@cogenta/core 0.3.0 → 0.6.0

package/dist/config/schema.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { CACHE_DRIVERS, DATABASE_DRIVERS, EMBEDDINGS_PROVIDERS, IMAGE_GENERATION_PROVIDERS, QUEUE_DRIVERS, STORAGE_DRIVERS, VECTOR_DRIVERS, } from './types.js';
+import { CACHE_DRIVERS, DATABASE_DRIVERS, EMBEDDINGS_PROVIDERS, IMAGE_GENERATION_PROVIDERS, PAYMENT_DRIVERS, QUEUE_DRIVERS, RATE_LIMIT_DRIVERS, STORAGE_DRIVERS, VECTOR_DRIVERS, } from './types.js';
 const nonEmpty = z.string().min(1);
 // Every object is strict: a typo in a key is an error, never a silently ignored
 // setting. Config drift between staging and production is the daily pain this
@@ -45,6 +45,10 @@ const queueSchema = z.strictObject({
     driver: z.enum(QUEUE_DRIVERS).default('auto'),
     url: nonEmpty.optional(),
 });
+const rateLimitSchema = z.strictObject({
+    driver: z.enum(RATE_LIMIT_DRIVERS).default('auto'),
+    url: nonEmpty.optional(),
+});
 const storageSchema = z.strictObject({
     driver: z.enum(STORAGE_DRIVERS).default('auto'),
     bucket: nonEmpty.optional(),
@@ -82,6 +86,21 @@ const corsSchema = z
     error: 'credentials cannot be combined with the "*" origin — every browser refuses that pair',
     path: ['credentials'],
 });
+/**
+ * Audit-log retention (T09-01 / fiche 21 task 5's retention half —
+ * `AuditLog.prune()` existed since that fiche with no caller anywhere in
+ * the codebase).
+ *
+ * Absent `retainDays` — the default — means the log grows without bound,
+ * exactly the behaviour before this setting existed: unlike the 404 log or
+ * analytics events, an audit trail disappearing on a schedule nobody asked
+ * for is a worse default than a bigger database, so `cogenta serve` never
+ * purges unless a site opts in. `0` is the explicit, documented way to say
+ * "never purge" out loud rather than by omission.
+ */
+const auditRetentionSchema = z.strictObject({
+    retainDays: z.number().int().nonnegative().max(3650).optional(),
+});
 const securitySchema = z.strictObject({
     cors: corsSchema.prefault({}),
     /**
@@ -106,6 +125,26 @@ const securitySchema = z.strictObject({
     hstsIncludeSubDomains: z.boolean().default(true),
     /** How long a public page may be cached, in seconds. */
     pageMaxAge: z.number().int().nonnegative().max(86_400).default(60),
+    audit: auditRetentionSchema.prefault({}),
+});
+/**
+ * The log of public URLs that answered a 404 (fiche 12 task 1).
+ *
+ * On by default, because an unresolved 404 is the daily nuisance no CMS
+ * should make an editor discover by luck. Everything it keeps is bounded on
+ * purpose: `maxPaths` is the hard cap on distinct paths tracked at once — an
+ * anonymous scanner can produce thousands of unique URLs a minute, and
+ * without a ceiling this log would be a disk-exhaustion vector any visitor
+ * could trigger — and `retainDays` is how long a path is kept since it was
+ * last requested. Neither an IP address nor a user agent is ever a field
+ * here, on any path: `AGENTS.md` § Logs forbids personal data outright, and
+ * the path plus its referrer already answer the only question this log
+ * exists for ("what should I redirect?").
+ */
+const notFoundLogSchema = z.strictObject({
+    enabled: z.boolean().default(true),
+    maxPaths: z.number().int().positive().max(100_000).default(2000),
+    retainDays: z.number().int().positive().max(3650).default(30),
 });
 /**
  * Outbound content-lifecycle webhooks (L14 task 1).
@@ -120,6 +159,18 @@ const webhooksSchema = z.strictObject({
     /** Absolute `http(s)` URLs. Empty — the default — means no webhook is sent. */
     endpoints: z.array(z.url()).default([]),
 });
+/**
+ * Analytics events retention (fiche 27 task 3).
