tempest-express-sdk 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,4 +1,4 @@
-export { VERSION } from './chunk-6QNSLBL3.js';
+export { VERSION } from './chunk-6ZKN2ELQ.js';
 import { AsyncLocalStorage } from 'async_hooks';
 import { extendZodWithOpenApi, OpenAPIRegistry, OpenApiGeneratorV31, OpenApiGeneratorV3 } from '@asteasolutions/zod-to-openapi';
 export { OpenAPIRegistry } from '@asteasolutions/zod-to-openapi';
@@ -6,7 +6,8 @@ import { z, ZodError } from 'zod';
 export { z } from 'zod';
 import { Model, column, sql } from 'tempest-db-js';
 export { AsyncEngine, AsyncResult, AsyncSession, BaseRepository, Column, DeleteBuilder, InsertBuilder, Model, NoResultError, NodeSqliteDriver, PostgresDialect, RecordNotFound, SelectBuilder, SqliteDialect, SyncEngine, SyncSession, UpdateBuilder, and, belongsTo, column, columnsOf, createEngine, createSyncEngine, del, detectDialect, getDialect, hasMany, insert, join, loadRelations, not, or, parseDatabaseUrl, select, sql, update } from 'tempest-db-js';
-import { createHash, randomBytes, timingSafeEqual, randomUUID } from 'crypto';
+import { createHash, randomBytes, timingSafeEqual, randomUUID, createHmac } from 'crypto';
+import { cpus, loadavg, totalmem, freemem } from 'os';
 import { mkdir, writeFile, readFile, rm } from 'fs/promises';
 import { join, dirname } from 'path';
 import express2, { Router } from 'express';
@@ -6752,6 +6753,361 @@ var AttemptThrottle = class {
   }
 };
 
+// src/utils/clientIp.ts
+var UNKNOWN = "unknown";
+function getClientIp(req, options = {}) {
+  if (options.trustedHeader) {
+    const value = req.header(options.trustedHeader);
+    if (value) return value.trim();
+  }
+  return req.socket?.remoteAddress ?? req.ip ?? UNKNOWN;
+}
+var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function base32Encode(bytes) {
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (const byte of bytes) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += BASE32_ALPHABET[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) out += BASE32_ALPHABET[value << 5 - bits & 31];
+  return out;
+}
+function base32Decode(secret) {
+  const clean = secret.toUpperCase().replace(/=+$/, "").replace(/\s/g, "");
+  let bits = 0;
+  let value = 0;
+  const out = [];
+  for (const char of clean) {
+    const index = BASE32_ALPHABET.indexOf(char);
+    if (index === -1) continue;
+    value = value << 5 | index;
+    bits += 5;
+    if (bits >= 8) {
+      out.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(out);
+}
+function hotp(secret, counter, digits) {
+  const buffer = Buffer.alloc(8);
+  buffer.writeUInt32BE(Math.floor(counter / 2 ** 32), 0);
+  buffer.writeUInt32BE(counter >>> 0, 4);
+  const digest = createHmac("sha1", secret).update(buffer).digest();
+  const offset = digest[digest.length - 1] & 15;
+  const binary = (digest[offset] & 127) << 24 | (digest[offset + 1] & 255) << 16 | (digest[offset + 2] & 255) << 8 | digest[offset + 3] & 255;
+  return (binary % 10 ** digits).toString().padStart(digits, "0");
+}
+var TOTPHelper = class {
+  issuer;
+  step;
+  digits;
+  /**
+   * @param options - Issuer label, time step and digit count.
+   */
+  constructor(options) {
+    this.issuer = options.issuer;
+    this.step = options.step ?? 30;
+    this.digits = options.digits ?? 6;
+  }
+  /**
+   * Generate a fresh base32 secret (80 bits).
+   *
+   * @returns A base32-encoded TOTP secret to persist on the user row.
+   */
+  generateSecret() {
+    return base32Encode(randomBytes(10));
+  }
+  /**
+   * Build the `otpauth://` provisioning URI (render as a QR code).
+   *
+   * @param secret - The base32 secret.
+   * @param accountName - Identifier shown next to the issuer (e.g. the email).
+   * @returns The `otpauth://totp/...` URI.
+   */
+  provisioningUri(secret, accountName) {
+    const label = encodeURIComponent(`${this.issuer}:${accountName}`);
+    const params = new URLSearchParams({
+      secret,
+      issuer: this.issuer,
+      algorithm: "SHA1",
+      digits: String(this.digits),
+      period: String(this.step)
+    });
+    return `otpauth://totp/${label}?${params.toString()}`;
+  }
+  /**
+   * Verify a code against the secret for the current time window.
