@de-otio/trellis 0.4.0

package/dist/lib/security-monitor.js

@@ -0,0 +1,287 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityMonitor = void 0;
+/**
+ * Security Monitor
+ *
+ * Handles security event logging, monitoring, and alerting for SSO authentication.
+ */
+const db_1 = require("../db");
+const logger_1 = require("./logger");
+/**
+ * Security Monitor class for logging and monitoring security events
+ */
+class SecurityMonitor {
+    /**
+     * Log SSO authentication event
+     */
+    async logSSOEvent(event, env) {
+        const severity = this.determineSeverity(event.type, event.success);
+        await this.logSecurityEvent({
+            type: event.type,
+            severity,
+            userId: event.userId,
+            ipAddress: event.ipAddress,
+            userAgent: event.userAgent,
+            provider: event.provider,
+            success: event.success,
+            metadata: event.metadata,
+        }, env);
+    }
+    /**
+     * Calculate retention date based on severity
+     *
+     * PREPARATORY CHANGE: This function calculates when a security event should be deleted.
+     * FUTURE USE: A scheduled cleanup job will use this to automatically delete old logs.
+     *
+     * Retention periods:
+     * - critical: 365 days (1 year)
+     * - high: 90 days
+     * - medium: 30 days
+     * - low: 7 days
+     *
+     * @param severity - Event severity level
+     * @returns Date when the event should be deleted, or null if retention is disabled
+     */
+    calculateRetentionUntil(severity) {
+        const retentionDays = {
+            critical: 365, // Keep critical events for 1 year
+            high: 90, // Keep high severity for 90 days
+            medium: 30, // Keep medium for 30 days
+            low: 7, // Keep low for 7 days
+        };
+        const days = retentionDays[severity] || 30;
+        const date = new Date();
+        date.setDate(date.getDate() + days);
+        return date;
+    }
+    /**
+     * Log security event to database and monitoring systems
+     *
+     * PREPARATORY CHANGE: Now includes retention date calculation for future log cleanup.
+     */
+    async logSecurityEvent(event, env) {
+        try {
+            const db = (0, db_1.createPrisma)(env);
+            // PREPARATORY: Calculate retention date for future cleanup job
+            // FUTURE USE: Cleanup job will delete events where retentionUntil < NOW()
+            const retentionUntil = this.calculateRetentionUntil(event.severity);
+            // Store in database (if SecurityEvent table exists)
+            try {
+                // Use Prisma create method instead of raw SQL for better compatibility with driver adapters
+                await db.securityEvent.create({
+                    data: {
+                        type: event.type,
+                        severity: event.severity,
+                        userId: event.userId || null,
+                        partnerId: event.partnerId || null,
+                        ipAddress: event.ipAddress || null,
+                        userAgent: event.userAgent || null,
+                        details: JSON.stringify({
+                            provider: event.provider,
+                            success: event.success,
+                            ...event.metadata,
+                        }),
+                        retentionUntil: retentionUntil, // PREPARATORY: Set retention date (null if column doesn't exist yet)
+                    },
+                });
+            }
+            catch (dbError) {
+                // Table might not exist yet - log to console for now
+                // This is expected until migration is run
+                // If retention_until column doesn't exist, the insert will fail - that's okay for now
+                logger_1.Logger.getInstance(env).warn("[SecurityMonitor] Database logging failed (table may not exist, migration needed):", dbError);
