@cogenta/core 0.4.0 → 0.6.0

package/dist/config/schema.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { CACHE_DRIVERS, DATABASE_DRIVERS, EMBEDDINGS_PROVIDERS, IMAGE_GENERATION_PROVIDERS, QUEUE_DRIVERS, STORAGE_DRIVERS, VECTOR_DRIVERS, } from './types.js';
+import { CACHE_DRIVERS, DATABASE_DRIVERS, EMBEDDINGS_PROVIDERS, IMAGE_GENERATION_PROVIDERS, PAYMENT_DRIVERS, QUEUE_DRIVERS, RATE_LIMIT_DRIVERS, STORAGE_DRIVERS, VECTOR_DRIVERS, } from './types.js';
 const nonEmpty = z.string().min(1);
 // Every object is strict: a typo in a key is an error, never a silently ignored
 // setting. Config drift between staging and production is the daily pain this
@@ -45,6 +45,10 @@ const queueSchema = z.strictObject({
     driver: z.enum(QUEUE_DRIVERS).default('auto'),
     url: nonEmpty.optional(),
 });
+const rateLimitSchema = z.strictObject({
+    driver: z.enum(RATE_LIMIT_DRIVERS).default('auto'),
+    url: nonEmpty.optional(),
+});
 const storageSchema = z.strictObject({
     driver: z.enum(STORAGE_DRIVERS).default('auto'),
     bucket: nonEmpty.optional(),
@@ -82,6 +86,21 @@ const corsSchema = z
     error: 'credentials cannot be combined with the "*" origin — every browser refuses that pair',
     path: ['credentials'],
 });
+/**
+ * Audit-log retention (T09-01 / fiche 21 task 5's retention half —
+ * `AuditLog.prune()` existed since that fiche with no caller anywhere in
+ * the codebase).
+ *
+ * Absent `retainDays` — the default — means the log grows without bound,
+ * exactly the behaviour before this setting existed: unlike the 404 log or
+ * analytics events, an audit trail disappearing on a schedule nobody asked
+ * for is a worse default than a bigger database, so `cogenta serve` never
+ * purges unless a site opts in. `0` is the explicit, documented way to say
+ * "never purge" out loud rather than by omission.
+ */
+const auditRetentionSchema = z.strictObject({
+    retainDays: z.number().int().nonnegative().max(3650).optional(),
+});
 const securitySchema = z.strictObject({
     cors: corsSchema.prefault({}),
     /**
@@ -106,6 +125,26 @@ const securitySchema = z.strictObject({
     hstsIncludeSubDomains: z.boolean().default(true),
     /** How long a public page may be cached, in seconds. */
     pageMaxAge: z.number().int().nonnegative().max(86_400).default(60),
+    audit: auditRetentionSchema.prefault({}),
+});
+/**
+ * The log of public URLs that answered a 404 (fiche 12 task 1).
+ *
+ * On by default, because an unresolved 404 is the daily nuisance no CMS
+ * should make an editor discover by luck. Everything it keeps is bounded on
+ * purpose: `maxPaths` is the hard cap on distinct paths tracked at once — an
+ * anonymous scanner can produce thousands of unique URLs a minute, and
+ * without a ceiling this log would be a disk-exhaustion vector any visitor
+ * could trigger — and `retainDays` is how long a path is kept since it was
+ * last requested. Neither an IP address nor a user agent is ever a field
+ * here, on any path: `AGENTS.md` § Logs forbids personal data outright, and
+ * the path plus its referrer already answer the only question this log
+ * exists for ("what should I redirect?").
+ */
+const notFoundLogSchema = z.strictObject({
+    enabled: z.boolean().default(true),
+    maxPaths: z.number().int().positive().max(100_000).default(2000),
+    retainDays: z.number().int().positive().max(3650).default(30),
 });
 /**
  * Outbound content-lifecycle webhooks (L14 task 1).
@@ -120,6 +159,18 @@ const webhooksSchema = z.strictObject({
     /** Absolute `http(s)` URLs. Empty — the default — means no webhook is sent. */
     endpoints: z.array(z.url()).default([]),
 });
+/**
+ * Analytics events retention (fiche 27 task 3).
+ *
+ * 400 days by default — long enough that "compare this year to last year" (a
+ * real question a site owner asks) still has data on both sides, short
+ * enough that the events table cannot grow forever on a busy site. `cogenta
+ * serve` purges past this every day; there is no way to disable purging
+ * outright, only to choose how long to keep.
