@actuate-media/cms-core 0.36.0 → 0.37.0

package/dist/security/center/status.js

@@ -0,0 +1,249 @@
+const ADMIN_HREF = '/settings?tab=users';
+const API_KEYS_HREF = '/settings?tab=api-keys';
+const FAILED_LOGIN_WARN_THRESHOLD = 20;
+const LEVEL_COPY = {
+    secure: {
+        label: 'Secure',
+        description: 'Core protections are configured. Keep MFA coverage and API keys under review.',
+    },
+    needs_attention: {
+        label: 'Needs attention',
+        description: 'Some recommended controls are missing. Review the warnings below.',
+    },
+    at_risk: {
+        label: 'At risk',
+        description: 'Critical protections are missing or misconfigured. Resolve these before running in production.',
+    },
+    unknown: {
+        label: 'Unknown',
+        description: 'Security state could not be fully determined. Some services may be unavailable.',
+    },
+};
+export function computeSecurityStatus(input) {
+    const checks = [];
+    const warnings = [];
+    // ── MFA coverage ──────────────────────────────────────────────────────────
+    if (input.users.totalAdmins === 0) {
+        checks.push({ key: 'mfa', label: 'MFA coverage', status: 'unknown', value: 'No admins' });
+    }
+    else {
+        const allCovered = input.users.adminsWithoutMfa === 0;
+        const mfaStatus = allCovered ? 'pass' : input.settings.mfa.required ? 'fail' : 'warning';
+        checks.push({
+            key: 'mfa',
+            label: 'MFA coverage',
+            status: mfaStatus,
+            value: `${input.users.withMfa} of ${input.users.totalAdmins} admins`,
+            actionHref: ADMIN_HREF,
+        });
+        if (input.settings.mfa.required && input.users.adminsWithoutMfa > 0) {
+            warnings.push({
+                id: 'mfa-required-gap',
+                severity: 'critical',
+                category: 'auth',
+                title: 'Admins without MFA while MFA is required',
+                description: `${input.users.adminsWithoutMfa} admin account(s) have not set up MFA. They must enroll within the grace period.`,
+                actionLabel: 'Review users',
+                actionHref: ADMIN_HREF,
+            });
+        }
+        else if (!input.settings.mfa.required && input.isProduction) {
+            warnings.push({
+                id: 'mfa-not-required',
+                severity: 'warning',
+                category: 'auth',
+                title: 'MFA is not required in production',
+                description: 'Requiring MFA for admins significantly reduces account-takeover risk.',
+            });
+        }
+    }
+    // ── Active sessions (informational) ─────────────────────────────────────────
+    checks.push({
+        key: 'sessions',
+        label: 'Active admin sessions',
+        status: 'pass',
+        value: String(input.activeSessions),
+        actionHref: '/settings?tab=security&section=sessions',
+    });
+    // ── API keys ────────────────────────────────────────────────────────────────
+    const keyRisk = input.apiKeys.broadScope > 0
+        ? 'fail'
+        : input.apiKeys.withoutExpiration > 0 || input.apiKeys.staleUnused90d > 0
+            ? 'warning'
+            : 'pass';
+    checks.push({
+        key: 'api_keys',
+        label: 'High-risk API keys',
+        status: keyRisk === 'pass' ? 'pass' : keyRisk,
+        value: keyRisk === 'pass' ? `${input.apiKeys.active} active` : describeKeyRisk(input.apiKeys),
+        actionHref: API_KEYS_HREF,
+    });
+    if (input.apiKeys.broadScope > 0) {
+        warnings.push({
+            id: 'api-keys-broad',
+            severity: 'warning',
+            category: 'api_keys',
+            title: 'API keys with broad scopes',
+            description: `${input.apiKeys.broadScope} key(s) hold admin or full read/write scope. Scope keys to the minimum required.`,
+            actionLabel: 'Review API keys',
+            actionHref: API_KEYS_HREF,
+        });
+    }
+    if (input.apiKeys.withoutExpiration > 0) {
+        warnings.push({