+            }
+            // Send to monitoring system
+            await this.sendToMonitoring(event, env);
+            // Alert if critical or high severity
+            if (event.severity === "critical" || event.severity === "high") {
+                await this.sendAlert(event, env);
+            }
+            // Detect suspicious patterns
+            if (event.type === "sso_failed") {
+                await this.detectFailedAuthPattern(event, env);
+            }
+        }
+        catch (error) {
+            // Don't fail the request if logging fails
+            logger_1.Logger.getInstance(env).error("[SecurityMonitor] Failed to log security event:", error);
+        }
+    }
+    /**
+     * Determine severity based on event type and success
+     */
+    determineSeverity(type, success) {
+        if (type === "sso_login" && success) {
+            return "low";
+        }
+        if (type === "sso_failed") {
+            return "high";
+        }
+        if (type === "sso_config_error") {
+            return "medium";
+        }
+        if (type === "rate_limit_exceeded") {
+            return "medium";
+        }
+        if (type === "suspicious_activity") {
+            return "high";
+        }
+        if (type === "unauthorized_access") {
+            return "critical";
+        }
+        return "low";
+    }
+    /**
+     * Detect failed authentication patterns
+     */
+    async detectFailedAuthPattern(event, env) {
+        if (!event.ipAddress)
+            return;
+        try {
+            const db = (0, db_1.createPrisma)(env);
+            // Check for multiple failed attempts from same IP in last 15 minutes
+            try {
+                const recentFailures = await db.$queryRawUnsafe(`
+          SELECT COUNT(*) as count
+          FROM security_events
+          WHERE type = 'sso_failed'
+            AND ip_address = $1
+            AND timestamp > NOW() - INTERVAL '15 minutes'
+        `, event.ipAddress);
+                const failureCount = Number(recentFailures[0]?.count || 0);
+                if (failureCount >= 5) {
+                    // Alert on suspicious pattern
+                    await this.logSecurityEvent({
+                        type: "suspicious_activity",
+                        severity: "high",
+                        ipAddress: event.ipAddress,
+                        userAgent: event.userAgent,
+                        success: false,
+                        metadata: {
+                            reason: "multiple_failed_attempts",
+                            failureCount,
+                            window: "15_minutes",
+                        },
+                    }, env);
+                }
+            }
+            catch (error) {
+                // Table might not exist yet - skip pattern detection
+                logger_1.Logger.getInstance(env).warn("[SecurityMonitor] Failed to detect failed auth pattern (table may not exist):", error);
+            }
+        }
+        catch (error) {
+            logger_1.Logger.getInstance(env).error("[SecurityMonitor] Failed to detect failed auth pattern:", error);
+        }
+    }
+    /**
+     * Check if analytics should be sent based on user preferences
+     *
+     * PREPARATORY CHANGE: This abstraction allows future analytics opt-out functionality.
+     * FUTURE USE: When user.analyticsOptOut is true, this will return false to skip analytics.
+     *
+     * Currently always returns true (current behavior, no breaking changes).
+     * When analytics opt-out is implemented, this will query the user's preference.
+     *
+     * @param userId - Optional user ID to check preferences
+     * @param env - Environment with configuration
+     * @returns true if analytics should be sent, false if user has opted out
+     */