+ */
+const analyticsSchema = z.strictObject({
+    retainDays: z.number().int().positive().max(3650).default(400),
+});
 const embeddingsSchema = z.strictObject({
     provider: z.enum(EMBEDDINGS_PROVIDERS).default('local'),
     model: nonEmpty.default('all-MiniLM-L6-v2'),
@@ -165,6 +216,94 @@ const billingSchema = z.strictObject({
     taxId: nonEmpty.optional(),
     footer: nonEmpty.optional(),
 });
+/**
+ * The scheduled-task clock (fiche 28 task 5).
+ *
+ * `'internal'` (the default) is `cogenta serve`'s own `setInterval` loop —
+ * the same shape every other recurring job in this codebase has always
+ * used, and the right choice for a process that stays up. `'external-cron'`
+ * is `docs/hebergement-mutualise.md`'s target: a host that recycles the
+ * process between requests, where an in-memory timer never fires reliably.
+ * In that mode `cogenta serve` registers every task but never ticks its own
+ * clock — only `cogenta cron`, called from the panel's own cron, drains due
+ * tasks. The admin screen reads this setting to say which mode is active,
+ * rather than guessing from whether a tick has happened recently.
+ */
+const schedulerSchema = z.strictObject({
+    mode: z.enum(['internal', 'external-cron']).default('internal'),
+});
+/**
+ * Scheduled full-site backups, riding the same clock as every other
+ * maintenance task (fiche 28 task 1's "sauvegarde planifiée", reusing
+ * `@cogenta/export`'s `createBackup` — the exact function `cogenta backup
+ * create` already calls by hand). Off by default: a backup file is
+ * unbounded disk usage a site did not ask for, and `dir` defaults to
+ * `.cogenta/backups` — the same directory the manual command writes to, so
+ * `cogenta backup list` shows scheduled and manual backups side by side.
+ */
+const backupSchema = z.strictObject({
+    enabled: z.boolean().default(false),
+    intervalHours: z
+        .number()
+        .int()
+        .positive()
+        .max(24 * 30)
+        .default(24),
+    /** Files kept before the oldest is pruned. */
+    keep: z.number().int().positive().max(365).default(10),
+    dir: nonEmpty.default('.cogenta/backups'),
+});
+/**
+ * The writing assistant's spending cap (fiche 30 task 3).
+ *
+ * A non-null default rather than "unlimited": the lot's own pitfall is exact
+ * — "le coût est invisible jusqu'à la facture", and a service billed per token
+ * left uncapped by default is the wrong default for a CMS that ships with AI
+ * off. One million tokens a month is generous for a single site's editors
+ * while still being a real ceiling, not a decoration.
+ */
+const assistantSchema = z.strictObject({
+    monthlyTokenLimit: z.number().int().positive().default(1_000_000),
+});
+/**
+ * OpenTelemetry tracing (fiche L22 task 5). No `otlpHeaders` field, on
+ * purpose (rule R7, `SECRET_KEYS` in `env.ts` refuses it before this schema
+ * even parses) — those come from `COGENTA_OTLP_HEADERS`/
+ * `OTEL_EXPORTER_OTLP_HEADERS` only. `otlpEndpoint` absent means local
+ * collection only: the recent-events buffer behind the admin's
+ * "Exploitation" screen always works with nothing configured here (R1).
+ */
+const observabilitySchema = z.strictObject({
+    serviceName: nonEmpty.default('cogenta'),
+    otlpEndpoint: z.url().optional(),
+});
+/**
+ * Contract E's payment gateway choice (fiche 34 task 3).
+ *
+ * No `secretKey` or `webhookSecret` field, on purpose (rule R7, same shape as
+ * `llmSchema`'s missing `apiKey`): Stripe's credentials come from
+ * `COGENTA_PAYMENT_STRIPE_SECRET_KEY`/`COGENTA_PAYMENT_STRIPE_WEBHOOK_SECRET`
+ * only, and `SECRET_KEYS` (`env.ts`) refuses either one written here before
+ * this schema is even parsed. `testMode` defaults `true`: a shop that has not
+ * deliberately flipped it to production cannot silently start taking real
+ * money, matching the fiche's "le mode test doit être criant".
+ */
+const paymentSchema = z.strictObject({
+    driver: z.enum(PAYMENT_DRIVERS).default('auto'),
+    testMode: z.boolean().default(true),
+    manualInstructions: nonEmpty.optional(),
+});
+/**
+ * Google Search Console OAuth (fiche 70 task 4, ADR-0032). No fields at all —
+ * the app's own OAuth client id/secret are both secrets (rule R7) and come
+ * from `COGENTA_SEARCH_CONSOLE_CLIENT_ID`/`COGENTA_SEARCH_CONSOLE_CLIENT_SECRET`
+ * only, refused here by `SECRET_KEYS` (`env.ts`) exactly like `payment`'s own
+ * Stripe/PayPal keys. Everything per-site — whether a site has connected, and
+ * which GSC property it queries — lives in the database
+ * (`@cogenta/schema`'s `search-console-store.ts`), never here: this section
+ * exists only so the *installation* can offer the connector at all.
