@actuate-media/cms-core 0.36.0 → 0.38.0

package/dist/auth/totp.d.ts

@@ -1,5 +1,17 @@
 export declare function generateTOTPSecret(): string;
 export declare function generateTOTPUri(secret: string, email: string, issuer?: string): string;
 export declare function verifyTOTP(token: string, secret: string, window?: number): boolean;
+/**
+ * Normalize a user-entered backup code: strip whitespace/dashes and lowercase
+ * so "ABCD-1234" and "abcd 1234" both match the stored "abcd1234".
+ */
+export declare function normalizeBackupCode(input: string): string;
+/**
+ * Find the index of the stored backup code matching the submitted value, or -1.
+ * Compares against every stored code in constant time so timing can't reveal
+ * which/whether a code matched. Callers must treat a match as single-use and
+ * remove the code from storage.
+ */
+export declare function findBackupCodeMatch(codes: string[], submitted: string): number;
 export declare function generateBackupCodes(count?: number): string[];
 //# sourceMappingURL=totp.d.ts.map

package/dist/auth/totp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/auth/totp.ts"],"names":[],"mappings":"AAKA,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,SAAgB,GAAG,MAAM,CAE7F;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,OAAO,CAQ7E;AAkED,wBAAgB,mBAAmB,CAAC,KAAK,SAAI,GAAG,MAAM,EAAE,CAavD"}
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/auth/totp.ts"],"names":[],"mappings":"AAKA,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,SAAgB,GAAG,MAAM,CAE7F;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,OAAO,CAQ7E;AAkED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQ9E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,SAAI,GAAG,MAAM,EAAE,CAavD"}

package/dist/auth/totp.js

@@ -77,6 +77,30 @@ function base32Decode(encoded) {
     }
     return Buffer.from(output);
 }
+/**
+ * Normalize a user-entered backup code: strip whitespace/dashes and lowercase
+ * so "ABCD-1234" and "abcd 1234" both match the stored "abcd1234".
+ */
+export function normalizeBackupCode(input) {
+    return input.replace(/[\s-]/g, '').toLowerCase();
+}
+/**
+ * Find the index of the stored backup code matching the submitted value, or -1.
+ * Compares against every stored code in constant time so timing can't reveal
+ * which/whether a code matched. Callers must treat a match as single-use and
+ * remove the code from storage.
+ */
+export function findBackupCodeMatch(codes, submitted) {
+    const normalized = normalizeBackupCode(submitted);
+    if (!normalized)
+        return -1;
+    let matchIdx = -1;
+    for (let i = 0; i < codes.length; i++) {
+        if (timingSafeEqual(codes[i].toLowerCase(), normalized))
+            matchIdx = i;
+    }
+    return matchIdx;
+}
 export function generateBackupCodes(count = 8) {
     const codes = [];
     for (let i = 0; i < count; i++) {