+            id: 'api-keys-no-expiry',
+            severity: 'info',
+            category: 'api_keys',
+            title: 'API keys without expiration',
+            description: `${input.apiKeys.withoutExpiration} key(s) never expire. Consider setting an expiry.`,
+            actionLabel: 'Review API keys',
+            actionHref: API_KEYS_HREF,
+        });
+    }
+    // ── Failed logins (24h) ──────────────────────────────────────────────────────
+    const loginStatus = input.failedLogins24h >= FAILED_LOGIN_WARN_THRESHOLD ? 'warning' : 'pass';
+    checks.push({
+        key: 'failed_logins',
+        label: 'Failed logins (24h)',
+        status: loginStatus,
+        value: String(input.failedLogins24h),
+    });
+    if (loginStatus === 'warning') {
+        warnings.push({
+            id: 'failed-logins-spike',
+            severity: 'warning',
+            category: 'auth',
+            title: 'Elevated failed login attempts',
+            description: `${input.failedLogins24h} failed logins in the last 24h. This may indicate a brute-force attempt.`,
+        });
+    }
+    // ── CSRF ──────────────────────────────────────────────────────────────────────
+    checks.push({
+        key: 'csrf',
+        label: 'CSRF protection',
+        status: input.csrfEnabled ? 'pass' : 'fail',
+        value: input.csrfEnabled ? 'Enabled' : 'Disabled',
+    });
+    if (!input.csrfEnabled) {
+        warnings.push({
+            id: 'csrf-disabled',
+            severity: 'critical',
+            category: 'access',
+            title: 'CSRF protection disabled',
+            description: 'State-changing requests are not CSRF-protected. This exposes the admin to cross-site request forgery.',
+        });
+    }
+    // ── Rate limiting ──────────────────────────────────────────────────────────────
+    const distributed = input.secrets.rateLimitBackend === 'distributed';
+    checks.push({
+        key: 'rate_limit',
+        label: 'Rate limiting',
+        status: distributed ? 'pass' : 'warning',
+        value: distributed ? 'Distributed (Upstash)' : 'In-memory',
+    });
+    if (!distributed && input.isProduction) {
+        warnings.push({
+            id: 'rate-limit-in-memory',
+            severity: 'warning',
+            category: 'rate_limit',
+            title: 'Rate limiting is in-memory',
+            description: 'Without Upstash/Redis, rate limits are per-process and ineffective across serverless invocations. Configure UPSTASH_REDIS_REST_URL.',
+        });
+    }
+    // ── Upload validation ───────────────────────────────────────────────────────
+    checks.push({
+        key: 'uploads',
+        label: 'Upload validation',
+        status: input.uploadValidation ? 'pass' : 'warning',
+        value: input.uploadValidation ? 'MIME + magic bytes + SVG sanitization' : 'Unknown',
+    });
+    // ── Secrets / encryption ─────────────────────────────────────────────────────
+    checks.push({
+        key: 'cms_secret',
+        label: 'CMS secret',
+        status: input.secrets.cmsSecret,
+        value: secretValueLabel(input.secrets.cmsSecret),
+    });
+    if (input.secrets.cmsSecret === 'fail') {
+        warnings.push({
+            id: 'cms-secret-missing',
+            severity: 'critical',
+            category: 'secrets',
+            title: 'CMS_SECRET is missing or weak',
+            description: 'Session JWTs cannot be signed securely. Set a 32+ character CMS_SECRET.',
+        });
+    }
+    checks.push({
+        key: 'encryption_key',
+        label: 'Encryption key',
+        status: input.secrets.encryptionKey,
+        value: secretValueLabel(input.secrets.encryptionKey),
+    });
+    if (input.secrets.encryptionKey === 'fail') {
+        warnings.push({
+            id: 'encryption-key',
+            severity: input.isProduction ? 'critical' : 'warning',
+            category: 'secrets',
+            title: 'Encryption key not configured',
+            description: 'CMS_ENCRYPTION_KEY (64 hex chars) is required to encrypt secrets at rest (webhook secrets, OAuth tokens, TOTP secrets).',