+ */
+const searchConsoleSchema = z.strictObject({});
 // `prefault` rather than `default`: an omitted section is parsed as `{}` so the
 // per-field defaults inside it apply, instead of being replaced wholesale.
 export const configSchema = z.strictObject({
@@ -172,14 +311,23 @@ export const configSchema = z.strictObject({
     database: databaseSchema,
     cache: cacheSchema.prefault({}),
     queue: queueSchema.prefault({}),
+    rateLimit: rateLimitSchema.prefault({}),
     storage: storageSchema.prefault({}),
     security: securitySchema.prefault({}),
+    notFoundLog: notFoundLogSchema.prefault({}),
     webhooks: webhooksSchema.prefault({}),
+    analytics: analyticsSchema.prefault({}),
     llm: llmSchema.optional(),
     embeddings: embeddingsSchema.prefault({}),
     imageGeneration: imageGenerationSchema.optional(),
     vector: vectorSchema.prefault({}),
     billing: billingSchema.optional(),
+    scheduler: schedulerSchema.prefault({}),
+    backup: backupSchema.prefault({}),
+    assistant: assistantSchema.prefault({}),
+    payment: paymentSchema.prefault({}),
+    observability: observabilitySchema.prefault({}),
+    searchConsole: searchConsoleSchema.prefault({}),
 });
 /**
  * Renders Zod issues as `field: reason`, one per line, so the user sees every

package/dist/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAA;AAEnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAElC,gFAAgF;AAChF,8EAA8E;AAC9E,uCAAuC;AACvC,MAAM,UAAU,GAAG,CAAC;KACjB,YAAY,CAAC;IACZ,IAAI,EAAE,QAAQ;IACd,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;IACZ,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;IACjD,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC;;;;;;;;;OASG;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,UAAU,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,6DAA6D,EAAE,CAAC;SACzF,OAAO,CAAC,MAAM,CAAC;CACnB,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;IAC3D,KAAK,EAAE,qDAAqD;IAC5D,IAAI,EAAE,CAAC,eAAe,CAAC;CACxB,CAAC,CAAA;AAEJ,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC3C,GAAG,EAAE,QAAQ;IACb,qEAAqE;IACrE,8DAA8D;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC1D,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;IACxB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;CAC3C,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;CACzB,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC1C,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;CACpC,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,CAAC;KACjB,YAAY,CAAC;IACZ,mGAAmG;IACnG,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrF,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACrE,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,+CAA+C;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CAChE,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE;IACnE,KAAK,EAAE,sFAAsF;IAC7F,IAAI,EAAE,CAAC,aAAa,CAAC;CACtB,CAAC,CAAA;AAEJ,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7B;;;;;;;;OAQG;IACH,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,wDAAwD;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,+EAA+E;IAC/E,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxC,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvD,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CACrD,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAC5C,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC5C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC;CAC3C,CAAC,CAAA;AAEF;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,SAAS,EAAE,QAAQ;IACnB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC1B,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAA;AAEF,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,cAAc;IACxB,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/B,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrC,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE;IACzB,UAAU,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzC,eAAe,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACjD,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAA;AAIF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,OAAO,KAAK,CAAC,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,OAAO,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAA;IAC/D,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAA;AAEnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAElC,gFAAgF;AAChF,8EAA8E;AAC9E,uCAAuC;AACvC,MAAM,UAAU,GAAG,CAAC;KACjB,YAAY,CAAC;IACZ,IAAI,EAAE,QAAQ;IACd,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;IACZ,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;IACjD,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC;;;;;;;;;OASG;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,UAAU,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,6DAA6D,EAAE,CAAC;SACzF,OAAO,CAAC,MAAM,CAAC;CACnB,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;IAC3D,KAAK,EAAE,qDAAqD;IAC5D,IAAI,EAAE,CAAC,eAAe,CAAC;CACxB,CAAC,CAAA;AAEJ,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC3C,GAAG,EAAE,QAAQ;IACb,qEAAqE;IACrE,8DAA8D;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC1D,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;IACxB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;CAC3C,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;CACzB,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAClD,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;CACzB,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC1C,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;CACpC,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,CAAC;KACjB,YAAY,CAAC;IACZ,mGAAmG;IACnG,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrF,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACrE,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,+CAA+C;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CAChE,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE;IACnE,KAAK,EAAE,sFAAsF;IAC7F,IAAI,EAAE,CAAC,aAAa,CAAC;CACtB,CAAC,CAAA;AAEJ;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7B;;;;;;;;OAQG;IACH,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,wDAAwD;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;CACzC,CAAC,CAAA;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,YAAY,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAChE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,+EAA+E;IAC/E,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxC,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CAC/D,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvD,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CACrD,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAC5C,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC5C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC;CAC3C,CAAC,CAAA;AAEF;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,SAAS,EAAE,QAAQ;IACnB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC1B,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;CAChE,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;SACZ,OAAO,CAAC,EAAE,CAAC;IACd,8CAA8C;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;CAC1C,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;CAClE,CAAC,CAAA;AAEF;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;IACxC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF;;;;;;;;;;GAUG;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACnC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;AAE9C,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,cAAc;IACxB,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/B,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrC,WAAW,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrC,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE;IACzB,UAAU,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzC,eAAe,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACjD,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjC,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,aAAa,EAAE,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/C,aAAa,EAAE,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;CAChD,CAAC,CAAA;AAIF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,OAAO,KAAK,CAAC,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,OAAO,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAA;IAC/D,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC"}

package/dist/config/secret-hygiene.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Detects, but never blocks, the two secret-hygiene gaps fiche 23 names as
+ * open (audit follow-up to L10 task 6 / `docs/hebergement-mutualise.md`):
+ * `create-cogenta` used to write a database URL — password included — into
+ * `cogenta.config.mjs` in the clear, and the generated `.env` (which holds
+ * `COGENTA_AUTH_SIGNING_KEY`) was written without a restrictive file mode, so
+ * another tenant on shared hosting could read it.
+ *
+ * `SECRET_KEYS` (`env.ts`) cannot simply gain `database.url`: unlike an API
+ * key, a database URL is legitimately present in the file for the common
+ * case — a SQLite path, or a Postgres URL with no password at all (peer
+ * trust, a local dev server) — so refusing it outright at `resolveConfig`
+ * would break every SQLite site, which is Cogenta's zero-config default.
+ * What *is* always wrong is a URL that embeds real credentials: that half is
+ * detected here and **surfaced**, on the ops-settings mirror (fiche 23 task
+ * 5's literal ask — "détecter et signaler"), never turned into a hard
+ * refusal that would regress a legitimate config.
+ */
+/**
+ * `true` when `value` parses as a URL carrying a non-empty username or
+ * password. A bare path (`./data.db`, `:memory:`) or a URL with no userinfo
+ * (`postgres://localhost/db`) is `false` — there is nothing secret to leak.
+ */
+export declare function urlHasEmbeddedCredentials(value: string): boolean;
+export interface SecretHygieneReport {
+    /** `true` when the raw config file sets `database.url` to a URL carrying real credentials. */
+    readonly databaseUrlHasCredentialsInFile: boolean;
+    /** The `.env` file `loadConfig` looked for next to the config, or `null` when there is no config file. */
+    readonly envFilePath: string | null;
+    /**
+     * `true` when `.env` grants read access to the file's group or to anyone
+     * else on the machine — exactly what a shared-hosting neighbour would use.
+     * `null` when there is no `.env` file, or the platform's permission bits
+     * are not the POSIX ones this check reads (win32).
+     */
+    readonly envFileReadableByOthers: boolean | null;
+}
+/** Reads the raw, unresolved `database.url` a config file declares, or `undefined` for none. */
+export declare function rawDatabaseUrl(input: unknown): string | undefined;
+/**
+ * `true` when `mode` (a POSIX file mode, as `fs.Stats.mode` reports it)
+ * grants read access to its group or to "other" — the two bits that matter
+ * on a shared host, where every tenant's process runs as a different,
+ * unprivileged user. Pure and platform-independent so the actual security
+ * arithmetic — which bits mean "someone else can read this" — is tested
+ * directly, without a real file or a real POSIX host.
+ */
+export declare function hasGroupOrOtherRead(mode: number): boolean;
+/**
+ * Builds the report `loadConfig` attaches to `LoadedConfig`. `rawConfig` is
+ * the *unresolved* file contents (before `resolveConfig` strips anything) —
+ * the same object `findSecretsInFile` already inspects.
