@actuate-media/cms-core 0.83.0 → 0.84.0

package/dist/__tests__/security/center.test.js

@@ -1,226 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { DEFAULT_SECURITY_SETTINGS, computeSecurityStatus, mfaEnableLockoutError, parseSecuritySettings, summarizeApiKeys, summarizeUsers, validateIpRange, validateSecuritySettings, } from '../../security/center/index.js';
-function baseInput(overrides = {}) {
-    return {
-        isProduction: true,
-        settings: {
-            mfa: { required: true, gracePeriodDays: 7 },
-            session: { maxConcurrentSessions: 5 },
-        },
-        users: {
-            totalUsers: 3,
-            totalAdmins: 2,
-            withMfa: 2,
-            withoutMfa: 1,
-            adminsWithoutMfa: 0,
-            inactive: 0,
-        },
-        apiKeys: { active: 1, withoutExpiration: 0, broadScope: 0, staleUnused90d: 0 },
-        secrets: {
-            cmsSecret: 'pass',
-            encryptionKey: 'pass',
-            rateLimitBackend: 'distributed',
-            apiKeysHashed: true,
-            webhookSecretsEncrypted: true,
-        },
-        ipAllowlist: {
-            enabled: false,
-            source: 'none',
-            ranges: [],
-            currentIp: '1.2.3.4',
-            currentIpAllowed: null,
-        },
-        failedLogins24h: 0,
-        activeSessions: 1,
-        csrfEnabled: true,
-        uploadValidation: true,
-        auditEnabled: true,
-        ...overrides,
-    };
-}
-describe('computeSecurityStatus', () => {
-    it('reports secure when all controls pass', () => {
-        const status = computeSecurityStatus(baseInput());
-        expect(status.status).toBe('secure');
-        expect(status.score).toBe(100);
-        expect(status.warnings).toHaveLength(0);
-        // Every advertised check is present.
-        const keys = status.checks.map((c) => c.key);
-        expect(keys).toEqual(expect.arrayContaining([
-            'mfa',
-            'sessions',
-            'api_keys',
-            'csrf',
-            'rate_limit',
-            'cms_secret',
-            'audit',
-        ]));
-    });
-    it('is at_risk when CSRF is disabled', () => {
-        const status = computeSecurityStatus(baseInput({ csrfEnabled: false }));
-        expect(status.status).toBe('at_risk');
-        expect(status.warnings.some((w) => w.id === 'csrf-disabled' && w.severity === 'critical')).toBe(true);
-        expect(status.score).toBeLessThan(100);
-    });
-    it('is at_risk when MFA is required but an admin has not enrolled', () => {
-        const status = computeSecurityStatus(baseInput({
-            users: {
-                totalUsers: 3,
-                totalAdmins: 2,
-                withMfa: 1,
-                withoutMfa: 1,
-                adminsWithoutMfa: 1,
-                inactive: 0,
-            },
-        }));
-        expect(status.status).toBe('at_risk');
-        expect(status.warnings.some((w) => w.id === 'mfa-required-gap')).toBe(true);
-        const mfaCheck = status.checks.find((c) => c.key === 'mfa');
-        expect(mfaCheck?.status).toBe('fail');
-    });
-    it('is at_risk in production when CMS_SECRET is missing', () => {
-        const status = computeSecurityStatus(baseInput({ secrets: { ...baseInput().secrets, cmsSecret: 'fail' } }));
-        expect(status.status).toBe('at_risk');
-        expect(status.warnings.some((w) => w.id === 'cms-secret-missing')).toBe(true);
-    });
-    it('needs_attention when MFA is not required in production', () => {
-        const status = computeSecurityStatus(baseInput({
-            settings: {
-                mfa: { required: false, gracePeriodDays: 7 },
-                session: { maxConcurrentSessions: 5 },
-            },
-        }));
-        expect(status.status).toBe('needs_attention');
-        expect(status.warnings.some((w) => w.id === 'mfa-not-required')).toBe(true);
-    });
-    it('warns (not critical) about in-memory rate limiting in production', () => {
-        const status = computeSecurityStatus(baseInput({ secrets: { ...baseInput().secrets, rateLimitBackend: 'in_memory' } }));
-        expect(status.status).toBe('needs_attention');
-        expect(status.warnings.some((w) => w.id === 'rate-limit-in-memory')).toBe(true);
-    });
-    it('is unknown when secret state cannot be determined', () => {
-        const status = computeSecurityStatus(baseInput({ secrets: { ...baseInput().secrets, cmsSecret: 'unknown' } }));
-        expect(status.status).toBe('unknown');
-    });
-    it('flags broad-scope API keys as a failing check', () => {
-        const status = computeSecurityStatus(baseInput({ apiKeys: { active: 2, withoutExpiration: 0, broadScope: 1, staleUnused90d: 0 } }));
-        expect(status.checks.find((c) => c.key === 'api_keys')?.status).toBe('fail');
-        expect(status.warnings.some((w) => w.id === 'api-keys-broad')).toBe(true);
