@de-otio/trellis 0.4.0

package/dist/lib/secret-resolver.js

@@ -0,0 +1,183 @@
+"use strict";
+/**
+ * Secret Resolver
+ *
+ * Resolves secrets from Cloudflare Workers environment using the new naming convention:
+ * - SSM path: /trellis/{env}/session/secret
+ * - Cloudflare secret name: trellis_{env}_session_secret
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Secrets = exports.SecretResolver = void 0;
+const logger_1 = require("./logger");
+/**
+ * Secret Resolver class for resolving secrets from environment
+ */
+class SecretResolver {
+    env;
+    constructor(env) {
+        this.env = env;
+    }
+    /**
+     * Get the current environment from the Env object
+     */
+    getEnvironment() {
+        // Try ENVIRONMENT first, then DEPLOY_ENV, then default to 'dev'
+        return this.env.ENVIRONMENT || this.env.DEPLOY_ENV || "dev";
+    }
+    /**
+     * Convert SSM parameter path to Cloudflare secret name
+     * Example: /trellis/dev/session/secret -> trellis_dev_session_secret
+     */
+    ssmPathToSecretName(ssmPath) {
+        // Remove leading slash, replace all slashes with underscores
+        return ssmPath.replace(/^\//, "").replace(/\//g, "_");
+    }
+    /**
+     * Get secret value from environment using new naming convention
+     *
+     * @param ssmPath - The SSM parameter path (e.g., /trellis/dev/session/secret)
+     * @returns The secret value, or undefined if not found
+     */
+    getSecret(ssmPath) {
+        const logger = logger_1.Logger.getInstance(this.env);
+        const secretName = this.ssmPathToSecretName(ssmPath);
+        const value = this.env[secretName];
+        if (value) {
+            if (typeof value !== "string") {
+                logger.error(`[SecretResolver] Secret ${secretName} is not a string, type: ${typeof value}`);
+                return undefined;
+            }
+            if (value.length === 0) {
+                logger.error(`[SecretResolver] Secret ${secretName} is empty`);
+                return undefined;
+            }
+            logger.debug(`[SecretResolver] Found secret: ${secretName} (length: ${value.length})`);
+        }
+        else {
+            logger.debug(`[SecretResolver] Secret not found: ${secretName}`);
+            // Debug: log available env keys that start with 'trellis' or 'session'
+            const envKeys = Object.keys(this.env).filter((k) => k.toLowerCase().includes("session") ||
+                k.toLowerCase().includes("trellis"));
+            if (envKeys.length > 0) {
+                logger.debug(`[SecretResolver] Available related env keys: ${envKeys.join(", ")}`);
+            }
+        }
+        return value;
+    }
+    /**
+     * Get secret value, throwing an error if not found
+     *
+     * @param ssmPath - The SSM parameter path (e.g., /trellis/dev/session/secret)
+     * @param description - Description of the secret for error messages
+     * @returns The secret value
+     * @throws Error if the secret is not found
+     */
+    requireSecret(ssmPath, description) {
+        const value = this.getSecret(ssmPath);
+        if (!value) {
+            const secretName = this.ssmPathToSecretName(ssmPath);
+            throw new Error(`Required secret not found: ${secretName}${description ? ` (${description})` : ""}`);
+        }
+        return value;
+    }
+    /**
+     * Get environment-specific secret path
+     * Example: getEnvSecretPath('dev', 'session', 'secret') -> /trellis/dev/session/secret
+     */
+    getEnvSecretPath(...pathParts) {
+        const environment = this.getEnvironment();
+        return `/trellis/${environment}/${pathParts.join("/")}`;
+    }
+    /**
+     * Get SESSION_SECRET (primary)
+     * Supports both new naming (trellis_{env}_session_secret) and legacy (SESSION_SECRET)
+     */
+    getSessionSecret() {
+        const logger = logger_1.Logger.getInstance(this.env);
+        const env = this.getEnvironment();
+        const newSecretName = this.ssmPathToSecretName(this.getEnvSecretPath("session", "secret"));
+        // Try new naming convention first
+        const newSecret = this.getSecret(this.getEnvSecretPath("session", "secret"));
+        if (newSecret && typeof newSecret === "string" && newSecret.length > 0) {
+            return newSecret;
+        }
+        // Fallback to legacy SESSION_SECRET for backward compatibility
+        const legacySecret = this.env.SESSION_SECRET;
+        if (legacySecret &&
+            typeof legacySecret === "string" &&
+            legacySecret.length > 0) {
+            logger.info(`[SecretResolver] Using legacy secret: SESSION_SECRET (env: ${env}, length: ${legacySecret.length}, first 4 chars: ${legacySecret.substring(0, 4)})`);
+            return legacySecret;
+        }
+        // If neither exists, throw error
+        logger.error(`[SecretResolver] Secret not found: ${newSecretName} or SESSION_SECRET (env: ${env})`);
+        logger.error(`[SecretResolver] newSecret type: ${typeof newSecret}, length: ${newSecret?.length ?? "N/A"}`);
+        logger.error(`[SecretResolver] legacySecret type: ${typeof legacySecret}, length: ${legacySecret?.length ?? "N/A"}`);
+        throw new Error(`Required secret not found: ${newSecretName} or SESSION_SECRET (session encryption key)`);
+    }
+    /**
+     * Get SESSION_SECRET_FALLBACK (optional)
+     */
+    getSessionSecretFallback() {
+        return this.getSecret(this.getEnvSecretPath("session", "secret", "fallback"));
+    }
+    /**
+     * Get DATABASE_URL
+     */
+    getDatabaseUrl() {
+        return this.requireSecret(this.getEnvSecretPath("database", "hyperdrive", "url"), "database connection string");
+    }
+    /**
+     * Get DIRECT_DATABASE_URL
+     */
+    getDirectDatabaseUrl() {
+        return this.requireSecret(this.getEnvSecretPath("supabase", "database", "url"), "direct database connection string");
+    }
+    /**
+     * Get RESEND_API_KEY
+     */
+    getResendApiKey() {
+        return this.getSecret(this.getEnvSecretPath("resend", "api", "key"));
+    }
+    /**
+     * Get GOOGLE_API_KEY
+     */
+    getGoogleApiKey() {
+        return this.getSecret(this.getEnvSecretPath("backend", "google", "api", "key"));
+    }
+    /**
+     * Get OPENAI_API_KEY
+     */
+    getOpenAIApiKey() {
+        return this.getSecret(this.getEnvSecretPath("backend", "openai", "api", "key"));
+    }
+}
+exports.SecretResolver = SecretResolver;
+/**
+ * Legacy export for backward compatibility
+ * @deprecated Use new SecretResolver class instead
+ */
+exports.Secrets = {
+    getSessionSecret(env) {
+        return new SecretResolver(env).getSessionSecret();
+    },
+    getSessionSecretFallback(env) {
+        return new SecretResolver(env).getSessionSecretFallback();
+    },
+    getDatabaseUrl(env) {
+        return new SecretResolver(env).getDatabaseUrl();
+    },
+    getDirectDatabaseUrl(env) {
+        return new SecretResolver(env).getDirectDatabaseUrl();
+    },
+    getResendApiKey(env) {
+        return new SecretResolver(env).getResendApiKey();
+    },
+    getGoogleApiKey(env) {
+        return new SecretResolver(env).getGoogleApiKey();
+    },
+    getOpenAIApiKey(env) {
+        return new SecretResolver(env).getOpenAIApiKey();
+    },
+};
+//# sourceMappingURL=secret-resolver.js.map

