@de-otio/trellis 0.4.0

package/dist/lib/crypto/voting/post-quantum-encryption.js

@@ -0,0 +1,123 @@
+"use strict";
+/**
+ * Post-Quantum Encryption Stub
+ *
+ * Placeholder for future post-quantum encryption implementation.
+ * This will be implemented when post-quantum homomorphic encryption becomes available.
+ *
+ * Part of: Cryptographic Design Comparison
+ * Status: Stub/Placeholder
+ * Last Updated: January 2025
+ *
+ * Note: Post-quantum homomorphic encryption is still in research phase.
+ * This stub documents requirements and prepares for future implementation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostQuantumEncryption = void 0;
+/**
+ * Post-Quantum Encryption Class (Stub)
+ *
+ * This is a placeholder for future post-quantum encryption implementation.
+ * Will be implemented when:
+ * 1. Post-quantum homomorphic encryption schemes become available
+ * 2. NIST standards are finalized for homomorphic encryption
+ * 3. Performance is acceptable for production use
+ */
+class PostQuantumEncryption {
+    /**
+     * Algorithm identifier (to be determined)
+     */
+    algorithmName = "post-quantum-homomorphic";
+    /**
+     * Encrypt a message using post-quantum encryption
+     *
+     * @param message - Message to encrypt
+     * @param publicKey - Post-quantum public key
+     * @returns Encrypted data
+     * @throws Error (not yet implemented)
+     */
+    async encrypt(message, publicKey) {
+        throw new Error("Post-quantum encryption not yet implemented. Post-quantum homomorphic encryption is still in research phase.");
+    }
+    /**
+     * Decrypt encrypted data using post-quantum decryption
+     *
+     * @param encryptedData - Encrypted data to decrypt
+     * @param privateKey - Post-quantum private key
+     * @returns Decrypted message
+     * @throws Error (not yet implemented)
+     */
+    async decrypt(encryptedData, privateKey) {
+        throw new Error("Post-quantum decryption not yet implemented. Post-quantum homomorphic encryption is still in research phase.");
+    }
+    /**
+     * Check if post-quantum encryption is quantum-resistant
+     *
+     * @returns true (post-quantum schemes are quantum-resistant)
+     */
+    isQuantumResistant() {
+        return true;
+    }
+    /**
+     * Get algorithm name
+     *
+     * @returns Algorithm identifier
+     */
+    getAlgorithmName() {
+        return this.algorithmName;
+    }
+    /**
+     * Check if post-quantum encryption supports homomorphic operations
+     *
+     * @returns true (if homomorphic scheme is selected)
+     */
+    isHomomorphic() {
+        // Will be true when homomorphic post-quantum scheme is implemented
+        return true;
+    }
+    /**
+     * Perform homomorphic addition (if supported)
+     *
+     * @param encrypted1 - First encrypted value
+     * @param encrypted2 - Second encrypted value
+     * @returns Sum of encrypted values (encrypted)
+     * @throws Error (not yet implemented)
+     */
+    async homomorphicAdd(encrypted1, encrypted2) {
+        throw new Error("Post-quantum homomorphic addition not yet implemented. Post-quantum homomorphic encryption is still in research phase.");
+    }
+}
+exports.PostQuantumEncryption = PostQuantumEncryption;
+/**
+ * Requirements for Post-Quantum Implementation
+ *
+ * When implementing post-quantum encryption, consider:
+ *
+ * 1. **Algorithm Selection**:
+ *    - Must support homomorphic operations (for vote aggregation)
+ *    - Must be quantum-resistant (NIST-approved or candidate)
+ *    - Must have acceptable performance characteristics
+ *
+ * 2. **NIST Standards**:
+ *    - Monitor NIST PQC standards for homomorphic encryption
+ *    - Use approved algorithms when available
+ *    - Consider hybrid schemes during transition
+ *
+ * 3. **Performance**:
+ *    - Key sizes may be larger than classical schemes