package/dist/auth/totp.js.map

@@ -1 +1 @@
-{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/auth/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAEnC,MAAM,WAAW,GAAG,EAAE,CAAA;AACtB,MAAM,WAAW,GAAG,CAAC,CAAA;AAErB,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,YAAY,CAAC,KAAK,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,KAAa,EAAE,MAAM,GAAG,aAAa;IACnF,OAAO,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,WAAW,MAAM,WAAW,kBAAkB,CAAC,MAAM,CAAC,0BAA0B,WAAW,WAAW,WAAW,EAAE,CAAA;AACrM,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,MAAc,EAAE,MAAM,GAAG,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,WAAW,CAAC,CAAA;QACjE,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC9C,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAA;IACnD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,OAAe;IACnD,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,IAAI,CAAA;QAC1B,OAAO,GAAG,OAAO,IAAI,CAAC,CAAA;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACnB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAA;IAChD,MAAM,IAAI,GACR,CAAC,CAAC,MAAM,CAAC,MAAM,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,CAAA;IAC9B,OAAO,MAAM,CAAC,IAAI,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;AACpE,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAA;AACrB,CAAC;AAED,MAAM,YAAY,GAAG,kCAAkC,CAAA;AAEvD,SAAS,YAAY,CAAC,IAAgB;IACpC,IAAI,IAAI,GAAG,CAAC,EACV,KAAK,GAAG,CAAC,EACT,MAAM,GAAG,EAAE,CAAA;IACb,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;QAC3B,IAAI,IAAI,CAAC,CAAA;QACT,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;YACnD,IAAI,IAAI,CAAC,CAAA;QACX,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IAChE,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACxD,IAAI,IAAI,GAAG,CAAC,EACV,KAAK,GAAG,CAAC,CAAA;IACX,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,SAAQ;QACxB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAA;QAC1B,IAAI,IAAI,CAAC,CAAA;QACT,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;YAC1C,IAAI,IAAI,CAAC,CAAA;QACX,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAK,GAAG,CAAC;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAC7B,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CACf,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/auth/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAEnC,MAAM,WAAW,GAAG,EAAE,CAAA;AACtB,MAAM,WAAW,GAAG,CAAC,CAAA;AAErB,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,YAAY,CAAC,KAAK,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,KAAa,EAAE,MAAM,GAAG,aAAa;IACnF,OAAO,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,WAAW,MAAM,WAAW,kBAAkB,CAAC,MAAM,CAAC,0BAA0B,WAAW,WAAW,WAAW,EAAE,CAAA;AACrM,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,MAAc,EAAE,MAAM,GAAG,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,WAAW,CAAC,CAAA;QACjE,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC9C,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAA;IACnD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,OAAe;IACnD,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,IAAI,CAAA;QAC1B,OAAO,GAAG,OAAO,IAAI,CAAC,CAAA;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACnB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAA;IAChD,MAAM,IAAI,GACR,CAAC,CAAC,MAAM,CAAC,MAAM,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,CAAA;IAC9B,OAAO,MAAM,CAAC,IAAI,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;AACpE,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAA;AACrB,CAAC;AAED,MAAM,YAAY,GAAG,kCAAkC,CAAA;AAEvD,SAAS,YAAY,CAAC,IAAgB;IACpC,IAAI,IAAI,GAAG,CAAC,EACV,KAAK,GAAG,CAAC,EACT,MAAM,GAAG,EAAE,CAAA;IACb,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;QAC3B,IAAI,IAAI,CAAC,CAAA;QACT,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;YACnD,IAAI,IAAI,CAAC,CAAA;QACX,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IAChE,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACxD,IAAI,IAAI,GAAG,CAAC,EACV,KAAK,GAAG,CAAC,CAAA;IACX,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,SAAQ;QACxB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAA;QAC1B,IAAI,IAAI,CAAC,CAAA;QACT,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;YAC1C,IAAI,IAAI,CAAC,CAAA;QACX,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAe,EAAE,SAAiB;IACpE,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAA;IACjD,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,CAAC,CAAA;IAC1B,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAA;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,UAAU,CAAC;YAAE,QAAQ,GAAG,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAK,GAAG,CAAC;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAC7B,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CACf,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/security/center/gather.d.ts

@@ -0,0 +1,12 @@
+import type { SecuritySettings, SecurityCenterData } from './types.js';
+/** Read the persisted, enforced security policy from the `settings` global. */
+export declare function getStoredSecuritySettings(db: unknown): Promise<SecuritySettings>;
+export interface GatherOptions {
+    db: unknown;
+    /** Acting admin's user id (for the lockout-safe MFA enable check). */
+    userId?: string;
+    /** Resolved client IP of the request (for the allowlist indicator). */
+    currentIp?: string | null;
+}
+export declare function getSecurityCenterData(opts: GatherOptions): Promise<SecurityCenterData>;
+//# sourceMappingURL=gather.d.ts.map

package/dist/security/center/gather.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather.d.ts","sourceRoot":"","sources":["../../../src/security/center/gather.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAGV,gBAAgB,EAChB,kBAAkB,EAEnB,MAAM,YAAY,CAAA;AAmCnB,+EAA+E;AAC/E,wBAAsB,yBAAyB,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYtF;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsJ5F"}