-    });
-});
-describe('validateSecuritySettings', () => {
-    it('accepts valid settings', () => {
-        expect(validateSecuritySettings(DEFAULT_SECURITY_SETTINGS)).toEqual([]);
-    });
-    it('rejects an out-of-range grace period', () => {
-        const issues = validateSecuritySettings({
-            mfa: { required: true, gracePeriodDays: 999 },
-            session: { maxConcurrentSessions: 5 },
-        });
-        expect(issues.some((i) => i.field === 'mfaGracePeriodDays' && i.severity === 'error')).toBe(true);
-    });
-    it('rejects an out-of-range concurrent session cap', () => {
-        const issues = validateSecuritySettings({
-            mfa: { required: false, gracePeriodDays: 0 },
-            session: { maxConcurrentSessions: -1 },
-        });
-        expect(issues.some((i) => i.field === 'maxConcurrentSessions')).toBe(true);
-    });
-});
-describe('parseSecuritySettings', () => {
-    it('returns defaults for an empty blob', () => {
-        expect(parseSecuritySettings({})).toEqual(DEFAULT_SECURITY_SETTINGS);
-    });
-    it('coerces and clamps values', () => {
-        const parsed = parseSecuritySettings({
-            security: {
-                mfa: { required: 'yes', gracePeriodDays: 9999 },
-                session: { maxConcurrentSessions: -5 },
-            },
-        });
-        expect(parsed.mfa.required).toBe(true);
-        expect(parsed.mfa.gracePeriodDays).toBe(365);
-        expect(parsed.session.maxConcurrentSessions).toBe(0);
-    });
-    it('preserves requiredAt when present', () => {
-        const parsed = parseSecuritySettings({
-            security: {
-                mfa: { required: true, gracePeriodDays: 1, requiredAt: '2026-01-01T00:00:00.000Z' },
-            },
-        });
-        expect(parsed.mfa.requiredAt).toBe('2026-01-01T00:00:00.000Z');
-    });
-});
-describe('validateIpRange', () => {
-    it.each([
-        '192.168.1.1',
-        '10.0.0.0/8',
-        '172.16.0.0/12',
-        '0.0.0.0/0',
-        '2001:db8::1',
-        '2001:db8::/32',
-        '::1',
-    ])('accepts %s', (entry) => {
-        expect(validateIpRange(entry)).toBe(true);
-    });
-    it.each(['', 'not-an-ip', '999.1.1.1', '10.0.0.0/33', '1.2.3.4/abc', '2001:db8::/129', '1.2.3'])('rejects %s', (entry) => {
-        expect(validateIpRange(entry)).toBe(false);
-    });
-});
-describe('mfaEnableLockoutError', () => {
-    it('blocks enabling MFA when the acting admin has no MFA', () => {
-        expect(mfaEnableLockoutError({ enabling: true, viewerHasMfa: false, totalAdmins: 1 })).toMatch(/lock yourself out/i);
-    });
-    it('allows enabling when the acting admin has MFA', () => {
-        expect(mfaEnableLockoutError({ enabling: true, viewerHasMfa: true, totalAdmins: 1 })).toBeNull();
-    });
-    it('never blocks when not enabling', () => {
-        expect(mfaEnableLockoutError({ enabling: false, viewerHasMfa: false, totalAdmins: 3 })).toBeNull();
-    });
-});
-describe('summarizeUsers', () => {
-    it('counts admin MFA coverage and inactive accounts', () => {
-        const summary = summarizeUsers([
-            { role: 'ADMIN', isActive: true, totpEnabled: true },
-            { role: 'ADMIN', isActive: true, totpEnabled: false },
-            { role: 'EDITOR', isActive: true, totpEnabled: false },
-            { role: 'ADMIN', isActive: false, totpEnabled: false },
-        ]);
-        expect(summary.totalUsers).toBe(4);
-        expect(summary.totalAdmins).toBe(3);
-        expect(summary.withMfa).toBe(1);
-        expect(summary.adminsWithoutMfa).toBe(1); // inactive admin excluded
-        expect(summary.inactive).toBe(1);
-    });
-});
-describe('summarizeApiKeys', () => {
-    const now = Date.parse('2026-06-01T00:00:00.000Z');
-    it('classifies risk and excludes revoked/expired keys', () => {
-        const summary = summarizeApiKeys([
-            { scopes: { admin: true }, expiresAt: null, lastUsedAt: null, revokedAt: null },
-            {
-                scopes: { media: true },
-                expiresAt: '2026-12-01T00:00:00.000Z',
-                lastUsedAt: '2026-01-01T00:00:00.000Z',
-                revokedAt: null,
-            },
-            {
-                scopes: { media: true },
-                expiresAt: '2020-01-01T00:00:00.000Z',
-                lastUsedAt: null,
-                revokedAt: null,
-            }, // expired
-            {
-                scopes: { admin: true },
-                expiresAt: null,
-                lastUsedAt: null,
-                revokedAt: '2026-01-01T00:00:00.000Z',
-            }, // revoked
-        ], now);
-        expect(summary.active).toBe(2);
-        expect(summary.broadScope).toBe(1);
-        expect(summary.withoutExpiration).toBe(1);
-        expect(summary.staleUnused90d).toBe(1); // key 2 last used > 90d before `now`
-    });
-});
-//# sourceMappingURL=center.test.js.map