+   *
+   * @param secret - The base32 secret.
+   * @param code - The submitted code.
+   * @param window - Tolerance in steps (±). Default 1 (previous/current/next).
+   * @returns `true` when the code matches within the window.
+   */
+  verify(secret, code, window = 1) {
+    const cleaned = code.trim().replace(/[\s-]/g, "");
+    if (!/^\d+$/.test(cleaned) || cleaned.length !== this.digits) return false;
+    const key = base32Decode(secret);
+    const counter = Math.floor(Date.now() / 1e3 / this.step);
+    for (let offset = -window; offset <= window; offset++) {
+      if (hotp(key, counter + offset, this.digits) === cleaned) return true;
+    }
+    return false;
+  }
+};
+
+// src/utils/httpClient.ts
+var CircuitOpenError = class extends Error {
+  constructor(host) {
+    super(`Circuit breaker is open for host ${host}`);
+    this.host = host;
+    this.name = "CircuitOpenError";
+  }
+  host;
+};
+var RetryPolicy = class {
+  /**
+   * @param maxRetries - Additional attempts after the first. Default 2.
+   * @param baseDelayMs - Base backoff in ms (doubles each attempt). Default 100.
+   * @param retryOn - HTTP status codes that trigger a retry. Default 5xx + 429.
+   */
+  constructor(maxRetries = 2, baseDelayMs = 100, retryOn = [429, 500, 502, 503, 504]) {
+    this.maxRetries = maxRetries;
+    this.baseDelayMs = baseDelayMs;
+    this.retryOn = retryOn;
+  }
+  maxRetries;
+  baseDelayMs;
+  retryOn;
+  /** Backoff delay in ms before `attempt` (0-indexed). */
+  sleepFor(attempt) {
+    return this.baseDelayMs * 2 ** attempt;
+  }
+};
+var HTTPClient = class {
+  baseUrl;
+  defaultHeaders;
+  timeoutMs;
+  retryPolicy;
+  breakerThreshold;
+  breakerCooldownMs;
+  breakers = /* @__PURE__ */ new Map();
+  /**
+   * @param options - Base URL, headers, timeout, retry and breaker settings.
+   */
+  constructor(options = {}) {
+    this.baseUrl = options.baseUrl ?? "";
+    this.defaultHeaders = options.defaultHeaders ?? {};
+    this.timeoutMs = options.timeoutMs ?? 3e4;
+    this.retryPolicy = options.retryPolicy ?? new RetryPolicy();
+    this.breakerThreshold = options.breakerThreshold ?? 5;
+    this.breakerCooldownMs = options.breakerCooldownMs ?? 3e4;
+  }
+  resolve(url) {
+    return this.baseUrl && !/^https?:\/\//.test(url) ? `${this.baseUrl}${url}` : url;
+  }
+  hostOf(url) {
+    try {
+      return new URL(url).host;
+    } catch {
+      return url;
+    }
+  }
+  breakerCheck(host) {
+    const state = this.breakers.get(host);
+    if (state && state.openUntil > Date.now()) throw new CircuitOpenError(host);
+  }
+  breakerRecord(host, failed) {
+    const state = this.breakers.get(host) ?? { failures: 0, openUntil: 0 };
+    if (failed) {
+      state.failures += 1;
+      if (state.failures >= this.breakerThreshold) {
+        state.openUntil = Date.now() + this.breakerCooldownMs;
+        state.failures = 0;
+      }
+    } else {
+      state.failures = 0;
+      state.openUntil = 0;
+    }
+    this.breakers.set(host, state);
+  }
+  /**
+   * Perform a request with retries and breaker protection.
+   *
+   * @param method - HTTP method.
+   * @param url - Absolute URL or a path resolved against `baseUrl`.
+   * @param init - Extra `fetch` init (headers, body, …).
+   * @returns The `Response`.
+   * @throws {CircuitOpenError} When the per-host breaker is open.
