req.query.pageSize) || 50));
+    readEntries(filesFor(options.dir, source)).then((entries) => {
+      entries.reverse();
+      const total = entries.length;
+      const start = (page2 - 1) * pageSize;
+      res.json({
+        items: entries.slice(start, start + pageSize),
+        total,
+        page: page2,
+        pageSize,
+        pages: Math.ceil(total / pageSize)
+      });
+    }).catch(next);
+  };
+  router.get(path, ...guards, handler);
+  return router;
+}
+function createTestDatabase(models) {
+  const driver = tempestDbJs.NodeSqliteDriver.open(":memory:");
+  for (const model of models) {
+    const table = migrations.reflectTable(model);
+    for (const statement of migrations.renderOperation({ kind: "create_table", table }, "sqlite")) {
+      driver.execute(statement, []);
+    }
+  }
+  const asyncDriver = {
+    execute: (sql5, params) => Promise.resolve(driver.execute(sql5, params)),
+    close: () => {
+      driver.close();
+      return Promise.resolve();
+    }
+  };
+  const engine = new tempestDbJs.AsyncEngine(asyncDriver, "sqlite");
+  return {
+    engine,
+    session: () => engine.session(),
+    close: () => engine.close()
+  };
+}
+async function withTestDatabase(models, fn) {
+  const db = createTestDatabase(models);
+  try {
+    return await fn(db);
+  } finally {
+    await db.close();
+  }
+}
+
 // src/version.ts
-var VERSION = "0.10.0";
+var VERSION = "0.20.0";
 
 Object.defineProperty(exports, "OpenAPIRegistry", {
   enumerable: true,
@@ -9694,12 +11480,21 @@ exports.ActivationService = ActivationService;
 exports.AdminSite = AdminSite;
 exports.AppException = AppException;
 exports.AttemptThrottle = AttemptThrottle;
+exports.AuditAction = AuditAction;
+exports.BaseAuditLogModel = BaseAuditLogModel;
 exports.BaseController = BaseController;
 exports.BaseModel = BaseModel;
+exports.BaseOAuthClient = BaseOAuthClient;
+exports.BaseOutboxModel = BaseOutboxModel;
 exports.BaseService = BaseService;
+exports.BaseUserModel = BaseUserModel;
+exports.BaseUserRefreshTokenModel = BaseUserRefreshTokenModel;
+exports.BaseUserTokenModel = BaseUserTokenModel;
 exports.CEP_PATTERN = CEP_PATTERN;
 exports.CNPJ_PATTERN = CNPJ_PATTERN;
 exports.CPF_PATTERN = CPF_PATTERN;
+exports.CSRF_COOKIE_NAME = CSRF_COOKIE_NAME;
+exports.CSRF_HEADER_NAME = CSRF_HEADER_NAME;
 exports.CircuitOpenError = CircuitOpenError;
 exports.CompositeFeatureFlagBackend = CompositeFeatureFlagBackend;
 exports.ConflictException = ConflictException;
@@ -9711,69 +11506,99 @@ exports.EventStream = EventStream;
 exports.ExpiredTokenException = ExpiredTokenException;
 exports.FeatureFlags = FeatureFlags;
 exports.ForbiddenException = ForbiddenException;
+exports.GitHubOAuthClient = GitHubOAuthClient;
+exports.GoogleOAuthClient = GoogleOAuthClient;
+exports.GracefulShutdown = GracefulShutdown;
 exports.HTTPClient = HTTPClient;
+exports.HTTP_500_LOG_FILE = HTTP_500_LOG_FILE;
 exports.HTTP_500_MARKER = HTTP_500_MARKER;
+exports.HttpMetrics = HttpMetrics;
+exports.IDEMPOTENCY_HEADER = IDEMPOTENCY_HEADER;
 exports.InvalidTokenException = InvalidTokenException;
 exports.JSONLogger = JSONLogger;
 exports.JWTUtils = JWTUtils;
+exports.LEVEL_LOG_FILES = LEVEL_LOG_FILES;