+    async shouldSendAnalytics(userId, env) {
+        // If no user, send analytics (anonymous usage)
+        if (!userId) {
+            return true;
+        }
+        // PREPARATORY: Check if analytics opt-out is enabled
+        // FUTURE USE: When ANALYTICS_OPT_OUT_ENABLED=true, query user preference from database
+        if (env?.ANALYTICS_OPT_OUT_ENABLED !== "true") {
+            // Feature not enabled yet - always send analytics (current behavior)
+            return true;
+        }
+        // FUTURE IMPLEMENTATION:
+        // const db = createPrisma(env);
+        // const user = await db.user.findUnique({
+        //   where: { id: userId },
+        //   select: { analyticsOptOut: true },
+        // });
+        // return !user?.analyticsOptOut;
+        // For now, always return true (no breaking changes)
+        return true;
+    }
+    /**
+     * Send event to monitoring system
+     *
+     * PREPARATORY CHANGE: Now respects user analytics opt-out preference (when enabled).
+     */
+    async sendToMonitoring(event, env) {
+        // PREPARATORY: Check if analytics should be sent based on user preferences
+        // FUTURE USE: When analytics opt-out is implemented, this will skip analytics for opted-out users
+        const shouldSend = await this.shouldSendAnalytics(event.userId, env);
+        // Send to Cloudflare Analytics Engine if available and user hasn't opted out
+        if (env.ANALYTICS && shouldSend) {
+            try {
+                await env.ANALYTICS.writeDataPoint({
+                    blobs: [
+                        "security_event",
+                        event.type,
+                        event.severity,
+                        event.provider || "",
+                    ],
+                    doubles: [Date.now()],
+                    indexes: [
+                        `security:${event.type}`,
+                        `severity:${event.severity}`,
+                        event.provider ? `provider:${event.provider}` : "",
+                    ].filter(Boolean),
+                });
+            }
+            catch (error) {
+                logger_1.Logger.getInstance(env).error("[SecurityMonitor] Analytics write failed:", error);
+                // Don't throw - analytics failures shouldn't break the app
+            }
+        }
+        // Log to console for development
+        logger_1.Logger.getInstance(env).info("[SecurityMonitor]", {
+            type: event.type,
+            severity: event.severity,
+            provider: event.provider,
+            success: event.success,
+            ipAddress: event.ipAddress,
+        });
+    }
+    /**
+     * Send alert for critical events
+     */
+    async sendAlert(event, env) {
+        if (!env.SECURITY_WEBHOOK_URL) {
+            // No webhook configured - just log
+            logger_1.Logger.getInstance(env).warn("[SecurityMonitor] Security alert (no webhook configured):", event);
+            return;
+        }
+        try {
+            await fetch(env.SECURITY_WEBHOOK_URL, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    title: `Security Alert: ${event.type}`,
+                    severity: event.severity,
+                    event: {
+                        type: event.type,
+                        provider: event.provider,
+                        success: event.success,
+                        ipAddress: event.ipAddress,
+                        userAgent: event.userAgent,
+                        metadata: event.metadata,
+                    },
+                    timestamp: new Date().toISOString(),
+                }),
+            });
+        }
+        catch (error) {
+            logger_1.Logger.getInstance(env).error("[SecurityMonitor] Failed to send alert:", error);
+        }
+    }
+}
+exports.SecurityMonitor = SecurityMonitor;
+//# sourceMappingURL=security-monitor.js.map