+ */
+export declare function buildSecretHygieneReport(rawConfig: unknown, envFilePath: string | null, envFileExists: boolean): Promise<SecretHygieneReport>;
+//# sourceMappingURL=secret-hygiene.d.ts.map

package/dist/config/secret-hygiene.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-hygiene.d.ts","sourceRoot":"","sources":["../../src/config/secret-hygiene.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOhE;AAED,MAAM,WAAW,mBAAmB;IAClC,8FAA8F;IAC9F,QAAQ,CAAC,+BAA+B,EAAE,OAAO,CAAA;IACjD,0GAA0G;IAC1G,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,GAAG,IAAI,CAAA;CACjD;AAMD,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMjE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD;AAqBD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,OAAO,EAClB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,mBAAmB,CAAC,CAQ9B"}

package/dist/config/secret-hygiene.js

@@ -0,0 +1,94 @@
+import { stat } from 'node:fs/promises';
+import process from 'node:process';
+/**
+ * Detects, but never blocks, the two secret-hygiene gaps fiche 23 names as
+ * open (audit follow-up to L10 task 6 / `docs/hebergement-mutualise.md`):
+ * `create-cogenta` used to write a database URL — password included — into
+ * `cogenta.config.mjs` in the clear, and the generated `.env` (which holds
+ * `COGENTA_AUTH_SIGNING_KEY`) was written without a restrictive file mode, so
+ * another tenant on shared hosting could read it.
+ *
+ * `SECRET_KEYS` (`env.ts`) cannot simply gain `database.url`: unlike an API
+ * key, a database URL is legitimately present in the file for the common
+ * case — a SQLite path, or a Postgres URL with no password at all (peer
+ * trust, a local dev server) — so refusing it outright at `resolveConfig`
+ * would break every SQLite site, which is Cogenta's zero-config default.
+ * What *is* always wrong is a URL that embeds real credentials: that half is
+ * detected here and **surfaced**, on the ops-settings mirror (fiche 23 task
+ * 5's literal ask — "détecter et signaler"), never turned into a hard
+ * refusal that would regress a legitimate config.
+ */
+/**
+ * `true` when `value` parses as a URL carrying a non-empty username or
+ * password. A bare path (`./data.db`, `:memory:`) or a URL with no userinfo
+ * (`postgres://localhost/db`) is `false` — there is nothing secret to leak.
+ */
+export function urlHasEmbeddedCredentials(value) {
+    try {
+        const url = new URL(value);
+        return url.username !== '' || url.password !== '';
+    }
+    catch {
+        return false;
+    }
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Reads the raw, unresolved `database.url` a config file declares, or `undefined` for none. */
+export function rawDatabaseUrl(input) {
+    if (!isPlainObject(input))
+        return undefined;
+    const database = input['database'];
+    if (!isPlainObject(database))
+        return undefined;
+    const url = database['url'];
+    return typeof url === 'string' ? url : undefined;
+}
+/**
+ * `true` when `mode` (a POSIX file mode, as `fs.Stats.mode` reports it)
+ * grants read access to its group or to "other" — the two bits that matter
+ * on a shared host, where every tenant's process runs as a different,
+ * unprivileged user. Pure and platform-independent so the actual security
+ * arithmetic — which bits mean "someone else can read this" — is tested
+ * directly, without a real file or a real POSIX host.
+ */
+export function hasGroupOrOtherRead(mode) {
+    // group-read (0o040) or other-read (0o004).
+    return (mode & 0o044) !== 0;
+}
+/**
+ * `path`'s mode, read from disk, or `null` on a platform whose permission
+ * model this check does not understand (win32 — ACLs, not POSIX rwx bits;
+ * Node synthesises a `mode` there rather than reporting a real one, and
+ * reporting `false` would claim a guarantee that platform cannot make) or
+ * when the file cannot be stat'd at all. Read-only by design: fixing the
+ * mode is `create-cogenta`'s job at write time (`scaffold.ts`), not
+ * something a running server silently changes under an operator's file.
+ */
+async function isReadableByOthers(path) {
+    if (process.platform === 'win32')
+        return null;
+    try {
+        const info = await stat(path);
+        return hasGroupOrOtherRead(info.mode);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Builds the report `loadConfig` attaches to `LoadedConfig`. `rawConfig` is
+ * the *unresolved* file contents (before `resolveConfig` strips anything) —
+ * the same object `findSecretsInFile` already inspects.