 exports.LocalUploadStorage = LocalUploadStorage;
 exports.MemoryBroker = MemoryBroker;
 exports.MemoryCacheManager = MemoryCacheManager;
 exports.MemoryFeatureFlagBackend = MemoryFeatureFlagBackend;
+exports.MemoryIdempotencyStore = MemoryIdempotencyStore;
+exports.MemoryRateLimitStore = MemoryRateLimitStore;
 exports.MemorySessionStore = MemorySessionStore;
 exports.MemoryThrottleBackend = MemoryThrottleBackend;
 exports.MessageCatalog = MessageCatalog;
+exports.MessagingHub = MessagingHub;
 exports.MetricsUtils = MetricsUtils;
 exports.MfaService = MfaService;
 exports.NotFoundException = NotFoundException;
+exports.OAuthError = OAuthError;
+exports.OIDCProvider = OIDCProvider;
+exports.OutboxRelay = OutboxRelay;
+exports.OutboxStatus = OutboxStatus;
 exports.PHONE_BR_PATTERN = PHONE_BR_PATTERN;
 exports.PasswordResetService = PasswordResetService;
 exports.PasswordUtils = PasswordUtils;
 exports.REQUEST_ID_HEADER = REQUEST_ID_HEADER;
 exports.RabbitBroker = RabbitBroker;
 exports.RedisCacheManager = RedisCacheManager;
+exports.RedisIdempotencyStore = RedisIdempotencyStore;
+exports.RedisRateLimitStore = RedisRateLimitStore;
 exports.RedisSSEBroker = RedisSSEBroker;
 exports.RedisSessionStore = RedisSessionStore;
 exports.Region = Region;
 exports.RetryPolicy = RetryPolicy;
+exports.S3UploadStorage = S3UploadStorage;
 exports.SSEBroker = SSEBroker;
 exports.ServerSentEvent = ServerSentEvent;
 exports.SessionService = SessionService;
 exports.TOTPHelper = TOTPHelper;
 exports.TaskManager = TaskManager;
 exports.TelegramProvider = TelegramProvider;
+exports.TenantScopedRepository = TenantScopedRepository;
 exports.TooManyRequestsException = TooManyRequestsException;
 exports.TwilioSmsProvider = TwilioSmsProvider;
 exports.UF = UF;
 exports.UnauthorizedException = UnauthorizedException;
 exports.UserAuthService = UserAuthService;
+exports.UserTokenPurpose = UserTokenPurpose;
 exports.VERSION = VERSION;
 exports.ValidationException = ValidationException;
 exports.WebPushDispatcher = WebPushDispatcher;
 exports.WebPushError = WebPushError;
 exports.WebPushGoneError = WebPushGoneError;
 exports.WebSocketHub = WebSocketHub;
+exports.WebhookSignatureVerifier = WebhookSignatureVerifier;
 exports.WhatsAppProvider = WhatsAppProvider;
 exports.activationSchema = activationSchema;
+exports.addLogSink = addLogSink;
 exports.attachWebSocketHub = attachWebSocketHub;
 exports.authResponseSchema = authResponseSchema;
+exports.authSettingsShape = authSettingsShape;
+exports.backupDatabase = backupDatabase;
 exports.baseAppSettingsSchema = baseAppSettingsSchema;
 exports.baseAppSettingsShape = baseAppSettingsShape;
 exports.baseResponseSchema = baseResponseSchema;
 exports.bearerToken = bearerToken;
+exports.bodySizeLimitMiddleware = bodySizeLimitMiddleware;
+exports.broadcastText = broadcastText;
 exports.buildContentDisposition = buildContentDisposition;
+exports.buildPaginationLinkHeader = buildPaginationLinkHeader;
 exports.cached = cached3;
+exports.centsField = centsField;
 exports.cepField = cepField;
 exports.citiesByUf = citiesByUf;
 exports.cnpjField = cnpjField;
 exports.coerceFlag = coerceFlag;
+exports.configureFileLogging = configureFileLogging;