+ *    - Encryption/decryption may be slower
+ *    - Homomorphic operations may have higher overhead
+ *
+ * 4. **Compatibility**:
+ *    - Must support same interface as ElGamalEncryption
+ *    - Must enable algorithm swapping
+ *    - Must support hybrid schemes
+ *
+ * 5. **Migration Path**:
+ *    - Support dual encryption (ElGamal + post-quantum)
+ *    - Maintain backward compatibility
+ *    - Gradual migration strategy
+ *
+ * See: doc/02-technical/architecture/cryptography/nist-pqc-monitoring.md
+ */
+//# sourceMappingURL=post-quantum-encryption.js.map

package/dist/lib/crypto/voting/post-quantum-encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-quantum-encryption.js","sourceRoot":"","sources":["../../../../src/lib/crypto/voting/post-quantum-encryption.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AASH;;;;;;;;GAQG;AACH,MAAa,qBAAqB;IAChC;;OAEG;IACc,aAAa,GAAG,0BAA0B,CAAC;IAE5D;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,OAAgB,EAChB,SAAoB;QAEpB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,aAA4B,EAC5B,UAAsB;QAEtB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,aAAa;QACX,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAClB,UAAyB,EACzB,UAAyB;QAEzB,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAC;IACJ,CAAC;CACF;AApFD,sDAoFC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG"}

package/dist/lib/csrf.d.ts

@@ -0,0 +1,95 @@
+/**
+ * CSRF Protection
+ *
+ * Provides CSRF token generation and validation to prevent Cross-Site Request Forgery attacks.
+ * Uses Double Submit Cookie pattern: token stored in encrypted session cookie and validated
+ * against X-CSRF-Token header.
+ *
+ * Fallback: If KV is configured, can also validate against KV (for migration/transition period).
+ */
+import type { Env } from "../env";
+import type { Session } from "./session-manager";
+/**
+ * CSRF Protection utility class
+ */
+export declare class CSRFProtection {
+    private env?;
+    constructor(env?: Env);
+    /**
+     * Generate a secure random CSRF token
+     * Uses crypto.randomUUID() for secure token generation
+     */
+    generateToken(): string;
+    /**
+     * Static convenience method for generating tokens (backward compatibility)
+     * @deprecated Use instance method instead: new CSRFProtection().generateToken()
+     */
+    static generateToken(): string;
+    /**
+     * Validate a CSRF token using Double Submit Cookie pattern
+     *
+     * Primary method: Validates token from session cookie against header token
+     * Fallback: If KV is configured and session doesn't have token, validates against KV
+     *
+     * @param token - The CSRF token from the request header (X-CSRF-Token)
+     * @param session - The user's session (contains csrfToken if available)
+     * @param env - Optional environment (for KV fallback)
+     * @returns true if token is valid, false otherwise
+     */
+    validateToken(token: string, session: Session | null, env?: Env): Promise<boolean>;
+    /**
+     * Static method for validating tokens (for convenience and testing)
+     * Creates a temporary instance to perform validation
+     */
+    static validateToken(token: string, session: Session | null, env?: Env): Promise<boolean>;
+    /**
+     * Store a CSRF token in session (Double Submit Cookie pattern)
+     *
+     * The token is included in the session object and will be stored in the encrypted
+     * session cookie. No separate storage is needed.
+     *
+     * @param token - The CSRF token to include in session
+     * @param session - The session object to update
+     * @returns Updated session with csrfToken and csrfTokenCreatedAt
+     */
+    storeTokenInSession(token: string, session: Session): Session;
+    /**
+     * Store a CSRF token in KV (legacy/fallback method)
+     *
+     * @deprecated Use storeTokenInSession instead. This method is kept for migration/fallback.