+ *
+ * 400 days by default — long enough that "compare this year to last year" (a
+ * real question a site owner asks) still has data on both sides, short
+ * enough that the events table cannot grow forever on a busy site. `cogenta
+ * serve` purges past this every day; there is no way to disable purging
+ * outright, only to choose how long to keep.
+ */
+const analyticsSchema = z.strictObject({
+    retainDays: z.number().int().positive().max(3650).default(400),
+});
 const embeddingsSchema = z.strictObject({
     provider: z.enum(EMBEDDINGS_PROVIDERS).default('local'),
     model: nonEmpty.default('all-MiniLM-L6-v2'),
@@ -151,6 +202,108 @@ const vectorSchema = z.strictObject({
     path: nonEmpty.default('./.cogenta/vectors'),
     table: nonEmpty.default('cogenta_vectors'),
 });
+/**
+ * Seller details for invoicing (contract E, ADR-0024).
+ *
+ * No defaults at all, unlike every other optional section: a guessed legal
+ * name or a blank address would produce an invoice that looks real and is
+ * not, which is worse than the feature being off. `cogenta serve` only mounts
+ * the invoice router once a site has filled this in.
+ */
+const billingSchema = z.strictObject({
+    legalName: nonEmpty,
+    address: z.array(nonEmpty).min(1),
+    taxId: nonEmpty.optional(),
+    footer: nonEmpty.optional(),
+});
+/**
+ * The scheduled-task clock (fiche 28 task 5).
+ *
+ * `'internal'` (the default) is `cogenta serve`'s own `setInterval` loop —
+ * the same shape every other recurring job in this codebase has always
+ * used, and the right choice for a process that stays up. `'external-cron'`
+ * is `docs/hebergement-mutualise.md`'s target: a host that recycles the
+ * process between requests, where an in-memory timer never fires reliably.
+ * In that mode `cogenta serve` registers every task but never ticks its own
+ * clock — only `cogenta cron`, called from the panel's own cron, drains due
+ * tasks. The admin screen reads this setting to say which mode is active,
+ * rather than guessing from whether a tick has happened recently.
+ */
+const schedulerSchema = z.strictObject({
+    mode: z.enum(['internal', 'external-cron']).default('internal'),
+});
+/**
+ * Scheduled full-site backups, riding the same clock as every other
+ * maintenance task (fiche 28 task 1's "sauvegarde planifiée", reusing
+ * `@cogenta/export`'s `createBackup` — the exact function `cogenta backup
+ * create` already calls by hand). Off by default: a backup file is
+ * unbounded disk usage a site did not ask for, and `dir` defaults to
+ * `.cogenta/backups` — the same directory the manual command writes to, so
+ * `cogenta backup list` shows scheduled and manual backups side by side.
+ */
+const backupSchema = z.strictObject({
+    enabled: z.boolean().default(false),
+    intervalHours: z
+        .number()
+        .int()
+        .positive()
+        .max(24 * 30)
+        .default(24),
+    /** Files kept before the oldest is pruned. */
+    keep: z.number().int().positive().max(365).default(10),
+    dir: nonEmpty.default('.cogenta/backups'),
+});
+/**
+ * The writing assistant's spending cap (fiche 30 task 3).
+ *
+ * A non-null default rather than "unlimited": the lot's own pitfall is exact
+ * — "le coût est invisible jusqu'à la facture", and a service billed per token
+ * left uncapped by default is the wrong default for a CMS that ships with AI
+ * off. One million tokens a month is generous for a single site's editors
+ * while still being a real ceiling, not a decoration.
+ */
+const assistantSchema = z.strictObject({
+    monthlyTokenLimit: z.number().int().positive().default(1_000_000),
+});
+/**
+ * OpenTelemetry tracing (fiche L22 task 5). No `otlpHeaders` field, on
+ * purpose (rule R7, `SECRET_KEYS` in `env.ts` refuses it before this schema
+ * even parses) — those come from `COGENTA_OTLP_HEADERS`/
+ * `OTEL_EXPORTER_OTLP_HEADERS` only. `otlpEndpoint` absent means local
+ * collection only: the recent-events buffer behind the admin's
+ * "Exploitation" screen always works with nothing configured here (R1).
