@de-otio/trellis 0.4.0

package/dist/lib/database-monitor.js

@@ -0,0 +1,199 @@
+"use strict";
+/**
+ * Database Monitoring Service
+ *
+ * Monitors database connection health, tracks failures, and alerts on unusual patterns.
+ *
+ * Features:
+ * - Connection failure tracking
+ * - Unusual error pattern detection
+ * - Security event alerting
+ * - Query performance monitoring (trace level only)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DatabaseMonitor = void 0;
+const logger_1 = require("./logger");
+const security_monitor_1 = require("./security-monitor");
+class DatabaseMonitor {
+    logger;
+    securityMonitor;
+    failureCounts = new Map(); // region -> count
+    lastFailureTime = new Map(); // region -> timestamp
+    FAILURE_THRESHOLD = 5; // Alert after 5 failures in window
+    FAILURE_WINDOW_MS = 60000; // 1 minute window
+    ALERT_COOLDOWN_MS = 300000; // 5 minutes between alerts
+    constructor(env) {
+        this.logger = logger_1.Logger.getInstance(env);
+        this.securityMonitor = new security_monitor_1.SecurityMonitor();
+    }
+    /**
+     * Log database connection failure
+     *
+     * @param failure - Connection failure details
+     * @param env - Environment variables
+     */
+    async logConnectionFailure(failure, env) {
+        const key = `${failure.region}:${failure.operation || "unknown"}`;
+        const now = new Date();
+        // Update failure counts
+        const count = (this.failureCounts.get(key) || 0) + 1;
+        this.failureCounts.set(key, count);
+        this.lastFailureTime.set(key, now);
+        // Log failure
+        this.logger.error("[DatabaseMonitor] Connection failure", {
+            region: failure.region,
+            operation: failure.operation,
+            error: failure.error,
+            count,
+            userId: failure.userId,
+        });
+        // Check if threshold exceeded
+        if (count >= this.FAILURE_THRESHOLD) {
+            await this.alertOnFailurePattern(key, failure, env);
+        }
+        // Log security event for critical failures
+        if (this.isCriticalFailure(failure.error)) {
+            await this.logSecurityEvent(failure, env);
+        }
+        // Cleanup old entries (prevent memory leak)
+        this.cleanupOldEntries(now);
+    }
+    /**
+     * Log database query (trace level only)
+     *
+     * SECURITY: Only logs at TRACE level to prevent sensitive data exposure
+     *
+     * @param log - Query log details
+     * @param env - Environment variables
+     */
+    logQuery(log, env) {
+        // Only log at TRACE level
+        const logLevel = env.LOG_LEVEL?.toUpperCase() || "INFO";
+        if (logLevel !== "TRACE" && logLevel !== "DEBUG") {
+            return; // Skip logging if not at trace/debug level
+        }
+        // Log query details (sanitized)
+        this.logger.debug("[DatabaseMonitor] Query executed", {
+            operation: log.operation,
+            region: log.region,
+            duration: log.duration,
+            success: log.success,
+            userId: log.userId,
+            // SECURITY: Do not log error details at trace level (may contain sensitive data)
+            // Only log error type, not full message
+            errorType: log.error ? this.extractErrorType(log.error) : undefined,
+        });
+    }
+    /**
+     * Alert on failure pattern
+     */
+    async alertOnFailurePattern(key, failure, env) {
+        const lastAlert = this.lastFailureTime.get(`${key}:alert`);
+        const now = new Date();
+        // Check cooldown
+        if (lastAlert &&
+            now.getTime() - lastAlert.getTime() < this.ALERT_COOLDOWN_MS) {
+            return; // Still in cooldown
+        }
+        // Update alert time
+        this.lastFailureTime.set(`${key}:alert`, now);
+        // Log alert
+        this.logger.error("[DatabaseMonitor] Failure pattern detected", {
+            region: failure.region,
+            operation: failure.operation,
+            failureCount: this.failureCounts.get(key),
+            threshold: this.FAILURE_THRESHOLD,
+        });
+        // Log security event
+        await this.logSecurityEvent({
+            ...failure,
+            error: `Multiple connection failures detected (${this.failureCounts.get(key)} failures)`,
+        }, env);
+    }
+    /**
+     * Log security event for database failures
+     */
+    async logSecurityEvent(failure, env) {
+        try {
+            const event = {
+                type: "database_connection_failure",
+                severity: this.isCriticalFailure(failure.error) ? "high" : "medium",
+                userId: failure.userId,
+                provider: "database",
+                ipAddress: "internal", // Database failures are internal
+                userAgent: "database-monitor",
+                success: false,
+                metadata: {
+                    region: failure.region,
+                    operation: failure.operation,
+                    error: failure.error,
+                },
+            };
+            await this.securityMonitor.logSecurityEvent(event, env);
+        }
+        catch (error) {
+            // Don't fail if security logging fails
+            this.logger.warn("[DatabaseMonitor] Failed to log security event", {
+                error,
+            });
+        }
+    }
+    /**
+     * Check if error is critical
+     */
+    isCriticalFailure(error) {
+        const criticalPatterns = [
+            /authentication.*failed/gi,
+            /connection.*refused/gi,
+            /timeout/gi,
+            /network.*error/gi,
+            /ssl.*error/gi,
+            /certificate.*error/gi,
+        ];
+        return criticalPatterns.some((pattern) => pattern.test(error));
+    }
+    /**
+     * Extract error type from error message (sanitized)
+     */
+    extractErrorType(error) {
+        // Extract just the error type, not the full message
+        const match = error.match(/^([A-Za-z]+Error|Error|Timeout|Connection)/);
+        return match ? match[1] : "UnknownError";
+    }
+    /**
+     * Cleanup old failure entries
+     */
+    cleanupOldEntries(now) {
+        const cutoff = now.getTime() - this.FAILURE_WINDOW_MS;
+        for (const [key, timestamp] of this.lastFailureTime.entries()) {
+            if (timestamp.getTime() < cutoff && !key.includes(":alert")) {
+                this.failureCounts.delete(key);
+                this.lastFailureTime.delete(key);
+            }
+        }
+    }
+    /**
+     * Get failure statistics
+     */
+    getFailureStats() {
+        const stats = {};
+        for (const [key, count] of this.failureCounts.entries()) {
+            if (!key.includes(":alert")) {
+                stats[key] = {
+                    count,
+                    lastFailure: this.lastFailureTime.get(key) || null,
+                };
+            }
+        }
+        return stats;
+    }
+    /**
+     * Reset failure statistics
+     */
+    resetStats() {
+        this.failureCounts.clear();
+        this.lastFailureTime.clear();
+    }
+}
+exports.DatabaseMonitor = DatabaseMonitor;
+//# sourceMappingURL=database-monitor.js.map