 exports.configureLogging = configureLogging;
 exports.corsSettingsShape = corsSettingsShape;
 exports.cpfField = cpfField;
 exports.cpfOrCnpjField = cpfOrCnpjField;
 exports.createApp = createApp;
 exports.createOpenApiRegistry = createOpenApiRegistry;
+exports.createTestDatabase = createTestDatabase;
 exports.createdByColumn = createdByColumn;
+exports.csrfMiddleware = csrfMiddleware;
 exports.cursorPaginationFilterSchema = cursorPaginationFilterSchema;
 exports.cursorPaginationSchema = cursorPaginationSchema;
 exports.databaseSettingsShape = databaseSettingsShape;
@@ -9781,7 +11606,13 @@ exports.decodeCursor = decodeCursor;
 exports.defaultMessageCatalog = defaultMessageCatalog;
 exports.defineEnum = defineEnum;
 exports.deletedAtColumn = deletedAtColumn;
+exports.diffSnapshots = diffSnapshots;
+exports.emailSettingsShape = emailSettingsShape;
 exports.encodeCursor = encodeCursor;
+exports.envBoolean = envBoolean;
+exports.envList = envList;
+exports.generateCsrfToken = generateCsrfToken;
+exports.generateOAuthState = generateOAuthState;
 exports.generateOpaqueToken = generateOpaqueToken;
 exports.generateOpenApiDocument = generateOpenApiDocument;
 exports.getAuth = getAuth;
@@ -9791,6 +11622,8 @@ exports.getPaginationConditions = getPaginationConditions;
 exports.getRequestId = getRequestId;
 exports.getState = getState;
 exports.hashOpaqueToken = hashOpaqueToken;
+exports.hexColorField = hexColorField;
+exports.idempotencyMiddleware = idempotencyMiddleware;
 exports.inboundMessageSchema = inboundMessageSchema;
 exports.isValidCep = isValidCep;
 exports.isValidCity = isValidCity;
@@ -9799,27 +11632,42 @@ exports.isValidCpf = isValidCpf;
 exports.isValidCpfCnpj = isValidCpfCnpj;
 exports.isValidPhoneBr = isValidPhoneBr;
 exports.isValidUf = isValidUf;
+exports.jwtSettingsShape = jwtSettingsShape;
+exports.keyByHeader = keyByHeader;
+exports.keyByIp = keyByIp;
+exports.keyByJwtClaim = keyByJwtClaim;
+exports.keyByJwtSubject = keyByJwtSubject;
+exports.latitudeField = latitudeField;
 exports.listStates = listStates;
 exports.loadSettings = loadSettings;
+exports.logEntrySchema = logEntrySchema;
+exports.logSettingsShape = logSettingsShape;
 exports.loginSchema = loginSchema;
+exports.longitudeField = longitudeField;
 exports.makeAdminRouter = makeAdminRouter;
 exports.makeAppExceptionHandler = makeAppExceptionHandler;
 exports.makeAuthRouter = makeAuthRouter;
 exports.makeFlagGuard = makeFlagGuard;
 exports.makeHealthRouter = makeHealthRouter;
 exports.makeJwtAuthMiddleware = makeJwtAuthMiddleware;
+exports.makeLogsRouter = makeLogsRouter;
 exports.makeMetricsRouter = makeMetricsRouter;
 exports.makeSessionMiddleware = makeSessionMiddleware;
+exports.makeToolSpecRouter = makeToolSpecRouter;
 exports.makeTwilioWebhookRouter = makeTwilioWebhookRouter;
 exports.makeUnhandledExceptionHandler = makeUnhandledExceptionHandler;
 exports.makeWhatsAppWebhookRouter = makeWhatsAppWebhookRouter;
 exports.mfaChallengeSchema = mfaChallengeSchema;
 exports.mfaCodeSchema = mfaCodeSchema;
 exports.mfaEnrollResponseSchema = mfaEnrollResponseSchema;
+exports.minioSettingsShape = minioSettingsShape;
 exports.modifyDict = modifyDict;
 exports.mountOpenApiJson = mountOpenApiJson;