package/dist/security/center/gather.js

@@ -0,0 +1,185 @@
+/**
+ * Security Center data gathering (async, DB + env I/O).
+ *
+ * Reads real auth/session/secret/audit state and composes the
+ * {@link SecurityCenterData} the admin tab renders. Never returns secret
+ * values — only configured/missing verdicts.
+ */
+import { getActuateConfig } from '../../config/runtime.js';
+import { validateEnvShape } from '../../diagnostics/env.js';
+import { isIpAllowed } from '../ip-allowlist.js';
+import { parseSecuritySettings } from './settings.js';
+import { computeSecurityStatus } from './status.js';
+import { summarizeApiKeys, summarizeUsers } from './summaries.js';
+function hasModel(db, model) {
+    return Boolean(db && typeof db === 'object' && db[model]);
+}
+function isProductionEnv() {
+    return (process.env.VERCEL_ENV ?? process.env.NODE_ENV) === 'production';
+}
+function envSeverityToCheck(s) {
+    switch (s) {
+        case 'ok':
+            return 'pass';
+        case 'warn':
+            return 'warning';
+        case 'error':
+        case 'missing':
+            return 'fail';
+        default:
+            return 'unknown';
+    }
+}
+/** Read the persisted, enforced security policy from the `settings` global. */
+export async function getStoredSecuritySettings(db) {
+    const d = db;
+    if (!hasModel(d, 'document'))
+        return parseSecuritySettings({});
+    try {
+        const row = await d.document.findFirst({
+            where: { collection: 'settings', deletedAt: null },
+            select: { data: true },
+        });
+        return parseSecuritySettings(row?.data ?? {});
+    }
+    catch {
+        return parseSecuritySettings({});
+    }
+}
+export async function getSecurityCenterData(opts) {
+    const d = opts.db;
+    const isProduction = isProductionEnv();
+    const now = Date.now();
+    const settings = await getStoredSecuritySettings(opts.db);
+    const userRows = hasModel(d, 'user')
+        ? await d
+            .user.findMany({ select: { role: true, isActive: true, totpEnabled: true } })
+            .catch(() => [])
+        : [];
+    const users = summarizeUsers(userRows);
+    let viewerHasMfa = false;
+    if (opts.userId && hasModel(d, 'user')) {
+        const viewer = await d
+            .user.findUnique({
+            where: { id: opts.userId },
+            select: { totpEnabled: true },
+        })
+            .catch(() => null);
+        viewerHasMfa = Boolean(viewer?.totpEnabled);
+    }
+    const activeSessions = hasModel(d, 'session')
+        ? await d
+            .session.count({ where: { revokedAt: null, expiresAt: { gt: new Date() } } })
+            .catch(() => 0)
+        : 0;
+    const apiKeyRows = hasModel(d, 'apiKey')
+        ? await d
+            .apiKey.findMany({
+            select: { scopes: true, expiresAt: true, lastUsedAt: true, revokedAt: true },
+        })
+            .catch(() => [])
+        : [];
+    const apiKeys = summarizeApiKeys(apiKeyRows, now);
+    const since = new Date(now - 24 * 60 * 60 * 1000);
+    const failedLogins24h = hasModel(d, 'auditLog')
+        ? await d
+            .auditLog.count({ where: { event: 'login_failed', timestamp: { gte: since } } })
+            .catch(() => 0)
+        : 0;
+    // ── Secrets / encryption (verdicts only, never values) ───────────────────────
+    const env = validateEnvShape();
+    const byName = new Map(env.checks.map((c) => [c.name, c]));
+    const config = getActuateConfig();
+    const configSecret = typeof config?.secret === 'string' && config.secret.length >= 32;
+    let cmsSecret = envSeverityToCheck(byName.get('CMS_SECRET')?.status ?? 'missing');
+    if (cmsSecret === 'fail' && configSecret)
+        cmsSecret = 'pass';
+    const encRaw = byName.get('CMS_ENCRYPTION_KEY')?.status ?? 'warn';
+    // A *missing* key is only a hard failure in production; elsewhere it's a warning.
+    let encryptionKey = envSeverityToCheck(encRaw);
+    if (encRaw === 'warn' && isProduction)
+        encryptionKey = 'fail';
+    const upstash = byName.get('UPSTASH_REDIS_REST_URL')?.status;
+    const rateLimitBackend = upstash === 'ok' ? 'distributed' : 'in_memory';
+    const secrets = {
+        cmsSecret,
+        encryptionKey,
+        rateLimitBackend,
+        apiKeysHashed: true,
+        webhookSecretsEncrypted: encryptionKey === 'pass',
+    };
+    // ── IP allowlist (config-driven; middleware enforces) ────────────────────────
+    const ranges = Array.isArray(config?.admin?.ipAllowlist)
+        ? config.admin.ipAllowlist
+        : [];
+    const currentIp = opts.currentIp ?? null;
+    const ipAllowlist = {
+        enabled: ranges.length > 0,
+        source: (ranges.length > 0 ? 'config' : 'none'),
+        ranges,
+        currentIp,
+        currentIpAllowed: ranges.length > 0 && currentIp ? isIpAllowed(currentIp, ranges) : null,
+    };
+    const sessionMaxAgeHours = 24 * 7; // login issues a fixed 7-day session today
+    const status = computeSecurityStatus({
+        isProduction,
+        settings,
+        users,
+        apiKeys,
+        secrets,
+        ipAllowlist,
+        failedLogins24h,
+        activeSessions,
+        csrfEnabled: true,
+        uploadValidation: true,
+        auditEnabled: true,
+    });
+    const editable = { source: 'database', editable: true };
+    const sources = {
+        mfaRequired: editable,
+        mfaGracePeriodDays: editable,
+        maxConcurrentSessions: editable,
+        sessionMaxAgeHours: {
+            source: 'computed',
+            editable: false,
+            reason: 'Sessions are issued with a fixed 7-day lifetime.',
+        },
+        ipAllowlist: {
+            source: 'config',
+            editable: false,
+            reason: 'Set admin.ipAllowlist in actuate.config.ts; enforced in middleware.',
+        },
+        csrf: { source: 'computed', editable: false, reason: 'Always enabled for mutating requests.' },
+        rateLimiting: {
+            source: 'environment',
+            editable: false,
+            reason: 'Backend is selected from UPSTASH_REDIS_REST_URL / KV_REST_API_URL.',
+        },
+        uploadValidation: {
+            source: 'computed',
+            editable: false,
+            reason: 'Always enforced server-side.',
+        },
+        cmsSecret: { source: 'environment', editable: false },
+        encryptionKey: { source: 'environment', editable: false },
+        audit: { source: 'computed', editable: false, reason: 'Always enabled.' },
+    };
+    return {
+        settings,
+        status,
+        users,
+        apiKeys,
+        secrets,
+        ipAllowlist,
+        failedLogins24h,
+        activeSessions,
+        csrfEnabled: true,
+        uploadValidation: true,
+        auditEnabled: true,
+        sessionMaxAgeHours,
+        viewerHasMfa,
+        environment: process.env.VERCEL_ENV ?? process.env.NODE_ENV ?? 'development',
+        sources,
+    };
+}
+//# sourceMappingURL=gather.js.map