package/dist/lib/database-monitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-monitor.js","sourceRoot":"","sources":["../../src/lib/database-monitor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,qCAAkC;AAClC,yDAAyE;AAyBzE,MAAa,eAAe;IAClB,MAAM,CAAS;IACf,eAAe,CAAkB;IACjC,aAAa,GAAwB,IAAI,GAAG,EAAE,CAAC,CAAC,kBAAkB;IAClE,eAAe,GAAsB,IAAI,GAAG,EAAE,CAAC,CAAC,sBAAsB;IAC7D,iBAAiB,GAAG,CAAC,CAAC,CAAC,mCAAmC;IAC1D,iBAAiB,GAAG,KAAK,CAAC,CAAC,kBAAkB;IAC7C,iBAAiB,GAAG,MAAM,CAAC,CAAC,2BAA2B;IAExE,YAAY,GAAuB;QACjC,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,IAAI,kCAAe,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAkC,EAClC,GAAuB;QAEvB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,wBAAwB;QACxB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAEnC,cAAc;QACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;YACxD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,8BAA8B;QAC9B,IAAI,KAAK,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,2CAA2C;QAC3C,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;QAED,4CAA4C;QAC5C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAqB,EAAE,GAAuB;QACrD,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,MAAM,CAAC;QACxD,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjD,OAAO,CAAC,2CAA2C;QACrD,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;YACpD,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,iFAAiF;YACjF,wCAAwC;YACxC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;SACpE,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB,CACjC,GAAW,EACX,OAAkC,EAClC,GAAuB;QAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,iBAAiB;QACjB,IACE,SAAS;YACT,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAC5D,CAAC;YACD,OAAO,CAAC,oBAAoB;QAC9B,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC;QAE9C,YAAY;QACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;YAC9D,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;YACzC,SAAS,EAAE,IAAI,CAAC,iBAAiB;SAClC,CAAC,CAAC;QAEH,qBAAqB;QACrB,MAAM,IAAI,CAAC,gBAAgB,CACzB;YACE,GAAG,OAAO;YACV,KAAK,EAAE,0CAA0C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY;SACzF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,OAAkC,EAClC,GAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,KAAK,GAAkB;gBAC3B,IAAI,EAAE,6BAA6B;gBACnC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBACnE,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,UAAU;gBACpB,SAAS,EAAE,UAAU,EAAE,iCAAiC;gBACxD,SAAS,EAAE,kBAAkB;gBAC7B,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB;aACF,CAAC;YAEF,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uCAAuC;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBACjE,KAAK;aACN,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,KAAa;QACrC,MAAM,gBAAgB,GAAG;YACvB,0BAA0B;YAC1B,uBAAuB;YACvB,WAAW;YACX,kBAAkB;YAClB,cAAc;YACd,sBAAsB;SACvB,CAAC;QAEF,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,KAAa;QACpC,oDAAoD;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IAC3C,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,GAAS;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAEtD,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe;QAIb,MAAM,KAAK,GACT,EAAE,CAAC;QAEL,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,KAAK,CAAC,GAAG,CAAC,GAAG;oBACX,KAAK;oBACL,WAAW,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;iBACnD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;CACF;AA/ND,0CA+NC"}