+   */
+  async request(method, url, init = {}) {
+    const target = this.resolve(url);
+    const host = this.hostOf(target);
+    this.breakerCheck(host);
+    let lastError;
+    for (let attempt = 0; attempt <= this.retryPolicy.maxRetries; attempt++) {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+      try {
+        const response = await fetch(target, {
+          ...init,
+          method,
+          headers: { ...this.defaultHeaders, ...init.headers ?? {} },
+          signal: controller.signal
+        });
+        clearTimeout(timer);
+        if (this.retryPolicy.retryOn.includes(response.status)) {
+          this.breakerRecord(host, true);
+          if (attempt < this.retryPolicy.maxRetries) {
+            await this.sleep(this.retryPolicy.sleepFor(attempt));
+            continue;
+          }
+          return response;
+        }
+        this.breakerRecord(host, false);
+        return response;
+      } catch (error) {
+        clearTimeout(timer);
+        lastError = error;
+        this.breakerRecord(host, true);
+        if (attempt < this.retryPolicy.maxRetries) {
+          await this.sleep(this.retryPolicy.sleepFor(attempt));
+          continue;
+        }
+      }
+    }
+    throw lastError instanceof Error ? lastError : new Error("Request failed");
+  }
+  sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+  /** GET request. */
+  get(url, init) {
+    return this.request("GET", url, init);
+  }
+  /** POST request. */
+  post(url, init) {
+    return this.request("POST", url, init);
+  }
+  /** PUT request. */
+  put(url, init) {
+    return this.request("PUT", url, init);
+  }
+  /** PATCH request. */
+  patch(url, init) {
+    return this.request("PATCH", url, init);
+  }
+  /** DELETE request. */
+  delete(url, init) {
+    return this.request("DELETE", url, init);
+  }
+};
+function readCpu() {
+  const cores = cpus().length;
+  const load1 = loadavg()[0] ?? 0;
+  return {
+    cores,
+    load1,
+    loadPercent: cores > 0 ? load1 / cores * 100 : 0
+  };
+}
+function readMemory() {
+  const total = totalmem();
+  const free = freemem();
+  const used = total - free;
+  return {
+    total,
+    free,
+    used,
+    usedPercent: total > 0 ? used / total * 100 : 0,
+    processRss: process.memoryUsage().rss
+  };
+}
+function readSystem() {
+  return {
+    cpu: readCpu(),
+    memory: readMemory(),
+    uptimeSeconds: process.uptime()
+  };
+}
+function toPrometheus(snapshot = readSystem()) {
+  const lines = [
+    "# HELP process_cpu_load_percent 1-minute load average as percent of cores",
+    "# TYPE process_cpu_load_percent gauge",
+    `process_cpu_load_percent ${snapshot.cpu.loadPercent}`,
+    "# HELP process_memory_used_percent System memory used percent",
+    "# TYPE process_memory_used_percent gauge",
+    `process_memory_used_percent ${snapshot.memory.usedPercent}`,
+    "# HELP process_memory_rss_bytes Resident set size of the process",
+    "# TYPE process_memory_rss_bytes gauge",
+    `process_memory_rss_bytes ${snapshot.memory.processRss}`,
+    "# HELP process_uptime_seconds Process uptime in seconds",
+    "# TYPE process_uptime_seconds counter",
+    `process_uptime_seconds ${snapshot.uptimeSeconds}`
+  ];
+  return `${lines.join("\n")}
+`;
+}
+var MetricsUtils = {
+  cpu: readCpu,
+  memory: readMemory,
+  system: readSystem,
+  toPrometheus
+};
+
+// src/utils/email.ts
+var EmailUtils = class {
+  /**
+   * @param options - SMTP connection and default sender.
+   */
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  transport = null;
+  async ready() {
+    if (this.transport) return this.transport;
+    let nodemailer;
+    try {
+      const mod = await import('nodemailer');
+      nodemailer = mod.default ?? mod;
+    } catch (cause) {
+      throw new Error(
+        "EmailUtils requires the 'nodemailer' peer dependency. Install with `npm i nodemailer`.",
+        { cause }
+      );
+    }
+    this.transport = nodemailer.createTransport({
+      host: this.options.host,
+      port: this.options.port ?? 587,
+      secure: this.options.secure ?? false,
+      ...this.options.user ? { auth: { user: this.options.user, pass: this.options.password ?? "" } } : {}
+    });
+    return this.transport;
+  }
+  /**
+   * Send an email message.
+   *
+   * @param message - The message (recipients, subject, body).