+     *
+     * @param token - The CSRF token to store
+     * @param sessionId - The user's session ID (userId from session)
+     * @param ttl - Time to live in seconds (default: 3600 = 1 hour)
+     */
+    storeTokenInKV(token: string, sessionId: string, ttl?: number): Promise<void>;
+    /**
+     * Remove CSRF token from session
+     * Useful for logout or token invalidation
+     *
+     * @param session - The session object to update
+     * @returns Updated session without csrfToken
+     */
+    removeTokenFromSession(session: Session): Session;
+    /**
+     * Delete a CSRF token from KV (legacy/fallback method)
+     *
+     * @deprecated Use removeTokenFromSession instead. This method is kept for migration/fallback.
+     *
+     * @param sessionId - The user's session ID
+     */
+    deleteTokenFromKV(sessionId: string): Promise<void>;
+    /**
+     * Constant-time string comparison to prevent timing attacks
+     *
+     * @param a - First string
+     * @param b - Second string
+     * @returns true if strings are equal, false otherwise
+     */
+    private constantTimeCompare;
+    static storeTokenInSession(token: string, session: Session): Session;
+    static storeTokenInKV(token: string, sessionId: string, env: Env, ttl?: number): Promise<void>;
+    static removeTokenFromSession(session: Session): Session;
+    static deleteTokenFromKV(sessionId: string, env: Env): Promise<void>;
+}
+//# sourceMappingURL=csrf.d.ts.map

package/dist/lib/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/lib/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAClC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAC,CAAM;gBAEN,GAAG,CAAC,EAAE,GAAG;IAIrB;;;OAGG;IACH,aAAa,IAAI,MAAM;IAIvB;;;OAGG;IACH,MAAM,CAAC,aAAa,IAAI,MAAM;IAI9B;;;;;;;;;;OAUG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,GAAG,IAAI,EACvB,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAAC,OAAO,CAAC;IA0CnB;;;OAGG;WACU,aAAa,CACxB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,GAAG,IAAI,EACvB,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAAC,OAAO,CAAC;IAKnB;;;;;;;;;OASG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO;IAS7D;;;;;;;;OAQG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAa,GACjB,OAAO,CAAC,IAAI,CAAC;IAUhB;;;;;;OAMG;IACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO;IAKjD;;;;;;OAMG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAa3B,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO;WAIvD,cAAc,CACzB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,GAAG,EACR,GAAG,GAAE,MAAa,GACjB,OAAO,CAAC,IAAI,CAAC;IAIhB,MAAM,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO;WAI3C,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3E"}

package/dist/lib/csrf.js

@@ -0,0 +1,174 @@
+"use strict";
+/**
+ * CSRF Protection
+ *
+ * Provides CSRF token generation and validation to prevent Cross-Site Request Forgery attacks.
+ * Uses Double Submit Cookie pattern: token stored in encrypted session cookie and validated
+ * against X-CSRF-Token header.
+ *
+ * Fallback: If KV is configured, can also validate against KV (for migration/transition period).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CSRFProtection = void 0;
+/**
+ * CSRF Protection utility class
+ */
+class CSRFProtection {
+    env;
+    constructor(env) {
+        this.env = env;
+    }
+    /**
+     * Generate a secure random CSRF token
+     * Uses crypto.randomUUID() for secure token generation
+     */
+    generateToken() {
+        return crypto.randomUUID();
+    }
+    /**
+     * Static convenience method for generating tokens (backward compatibility)
+     * @deprecated Use instance method instead: new CSRFProtection().generateToken()
+     */
+    static generateToken() {
+        return new CSRFProtection().generateToken();
+    }
+    /**
+     * Validate a CSRF token using Double Submit Cookie pattern
+     *
+     * Primary method: Validates token from session cookie against header token