 exports.mountRedoc = mountRedoc;
 exports.mountSwaggerUi = mountSwaggerUi;
+exports.nonEmptyStrField = nonEmptyStrField;
+exports.nonNegativeFloatField = nonNegativeFloatField;
+exports.nonNegativeIntField = nonNegativeIntField;
 exports.normalizeCep = normalizeCep;
 exports.normalizeCnpj = normalizeCnpj;
 exports.normalizeCpf = normalizeCpf;
@@ -9834,33 +11682,61 @@ exports.parseAcceptLanguage = parseAcceptLanguage;
 exports.parseCookies = parseCookies;
 exports.passwordResetConfirmSchema = passwordResetConfirmSchema;
 exports.passwordResetRequestSchema = passwordResetRequestSchema;
+exports.percentField = percentField;
 exports.phoneBrField = phoneBrField;
+exports.portField = portField;
+exports.positiveFloatField = positiveFloatField;
+exports.positiveIntField = positiveIntField;
+exports.priceField = priceField;
+exports.prometheusMiddleware = prometheusMiddleware;
+exports.rabbitmqSettingsShape = rabbitmqSettingsShape;
+exports.rateLimitMiddleware = rateLimitMiddleware;
+exports.ratingField = ratingField;
+exports.ratioField = ratioField;
+exports.redisSettingsShape = redisSettingsShape;
 exports.refreshSchema = refreshSchema;
 exports.registerExceptionHandlers = registerExceptionHandlers;
+exports.renderAuthResultPage = renderAuthResultPage;
+exports.renderPasswordResetFormPage = renderPasswordResetFormPage;
 exports.requestIdMiddleware = requestIdMiddleware;
+exports.requestTracingMiddleware = requestTracingMiddleware;
 exports.requireRoles = requireRoles;
+exports.resolveDownloadPath = resolveDownloadPath;
 exports.runServer = runServer;
 exports.runWithRequestContext = runWithRequestContext;
+exports.sendBytesDownload = sendBytesDownload;
+exports.sendFileDownload = sendFileDownload;
 exports.serverSettingsShape = serverSettingsShape;
 exports.sessionCookie = sessionCookie;
+exports.sessionSettingsShape = sessionSettingsShape;
 exports.setRequestId = setRequestId;
 exports.signupSchema = signupSchema;
+exports.slugField = slugField;
+exports.snapshot = snapshot;
 exports.sseResponse = sseResponse;
 exports.statesByRegion = statesByRegion;
+exports.syncFilterSchema = syncFilterSchema;
+exports.syncPaginationSchema = syncPaginationSchema;
 exports.tableNameFor = tableNameFor;
 exports.toDict = toDict;
 exports.toUtc = toUtc;
 exports.tokenFromUrl = tokenFromUrl;
 exports.tokenPairSchema = tokenPairSchema;
+exports.tokenSettingsShape = tokenSettingsShape;
 exports.ufField = ufField;
 exports.updatedByColumn = updatedByColumn;
+exports.uploadSettingsShape = uploadSettingsShape;
 exports.userPublicSchema = userPublicSchema;
 exports.utcnow = utcnow;
 exports.validateTwilioSignature = validateTwilioSignature;
 exports.verifyOpaqueToken = verifyOpaqueToken;
 exports.webPushKeysSchema = webPushKeysSchema;
 exports.webPushPayloadSchema = webPushPayloadSchema;
+exports.webPushSettingsShape = webPushSettingsShape;
 exports.webPushSubscriptionSchema = webPushSubscriptionSchema;
+exports.webSocketSettingsShape = webSocketSettingsShape;
+exports.withTestDatabase = withTestDatabase;
+exports.wrapWithSlowQueryLog = wrapWithSlowQueryLog;
 exports.wsEnvelopeSchema = wsEnvelopeSchema;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map