+ */
+const observabilitySchema = z.strictObject({
+    serviceName: nonEmpty.default('cogenta'),
+    otlpEndpoint: z.url().optional(),
+});
+/**
+ * Contract E's payment gateway choice (fiche 34 task 3).
+ *
+ * No `secretKey` or `webhookSecret` field, on purpose (rule R7, same shape as
+ * `llmSchema`'s missing `apiKey`): Stripe's credentials come from
+ * `COGENTA_PAYMENT_STRIPE_SECRET_KEY`/`COGENTA_PAYMENT_STRIPE_WEBHOOK_SECRET`
+ * only, and `SECRET_KEYS` (`env.ts`) refuses either one written here before
+ * this schema is even parsed. `testMode` defaults `true`: a shop that has not
+ * deliberately flipped it to production cannot silently start taking real
+ * money, matching the fiche's "le mode test doit être criant".
+ */
+const paymentSchema = z.strictObject({
+    driver: z.enum(PAYMENT_DRIVERS).default('auto'),
+    testMode: z.boolean().default(true),
+    manualInstructions: nonEmpty.optional(),
+});
+/**
+ * Google Search Console OAuth (fiche 70 task 4, ADR-0032). No fields at all —
+ * the app's own OAuth client id/secret are both secrets (rule R7) and come
+ * from `COGENTA_SEARCH_CONSOLE_CLIENT_ID`/`COGENTA_SEARCH_CONSOLE_CLIENT_SECRET`
+ * only, refused here by `SECRET_KEYS` (`env.ts`) exactly like `payment`'s own
+ * Stripe/PayPal keys. Everything per-site — whether a site has connected, and
+ * which GSC property it queries — lives in the database
+ * (`@cogenta/schema`'s `search-console-store.ts`), never here: this section
+ * exists only so the *installation* can offer the connector at all.
+ */
+const searchConsoleSchema = z.strictObject({});
 // `prefault` rather than `default`: an omitted section is parsed as `{}` so the
 // per-field defaults inside it apply, instead of being replaced wholesale.
 export const configSchema = z.strictObject({
@@ -158,13 +311,23 @@ export const configSchema = z.strictObject({
     database: databaseSchema,
     cache: cacheSchema.prefault({}),
     queue: queueSchema.prefault({}),
+    rateLimit: rateLimitSchema.prefault({}),
     storage: storageSchema.prefault({}),
     security: securitySchema.prefault({}),
+    notFoundLog: notFoundLogSchema.prefault({}),
     webhooks: webhooksSchema.prefault({}),
+    analytics: analyticsSchema.prefault({}),
     llm: llmSchema.optional(),
     embeddings: embeddingsSchema.prefault({}),
     imageGeneration: imageGenerationSchema.optional(),
     vector: vectorSchema.prefault({}),
+    billing: billingSchema.optional(),
+    scheduler: schedulerSchema.prefault({}),
+    backup: backupSchema.prefault({}),
+    assistant: assistantSchema.prefault({}),
+    payment: paymentSchema.prefault({}),
+    observability: observabilitySchema.prefault({}),
+    searchConsole: searchConsoleSchema.prefault({}),
 });
 /**
  * Renders Zod issues as `field: reason`, one per line, so the user sees every

package/dist/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAA;AAEnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAElC,gFAAgF;AAChF,8EAA8E;AAC9E,uCAAuC;AACvC,MAAM,UAAU,GAAG,CAAC;KACjB,YAAY,CAAC;IACZ,IAAI,EAAE,QAAQ;IACd,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;IACZ,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;IACjD,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC;;;;;;;;;OASG;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,UAAU,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,6DAA6D,EAAE,CAAC;SACzF,OAAO,CAAC,MAAM,CAAC;CACnB,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;IAC3D,KAAK,EAAE,qDAAqD;IAC5D,IAAI,EAAE,CAAC,eAAe,CAAC;CACxB,CAAC,CAAA;AAEJ,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC3C,GAAG,EAAE,QAAQ;IACb,qEAAqE;IACrE,8DAA8D;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC1D,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;IACxB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;CAC3C,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;CACzB,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC1C,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;CACpC,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,CAAC;KACjB,YAAY,CAAC;IACZ,mGAAmG;IACnG,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrF,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACrE,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,+CAA+C;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CAChE,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE;IACnE,KAAK,EAAE,sFAAsF;IAC7F,IAAI,EAAE,CAAC,aAAa,CAAC;CACtB,CAAC,CAAA;AAEJ,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7B;;;;;;;;OAQG;IACH,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,wDAAwD;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,+EAA+E;IAC/E,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxC,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvD,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CACrD,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAC5C,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC5C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC;CAC3C,CAAC,CAAA;AAEF,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,cAAc;IACxB,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/B,