package/dist/lib/secret-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-resolver.js","sourceRoot":"","sources":["../../src/lib/secret-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAGH,qCAAkC;AAElC;;GAEG;AACH,MAAa,cAAc;IACjB,GAAG,CAAM;IAEjB,YAAY,GAAQ;QAClB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,cAAc;QACpB,gEAAgE;QAChE,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,IAAK,IAAI,CAAC,GAAW,CAAC,UAAU,IAAI,KAAK,CAAC;IACvE,CAAC;IAED;;;OAGG;IACK,mBAAmB,CAAC,OAAe;QACzC,6DAA6D;QAC7D,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,OAAe;QACvB,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,KAAK,GAAI,IAAI,CAAC,GAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,CAAC,KAAK,CACV,2BAA2B,UAAU,2BAA2B,OAAO,KAAK,EAAE,CAC/E,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,KAAK,CAAC,2BAA2B,UAAU,WAAW,CAAC,CAAC;gBAC/D,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,CAAC,KAAK,CACV,kCAAkC,UAAU,aAAa,KAAK,CAAC,MAAM,GAAG,CACzE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAC;YACjE,uEAAuE;YACvE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAU,CAAC,CAAC,MAAM,CACjD,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACnC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CACtC,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,KAAK,CACV,gDAAgD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,aAAa,CAAC,OAAe,EAAE,WAAoB;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,8BAA8B,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,GAAG,SAAmB;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,YAAY,WAAW,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,gBAAgB;QACd,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAC5C,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAC3C,CAAC;QAEF,kCAAkC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAC9B,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAC3C,CAAC;QACF,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,+DAA+D;QAC/D,MAAM,YAAY,GAAI,IAAI,CAAC,GAAW,CAAC,cAAc,CAAC;QACtD,IACE,YAAY;YACZ,OAAO,YAAY,KAAK,QAAQ;YAChC,YAAY,CAAC,MAAM,GAAG,CAAC,EACvB,CAAC;YACD,MAAM,CAAC,IAAI,CACT,8DAA8D,GAAG,aAAa,YAAY,CAAC,MAAM,oBAAoB,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CACrJ,CAAC;YACF,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,iCAAiC;QACjC,MAAM,CAAC,KAAK,CACV,sCAAsC,aAAa,4BAA4B,GAAG,GAAG,CACtF,CAAC;QACF,MAAM,CAAC,KAAK,CACV,oCAAoC,OAAO,SAAS,aAAa,SAAS,EAAE,MAAM,IAAI,KAAK,EAAE,CAC9F,CAAC;QACF,MAAM,CAAC,KAAK,CACV,uCAAuC,OAAO,YAAY,aAAa,YAAY,EAAE,MAAM,IAAI,KAAK,EAAE,CACvG,CAAC;QACF,MAAM,IAAI,KAAK,CACb,8BAA8B,aAAa,6CAA6C,CACzF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,wBAAwB;QACtB,OAAO,IAAI,CAAC,SAAS,CACnB,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CACvD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,aAAa,CACvB,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,EACtD,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,OAAO,IAAI,CAAC,aAAa,CACvB,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,EACpD,mCAAmC,CACpC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,SAAS,CACnB,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CACzD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,SAAS,CACnB,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CACzD,CAAC;IACJ,CAAC;CACF;AAjMD,wCAiMC;AAED;;;GAGG;AACU,QAAA,OAAO,GAAG;IACrB,gBAAgB,CAAC,GAAQ;QACvB,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC;IACD,wBAAwB,CAAC,GAAQ;QAC/B,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,wBAAwB,EAAE,CAAC;IAC5D,CAAC;IACD,cAAc,CAAC,GAAQ;QACrB,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,CAAC;IAClD,CAAC;IACD,oBAAoB,CAAC,GAAQ;QAC3B,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,oBAAoB,EAAE,CAAC;IACxD,CAAC;IACD,eAAe,CAAC,GAAQ;QACtB,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,CAAC;IACnD,CAAC;IACD,eAAe,CAAC,GAAQ;QACtB,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,CAAC;IACnD,CAAC;IACD,eAAe,CAAC,GAAQ;QACtB,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,CAAC;IACnD,CAAC;CACF,CAAC"}