package/dist/lib/database-rate-limiter.d.ts

@@ -0,0 +1,41 @@
+import type { KVNamespace } from "../types/cloudflare-compat";
+export interface DatabaseRateLimiterEnv {
+    RATE_LIMIT_KV?: KVNamespace;
+}
+export interface DatabaseRateLimitConfig {
+    userLimit: number;
+    userWindowMs: number;
+    operationLimit: number;
+    operationWindowMs: number;
+    globalLimit: number;
+    globalWindowMs: number;
+}
+export declare class DatabaseRateLimiter {
+    private rateLimiter;
+    private config;
+    private env;
+    constructor(env: DatabaseRateLimiterEnv, config?: Partial<DatabaseRateLimitConfig>);
+    /**
+     * Check if database operation is allowed
+     *
+     * @param request - Request object (for rate limit key generation)
+     * @param userId - User ID (optional)
+     * @param operation - Database operation name (e.g., 'findMany', 'create')
+     * @returns True if allowed, false if rate limited
+     */
+    checkLimit(request: Request, userId?: string, operation?: string): Promise<{
+        allowed: boolean;
+        retryAfter?: number;
+    }>;
+    /**
+     * Record a database operation (increment counters)
+     * Note: RateLimiter automatically records on checkRateLimit, so this is a no-op
+     * but kept for API consistency
+     *
+     * @param request - Request object
+     * @param userId - User ID (optional)
+     * @param operation - Database operation name (optional)
+     */
+    recordOperation(request: Request, userId?: string, operation?: string): Promise<void>;
+}
+//# sourceMappingURL=database-rate-limiter.d.ts.map

package/dist/lib/database-rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/lib/database-rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,4BAA4B,CAAC;AAgBzF,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,EAAE,WAAW,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IAEtC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IAGrB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAG1B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,GAAG,CAAyB;gBAGlC,GAAG,EAAE,sBAAsB,EAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC;IAc3C;;;;;;;OAOG;IACG,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAoErD;;;;;;;;OAQG;IACG,eAAe,CACnB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;CAKjB"}