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrC,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE;IACzB,UAAU,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzC,eAAe,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACjD,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;CAClC,CAAC,CAAA;AAIF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,OAAO,KAAK,CAAC,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,OAAO,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAA;IAC/D,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAA;AAEnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAElC,gFAAgF;AAChF,8EAA8E;AAC9E,uCAAuC;AACvC,MAAM,UAAU,GAAG,CAAC;KACjB,YAAY,CAAC;IACZ,IAAI,EAAE,QAAQ;IACd,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;IACZ,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;IACjD,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC;;;;;;;;;OASG;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,UAAU,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,6DAA6D,EAAE,CAAC;SACzF,OAAO,CAAC,MAAM,CAAC;CACnB,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;IAC3D,KAAK,EAAE,qDAAqD;IAC5D,IAAI,EAAE,CAAC,eAAe,CAAC;CACxB,CAAC,CAAA;AAEJ,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC3C,GAAG,EAAE,QAAQ;IACb,qEAAqE;IACrE,8DAA8D;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC1D,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;IACxB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;CAC3C,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;CACzB,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAClD,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;CACzB,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC1C,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;CACpC,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,CAAC;KACjB,YAAY,CAAC;IACZ,mGAAmG;IACnG,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrF,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACrE,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,+CAA+C;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CAChE,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE;IACnE,KAAK,EAAE,sFAAsF;IAC7F,IAAI,EAAE,CAAC,aAAa,CAAC;CACtB,CAAC,CAAA;AAEJ;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7B;;;;;;;;OAQG;IACH,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,wDAAwD;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;CACzC,CAAC,CAAA;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,YAAY,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAChE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,+EAA+E;IAC/E,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxC,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CAC/D,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvD,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CACrD,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAC5C,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC5C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC;CAC3C,CAAC,CAAA;AAEF;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,SAAS,EAAE,QAAQ;IACnB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC1B,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;CAChE,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;SACZ,OAAO,CAAC,EAAE,CAAC;IACd,8CAA8C;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;CAC1C,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;CAClE,CAAC,CAAA;AAEF;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;IACxC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF;;;;;;;;;;GAUG;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACnC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;AAE9C,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,cAAc;IACxB,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/B,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrC,WAAW,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrC,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE;IACzB,UAAU,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzC,eAAe,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACjD,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjC,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,aAAa,EAAE,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/C,aAAa,EAAE,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;CAChD,CAAC,CAAA;AAIF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,OAAO,KAAK,CAAC,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,OAAO,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAA;IAC/D,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC"}

package/dist/config/secret-hygiene.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Detects, but never blocks, the two secret-hygiene gaps fiche 23 names as
+ * open (audit follow-up to L10 task 6 / `docs/hebergement-mutualise.md`):
+ * `create-cogenta` used to write a database URL — password included — into
+ * `cogenta.config.mjs` in the clear, and the generated `.env` (which holds
+ * `COGENTA_AUTH_SIGNING_KEY`) was written without a restrictive file mode, so
+ * another tenant on shared hosting could read it.