package/dist/lib/security-monitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-monitor.js","sourceRoot":"","sources":["../../src/lib/security-monitor.ts"],"names":[],"mappings":";;;AACA;;;;GAIG;AAGH,8BAAqC;AACrC,qCAAkD;AAkClD;;GAEG;AACH,MAAa,eAAe;IAC1B;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,KAQC,EACD,GAAQ;QAER,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnE,MAAM,IAAI,CAAC,gBAAgB,CACzB;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ;YACR,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,uBAAuB,CAC7B,QAA+B;QAE/B,MAAM,aAAa,GAA0C;YAC3D,QAAQ,EAAE,GAAG,EAAE,kCAAkC;YACjD,IAAI,EAAE,EAAE,EAAE,iCAAiC;YAC3C,MAAM,EAAE,EAAE,EAAE,0BAA0B;YACtC,GAAG,EAAE,CAAC,EAAE,sBAAsB;SAC/B,CAAC;QAEF,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAoB,EAAE,GAAQ;QACnD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;YAE7B,+DAA+D;YAC/D,0EAA0E;YAC1E,MAAM,cAAc,GAAG,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAEpE,oDAAoD;YACpD,IAAI,CAAC;gBACH,4FAA4F;gBAC5F,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;oBAC5B,IAAI,EAAE;wBACJ,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;wBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;wBAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;wBAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;wBAClC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;4BACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,OAAO,EAAE,KAAK,CAAC,OAAO;4BACtB,GAAG,KAAK,CAAC,QAAQ;yBAClB,CAAC;wBACF,cAAc,EAAE,cAAc,EAAE,qEAAqE;qBACtG;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,qDAAqD;gBACrD,0CAA0C;gBAC1C,sFAAsF;gBACtF,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,oFAAoF,EACpF,OAAO,CACR,CAAC;YACJ,CAAC;YAED,4BAA4B;YAC5B,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAExC,qCAAqC;YACrC,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC/D,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACnC,CAAC;YAED,6BAA6B;YAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0CAA0C;YAC1C,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,iDAAiD,EACjD,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,iBAAiB,CACvB,IAAuB,EACvB,OAAgB;QAEhB,IAAI,IAAI,KAAK,WAAW,IAAI,OAAO,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAChC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACnC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACnC,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,uBAAuB,CACnC,KAAoB,EACpB,GAAQ;QAER,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,OAAO;QAE7B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;YAE7B,qEAAqE;YACrE,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,MAAO,EAAE,CAAC,eAAuB,CACtD;;;;;;SAMD,EACC,KAAK,CAAC,SAAS,CAChB,CAAC;gBAEF,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;gBAE3D,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;oBACtB,8BAA8B;oBAC9B,MAAM,IAAI,CAAC,gBAAgB,CACzB;wBACE,IAAI,EAAE,qBAAqB;wBAC3B,QAAQ,EAAE,MAAM;wBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,OAAO,EAAE,KAAK;wBACd,QAAQ,EAAE;4BACR,MAAM,EAAE,0BAA0B;4BAClC,YAAY;4BACZ,MAAM,EAAE,YAAY;yBACrB;qBACF,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,qDAAqD;gBACrD,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,+EAA+E,EAC/E,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,yDAAyD,EACzD,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAe,EACf,GAAS;QAET,+CAA+C;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qDAAqD;QACrD,uFAAuF;QACvF,IAAI,GAAG,EAAE,yBAAyB,KAAK,MAAM,EAAE,CAAC;YAC9C,qEAAqE;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yBAAyB;QACzB,gCAAgC;QAChC,0CAA0C;QAC1C,2BAA2B;QAC3B,uCAAuC;QACvC,MAAM;QACN,iCAAiC;QAEjC,oDAAoD;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAC5B,KAAoB,EACpB,GAAQ;QAER,2EAA2E;QAC3E,kGAAkG;QAClG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAErE,6EAA6E;QAC7E,IAAI,GAAG,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC;oBACjC,KAAK,EAAE;wBACL,gBAAgB;wBAChB,KAAK,CAAC,IAAI;wBACV,KAAK,CAAC,QAAQ;wBACd,KAAK,CAAC,QAAQ,IAAI,EAAE;qBACrB;oBACD,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;oBACrB,OAAO,EAAE;wBACP,YAAY,KAAK,CAAC,IAAI,EAAE;wBACxB,YAAY,KAAK,CAAC,QAAQ,EAAE;wBAC5B,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE;qBACnD,CAAC,MAAM,CAAC,OAAO,CAAC;iBAClB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,2CAA2C,EAC3C,KAAK,CACN,CAAC;gBACF,2DAA2D;YAC7D,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE;YAChD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS,CAAC,KAAoB,EAAE,GAAQ;QACpD,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;YAC9B,mCAAmC;YACnC,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,2DAA2D,EAC3D,KAAK,CACN,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBACpC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,mBAAmB,KAAK,CAAC,IAAI,EAAE;oBACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE;wBACL,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;qBACzB;oBACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,yCAAyC,EACzC,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAvVD,0CAuVC"}

