tempest-express-sdk 0.11.0 → 0.20.0

package/dist/index.js

@@ -1,19 +1,21 @@
-export { VERSION } from './chunk-IHO6X75J.js';
+import { z, toDict } from './chunk-2OYRCWG5.js';
+export { PasswordUtils, VERSION, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, corsSettingsShape, databaseSettingsShape, loadSettings, serverSettingsShape, toDict, z } from './chunk-2OYRCWG5.js';
 import { AsyncLocalStorage } from 'async_hooks';
-import { extendZodWithOpenApi, OpenAPIRegistry, OpenApiGeneratorV31, OpenApiGeneratorV3 } from '@asteasolutions/zod-to-openapi';
-export { OpenAPIRegistry } from '@asteasolutions/zod-to-openapi';
-import { z, ZodError } from 'zod';
-export { z } from 'zod';
-import { Model, column, sql } from 'tempest-db-js';
+import { Model, column, sql, BaseRepository, RecordNotFound, detectDialect, NodeSqliteDriver, AsyncEngine } from 'tempest-db-js';
 export { AsyncEngine, AsyncResult, AsyncSession, BaseRepository, Column, DeleteBuilder, InsertBuilder, Model, NoResultError, NodeSqliteDriver, PostgresDialect, RecordNotFound, SelectBuilder, SqliteDialect, SyncEngine, SyncSession, UpdateBuilder, and, belongsTo, column, columnsOf, createEngine, createSyncEngine, del, detectDialect, getDialect, hasMany, insert, join, loadRelations, not, or, parseDatabaseUrl, select, sql, update } from 'tempest-db-js';
+import { execFile, spawn } from 'child_process';
+import { copyFile, mkdir, writeFile, readFile, rm, stat } from 'fs/promises';
 import { createHash, randomBytes, timingSafeEqual, randomUUID, createHmac } from 'crypto';
-import { execFile } from 'child_process';
+import { createReadStream, mkdirSync, createWriteStream } from 'fs';
+import { join, dirname, normalize, relative, isAbsolute } from 'path';
 import { cpus, loadavg, totalmem, freemem } from 'os';
 import { promisify } from 'util';
-import { mkdir, writeFile, readFile, rm } from 'fs/promises';
-import { join, dirname } from 'path';
 import express2, { Router } from 'express';
+import { ZodError } from 'zod';
+import { OpenAPIRegistry, OpenApiGeneratorV31, OpenApiGeneratorV3 } from '@asteasolutions/zod-to-openapi';
+export { OpenAPIRegistry } from '@asteasolutions/zod-to-openapi';
 import { getAbsoluteFSPath } from 'swagger-ui-dist';
+import { reflectTable, renderOperation } from 'tempest-db-js/migrations';
 
 var storage = new AsyncLocalStorage();
 function runWithRequestContext(context, fn) {
@@ -35,6 +37,14 @@ var LEVEL_ORDER = {
   warning: 30,
   error: 40
 };
+var sinks = [];
+function addLogSink(sink) {
+  sinks.push(sink);
+  return () => {
+    const index = sinks.indexOf(sink);
+    if (index !== -1) sinks.splice(index, 1);
+  };
+}
 var JSONLogger = class {
   /**
    * @param name - Logger name embedded in every record.
@@ -83,6 +93,12 @@ var JSONLogger = class {
 `);
     else process.stdout.write(`${line}
 `);
+    for (const sink of sinks) {
+      try {
+        sink(level, record);
+      } catch {
+      }
+    }
   }
 };
 function configureLogging(name, level = "info") {
@@ -264,23 +280,6 @@ var MessageCatalog = class {
 function defaultMessageCatalog() {
   return new MessageCatalog();
 }
-extendZodWithOpenApi(z);
-function toDict(data, options = {}) {
-  const exclude = new Set(options.exclude ?? []);
-  const out = {};
-  for (const [key, value] of Object.entries(data)) {
-    if (exclude.has(key)) continue;
-    if (value === null || value === void 0) continue;
-    out[key] = value;
-  }
-  return { ...out, ...options.include ?? {} };
-}
-var baseResponseSchema = z.object({
-  id: z.string().uuid().openapi({ description: "The unique identifier of the record." }),
-  isActive: z.boolean().openapi({ description: "Whether the record is active (soft-delete flag)." }),
-  createdAt: z.coerce.date().openapi({ description: "The creation timestamp of the record (UTC)." }),
-  updatedAt: z.coerce.date().openapi({ description: "The last update timestamp of the record (UTC)." })
-});
 
 // src/schemas/pagination.ts
 var paginationFilterSchema = z.object({
@@ -344,29 +343,197 @@ function decodeCursor(cursor) {
   return parsed;
 }
 
-// src/settings/base.ts
-var serverSettingsShape = {
-  HOST: z.string().default("127.0.0.1"),
-  PORT: z.coerce.number().int().min(0).max(65535).default(8e3),
-  DEBUG: z.coerce.boolean().default(false)
+// src/schemas/fields.ts
+var positiveIntField = z.number().int().positive();
+var nonNegativeIntField = z.number().int().min(0);
+var centsField = z.number().int().min(0);
+var portField = z.number().int().min(1).max(65535);
+var ratingField = z.number().int().min(0).max(5);
+var positiveFloatField = z.number().positive();
+var nonNegativeFloatField = z.number().min(0);
+var percentField = z.number().min(0).max(100);
+var ratioField = z.number().min(0).max(1);
+var latitudeField = z.number().min(-90).max(90);
+var longitudeField = z.number().min(-180).max(180);
+var nonEmptyStrField = z.string().transform((value) => value.trim()).pipe(z.string().min(1));
+var slugField = z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, {
+  message: "Must be a lowercase hyphen-separated slug."
+});
+var hexColorField = z.string().regex(/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/, {
+  message: "Must be a #rgb or #rrggbb hex color."
+});
+var priceField = z.string().regex(/^\d+(?:\.\d{1,2})?$/, {
+  message: 'Must be a decimal money string, e.g. "19.90".'
+});
+
+// src/schemas/sync.ts
+var syncFilterSchema = z.object({
+  since: z.coerce.date().optional().openapi({
+    description: "High-water mark; only rows changed after this are returned."
+  }),
+  cursor: z.string().optional().openapi({
+    description: "Opaque cursor from the previous page; omit for the first."
+  }),
+  limit: z.coerce.number().int().min(1).max(1e3).default(100).openapi({ description: "Maximum number of items to return." }),
+  includeDeleted: z.coerce.boolean().default(false).openapi({ description: "Whether soft-deleted rows are included in the delta." })
+});
+function syncPaginationSchema(item) {
+  return z.object({
+    items: z.array(item).openapi({ description: "Changed rows in this page." }),
+    nextCursor: z.string().nullable().openapi({ description: "Cursor for the next page, or null when exhausted." }),
+    hasMore: z.boolean().openapi({ description: "Whether another page is available." }),
+    limit: z.number().int().min(1).openapi({ description: "The page size used." }),
+    serverTime: z.coerce.date().openapi({
+      description: "Server instant to persist as the next `since` watermark."
+    })
+  });
+}
+
+// src/schemas/linkHeaders.ts
+function buildPaginationLinkHeader(options) {
+  const { baseUrl, page: page2, pageSize, pages } = options;
+  if (pages <= 0) return "";
+  const pageParam = options.pageParam ?? "page";
+  const sizeParam = options.sizeParam ?? "pageSize";
+  const [path, existingQuery = ""] = baseUrl.split("?", 2);
+  const params = new URLSearchParams(existingQuery);
+  for (const [key, value] of Object.entries(options.extraParams ?? {})) {
+    if (!params.has(key)) params.set(key, value);
+  }
+  const urlFor = (target) => {
+    const q = new URLSearchParams(params);
+    q.set(pageParam, String(target));
+    q.set(sizeParam, String(pageSize));
+    return `${path}?${q.toString()}`;
+  };
+  const parts = [
+    `<${urlFor(1)}>; rel="first"`,
+    `<${urlFor(pages)}>; rel="last"`
+  ];
+  if (page2 > 1) parts.push(`<${urlFor(page2 - 1)}>; rel="prev"`);
+  if (page2 < pages) parts.push(`<${urlFor(page2 + 1)}>; rel="next"`);
+  return parts.join(", ");
+}
+
+// src/schemas/logs.ts
+var logEntrySchema = z.object({
+  timestamp: z.string().openapi({ description: "ISO-8601 UTC timestamp of the record." }),
+  level: z.string().openapi({ description: "Log level name (INFO, ERROR, \u2026)." }),
+  logger: z.string().openapi({ description: "Name of the emitting logger." }),
+  message: z.string().openapi({ description: "The formatted log message." }),
+  requestId: z.string().nullable().optional().openapi({ description: "Correlation id, when present." }),
+  stack: z.string().nullable().optional().openapi({
+    description: "Formatted stack trace, when the record carries an error."