package/dist/__tests__/security/center.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"center.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/center.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,wBAAwB,GAEzB,MAAM,gCAAgC,CAAA;AAEvC,SAAS,SAAS,CAAC,YAA0C,EAAE;IAC7D,OAAO;QACL,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE;YACR,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;YAC3C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;SACtC;QACD,KAAK,EAAE;YACL,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,CAAC;YACb,gBAAgB,EAAE,CAAC;YACnB,QAAQ,EAAE,CAAC;SACZ;QACD,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE;QAC9E,OAAO,EAAE;YACP,SAAS,EAAE,MAAM;YACjB,aAAa,EAAE,MAAM;YACrB,gBAAgB,EAAE,aAAa;YAC/B,aAAa,EAAE,IAAI;YACnB,uBAAuB,EAAE,IAAI;SAC9B;QACD,WAAW,EAAE;YACX,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,EAAE;YACV,SAAS,EAAE,SAAS;YACpB,gBAAgB,EAAE,IAAI;SACvB;QACD,eAAe,EAAE,CAAC;QAClB,cAAc,EAAE,CAAC;QACjB,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE,IAAI;QAClB,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACvC,qCAAqC;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAClB,MAAM,CAAC,eAAe,CAAC;YACrB,KAAK;YACL,UAAU;YACV,UAAU;YACV,MAAM;YACN,YAAY;YACZ,YAAY;YACZ,OAAO;SACR,CAAC,CACH,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACvE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAC7F,IAAI,CACL,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC;YACR,KAAK,EAAE;gBACL,UAAU,EAAE,CAAC;gBACb,WAAW,EAAE,CAAC;gBACd,OAAO,EAAE,CAAC;gBACV,UAAU,EAAE,CAAC;gBACb,gBAAgB,EAAE,CAAC;gBACnB,QAAQ,EAAE,CAAC;aACZ;SACF,CAAC,CACH,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAA;QAC3D,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CACtE,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC;YACR,QAAQ,EAAE;gBACR,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE;gBAC5C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;aACtC;SACF,CAAC,CACH,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC7C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,EAAE,CAAC,CAClF,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC7C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CACzE,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC,CAC9F,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACtC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE;YAC7C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;SACtC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,oBAAoB,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CACzF,IAAI,CACL,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACtC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE;YAC5C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,EAAE;SACvC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACnC,QAAQ,EAAE;gBACR,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;gBAC/C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,EAAE;aACvC;SACF,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACnC,QAAQ,EAAE;gBACR,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,UAAU,EAAE,0BAA0B,EAAE;aACpF;SACF,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,IAAI,CAAC;QACN,aAAa;QACb,YAAY;QACZ,eAAe;QACf,WAAW;QACX,aAAa;QACb,eAAe;QACf,KAAK;KACN,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;QACzB,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAC9F,YAAY,EACZ,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5C,CAAC,CACF,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAC5F,oBAAoB,CACrB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IAClG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CACJ,qBAAqB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAChF,CAAC,QAAQ,EAAE,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,OAAO,GAAG,cAAc,CAAC;YAC7B,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YACpD,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;YACrD,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;YACtD,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE;SACvD,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,0BAA0B;QACnE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAElD,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,OAAO,GAAG,gBAAgB,CAC9B;YACE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;YAC/E;gBACE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;gBACvB,SAAS,EAAE,0BAA0B;gBACrC,UAAU,EAAE,0BAA0B;gBACtC,SAAS,EAAE,IAAI;aAChB;YACD;gBACE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;gBACvB,SAAS,EAAE,0BAA0B;gBACrC,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;aAChB,EAAE,UAAU;YACb;gBACE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;gBACvB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,0BAA0B;aACtC,EAAE,UAAU;SACd,EACD,GAAG,CACJ,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,qCAAqC;IAC9E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/client-ip.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=client-ip.test.d.ts.map