+        });
+    }
+    // ── Audit logging ──────────────────────────────────────────────────────────────
+    checks.push({
+        key: 'audit',
+        label: 'Audit logging',
+        status: input.auditEnabled ? 'pass' : 'warning',
+        value: input.auditEnabled ? 'Enabled' : 'Disabled',
+        actionHref: '/settings?tab=security&section=audit',
+    });
+    // ── Roll up level + score ────────────────────────────────────────────────────
+    const hasCritical = warnings.some((w) => w.severity === 'critical');
+    const hasWarning = warnings.some((w) => w.severity === 'warning');
+    const unknown = input.secrets.cmsSecret === 'unknown';
+    let level;
+    if (unknown)
+        level = 'unknown';
+    else if (hasCritical)
+        level = 'at_risk';
+    else if (hasWarning)
+        level = 'needs_attention';
+    else
+        level = 'secure';
+    let score = 100;
+    for (const w of warnings) {
+        score -= w.severity === 'critical' ? 30 : w.severity === 'warning' ? 12 : 3;
+    }
+    score = Math.max(0, Math.min(100, score));
+    return {
+        status: level,
+        score,
+        label: LEVEL_COPY[level].label,
+        description: LEVEL_COPY[level].description,
+        checks,
+        warnings,
+        lastCheckedAt: new Date().toISOString(),
+    };
+}
+function describeKeyRisk(k) {
+    const parts = [];
+    if (k.broadScope > 0)
+        parts.push(`${k.broadScope} broad-scope`);
+    if (k.withoutExpiration > 0)
+        parts.push(`${k.withoutExpiration} no expiry`);
+    if (k.staleUnused90d > 0)
+        parts.push(`${k.staleUnused90d} stale`);
+    return parts.join(', ') || 'OK';
+}
+function secretValueLabel(status) {
+    switch (status) {
+        case 'pass':
+            return 'Configured';
+        case 'warning':
+            return 'Not configured';
+        case 'fail':
+            return 'Missing / invalid';
+        default:
+            return 'Unknown';
+    }
+}
+//# sourceMappingURL=status.js.map

package/dist/security/center/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/security/center/status.ts"],"names":[],"mappings":"AAeA,MAAM,UAAU,GAAG,qBAAqB,CAAA;AACxC,MAAM,aAAa,GAAG,wBAAwB,CAAA;AAE9C,MAAM,2BAA2B,GAAG,EAAE,CAAA;AAEtC,MAAM,UAAU,GAAwE;IACtF,MAAM,EAAE;QACN,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,+EAA+E;KAC7F;IACD,eAAe,EAAE;QACf,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,mEAAmE;KACjF;IACD,OAAO,EAAE;QACP,KAAK,EAAE,SAAS;QAChB,WAAW,EACT,gGAAgG;KACnG;IACD,OAAO,EAAE;QACP,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,iFAAiF;KAC/F;CACF,CAAA;AAED,MAAM,UAAU,qBAAqB,CAAC,KAA0B;IAC9D,MAAM,MAAM,GAAoB,EAAE,CAAA;IAClC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IAEtC,6EAA6E;IAC7E,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IAC3F,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;QACxF,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,EAAE,KAAK;YACV,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,SAAS;YACpE,UAAU,EAAE,UAAU;SACvB,CAAC,CAAA;QACF,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,0CAA0C;gBACjD,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,kFAAkF;gBAC9H,WAAW,EAAE,cAAc;gBAC3B,UAAU,EAAE,UAAU;aACvB,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,mCAAmC;gBAC1C,WAAW,EAAE,uEAAuE;aACrF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;QACnC,UAAU,EAAE,yCAAyC;KACtD,CAAC,CAAA;IAEF,+EAA+E;IAC/E,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC;QAC1B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC;YACvE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAA;IACd,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QAC7C,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7F,UAAU,EAAE,aAAa;KAC1B,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,gBAAgB;YACpB,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,kFAAkF;YAC1H,WAAW,EAAE,iBAAiB;YAC9B,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,oBAAoB;YACxB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