+  })
+}).passthrough();
+
+// src/settings/mixins.ts
+function envBoolean(defaultValue) {
+  return z.union([z.boolean(), z.string()]).default(defaultValue).transform((value) => {
+    if (typeof value === "boolean") return value;
+    return ["true", "1", "yes", "on"].includes(value.trim().toLowerCase());
+  });
+}
+function envList(defaultValue = "") {
+  return z.string().default(defaultValue).transform(
+    (value) => value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0)
+  );
+}
+var logSettingsShape = {
+  LOG_LEVEL: z.enum(["DEBUG", "INFO", "WARNING", "ERROR"]).default("INFO"),
+  LOG_JSON: envBoolean(true),
+  LOG_DIR: z.string().default("logs")
+};
+var redisSettingsShape = {
+  REDIS_URL: z.string().default("redis://localhost:6379/0")
+};
+var rabbitmqSettingsShape = {
+  RABBITMQ_URL: z.string().default("amqp://guest:guest@localhost:5672/"),
+  RABBITMQ_PREFETCH_COUNT: z.coerce.number().int().min(1).default(10)
+};
+var jwtSettingsShape = {
+  JWT_SECRET: z.string().default("change-me-change-me-change-me-32"),
+  JWT_ALGORITHM: z.string().default("HS256"),
+  JWT_ACCESS_TTL_SECONDS: z.coerce.number().int().min(1).default(3600),
+  JWT_REFRESH_TTL_SECONDS: z.coerce.number().int().min(1).default(86400 * 7),
+  JWT_ISSUER: z.string().optional()
+};
+var tokenSettingsShape = {
+  TOKEN_SECRET: z.string().default("")
+};
+var emailSettingsShape = {
+  SMTP_HOST: z.string().default("localhost"),
+  SMTP_PORT: z.coerce.number().int().min(1).max(65535).default(587),
+  SMTP_USERNAME: z.string().optional(),
+  SMTP_PASSWORD: z.string().optional(),
+  SMTP_FROM_ADDR: z.string().default("noreply@example.com"),
+  SMTP_USE_TLS: envBoolean(true),
+  SMTP_USE_SSL: envBoolean(false),
+  SMTP_TIMEOUT_SECONDS: z.coerce.number().min(0).default(30)
 };
-var databaseSettingsShape = {
-  DATABASE_URL: z.string().default("sqlite://./app.db")
+var uploadSettingsShape = {
+  UPLOAD_DIR: z.string().default("./var/uploads"),
+  UPLOAD_MAX_SIZE_BYTES: z.coerce.number().int().min(0).default(10 * 1024 * 1024),
+  UPLOAD_ALLOWED_EXTENSIONS: envList(),
+  UPLOAD_ALLOWED_MIMETYPES: envList()
 };
-var corsSettingsShape = {
-  CORS_ORIGINS: z.string().default("*").transform(
-    (value) => value.split(",").map((origin) => origin.trim()).filter((origin) => origin.length > 0)
+var minioSettingsShape = {
+  MINIO_ENDPOINT: z.string().default("localhost:9000"),
+  MINIO_ACCESS_KEY: z.string().default("minioadmin"),
+  MINIO_SECRET_KEY: z.string().default("minioadmin"),
+  MINIO_SECURE: envBoolean(false),
+  MINIO_REGION: z.string().default("us-east-1"),
+  MINIO_DEFAULT_BUCKET: z.string().default("uploads"),
+  MINIO_PUBLIC_ENDPOINT: z.string().optional(),
+  MINIO_PUBLIC_SECURE: z.union([z.boolean(), z.string()]).optional().transform(
+    (value) => value === void 0 ? void 0 : typeof value === "boolean" ? value : ["true", "1", "yes", "on"].includes(value.trim().toLowerCase())
   )
 };
-var baseAppSettingsShape = {
-  ...serverSettingsShape,
-  ...databaseSettingsShape,
-  ...corsSettingsShape
+var webPushSettingsShape = {
+  VAPID_PUBLIC_KEY: z.string().default(""),
+  VAPID_PRIVATE_KEY: z.string().default(""),
+  VAPID_SUBJECT: z.string().default("mailto:admin@example.com"),
+  WEBPUSH_DEFAULT_TTL_SECONDS: z.coerce.number().int().min(0).default(86400)
+};
+var sessionSettingsShape = {
+  SESSION_TTL_SECONDS: z.coerce.number().int().min(1).default(86400),
+  SESSION_SLIDING: envBoolean(true),
+  SESSION_COOKIE_NAME: z.string().default("tempest_session"),
+  SESSION_COOKIE_DOMAIN: z.string().optional(),
+  SESSION_COOKIE_PATH: z.string().default("/"),
+  SESSION_COOKIE_SECURE: envBoolean(true),
+  SESSION_COOKIE_HTTPONLY: envBoolean(true),
+  SESSION_COOKIE_SAMESITE: z.enum(["lax", "strict", "none"]).default("lax"),
+  SESSION_ROTATE_ON_LOGIN: envBoolean(true)
+};
+var webSocketSettingsShape = {
+  WS_HEARTBEAT_SECONDS: z.coerce.number().int().min(1).default(30),
+  WS_HEARTBEAT_TIMEOUT_SECONDS: z.coerce.number().int().min(1).default(60),
+  WS_MAX_CONNECTIONS_PER_USER: z.coerce.number().int().min(1).default(5),
+  WS_MAX_MESSAGE_BYTES: z.coerce.number().int().min(1).default(64 * 1024)
+};
+var authSettingsShape = {
+  AUTH_AUTO_ACTIVATE: envBoolean(false),
+  AUTH_RETURN_TOKEN_IN_RESPONSE: envBoolean(false),
+  AUTH_ACTIVATION_TTL_SECONDS: z.coerce.number().int().min(1).default(86400 * 7),
+  AUTH_PASSWORD_RESET_TTL_SECONDS: z.coerce.number().int().min(1).default(3600),
+  AUTH_ACTIVATION_URL_TEMPLATE: z.string().default("http://localhost:3000/activate?token={token}"),
+  AUTH_PASSWORD_RESET_URL_TEMPLATE: z.string().default("http://localhost:3000/reset-password?token={token}"),
+  AUTH_PASSWORD_MIN_LENGTH: z.coerce.number().int().min(1).default(12),
+  AUTH_PASSWORD_REQUIRE_COMPLEXITY: envBoolean(false),
+  AUTH_DEFAULT_LOCALE: z.string().default("pt-BR"),
+  AUTH_MFA_ENABLED: envBoolean(false),
+  AUTH_MFA_ISSUER: z.string().default("Tempest"),
+  AUTH_MFA_RECOVERY_CODES_COUNT: z.coerce.number().int().min(0).default(10),
+  AUTH_MFA_TOKEN_TTL_SECONDS: z.coerce.number().int().min(1).default(300),
+  AUTH_MFA_VERIFY_WINDOW: z.coerce.number().int().min(0).default(1),
+  AUTH_TOKEN_DELIVERY: z.enum(["bearer", "cookie", "both"]).default("bearer"),
+  AUTH_COOKIE_SECURE: envBoolean(true),
+  AUTH_COOKIE_SAMESITE: z.enum(["lax", "strict", "none"]).default("lax"),
+  AUTH_COOKIE_DOMAIN: z.string().optional(),
+  AUTH_ACCESS_COOKIE_NAME: z.string().default("access_token"),
+  AUTH_REFRESH_COOKIE_NAME: z.string().default("refresh_token")
 };
-var baseAppSettingsSchema = z.object(baseAppSettingsShape);
-function loadSettings(schema, env = process.env) {
-  return Object.freeze(schema.parse(env));
-}
 function toSnakeCase(name) {
   return name.replace(/(?<!^)(?=[A-Z])/g, "_").toLowerCase();
 }
@@ -392,6 +559,364 @@ function createdByColumn() {
 function updatedByColumn() {
   return column.uuid();
 }
+var BaseUserModel = class extends BaseModel {
+  /** Login identifier; enforce uniqueness with a unique index in a migration. */
+  email = column.varchar(320).notNull();
+  /** The password hash (never the plaintext) — see `PasswordUtils`. */
+  hashedPassword = column.text().notNull();
+  /** Whether the user has administrative privileges. */
+  isAdmin = column.boolean().notNull().default(false);
+  /** Timestamp of the last successful login, or `null` if never. */
+  lastLoginAt = column.datetime();
+};
+var UserTokenPurpose = {
+  ACTIVATION: "activation",
+  PASSWORD_RESET: "password_reset",
+  EMAIL_VERIFICATION: "email_verification",
+  EMAIL_CHANGE: "email_change"
+};
+var BaseUserTokenModel = class extends BaseModel {
+  /** Owning user id. */
+  userId = column.uuid().notNull();
+  /** Hash of the opaque token value. */
+  tokenHash = column.text().notNull();
+  /** Purpose discriminator (a {@link UserTokenPurpose} value). */
+  purpose = column.varchar(32).notNull();
+  /** When the token stops being valid. */
+  expiresAt = column.datetime().notNull();
+  /** When the token was consumed, or `null` while still usable. */
+  usedAt = column.datetime();
+  /** Optional JSON payload carried with the token (e.g. the pending email). */
+  payload = column.json();
+};
+var BaseUserRefreshTokenModel = class extends BaseModel {
+  /** Owning user id. */
+  userId = column.uuid().notNull();
+  /** Hash of the opaque refresh token. */
+  tokenHash = column.text().notNull();
+  /** Rotation family — all tokens descended from one login share it. */
+  familyId = column.uuid().notNull().default(sql.uuidv4());
+  /** When the token expires. */
+  expiresAt = column.datetime().notNull();
+  /** When the token was rotated/consumed, or `null`. */
+  usedAt = column.datetime();
+  /** When the token was revoked, or `null` while active. */
+  revokedAt = column.datetime();
+};
+var AuditAction = {
+  CREATE: "create",
+  UPDATE: "update",
+  DELETE: "delete"
+};
+function snapshot(row, exclude = []) {
+  const skip = new Set(exclude);
+  const out = {};
+  for (const [key, value] of Object.entries(row)) {
+    if (skip.has(key) || typeof value === "function") continue;
+    out[key] = value;
+  }
+  return out;
+}
+function diffSnapshots(before, after) {
+  const changed = {};
+  const keys = /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)]);
+  for (const key of keys) {
+    const oldValue = before[key];
+    const newValue = after[key];
+    if (!Object.is(oldValue, newValue) && JSON.stringify(oldValue) !== JSON.stringify(newValue)) {
+      changed[key] = { before: oldValue, after: newValue };
+    }
+  }
+  return changed;
+}
+var BaseAuditLogModel = class extends BaseModel {
+  /** Changed model name (e.g. `"UserModel"`). */
+  entity = column.varchar(128).notNull();
+  /** Changed row id, stored as text. */
+  entityId = column.varchar(64).notNull();
+  /** Mutation kind (an {@link AuditAction} value). */
+  action = column.varchar(16).notNull();
+  /** Who performed the change, or `null` for system/anonymous. */
+  actor = column.varchar(128);
+  /** Before/after diff, serialized as JSON. */
+  changes = column.json().notNull();
+  /** Optional extra metadata (request id, ip, reason, …). */
+  context = column.json();
+};
+var TenantScopedRepository = class extends BaseRepository {
+  tenantId;
+  tenantField;
+  modelClass;
+  /**
+   * @param model - The model class (must have the `tenantField` column).
+   * @param session - The async session.
+   * @param tenantId - The tenant every operation is scoped to.
+   * @param tenantField - Name of the tenant column. Default `"tenantId"`.