package/dist/security/center/gather.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather.js","sourceRoot":"","sources":["../../../src/security/center/gather.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,0BAA0B,CAAA;AAClF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAgC,MAAM,gBAAgB,CAAA;AAoB/F,SAAS,QAAQ,CAAyB,EAAU,EAAE,KAAQ;IAC5D,OAAO,OAAO,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAA;AAC1E,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAmB;IAC7C,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,IAAI;YACP,OAAO,MAAM,CAAA;QACf,KAAK,MAAM;YACT,OAAO,SAAS,CAAA;QAClB,KAAK,OAAO,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,MAAM,CAAA;QACf;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAAW;IACzD,MAAM,CAAC,GAAG,EAAY,CAAA;IACtB,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC;QAAE,OAAO,qBAAqB,CAAC,EAAE,CAAC,CAAA;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,QAAS,CAAC,SAAS,CAAC;YACtC,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE;YAClD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACvB,CAAC,CAAA;QACF,OAAO,qBAAqB,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qBAAqB,CAAC,EAAE,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAmB;IAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,EAAY,CAAA;IAC3B,MAAM,YAAY,GAAG,eAAe,EAAE,CAAA;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAEtB,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEzD,MAAM,QAAQ,GAAc,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC;aACJ,IAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;aAC7E,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACpB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IAEtC,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC;aACnB,IAAK,CAAC,UAAU,CAAC;YAChB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;YAC1B,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;SAC9B,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACpB,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC7C,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC;aACJ,OAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC;aAC7E,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC,CAAA;IAEL,MAAM,UAAU,GAAgB,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC;aACJ,MAAO,CAAC,QAAQ,CAAC;YAChB,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;SAC7E,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACpB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAEjD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACjD,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC;aACJ,QAAS,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;aAChF,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC,CAAA;IAEL,gFAAgF;IAChF,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;IACjC,MAAM,YAAY,GAAG,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IAErF,IAAI,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,IAAI,SAAS,CAAC,CAAA;IACjF,IAAI,SAAS,KAAK,MAAM,IAAI,YAAY;QAAE,SAAS,GAAG,MAAM,CAAA;IAE5D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,MAAM,IAAI,MAAM,CAAA;IACjE,kFAAkF;IAClF,IAAI,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAC9C,IAAI,MAAM,KAAK,MAAM,IAAI,YAAY;QAAE,aAAa,GAAG,MAAM,CAAA;IAE7D,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAA;IAC5D,MAAM,gBAAgB,GACpB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAA;IAEhD,MAAM,OAAO,GAAkB;QAC7B,SAAS;QACT,aAAa;QACb,gBAAgB;QAChB,aAAa,EAAE,IAAI;QACnB,uBAAuB,EAAE,aAAa,KAAK,MAAM;KAClD,CAAA;IAED,gFAAgF;IAChF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC;QACtD,CAAC,CAAE,MAAO,CAAC,KAAM,CAAC,WAAwB;QAC1C,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAA;IACxC,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;QAC1B,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAsB;QACpE,MAAM;QACN,SAAS;QACT,gBAAgB,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;KACzF,CAAA;IAED,MAAM,kBAAkB,GAAG,EAAE,GAAG,CAAC,CAAA,CAAC,2CAA2C;IAE7E,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACnC,YAAY;QACZ,QAAQ;QACR,KAAK;QACL,OAAO;QACP,OAAO;QACP,WAAW;QACX,eAAe;QACf,cAAc;QACd,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE,IAAI;KACnB,CAAC,CAAA;IAEF,MAAM,QAAQ,GAA2B,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC/E,MAAM,OAAO,GAA2C;QACtD,WAAW,EAAE,QAAQ;QACrB,kBAAkB,EAAE,QAAQ;QAC5B,qBAAqB,EAAE,QAAQ;QAC/B,kBAAkB,EAAE;YAClB,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,kDAAkD;SAC3D;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,qEAAqE;SAC9E;QACD,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE;QAC9F,YAAY,EAAE;YACZ,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,oEAAoE;SAC7E;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,8BAA8B;SACvC;QACD,SAAS,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;QACrD,aAAa,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;QACzD,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE;KAC1E,CAAA;IAED,OAAO;QACL,QAAQ;QACR,MAAM;QACN,KAAK;QACL,OAAO;QACP,OAAO;QACP,WAAW;QACX,eAAe;QACf,cAAc;QACd,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE,IAAI;QAClB,kBAAkB;QAClB,YAAY;QACZ,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa;QAC5E,OAAO;KACR,CAAA;AACH,CAAC"}