,6BAA6B;YACpC,WAAW,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,mDAAmD;YAClG,WAAW,EAAE,iBAAiB;YAC9B,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAA;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,WAAW,GAAG,KAAK,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;IAC7F,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,qBAAqB;QAC5B,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;KACrC,CAAC,CAAA;IACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,qBAAqB;YACzB,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,GAAG,KAAK,CAAC,eAAe,0EAA0E;SAChH,CAAC,CAAA;IACJ,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,iBAAiB;QACxB,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC3C,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;KAClD,CAAC,CAAA;IACF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,eAAe;YACnB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,0BAA0B;YACjC,WAAW,EACT,uGAAuG;SAC1G,CAAC,CAAA;IACJ,CAAC;IAED,kFAAkF;IAClF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,KAAK,aAAa,CAAA;IACpE,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACxC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,WAAW;KAC3D,CAAC,CAAA;IACF,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,sBAAsB;YAC1B,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EACT,qIAAqI;SACxI,CAAC,CAAA;IACJ,CAAC;IAED,+EAA+E;IAC/E,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,mBAAmB;QAC1B,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACnD,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,SAAS;KACpF,CAAC,CAAA;IAEF,gFAAgF;IAChF,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAC/B,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;KACjD,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,oBAAoB;YACxB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,+BAA+B;YACtC,WAAW,EAAE,yEAAyE;SACvF,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;QACnC,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;KACrD,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,gBAAgB;YACpB,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACrD,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,+BAA+B;YACtC,WAAW,EACT,yHAAyH;SAC5H,CAAC,CAAA;IACJ,CAAC;IAED,kFAAkF;IAClF,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC/C,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QAClD,UAAU,EAAE,sCAAsC;KACnD,CAAC,CAAA;IAEF,gFAAgF;IAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAA;IACnE,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAA;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAA;IAErD,IAAI,KAA0B,CAAA;IAC9B,IAAI,OAAO;QAAE,KAAK,GAAG,SAAS,CAAA;SACzB,IAAI,WAAW;QAAE,KAAK,GAAG,SAAS,CAAA;SAClC,IAAI,UAAU;QAAE,KAAK,GAAG,iBAAiB,CAAA;;QACzC,KAAK,GAAG,QAAQ,CAAA;IAErB,IAAI,KAAK,GAAG,GAAG,CAAA;IACf,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7E,CAAC;IACD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IAEzC,OAAO;QACL,MAAM,EAAE,KAAK;QACb,KAAK;QACL,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK;QAC9B,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW;QAC1C,MAAM;QACN,QAAQ;QACR,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACxC,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAIxB;IACC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,cAAc,CAAC,CAAA;IAC/D,IAAI,CAAC,CAAC,iBAAiB,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,YAAY,CAAC,CAAA;IAC3E,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,QAAQ,CAAC,CAAA;IACjE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA+B;IACvD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,YAAY,CAAA;QACrB,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAA;QACzB,KAAK,MAAM;YACT,OAAO,mBAAmB,CAAA;QAC5B;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC"}

package/dist/security/center/summaries.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Pure cross-module risk summaries (users + API keys).
+ *
+ * Take already-fetched rows so they can be unit-tested without a DB. The
+ * gatherer queries the minimal columns and hands them here.