+ */
+export async function buildSecretHygieneReport(rawConfig, envFilePath, envFileExists) {
+    const url = rawDatabaseUrl(rawConfig);
+    const path = envFileExists ? envFilePath : null;
+    return {
+        databaseUrlHasCredentialsInFile: url !== undefined && urlHasEmbeddedCredentials(url),
+        envFilePath: path,
+        envFileReadableByOthers: path === null ? null : await isReadableByOthers(path),
+    };
+}
+//# sourceMappingURL=secret-hygiene.js.map

package/dist/config/secret-hygiene.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-hygiene.js","sourceRoot":"","sources":["../../src/config/secret-hygiene.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACvC,OAAO,OAAO,MAAM,cAAc,CAAA;AAElC;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,OAAO,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAgBD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAA;IAClC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3B,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,4CAA4C;IAC5C,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,kBAAkB,CAAC,IAAY;IAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7B,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAkB,EAClB,WAA0B,EAC1B,aAAsB;IAEtB,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/C,OAAO;QACL,+BAA+B,EAAE,GAAG,KAAK,SAAS,IAAI,yBAAyB,CAAC,GAAG,CAAC;QACpF,WAAW,EAAE,IAAI;QACjB,uBAAuB,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC;KAC/E,CAAA;AACH,CAAC"}

package/dist/config/types.d.ts

@@ -1,19 +1,25 @@
 export declare const DATABASE_DRIVERS: readonly ['postgres', 'mysql', 'sqlite'];
 export declare const CACHE_DRIVERS: readonly ['auto', 'redis', 'file', 'memory'];
 export declare const QUEUE_DRIVERS: readonly ['auto', 'redis', 'database'];
+/** Per-API-key request quota (fiche 20 task 3). `auto` prefers Redis, falling back to the in-process counter (R1). */
+export declare const RATE_LIMIT_DRIVERS: readonly ['auto', 'redis', 'memory'];
 export declare const STORAGE_DRIVERS: readonly ['auto', 's3', 'local'];
 export declare const EMBEDDINGS_PROVIDERS: readonly ['local', 'openai'];
 /** Image generation vendors (L18 task 4). Never one hardcoded vendor. */
 export declare const IMAGE_GENERATION_PROVIDERS: readonly ['openai', 'stability'];
 /** Where embeddings are kept (L18 tasks 1/5). `auto` lets the registry choose, optimal first. */
 export declare const VECTOR_DRIVERS: readonly ['auto', 'pgvector', 'file', 'memory'];
+/** Contract E's payment gateway (fiche 34 task 3). `auto` prefers Stripe or PayPal, whichever has real credentials configured, falling back to bank transfer (R1). */
+export declare const PAYMENT_DRIVERS: readonly ['auto', 'stripe', 'paypal', 'manual'];
 export type DatabaseDriverName = (typeof DATABASE_DRIVERS)[number];
 export type CacheDriverName = (typeof CACHE_DRIVERS)[number];
 export type QueueDriverName = (typeof QUEUE_DRIVERS)[number];
+export type RateLimitDriverName = (typeof RATE_LIMIT_DRIVERS)[number];
 export type StorageDriverName = (typeof STORAGE_DRIVERS)[number];
 export type EmbeddingsProvider = (typeof EMBEDDINGS_PROVIDERS)[number];
 export type ImageGenerationProvider = (typeof IMAGE_GENERATION_PROVIDERS)[number];
 export type VectorDriverName = (typeof VECTOR_DRIVERS)[number];
+export type PaymentDriverName = (typeof PAYMENT_DRIVERS)[number];
 /**
  * What a user writes in `cogenta.config.ts`. Everything but `site` and
  * `database` is optional, and no field here may hold a secret — those come from
@@ -44,6 +50,15 @@ export interface CogentaConfigInput {
         readonly driver?: QueueDriverName;
         readonly url?: string;
     };
+    /**
+     * Per-API-key request quota (fiche 20 task 3, R1). `auto` — the default —
+     * prefers Redis when one is configured and falls back to an in-process
+     * counter otherwise, so the limiter works on a site with no Redis at all.
+     */
+    readonly rateLimit?: {
+        readonly driver?: RateLimitDriverName;
+        readonly url?: string;
+    };
     readonly storage?: {
         readonly driver?: StorageDriverName;
         readonly bucket?: string;
@@ -78,6 +93,26 @@ export interface CogentaConfigInput {
         readonly hstsIncludeSubDomains?: boolean;
         /** How long a public page may be cached, in seconds. */
         readonly pageMaxAge?: number;
+        /**
+         * Audit-log retention (T09-01). Absent — the default — means the log
+         * grows without bound, unchanged from before this field existed. `0` is
+         * the explicit way to say "never purge" rather than leaving it absent.
+         */
+        readonly audit?: {
+            readonly retainDays?: number;
+        };
+    };
+    /**
+     * The log of public URLs that answered a 404 (fiche 12 task 1). On by
+     * default; every field bounds how much this ever keeps (see the schema
+     * comment in `schema.ts` for why). Never carries an IP or a user agent.
