@de-otio/trellis 0.4.0

package/dist/lib/activitypub/standalone-mode.js

@@ -0,0 +1,127 @@
+"use strict";
+/**
+ * ActivityPub Standalone Mode Helper
+ *
+ * Provides efficient checking of the ActivityPub Standalone Mode feature toggle.
+ * In standalone mode, the application runs ActivityPub protocol features locally
+ * only, without federation (no remote activities, deliveries, or fetches).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isStandaloneModeEnabled = isStandaloneModeEnabled;
+exports.isRemoteUri = isRemoteUri;
+const logger_1 = require("../logger");
+const database_connection_manager_1 = require("../database-connection-manager");
+const db_query_helper_1 = require("../db-query-helper");
+const region_detection_1 = require("../region-detection");
+const STANDALONE_MODE_TOGGLE_KEY = "activitypub_standalone_mode_enabled";
+/**
+ * Check if ActivityPub Standalone Mode is enabled
+ *
+ * This function efficiently checks the feature toggle with:
+ * - Database query timeout protection
+ * - Graceful degradation (defaults to false if toggle doesn't exist)
+ * - Error handling
+ *
+ * @param db - Prisma client (optional, will use shared connection manager if not provided)
+ * @param env - Cloudflare Workers environment
+ * @param request - Request object (optional, for region detection)
+ * @returns True if standalone mode is enabled, false otherwise
+ */
+async function isStandaloneModeEnabled(env, db, request) {
+    const logger = logger_1.Logger.getInstance(env);
+    try {
+        // If database provided, use it directly (most efficient)
+        if (db) {
+            const { FeatureToggleService } = await Promise.resolve().then(() => __importStar(require("../feature-toggle-service")));
+            const toggleService = new FeatureToggleService(db);
+            return await toggleService.isEnabled(STANDALONE_MODE_TOGGLE_KEY);
+        }
+        // Otherwise, use shared connection manager with region detection
+        const region = request ? (0, region_detection_1.detectRegionSync)(request, env) : "EU";
+        const dbManager = database_connection_manager_1.sharedDatabaseConnectionManager;
+        const result = await (0, db_query_helper_1.withQueryTimeoutAndRetry)(dbManager, region, env, async (client) => {
+            const { FeatureToggleService } = await Promise.resolve().then(() => __importStar(require("../feature-toggle-service")));
+            const toggleService = new FeatureToggleService(client);
+            return await toggleService.isEnabled(STANDALONE_MODE_TOGGLE_KEY);
+        }, {
+            ...db_query_helper_1.QueryTimeoutPresets.STANDARD, // Use STANDARD preset
+            defaultValue: false, // Default to false (federation enabled) if query fails
+            context: {
+                operation: "checkStandaloneMode",
+            },
+        });
+        return result ?? false;
+    }
+    catch (error) {
+        logger.error("[StandaloneMode] Error checking standalone mode toggle:", error);
+        // Fail-safe: default to false (federation enabled) on error
+        return false;
+    }
+}
+/**
+ * Check if a URI is remote (not from this server)
+ *
+ * Helper function to determine if a URI belongs to a remote server.
+ *
+ * @param uri - URI to check
+ * @param env - Cloudflare Workers environment
+ * @returns True if URI is remote, false if local
+ */
+function isRemoteUri(uri, env) {
+    // Get base URL directly from env to avoid circular dependencies
+    // Try ACTIVITYPUB_BASE_URL first, then APP_DOMAIN, then default
+    let baseUrl = "https://example.com";
+    if (env.ACTIVITYPUB_BASE_URL) {
+        try {
+            const url = new URL(env.ACTIVITYPUB_BASE_URL);
+            baseUrl = `${url.protocol}//${url.hostname}`;
+        }
+        catch {
+            // Invalid URL, use default
+        }
+    }
+    else if (env.APP_DOMAIN) {
+        try {
+            const url = new URL(env.APP_DOMAIN);
+            baseUrl = `${url.protocol}//${url.hostname}`;
+        }
+        catch {
+            // Invalid URL, use default
+        }
+    }
+    return !uri.startsWith(baseUrl);
+}
+//# sourceMappingURL=standalone-mode.js.map