package/dist/__tests__/security/client-ip.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client-ip.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/client-ip.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/security/client-ip.test.js

@@ -1,37 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { getClientIp, isResolvedIp } from '../../security/client-ip.js';
-function req(headers) {
-    return new Request('https://example.com/x', { headers });
-}
-describe('client-ip helper', () => {
-    it('uses X-Vercel-Forwarded-For first', () => {
-        const r = req({
-            'x-vercel-forwarded-for': '203.0.113.5',
-            'x-forwarded-for': '198.51.100.1, 203.0.113.5',
-            'x-real-ip': '198.51.100.1',
-        });
-        expect(getClientIp(r)).toBe('203.0.113.5');
-    });
-    it('falls back to x-real-ip when no Vercel header', () => {
-        const r = req({ 'x-real-ip': '203.0.113.99' });
-        expect(getClientIp(r)).toBe('203.0.113.99');
-    });
-    it('does NOT trust X-Forwarded-For by default', () => {
-        const r = req({ 'x-forwarded-for': '1.2.3.4' });
-        expect(getClientIp(r)).toBe('unknown');
-    });
-    it('uses the LAST X-Forwarded-For entry when trustProxy is enabled', () => {
-        const r = req({ 'x-forwarded-for': '198.51.100.1, 203.0.113.5, 1.2.3.4' });
-        // Last entry = closest to our trusted proxy = the one to trust.
-        expect(getClientIp(r, { trustProxy: true })).toBe('1.2.3.4');
-    });
-    it('reports "unknown" with no headers', () => {
-        expect(getClientIp(req({}))).toBe('unknown');
-    });
-    it('isResolvedIp is false for "unknown"', () => {
-        expect(isResolvedIp('unknown')).toBe(false);
-        expect(isResolvedIp('')).toBe(false);
-        expect(isResolvedIp('203.0.113.5')).toBe(true);
-    });
-});
-//# sourceMappingURL=client-ip.test.js.map

package/dist/__tests__/security/client-ip.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client-ip.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/client-ip.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAEvE,SAAS,GAAG,CAAC,OAA+B;IAC1C,OAAO,IAAI,OAAO,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;AAC1D,CAAC;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAG,GAAG,CAAC;YACZ,wBAAwB,EAAE,aAAa;YACvC,iBAAiB,EAAE,2BAA2B;YAC9C,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAA;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAA;QAC9C,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,iBAAiB,EAAE,oCAAoC,EAAE,CAAC,CAAA;QAC1E,gEAAgE;QAChE,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/csrf.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=csrf.test.d.ts.map

package/dist/__tests__/security/csrf.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"csrf.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/csrf.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/security/csrf.test.js

@@ -1,40 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { generateToken, validateToken } from '../../security/csrf.js';
-describe('generateToken', () => {
-    it('returns a 64-char hex string', async () => {
-        const token = await generateToken();
-        expect(token).toHaveLength(64);
-        expect(token).toMatch(/^[0-9a-f]{64}$/);
-    });
-    it('generates unique tokens on each call', async () => {
-        const token1 = await generateToken();
-        const token2 = await generateToken();
-        expect(token1).not.toBe(token2);
-    });
-});
-describe('validateToken', () => {
-    it('returns true for matching tokens', async () => {
-        const token = await generateToken();
-        expect(validateToken(token, token)).toBe(true);
-    });
-    it('returns true for identical manually-constructed tokens', () => {
-        const token = 'a'.repeat(64);
-        expect(validateToken(token, token)).toBe(true);
-    });
-    it('returns false for different tokens of the same length', async () => {
-        const token1 = await generateToken();
-        const token2 = await generateToken();
-        expect(validateToken(token1, token2)).toBe(false);
-    });
-    it('returns false for tokens of different lengths', () => {
-        const short = 'abcdef';
-        const long = 'abcdefabcdef';
-        expect(validateToken(short, long)).toBe(false);
-    });
-    it('returns false when one token is empty', async () => {
-        const token = await generateToken();
-        expect(validateToken(token, '')).toBe(false);
-        expect(validateToken('', token)).toBe(false);
-    });
-});
-//# sourceMappingURL=csrf.test.js.map