+     */
+    readonly notFoundLog?: {
+        readonly enabled?: boolean;
+        /** Distinct paths tracked before new ones stop being recorded. */
+        readonly maxPaths?: number;
+        /** Days a path is kept since it was last requested. */
+        readonly retainDays?: number;
     };
     /**
      * Where a content-lifecycle webhook is sent (L14 task 1).
@@ -88,6 +123,17 @@ export interface CogentaConfigInput {
     readonly webhooks?: {
         readonly endpoints?: readonly string[];
     };
+    /**
+     * Self-hosted, cookie-free page-view analytics (`@cogenta/analytics`, fiche
+     * 27 task 3). The only knob a site owner has: how long a raw event row is
+     * kept before `cogenta serve`'s daily sweep purges it. The events table is
+     * the largest table on a site with real traffic (fiche 27's own piège), so
+     * there is no way to switch purging off entirely — only how long to wait.
+     */
+    readonly analytics?: {
+        /** Days an event row is kept, counted from when it was recorded. */
+        readonly retainDays?: number;
+    };
     readonly llm?: {
         readonly provider?: string;
         readonly model?: string;
@@ -132,6 +178,58 @@ export interface CogentaConfigInput {
         /** Legal footer printed on every invoice page: payment terms, mentions. */
         readonly footer?: string;
     };
+    /** The scheduled-task clock (fiche 28 task 5). `'internal'` by default — see the schema comment for what `'external-cron'` changes. */
+    readonly scheduler?: {
+        readonly mode?: 'internal' | 'external-cron';
+    };
+    /** Scheduled full-site backups (fiche 28 task 1). Off by default. */
+    readonly backup?: {
+        readonly enabled?: boolean;
+        readonly intervalHours?: number;
+        readonly keep?: number;
+        readonly dir?: string;
+    };
+    /** The writing assistant's spending cap (fiche 30 task 3). Absent means the default cap applies — never "unlimited". */
+    readonly assistant?: {
+        readonly monthlyTokenLimit?: number;
+    };
+    /**
+     * OpenTelemetry tracing (fiche L22 task 5). Whether collection actually
+     * runs, and the log level it runs at, are **not** here — those are
+     * editorial (`observability.enabled`/`observability.logLevel` in
+     * `SITE_SETTINGS_REGISTRY`, changeable from the admin with no restart).
+     * This section only holds what an infra operator wires once: where to
+     * export to. There is no `otlpHeaders` field, on purpose (rule R7, same
+     * shape as `payment`'s missing `stripeSecretKey`): a header commonly
+     * carries a bearer token for the OTLP backend, so it comes from
+     * `COGENTA_OTLP_HEADERS`/`OTEL_EXPORTER_OTLP_HEADERS` only.
+     */
+    readonly observability?: {
+        readonly serviceName?: string;
+        /** Absent means "local collection only" (R1) — no external exporter runs. */
+        readonly otlpEndpoint?: string;
+    };
+    /**
+     * Which payment gateway a shop uses (contract E, fiche 34 task 3).
+     *
+     * There is no `secretKey`, `webhookSecret`, `clientId`, `clientSecret` or
+     * `webhookId` field here, on purpose (rule R7): Stripe's credentials come
+     * from `COGENTA_PAYMENT_STRIPE_SECRET_KEY` and
+     * `COGENTA_PAYMENT_STRIPE_WEBHOOK_SECRET` only, PayPal's from
+     * `COGENTA_PAYMENT_PAYPAL_CLIENT_ID`, `COGENTA_PAYMENT_PAYPAL_CLIENT_SECRET`
+     * and `COGENTA_PAYMENT_PAYPAL_WEBHOOK_ID`, and the admin payment screen
+     * shows their *presence*, never their value. `testMode` is a declared
+     * intent an operator sets deliberately — it does not infer test vs. live
+     * from the shape of a key, so a shop that switches gateway modes without
+     * updating this flag gets a loud, visible mismatch rather than a silent
+     * one.