package/dist/lib/database-rate-limiter.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DatabaseRateLimiter = void 0;
+/**
+ * Database Rate Limiter
+ *
+ * Rate limits database operations to prevent abuse and DoS attacks.
+ *
+ * Features:
+ * - Per-user rate limiting
+ * - Per-operation rate limiting
+ * - Configurable limits
+ * - KV-backed distributed rate limiting
+ */
+const rate_limit_1 = require("./rate-limit");
+class DatabaseRateLimiter {
+    rateLimiter;
+    config;
+    env;
+    constructor(env, config) {
+        this.env = env;
+        this.rateLimiter = new rate_limit_1.RateLimiter();
+        this.config = {
+            userLimit: config?.userLimit ?? 100, // 100 queries per user per window
+            userWindowMs: config?.userWindowMs ?? 60000, // 1 minute
+            operationLimit: config?.operationLimit ?? 50, // 50 queries per operation per window
+            operationWindowMs: config?.operationWindowMs ?? 60000, // 1 minute
+            globalLimit: config?.globalLimit ?? 1000, // 1000 queries globally per window
+            globalWindowMs: config?.globalWindowMs ?? 60000, // 1 minute
+        };
+    }
+    /**
+     * Check if database operation is allowed
+     *
+     * @param request - Request object (for rate limit key generation)
+     * @param userId - User ID (optional)
+     * @param operation - Database operation name (e.g., 'findMany', 'create')
+     * @returns True if allowed, false if rate limited
+     */
+    async checkLimit(request, userId, operation) {
+        // Check global limit
+        const globalResult = this.rateLimiter.checkRateLimit(request, "db:global", this.config.globalLimit, Math.floor(this.config.globalWindowMs / 1000), undefined, undefined, userId);
+        if (!globalResult.allowed) {
+            const retryAfter = Math.ceil((globalResult.resetAt - Date.now()) / 1000) * 1000;
+            return {
+                allowed: false,
+                retryAfter,
+            };
+        }
+        // Check per-user limit
+        if (userId) {
+            const userResult = this.rateLimiter.checkRateLimit(request, `db:user:${userId}`, this.config.userLimit, Math.floor(this.config.userWindowMs / 1000), undefined, undefined, userId);
+            if (!userResult.allowed) {
+                const retryAfter = Math.ceil((userResult.resetAt - Date.now()) / 1000) * 1000;
+                return {
+                    allowed: false,
+                    retryAfter,
+                };
+            }
+        }
+        // Check per-operation limit
+        if (operation) {
+            const operationResult = this.rateLimiter.checkRateLimit(request, `db:op:${operation}`, this.config.operationLimit, Math.floor(this.config.operationWindowMs / 1000), undefined, undefined, userId);
+            if (!operationResult.allowed) {
+                const retryAfter = Math.ceil((operationResult.resetAt - Date.now()) / 1000) * 1000;
+                return {
+                    allowed: false,
+                    retryAfter,
+                };
+            }
+        }
+        return { allowed: true };
+    }
+    /**
+     * Record a database operation (increment counters)
+     * Note: RateLimiter automatically records on checkRateLimit, so this is a no-op
+     * but kept for API consistency
+     *
+     * @param request - Request object
+     * @param userId - User ID (optional)
+     * @param operation - Database operation name (optional)
+     */
+    async recordOperation(request, userId, operation) {
+        // RateLimiter automatically records on checkRateLimit
+        // This method is kept for API consistency but is effectively a no-op
+        // The actual recording happens in checkLimit()
+    }
+}
+exports.DatabaseRateLimiter = DatabaseRateLimiter;
+//# sourceMappingURL=database-rate-limiter.js.map