package/dist/lib/activitypub/standalone-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone-mode.js","sourceRoot":"","sources":["../../../src/lib/activitypub/standalone-mode.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BH,0DAkDC;AAWD,kCAoBC;AAxGD,sCAAmC;AACnC,gFAAiF;AACjF,wDAG4B;AAC5B,0DAAuD;AAEvD,MAAM,0BAA0B,GAAG,qCAAqC,CAAC;AAEzE;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,uBAAuB,CAC3C,GAAQ,EACR,EAAiB,EACjB,OAAiB;IAEjB,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,yDAAyD;QACzD,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,EAAE,oBAAoB,EAAE,GAAG,wDAC/B,2BAA2B,GAC5B,CAAC;YACF,MAAM,aAAa,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;YACnD,OAAO,MAAM,aAAa,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACnE,CAAC;QAED,iEAAiE;QACjE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,mCAAgB,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,MAAM,SAAS,GAAG,6DAA+B,CAAC;QAElD,MAAM,MAAM,GAAG,MAAM,IAAA,0CAAwB,EAC3C,SAAS,EACT,MAAM,EACN,GAAG,EACH,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,oBAAoB,EAAE,GAAG,wDAC/B,2BAA2B,GAC5B,CAAC;YACF,MAAM,aAAa,GAAG,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO,MAAM,aAAa,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACnE,CAAC,EACD;YACE,GAAG,qCAAmB,CAAC,QAAQ,EAAE,sBAAsB;YACvD,YAAY,EAAE,KAAK,EAAE,uDAAuD;YAC5E,OAAO,EAAE;gBACP,SAAS,EAAE,qBAAqB;aACjC;SACF,CACF,CAAC;QAEF,OAAO,MAAM,IAAI,KAAK,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,yDAAyD,EACzD,KAAK,CACN,CAAC;QACF,4DAA4D;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,WAAW,CAAC,GAAW,EAAE,GAAQ;IAC/C,gEAAgE;IAChE,gEAAgE;IAChE,IAAI,OAAO,GAAG,qBAAqB,CAAC;IACpC,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAC9C,OAAO,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACpC,OAAO,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC"}

package/dist/lib/activitypub/webfinger/server.d.ts

@@ -0,0 +1,16 @@
+/**
+ * WebFinger Server (Fedify-Based)
+ *
+ * Implements WebFinger protocol for ActivityPub actor discovery.
+ * Fedify provides WebFinger support for actor URI resolution.
+ */
+import type { Env } from "../../../env";
+/**
+ * Handle WebFinger request
+ *
+ * @param request - HTTP request
+ * @param env - Cloudflare Workers environment
+ * @returns WebFinger JSON response
+ */
+export declare function handleWebFinger(request: Request, env: Env): Promise<Response>;
+//# sourceMappingURL=server.d.ts.map

package/dist/lib/activitypub/webfinger/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/lib/activitypub/webfinger/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAyCxC;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC,CAiKnB"}