package/dist/lib/security-event-cleaner.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Security Event Cleaner
+ *
+ * PREPARATORY: Border Safety Mode - Security event retention cleanup
+ *
+ * Manages cleanup of expired security events based on retention policies.
+ * Currently a stub - not yet implemented. This prepares for future implementation
+ * where security events are automatically deleted after their retention period.
+ *
+ * FUTURE USE: When Border Safety Mode is implemented, this class will:
+ * - Delete expired security events based on retentionUntil field
+ * - Run as a scheduled job (e.g., daily via Cloudflare Cron Trigger)
+ * - Log cleanup statistics
+ * - Handle cleanup errors gracefully
+ *
+ * @see doc/01-business/features/b2c-features/border-safety-mode/preparatory-design-changes/06-metadata.md
+ */
+/**
+ * Security Event Cleaner
+ *
+ * Manages cleanup of expired security events. Currently a stub.
+ */
+export declare class SecurityEventCleaner {
+    /**
+     * Clean up expired security events
+     *
+     * PREPARATORY: Currently a stub that does nothing.
+     * This method prepares for future implementation where security events
+     * are automatically deleted after their retention period expires.
+     *
+     * FUTURE USE: When Border Safety Mode is implemented, this will:
+     * 1. Query database for security events where retentionUntil < current date
+     * 2. Delete expired events in batches
+     * 3. Log cleanup statistics (number of events deleted)
+     * 4. Handle errors gracefully (continue on individual failures)
+     * 5. Return count of deleted events
+     *
+     * This should be run as a scheduled job (e.g., daily via Cloudflare Cron Trigger):
+     * ```typescript
+     * // In scheduled handler
+     * const cleaner = new SecurityEventCleaner();
+     * const deletedCount = await cleaner.cleanupExpiredEvents(env);
+     * console.log(`Cleaned up ${deletedCount} expired security events`);
+     * ```
+     *
+     * @returns Promise that resolves to number of events deleted (currently always 0)
+     *
+     * @example
+     * ```typescript
+     * const cleaner = new SecurityEventCleaner();
+     * try {
+     *   const deletedCount = await cleaner.cleanupExpiredEvents();
+     *   console.log(`Deleted ${deletedCount} expired events`);
+     * } catch (error) {
+     *   // Feature not yet implemented
+     * }
+     * ```
+     */
+    cleanupExpiredEvents(): Promise<number>;
+}
+//# sourceMappingURL=security-event-cleaner.d.ts.map