package/dist/lib/database-rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-rate-limiter.js","sourceRoot":"","sources":["../../src/lib/database-rate-limiter.ts"],"names":[],"mappings":";;;AACA;;;;;;;;;;GAUG;AAEH,6CAA2C;AAqB3C,MAAa,mBAAmB;IACtB,WAAW,CAAc;IACzB,MAAM,CAA0B;IAChC,GAAG,CAAyB;IAEpC,YACE,GAA2B,EAC3B,MAAyC;QAEzC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,IAAI,wBAAW,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,GAAG,EAAE,kCAAkC;YACvE,YAAY,EAAE,MAAM,EAAE,YAAY,IAAI,KAAK,EAAE,WAAW;YACxD,cAAc,EAAE,MAAM,EAAE,cAAc,IAAI,EAAE,EAAE,sCAAsC;YACpF,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,IAAI,KAAK,EAAE,WAAW;YAClE,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,IAAI,EAAE,mCAAmC;YAC7E,cAAc,EAAE,MAAM,EAAE,cAAc,IAAI,KAAK,EAAE,WAAW;SAC7D,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACd,OAAgB,EAChB,MAAe,EACf,SAAkB;QAElB,qBAAqB;QACrB,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,CAClD,OAAO,EACP,WAAW,EACX,IAAI,CAAC,MAAM,CAAC,WAAW,EACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,EAC7C,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,UAAU,GACd,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YAC/D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,UAAU;aACX,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,CAChD,OAAO,EACP,WAAW,MAAM,EAAE,EACnB,IAAI,CAAC,MAAM,CAAC,SAAS,EACrB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,EAC3C,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAC;YAEF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,UAAU,GACd,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;gBAC7D,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,UAAU;iBACX,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,CACrD,OAAO,EACP,SAAS,SAAS,EAAE,EACpB,IAAI,CAAC,MAAM,CAAC,cAAc,EAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,EAChD,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAC;YAEF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;gBAC7B,MAAM,UAAU,GACd,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;gBAClE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,UAAU;iBACX,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CACnB,OAAgB,EAChB,MAAe,EACf,SAAkB;QAElB,sDAAsD;QACtD,qEAAqE;QACrE,+CAA+C;IACjD,CAAC;CACF;AAvHD,kDAuHC"}

package/dist/lib/database-wrapper-helper.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Database Wrapper Helper
+ *
+ * Provides seamless integration of database monitoring and logging
+ * without requiring changes to existing database call patterns.
+ *
+ * Performance Considerations:
+ * - Monitoring: Minimal overhead (<1ms) for logging
+ * - Query logging: Only at TRACE level, zero overhead in production
+ *
+ * Note: Rate limiting is handled at the API level (in worker.ts), not per database operation.
+ *
+ * Usage:
+ * ```typescript
+ * const db = getWrappedDatabase(region, env, request, userId);
+ * // Use db normally - all operations are automatically monitored
+ * const user = await db.user.findUnique({ where: { id } });
+ * ```
+ */
+import type { PrismaClient } from "@prisma/client";
+import { type EnvWithDb } from "../db";
+import { type DatabaseWrapperEnv } from "./database-wrapper";
+/**
+ * Get a wrapped database client with monitoring and logging
+ *
+ * Performance: Creates fresh Prisma clients per request to follow Hyperdrive best practices
+ *
+ * Note: Rate limiting is handled at the API level, not here.
+ *
+ * @param region - Region code ('US', 'EU', 'CN')
+ * @param env - Environment variables
+ * @param request - Request object (for monitoring context)
+ * @param userId - Optional user ID (for monitoring context)
+ * @returns Wrapped Prisma client that automatically monitors operations
+ */
+export declare function getWrappedDatabase(region: string, env: DatabaseWrapperEnv, request: Request, userId?: string): PrismaClient;
+/**
+ * Get unwrapped database client (for internal operations that don't need monitoring)
+ *
+ * Use this sparingly - only for operations that should bypass monitoring
+ * (e.g., health checks, admin operations)
+ */
+export declare function getUnwrappedDatabase(region: string, env: EnvWithDb): PrismaClient;
+//# sourceMappingURL=database-wrapper-helper.d.ts.map

package/dist/lib/database-wrapper-helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-wrapper-helper.d.ts","sourceRoot":"","sources":["../../src/lib/database-wrapper-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAyB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAC9D,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE9E;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,kBAAkB,EACvB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,YAAY,CAKd;AAoFD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,SAAS,GACb,YAAY,CAEd"}