package/dist/lib/sentiment-digest.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Sentiment Digest Generator
+ *
+ * Generates a digest of sentiment activity on a user's posts.
+ * Uses KV cache with 1-hour TTL to avoid repeated DB queries.
+ * Part of Stream C: Sentiment Safeguards.
+ */
+import type { Env } from "../env";
+export interface SentimentDigest {
+    posts: Array<{
+        postId: string;
+        postPreview: string;
+        sentiments: string[];
+        newSentimentCount: number;
+    }>;
+    generatedAt: Date;
+}
+export declare function generateSentimentDigest(userId: string, since: Date, env: Env): Promise<SentimentDigest>;
+//# sourceMappingURL=sentiment-digest.d.ts.map

package/dist/lib/sentiment-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentiment-digest.d.ts","sourceRoot":"","sources":["../../src/lib/sentiment-digest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAIlC,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,KAAK,CAAC;QACX,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC,CAAC;IACH,WAAW,EAAE,IAAI,CAAC;CACnB;AAID,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,IAAI,EACX,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,eAAe,CAAC,CAwF1B"}

package/dist/lib/sentiment-digest.js

@@ -0,0 +1,99 @@
+"use strict";
+/**
+ * Sentiment Digest Generator
+ *
+ * Generates a digest of sentiment activity on a user's posts.
+ * Uses KV cache with 1-hour TTL to avoid repeated DB queries.
+ * Part of Stream C: Sentiment Safeguards.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSentimentDigest = generateSentimentDigest;
+const db_1 = require("../db");
+const logger_1 = require("./logger");
+const DIGEST_CACHE_TTL_SECONDS = 3600; // 1 hour
+async function generateSentimentDigest(userId, since, env) {
+    const logger = logger_1.Logger.getInstance(env);
+    const cacheKey = `digest:${userId}`;
+    // 1. Try to read from KV cache
+    if (env.FEED_CACHE_KV) {
+        try {
+            const cached = await env.FEED_CACHE_KV.get(cacheKey);
+            if (cached) {
+                const parsed = JSON.parse(cached);
+                const cachedAt = new Date(parsed.generatedAt);
+                const now = new Date();
+                const ageMs = now.getTime() - cachedAt.getTime();
+                // Return cached if not expired (1 hour TTL)
+                if (ageMs < DIGEST_CACHE_TTL_SECONDS * 1000) {
+                    return {
+                        ...parsed,
+                        generatedAt: cachedAt,
+                    };
+                }
+            }
+        }
+        catch (error) {
+            logger.warn("Error reading digest cache, falling back to DB", error);
+        }
+    }
+    // 2. Query DB for posts by userId that have sentiments since `since`
+    const db = (0, db_1.createPrisma)(env);
+    try {
+        const posts = await db.post.findMany({
+            where: {
+                authorId: userId,
+                sentiments: {
+                    some: {
+                        createdAt: { gte: since },
+                    },
+                },
+            },
+            select: {
+                id: true,
+                text: true,
+                sentiments: {
+                    where: {
+                        createdAt: { gte: since },
+                    },
+                    select: {
+                        sentiment: true,
+                    },
+                },
+            },
+            orderBy: { createdAt: "desc" },
+            take: 50, // Circuit breaker: max 50 posts per digest
+        });
+        // 3. For each post: get unique sentiment types and count
+        const digestPosts = posts.map((post) => {
+            const sentiments = [
+                ...new Set(post.sentiments.map((s) => s.sentiment)),
+            ];
+            return {
+                postId: post.id,
+                postPreview: (post.text || "").slice(0, 100),
+                sentiments,
+                newSentimentCount: post.sentiments.length,
+            };
+        });
+        const digest = {
+            posts: digestPosts,
+            generatedAt: new Date(),
+        };
+        // 4. Cache result in KV with 1-hour TTL
+        if (env.FEED_CACHE_KV) {
+            try {
+                await env.FEED_CACHE_KV.put(cacheKey, JSON.stringify(digest), {
+                    expirationTtl: DIGEST_CACHE_TTL_SECONDS,
+                });
+            }
+            catch (error) {
+                logger.warn("Error writing digest cache", error);
+            }
+        }
+        return digest;
+    }
+    finally {
+        await db.release();
+    }
+}
+//# sourceMappingURL=sentiment-digest.js.map