package/dist/security/center/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Security Center — public barrel.
+ *
+ * Exports the PURE pieces only (types, settings parse/validate, IP validation,
+ * status computation, cross-module summaries) so the admin client can import
+ * them without pulling in server-side DB/env code. The async gatherer
+ * (`gather.ts`) is imported directly by the API handlers, not re-exported here.
+ */
+export type { ApiKeysSecuritySummary, CheckStatus, IpAllowlistStatus, MfaSettings, SecretsStatus, SecurityCenterData, SecurityCheck, SecuritySettings, SecuritySourceMetadata, SecurityStatus, SecurityStatusInput, SecurityStatusLevel, SecurityWarning, SecurityWarningCategory, SessionSettings, UsersSecuritySummary, } from './types.js';
+export { DEFAULT_SECURITY_SETTINGS, MAX_CONCURRENT_SESSION_OPTIONS, MFA_GRACE_PERIOD_OPTIONS, mfaEnableLockoutError, parseSecuritySettings, validateIpRange, validateSecuritySettings, type SecurityValidationIssue, } from './settings.js';
+export { computeSecurityStatus } from './status.js';
+export { summarizeApiKeys, summarizeUsers, type ApiKeyRow, type UserRow } from './summaries.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/center/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/center/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,YAAY,EACV,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,eAAe,EACf,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,wBAAwB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/security/center/index.js