package/dist/lib/activitypub/webfinger/server.js

@@ -0,0 +1,221 @@
+"use strict";
+/**
+ * WebFinger Server (Fedify-Based)
+ *
+ * Implements WebFinger protocol for ActivityPub actor discovery.
+ * Fedify provides WebFinger support for actor URI resolution.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleWebFinger = handleWebFinger;
+const logger_1 = require("../../logger");
+const context_1 = require("../fedify/context");
+const user_actor_1 = require("../dispatchers/user-actor");
+const database_connection_manager_1 = require("../../database-connection-manager");
+const region_detection_1 = require("../../region-detection");
+const db_query_helper_1 = require("../../db-query-helper");
+/**
+ * Parse WebFinger resource identifier
+ *
+ * @param resource - WebFinger resource string (e.g., "acct:alice@example.com")
+ * @returns Parsed resource or null if invalid
+ */
+function parseWebFingerResource(resource) {
+    // WebFinger resource format: acct:username@domain
+    const match = resource.match(/^acct:(.+)@(.+)$/);
+    if (!match) {
+        return null;
+    }
+    return {
+        subject: resource,
+        username: match[1],
+        domain: match[2],
+    };
+}
+/**
+ * Handle WebFinger request
+ *
+ * @param request - HTTP request
+ * @param env - Cloudflare Workers environment
+ * @returns WebFinger JSON response
+ */
+async function handleWebFinger(request, env) {
+    const logger = logger_1.Logger.getInstance(env);
+    const { SecurityHeaders } = await Promise.resolve().then(() => __importStar(require("../../security-headers")));
+    const securityHeaders = new SecurityHeaders(env);
+    try {
+        // Parse query parameters
+        const url = new URL(request.url);
+        const resource = url.searchParams.get("resource");
+        if (!resource) {
+            return securityHeaders.createSecureResponse(JSON.stringify({ error: "resource parameter is required" }), {
+                status: 400,
+                headers: { "content-type": "application/json" },
+            });
+        }
+        // Try entity URI lookup first (resource=https://...entities/{type}/{id})
+        if (resource.startsWith("https://") || resource.startsWith("http://")) {
+            try {
+                const resourceUrl = new URL(resource);
+                const entityMatch = resourceUrl.pathname.match(/^\/entities\/([^/]+)\/(.+)$/);
+                if (entityMatch) {
+                    const entityResult = await resolveEntityWebFinger(resource, decodeURIComponent(entityMatch[2]), request, env, logger, securityHeaders);
+                    if (entityResult)
+                        return entityResult;
+                }
+            }
+            catch {
+                // Invalid URL, fall through to acct: parsing
+            }
+        }
+        // Parse acct: WebFinger resource
+        const parsed = parseWebFingerResource(resource);
+        if (!parsed) {
+            return securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid resource format" }), {
+                status: 400,
+                headers: { "content-type": "application/json" },
+            });
+        }
+        // Verify domain matches
+        const baseUrl = (0, context_1.getActivityPubBaseUrl)(env, request.url);
+        const baseDomain = new URL(baseUrl).hostname;
+        if (parsed.domain !== baseDomain) {
+            return securityHeaders.createSecureResponse(JSON.stringify({ error: "Domain mismatch" }), {
+                status: 400,
+                headers: { "content-type": "application/json" },
+            });
+        }
+        // Get region for database connection
+        const region = (0, region_detection_1.detectRegionSync)(request, env);
+        const dbManager = database_connection_manager_1.sharedDatabaseConnectionManager;
+        // Find user by username
+        const user = await (0, db_query_helper_1.withQueryTimeoutAndRetry)(dbManager, region, env, async (db) => {
+            return db.user.findUnique({
+                where: { username: parsed.username },
+                select: {
+                    id: true,
+                    username: true,
+                    actorUri: true,
+                    publicKey: true,
+                    suspended: true,
+                    deletionConfirmedAt: true,
+                },
+            });
+        }, {
+            ...db_query_helper_1.QueryTimeoutPresets.STANDARD,
+            context: {
+                operation: "webfinger_findUser",
+                username: parsed.username,
+            },
+        });
+        if (!user || !user.actorUri || !user.publicKey) {
+            return securityHeaders.createSecureResponse(JSON.stringify({ error: "User not found" }), {
+                status: 404,
+                headers: { "content-type": "application/json" },
+            });
+        }
+        if (user.suspended || user.deletionConfirmedAt) {
+            return securityHeaders.createSecureResponse(JSON.stringify({ error: "User account is suspended or deleted" }), {
+                status: 404,
+                headers: { "content-type": "application/json" },
+            });
+        }
+        // Generate actor URI
+        const actorUri = user_actor_1.UserActorDispatcher.generateActorUri(user.username || "", env);
+        // Build WebFinger response
+        const webfingerResponse = {
+            subject: parsed.subject,
+            links: [
+                {
+                    rel: "self",
+                    type: "application/activity+json",
+                    href: actorUri,
+                },
+            ],
+        };
+        logger.debug("[WebFinger] Resolved actor", {
+            resource: parsed.subject,
+            actorUri,
+        });
+        return securityHeaders.createSecureResponse(JSON.stringify(webfingerResponse), {
+            status: 200,
+            headers: {
+                "content-type": "application/jrd+json",
+            },
+        });
+    }
+    catch (error) {
+        logger.error("[WebFinger] Error handling request:", error);
+        return securityHeaders.createSecureResponse(JSON.stringify({ error: "Internal server error" }), {
+            status: 500,
+            headers: { "content-type": "application/json" },
+        });
+    }
+}
+/**
+ * Resolve an entity by ID for WebFinger.
+ * Returns a WebFinger Response if entity found, or null to fall through.
+ */
+async function resolveEntityWebFinger(resourceUri, entityId, request, env, logger, securityHeaders) {
+    const region = (0, region_detection_1.detectRegionSync)(request, env);
+    const entity = await (0, db_query_helper_1.withQueryTimeoutAndRetry)(database_connection_manager_1.sharedDatabaseConnectionManager, region, env, async (db) => db.entity.findUnique({
+        where: { id: entityId },
+        select: { id: true, actorUri: true, entityType: true },
+    }), {
+        ...db_query_helper_1.QueryTimeoutPresets.STANDARD,
+        context: { operation: "webfinger_findEntity", entityId },
+    });
+    if (!entity?.actorUri)
+        return null;
+    const webfingerResponse = {
+        subject: resourceUri,
+        links: [
+            {
+                rel: "self",
+                type: "application/activity+json",
+                href: entity.actorUri,
+            },
+        ],
+    };
+    logger.debug("[WebFinger] Resolved entity actor", {
+        resource: resourceUri,
+        actorUri: entity.actorUri,
+    });
+    return securityHeaders.createSecureResponse(JSON.stringify(webfingerResponse), {
+        status: 200,
+        headers: { "content-type": "application/jrd+json" },
+    });
+}
+//# sourceMappingURL=server.js.map