+ */
+import type { ApiKeysSecuritySummary, UsersSecuritySummary } from './types.js';
+export interface UserRow {
+    role: string;
+    isActive: boolean;
+    totpEnabled: boolean;
+}
+export declare function summarizeUsers(rows: UserRow[]): UsersSecuritySummary;
+export interface ApiKeyRow {
+    scopes: unknown;
+    expiresAt: Date | string | null;
+    lastUsedAt: Date | string | null;
+    revokedAt: Date | string | null;
+}
+export declare function summarizeApiKeys(rows: ApiKeyRow[], now?: number): ApiKeysSecuritySummary;
+//# sourceMappingURL=summaries.d.ts.map

package/dist/security/center/summaries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"summaries.d.ts","sourceRoot":"","sources":["../../../src/security/center/summaries.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE9E,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;CACrB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAwBpE;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAC/B,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,SAAS,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CAChC;AAgBD,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,EAAE,EACjB,GAAG,GAAE,MAAmB,GACvB,sBAAsB,CAgBxB"}

package/dist/security/center/summaries.js

@@ -0,0 +1,65 @@
+export function summarizeUsers(rows) {
+    let totalAdmins = 0;
+    let withMfa = 0;
+    let adminsWithoutMfa = 0;
+    let withoutMfa = 0;
+    let inactive = 0;
+    for (const u of rows) {
+        if (!u.isActive)
+            inactive++;
+        if (!u.totpEnabled)
+            withoutMfa++;
+        const isAdmin = u.role === 'ADMIN';
+        if (isAdmin) {
+            totalAdmins++;
+            if (u.totpEnabled)
+                withMfa++;
+            else if (u.isActive)
+                adminsWithoutMfa++;
+        }
+    }
+    return {
+        totalUsers: rows.length,
+        totalAdmins,
+        withMfa,
+        withoutMfa,
+        adminsWithoutMfa,
+        inactive,
+    };
+}
+const STALE_MS = 90 * 24 * 60 * 60 * 1000;
+/** A key is "broad" if it carries the admin scope (full control). */
+function isBroadScope(scopes) {
+    if (!scopes || typeof scopes !== 'object')
+        return false;
+    return scopes.admin === true;
+}
+function toTime(v) {
+    if (!v)
+        return null;
+    const t = v instanceof Date ? v.getTime() : new Date(v).getTime();
+    return Number.isFinite(t) ? t : null;
+}
+export function summarizeApiKeys(rows, now = Date.now()) {
+    let active = 0;
+    let withoutExpiration = 0;
+    let broadScope = 0;
+    let staleUnused90d = 0;
+    for (const k of rows) {
+        if (k.revokedAt)
+            continue;
+        const exp = toTime(k.expiresAt);
+        if (exp !== null && exp <= now)
+            continue; // expired ⇒ not active
+        active++;
+        if (exp === null)
+            withoutExpiration++;
+        if (isBroadScope(k.scopes))
+            broadScope++;
+        const used = toTime(k.lastUsedAt);
+        if (used !== null && now - used > STALE_MS)
+            staleUnused90d++;
+    }
+    return { active, withoutExpiration, broadScope, staleUnused90d };
+}
+//# sourceMappingURL=summaries.js.map

package/dist/security/center/summaries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"summaries.js","sourceRoot":"","sources":["../../../src/security/center/summaries.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,cAAc,CAAC,IAAe;IAC5C,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,gBAAgB,GAAG,CAAC,CAAA;IACxB,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,QAAQ,EAAE,CAAA;QAC3B,IAAI,CAAC,CAAC,CAAC,WAAW;YAAE,UAAU,EAAE,CAAA;QAChC,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO,CAAA;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,WAAW,EAAE,CAAA;YACb,IAAI,CAAC,CAAC,WAAW;gBAAE,OAAO,EAAE,CAAA;iBACvB,IAAI,CAAC,CAAC,QAAQ;gBAAE,gBAAgB,EAAE,CAAA;QACzC,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,WAAW;QACX,OAAO;QACP,UAAU;QACV,gBAAgB;QAChB,QAAQ;KACT,CAAA;AACH,CAAC;AASD,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEzC,qEAAqE;AACrE,SAAS,YAAY,CAAC,MAAe;IACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACvD,OAAQ,MAAkC,CAAC,KAAK,KAAK,IAAI,CAAA;AAC3D,CAAC;AAED,SAAS,MAAM,CAAC,CAAuB;IACrC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;IACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAiB,EACjB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,iBAAiB,GAAG,CAAC,CAAA;IACzB,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,SAAS;YAAE,SAAQ;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC/B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG;YAAE,SAAQ,CAAC,uBAAuB;QAChE,MAAM,EAAE,CAAA;QACR,IAAI,GAAG,KAAK,IAAI;YAAE,iBAAiB,EAAE,CAAA;QACrC,IAAI,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,UAAU,EAAE,CAAA;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;QACjC,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,QAAQ;YAAE,cAAc,EAAE,CAAA;IAC9D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,EAAE,CAAA;AAClE,CAAC"}

package/dist/security/center/types.d.ts

@@ -0,0 +1,127 @@
+/**
+ * Security Center types.