+   */
+  constructor(model, session, tenantId, tenantField = "tenantId") {
+    super(model, session);
+    this.modelClass = model;
+    this.tenantId = tenantId;
+    this.tenantField = tenantField;
+  }
+  /** Merge the tenant predicate into a filter object. */
+  scoped(filters) {
+    return { ...filters ?? {}, [this.tenantField]: this.tenantId };
+  }
+  /** Stamp the tenant id onto an insert payload. */
+  stamped(data) {
+    return { ...data, [this.tenantField]: this.tenantId };
+  }
+  list(filters) {
+    return super.list(this.scoped(filters));
+  }
+  first(filters) {
+    return super.first(this.scoped(filters));
+  }
+  exists(filters) {
+    return super.exists(this.scoped(filters));
+  }
+  count(filters) {
+    return super.count(this.scoped(filters));
+  }
+  /** Fetch by id **within the tenant**; throws `RecordNotFound` across tenants. */
+  async getById(id) {
+    const row = await super.first(this.scoped({ id }));
+    if (row === null) {
+      throw new RecordNotFound(
+        this.modelClass.tablename ?? "row",
+        id
+      );
+    }
+    return row;
+  }
+  getByIdOrNull(id) {
+    return super.first(this.scoped({ id }));
+  }
+  /** Insert one row; the tenant id is stamped for you (don't pass it). */
+  create(data) {
+    return super.create(this.stamped(data));
+  }
+  /** Insert many rows; the tenant id is stamped onto each. */
+  createMany(data) {
+    return super.createMany(
+      data.map((d) => this.stamped(d))
+    );
+  }
+  update(filters, set) {
+    const { [this.tenantField]: _drop, ...safeSet } = set;
+    return super.update(this.scoped(filters), safeSet);
+  }
+  delete(filters) {
+    return super.delete(this.scoped(filters));
+  }
+  paginate(filter = {}) {
+    return super.paginate({ ...filter, filters: this.scoped(filter.filters) });
+  }
+};
+var OutboxStatus = {
+  PENDING: "pending",
+  SENT: "sent",
+  FAILED: "failed"
+};
+var BaseOutboxModel = class extends BaseModel {
+  /** Destination topic / routing key. */
+  topic = column.varchar(255).notNull();
+  /** The event body, serialized as JSON. */
+  payload = column.json().notNull();
+  /** Delivery state (an {@link OutboxStatus} value). */
+  status = column.varchar(16).notNull().default(OutboxStatus.PENDING);
+  /** How many delivery attempts have been made. */
+  attempts = column.integer().notNull().default(0);
+  /** Give up (mark `failed`) after this many attempts. */
+  maxAttempts = column.integer().notNull().default(5);
+  /** Earliest time the row may be delivered (drives retry backoff). */
+  availableAt = column.datetime().notNull().default(sql.now());
+  /** When the row was successfully delivered, or `null`. */
+  sentAt = column.datetime();
+  /** The last delivery error message, or `null`. */
+  lastError = column.text();
+};
+var OutboxRelay = class {
+  /**
+   * @param repository - Repository over the outbox model.
+   * @param publish - Callback that delivers one event to the broker.
+   * @param options - Batch size and retry backoff.
+   */
+  constructor(repository, publish, options = {}) {
+    this.repository = repository;
+    this.publish = publish;
+    this.batchSize = options.batchSize ?? 100;
+    this.retryBackoffSeconds = options.retryBackoffSeconds ?? 30;
+  }
+  repository;
+  publish;
+  logger = new JSONLogger("tempest_express_sdk.db.outbox");
+  batchSize;
+  retryBackoffSeconds;
+  running = false;
+  /**
+   * Deliver one batch of due pending events.
+   *
+   * @param now - The current time (injectable for tests). Defaults to `new Date()`.
+   * @returns The number of events successfully delivered.
+   */
+  async drainOnce(now = /* @__PURE__ */ new Date()) {
+    const due = await this.repository.list({
+      status: OutboxStatus.PENDING,
+      availableAt: { lte: now }
+    });
+    let delivered = 0;
+    for (const event of due.slice(0, this.batchSize)) {
+      try {
+        await this.publish(
+          event.topic,
+          event.payload
+        );
+        await this.repository.update(
+          { id: event.id },
+          {
+            status: OutboxStatus.SENT,
+            sentAt: now,
+            lastError: null
+          }
+        );
+        delivered += 1;
+      } catch (error) {
+        await this.markFailure(event, error, now);
+      }
+    }
+    return delivered;
+  }
+  async markFailure(event, error, now) {
+    const attempts = event.attempts + 1;
+    const maxAttempts = event.maxAttempts;
+    const message = error instanceof Error ? error.message : String(error);
+    const exhausted = attempts >= maxAttempts;
+    const nextAvailable = new Date(
+      now.getTime() + attempts * this.retryBackoffSeconds * 1e3
+    );
+    await this.repository.update(
+      { id: event.id },
+      {
+        attempts,
+        status: exhausted ? OutboxStatus.FAILED : OutboxStatus.PENDING,
+        availableAt: exhausted ? event.availableAt : nextAvailable,
+        lastError: message
+      }
+    );
+    this.logger.warning("outbox delivery failed", {
+      id: String(event.id),
+      topic: String(event.topic),
+      attempts,
+      exhausted
+    });
+  }
+  /**
+   * Run `drainOnce` on an interval until {@link stop} is called.
+   *
+   * @param intervalMs - Delay between passes in milliseconds. Default `1000`.
+   */
+  async run(intervalMs = 1e3) {
+    this.running = true;
+    while (this.running) {
+      try {
+        await this.drainOnce();
+      } catch (error) {
+        this.logger.error("outbox relay pass failed", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+      await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    }
+  }
+  /** Stop the {@link run} loop after the current pass. */
+  stop() {
+    this.running = false;
+  }
+};
+
+// src/db/slowQuery.ts
+function wrapWithSlowQueryLog(driver, options = {}) {
+  const thresholdMs = options.thresholdMs ?? 500;
+  const level = options.level ?? "warning";
+  const logParameters = options.logParameters ?? false;
+  const logger4 = new JSONLogger(
+    options.loggerName ?? "tempest_express_sdk.db.slow_query"
+  );
+  const timed = (exec) => {
+    return async (sql5, params) => {
+      const start = process.hrtime.bigint();
+      try {
+        return await exec(sql5, params);
+      } finally {
+        const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
+        if (durationMs >= thresholdMs) {
+          logger4.log(level, "slow query", {
+            sql: sql5,
+            durationMs: Math.round(durationMs * 1e3) / 1e3,
+            ...logParameters ? { params } : {}
+          });
+        }
+      }
+    };
+  };
+  const wrapped = {
+    execute: timed(driver.execute.bind(driver)),
+    close: () => driver.close()
+  };
+  if (driver.iterate) {
+    wrapped.iterate = (sql5, params) => driver.iterate?.(sql5, params);
+  }
+  if (driver.reserve) {
+    wrapped.reserve = async () => {
+      const reserved = await driver.reserve?.();
+      if (!reserved) throw new Error("driver.reserve() returned nothing");
+      return {
+        execute: timed(reserved.execute.bind(reserved)),
+        close: () => reserved.close(),
+        release: () => reserved.release(),
+        ...reserved.iterate ? { iterate: (sql5, params) => reserved.iterate?.(sql5, params) } : {}
+      };
+    };
+  }
+  return wrapped;
+}
+function sqlitePath(url) {
+  const withoutScheme = url.replace(/^sqlite:\/\//, "");
+  if (withoutScheme === ":memory:" || withoutScheme === "") {
+    throw new Error("Cannot back up an in-memory SQLite database");
+  }
+  return withoutScheme.startsWith("/") ? withoutScheme : withoutScheme.replace(/^\.?\//, "./");
+}
+async function backupDatabase(databaseUrl, destPath, options = {}) {
+  const dialect = detectDialect(databaseUrl);
+  if (dialect === "sqlite") {
+    await copyFile(sqlitePath(databaseUrl), destPath);
+    return destPath;
+  }
+  if (dialect === "postgresql") {
+    const bin = options.pgDumpPath ?? "pg_dump";
+    const args = [...options.pgDumpArgs ?? [], "-f", destPath, databaseUrl];
+    await runPgDump(bin, args);
+    return destPath;
+  }
+  throw new Error(`backupDatabase does not support the '${dialect}' dialect`);
+}
+function runPgDump(bin, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(bin, args, { stdio: ["ignore", "ignore", "pipe"] });
+    let stderr = "";
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code === 0) resolve();
+      else reject(new Error(`pg_dump exited with code ${code}: ${stderr.trim()}`));
+    });
+  });
+}
 
 // src/services/base.ts
 var BaseService = class {
@@ -472,8 +997,8 @@ var BaseService = class {
    * @returns The page envelope with mapped items.
    */
   async paginate(filter = {}) {
-    const page = await this.repository.paginate(filter);
-    return { ...page, items: await this.mapMany(page.items) };
+    const page2 = await this.repository.paginate(filter);
+    return { ...page2, items: await this.mapMany(page2.items) };
   }
 };
 
@@ -6546,73 +7071,20 @@ function verifyOpaqueToken(plaintext, tokenHash) {
   return timingSafeEqual(computed, expected);
 }
 
-// src/utils/password.ts
-var cached = null;
-async function loadBcrypt() {
-  if (cached) return cached;
-  try {
-    const mod = await import('bcryptjs');
-    cached = mod.default ?? mod;
-  } catch (cause) {
-    throw new Error(
-      "PasswordUtils requires the 'bcryptjs' peer dependency. Install with `npm i bcryptjs`.",
-      { cause }
-    );
-  }
-  return cached;
-}
-var PasswordUtils = class {
-  /**
-   * @param rounds - The bcrypt cost factor. Higher is slower and harder to
-   *   brute-force. Defaults to 12.
-   */
-  constructor(rounds = 12) {
-    this.rounds = rounds;
-  }
-  rounds;
-  /**
-   * Hash a plaintext password.
-   *
-   * @param plain - The plaintext password.
-   * @returns The bcrypt hash, ready to persist.
-   */
-  async hash(plain) {
-    const bcrypt = await loadBcrypt();
-    const salt = await bcrypt.genSalt(this.rounds);
-    return bcrypt.hash(plain, salt);
-  }
-  /**
-   * Verify a plaintext password against a stored hash. Returns `false` for
-   * malformed hashes rather than throwing.