package/dist/lib/security-event-cleaner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-event-cleaner.d.ts","sourceRoot":"","sources":["../../src/lib/security-event-cleaner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;GAIG;AACH,qBAAa,oBAAoB;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;CAW9C"}

package/dist/lib/security-event-cleaner.js

@@ -0,0 +1,74 @@
+"use strict";
+/**
+ * Security Event Cleaner
+ *
+ * PREPARATORY: Border Safety Mode - Security event retention cleanup
+ *
+ * Manages cleanup of expired security events based on retention policies.
+ * Currently a stub - not yet implemented. This prepares for future implementation
+ * where security events are automatically deleted after their retention period.
+ *
+ * FUTURE USE: When Border Safety Mode is implemented, this class will:
+ * - Delete expired security events based on retentionUntil field
+ * - Run as a scheduled job (e.g., daily via Cloudflare Cron Trigger)
+ * - Log cleanup statistics
+ * - Handle cleanup errors gracefully
+ *
+ * @see doc/01-business/features/b2c-features/border-safety-mode/preparatory-design-changes/06-metadata.md
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityEventCleaner = void 0;
+/**
+ * Security Event Cleaner
+ *
+ * Manages cleanup of expired security events. Currently a stub.
+ */
+class SecurityEventCleaner {
+    /**
+     * Clean up expired security events
+     *
+     * PREPARATORY: Currently a stub that does nothing.
+     * This method prepares for future implementation where security events
+     * are automatically deleted after their retention period expires.
+     *
+     * FUTURE USE: When Border Safety Mode is implemented, this will:
+     * 1. Query database for security events where retentionUntil < current date
+     * 2. Delete expired events in batches
+     * 3. Log cleanup statistics (number of events deleted)
+     * 4. Handle errors gracefully (continue on individual failures)
+     * 5. Return count of deleted events
+     *
+     * This should be run as a scheduled job (e.g., daily via Cloudflare Cron Trigger):
+     * ```typescript
+     * // In scheduled handler
+     * const cleaner = new SecurityEventCleaner();
+     * const deletedCount = await cleaner.cleanupExpiredEvents(env);
+     * console.log(`Cleaned up ${deletedCount} expired security events`);
+     * ```
+     *
+     * @returns Promise that resolves to number of events deleted (currently always 0)
+     *
+     * @example
+     * ```typescript
+     * const cleaner = new SecurityEventCleaner();
+     * try {
+     *   const deletedCount = await cleaner.cleanupExpiredEvents();
+     *   console.log(`Deleted ${deletedCount} expired events`);
+     * } catch (error) {
+     *   // Feature not yet implemented
+     * }
+     * ```
+     */
+    async cleanupExpiredEvents() {
+        // PREPARATORY: Stub for now - returns 0
+        // TODO: Implement cleanup logic when Border Safety Mode is implemented (Phase 2)
+        // This will:
+        // 1. Query SecurityEvent table for events where retentionUntil < NOW()
+        // 2. Delete expired events in batches (to avoid large transactions)
+        // 3. Log cleanup statistics
+        // 4. Return count of deleted events
+        return 0;
+    }
+}
+exports.SecurityEventCleaner = SecurityEventCleaner;
+//# sourceMappingURL=security-event-cleaner.js.map