+ *
+ * The Security Center answers one question for an operator: "is this CMS safe
+ * to run in production?" It is mostly a *computed posture* surface — it reads
+ * real auth/session/secret/audit state — plus a small set of genuinely
+ * enforced, persisted policy settings (MFA requirement, concurrent-session
+ * cap). Anything that is not actually enforced is reported as honest status
+ * with a source badge, never as a decorative toggle.
+ */
+export type SecurityStatusLevel = 'secure' | 'needs_attention' | 'at_risk' | 'unknown';
+export type CheckStatus = 'pass' | 'warning' | 'fail' | 'unknown';
+export interface SecurityCheck {
+    key: string;
+    label: string;
+    status: CheckStatus;
+    /** Short human value, e.g. "3 of 4 admins" or "Enabled". */
+    value?: string;
+    /** In-admin deep link the operator can follow to act on this check. */
+    actionHref?: string;
+}
+export type SecurityWarningCategory = 'auth' | 'sessions' | 'api_keys' | 'uploads' | 'rate_limit' | 'audit' | 'secrets' | 'access';
+export interface SecurityWarning {
+    id: string;
+    severity: 'critical' | 'warning' | 'info';
+    category: SecurityWarningCategory;
+    title: string;
+    description: string;
+    actionLabel?: string;
+    actionHref?: string;
+}
+export interface SecurityStatus {
+    status: SecurityStatusLevel;
+    /** 0–100 posture score (advisory; the level is the source of truth). */
+    score: number;
+    label: string;
+    description: string;
+    checks: SecurityCheck[];
+    warnings: SecurityWarning[];
+    lastCheckedAt: string;
+}
+/** Persisted, enforced MFA policy. */
+export interface MfaSettings {
+    required: boolean;
+    gracePeriodDays: number;
+    /** ISO timestamp when `required` was last switched on (drives the grace window). */
+    requiredAt?: string;
+}
+/** Persisted, enforced session policy. `maxConcurrentSessions = 0` ⇒ unlimited. */
+export interface SessionSettings {
+    maxConcurrentSessions: number;
+}
+export interface SecuritySettings {
+    mfa: MfaSettings;
+    session: SessionSettings;
+    updatedAt?: string;
+    updatedBy?: string;
+}
+export interface UsersSecuritySummary {
+    totalUsers: number;
+    totalAdmins: number;
+    withMfa: number;
+    withoutMfa: number;
+    adminsWithoutMfa: number;
+    inactive: number;
+}
+export interface ApiKeysSecuritySummary {
+    active: number;
+    withoutExpiration: number;
+    broadScope: number;
+    staleUnused90d: number;
+}
+/** Status of secrets/encryption — never the values themselves. */
+export interface SecretsStatus {
+    cmsSecret: CheckStatus;
+    encryptionKey: CheckStatus;
+    rateLimitBackend: 'distributed' | 'in_memory';
+    apiKeysHashed: boolean;
+    webhookSecretsEncrypted: boolean;
+}
+export interface IpAllowlistStatus {
+    enabled: boolean;
+    source: 'config' | 'none';
+    ranges: string[];
+    currentIp: string | null;
+    currentIpAllowed: boolean | null;
+}
+export interface SecuritySourceMetadata {
+    source: 'config' | 'environment' | 'database' | 'plugin' | 'computed';
+    editable: boolean;
+    reason?: string;
+}
+/** Everything the admin Security tab needs in one round-trip. */
+export interface SecurityCenterData {
+    settings: SecuritySettings;
+    status: SecurityStatus;
+    users: UsersSecuritySummary;
+    apiKeys: ApiKeysSecuritySummary;
+    secrets: SecretsStatus;
+    ipAllowlist: IpAllowlistStatus;
+    failedLogins24h: number;
+    activeSessions: number;
+    csrfEnabled: boolean;
+    uploadValidation: boolean;
+    auditEnabled: boolean;
+    /** Effective max session age in hours (config/default; read-only today). */
+    sessionMaxAgeHours: number;
+    /** Whether the current admin (the viewer) has TOTP enabled — drives lockout-safe MFA enable. */