-   *
-   * @param plain - The plaintext password to verify.
-   * @param hashed - The previously stored bcrypt hash.
-   * @returns `true` when the password matches.
-   */
-  async verify(plain, hashed) {
-    try {
-      const bcrypt = await loadBcrypt();
-      return await bcrypt.compare(plain, hashed);
-    } catch {
-      return false;
-    }
-  }
-};
-
 // src/utils/jwt.ts
-var cached2 = null;
+var cached = null;
 async function loadJwt() {
-  if (cached2) return cached2;
+  if (cached) return cached;
   try {
     const mod = await import('jsonwebtoken');
-    cached2 = mod.default ?? mod;
+    cached = mod.default ?? mod;
   } catch (cause) {
     throw new Error(
       "JWTUtils requires the 'jsonwebtoken' peer dependency. Install with `npm i jsonwebtoken`.",
       { cause }
     );
   }
-  return cached2;
+  return cached;
 }
 var JWTUtils = class {
   /**
@@ -6764,6 +7236,133 @@ function getClientIp(req, options = {}) {
   }
   return req.socket?.remoteAddress ?? req.ip ?? UNKNOWN;
 }
+var LocalUploadStorage = class {
+  root;
+  baseUrl;
+  /**
+   * @param options - Filesystem root and public base URL.
+   */
+  constructor(options) {
+    this.root = options.root;
+    this.baseUrl = options.baseUrl ?? "";
+  }
+  async save(key, data, options = {}) {
+    const target = join(this.root, key);
+    await mkdir(dirname(target), { recursive: true });
+    await writeFile(target, data);
+    return {
+      key,
+      url: this.url(key),
+      size: data.byteLength,
+      ...options.contentType !== void 0 ? { contentType: options.contentType } : {}
+    };
+  }
+  async read(key) {
+    return readFile(join(this.root, key));
+  }
+  async delete(key) {
+    await rm(join(this.root, key), { force: true });
+  }
+  url(key) {
+    const base = this.baseUrl.replace(/\/$/, "");
+    return base ? `${base}/${key}` : `/${key}`;
+  }
+};
+function buildContentDisposition(filename, inline = false) {
+  const disposition = inline ? "inline" : "attachment";
+  const encoded = encodeURIComponent(filename);
+  return `${disposition}; filename*=UTF-8''${encoded}`;
+}
+
+// src/utils/download.ts
+function resolveDownloadPath(root, relativePath, subdir = "") {
+  const base = normalize(join(root, subdir));
+  const target = normalize(join(base, relativePath));
+  const rel = relative(base, target);
+  if (rel.startsWith("..") || isAbsolute(rel)) {
+    throw new Error("Resolved path escapes the download root");
+  }
+  return target;
+}
+function parseRange(header, size) {
+  if (!header) return null;
+  const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+  if (!match) return null;
+  const [, rawStart, rawEnd] = match;
+  if (rawStart === "" && rawEnd === "") return null;
+  let start;
+  let end;
+  if (rawStart === "") {
+    const suffix = Number(rawEnd);
+    start = Math.max(0, size - suffix);
+    end = size - 1;
+  } else {
+    start = Number(rawStart);
+    end = rawEnd === "" ? size - 1 : Math.min(Number(rawEnd), size - 1);
+  }
+  if (Number.isNaN(start) || Number.isNaN(end) || start > end || start >= size)
+    return null;
+  return { start, end };
+}
+async function sendFileDownload(req, res, absolutePath, options = {}) {
+  const info = await stat(absolutePath);
+  const filename = options.filename ?? absolutePath.split(/[/\\]/).pop() ?? "download";
+  res.setHeader("Content-Type", options.contentType ?? "application/octet-stream");
+  res.setHeader("Content-Disposition", buildContentDisposition(filename, options.inline));
+  res.setHeader("Accept-Ranges", "bytes");
+  const range = parseRange(req.header("range"), info.size);
+  if (range) {
+    res.status(206);
+    res.setHeader("Content-Range", `bytes ${range.start}-${range.end}/${info.size}`);
+    res.setHeader("Content-Length", String(range.end - range.start + 1));
+    createReadStream(absolutePath, { start: range.start, end: range.end }).pipe(res);
+    return;
+  }
+  res.status(200);
+  res.setHeader("Content-Length", String(info.size));
+  createReadStream(absolutePath).pipe(res);
+}
+function sendBytesDownload(res, data, options = {}) {
+  const filename = options.filename ?? "download";
+  res.setHeader("Content-Type", options.contentType ?? "application/octet-stream");
+  res.setHeader("Content-Disposition", buildContentDisposition(filename, options.inline));
+  res.setHeader("Content-Length", String(data.byteLength));
+  res.status(200).end(Buffer.from(data));
+}
+var LEVEL_LOG_FILES = {
+  debug: "debug.log",
+  info: "info.log",
+  warning: "warning.log",
+  error: "error.log"
+};
+var HTTP_500_LOG_FILE = "500.log";
+function configureFileLogging(options) {
+  const { dir } = options;
+  mkdirSync(dir, { recursive: true });
+  const streams = /* @__PURE__ */ new Map();
+  const streamFor = (filename) => {
+    let stream = streams.get(filename);
+    if (!stream) {
+      stream = createWriteStream(join(dir, filename), { flags: "a" });
+      streams.set(filename, stream);
+    }
+    return stream;
+  };
+  const sink = (level, record) => {
+    const line = `${JSON.stringify(record)}
+`;
+    streamFor(LEVEL_LOG_FILES[level]).write(line);
+    if (record[HTTP_500_MARKER]) streamFor(HTTP_500_LOG_FILE).write(line);
+  };
+  const detach = addLogSink(sink);
+  return {
+    close() {
+      detach();
+      for (const stream of streams.values()) stream.end();
+      streams.clear();
+    }
+  };
+}
 var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
 function base32Encode(bytes) {
   let bits = 0;
@@ -7059,20 +7658,20 @@ async function readGpus() {
     return [];
   }
 }
-function toPrometheus(snapshot = readSystem(), gpus = []) {
+function toPrometheus(snapshot2 = readSystem(), gpus = []) {
   const lines = [
     "# HELP process_cpu_load_percent 1-minute load average as percent of cores",
     "# TYPE process_cpu_load_percent gauge",
-    `process_cpu_load_percent ${snapshot.cpu.loadPercent}`,
+    `process_cpu_load_percent ${snapshot2.cpu.loadPercent}`,
     "# HELP process_memory_used_percent System memory used percent",
     "# TYPE process_memory_used_percent gauge",
-    `process_memory_used_percent ${snapshot.memory.usedPercent}`,
+    `process_memory_used_percent ${snapshot2.memory.usedPercent}`,
     "# HELP process_memory_rss_bytes Resident set size of the process",
     "# TYPE process_memory_rss_bytes gauge",
-    `process_memory_rss_bytes ${snapshot.memory.processRss}`,
+    `process_memory_rss_bytes ${snapshot2.memory.processRss}`,
     "# HELP process_uptime_seconds Process uptime in seconds",
     "# TYPE process_uptime_seconds counter",
-    `process_uptime_seconds ${snapshot.uptimeSeconds}`
+    `process_uptime_seconds ${snapshot2.uptimeSeconds}`
   ];
   if (gpus.length > 0) {
     lines.push(
@@ -7225,7 +7824,7 @@ var RedisCacheManager = class {
 };
 
 // src/cache/cached.ts
-function cached3(fn, options) {
+function cached2(fn, options) {
   return async (...args) => {
     const key = options.key(...args);
     const hit = await options.manager.get(key);
@@ -8113,43 +8712,76 @@ function makeFlagGuard(flags, flag) {
     }).catch(next);
   };
 }
-var LocalUploadStorage = class {
-  root;
-  baseUrl;
+
+// src/storage/s3.ts
+async function streamToBuffer(stream) {
+  const chunks = [];
+  for await (const chunk of stream) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks);
+}
+var S3UploadStorage = class {
+  bucket;
+  publicBaseUrl;
+  client;
+  options;
   /**
-   * @param options - Filesystem root and public base URL.
+   * @param options - Bucket, public URL and either a client or connection config.
    */
   constructor(options) {
-    this.root = options.root;
-    this.baseUrl = options.baseUrl ?? "";
+    this.bucket = options.bucket;
+    this.publicBaseUrl = options.publicBaseUrl ?? "";
+    this.client = options.client;
+    this.options = options;
+  }
+  /** Resolve the client, lazy-loading `minio` when one wasn't injected. */
+  async getClient() {
+    if (this.client) return this.client;
+    const specifier = "minio";
+    let mod;
+    try {
+      mod = await import(specifier);
+    } catch {
+      throw new Error(
+        "S3UploadStorage requires the 'minio' peer dependency. Install with `npm i minio`."