package/dist/lib/activitypub/webfinger/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../../src/lib/activitypub/webfinger/server.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkDH,0CAoKC;AAnND,yCAAsC;AACtC,+CAA0D;AAC1D,0DAAgE;AAChE,mFAAoF;AACpF,6DAA0D;AAC1D,2DAG+B;AAY/B;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,kDAAkD;IAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAClB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,GAAQ;IAER,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,EAAE,eAAe,EAAE,GAAG,wDAAa,wBAAwB,GAAC,CAAC;IACnE,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IAEjD,IAAI,CAAC;QACH,yBAAyB;QACzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAElD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,EAC3D;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACtC,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBAC9E,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAC/C,QAAQ,EACR,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAClC,OAAO,EACP,GAAG,EACH,MAAM,EACN,eAAe,CAChB,CAAC;oBACF,IAAI,YAAY;wBAAE,OAAO,YAAY,CAAC;gBACxC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,EACpD;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;QAED,wBAAwB;QACxB,MAAM,OAAO,GAAG,IAAA,+BAAqB,EAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QAE7C,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAC5C;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,MAAM,MAAM,GAAG,IAAA,mCAAgB,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,6DAA+B,CAAC;QAElD,wBAAwB;QACxB,MAAM,IAAI,GAAG,MAAM,IAAA,0CAAwB,EACzC,SAAS,EACT,MAAM,EACN,GAAG,EACH,KAAK,EAAE,EAAE,EAAE,EAAE;YACX,OAAO,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;gBACxB,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACpC,MAAM,EAAE;oBACN,EAAE,EAAE,IAAI;oBACR,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,IAAI;oBACd,SAAS,EAAE,IAAI;oBACf,SAAS,EAAE,IAAI;oBACf,mBAAmB,EAAE,IAAI;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC,EACD;YACE,GAAG,qCAAmB,CAAC,QAAQ;YAC/B,OAAO,EAAE;gBACP,SAAS,EAAE,oBAAoB;gBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B;SACF,CACF,CAAC;QAEF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/C,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAC3C;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC/C,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,EACjE;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,MAAM,QAAQ,GAAG,gCAAmB,CAAC,gBAAgB,CACnD,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,GAAG,CACJ,CAAC;QAEF,2BAA2B;QAC3B,MAAM,iBAAiB,GAAG;YACxB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE;gBACL;oBACE,GAAG,EAAE,MAAM;oBACX,IAAI,EAAE,2BAA2B;oBACjC,IAAI,EAAE,QAAQ;iBACf;aACF;SACF,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;YACzC,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EACjC;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,sBAAsB;aACvC;SACF,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAE3D,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAClD;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,WAAmB,EACnB,QAAgB,EAChB,OAAgB,EAChB,GAAQ,EACR,MAAc,EACd,eAAoB;IAEpB,MAAM,MAAM,GAAG,IAAA,mCAAgB,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAG,MAAM,IAAA,0CAAwB,EAC3C,6DAA+B,EAC/B,MAAM,EACN,GAAG,EACH,KAAK,EAAE,EAAE,EAAE,EAAE,CACX,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;QACnB,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;KACvD,CAAC,EACJ;QACE,GAAG,qCAAmB,CAAC,QAAQ;QAC/B,OAAO,EAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE,QAAQ,EAAE;KACzD,CACF,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,iBAAiB,GAAG;QACxB,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE;YACL;gBACE,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,2BAA2B;gBACjC,IAAI,EAAE,MAAM,CAAC,QAAQ;aACtB;SACF;KACF,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;QAChD,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EACjC;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,sBAAsB,EAAE;KACpD,CACF,CAAC;AACJ,CAAC"}