package/dist/lib/sentiment-digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentiment-digest.js","sourceRoot":"","sources":["../../src/lib/sentiment-digest.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAkBH,0DA4FC;AA3GD,8BAAqC;AACrC,qCAAkC;AAYlC,MAAM,wBAAwB,GAAG,IAAI,CAAC,CAAC,SAAS;AAEzC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,KAAW,EACX,GAAQ;IAER,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,UAAU,MAAM,EAAE,CAAC;IAEpC,+BAA+B;IAC/B,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAClC,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAEjD,4CAA4C;gBAC5C,IAAI,KAAK,GAAG,wBAAwB,GAAG,IAAI,EAAE,CAAC;oBAC5C,OAAO;wBACL,GAAG,MAAM;wBACT,WAAW,EAAE,QAAQ;qBACtB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnC,KAAK,EAAE;gBACL,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE;oBACV,IAAI,EAAE;wBACJ,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE;qBAC1B;iBACF;aACF;YACD,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,IAAI;gBACV,UAAU,EAAE;oBACV,KAAK,EAAE;wBACL,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE;qBAC1B;oBACD,MAAM,EAAE;wBACN,SAAS,EAAE,IAAI;qBAChB;iBACF;aACF;YACD,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC9B,IAAI,EAAE,EAAE,EAAE,2CAA2C;SACtD,CAAC,CAAC;QAEH,yDAAyD;QACzD,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACrC,MAAM,UAAU,GAAG;gBACjB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAwB,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aAC3E,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC5C,UAAU;gBACV,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;aAC1C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAoB;YAC9B,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,IAAI,IAAI,EAAE;SACxB,CAAC;QAEF,wCAAwC;QACxC,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;oBAC5D,aAAa,EAAE,wBAAwB;iBACxC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/lib/sentiment-display.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Sentiment Display Mode
+ *
+ * Determines how sentiment data is displayed based on the viewer's age tier
+ * and whether they are the post author. Part of Stream C: Sentiment Safeguards.
+ *
+ * Rules:
+ * - CHILD viewing own post: DISTRIBUTION (aggregate only)
+ * - CHILD viewing other's post: HIDDEN (no sentiment data)
+ * - TEEN viewing any post: DISTRIBUTION (aggregate only)
+ * - ADULT viewing any post: FULL (all details)
+ */
+import type { AgeTier } from "@prisma/client";
+export declare enum SentimentDisplayMode {
+    FULL = "full",
+    DISTRIBUTION = "distribution",
+    HIDDEN = "hidden"
+}
+export declare function getSentimentDisplayMode(ageTier: AgeTier, isPostAuthor: boolean): SentimentDisplayMode;
+//# sourceMappingURL=sentiment-display.d.ts.map

package/dist/lib/sentiment-display.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentiment-display.d.ts","sourceRoot":"","sources":["../../src/lib/sentiment-display.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAE9C,oBAAY,oBAAoB;IAC9B,IAAI,SAAS;IACb,YAAY,iBAAiB;IAC7B,MAAM,WAAW;CAClB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,OAAO,GACpB,oBAAoB,CActB"}

package/dist/lib/sentiment-display.js

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * Sentiment Display Mode
+ *
+ * Determines how sentiment data is displayed based on the viewer's age tier
+ * and whether they are the post author. Part of Stream C: Sentiment Safeguards.
+ *
+ * Rules:
+ * - CHILD viewing own post: DISTRIBUTION (aggregate only)
+ * - CHILD viewing other's post: HIDDEN (no sentiment data)
+ * - TEEN viewing any post: DISTRIBUTION (aggregate only)
+ * - ADULT viewing any post: FULL (all details)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SentimentDisplayMode = void 0;
+exports.getSentimentDisplayMode = getSentimentDisplayMode;
+var SentimentDisplayMode;
+(function (SentimentDisplayMode) {
+    SentimentDisplayMode["FULL"] = "full";
+    SentimentDisplayMode["DISTRIBUTION"] = "distribution";
+    SentimentDisplayMode["HIDDEN"] = "hidden";
+})(SentimentDisplayMode || (exports.SentimentDisplayMode = SentimentDisplayMode = {}));
+function getSentimentDisplayMode(ageTier, isPostAuthor) {
+    switch (ageTier) {
+        case "CHILD":
+            return isPostAuthor
+                ? SentimentDisplayMode.DISTRIBUTION
+                : SentimentDisplayMode.HIDDEN;
+        case "TEEN":
+            return SentimentDisplayMode.DISTRIBUTION;
+        case "ADULT":
+            return SentimentDisplayMode.FULL;
+        default:
+            // Default to most restrictive for unknown tiers
+            return SentimentDisplayMode.HIDDEN;
+    }
+}
+//# sourceMappingURL=sentiment-display.js.map

package/dist/lib/sentiment-display.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentiment-display.js","sourceRoot":"","sources":["../../src/lib/sentiment-display.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAUH,0DAiBC;AAvBD,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,qCAAa,CAAA;IACb,qDAA6B,CAAA;IAC7B,yCAAiB,CAAA;AACnB,CAAC,EAJW,oBAAoB,oCAApB,oBAAoB,QAI/B;AAED,SAAgB,uBAAuB,CACrC,OAAgB,EAChB,YAAqB;IAErB,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,YAAY;gBACjB,CAAC,CAAC,oBAAoB,CAAC,YAAY;gBACnC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC;QAClC,KAAK,MAAM;YACT,OAAO,oBAAoB,CAAC,YAAY,CAAC;QAC3C,KAAK,OAAO;YACV,OAAO,oBAAoB,CAAC,IAAI,CAAC;QACnC;YACE,gDAAgD;YAChD,OAAO,oBAAoB,CAAC,MAAM,CAAC;IACvC,CAAC;AACH,CAAC"}