+ *
+ * `SECRET_KEYS` (`env.ts`) cannot simply gain `database.url`: unlike an API
+ * key, a database URL is legitimately present in the file for the common
+ * case — a SQLite path, or a Postgres URL with no password at all (peer
+ * trust, a local dev server) — so refusing it outright at `resolveConfig`
+ * would break every SQLite site, which is Cogenta's zero-config default.
+ * What *is* always wrong is a URL that embeds real credentials: that half is
+ * detected here and **surfaced**, on the ops-settings mirror (fiche 23 task
+ * 5's literal ask — "détecter et signaler"), never turned into a hard
+ * refusal that would regress a legitimate config.
+ */
+/**
+ * `true` when `value` parses as a URL carrying a non-empty username or
+ * password. A bare path (`./data.db`, `:memory:`) or a URL with no userinfo
+ * (`postgres://localhost/db`) is `false` — there is nothing secret to leak.
+ */
+export declare function urlHasEmbeddedCredentials(value: string): boolean;
+export interface SecretHygieneReport {
+    /** `true` when the raw config file sets `database.url` to a URL carrying real credentials. */
+    readonly databaseUrlHasCredentialsInFile: boolean;
+    /** The `.env` file `loadConfig` looked for next to the config, or `null` when there is no config file. */
+    readonly envFilePath: string | null;
+    /**
+     * `true` when `.env` grants read access to the file's group or to anyone
+     * else on the machine — exactly what a shared-hosting neighbour would use.
+     * `null` when there is no `.env` file, or the platform's permission bits
+     * are not the POSIX ones this check reads (win32).
+     */
+    readonly envFileReadableByOthers: boolean | null;
+}
+/** Reads the raw, unresolved `database.url` a config file declares, or `undefined` for none. */
+export declare function rawDatabaseUrl(input: unknown): string | undefined;
+/**
+ * `true` when `mode` (a POSIX file mode, as `fs.Stats.mode` reports it)
+ * grants read access to its group or to "other" — the two bits that matter
+ * on a shared host, where every tenant's process runs as a different,
+ * unprivileged user. Pure and platform-independent so the actual security
+ * arithmetic — which bits mean "someone else can read this" — is tested
+ * directly, without a real file or a real POSIX host.
+ */
+export declare function hasGroupOrOtherRead(mode: number): boolean;
+/**
+ * Builds the report `loadConfig` attaches to `LoadedConfig`. `rawConfig` is
+ * the *unresolved* file contents (before `resolveConfig` strips anything) —
+ * the same object `findSecretsInFile` already inspects.
+ */
+export declare function buildSecretHygieneReport(rawConfig: unknown, envFilePath: string | null, envFileExists: boolean): Promise<SecretHygieneReport>;
+//# sourceMappingURL=secret-hygiene.d.ts.map

package/dist/config/secret-hygiene.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-hygiene.d.ts","sourceRoot":"","sources":["../../src/config/secret-hygiene.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOhE;AAED,MAAM,WAAW,mBAAmB;IAClC,8FAA8F;IAC9F,QAAQ,CAAC,+BAA+B,EAAE,OAAO,CAAA;IACjD,0GAA0G;IAC1G,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,GAAG,IAAI,CAAA;CACjD;AAMD,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMjE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD;AAqBD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,OAAO,EAClB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,mBAAmB,CAAC,CAQ9B"}

package/dist/config/secret-hygiene.js

@@ -0,0 +1,94 @@
+import { stat } from 'node:fs/promises';
+import process from 'node:process';
+/**
+ * Detects, but never blocks, the two secret-hygiene gaps fiche 23 names as
+ * open (audit follow-up to L10 task 6 / `docs/hebergement-mutualise.md`):
+ * `create-cogenta` used to write a database URL — password included — into
+ * `cogenta.config.mjs` in the clear, and the generated `.env` (which holds
+ * `COGENTA_AUTH_SIGNING_KEY`) was written without a restrictive file mode, so
+ * another tenant on shared hosting could read it.
+ *
+ * `SECRET_KEYS` (`env.ts`) cannot simply gain `database.url`: unlike an API
+ * key, a database URL is legitimately present in the file for the common
+ * case — a SQLite path, or a Postgres URL with no password at all (peer
+ * trust, a local dev server) — so refusing it outright at `resolveConfig`
+ * would break every SQLite site, which is Cogenta's zero-config default.