@@ -0,0 +1,4 @@
+export { DEFAULT_SECURITY_SETTINGS, MAX_CONCURRENT_SESSION_OPTIONS, MFA_GRACE_PERIOD_OPTIONS, mfaEnableLockoutError, parseSecuritySettings, validateIpRange, validateSecuritySettings, } from './settings.js';
+export { computeSecurityStatus } from './status.js';
+export { summarizeApiKeys, summarizeUsers } from './summaries.js';
+//# sourceMappingURL=index.js.map

package/dist/security/center/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/center/index.ts"],"names":[],"mappings":"AA2BA,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,wBAAwB,GAEzB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAgC,MAAM,gBAAgB,CAAA"}

package/dist/security/center/settings.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Security settings parsing + validation (pure).
+ *
+ * The persisted, enforced policy lives under the `security` key of the
+ * `settings` global. Only fields the runtime actually enforces are stored
+ * here (MFA requirement + grace, concurrent-session cap) so the UI never
+ * presents a control that does nothing.
+ */
+import type { SecuritySettings } from './types.js';
+export declare const DEFAULT_SECURITY_SETTINGS: SecuritySettings;
+export declare const MFA_GRACE_PERIOD_OPTIONS: readonly [0, 1, 7, 14, 30];
+export declare const MAX_CONCURRENT_SESSION_OPTIONS: readonly [0, 3, 5, 10];
+export interface SecurityValidationIssue {
+    field: string;
+    message: string;
+    severity: 'error' | 'warning';
+}
+/** Read the `security` blob off a settings document, coercing to a safe shape. */
+export declare function parseSecuritySettings(blob: unknown): SecuritySettings;
+/** Validate an incoming settings payload. Pure — no DB / lockout checks here. */
+export declare function validateSecuritySettings(settings: SecuritySettings): SecurityValidationIssue[];
+/**
+ * Lockout-safe MFA enable check. Enabling org-wide MFA while the acting admin
+ * has no TOTP configured would lock them (and possibly everyone) out. Callers
+ * MUST run this server-side before persisting `mfa.required = true`.
+ */
+export declare function mfaEnableLockoutError(input: {
+    enabling: boolean;
+    viewerHasMfa: boolean;
+    totalAdmins: number;
+}): string | null;
+/**
+ * Validate a single allowlist entry: an IPv4/IPv6 literal or a CIDR range.
+ * Standalone (does not import the matcher's private helpers) so it can run in
+ * the client bundle for inline form validation.
+ */
+export declare function validateIpRange(entry: string): boolean;
+//# sourceMappingURL=settings.d.ts.map

package/dist/security/center/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../../src/security/center/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,eAAO,MAAM,yBAAyB,EAAE,gBAGvC,CAAA;AAED,eAAO,MAAM,wBAAwB,4BAA6B,CAAA;AAClE,eAAO,MAAM,8BAA8B,wBAAyB,CAAA;AAEpE,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAA;CAC9B;AAOD,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAiCrE;AAcD,iFAAiF;AACjF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,uBAAuB,EAAE,CAmB9F;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAA;IACjB,YAAY,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;CACpB,GAAG,MAAM,GAAG,IAAI,CAMhB;AAKD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAatD"}