+     * Fallback: If KV is configured and session doesn't have token, validates against KV
+     *
+     * @param token - The CSRF token from the request header (X-CSRF-Token)
+     * @param session - The user's session (contains csrfToken if available)
+     * @param env - Optional environment (for KV fallback)
+     * @returns true if token is valid, false otherwise
+     */
+    async validateToken(token, session, env) {
+        if (!token) {
+            return false;
+        }
+        // Use provided env or instance env
+        const effectiveEnv = env || this.env;
+        // Primary method: Double Submit Cookie pattern (token in session)
+        if (session?.csrfToken) {
+            // Use constant-time comparison to prevent timing attacks
+            const isValid = this.constantTimeCompare(token, session.csrfToken);
+            // If token is valid but older than 24 hours, flag it for rotation
+            if (isValid && session.csrfTokenCreatedAt) {
+                const TWENTY_FOUR_HOURS_MS = 24 * 60 * 60 * 1000;
+                if (Date.now() - session.csrfTokenCreatedAt > TWENTY_FOUR_HOURS_MS) {
+                    session.csrfTokenNeedsRotation = true;
+                }
+            }
+            return isValid;
+        }
+        // Fallback: KV storage (for migration/transition period)
+        if (effectiveEnv?.CSRF_TOKENS_KV && session?.userId) {
+            const storedToken = await effectiveEnv.CSRF_TOKENS_KV.get(`csrf:${session.userId}`, "text");
+            if (!storedToken) {
+                return false;
+            }
+            return this.constantTimeCompare(token, storedToken);
+        }
+        // No session or token - invalid
+        return false;
+    }
+    /**
+     * Static method for validating tokens (for convenience and testing)
+     * Creates a temporary instance to perform validation
+     */
+    static async validateToken(token, session, env) {
+        const instance = new CSRFProtection(env);
+        return instance.validateToken(token, session, env);
+    }
+    /**
+     * Store a CSRF token in session (Double Submit Cookie pattern)
+     *
+     * The token is included in the session object and will be stored in the encrypted
+     * session cookie. No separate storage is needed.
+     *
+     * @param token - The CSRF token to include in session
+     * @param session - The session object to update
+     * @returns Updated session with csrfToken and csrfTokenCreatedAt
+     */
+    storeTokenInSession(token, session) {
+        return {
+            ...session,
+            csrfToken: token,
+            csrfTokenCreatedAt: Date.now(),
+            csrfTokenNeedsRotation: false,
+        };
+    }
+    /**
+     * Store a CSRF token in KV (legacy/fallback method)
+     *
+     * @deprecated Use storeTokenInSession instead. This method is kept for migration/fallback.
+     *
+     * @param token - The CSRF token to store
+     * @param sessionId - The user's session ID (userId from session)
+     * @param ttl - Time to live in seconds (default: 3600 = 1 hour)
+     */
+    async storeTokenInKV(token, sessionId, ttl = 3600) {
+        if (!this.env?.CSRF_TOKENS_KV) {
+            return; // Silently skip if KV not available
+        }
+        await this.env.CSRF_TOKENS_KV.put(`csrf:${sessionId}`, token, {
+            expirationTtl: ttl,
+        });
+    }
+    /**
+     * Remove CSRF token from session
+     * Useful for logout or token invalidation
+     *
+     * @param session - The session object to update
+     * @returns Updated session without csrfToken
+     */
+    removeTokenFromSession(session) {
+        const { csrfToken, ...sessionWithoutToken } = session;
+        return sessionWithoutToken;
+    }
+    /**
+     * Delete a CSRF token from KV (legacy/fallback method)
+     *
+     * @deprecated Use removeTokenFromSession instead. This method is kept for migration/fallback.