package/dist/lib/age-gate-middleware.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Age Gate Middleware
+ *
+ * Reads ageTier from the session and injects featureAccess into the request context.
+ * Defaults to ADULT access if no ageTier is present on the session.
+ */
+import type { Middleware } from "./middleware";
+import { type FeatureAccess } from "./age-gate";
+declare module "./request-context" {
+    interface RequestContext {
+        featureAccess?: FeatureAccess;
+    }
+}
+/**
+ * Middleware that computes feature access based on the session's ageTier
+ * and attaches it to the request context.
+ */
+export declare function ageGateMiddleware(): Middleware;
+//# sourceMappingURL=age-gate-middleware.d.ts.map

package/dist/lib/age-gate-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"age-gate-middleware.d.ts","sourceRoot":"","sources":["../../src/lib/age-gate-middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGlE,OAAO,QAAQ,mBAAmB,CAAC;IACjC,UAAU,cAAc;QACtB,aAAa,CAAC,EAAE,aAAa,CAAC;KAC/B;CACF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAY9C"}

package/dist/lib/age-gate-middleware.js

@@ -0,0 +1,26 @@
+"use strict";
+/**
+ * Age Gate Middleware
+ *
+ * Reads ageTier from the session and injects featureAccess into the request context.
+ * Defaults to ADULT access if no ageTier is present on the session.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ageGateMiddleware = ageGateMiddleware;
+const age_gate_1 = require("./age-gate");
+/**
+ * Middleware that computes feature access based on the session's ageTier
+ * and attaches it to the request context.
+ */
+function ageGateMiddleware() {
+    return async (context, next) => {
+        const { requestContext } = context;
+        // Only inject if we have a request context with a session
+        if (requestContext?.session) {
+            const ageTier = requestContext.session.ageTier ?? "ADULT";
+            requestContext.featureAccess = (0, age_gate_1.getFeatureAccess)(ageTier);
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=age-gate-middleware.js.map

package/dist/lib/age-gate-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"age-gate-middleware.js","sourceRoot":"","sources":["../../src/lib/age-gate-middleware.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAgBH,8CAYC;AAzBD,yCAAkE;AASlE;;;GAGG;AACH,SAAgB,iBAAiB;IAC/B,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAEnC,0DAA0D;QAC1D,IAAI,cAAc,EAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;YAC1D,cAAc,CAAC,aAAa,GAAG,IAAA,2BAAgB,EAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/lib/age-gate.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Age Gate Module
+ *
+ * Computes age tiers from date of birth and provides tier-based feature access
+ * configuration for child safety compliance.
+ */
+import type { AgeTier } from "@prisma/client";
+export interface FeatureAccess {
+    maxFeedPages: number | null;
+    sessionTimeLimits: {
+        firstNudgeMinutes: number | null;
+        secondNudgeMinutes: number | null;
+        hardLimitMinutes: number | null;
+    };
+    sentimentDisplay: "full" | "distribution" | "hidden";
+    sentimentDisplayOwnPost: "full" | "distribution";
+    canViewSentimentUsers: boolean;
+    canEditNotificationPreferences: boolean;
+    showUnreadCount: boolean;
+    dmAccess: "anyone" | "connections" | "nobody";
+}
+/**
+ * Calculate age tier from date of birth.
+ *
+ * Under 13 = CHILD, 13-17 = TEEN, 18+ = ADULT.
+ * Uses UTC dates to avoid timezone issues.
+ */
+export declare function computeAgeTier(dateOfBirth: Date): AgeTier;
+/**
+ * Returns true if the age tier requires parental consent (CHILD only).
+ */
+export declare function requiresParentalConsent(ageTier: AgeTier): boolean;
+/**
+ * Returns the feature access configuration for the given age tier.
+ */
+export declare function getFeatureAccess(ageTier: AgeTier): FeatureAccess;
+//# sourceMappingURL=age-gate.d.ts.map