package/dist/security/center/settings.js

@@ -0,0 +1,121 @@
+export const DEFAULT_SECURITY_SETTINGS = {
+    mfa: { required: false, gracePeriodDays: 7 },
+    session: { maxConcurrentSessions: 5 },
+};
+export const MFA_GRACE_PERIOD_OPTIONS = [0, 1, 7, 14, 30];
+export const MAX_CONCURRENT_SESSION_OPTIONS = [0, 3, 5, 10];
+function toInt(value, fallback) {
+    const n = typeof value === 'number' ? value : Number(value);
+    return Number.isFinite(n) ? Math.trunc(n) : fallback;
+}
+/** Read the `security` blob off a settings document, coercing to a safe shape. */
+export function parseSecuritySettings(blob) {
+    const root = (blob && typeof blob === 'object' ? blob : {}) ?? {};
+    const sec = (root.security && typeof root.security === 'object'
+        ? root.security
+        : {});
+    const mfa = (sec.mfa && typeof sec.mfa === 'object' ? sec.mfa : {});
+    const session = (sec.session && typeof sec.session === 'object' ? sec.session : {});
+    return {
+        mfa: {
+            required: Boolean(mfa.required),
+            gracePeriodDays: clampGrace(toInt(mfa.gracePeriodDays, DEFAULT_SECURITY_SETTINGS.mfa.gracePeriodDays)),
+            requiredAt: typeof mfa.requiredAt === 'string' ? mfa.requiredAt : undefined,
+        },
+        session: {
+            maxConcurrentSessions: clampSessions(toInt(session.maxConcurrentSessions, DEFAULT_SECURITY_SETTINGS.session.maxConcurrentSessions)),
+        },
+        updatedAt: typeof sec.updatedAt === 'string' ? sec.updatedAt : undefined,
+        updatedBy: typeof sec.updatedBy === 'string' ? sec.updatedBy : undefined,
+    };
+}
+function clampGrace(n) {
+    if (n < 0)
+        return 0;
+    if (n > 365)
+        return 365;
+    return n;
+}
+function clampSessions(n) {
+    if (n < 0)
+        return 0;
+    if (n > 100)
+        return 100;
+    return n;
+}
+/** Validate an incoming settings payload. Pure — no DB / lockout checks here. */
+export function validateSecuritySettings(settings) {
+    const issues = [];
+    const grace = settings.mfa.gracePeriodDays;
+    if (!Number.isInteger(grace) || grace < 0 || grace > 365) {
+        issues.push({
+            field: 'mfaGracePeriodDays',
+            message: 'MFA grace period must be a whole number of days between 0 and 365.',
+            severity: 'error',
+        });
+    }
+    const max = settings.session.maxConcurrentSessions;
+    if (!Number.isInteger(max) || max < 0 || max > 100) {
+        issues.push({
+            field: 'maxConcurrentSessions',
+            message: 'Maximum concurrent sessions must be a whole number between 0 (unlimited) and 100.',
+            severity: 'error',
+        });
+    }
+    return issues;
+}
+/**
+ * Lockout-safe MFA enable check. Enabling org-wide MFA while the acting admin
+ * has no TOTP configured would lock them (and possibly everyone) out. Callers
+ * MUST run this server-side before persisting `mfa.required = true`.
+ */
+export function mfaEnableLockoutError(input) {
+    if (!input.enabling)
+        return null;
+    if (!input.viewerHasMfa) {
+        return 'Set up MFA for your own account before requiring it for everyone — otherwise you would lock yourself out.';
+    }
+    return null;
+}
+const IPV4_OCTET = '(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)';
+const IPV4_RE = new RegExp(`^${IPV4_OCTET}(\\.${IPV4_OCTET}){3}$`);
+/**
+ * Validate a single allowlist entry: an IPv4/IPv6 literal or a CIDR range.
+ * Standalone (does not import the matcher's private helpers) so it can run in
+ * the client bundle for inline form validation.
+ */
+export function validateIpRange(entry) {
+    const value = entry.trim();
+    if (!value)
+        return false;
+    const [addr, maskStr, ...rest] = value.split('/');
+    if (rest.length > 0 || addr === undefined)
+        return false;
+    const isV6 = addr.includes(':');
+    if (maskStr !== undefined) {
+        if (!/^\d{1,3}$/.test(maskStr))
+            return false;
+        const mask = Number(maskStr);
+        if (isV6 ? mask > 128 : mask > 32)
+            return false;
+    }
+    return isV6 ? isValidIpv6(addr) : IPV4_RE.test(addr);
+}
+function isValidIpv6(addr) {
+    // Reject IPv4-mapped + multiple `::`; otherwise validate 1–8 hextet groups.
+    if (addr.includes('.'))
+        return false;
+    const halves = addr.split('::');
+    if (halves.length > 2)
+        return false;
+    const groups = addr
+        .replace('::', ':')
+        .split(':')
+        .filter((g) => g.length > 0);
+    if (groups.length === 0 && halves.length !== 2)
+        return false;
+    if (groups.length > 8)
+        return false;
+    return groups.every((g) => /^[0-9a-fA-F]{1,4}$/.test(g));
+}
+//# sourceMappingURL=settings.js.map