+      );
+    }
+    this.client = new mod.Client({
+      endPoint: this.options.endPoint,
+      port: this.options.port,
+      useSSL: this.options.useSSL,
+      accessKey: this.options.accessKey,
+      secretKey: this.options.secretKey,
+      region: this.options.region
+    });
+    return this.client;
   }
   async save(key, data, options = {}) {
-    const target = join(this.root, key);
-    await mkdir(dirname(target), { recursive: true });
-    await writeFile(target, data);
+    const client = await this.getClient();
+    const buffer = Buffer.from(data);
+    const metaData = options.contentType ? { "Content-Type": options.contentType } : void 0;
+    await client.putObject(this.bucket, key, buffer, buffer.byteLength, metaData);
     return {
       key,
       url: this.url(key),
-      size: data.byteLength,
+      size: buffer.byteLength,
       ...options.contentType !== void 0 ? { contentType: options.contentType } : {}
     };
   }
   async read(key) {
-    return readFile(join(this.root, key));
+    const client = await this.getClient();
+    return streamToBuffer(await client.getObject(this.bucket, key));
   }
   async delete(key) {
-    await rm(join(this.root, key), { force: true });
+    const client = await this.getClient();
+    await client.removeObject(this.bucket, key);
   }
   url(key) {
-    const base = this.baseUrl.replace(/\/$/, "");
-    return base ? `${base}/${key}` : `/${key}`;
+    const base = this.publicBaseUrl.replace(/\/$/, "");
+    return base ? `${base}/${this.bucket}/${key}` : `/${this.bucket}/${key}`;
   }
 };
-function buildContentDisposition(filename, inline = false) {
-  const disposition = inline ? "inline" : "attachment";
-  const encoded = encodeURIComponent(filename);
-  return `${disposition}; filename*=UTF-8''${encoded}`;
-}
 
 // src/webpush/schemas.ts
 var webPushKeysSchema = z.object({
@@ -8182,19 +8814,19 @@ var WebPushGoneError = class extends WebPushError {
     this.name = "WebPushGoneError";
   }
 };
-var cached4 = null;
+var cached3 = null;
 async function loadWebPush() {
-  if (cached4) return cached4;
+  if (cached3) return cached3;
   try {
     const mod = await import('web-push');
-    cached4 = mod.default ?? mod;
+    cached3 = mod.default ?? mod;
   } catch (cause) {
     throw new Error(
       "WebPushDispatcher requires the 'web-push' peer dependency. Install with `npm i web-push`.",
       { cause }
     );
   }
-  return cached4;
+  return cached3;
 }
 var WebPushDispatcher = class {
   /**
@@ -8778,12 +9410,12 @@ function makeAdminRouter(site, options = {}) {
     for (const [key, value] of Object.entries(req.query)) {
       if (!PAGINATION_KEYS2.has(key) && typeof value === "string") filters[key] = value;
     }
-    const page = Math.max(1, Number.parseInt(String(req.query.page ?? "1"), 10) || 1);
+    const page2 = Math.max(1, Number.parseInt(String(req.query.page ?? "1"), 10) || 1);
     const pageSize = Math.max(
       1,
       Number.parseInt(String(req.query.pageSize ?? "20"), 10) || 20
     );
-    res.json(await resource.list({ page, pageSize, filters }));
+    res.json(await resource.list({ page: page2, pageSize, filters }));
   });
   router.get(`${prefix}/:resource/:id`, async (req, res) => {
     const resource = requireResource(site, req.params.resource);
@@ -9340,12 +9972,62 @@ function makeAuthRouter(options) {
   }
   return router;
 }
+
+// src/auth/htmlPages.ts
+function esc(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+var STYLE = `
+  :root { color-scheme: light dark; }
+  body { font: 16px/1.5 system-ui, sans-serif; margin: 0; display: grid; min-height: 100vh; place-items: center; background: #f6f7f9; color: #1a1a1a; }
+  @media (prefers-color-scheme: dark) { body { background: #16181d; color: #e8e8e8; } .card { background: #1f2229 !important; } input { background: #16181d !important; color: inherit !important; border-color: #3a3f4b !important; } }
+  .card { background: #fff; max-width: 26rem; width: calc(100% - 3rem); padding: 2rem; border-radius: 14px; box-shadow: 0 6px 30px rgba(0,0,0,.08); text-align: center; }
+  h1 { font-size: 1.4rem; margin: 0 0 .5rem; }
+  p { margin: .25rem 0 1rem; opacity: .85; }
+  .ico { font-size: 2.5rem; }
+  a.btn, button.btn { display: inline-block; margin-top: .5rem; padding: .6rem 1.2rem; border-radius: 9px; border: 0; background: #4f46e5; color: #fff; text-decoration: none; font-weight: 600; cursor: pointer; }
+  form { text-align: left; margin-top: 1rem; }
+  label { display: block; font-size: .85rem; font-weight: 600; margin-bottom: .3rem; }
+  input { width: 100%; box-sizing: border-box; padding: .6rem .7rem; border: 1px solid #d0d3d9; border-radius: 9px; font: inherit; }
+`;
+function page(title, body) {
+  return `<!doctype html>
+<html lang="pt-BR">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${esc(title)}</title><style>${STYLE}</style></head>
+<body><main class="card">${body}</main></body>
+</html>`;
+}
+function renderAuthResultPage(options) {
+  const icon = options.ok ? "\u2705" : "\u26A0\uFE0F";
+  const cta = options.cta ? `<a class="btn" href="${esc(options.cta.href)}">${esc(options.cta.label)}</a>` : "";
+  return page(
+    options.title,
+    `<div class="ico">${icon}</div><h1>${esc(options.title)}</h1><p>${esc(options.message)}</p>${cta}`
+  );
+}
+function renderPasswordResetFormPage(options) {
+  const title = options.title ?? "Redefinir senha";
+  const tokenField = options.tokenField ?? "token";
+  const passwordField = options.passwordField ?? "password";
+  const submitLabel = options.submitLabel ?? "Redefinir senha";
+  return page(
+    title,
+    `<h1>${esc(title)}</h1>
+     <form method="post" action="${esc(options.action)}">
+       <input type="hidden" name="${esc(tokenField)}" value="${esc(options.token)}">
+       <label for="pw">Nova senha</label>
+       <input id="pw" type="password" name="${esc(passwordField)}" required minlength="8" autocomplete="new-password">
+       <button class="btn" type="submit" style="margin-top:1rem;width:100%">${esc(submitLabel)}</button>
+     </form>`
+  );
+}
 var logger2 = new JSONLogger("tempest_express_sdk.api.handlers");
 var REQUEST_ID_HEADER = "X-Request-ID";
+var VALID_REQUEST_ID = /^[A-Za-z0-9._\-:+/=]{1,128}$/;
 function requestIdMiddleware() {
   return (req, res, next) => {
     const inbound = req.header(REQUEST_ID_HEADER);
-    const requestId = inbound && inbound.length > 0 ? inbound : randomUUID();
+    const requestId = inbound && VALID_REQUEST_ID.test(inbound) ? inbound : randomUUID();
     res.setHeader(REQUEST_ID_HEADER, requestId);
     runWithRequestContext({ requestId }, () => next());
   };
@@ -9615,6 +10297,933 @@ function runServer(app, options = {}) {
   });
 }
 
-export { ActivationService, AdminSite, AppException, AttemptThrottle, BaseController, BaseModel, BaseService, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailProvider, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, HTTPClient, HTTP_500_MARKER, InvalidTokenException, JSONLogger, JWTUtils, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MessagingHub, MetricsUtils, MfaService, NotFoundException, PHONE_BR_PATTERN, PasswordResetService, PasswordUtils, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WhatsAppProvider, activationSchema, attachWebSocketHub, authResponseSchema, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, broadcastText, buildContentDisposition, cached3 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createdByColumn, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, encodeCursor, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, listStates, loadSettings, loginSchema, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeMetricsRouter, makeSessionMiddleware, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, refreshSchema, registerExceptionHandlers, requestIdMiddleware, requireRoles, runServer, runWithRequestContext, serverSettingsShape, sessionCookie, setRequestId, signupSchema, sseResponse, statesByRegion, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, ufField, updatedByColumn, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSubscriptionSchema, wsEnvelopeSchema };
+// src/api/middlewares/bodySize.ts
+function bodySizeLimitMiddleware(options) {
+  const { maxBytes } = options;
+  const excludePaths = options.excludePaths ?? [];
+  const reject = (res) => {
+    res.status(413).json({
+      detail: "Request body too large.",
+      code: "REQUEST_BODY_TOO_LARGE",
+      details: { maxBytes }
+    });
+  };
+  return (req, res, next) => {
+    if (maxBytes <= 0 || excludePaths.some((prefix) => req.path.startsWith(prefix))) {
+      next();
+      return;
+    }
+    const declared = Number.parseInt(req.header("content-length") ?? "", 10);
+    if (Number.isFinite(declared) && declared > maxBytes) {
+      reject(res);
+      return;
+    }
+    let seen = 0;
+    let aborted = false;
+    const onData = (chunk) => {
+      if (aborted) return;
+      seen += Buffer.byteLength(chunk);
+      if (seen > maxBytes) {
+        aborted = true;
+        req.removeListener("data", onData);
+        if (!res.headersSent) reject(res);
+        req.destroy();
+      }
+    };
+    req.on("data", onData);
+    req.on("end", () => req.removeListener("data", onData));
+    next();
+  };
+}
+var CSRF_COOKIE_NAME = "csrf_token";
+var CSRF_HEADER_NAME = "X-CSRF-Token";
+var UNSAFE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function generateCsrfToken(nBytes = 32) {
+  return randomBytes(nBytes).toString("base64url");
+}
+function readCookie(req, name) {
+  const parsed = req.cookies;
+  if (parsed && typeof parsed[name] === "string") return parsed[name];
+  const header = req.header("cookie");
+  if (!header) return void 0;
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1) continue;
+    if (part.slice(0, idx).trim() === name) return part.slice(idx + 1).trim();
+  }
+  return void 0;
+}
+function safeEqual2(a, b) {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+function csrfMiddleware(options = {}) {
+  const cookieName = options.cookieName ?? CSRF_COOKIE_NAME;
+  const headerName = options.headerName ?? CSRF_HEADER_NAME;
+  const excludePaths = options.excludePaths ?? [];
+  const reject = (res, message) => {
+    res.status(403).json({ detail: message, code: "CSRF_FAILED", details: {} });
+  };
+  return (req, res, next) => {
+    if (!UNSAFE_METHODS.has(req.method)) {
+      next();
+      return;
+    }
+    if (excludePaths.some((prefix) => req.path.startsWith(prefix))) {
+      next();
+      return;
+    }
+    const cookieToken = readCookie(req, cookieName);
+    const headerToken = req.header(headerName);
+    if (!cookieToken || !headerToken) {
+      reject(res, "CSRF token missing.");
+      return;
+    }
+    if (!safeEqual2(cookieToken, headerToken)) {
+      reject(res, "CSRF token mismatch.");
+      return;
+    }
+    next();
+  };
+}
+
+// src/api/middlewares/graceful.ts
+var GracefulShutdown = class {
+  drainTimeoutSeconds;
+  retryAfterSeconds;
+  exempt;
+  inFlightCount = 0;
+  draining = false;
+  idleResolvers = [];
+  constructor(options = {}) {
+    this.drainTimeoutSeconds = options.drainTimeoutSeconds ?? 30;
+    this.retryAfterSeconds = options.retryAfterSeconds ?? 5;
+    this.exempt = new Set(options.exemptPaths ?? []);
+  }
+  /** Number of requests currently being served. */
+  get inFlight() {
+    return this.inFlightCount;
+  }
+  /** Whether draining has begun. */
+  get isDraining() {
+    return this.draining;
+  }
+  /** The Express middleware: counts in-flight requests, 503s while draining. */
+  middleware() {
+    return (req, res, next) => {
+      if (this.draining && !this.exempt.has(req.path)) {
+        res.setHeader("Retry-After", String(this.retryAfterSeconds));
+        res.setHeader("Connection", "close");
+        res.status(503).json({
+          detail: "Server is shutting down.",
+          code: "SERVICE_UNAVAILABLE",
+          details: {}
+        });
+        return;
+      }
+      this.inFlightCount += 1;
+      let settled = false;
+      const settle = () => {
+        if (settled) return;
+        settled = true;
+        this.release();
+      };
+      res.on("finish", settle);
+      res.on("close", settle);
+      next();
+    };
+  }
+  release() {
+    this.inFlightCount -= 1;
+    if (this.inFlightCount === 0) {
+      const resolvers = this.idleResolvers;
+      this.idleResolvers = [];
+      for (const resolve of resolvers) resolve();
+    }
+  }
+  /** Flip into draining mode (idempotent). New non-exempt requests get 503. */
+  beginDrain() {
+    this.draining = true;
+  }
+  /**
+   * Wait until in-flight requests finish or the drain timeout elapses.