package/dist/lib/age-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"age-gate.d.ts","sourceRoot":"","sources":["../../src/lib/age-gate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAE9C,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE;QACjB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,CAAC;IACF,gBAAgB,EAAE,MAAM,GAAG,cAAc,GAAG,QAAQ,CAAC;IACrD,uBAAuB,EAAE,MAAM,GAAG,cAAc,CAAC;IACjD,qBAAqB,EAAE,OAAO,CAAC;IAC/B,8BAA8B,EAAE,OAAO,CAAC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAE,QAAQ,GAAG,aAAa,GAAG,QAAQ,CAAC;CAC/C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,IAAI,GAAG,OAAO,CAsBzD;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAEjE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAkDhE"}

package/dist/lib/age-gate.js

@@ -0,0 +1,96 @@
+"use strict";
+/**
+ * Age Gate Module
+ *
+ * Computes age tiers from date of birth and provides tier-based feature access
+ * configuration for child safety compliance.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeAgeTier = computeAgeTier;
+exports.requiresParentalConsent = requiresParentalConsent;
+exports.getFeatureAccess = getFeatureAccess;
+/**
+ * Calculate age tier from date of birth.
+ *
+ * Under 13 = CHILD, 13-17 = TEEN, 18+ = ADULT.
+ * Uses UTC dates to avoid timezone issues.
+ */
+function computeAgeTier(dateOfBirth) {
+    const now = new Date();
+    // Calculate age using UTC to avoid timezone issues
+    let age = now.getUTCFullYear() - dateOfBirth.getUTCFullYear();
+    // Check if birthday has not yet occurred this year
+    const monthDiff = now.getUTCMonth() - dateOfBirth.getUTCMonth();
+    if (monthDiff < 0 ||
+        (monthDiff === 0 && now.getUTCDate() < dateOfBirth.getUTCDate())) {
+        age--;
+    }
+    if (age < 13) {
+        return "CHILD";
+    }
+    else if (age < 18) {
+        return "TEEN";
+    }
+    else {
+        return "ADULT";
+    }
+}
+/**
+ * Returns true if the age tier requires parental consent (CHILD only).
+ */
+function requiresParentalConsent(ageTier) {
+    return ageTier === "CHILD";
+}
+/**
+ * Returns the feature access configuration for the given age tier.
+ */
+function getFeatureAccess(ageTier) {
+    switch (ageTier) {
+        case "CHILD":
+            return {
+                maxFeedPages: 5,
+                sessionTimeLimits: {
+                    firstNudgeMinutes: 15,
+                    secondNudgeMinutes: 25,
+                    hardLimitMinutes: 30,
+                },
+                sentimentDisplay: "hidden",
+                sentimentDisplayOwnPost: "distribution",
+                canViewSentimentUsers: false,
+                canEditNotificationPreferences: false,
+                showUnreadCount: false,
+                dmAccess: "nobody",
+            };
+        case "TEEN":
+            return {
+                maxFeedPages: 20,
+                sessionTimeLimits: {
+                    firstNudgeMinutes: 30,
+                    secondNudgeMinutes: 50,
+                    hardLimitMinutes: null,
+                },
+                sentimentDisplay: "distribution",
+                sentimentDisplayOwnPost: "distribution",
+                canViewSentimentUsers: false,
+                canEditNotificationPreferences: true,
+                showUnreadCount: false,
+                dmAccess: "connections",
+            };
+        case "ADULT":
+            return {
+                maxFeedPages: null,
+                sessionTimeLimits: {
+                    firstNudgeMinutes: 60,
+                    secondNudgeMinutes: null,
+                    hardLimitMinutes: null,
+                },
+                sentimentDisplay: "full",
+                sentimentDisplayOwnPost: "full",
+                canViewSentimentUsers: true,
+                canEditNotificationPreferences: true,
+                showUnreadCount: true,
+                dmAccess: "connections",
+            };
+    }
+}
+//# sourceMappingURL=age-gate.js.map