package/dist/lib/security-event-cleaner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-event-cleaner.js","sourceRoot":"","sources":["../../src/lib/security-event-cleaner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAEH;;;;GAIG;AACH,MAAa,oBAAoB;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,KAAK,CAAC,oBAAoB;QACxB,wCAAwC;QACxC,iFAAiF;QACjF,aAAa;QACb,uEAAuE;QACvE,oEAAoE;QACpE,4BAA4B;QAC5B,oCAAoC;QAEpC,OAAO,CAAC,CAAC;IACX,CAAC;CACF;AA/CD,oDA+CC"}

package/dist/lib/security-headers.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Security Headers
+ *
+ * Utilities for adding security headers to responses.
+ *
+ * Environment Variables:
+ * - CSP_CONNECT_SRC: Additional domains for CSP connect-src directive
+ * - CSP_SCRIPT_SRC: Override for CSP script-src directive
+ * - CSP_STYLE_SRC: Override for CSP style-src directive
+ */
+export interface SecurityHeadersEnv {
+    CSP_CONNECT_SRC?: string;
+    CSP_SCRIPT_SRC?: string;
+    CSP_STYLE_SRC?: string;
+}
+/**
+ * Security Headers manager class
+ */
+export declare class SecurityHeaders {
+    private headers;
+    constructor(env?: SecurityHeadersEnv);
+    /**
+     * Build CSP connect-src directive with environment-specific domains
+     */
+    private buildCSPConnectSrc;
+    /**
+     * Add security headers to a response
+     * Preserves existing headers and status
+     */
+    addSecurityHeaders(response: Response): Response;
+    /**
+     * Add security headers to a new response
+     */
+    createSecureResponse(body: BodyInit | null, init?: ResponseInit): Response;
+}
+//# sourceMappingURL=security-headers.d.ts.map

package/dist/lib/security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/lib/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,kBAAkB;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAyB;gBAE5B,GAAG,CAAC,EAAE,kBAAkB;IA8BpC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAiB1B;;;OAGG;IACH,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ;IAgBhD;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,QAAQ;CAI3E"}