package/dist/security/center/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/security/center/settings.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IACzD,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE;IAC5C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;CACtC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAU,CAAA;AAClE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAU,CAAA;AAQpE,SAAS,KAAK,CAAC,KAAc,EAAE,QAAgB;IAC7C,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AACtD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,qBAAqB,CAAC,IAAa;IACjD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAA;IAC9F,MAAM,GAAG,GAAG,CACV,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAChD,CAAC,CAAE,IAAI,CAAC,QAAoC;QAC5C,CAAC,CAAC,EAAE,CACoB,CAAA;IAC5B,MAAM,GAAG,GAAG,CACV,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,GAA+B,CAAC,CAAC,CAAC,EAAE,CACxD,CAAA;IAC5B,MAAM,OAAO,GAAG,CACd,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,OAAmC,CAAC,CAAC,CAAC,EAAE,CACpE,CAAA;IAE5B,OAAO;QACL,GAAG,EAAE;YACH,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC/B,eAAe,EAAE,UAAU,CACzB,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,yBAAyB,CAAC,GAAG,CAAC,eAAe,CAAC,CAC1E;YACD,UAAU,EAAE,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SAC5E;QACD,OAAO,EAAE;YACP,qBAAqB,EAAE,aAAa,CAClC,KAAK,CACH,OAAO,CAAC,qBAAqB,EAC7B,yBAAyB,CAAC,OAAO,CAAC,qBAAqB,CACxD,CACF;SACF;QACD,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACxE,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACzE,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAA;IACnB,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,GAAG,CAAA;IACvB,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAA;IACnB,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,GAAG,CAAA;IACvB,OAAO,CAAC,CAAA;AACV,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CAAC,QAA0B;IACjE,MAAM,MAAM,GAA8B,EAAE,CAAA;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,oEAAoE;YAC7E,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAA;IAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,mFAAmF;YAC5F,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAIrC;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,2GAA2G,CAAA;IACpH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,GAAG,uCAAuC,CAAA;AAC1D,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,OAAO,UAAU,OAAO,CAAC,CAAA;AAElE;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAEvD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAA;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5B,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE;YAAE,OAAO,KAAK,CAAA;IACjD,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,4EAA4E;IAC5E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACnC,MAAM,MAAM,GAAG,IAAI;SAChB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACnC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1D,CAAC"}

package/dist/security/center/status.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Pure security-posture computation.
+ *
+ * Turns gathered signals ({@link SecurityStatusInput}) into checks, warnings,
+ * an overall level, and an advisory score. No I/O — fully unit-tested so the
+ * "is this safe for production?" verdict is deterministic and reviewable.
+ */
+import type { SecurityStatus, SecurityStatusInput } from './types.js';
+export declare function computeSecurityStatus(input: SecurityStatusInput): SecurityStatus;
+//# sourceMappingURL=status.d.ts.map

package/dist/security/center/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/security/center/status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAEV,cAAc,EACd,mBAAmB,EAGpB,MAAM,YAAY,CAAA;AA2BnB,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAuNhF"}