package/dist/lib/age-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"age-gate.js","sourceRoot":"","sources":["../../src/lib/age-gate.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAyBH,wCAsBC;AAKD,0DAEC;AAKD,4CAkDC;AA1FD;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,WAAiB;IAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,mDAAmD;IACnD,IAAI,GAAG,GAAG,GAAG,CAAC,cAAc,EAAE,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC;IAE9D,mDAAmD;IACnD,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAChE,IACE,SAAS,GAAG,CAAC;QACb,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,UAAU,EAAE,CAAC,EAChE,CAAC;QACD,GAAG,EAAE,CAAC;IACR,CAAC;IAED,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC;QACb,OAAO,OAAO,CAAC;IACjB,CAAC;SAAM,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,OAAgB;IACtD,OAAO,OAAO,KAAK,OAAO,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,OAAgB;IAC/C,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO;gBACL,YAAY,EAAE,CAAC;gBACf,iBAAiB,EAAE;oBACjB,iBAAiB,EAAE,EAAE;oBACrB,kBAAkB,EAAE,EAAE;oBACtB,gBAAgB,EAAE,EAAE;iBACrB;gBACD,gBAAgB,EAAE,QAAQ;gBAC1B,uBAAuB,EAAE,cAAc;gBACvC,qBAAqB,EAAE,KAAK;gBAC5B,8BAA8B,EAAE,KAAK;gBACrC,eAAe,EAAE,KAAK;gBACtB,QAAQ,EAAE,QAAQ;aACnB,CAAC;QAEJ,KAAK,MAAM;YACT,OAAO;gBACL,YAAY,EAAE,EAAE;gBAChB,iBAAiB,EAAE;oBACjB,iBAAiB,EAAE,EAAE;oBACrB,kBAAkB,EAAE,EAAE;oBACtB,gBAAgB,EAAE,IAAI;iBACvB;gBACD,gBAAgB,EAAE,cAAc;gBAChC,uBAAuB,EAAE,cAAc;gBACvC,qBAAqB,EAAE,KAAK;gBAC5B,8BAA8B,EAAE,IAAI;gBACpC,eAAe,EAAE,KAAK;gBACtB,QAAQ,EAAE,aAAa;aACxB,CAAC;QAEJ,KAAK,OAAO;YACV,OAAO;gBACL,YAAY,EAAE,IAAI;gBAClB,iBAAiB,EAAE;oBACjB,iBAAiB,EAAE,EAAE;oBACrB,kBAAkB,EAAE,IAAI;oBACxB,gBAAgB,EAAE,IAAI;iBACvB;gBACD,gBAAgB,EAAE,MAAM;gBACxB,uBAAuB,EAAE,MAAM;gBAC/B,qBAAqB,EAAE,IAAI;gBAC3B,8BAA8B,EAAE,IAAI;gBACpC,eAAe,EAAE,IAAI;gBACrB,QAAQ,EAAE,aAAa;aACxB,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/lib/age-tier-transition.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Age Tier Transition
+ *
+ * Checks users' date of birth and transitions their age tier when appropriate.
+ * Applies new privacy defaults and notifies users and guardians.
+ */
+import type { AgeTier } from "@prisma/client";
+import type { Env } from "../env";
+/**
+ * Compute the age tier from a date of birth.
+ */
+export declare function computeAgeTier(dateOfBirth: Date, now?: Date): AgeTier;
+/**
+ * Check all users with a date of birth and transition their age tier if needed.
+ * Returns the count of transitioned users and errors.
+ */
+export declare function checkAgeTierTransitions(env: Env): Promise<{
+    transitioned: number;
+    errors: number;
+}>;
+//# sourceMappingURL=age-tier-transition.d.ts.map

package/dist/lib/age-tier-transition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"age-tier-transition.d.ts","sourceRoot":"","sources":["../../src/lib/age-tier-transition.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAIlC;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAKjF;AA6CD;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAsGD"}