+   *
+   * @returns `true` if everything drained in time, `false` on timeout.
+   */
+  waitDrained() {
+    if (this.inFlightCount === 0) return Promise.resolve(true);
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        this.idleResolvers = this.idleResolvers.filter((r) => r !== onIdle);
+        resolve(false);
+      }, this.drainTimeoutSeconds * 1e3);
+      const onIdle = () => {
+        clearTimeout(timer);
+        resolve(true);
+      };
+      this.idleResolvers.push(onIdle);
+    });
+  }
+};
+
+// src/api/middlewares/idempotency.ts
+var IDEMPOTENCY_HEADER = "Idempotency-Key";
+var MUTATING_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var MemoryIdempotencyStore = class {
+  store = /* @__PURE__ */ new Map();
+  async get(key) {
+    const entry = this.store.get(key);
+    if (!entry) return null;
+    if (entry.expiresAt < Date.now()) {
+      this.store.delete(key);
+      return null;
+    }
+    return entry.response;
+  }
+  async set(key, response, ttlSeconds) {
+    this.store.set(key, { expiresAt: Date.now() + ttlSeconds * 1e3, response });
+  }
+};
+var RedisIdempotencyStore = class {
+  constructor(client, options = {}) {
+    this.client = client;
+    this.prefix = options.prefix ?? "idem:";
+  }
+  client;
+  prefix;
+  async get(key) {
+    const raw = await this.client.get(this.prefix + key);
+    return raw === null ? null : JSON.parse(raw);
+  }
+  async set(key, response, ttlSeconds) {
+    await this.client.set(this.prefix + key, JSON.stringify(response), {
+      EX: ttlSeconds
+    });
+  }
+};
+function idempotencyMiddleware(options) {
+  const { store } = options;
+  const ttlSeconds = options.ttlSeconds ?? 24 * 3600;
+  const headerName = options.headerName ?? IDEMPOTENCY_HEADER;
+  return (req, res, next) => {
+    if (!MUTATING_METHODS.has(req.method)) {
+      next();
+      return;
+    }
+    const rawKey = req.header(headerName);
+    if (!rawKey) {
+      next();
+      return;
+    }
+    const scoped = `${req.method}:${req.path}:${rawKey}`;
+    store.get(scoped).then((cached4) => {
+      if (cached4) {
+        for (const [name, value] of cached4.headers) res.setHeader(name, value);
+        res.setHeader("Idempotent-Replayed", "true");
+        if (cached4.contentType) res.type(cached4.contentType);
+        res.status(cached4.statusCode).send(cached4.body);
+        return;
+      }
+      captureAndForward(res, scoped, store, ttlSeconds);
+      next();
+    }).catch(next);
+  };
+}
+function captureAndForward(res, key, store, ttlSeconds) {
+  const originalSend = res.send.bind(res);
+  let capturedBody = "";
+  res.send = ((body) => {
+    if (typeof body === "string") capturedBody = body;
+    else if (body !== void 0) capturedBody = JSON.stringify(body);
+    return originalSend(body);
+  });
+  res.on("finish", () => {
+    if (res.statusCode < 200 || res.statusCode >= 300) return;
+    const contentType = res.getHeader("content-type");
+    void store.set(
+      key,
+      {
+        statusCode: res.statusCode,
+        headers: [],
+        body: capturedBody,
+        contentType: typeof contentType === "string" ? contentType : null
+      },
+      ttlSeconds
+    ).catch(() => {
+    });
+  });
+}
+
+// src/api/middlewares/prometheus.ts
+var DEFAULT_BUCKETS = [
+  5e-3,
+  0.01,
+  0.025,
+  0.05,
+  0.1,
+  0.25,
+  0.5,
+  1,
+  2.5,
+  5,
+  10
+];
+var HttpMetrics = class {
+  buckets;
+  /** `method|status` → count. */
+  requestTotals = /* @__PURE__ */ new Map();
+  /** `method|route` → histogram. */
+  durations = /* @__PURE__ */ new Map();
+  constructor(options = {}) {
+    this.buckets = [...options.buckets ?? DEFAULT_BUCKETS].sort((a, b) => a - b);
+  }
+  /**
+   * Record one completed request.
+   *
+   * @param method - HTTP method.
+   * @param route - The route pattern (or path) — keep cardinality bounded.
+   * @param status - Response status code.
+   * @param durationSeconds - Wall-clock request duration in seconds.
+   */
+  observe(method, route, status, durationSeconds) {
+    const totalKey = `${method}|${status}`;
+    this.requestTotals.set(totalKey, (this.requestTotals.get(totalKey) ?? 0) + 1);
+    const durKey = `${method}|${route}`;
+    let hist = this.durations.get(durKey);
+    if (!hist) {
+      hist = { bucketCounts: new Array(this.buckets.length).fill(0), sum: 0, count: 0 };
+      this.durations.set(durKey, hist);
+    }
+    hist.sum += durationSeconds;
+    hist.count += 1;
+    for (let i = 0; i < this.buckets.length; i += 1) {
+      const upper = this.buckets[i];
+      if (upper !== void 0 && durationSeconds <= upper) {
+        hist.bucketCounts[i] = (hist.bucketCounts[i] ?? 0) + 1;
+      }
+    }
+  }
+  /** Render the collected metrics as Prometheus exposition text. */
+  render() {
+    const lines = [];
+    lines.push("# HELP http_requests_total Total HTTP requests.");
+    lines.push("# TYPE http_requests_total counter");
+    for (const [key, value] of this.requestTotals) {
+      const [method = "", status = ""] = key.split("|");
+      lines.push(
+        `http_requests_total{method="${esc2(method)}",status="${esc2(status)}"} ${value}`
+      );
+    }
+    lines.push("# HELP http_request_duration_seconds HTTP request latency.");
+    lines.push("# TYPE http_request_duration_seconds histogram");
+    for (const [key, hist] of this.durations) {
+      const [method = "", route = ""] = key.split("|");
+      const labels = `method="${esc2(method)}",route="${esc2(route)}"`;
+      for (let i = 0; i < this.buckets.length; i += 1) {
+        lines.push(
+          `http_request_duration_seconds_bucket{${labels},le="${this.buckets[i]}"} ${hist.bucketCounts[i] ?? 0}`
+        );
+      }
+      lines.push(
+        `http_request_duration_seconds_bucket{${labels},le="+Inf"} ${hist.count}`
+      );
+      lines.push(`http_request_duration_seconds_sum{${labels}} ${hist.sum}`);
+      lines.push(`http_request_duration_seconds_count{${labels}} ${hist.count}`);
+    }
+    return `${lines.join("\n")}
+`;
+  }
+  /**
+   * Build the middleware that records each request into this collector.
+   *
+   * @param options - Optional exempt paths (e.g. the metrics route itself).
+   * @returns An Express middleware.
+   */
+  middleware(options = {}) {
+    const exempt = new Set(options.exemptPaths ?? []);
+    return (req, res, next) => {
+      if (exempt.has(req.path)) {
+        next();
+        return;
+      }
+      const start = process.hrtime.bigint();
+      res.on("finish", () => {
+        const durationSeconds = Number(process.hrtime.bigint() - start) / 1e9;
+        const route = req.route?.path ?? req.path;
+        this.observe(req.method, route, res.statusCode, durationSeconds);
+      });
+      next();
+    };
+  }
+};
+function esc2(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n");
+}
+function prometheusMiddleware(options = {}) {
+  const metrics = new HttpMetrics(
+    options.buckets !== void 0 ? { buckets: options.buckets } : {}
+  );
+  return {
+    metrics,
+    middleware: metrics.middleware(
+      options.exemptPaths !== void 0 ? { exemptPaths: options.exemptPaths } : {}
+    )
+  };
+}
+var MemoryRateLimitStore = class {
+  buckets = /* @__PURE__ */ new Map();
+  async hit(key, maxRequests, windowSeconds) {
+    const now = Date.now();
+    const windowMs = windowSeconds * 1e3;
+    const cutoff = now - windowMs;
+    const bucket = this.buckets.get(key) ?? [];
+    let start = 0;
+    while (start < bucket.length) {
+      const ts = bucket[start];
+      if (ts === void 0 || ts >= cutoff) break;
+      start += 1;
+    }
+    const live = start > 0 ? bucket.slice(start) : bucket;
+    if (live.length >= maxRequests) {
+      this.buckets.set(key, live);
+      const oldest = live[0] ?? now;
+      const retryAfter = Math.max(1, Math.ceil((oldest + windowMs - now) / 1e3));
+      return { allowed: false, remaining: 0, retryAfter };
+    }
+    live.push(now);
+    this.buckets.set(key, live);
+    return { allowed: true, remaining: maxRequests - live.length, retryAfter: 0 };
+  }
+};
+var SLIDING_WINDOW_LUA = `
+local key = KEYS[1]
+local now = tonumber(ARGV[1])
+local window = tonumber(ARGV[2])
+local limit = tonumber(ARGV[3])
+local member = ARGV[4]
+redis.call('ZREMRANGEBYSCORE', key, 0, now - window)
+local count = redis.call('ZCARD', key)
+if count < limit then
+  redis.call('ZADD', key, now, member)
+  redis.call('PEXPIRE', key, window)
+  return {1, limit - count - 1, 0}
+end
+local oldest = redis.call('ZRANGE', key, 0, 0, 'WITHSCORES')
+local retry = window
+if oldest[2] then
+  retry = (tonumber(oldest[2]) + window) - now
+end
+if retry < 1 then retry = 1 end
+return {0, 0, retry}
+`;
+var RedisRateLimitStore = class {
+  /**
+   * @param redis - Async Redis client exposing `eval({ keys, arguments })`.
