tempest-express-sdk 0.8.0 → 0.10.0

package/dist/index.js

@@ -1,4 +1,4 @@
-export { VERSION } from './chunk-JWJJAIXV.js';
+export { VERSION } from './chunk-U3SXT3KR.js';
 import { AsyncLocalStorage } from 'async_hooks';
 import { extendZodWithOpenApi, OpenAPIRegistry, OpenApiGeneratorV31, OpenApiGeneratorV3 } from '@asteasolutions/zod-to-openapi';
 export { OpenAPIRegistry } from '@asteasolutions/zod-to-openapi';
@@ -7,7 +7,9 @@ export { z } from 'zod';
 import { Model, column, sql } from 'tempest-db-js';
 export { AsyncEngine, AsyncResult, AsyncSession, BaseRepository, Column, DeleteBuilder, InsertBuilder, Model, NoResultError, NodeSqliteDriver, PostgresDialect, RecordNotFound, SelectBuilder, SqliteDialect, SyncEngine, SyncSession, UpdateBuilder, and, belongsTo, column, columnsOf, createEngine, createSyncEngine, del, detectDialect, getDialect, hasMany, insert, join, loadRelations, not, or, parseDatabaseUrl, select, sql, update } from 'tempest-db-js';
 import { createHash, randomBytes, timingSafeEqual, randomUUID, createHmac } from 'crypto';
+import { execFile } from 'child_process';
 import { cpus, loadavg, totalmem, freemem } from 'os';
+import { promisify } from 'util';
 import { mkdir, writeFile, readFile, rm } from 'fs/promises';
 import { join, dirname } from 'path';
 import express2, { Router } from 'express';
@@ -7008,6 +7010,7 @@ var HTTPClient = class {
     return this.request("DELETE", url, init);
   }
 };
+var execFileAsync = promisify(execFile);
 function readCpu() {
   const cores = cpus().length;
   const load1 = loadavg()[0] ?? 0;
@@ -7036,7 +7039,27 @@ function readSystem() {
     uptimeSeconds: process.uptime()
   };
 }
-function toPrometheus(snapshot = readSystem()) {
+async function readGpus() {
+  try {
+    const { stdout } = await execFileAsync("nvidia-smi", [
+      "--query-gpu=index,utilization.gpu,memory.used,memory.total,temperature.gpu",
+      "--format=csv,noheader,nounits"
+    ]);
+    return stdout.trim().split("\n").filter((line) => line.trim().length > 0).map((line) => {
+      const [index, util, used, total, temp] = line.split(",").map((v) => Number(v.trim()));
+      return {
+        index: index ?? 0,
+        utilizationPercent: util ?? 0,
+        memoryUsedMb: used ?? 0,
+        memoryTotalMb: total ?? 0,
+        temperatureC: temp ?? 0
+      };
+    });
+  } catch {
+    return [];
+  }
+}
+function toPrometheus(snapshot = readSystem(), gpus = []) {
   const lines = [
     "# HELP process_cpu_load_percent 1-minute load average as percent of cores",
     "# TYPE process_cpu_load_percent gauge",
@@ -7051,6 +7074,29 @@ function toPrometheus(snapshot = readSystem()) {
     "# TYPE process_uptime_seconds counter",
     `process_uptime_seconds ${snapshot.uptimeSeconds}`
   ];
+  if (gpus.length > 0) {
+    lines.push(
+      "# HELP gpu_utilization_percent GPU utilization percent",
+      "# TYPE gpu_utilization_percent gauge"
+    );
+    for (const gpu of gpus) {
+      lines.push(`gpu_utilization_percent{gpu="${gpu.index}"} ${gpu.utilizationPercent}`);
+    }
+    lines.push(
+      "# HELP gpu_memory_used_mb GPU memory used in MiB",
+      "# TYPE gpu_memory_used_mb gauge"
+    );
+    for (const gpu of gpus) {
+      lines.push(`gpu_memory_used_mb{gpu="${gpu.index}"} ${gpu.memoryUsedMb}`);
+    }
+    lines.push(
+      "# HELP gpu_temperature_celsius GPU core temperature",
+      "# TYPE gpu_temperature_celsius gauge"
+    );
+    for (const gpu of gpus) {
+      lines.push(`gpu_temperature_celsius{gpu="${gpu.index}"} ${gpu.temperatureC}`);
+    }
+  }
   return `${lines.join("\n")}
 `;
 }
@@ -7058,6 +7104,7 @@ var MetricsUtils = {
   cpu: readCpu,
   memory: readMemory,
   system: readSystem,
+  gpus: readGpus,
   toPrometheus
 };
 