package/dist/lib/security-headers.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * Security Headers
+ *
+ * Utilities for adding security headers to responses.
+ *
+ * Environment Variables:
+ * - CSP_CONNECT_SRC: Additional domains for CSP connect-src directive
+ * - CSP_SCRIPT_SRC: Override for CSP script-src directive
+ * - CSP_STYLE_SRC: Override for CSP style-src directive
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityHeaders = void 0;
+/**
+ * Security Headers manager class
+ */
+class SecurityHeaders {
+    headers;
+    constructor(env) {
+        // Build CSP policy based on environment
+        const cspConnectSrc = this.buildCSPConnectSrc(env);
+        const cspScriptSrc = env?.CSP_SCRIPT_SRC || "'self' https://www.gstatic.com";
+        // Note: 'unsafe-inline' intentionally removed for security. If Flutter web
+        // uses inline styles, set CSP_STYLE_SRC env var to include 'unsafe-inline'.
+        const cspStyleSrc = env?.CSP_STYLE_SRC || "'self' https://fonts.googleapis.com";
+        const csp = [
+            "default-src 'self'",
+            `script-src ${cspScriptSrc}`,
+            `style-src ${cspStyleSrc}`,
+            "img-src 'self' data: https:",
+            "font-src 'self' data: https://fonts.gstatic.com",
+            `connect-src ${cspConnectSrc}`,
+            "frame-ancestors 'none'",
+        ].join("; ");
+        this.headers = {
+            "X-Content-Type-Options": "nosniff",
+            "X-Frame-Options": "DENY",
+            "X-XSS-Protection": "1; mode=block",
+            "Referrer-Policy": "strict-origin-when-cross-origin",
+            "Strict-Transport-Security": "max-age=31536000; includeSubDomains; preload",
+            "Content-Security-Policy": csp,
+        };
+    }
+    /**
+     * Build CSP connect-src directive with environment-specific domains
+     */
+    buildCSPConnectSrc(env) {
+        const defaults = [
+            "'self'",
+            "https://bsky.social",
+            "https://api.rkm1.de",
+            "https://www.gstatic.com",
+        ];
+        if (env?.CSP_CONNECT_SRC) {
+            // Add additional domains from environment
+            const additionalDomains = env.CSP_CONNECT_SRC.trim().split(/\s+/);
+            return [...defaults, ...additionalDomains].join(" ");
+        }
+        return defaults.join(" ");
+    }
+    /**
+     * Add security headers to a response
+     * Preserves existing headers and status
+     */
+    addSecurityHeaders(response) {
+        // Create a new response with the same body and status
+        const newResponse = new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: response.headers,
+        });
+        // Add security headers (this will override if they already exist)
+        Object.entries(this.headers).forEach(([key, value]) => {
+            newResponse.headers.set(key, value);
+        });
+        return newResponse;
+    }
+    /**
+     * Add security headers to a new response
+     */
+    createSecureResponse(body, init) {
+        const response = new Response(body, init);
+        return this.addSecurityHeaders(response);
+    }
+}
+exports.SecurityHeaders = SecurityHeaders;
+//# sourceMappingURL=security-headers.js.map

package/dist/lib/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/lib/security-headers.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAQH;;GAEG;AACH,MAAa,eAAe;IAClB,OAAO,CAAyB;IAExC,YAAY,GAAwB;QAClC,wCAAwC;QACxC,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,YAAY,GAChB,GAAG,EAAE,cAAc,IAAI,gCAAgC,CAAC;QAC1D,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,WAAW,GAAG,GAAG,EAAE,aAAa,IAAI,qCAAqC,CAAC;QAEhF,MAAM,GAAG,GAAG;YACV,oBAAoB;YACpB,cAAc,YAAY,EAAE;YAC5B,aAAa,WAAW,EAAE;YAC1B,6BAA6B;YAC7B,iDAAiD;YACjD,eAAe,aAAa,EAAE;YAC9B,wBAAwB;SACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,IAAI,CAAC,OAAO,GAAG;YACb,wBAAwB,EAAE,SAAS;YACnC,iBAAiB,EAAE,MAAM;YACzB,kBAAkB,EAAE,eAAe;YACnC,iBAAiB,EAAE,iCAAiC;YACpD,2BAA2B,EACzB,8CAA8C;YAChD,yBAAyB,EAAE,GAAG;SAC/B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,GAAwB;QACjD,MAAM,QAAQ,GAAG;YACf,QAAQ;YACR,qBAAqB;YACrB,qBAAqB;YACrB,yBAAyB;SAC1B,CAAC;QAEF,IAAI,GAAG,EAAE,eAAe,EAAE,CAAC;YACzB,0CAA0C;YAC1C,MAAM,iBAAiB,GAAG,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,QAAkB;QACnC,sDAAsD;QACtD,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAC;QAEH,kEAAkE;QAClE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YACpD,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAqB,EAAE,IAAmB;QAC7D,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF;AAhFD,0CAgFC"}