+   * @param options - Key namespace and fail-open behavior.
+   */
+  constructor(redis, options = {}) {
+    this.redis = redis;
+    this.namespace = options.namespace ?? "ratelimit";
+    this.failOpen = options.failOpen ?? true;
+  }
+  redis;
+  namespace;
+  failOpen;
+  async hit(key, maxRequests, windowSeconds) {
+    const nowMs = Date.now();
+    const windowMs = Math.round(windowSeconds * 1e3);
+    const member = randomUUID();
+    try {
+      const raw = await this.redis.eval(SLIDING_WINDOW_LUA, {
+        keys: [`${this.namespace}:${key}`],
+        arguments: [String(nowMs), String(windowMs), String(maxRequests), member]
+      });
+      const [allowedFlag, remaining, retryMs] = raw;
+      const allowed = Boolean(allowedFlag);
+      return {
+        allowed,
+        remaining: Number(remaining),
+        retryAfter: allowed ? 0 : Math.max(1, Math.ceil(Number(retryMs) / 1e3))
+      };
+    } catch (error) {
+      if (this.failOpen) {
+        return { allowed: true, remaining: maxRequests - 1, retryAfter: 0 };
+      }
+      throw error;
+    }
+  }
+};
+function ipOpts(trustedHeader) {
+  return trustedHeader !== void 0 ? { trustedHeader } : {};
+}
+function bearerToken2(req) {
+  const header = req.header("authorization");
+  if (!header) return null;
+  const parts = header.split(/\s+/, 2);
+  const [scheme, token] = parts;
+  if (scheme?.toLowerCase() === "bearer" && token) return token.trim();
+  return null;
+}
+function keyByIp(options = {}) {
+  return (req) => `ip:${getClientIp(req, options)}`;
+}
+function keyByHeader(headerName, options = {}) {
+  const scope = options.scope ?? "key";
+  const fallbackToIp = options.fallbackToIp ?? true;
+  return (req) => {
+    const value = req.header(headerName);
+    if (value) return `${scope}:${value.trim()}`;
+    if (fallbackToIp) return `ip:${getClientIp(req, ipOpts(options.trustedIpHeader))}`;
+    return `${scope}:anonymous`;
+  };
+}
+function keyByJwtClaim(jwt, claim, options = {}) {
+  const label = options.scope ?? claim;
+  const fallbackToIp = options.fallbackToIp ?? true;
+  return async (req) => {
+    const token = bearerToken2(req);
+    if (token) {
+      try {
+        const claims = await jwt.decode(token);
+        const value = claims[claim];
+        if (value !== void 0 && value !== null) return `${label}:${String(value)}`;
+      } catch {
+      }
+    }
+    if (fallbackToIp) return `ip:${getClientIp(req, ipOpts(options.trustedIpHeader))}`;
+    return `${label}:anonymous`;
+  };
+}
+function keyByJwtSubject(jwt, options = {}) {
+  return keyByJwtClaim(jwt, "sub", { scope: "user", ...options });
+}
+function rateLimitMiddleware(options = {}) {
+  const maxRequests = options.maxRequests ?? 60;
+  const windowSeconds = options.windowSeconds ?? 60;
+  if (maxRequests < 1) throw new RangeError("maxRequests must be >= 1");
+  if (windowSeconds <= 0) throw new RangeError("windowSeconds must be > 0");
+  const store = options.store ?? new MemoryRateLimitStore();
+  const keyFunc = options.keyFunc ?? keyByIp(ipOpts(options.trustedIpHeader));
+  const exempt = new Set(options.exemptPaths ?? []);
+  const retryAfterHeader = options.retryAfterHeader ?? true;
+  const errorMessage = options.errorMessage ?? "Too many requests";
+  return (req, res, next) => {
+    if (exempt.has(req.path)) {
+      next();
+      return;
+    }
+    Promise.resolve(keyFunc(req)).then((key) => store.hit(key, maxRequests, windowSeconds)).then((result) => {
+      res.setHeader("X-RateLimit-Limit", String(maxRequests));
+      res.setHeader("X-RateLimit-Remaining", String(Math.max(0, result.remaining)));
+      if (!result.allowed) {
+        if (retryAfterHeader) res.setHeader("Retry-After", String(result.retryAfter));
+        res.status(429).json({
+          detail: errorMessage,
+          code: "TOO_MANY_REQUESTS",
+          details: { retryAfterSeconds: result.retryAfter }
+        });
+        return;
+      }
+      next();
+    }).catch(next);
+  };
+}
+
+// src/api/middlewares/tracing.ts
+function requestTracingMiddleware(options = {}) {
+  const logger4 = new JSONLogger(options.loggerName ?? "tempest_express_sdk.api.tracing");
+  const level = options.level ?? "info";
+  const exempt = new Set(options.exemptPaths ?? []);
+  return (req, res, next) => {
+    if (exempt.has(req.path)) {
+      next();
+      return;
+    }
+    const start = process.hrtime.bigint();
+    res.on("finish", () => {
+      const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
+      logger4.log(level, "request", {
+        method: req.method,
+        path: req.path,
+        statusCode: res.statusCode,
+        durationMs: Math.round(durationMs * 1e3) / 1e3,
+        requestId: getRequestId()
+      });
+    });
+    next();
+  };
+}
+var OAuthError = class extends AppException {
+  static statusCode = 502;
+  static code = "OAUTH_ERROR";
+};
+function generateOAuthState(nBytes = 32) {
+  return randomBytes(nBytes).toString("base64url");
+}
+var BaseOAuthClient = class {
+  clientId;
+  clientSecret;
+  redirectUri;
+  scopes;
+  http;
+  constructor(options) {
+    this.clientId = options.clientId;
+    this.clientSecret = options.clientSecret;
+    this.redirectUri = options.redirectUri;
+    this.scopes = options.scopes ?? this.defaultScopes();
+    this.http = options.httpClient ?? new HTTPClient({ timeoutMs: 1e4 });
+  }
+  defaultScopes() {
+    return [];
+  }
+  /** The provider's userinfo endpoint, or `null` when unavailable. */
+  userinfoUrl() {
+    return null;
+  }
+  /**
+   * Build the fully-formed authorize URL to redirect the user to.
+   *
+   * @param state - A value from {@link generateOAuthState}, saved server-side.
+   * @param extra - Extra query params (e.g. `{ access_type: "offline" }`).
+   * @returns The authorize URL.
+   */
+  buildAuthorizeUrl(state, extra = {}) {
+    const params = new URLSearchParams({
+      client_id: this.clientId,
+      redirect_uri: this.redirectUri,
+      response_type: "code",
+      scope: this.scopes.join(" "),
+      state,
+      ...extra
+    });
+    return `${this.authorizeUrl()}?${params.toString()}`;
+  }
+  /**
+   * Exchange an authorization code for tokens.
+   *
+   * @param code - The `code` query param from the callback.
+   * @returns The parsed token bundle.
+   * @throws {OAuthError} When the provider rejects the exchange.
+   */
+  async exchangeCode(code) {
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: this.redirectUri,
+      client_id: this.clientId,
+      client_secret: this.clientSecret
+    });
+    const response = await this.http.request("POST", this.tokenUrl(), {
+      body: body.toString(),
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json"
+      }
+    });
+    if (response.status >= 400) {
+      throw new OAuthError({
+        message: `token exchange failed (${response.status})`,
+        details: { body: await safeText(response) }
+      });
+    }
+    const payload = await response.json();
+    return {
+      accessToken: String(payload.access_token),
+      tokenType: payload.token_type ?? "Bearer",
+      refreshToken: payload.refresh_token ?? null,
+      idToken: payload.id_token ?? null,
+      expiresIn: payload.expires_in ?? null,
+      scope: payload.scope ?? null,
+      raw: payload
+    };
+  }
+  /**
+   * Fetch the normalized user identity for a token bundle.
+   *
+   * @param tokens - The tokens from {@link exchangeCode}.
+   * @returns The normalized user.
+   * @throws {OAuthError} When userinfo is unconfigured or the call fails.