+     *
+     * @param sessionId - The user's session ID
+     */
+    async deleteTokenFromKV(sessionId) {
+        if (!this.env?.CSRF_TOKENS_KV) {
+            return;
+        }
+        await this.env.CSRF_TOKENS_KV.delete(`csrf:${sessionId}`);
+    }
+    /**
+     * Constant-time string comparison to prevent timing attacks
+     *
+     * @param a - First string
+     * @param b - Second string
+     * @returns true if strings are equal, false otherwise
+     */
+    constantTimeCompare(a, b) {
+        if (a.length !== b.length) {
+            return false;
+        }
+        let result = 0;
+        for (let i = 0; i < a.length; i++) {
+            result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+        }
+        return result === 0;
+    }
+    static storeTokenInSession(token, session) {
+        return new CSRFProtection().storeTokenInSession(token, session);
+    }
+    static async storeTokenInKV(token, sessionId, env, ttl = 3600) {
+        return new CSRFProtection(env).storeTokenInKV(token, sessionId, ttl);
+    }
+    static removeTokenFromSession(session) {
+        return new CSRFProtection().removeTokenFromSession(session);
+    }
+    static async deleteTokenFromKV(sessionId, env) {
+        return new CSRFProtection(env).deleteTokenFromKV(sessionId);
+    }
+}
+exports.CSRFProtection = CSRFProtection;
+//# sourceMappingURL=csrf.js.map

package/dist/lib/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/lib/csrf.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAKH;;GAEG;AACH,MAAa,cAAc;IACjB,GAAG,CAAO;IAElB,YAAY,GAAS;QACnB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,aAAa;QACX,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,aAAa;QAClB,OAAO,IAAI,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,OAAuB,EACvB,GAAS;QAET,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mCAAmC;QACnC,MAAM,YAAY,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAErC,kEAAkE;QAClE,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,yDAAyD;YACzD,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAEnE,kEAAkE;YAClE,IAAI,OAAO,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC1C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;gBACjD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,EAAE,CAAC;oBACnE,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;gBACxC,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,yDAAyD;QACzD,IAAI,YAAY,EAAE,cAAc,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpD,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,GAAG,CACvD,QAAQ,OAAO,CAAC,MAAM,EAAE,EACxB,MAAM,CACP,CAAC;YAEF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC;QAED,gCAAgC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,aAAa,CACxB,KAAa,EACb,OAAuB,EACvB,GAAS;QAET,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;OASG;IACH,mBAAmB,CAAC,KAAa,EAAE,OAAgB;QACjD,OAAO;YACL,GAAG,OAAO;YACV,SAAS,EAAE,KAAK;YAChB,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE;YAC9B,sBAAsB,EAAE,KAAK;SAC9B,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,SAAiB,EACjB,MAAc,IAAI;QAElB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC;YAC9B,OAAO,CAAC,oCAAoC;QAC9C,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,SAAS,EAAE,EAAE,KAAK,EAAE;YAC5D,aAAa,EAAE,GAAG;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,sBAAsB,CAAC,OAAgB;QACrC,MAAM,EAAE,SAAS,EAAE,GAAG,mBAAmB,EAAE,GAAG,OAAO,CAAC;QACtD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CAAC,CAAS,EAAE,CAAS;QAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,MAAM,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,mBAAmB,CAAC,KAAa,EAAE,OAAgB;QACxD,OAAO,IAAI,cAAc,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,KAAa,EACb,SAAiB,EACjB,GAAQ,EACR,MAAc,IAAI;QAElB,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,sBAAsB,CAAC,OAAgB;QAC5C,OAAO,IAAI,cAAc,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,GAAQ;QACxD,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;CACF;AA1MD,wCA0MC"}

package/dist/lib/data-router.d.ts

@@ -0,0 +1,209 @@
+/**
+ * Data Router Module
+ *
+ * Routes data operations to region-specific databases and enforces data residency.
+ *
+ * Security: All operations validate region and enforce strict region boundaries.
+ *
+ * Performance: Uses cached database connections (via createPrismaForRegion).
+ */
+import { createPrismaForRegion, type EnvWithDb } from "../db";
+import { type AuditLoggerEnv } from "./audit-logger";
+import { type Region } from "./region-detection";
+/**
+ * Environment interface for data router
+ */
+export interface DataRouterEnv extends EnvWithDb, AuditLoggerEnv {
+    DEFAULT_REGION?: string;
+    LOG_LEVEL?: string;
+}
+/**
+ * Input for creating a user
+ */
+export interface CreateUserInput {
+    id: string;
+    email: string;
+    role?: string;
+    username?: string;
+    [key: string]: unknown;
+}
+/**
+ * Data Router class for region-aware data operations
+ *
+ * Security: All operations validate region and enforce dataRegion matching.