package/dist/lib/database-wrapper-helper.js

@@ -0,0 +1,104 @@
+"use strict";
+/**
+ * Database Wrapper Helper
+ *
+ * Provides seamless integration of database monitoring and logging
+ * without requiring changes to existing database call patterns.
+ *
+ * Performance Considerations:
+ * - Monitoring: Minimal overhead (<1ms) for logging
+ * - Query logging: Only at TRACE level, zero overhead in production
+ *
+ * Note: Rate limiting is handled at the API level (in worker.ts), not per database operation.
+ *
+ * Usage:
+ * ```typescript
+ * const db = getWrappedDatabase(region, env, request, userId);
+ * // Use db normally - all operations are automatically monitored
+ * const user = await db.user.findUnique({ where: { id } });
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getWrappedDatabase = getWrappedDatabase;
+exports.getUnwrappedDatabase = getUnwrappedDatabase;
+const db_1 = require("../db");
+const database_wrapper_1 = require("./database-wrapper");
+/**
+ * Get a wrapped database client with monitoring and logging
+ *
+ * Performance: Creates fresh Prisma clients per request to follow Hyperdrive best practices
+ *
+ * Note: Rate limiting is handled at the API level, not here.
+ *
+ * @param region - Region code ('US', 'EU', 'CN')
+ * @param env - Environment variables
+ * @param request - Request object (for monitoring context)
+ * @param userId - Optional user ID (for monitoring context)
+ * @returns Wrapped Prisma client that automatically monitors operations
+ */
+function getWrappedDatabase(region, env, request, userId) {
+    // Always create a fresh Prisma client per request to avoid stale connections
+    const prisma = (0, db_1.createPrismaForRegion)(region, env);
+    const wrapper = new database_wrapper_1.DatabaseWrapper(prisma, env, region);
+    return createDatabaseProxy(wrapper, env, request, userId, region);
+}
+/**
+ * Create a proxy that intercepts Prisma operations
+ *
+ * This allows existing code to use the database normally while adding
+ * monitoring and logging transparently.
+ */
+function createDatabaseProxy(wrapper, env, request, userId, region) {
+    const prisma = wrapper.getClient();
+    // Create a proxy that intercepts method calls
+    return new Proxy(prisma, {
+        get(target, prop) {
+            const value = target[prop];
+            // If it's a model (user, post, etc.), wrap its methods
+            if (typeof value === "object" &&
+                value !== null &&
+                prop !== "$connect" &&
+                prop !== "$disconnect") {
+                return createModelProxy(value, wrapper, env, request, userId, prop, region);
+            }
+            // For other properties (like $transaction, $queryRaw), return as-is
+            // These are handled separately if needed
+            return value;
+        },
+    });
+}
+/**
+ * Create a proxy for a Prisma model (user, post, etc.)
+ */
+function createModelProxy(model, wrapper, env, request, userId, modelName, region) {
+    return new Proxy(model, {
+        get(target, prop) {
+            const method = target[prop];
+            // If it's a function (findUnique, findMany, create, update, etc.), wrap it
+            if (typeof method === "function") {
+                return async (...args) => {
+                    // Extract operation name from method name
+                    const operation = `${modelName}.${String(prop)}`;
+                    return wrapper.execute(() => method.apply(target, args), {
+                        region,
+                        operation,
+                        request,
+                        userId,
+                        env,
+                    });
+                };
+            }
+            return method;
+        },
+    });
+}
+/**
+ * Get unwrapped database client (for internal operations that don't need monitoring)
+ *
+ * Use this sparingly - only for operations that should bypass monitoring
+ * (e.g., health checks, admin operations)
+ */
+function getUnwrappedDatabase(region, env) {
+    return (0, db_1.createPrismaForRegion)(region, env);
+}
+//# sourceMappingURL=database-wrapper-helper.js.map