+     */
+    readonly payment?: {
+        readonly driver?: PaymentDriverName;
+        readonly testMode?: boolean;
+        /** Shown to the shopper by the bank-transfer driver. Free text, per site. Not a secret. */
+        readonly manualInstructions?: string;
+    };
 }
 /**
  * What the rest of Cogenta consumes: every field resolved, defaults applied,
@@ -163,6 +261,10 @@ export interface CogentaConfig {
         readonly driver: QueueDriverName;
         readonly url: string | undefined;
     };
+    readonly rateLimit: {
+        readonly driver: RateLimitDriverName;
+        readonly url: string | undefined;
+    };
     readonly storage: {
         readonly driver: StorageDriverName;
         readonly bucket: string | undefined;
@@ -194,6 +296,16 @@ export interface CogentaConfig {
         readonly hstsMaxAge: number;
         readonly hstsIncludeSubDomains: boolean;
         readonly pageMaxAge: number;
+        readonly audit: {
+            /** `undefined` (absent) and `0` both mean "never purge" — see the input type's comment. */
+            readonly retainDays: number | undefined;
+        };
+    };
+    /** The log of public URLs that answered a 404 (fiche 12 task 1). Resolved, defaults applied. */
+    readonly notFoundLog: {
+        readonly enabled: boolean;
+        readonly maxPaths: number;
+        readonly retainDays: number;
     };
     /**
      * `secret` is `undefined` until `COGENTA_WEBHOOK_SECRET` is set. Whoever
@@ -204,6 +316,10 @@ export interface CogentaConfig {
         readonly endpoints: readonly string[];
         readonly secret: string | undefined;
     };
+    /** The events-table retention window (fiche 27 task 3). Resolved, default applied. */
+    readonly analytics: {
+        readonly retainDays: number;
+    };
     /** Absent when no provider is configured. The CMS works without AI (rule R2). */
     readonly llm: {
         readonly provider: string;
@@ -239,6 +355,56 @@ export interface CogentaConfig {
         readonly taxId: string | undefined;
         readonly footer: string | undefined;
     } | undefined;
+    /** The scheduled-task clock (fiche 28 task 5). Resolved, defaults applied. */
+    readonly scheduler: {
+        readonly mode: 'internal' | 'external-cron';
+    };
+    /** Scheduled full-site backups (fiche 28 task 1). Resolved, defaults applied. */
+    readonly backup: {
+        readonly enabled: boolean;
+        readonly intervalHours: number;
+        readonly keep: number;
+        readonly dir: string;
+    };
+    /** The writing assistant's spending cap (fiche 30 task 3), always resolved — never absent. */
+    readonly assistant: {
+        readonly monthlyTokenLimit: number;
+    };
+    /** OpenTelemetry tracing (fiche L22 task 5), always resolved — never absent (R1: local collection needs no export target at all). */
+    readonly observability: {
+        readonly serviceName: string;
+        /** `undefined` means no OTLP exporter runs — the local exporter (recent-events buffer, NDJSON) still does. */
+        readonly otlpEndpoint: string | undefined;
+        /** `undefined` until `COGENTA_OTLP_HEADERS`/`OTEL_EXPORTER_OTLP_HEADERS` is set. */
+        readonly otlpHeaders: Readonly<Record<string, string>> | undefined;
+    };
+    /** Contract E's payment gateway (fiche 34 task 3), always resolved — never absent (a shop with no key still takes bank transfers, R1/R2). */
+    readonly payment: {
+        readonly driver: PaymentDriverName;
+        readonly testMode: boolean;
+        readonly manualInstructions: string | undefined;
+        /** `undefined` until `COGENTA_PAYMENT_STRIPE_SECRET_KEY` is set. Never round-tripped to any admin response — only its presence is. */
+        readonly stripeSecretKey: string | undefined;
+        /** `undefined` until `COGENTA_PAYMENT_STRIPE_WEBHOOK_SECRET` is set. */
+        readonly stripeWebhookSecret: string | undefined;
+        /** `undefined` until `COGENTA_PAYMENT_PAYPAL_CLIENT_ID` is set. Never round-tripped to any admin response — only its presence is. */
+        readonly paypalClientId: string | undefined;
+        /** `undefined` until `COGENTA_PAYMENT_PAYPAL_CLIENT_SECRET` is set. */
+        readonly paypalClientSecret: string | undefined;
+        /** `undefined` until `COGENTA_PAYMENT_PAYPAL_WEBHOOK_ID` is set. */
+        readonly paypalWebhookId: string | undefined;
+    };
+    /**
+     * Google Search Console OAuth (fiche 70 task 4, ADR-0032), always
+     * resolved — never absent (R1/R2: a site with no OAuth app configured
+     * simply offers no connector, the rest of the SEO screen is unaffected).
+     */
+    readonly searchConsole: {
+        /** `undefined` until `COGENTA_SEARCH_CONSOLE_CLIENT_ID` is set — the whole connector is unreachable until then. */
+        readonly clientId: string | undefined;
+        /** `undefined` until `COGENTA_SEARCH_CONSOLE_CLIENT_SECRET` is set. Never round-tripped to any admin response. */
+        readonly clientSecret: string | undefined;
+    };
 }
 /** A read-only view of the process environment. */
 export type Environment = Readonly<Record<string, string | undefined>>;