+ *
+ * Audit: All operations are logged for compliance and security monitoring.
+ */
+export declare class DataRouter {
+    private static auditLogger?;
+    /**
+     * Get or create audit logger instance
+     */
+    private static getAuditLogger;
+    /**
+     * Validate region access for data operations
+     *
+     * Security: Ensures dataRegion matches requested region to prevent cross-region data access.
+     *
+     * @param dataRegion - Region where data is stored (from database)
+     * @param requestedRegion - Region where request originated
+     * @param userId - Optional user ID for audit logging
+     * @param env - Environment variables
+     * @param request - Optional request object for audit logging
+     * @param requestId - Optional request ID for audit log correlation
+     * @throws Error if dataRegion doesn't match requested region
+     */
+    /**
+     * Check if user has consented to cross-region access
+     */
+    static checkCrossRegionConsent(userId: string, dataRegion: string, accessRegion: Region, env: DataRouterEnv): Promise<boolean>;
+    static validateRegionAccess(dataRegion: string | null | undefined, requestedRegion: Region, userId: string | undefined, env: DataRouterEnv, request?: Request, requestId?: string): void;
+    /**
+     * Validate region access with consent check (async version)
+     * Use this when you need to check for existing consent
+     */
+    static validateRegionAccessWithConsent(dataRegion: string | null | undefined, requestedRegion: Region, userId: string | undefined, env: DataRouterEnv, request?: Request, requestId?: string): Promise<void>;
+    /**
+     * Get database client for a specific region
+     *
+     * Performance: Uses createPrismaForRegion for database connection pooling and caching.
+     *
+     * If request and userId are provided, returns a wrapped client with monitoring and rate limiting.
+     * Otherwise, returns an unwrapped client (for backward compatibility).
+     *
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @param request - Optional request object (if provided, enables monitoring and rate limiting)
+     * @param userId - Optional user ID (if provided, enables per-user rate limiting)
+     * @returns Prisma client for the region
+     * @throws Error if region is invalid
+     */
+    static getDatabaseForRegion(region: string, env: DataRouterEnv, request?: Request, userId?: string): ReturnType<typeof createPrismaForRegion>;
+    /**
+     * Create a user in the region-specific database
+     *
+     * Security: Enforces region validation and dataRegion matching.
+     *
+     * Audit: Logs user creation for compliance.
+     *
+     * @param userData - User data to create
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @param request - Optional request object for audit logging (IP, user agent)
+     * @param requestId - Optional request ID for audit log correlation
+     * @returns Created user
+     * @throws Error if region is invalid or dataRegion mismatch
+     */
+    static createUser(userData: CreateUserInput, region: string, env: DataRouterEnv, request?: Request, requestId?: string): Promise<{
+        id: string;
+        email: string;
+        region: string;
+        dataRegion: string | null;
+        [key: string]: unknown;
+    }>;
+    /**
+     * Get a user from the region-specific database
+     *
+     * Security: Validates region and verifies dataRegion matches requested region.
+     *
+     * Audit: Logs data access for compliance.
+     *
+     * @param userId - User ID
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @param request - Optional request object for audit logging (IP, user agent)
+     * @param requestId - Optional request ID for audit log correlation
+     * @param requestingUserId - Optional ID of user making the request (for audit)
+     * @returns User or null if not found
+     * @throws Error if region is invalid or dataRegion mismatch detected
+     */
+    static getUser(userId: string, region: string, env: DataRouterEnv, request?: Request, requestId?: string, requestingUserId?: string): Promise<{
+        id: string;
+        email: string;
+        region: string;
+        dataRegion: string | null;
+        [key: string]: unknown;
+    } | null>;
+    /**
+     * Update a user in the region-specific database
+     *
+     * Security: Validates region and ensures dataRegion cannot be changed.