+   */
+  async send(message) {
+    const transport = await this.ready();
+    await transport.sendMail({
+      from: message.from ?? this.options.from,
+      to: message.to,
+      subject: message.subject,
+      ...message.text !== void 0 ? { text: message.text } : {},
+      ...message.html !== void 0 ? { html: message.html } : {}
+    });
+  }
+};
+
 // src/cache/manager.ts
 var MemoryCacheManager = class {
   store = /* @__PURE__ */ new Map();
@@ -7592,6 +7948,84 @@ function buildContentDisposition(filename, inline = false) {
   return `${disposition}; filename*=UTF-8''${encoded}`;
 }
 
+// src/webpush/schemas.ts
+var webPushKeysSchema = z.object({
+  p256dh: z.string().openapi({ description: "Client public key (base64url)." }),
+  auth: z.string().openapi({ description: "Client auth secret (base64url)." })
+}).openapi("WebPushKeys");
+var webPushSubscriptionSchema = z.object({
+  endpoint: z.string().url().openapi({ description: "Push service endpoint URL." }),
+  keys: webPushKeysSchema
+}).openapi("WebPushSubscription");
+var webPushPayloadSchema = z.object({
+  title: z.string().openapi({ description: "Notification title." }),
+  body: z.string().optional().openapi({ description: "Notification body." }),
+  url: z.string().optional().openapi({ description: "URL opened on click." }),
+  data: z.record(z.unknown()).optional().openapi({ description: "Extra data." })
+}).openapi("WebPushPayload");
+
+// src/webpush/dispatcher.ts
+var WebPushError = class extends Error {
+  constructor(message, statusCode) {
+    super(message);
+    this.statusCode = statusCode;
+    this.name = "WebPushError";
+  }
+  statusCode;
+};
+var WebPushGoneError = class extends WebPushError {
+  constructor(statusCode) {
+    super("Push subscription is gone", statusCode);
+    this.name = "WebPushGoneError";
+  }
+};
+var cached4 = null;
+async function loadWebPush() {
+  if (cached4) return cached4;
+  try {
+    const mod = await import('web-push');
+    cached4 = mod.default ?? mod;
+  } catch (cause) {
+    throw new Error(
+      "WebPushDispatcher requires the 'web-push' peer dependency. Install with `npm i web-push`.",
+      { cause }
+    );
+  }
+  return cached4;
+}
+var WebPushDispatcher = class {
+  /**
+   * @param options - VAPID keys and subject.
+   */
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  /**
+   * Send a payload to a single subscription.
+   *
+   * @param subscription - The browser push subscription.
+   * @param payload - The notification payload.
+   * @throws {WebPushGoneError} When the subscription is expired (410/404).
+   * @throws {WebPushError} On any other delivery failure.
+   */
+  async send(subscription, payload) {
+    const webpush = await loadWebPush();
+    webpush.setVapidDetails(
+      this.options.subject,
+      this.options.publicKey,
+      this.options.privateKey
+    );
+    try {
+      await webpush.sendNotification(subscription, JSON.stringify(payload));
+    } catch (error) {
+      const status = error.statusCode;
+      if (status === 404 || status === 410) throw new WebPushGoneError(status);
+      throw new WebPushError(error.message, status);
+    }
+  }
+};
+
 // src/auth/schemas.ts
 var signupSchema = z.object({
   email: z.string().email().openapi({ description: "Login identifier (email)." }),
@@ -8103,6 +8537,6 @@ function runServer(app, options = {}) {
   });
 }
 
-export { AppException, AttemptThrottle, BaseController, BaseModel, BaseService, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, HTTP_500_MARKER, InvalidTokenException, JSONLogger, JWTUtils, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, NotFoundException, PHONE_BR_PATTERN, PasswordUtils, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, Region, SSEBroker, ServerSentEvent, SessionService, TaskManager, TooManyRequestsException, UF, UnauthorizedException, UserAuthService, ValidationException, WebSocketHub, attachWebSocketHub, authResponseSchema, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, buildContentDisposition, cached3 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createdByColumn, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, encodeCursor, generateOpaqueToken, generateOpenApiDocument, getAuth, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, listStates, loadSettings, loginSchema, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeSessionMiddleware, makeUnhandledExceptionHandler, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, phoneBrField, refreshSchema, registerExceptionHandlers, requestIdMiddleware, requireRoles, runServer, runWithRequestContext, serverSettingsShape, sessionCookie, setRequestId, signupSchema, sseResponse, statesByRegion, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, ufField, updatedByColumn, userPublicSchema, utcnow, verifyOpaqueToken, wsEnvelopeSchema };
+export { AppException, AttemptThrottle, BaseController, BaseModel, BaseService, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, HTTPClient, HTTP_500_MARKER, InvalidTokenException, JSONLogger, JWTUtils, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MetricsUtils, NotFoundException, PHONE_BR_PATTERN, PasswordUtils, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, Region, RetryPolicy, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TooManyRequestsException, UF, UnauthorizedException, UserAuthService, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, attachWebSocketHub, authResponseSchema, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, buildContentDisposition, cached3 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createdByColumn, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, encodeCursor, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, listStates, loadSettings, loginSchema, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeSessionMiddleware, makeUnhandledExceptionHandler, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, phoneBrField, refreshSchema, registerExceptionHandlers, requestIdMiddleware, requireRoles, runServer, runWithRequestContext, serverSettingsShape, sessionCookie, setRequestId, signupSchema, sseResponse, statesByRegion, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, ufField, updatedByColumn, userPublicSchema, utcnow, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSubscriptionSchema, wsEnvelopeSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map