+   */
+  async fetchUser(tokens) {
+    const url = this.userinfoUrl();
+    if (url === null) {
+      throw new OAuthError({
+        message: `${this.providerName}: userinfo endpoint not configured`
+      });
+    }
+    const response = await this.http.request("GET", url, {
+      headers: {
+        authorization: `${tokens.tokenType} ${tokens.accessToken}`,
+        accept: "application/json",
+        "user-agent": "tempest-express-sdk"
+      }
+    });
+    if (response.status >= 400) {
+      throw new OAuthError({
+        message: `userinfo failed (${response.status})`,
+        details: { body: await safeText(response) }
+      });
+    }
+    return this.parseUser(await response.json());
+  }
+};
+async function safeText(response) {
+  try {
+    return await response.text();
+  } catch {
+    return "";
+  }
+}
+var GoogleOAuthClient = class extends BaseOAuthClient {
+  providerName = "google";
+  defaultScopes() {
+    return ["openid", "email", "profile"];
+  }
+  authorizeUrl() {
+    return "https://accounts.google.com/o/oauth2/v2/auth";
+  }
+  tokenUrl() {
+    return "https://oauth2.googleapis.com/token";
+  }
+  userinfoUrl() {
+    return "https://openidconnect.googleapis.com/v1/userinfo";
+  }
+  parseUser(payload) {
+    return {
+      provider: this.providerName,
+      subject: String(payload.sub),
+      email: payload.email ?? null,
+      name: payload.name ?? null,
+      picture: payload.picture ?? null,
+      raw: payload
+    };
+  }
+};
+var GitHubOAuthClient = class extends BaseOAuthClient {
+  providerName = "github";
+  defaultScopes() {
+    return ["read:user", "user:email"];
+  }
+  authorizeUrl() {
+    return "https://github.com/login/oauth/authorize";
+  }
+  tokenUrl() {
+    return "https://github.com/login/oauth/access_token";
+  }
+  userinfoUrl() {
+    return "https://api.github.com/user";
+  }
+  parseUser(payload) {
+    return {
+      provider: this.providerName,
+      subject: String(payload.id),
+      email: payload.email ?? null,
+      name: payload.name ?? payload.login ?? null,
+      picture: payload.avatar_url ?? null,
+      raw: payload
+    };
+  }
+};
+var OIDCProvider = class extends BaseOAuthClient {
+  providerName;
+  _authorizeUrl;
+  _tokenUrl;
+  _userinfoUrl;
+  constructor(options) {
+    super(options);
+    this.providerName = options.providerName ?? "oidc";
+    this._authorizeUrl = options.authorizeUrl;
+    this._tokenUrl = options.tokenUrl;
+    this._userinfoUrl = options.userinfoUrl ?? null;
+  }
+  defaultScopes() {
+    return ["openid", "email", "profile"];
+  }
+  authorizeUrl() {
+    return this._authorizeUrl;
+  }
+  tokenUrl() {
+    return this._tokenUrl;
+  }
+  userinfoUrl() {
+    return this._userinfoUrl;
+  }
+  parseUser(payload) {
+    return {
+      provider: this.providerName,
+      subject: String(payload.sub ?? payload.id),
+      email: payload.email ?? null,
+      name: payload.name ?? null,
+      picture: payload.picture ?? null,
+      raw: payload
+    };
+  }
+};
+var WebhookSignatureVerifier = class {
+  secret;
+  algorithm;
+  headerName;
+  encoding;
+  prefix;
+  /**
+   * @param secret - The shared signing secret.
+   * @param options - Algorithm, header name, encoding and optional prefix.
+   */
+  constructor(secret, options = {}) {
+    this.secret = secret;
+    this.algorithm = options.algorithm ?? "sha256";
+    this.headerName = options.headerName ?? "X-Signature";
+    this.encoding = options.encoding ?? "hex";
+    this.prefix = options.prefix ?? "";
+  }
+  /** The header name this verifier reads. */
+  get header() {
+    return this.headerName;
+  }
+  /**
+   * Compute the expected signature for a raw body.
+   *
+   * @param body - The raw request body.
+   * @returns The signature in the configured encoding.
+   */
+  expected(body) {
+    return createHmac(this.algorithm, this.secret).update(body).digest(this.encoding);
+  }
+  /**
+   * Verify a signature against a raw body (constant time).
+   *
+   * @param body - The raw request body.
+   * @param signature - The header value (including any configured prefix).
+   * @returns `true` when it matches.
+   */
+  verify(body, signature) {
+    let candidate = signature;
+    if (this.prefix && candidate.startsWith(this.prefix)) {
+      candidate = candidate.slice(this.prefix.length);
+    }
+    const expected = Buffer.from(this.expected(body));
+    const provided = Buffer.from(candidate);
+    if (expected.length !== provided.length) return false;
+    return timingSafeEqual(expected, provided);
+  }
+  /**
+   * Build an Express middleware that rejects requests with a bad signature.
+   *
+   * The route **must** receive the raw body as a `Buffer` — mount
+   * `express.raw({ type: "..." })` (matching every content type) before this
+   * middleware so `req.body` is the raw bytes. On success the request proceeds
+   * (parse `req.body` yourself).
+   *
+   * @param options - Custom error message.
+   * @returns An Express middleware.
+   */
+  middleware(options = {}) {
+    const errorMessage = options.errorMessage ?? "Invalid webhook signature";
+    return (req, res, next) => {
+      const signature = req.header(this.headerName) ?? "";
+      const body = Buffer.isBuffer(req.body) ? req.body : Buffer.from(typeof req.body === "string" ? req.body : "");
+      if (!signature || !this.verify(body, signature)) {
+        res.status(401).json({ detail: errorMessage, code: "UNAUTHORIZED", details: {} });
+        return;
+      }
+      next();
+    };
+  }
+};
+function makeToolSpecRouter(spec, options = {}) {
+  const router = Router();
+  const path = options.path ?? "/tool-spec";
+  router.get(path, (_req, res, next) => {
+    Promise.resolve(typeof spec === "function" ? spec() : spec).then((result) => res.json(result)).catch(next);
+  });
+  return router;
+}
+function filesFor(dir, source) {
+  if (source === "500") return [join(dir, HTTP_500_LOG_FILE)];
+  if (source === "all") return Object.values(LEVEL_LOG_FILES).map((f) => join(dir, f));
+  return [join(dir, LEVEL_LOG_FILES[source])];
+}
+async function readEntries(files) {
+  const entries = [];
+  for (const file of files) {
+    let content;
+    try {
+      content = await readFile(file, "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of content.split("\n")) {
+      if (!line.trim()) continue;
+      try {
+        entries.push(JSON.parse(line));
+      } catch {
+      }
+    }
+  }
+  return entries;
+}
+function makeLogsRouter(options) {
+  const router = Router();
+  const path = options.path ?? "/logs";
+  const guards = options.guards ?? [];
+  const handler = (req, res, next) => {
+    const source = req.query.source ?? "all";
+    const validSources = ["all", "debug", "info", "warning", "error", "500"];
+    if (!validSources.includes(source)) {
+      res.status(422).json({ detail: "Invalid log source", code: "VALIDATION_ERROR", details: {} });
+      return;
+    }
+    const page2 = Math.max(1, Number(req.query.page) || 1);
+    const pageSize = Math.min(500, Math.max(1, Number(req.query.pageSize) || 50));
+    readEntries(filesFor(options.dir, source)).then((entries) => {
+      entries.reverse();
+      const total = entries.length;
+      const start = (page2 - 1) * pageSize;
+      res.json({
+        items: entries.slice(start, start + pageSize),
+        total,
+        page: page2,
+        pageSize,
+        pages: Math.ceil(total / pageSize)
+      });
+    }).catch(next);
+  };
+  router.get(path, ...guards, handler);
+  return router;
+}
+function createTestDatabase(models) {
+  const driver = NodeSqliteDriver.open(":memory:");
+  for (const model of models) {
+    const table = reflectTable(model);
+    for (const statement of renderOperation({ kind: "create_table", table }, "sqlite")) {
+      driver.execute(statement, []);
+    }
+  }
+  const asyncDriver = {
+    execute: (sql5, params) => Promise.resolve(driver.execute(sql5, params)),
+    close: () => {
+      driver.close();
+      return Promise.resolve();
+    }
+  };
+  const engine = new AsyncEngine(asyncDriver, "sqlite");
+  return {
+    engine,
+    session: () => engine.session(),
+    close: () => engine.close()
+  };
+}
+async function withTestDatabase(models, fn) {
+  const db = createTestDatabase(models);
+  try {
+    return await fn(db);
+  } finally {
+    await db.close();
+  }
+}
+
+export { ActivationService, AdminSite, AppException, AttemptThrottle, AuditAction, BaseAuditLogModel, BaseController, BaseModel, BaseOAuthClient, BaseOutboxModel, BaseService, BaseUserModel, BaseUserRefreshTokenModel, BaseUserTokenModel, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailProvider, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, GitHubOAuthClient, GoogleOAuthClient, GracefulShutdown, HTTPClient, HTTP_500_LOG_FILE, HTTP_500_MARKER, HttpMetrics, IDEMPOTENCY_HEADER, InvalidTokenException, JSONLogger, JWTUtils, LEVEL_LOG_FILES, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemoryIdempotencyStore, MemoryRateLimitStore, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MessagingHub, MetricsUtils, MfaService, NotFoundException, OAuthError, OIDCProvider, OutboxRelay, OutboxStatus, PHONE_BR_PATTERN, PasswordResetService, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisIdempotencyStore, RedisRateLimitStore, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, S3UploadStorage, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TenantScopedRepository, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, UserTokenPurpose, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WebhookSignatureVerifier, WhatsAppProvider, activationSchema, addLogSink, attachWebSocketHub, authResponseSchema, authSettingsShape, backupDatabase, bearerToken, bodySizeLimitMiddleware, broadcastText, buildContentDisposition, buildPaginationLinkHeader, cached2 as cached, centsField, cepField, citiesByUf, cnpjField, coerceFlag, configureFileLogging, configureLogging, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createTestDatabase, createdByColumn, csrfMiddleware, cursorPaginationFilterSchema, cursorPaginationSchema, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, diffSnapshots, emailSettingsShape, encodeCursor, envBoolean, envList, generateCsrfToken, generateOAuthState, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, hexColorField, idempotencyMiddleware, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, jwtSettingsShape, keyByHeader, keyByIp, keyByJwtClaim, keyByJwtSubject, latitudeField, listStates, logEntrySchema, logSettingsShape, loginSchema, longitudeField, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeLogsRouter, makeMetricsRouter, makeSessionMiddleware, makeToolSpecRouter, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, minioSettingsShape, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, nonEmptyStrField, nonNegativeFloatField, nonNegativeIntField, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, passwordResetConfirmSchema, passwordResetRequestSchema, percentField, phoneBrField, portField, positiveFloatField, positiveIntField, priceField, prometheusMiddleware, rabbitmqSettingsShape, rateLimitMiddleware, ratingField, ratioField, redisSettingsShape, refreshSchema, registerExceptionHandlers, renderAuthResultPage, renderPasswordResetFormPage, requestIdMiddleware, requestTracingMiddleware, requireRoles, resolveDownloadPath, runServer, runWithRequestContext, sendBytesDownload, sendFileDownload, sessionCookie, sessionSettingsShape, setRequestId, signupSchema, slugField, snapshot, sseResponse, statesByRegion, syncFilterSchema, syncPaginationSchema, tableNameFor, toUtc, tokenFromUrl, tokenPairSchema, tokenSettingsShape, ufField, updatedByColumn, uploadSettingsShape, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSettingsShape, webPushSubscriptionSchema, webSocketSettingsShape, withTestDatabase, wrapWithSlowQueryLog, wsEnvelopeSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map