+     *
+     * Audit: Logs user update for compliance.
+     *
+     * @param userId - User ID
+     * @param updateData - Data to update
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @param request - Optional request object for audit logging (IP, user agent)
+     * @param requestId - Optional request ID for audit log correlation
+     * @param requestingUserId - Optional ID of user making the request (for audit)
+     * @returns Updated user
+     * @throws Error if region is invalid or dataRegion mismatch
+     */
+    static updateUser(userId: string, updateData: Partial<CreateUserInput>, region: string, env: DataRouterEnv, request?: Request, requestId?: string, requestingUserId?: string): Promise<{
+        id: string;
+        email: string;
+        region: string;
+        dataRegion: string | null;
+        [key: string]: unknown;
+    }>;
+    /**
+     * Create a post in the region-specific database
+     *
+     * Security: Enforces region validation and dataRegion matching.
+     *
+     * Audit: Logs post creation for compliance.
+     *
+     * @param postData - Post data to create
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @param request - Optional request object for audit logging (IP, user agent)
+     * @param requestId - Optional request ID for audit log correlation
+     * @returns Created post
+     * @throws Error if region is invalid
+     */
+    static createPost(postData: {
+        authorId: string;
+        text: string;
+        visibility: string;
+        entityRefs?: string[];
+        geoData?: unknown;
+        media?: Array<{
+            id: string;
+            alt?: string;
+        }>;
+        [key: string]: unknown;
+    }, region: string, env: DataRouterEnv, request?: Request, requestId?: string, session?: {
+        userId: string;
+        email: string;
+    }): Promise<{
+        id: string;
+        authorId: string;
+        dataRegion: string | null;
+        [key: string]: unknown;
+    }>;
+    /**
+     * Get a post from the region-specific database
+     *
+     * Security: Validates region and verifies dataRegion matches requested region.
+     *
+     * Audit: Logs data access for compliance.
+     *
+     * @param postId - Post ID
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @param request - Optional request object for audit logging (IP, user agent)
+     * @param requestId - Optional request ID for audit log correlation
+     * @param requestingUserId - Optional ID of user making the request (for audit)
+     * @returns Post or null if not found
+     * @throws Error if region is invalid or dataRegion mismatch detected
+     */
+    static getPost(postId: string, region: string, env: DataRouterEnv, request?: Request, requestId?: string, requestingUserId?: string): Promise<{
+        id: string;
+        authorId: string;
+        dataRegion: string | null;
+        [key: string]: unknown;
+    } | null>;
+}
+//# sourceMappingURL=data-router.d.ts.map

package/dist/lib/data-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-router.d.ts","sourceRoot":"","sources":["../../src/lib/data-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,qBAAqB,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAC9D,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKlE,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,SAAS,EAAE,cAAc;IAE9D,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAc;IAEzC;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAY7B;;;;;;;;;;;;OAYG;IACH;;OAEG;WACU,uBAAuB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,OAAO,CAAC;IAuBnB,MAAM,CAAC,oBAAoB,CACzB,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI;IAyFP;;;OAGG;WACU,+BAA+B,CAC1C,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IAmEhB;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,oBAAoB,CACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,UAAU,CAAC,OAAO,qBAAqB,CAAC;IAsB3C;;;;;;;;;;;;;;OAcG;WACU,UAAU,CACrB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IAoLF;;;;;;;;;;;;;;;OAeG;WACU,OAAO,CAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,GAAG,IAAI,CAAC;IAuFT;;;;;;;;;;;;;;;;OAgBG;WACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,EACpC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IAwEF;;;;;;;;;;;;;;OAcG;WACU,UAAU,CACrB,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,EACD,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC1C,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IA2MF;;;;;;;;;;;;;;;OAeG;WACU,OAAO,CAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,GAAG,IAAI,CAAC;CAyFV"}