+ * What *is* always wrong is a URL that embeds real credentials: that half is
+ * detected here and **surfaced**, on the ops-settings mirror (fiche 23 task
+ * 5's literal ask — "détecter et signaler"), never turned into a hard
+ * refusal that would regress a legitimate config.
+ */
+/**
+ * `true` when `value` parses as a URL carrying a non-empty username or
+ * password. A bare path (`./data.db`, `:memory:`) or a URL with no userinfo
+ * (`postgres://localhost/db`) is `false` — there is nothing secret to leak.
+ */
+export function urlHasEmbeddedCredentials(value) {
+    try {
+        const url = new URL(value);
+        return url.username !== '' || url.password !== '';
+    }
+    catch {
+        return false;
+    }
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Reads the raw, unresolved `database.url` a config file declares, or `undefined` for none. */
+export function rawDatabaseUrl(input) {
+    if (!isPlainObject(input))
+        return undefined;
+    const database = input['database'];
+    if (!isPlainObject(database))
+        return undefined;
+    const url = database['url'];
+    return typeof url === 'string' ? url : undefined;
+}
+/**
+ * `true` when `mode` (a POSIX file mode, as `fs.Stats.mode` reports it)
+ * grants read access to its group or to "other" — the two bits that matter
+ * on a shared host, where every tenant's process runs as a different,
+ * unprivileged user. Pure and platform-independent so the actual security
+ * arithmetic — which bits mean "someone else can read this" — is tested
+ * directly, without a real file or a real POSIX host.
+ */
+export function hasGroupOrOtherRead(mode) {
+    // group-read (0o040) or other-read (0o004).
+    return (mode & 0o044) !== 0;
+}
+/**
+ * `path`'s mode, read from disk, or `null` on a platform whose permission
+ * model this check does not understand (win32 — ACLs, not POSIX rwx bits;
+ * Node synthesises a `mode` there rather than reporting a real one, and
+ * reporting `false` would claim a guarantee that platform cannot make) or
+ * when the file cannot be stat'd at all. Read-only by design: fixing the
+ * mode is `create-cogenta`'s job at write time (`scaffold.ts`), not
+ * something a running server silently changes under an operator's file.
+ */
+async function isReadableByOthers(path) {
+    if (process.platform === 'win32')
+        return null;
+    try {
+        const info = await stat(path);
+        return hasGroupOrOtherRead(info.mode);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Builds the report `loadConfig` attaches to `LoadedConfig`. `rawConfig` is
+ * the *unresolved* file contents (before `resolveConfig` strips anything) —
+ * the same object `findSecretsInFile` already inspects.
+ */
+export async function buildSecretHygieneReport(rawConfig, envFilePath, envFileExists) {
+    const url = rawDatabaseUrl(rawConfig);
+    const path = envFileExists ? envFilePath : null;
+    return {
+        databaseUrlHasCredentialsInFile: url !== undefined && urlHasEmbeddedCredentials(url),
+        envFilePath: path,
+        envFileReadableByOthers: path === null ? null : await isReadableByOthers(path),
+    };
+}
+//# sourceMappingURL=secret-hygiene.js.map

package/dist/config/secret-hygiene.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-hygiene.js","sourceRoot":"","sources":["../../src/config/secret-hygiene.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACvC,OAAO,OAAO,MAAM,cAAc,CAAA;AAElC;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,OAAO,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAgBD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAA;IAClC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3B,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,4CAA4C;IAC5C,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,kBAAkB,CAAC,IAAY;IAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7B,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAkB,EAClB,WAA0B,EAC1B,aAAsB;IAEtB,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/C,OAAO;QACL,+BAA+B,EAAE,GAAG,KAAK,SAAS,IAAI,yBAAyB,CAAC,GAAG,CAAC;QACpF,WAAW,EAAE,IAAI;QACjB,uBAAuB,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC;KAC/E,CAAA;AACH,CAAC"}