package/dist/lib/database-wrapper-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-wrapper-helper.js","sourceRoot":"","sources":["../../src/lib/database-wrapper-helper.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;AAmBH,gDAUC;AA0FD,oDAKC;AAzHD,8BAA8D;AAC9D,yDAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,SAAgB,kBAAkB,CAChC,MAAc,EACd,GAAuB,EACvB,OAAgB,EAChB,MAAe;IAEf,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAA,0BAAqB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,kCAAe,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,OAAwB,EACxB,GAAuB,EACvB,OAAgB,EAChB,MAA0B,EAC1B,MAAc;IAEd,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAEnC,8CAA8C;IAC9C,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,MAAM,KAAK,GAAI,MAAc,CAAC,IAAI,CAAC,CAAC;YAEpC,uDAAuD;YACvD,IACE,OAAO,KAAK,KAAK,QAAQ;gBACzB,KAAK,KAAK,IAAI;gBACd,IAAI,KAAK,UAAU;gBACnB,IAAI,KAAK,aAAa,EACtB,CAAC;gBACD,OAAO,gBAAgB,CACrB,KAAK,EACL,OAAO,EACP,GAAG,EACH,OAAO,EACP,MAAM,EACN,IAAc,EACd,MAAM,CACP,CAAC;YACJ,CAAC;YAED,oEAAoE;YACpE,yCAAyC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAiB,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CACvB,KAAU,EACV,OAAwB,EACxB,GAAuB,EACvB,OAAgB,EAChB,MAA0B,EAC1B,SAAiB,EACjB,MAAc;IAEd,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE;QACtB,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAE5B,2EAA2E;YAC3E,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,OAAO,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;oBAC9B,0CAA0C;oBAC1C,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAEjD,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;wBACvD,MAAM;wBACN,SAAS;wBACT,OAAO;wBACP,MAAM;wBACN,GAAG;qBACJ,CAAC,CAAC;gBACL,CAAC,CAAC;YACJ,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAClC,MAAc,EACd,GAAc;IAEd,OAAO,IAAA,0BAAqB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC"}

package/dist/lib/database-wrapper.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Database Wrapper
+ *
+ * Wraps Prisma client with monitoring and query logging.
+ *
+ * Features:
+ * - Connection failure monitoring
+ * - Query logging (trace level only)
+ * - Error handling and sanitization
+ *
+ * Note: Rate limiting is handled at the API level (in worker.ts), not per database operation.
+ * This avoids the performance overhead of checking limits on every database call.
+ */
+import type { PrismaClient } from "@prisma/client";
+import { type DatabaseMonitorEnv } from "./database-monitor";
+export interface DatabaseWrapperEnv extends DatabaseMonitorEnv {
+}
+export interface DatabaseWrapperOptions {
+    userId?: string;
+    region: string;
+    operation?: string;
+    request: Request;
+    env: DatabaseWrapperEnv;
+}
+/**
+ * Database wrapper that adds monitoring and logging
+ *
+ * Note: Rate limiting is handled at the API level, not here.
+ */
+export declare class DatabaseWrapper {
+    private prisma;
+    private monitor;
+    private logger;
+    private region;
+    constructor(prisma: PrismaClient, env: DatabaseWrapperEnv, region: string);
+    /**
+     * Execute a database operation with monitoring and logging
+     *
+     * Note: Rate limiting is handled at the API level (in worker.ts), not here.
+     */
+    execute<T>(operation: () => Promise<T>, options: DatabaseWrapperOptions): Promise<T>;
+    /**
+     * Check if error is a connection error
+     */
+    private isConnectionError;
+    /**
+     * Get underlying Prisma client (for direct access when needed)
+     */
+    getClient(): PrismaClient;
+}
+//# sourceMappingURL=database-wrapper.d.ts.map

package/dist/lib/database-wrapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-wrapper.d.ts","sourceRoot":"","sources":["../../src/lib/database-wrapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;CAAG;AAEjE,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,kBAAkB,CAAC;CACzB;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM;IAOzE;;;;OAIG;IACG,OAAO,CAAC,CAAC,EACb,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,CAAC,CAAC;IA2Db;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAgBzB;;OAEG;IACH,SAAS,IAAI,YAAY;CAG1B"}