+    viewerHasMfa: boolean;
+    environment: string;
+    sources: Record<string, SecuritySourceMetadata>;
+}
+/** Signals consumed by the pure {@link computeSecurityStatus}. */
+export interface SecurityStatusInput {
+    isProduction: boolean;
+    settings: SecuritySettings;
+    users: UsersSecuritySummary;
+    apiKeys: ApiKeysSecuritySummary;
+    secrets: SecretsStatus;
+    ipAllowlist: IpAllowlistStatus;
+    failedLogins24h: number;
+    activeSessions: number;
+    csrfEnabled: boolean;
+    uploadValidation: boolean;
+    auditEnabled: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/security/center/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/security/center/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,iBAAiB,GAAG,SAAS,GAAG,SAAS,CAAA;AACtF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAA;AAEjE,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,WAAW,CAAA;IACnB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,MAAM,uBAAuB,GAC/B,MAAM,GACN,UAAU,GACV,UAAU,GACV,SAAS,GACT,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,CAAA;AAEZ,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAA;IACzC,QAAQ,EAAE,uBAAuB,CAAA;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,mBAAmB,CAAA;IAC3B,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,aAAa,EAAE,CAAA;IACvB,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,qBAAqB,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,WAAW,CAAA;IAChB,OAAO,EAAE,eAAe,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,iBAAiB,EAAE,MAAM,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,WAAW,CAAA;IACtB,aAAa,EAAE,WAAW,CAAA;IAC1B,gBAAgB,EAAE,aAAa,GAAG,WAAW,CAAA;IAC7C,aAAa,EAAE,OAAO,CAAA;IACtB,uBAAuB,EAAE,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAA;IACrE,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,MAAM,EAAE,cAAc,CAAA;IACtB,KAAK,EAAE,oBAAoB,CAAA;IAC3B,OAAO,EAAE,sBAAsB,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,WAAW,EAAE,iBAAiB,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,OAAO,CAAA;IACzB,YAAY,EAAE,OAAO,CAAA;IACrB,4EAA4E;IAC5E,kBAAkB,EAAE,MAAM,CAAA;IAC1B,gGAAgG;IAChG,YAAY,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;CAChD;AAED,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,OAAO,CAAA;IACrB,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,KAAK,EAAE,oBAAoB,CAAA;IAC3B,OAAO,EAAE,sBAAsB,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,WAAW,EAAE,iBAAiB,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,OAAO,CAAA;IACzB,YAAY,EAAE,OAAO,CAAA;CACtB"}

package/dist/security/center/types.js

@@ -0,0 +1,12 @@
+/**
+ * Security Center types.
+ *
+ * The Security Center answers one question for an operator: "is this CMS safe
+ * to run in production?" It is mostly a *computed posture* surface — it reads
+ * real auth/session/secret/audit state — plus a small set of genuinely
+ * enforced, persisted policy settings (MFA requirement, concurrent-session
+ * cap). Anything that is not actually enforced is reported as honest status
+ * with a source badge, never as a decorative toggle.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/security/center/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/security/center/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/cms-core",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/actuate-media/actuatecms.git",
@@ -59,6 +59,11 @@
       "import": "./dist/appearance/index.js",
       "default": "./dist/appearance/index.js"
     },
+    "./security-center": {
+      "types": "./dist/security/center/index.d.ts",
+      "import": "./dist/security/center/index.js",
+      "default": "./dist/security/center/index.js"
+    },
     "./page-builder": {
       "types": "./dist/page-builder/index.d.ts",
       "import": "./dist/page-builder/index.js",