@@ -8534,6 +8581,50 @@ function makeTwilioWebhookRouter(options) {
   return router;
 }
 
+// src/integrations/email.ts
+var EmailProvider = class {
+  email;
+  subject;
+  /**
+   * @param options - The email sender and default subject.
+   */
+  constructor(options) {
+    this.email = options.email;
+    this.subject = options.subject ?? "Notification";
+  }
+  /**
+   * Send a plain-text email.
+   *
+   * @param to - Recipient address.
+   * @param text - Body text (also used as HTML).
+   * @returns A sent result.
+   */
+  async sendText(to, text) {
+    await this.email.send({ to, subject: this.subject, text });
+    return { status: "sent" };
+  }
+  /**
+   * Send an email linking to the media (caption becomes the lead text).
+   *
+   * @param to - Recipient address.
+   * @param media - The media reference (URL) + optional caption.
+   * @returns A sent result.
+   */
+  async sendMedia(to, media) {
+    const caption = media.caption ?? "";
+    await this.email.send({
+      to,
+      subject: this.subject,
+      html: `${caption ? `<p>${caption}</p>` : ""}<p><a href="${media.media}">${media.media}</a></p>`
+    });
+    return { status: "sent" };
+  }
+  /** Always `"connected"` — SMTP reachability is verified on first send. */
+  async status() {
+    return "connected";
+  }
+};
+
 // src/admin/site.ts
 var AdminSite = class {
   /**
@@ -8673,6 +8764,10 @@ var mfaEnrollResponseSchema = z.object({
   otpauthUri: z.string().openapi({ description: "otpauth:// URI to render as QR." })
 }).openapi("MfaEnrollResponse");
 var mfaCodeSchema = z.object({ code: z.string().min(1).openapi({ description: "Authenticator code." }) }).openapi("MfaCode");
+var mfaChallengeSchema = z.object({
+  mfaToken: z.string().min(1).openapi({ description: "Challenge token from login." }),
+  code: z.string().min(1).openapi({ description: "Authenticator code." })
+}).openapi("MfaChallenge");
 var activationSchema = z.object({ token: z.string().min(1).openapi({ description: "Activation token." }) }).openapi("Activation");
 var passwordResetRequestSchema = z.object({ email: z.string().email().openapi({ description: "Account email." }) }).openapi("PasswordResetRequest");
 var passwordResetConfirmSchema = z.object({
@@ -8697,6 +8792,8 @@ var UserAuthService = class {
   passwordMinLength;
   accessTtlSeconds;
   refreshTtlSeconds;
+  mfa;
+  mfaChallengeTtlSeconds;
   /**
    * @param options - Store, password/JWT helpers and token policy.
    */
@@ -8707,6 +8804,8 @@ var UserAuthService = class {
     this.passwordMinLength = options.passwordMinLength ?? 12;
     this.accessTtlSeconds = options.accessTtlSeconds ?? 3600;
     this.refreshTtlSeconds = options.refreshTtlSeconds ?? 60 * 60 * 24 * 14;
+    this.mfa = options.mfa;
+    this.mfaChallengeTtlSeconds = options.mfaChallengeTtlSeconds ?? 300;
   }
   /** Mint a signed access + refresh token pair for `user`. */
   async issueTokens(user) {
@@ -8756,7 +8855,7 @@ var UserAuthService = class {
    * Authenticate a user by email + password.
    *
    * @param data - Validated login payload.
-   * @returns The public user and a fresh token pair.
+   * @returns Full auth, or an {@link MfaChallenge} when MFA is enabled.
    * @throws {UnauthorizedException} On bad credentials or inactive account.
    */
   async login(data) {
@@ -8768,6 +8867,37 @@ var UserAuthService = class {
     if (!user.isActive) {
       throw new UnauthorizedException({ message: "Account is inactive" });
     }
+    if (this.mfa && await this.mfa.isEnabled(user.id)) {
+      const mfaToken = await this.jwt.encode(
+        { sub: user.id, type: "mfa" },
+        { ttlSeconds: this.mfaChallengeTtlSeconds }
+      );
+      return { mfaRequired: true, mfaToken };
+    }
+    return { user: toPublic(user), tokens: await this.issueTokens(user) };
+  }
+  /**
+   * Complete an MFA login challenge: verify the code and issue tokens.
+   *
+   * @param mfaToken - The challenge token from {@link login}.
+   * @param code - The authenticator code.
+   * @returns The public user and a fresh token pair.
+   * @throws {UnauthorizedException} When the challenge/code is invalid, MFA is
+   *   not configured, or the account no longer exists / is inactive.
+   */
+  async verifyMfaChallenge(mfaToken, code) {
+    if (!this.mfa) throw new UnauthorizedException({ message: "MFA not configured" });
+    const claims = await this.jwt.decodeOrNull(mfaToken);
+    if (!claims || claims.type !== "mfa" || typeof claims.sub !== "string") {
+      throw new UnauthorizedException({ message: "Invalid MFA challenge" });
+    }
+    if (!await this.mfa.verify(claims.sub, code)) {
+      throw new UnauthorizedException({ message: "Invalid MFA code" });
+    }
+    const user = await this.store.findById(claims.sub);
+    if (!user || !user.isActive) {
+      throw new UnauthorizedException({ message: "Account is inactive" });
+    }
     return { user: toPublic(user), tokens: await this.issueTokens(user) };
   }
   /**
@@ -8841,6 +8971,15 @@ var MfaService = class {
     const secret = await this.store.getSecret(userId);
     return secret ? this.totp.verify(secret, code) : false;
   }
+  /**
+   * Whether MFA is enabled for a user (used to gate the login challenge).
+   *
+   * @param userId - The user.
+   * @returns `true` when MFA is enabled.
+   */
+  async isEnabled(userId) {
+    return this.store.isEnabled(userId);
+  }
   /**
    * Disable MFA after verifying a code.
    *
@@ -9088,6 +9227,10 @@ function makeAuthRouter(options) {
   }
   if (options.mfa) {
     const mfa = options.mfa;
+    router.post(`${prefix}/mfa/challenge`, async (req, res) => {
+      const { mfaToken, code } = mfaChallengeSchema.parse(req.body);
+      res.json(await service.verifyMfaChallenge(mfaToken, code));
+    });
     const requireUser = (req) => {
       const claims = getAuth(req);
       if (!claims || typeof claims.sub !== "string") {
@@ -9314,6 +9457,16 @@ function makeHealthRouter(options = {}) {
   });
   return router;
 }
+function makeMetricsRouter(options = {}) {
+  const path = options.path ?? "/metrics";
+  const router = Router();
+  if (options.guard) router.use(path, options.guard);
+  router.get(path, async (_req, res) => {
+    const gpus = options.includeGpu ? await MetricsUtils.gpus() : [];
+    res.type("text/plain").send(MetricsUtils.toPrometheus(MetricsUtils.system(), gpus));
+  });
+  return router;
+}
 var logger3 = new JSONLogger("tempest_express_sdk.api.server");
 function corsMiddleware(origins) {
   const allowAll = origins === "*";
@@ -9379,6 +9532,6 @@ function runServer(app, options = {}) {
   });
 }
 