package/dist/__tests__/security/csrf.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"csrf.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/csrf.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAErE,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAA;QACnC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAA;QACpC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAA;QACnC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC5B,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAA;QACpC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,KAAK,GAAG,QAAQ,CAAA;QACtB,MAAM,IAAI,GAAG,cAAc,CAAA;QAC3B,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAA;QACnC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/encrypted-fields.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=encrypted-fields.test.d.ts.map

package/dist/__tests__/security/encrypted-fields.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"encrypted-fields.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/encrypted-fields.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/security/encrypted-fields.test.js

@@ -1,60 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { encryptField, decryptField, InvalidEncryptionKeyError, } from '../../security/encrypted-fields.js';
-const VALID_KEY = 'a'.repeat(64); // 64 hex chars = 32 bytes
-const ALT_KEY = 'b'.repeat(64);
-describe('encrypted-fields key validation', () => {
-    it('rejects empty key', async () => {
-        await expect(encryptField('hello', '')).rejects.toBeInstanceOf(InvalidEncryptionKeyError);
-    });
-    it('rejects undefined / non-string key', async () => {
-        await expect(encryptField('hello', undefined)).rejects.toBeInstanceOf(InvalidEncryptionKeyError);
-    });
-    it('rejects too-short key', async () => {
-        await expect(encryptField('hello', 'a'.repeat(32))).rejects.toBeInstanceOf(InvalidEncryptionKeyError);
-    });
-    it('rejects too-long key', async () => {
-        await expect(encryptField('hello', 'a'.repeat(128))).rejects.toBeInstanceOf(InvalidEncryptionKeyError);
-    });
-    it('rejects non-hex characters', async () => {
-        await expect(encryptField('hello', 'z'.repeat(63) + 'a')).rejects.toBeInstanceOf(InvalidEncryptionKeyError);
-    });
-    it('rejects the placeholder dev key from the .env example', async () => {
-        // "aes256-local-dev-key-change-in-prod" is 35 chars, not 64, and contains '-'.
-        await expect(encryptField('hello', 'aes256-local-dev-key-change-in-prod')).rejects.toBeInstanceOf(InvalidEncryptionKeyError);
-    });
-    it('error message points operators at the random-bytes generator', async () => {
-        try {
-            await encryptField('hello', 'short');
-            throw new Error('should have thrown');
-        }
-        catch (err) {
-            expect(err).toBeInstanceOf(InvalidEncryptionKeyError);
-            expect(err.message).toContain('randomBytes(32)');
-        }
-    });
-});
-describe('encrypted-fields round-trip', () => {
-    it('encrypts and decrypts with the same key', async () => {
-        const plaintext = 'hello, world — with unicode ✓';
-        const encrypted = await encryptField(plaintext, VALID_KEY);
-        expect(encrypted).not.toBe(plaintext);
-        const decrypted = await decryptField(encrypted, VALID_KEY);
-        expect(decrypted).toBe(plaintext);
-    });
-    it('produces different ciphertext on every call (unique IV)', async () => {
-        const a = await encryptField('same input', VALID_KEY);
-        const b = await encryptField('same input', VALID_KEY);
-        expect(a).not.toBe(b);
-    });
-    it('rejects ciphertext encrypted with a different key', async () => {
-        const encrypted = await encryptField('secret', VALID_KEY);
-        await expect(decryptField(encrypted, ALT_KEY)).rejects.toThrow();
-    });
-    it('rejects tampered ciphertext (AES-GCM auth tag enforces integrity)', async () => {
-        const encrypted = await encryptField('secret', VALID_KEY);
-        // Flip one byte at the end (inside the auth tag region)
-        const tampered = encrypted.slice(0, -2) + (encrypted.slice(-2) === 'ff' ? '00' : 'ff');
-        await expect(decryptField(tampered, VALID_KEY)).rejects.toThrow();
-    });
-});
-//# sourceMappingURL=encrypted-fields.test.js.map