package/dist/lib/security-monitor.d.ts

@@ -0,0 +1,92 @@
+import type { AnalyticsEngineDataset } from "../types/cloudflare-compat";
+export type SecurityEventType = "sso_login" | "sso_failed" | "sso_config_error" | "rate_limit_exceeded" | "suspicious_activity" | "unauthorized_access" | "database_connection_failure";
+export type SecurityEventSeverity = "low" | "medium" | "high" | "critical";
+export interface SecurityEvent {
+    type: SecurityEventType;
+    severity: SecurityEventSeverity;
+    userId?: string;
+    partnerId?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    provider?: string;
+    success: boolean;
+    metadata?: Record<string, any>;
+}
+export interface Env {
+    DATABASE_URL: string;
+    SECURITY_WEBHOOK_URL?: string;
+    ANALYTICS?: AnalyticsEngineDataset;
+    ANALYTICS_OPT_OUT_ENABLED?: string;
+}
+/**
+ * Security Monitor class for logging and monitoring security events
+ */
+export declare class SecurityMonitor {
+    /**
+     * Log SSO authentication event
+     */
+    logSSOEvent(event: {
+        type: "sso_login" | "sso_failed" | "sso_config_error";
+        userId?: string;
+        provider: string;
+        ipAddress: string;
+        userAgent: string;
+        success: boolean;
+        metadata?: Record<string, any>;
+    }, env: Env): Promise<void>;
+    /**
+     * Calculate retention date based on severity
+     *
+     * PREPARATORY CHANGE: This function calculates when a security event should be deleted.
+     * FUTURE USE: A scheduled cleanup job will use this to automatically delete old logs.
+     *
+     * Retention periods:
+     * - critical: 365 days (1 year)
+     * - high: 90 days
+     * - medium: 30 days
+     * - low: 7 days
+     *
+     * @param severity - Event severity level
+     * @returns Date when the event should be deleted, or null if retention is disabled
+     */
+    private calculateRetentionUntil;
+    /**
+     * Log security event to database and monitoring systems
+     *
+     * PREPARATORY CHANGE: Now includes retention date calculation for future log cleanup.
+     */
+    logSecurityEvent(event: SecurityEvent, env: Env): Promise<void>;
+    /**
+     * Determine severity based on event type and success
+     */
+    private determineSeverity;
+    /**
+     * Detect failed authentication patterns
+     */
+    private detectFailedAuthPattern;
+    /**
+     * Check if analytics should be sent based on user preferences
+     *
+     * PREPARATORY CHANGE: This abstraction allows future analytics opt-out functionality.
+     * FUTURE USE: When user.analyticsOptOut is true, this will return false to skip analytics.
+     *
+     * Currently always returns true (current behavior, no breaking changes).
+     * When analytics opt-out is implemented, this will query the user's preference.
+     *
+     * @param userId - Optional user ID to check preferences
+     * @param env - Environment with configuration
+     * @returns true if analytics should be sent, false if user has opted out
+     */
+    private shouldSendAnalytics;
+    /**
+     * Send event to monitoring system
+     *
+     * PREPARATORY CHANGE: Now respects user analytics opt-out preference (when enabled).
+     */
+    private sendToMonitoring;
+    /**
+     * Send alert for critical events
+     */
+    private sendAlert;
+}
+//# sourceMappingURL=security-monitor.d.ts.map

package/dist/lib/security-monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-monitor.d.ts","sourceRoot":"","sources":["../../src/lib/security-monitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAWzE,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,YAAY,GACZ,kBAAkB,GAClB,qBAAqB,GACrB,qBAAqB,GACrB,qBAAqB,GACrB,6BAA6B,CAAC;AAElC,MAAM,MAAM,qBAAqB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,EAAE,qBAAqB,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,GAAG;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,EAAE,sBAAsB,CAAC;IAGnC,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B;;OAEG;IACG,WAAW,CACf,KAAK,EAAE;QACL,IAAI,EAAE,WAAW,GAAG,YAAY,GAAG,kBAAkB,CAAC;QACtD,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAChC,EACD,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC;IAkBhB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,uBAAuB;IAgB/B;;;;OAIG;IACG,gBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IA0DrE;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAyBzB;;OAEG;YACW,uBAAuB;IAyDrC;;;;;;;;;;;;OAYG;YACW,mBAAmB;IA4BjC;;;;OAIG;YACW,gBAAgB;IA4C9B;;OAEG;YACW,SAAS;CAmCxB"}