-export { ActivationService, AdminSite, AppException, AttemptThrottle, BaseController, BaseModel, BaseService, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, HTTPClient, HTTP_500_MARKER, InvalidTokenException, JSONLogger, JWTUtils, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MetricsUtils, MfaService, NotFoundException, PHONE_BR_PATTERN, PasswordResetService, PasswordUtils, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WhatsAppProvider, activationSchema, attachWebSocketHub, authResponseSchema, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, buildContentDisposition, cached3 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createdByColumn, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, encodeCursor, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, listStates, loadSettings, loginSchema, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeSessionMiddleware, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaCodeSchema, mfaEnrollResponseSchema, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, refreshSchema, registerExceptionHandlers, requestIdMiddleware, requireRoles, runServer, runWithRequestContext, serverSettingsShape, sessionCookie, setRequestId, signupSchema, sseResponse, statesByRegion, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, ufField, updatedByColumn, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSubscriptionSchema, wsEnvelopeSchema };
+export { ActivationService, AdminSite, AppException, AttemptThrottle, BaseController, BaseModel, BaseService, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailProvider, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, HTTPClient, HTTP_500_MARKER, InvalidTokenException, JSONLogger, JWTUtils, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MetricsUtils, MfaService, NotFoundException, PHONE_BR_PATTERN, PasswordResetService, PasswordUtils, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WhatsAppProvider, activationSchema, attachWebSocketHub, authResponseSchema, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, buildContentDisposition, cached3 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createdByColumn, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, encodeCursor, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, listStates, loadSettings, loginSchema, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeMetricsRouter, makeSessionMiddleware, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, refreshSchema, registerExceptionHandlers, requestIdMiddleware, requireRoles, runServer, runWithRequestContext, serverSettingsShape, sessionCookie, setRequestId, signupSchema, sseResponse, statesByRegion, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, ufField, updatedByColumn, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSubscriptionSchema, wsEnvelopeSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map