package/dist/__tests__/security/encrypted-fields.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"encrypted-fields.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/encrypted-fields.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,yBAAyB,GAC1B,MAAM,oCAAoC,CAAA;AAE3C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA,CAAC,0BAA0B;AAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAE9B,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAA;IAC3F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,SAA8B,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CACxF,yBAAyB,CAC1B,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CACxE,yBAAyB,CAC1B,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CACzE,yBAAyB,CAC1B,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAC9E,yBAAyB,CAC1B,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,+EAA+E;QAC/E,MAAM,MAAM,CACV,YAAY,CAAC,OAAO,EAAE,qCAAqC,CAAC,CAC7D,CAAC,OAAO,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACpC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAA;YACrD,MAAM,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,SAAS,GAAG,+BAA+B,CAAA;QACjD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QAC1D,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QAC1D,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;QACrD,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;QACrD,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QACzD,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QACzD,wDAAwD;QACxD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACtF,MAAM,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IACnE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/ip-allowlist.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=ip-allowlist.test.d.ts.map

package/dist/__tests__/security/ip-allowlist.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ip-allowlist.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/ip-allowlist.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/security/ip-allowlist.test.js

@@ -1,40 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { isIpAllowed } from '../../security/ip-allowlist.js';
-describe('isIpAllowed', () => {
-    it('allows everything when allowlist is empty', () => {
-        expect(isIpAllowed('203.0.113.5', [])).toBe(true);
-    });
-    it('rejects the literal "unknown" sentinel against a non-empty allowlist', () => {
-        expect(isIpAllowed('unknown', ['203.0.113.5'])).toBe(false);
-    });
-    it('still allows "unknown" when no allowlist is configured', () => {
-        // Empty allowlist means "no IP restriction at all". The middleware
-        // separately decides whether unknown IPs should be allowed via
-        // isResolvedIp() before consulting this helper.
-        expect(isIpAllowed('unknown', [])).toBe(true);
-    });
-    it('matches a literal IPv4 address', () => {
-        expect(isIpAllowed('203.0.113.5', ['203.0.113.5'])).toBe(true);
-        expect(isIpAllowed('203.0.113.6', ['203.0.113.5'])).toBe(false);
-    });
-    it('matches an IPv4 CIDR range', () => {
-        expect(isIpAllowed('203.0.113.42', ['203.0.113.0/24'])).toBe(true);
-        expect(isIpAllowed('203.0.114.42', ['203.0.113.0/24'])).toBe(false);
-    });
-    it('matches a literal IPv6 address with normalisation', () => {
-        expect(isIpAllowed('2001:db8::1', ['2001:db8:0:0:0:0:0:1'])).toBe(true);
-    });
-    it('matches an IPv6 CIDR range', () => {
-        expect(isIpAllowed('2001:db8:abcd::1', ['2001:db8::/32'])).toBe(true);
-        expect(isIpAllowed('2001:db9::1', ['2001:db8::/32'])).toBe(false);
-    });
-    it('normalises IPv4-mapped IPv6 addresses', () => {
-        expect(isIpAllowed('::ffff:203.0.113.5', ['203.0.113.5'])).toBe(true);
-        expect(isIpAllowed('::ffff:203.0.113.5', ['203.0.113.0/24'])).toBe(true);
-    });
-    it('rejects malformed CIDR values', () => {
-        expect(isIpAllowed('203.0.113.5', ['203.0.113.0/abc'])).toBe(false);
-        expect(isIpAllowed('203.0.113.5', ['203.0.113.0/-1'])).toBe(false);
-    });
-});
-//# sourceMappingURL=ip-allowlist.test.js.map

package/dist/__tests__/security/ip-allowlist.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ip-allowlist.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/ip-allowlist.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AAE5D,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,mEAAmE;QACnE,+DAA+D;QAC/D,gDAAgD;QAChD,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClE,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,WAAW,CAAC,kBAAkB,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrE,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,WAAW,CAAC,oBAAoB,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrE,MAAM,CAAC,WAAW,CAAC,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnE,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/rate-limit.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=rate-limit.test.d.ts.map

package/dist/__tests__/security/rate-limit.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rate-limit.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/rate-limit.test.ts"],"names":[],"mappings":""}