package/dist/lib/services/image-normalizer.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Image normalizer — no-op stub for AWS architecture.
+ *
+ * In the AWS stack, ICC profile normalization (Display P3 → sRGB) and
+ * format conversion happen asynchronously in the Lambda media-processing-worker
+ * via Sharp, triggered by the S3 upload event → SQS → Lambda pipeline.
+ *
+ * The original Cloudflare Images synchronous path is no longer used.
+ */
+export declare class ImageNormalizer {
+    constructor(_images: unknown, _mediaBucket: unknown);
+    /** Returns null — processing is async via Lambda media-processing-worker. */
+    normalize(_originalKey: string, _contentHash: string): Promise<string | null>;
+}
+//# sourceMappingURL=image-normalizer.d.ts.map

package/dist/lib/services/image-normalizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-normalizer.d.ts","sourceRoot":"","sources":["../../../src/lib/services/image-normalizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,qBAAa,eAAe;gBAEd,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO;IAEnD,6EAA6E;IACvE,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGpF"}

package/dist/lib/services/image-normalizer.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImageNormalizer = void 0;
+/**
+ * Image normalizer — no-op stub for AWS architecture.
+ *
+ * In the AWS stack, ICC profile normalization (Display P3 → sRGB) and
+ * format conversion happen asynchronously in the Lambda media-processing-worker
+ * via Sharp, triggered by the S3 upload event → SQS → Lambda pipeline.
+ *
+ * The original Cloudflare Images synchronous path is no longer used.
+ */
+class ImageNormalizer {
+    // eslint-disable-next-line @typescript-eslint/no-useless-constructor
+    constructor(_images, _mediaBucket) { }
+    /** Returns null — processing is async via Lambda media-processing-worker. */
+    async normalize(_originalKey, _contentHash) {
+        return null;
+    }
+}
+exports.ImageNormalizer = ImageNormalizer;
+//# sourceMappingURL=image-normalizer.js.map

package/dist/lib/services/image-normalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-normalizer.js","sourceRoot":"","sources":["../../../src/lib/services/image-normalizer.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACH,MAAa,eAAe;IAC1B,qEAAqE;IACrE,YAAY,OAAgB,EAAE,YAAqB,IAAG,CAAC;IAEvD,6EAA6E;IAC7E,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,YAAoB;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AARD,0CAQC"}

package/dist/lib/services/media-reconciliation-service.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Media Reconciliation Service
+ *
+ * Processes queued media uploads and creates database records
+ * Handles deduplication, retries, and R2 metadata updates
+ */
+import type { MediaReconciliationMessage } from "../types/media-reconciliation";
+export declare class MediaReconciliationService {
+    private env;
+    private r2Bucket;
+    constructor(env: any);
+    /**
+     * Reconcile batch of media uploads
+     */
+    reconcileBatch(messages: MediaReconciliationMessage[]): Promise<void>;
+    /**
+     * Update R2 metadata for newly reconciled uploads
+     */
+    private updateR2Metadata;
+    /**
+     * Update R2 metadata for existing records (deduplication case)
+     */
+    private updateR2MetadataForExisting;
+}
+//# sourceMappingURL=media-reconciliation-service.d.ts.map

package/dist/lib/services/media-reconciliation-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-reconciliation-service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/media-reconciliation-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAEhF,qBAAa,0BAA0B;IACrC,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,QAAQ,CAAW;gBAEf,GAAG,EAAE,GAAG;IAKpB;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,0BAA0B,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA2G3E;;OAEG;YACW,gBAAgB;IAuD9B;;OAEG;YACW,2BAA2B;CA0C1C"}