@de-otio/trellis 0.4.0

package/dist/lib/domain-reputation-service.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Domain Reputation Service
+ *
+ * Manages domain reputation scoring, blocklists, and allowlists for link security.
+ * Integrates with threat intelligence and user reports to build domain reputation over time.
+ */
+import { type DataRouterEnv } from "./data-router";
+export interface Env extends DataRouterEnv {
+}
+/**
+ * Domain reputation status
+ */
+export type DomainStatus = "unknown" | "safe" | "warning" | "blocked";
+/**
+ * Reputation signal types
+ */
+export type ReputationSignal = "threat_intel_positive" | "threat_intel_negative" | "user_report" | "many_users" | "no_reports" | "admin_block" | "admin_allow" | "auto_block" | "auto_unblock";
+/**
+ * Domain reputation result
+ */
+export interface DomainReputationResult {
+    domain: string;
+    reputation: number;
+    status: DomainStatus;
+    lastChecked: Date;
+    isBlocklisted: boolean;
+    isAllowlisted: boolean;
+}
+/**
+ * Service for managing domain reputation
+ */
+export declare class DomainReputationService {
+    private logger;
+    private readonly MAX_REPUTATION;
+    private readonly MIN_REPUTATION;
+    private readonly DEFAULT_REPUTATION;
+    private readonly SAFE_THRESHOLD;
+    private readonly WARNING_THRESHOLD;
+    private readonly BLOCKED_THRESHOLD;
+    private readonly SIGNAL_WEIGHTS;
+    private readonly AUTO_BLOCK_REPORT_THRESHOLD;
+    constructor(env?: Env);
+    /**
+     * Get domain reputation
+     *
+     * @param domain - Domain name (e.g., "example.com")
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @returns Domain reputation result
+     */
+    getReputation(domain: string, region: string, env: Env): Promise<DomainReputationResult>;
+    /**
+     * Update domain reputation based on a signal
+     *
+     * @param domain - Domain name
+     * @param signal - Reputation signal type
+     * @param region - Region code
+     * @param env - Environment variables
+     * @param metadata - Optional metadata (e.g., report count, user count)
+     */
+    updateReputation(domain: string, signal: ReputationSignal, region: string, env: Env, metadata?: Record<string, unknown>): Promise<void>;
+    /**
+     * Block a domain (admin action)
+     *
+     * @param domain - Domain name
+     * @param region - Region code
+     * @param env - Environment variables
+     */
+    blockDomain(domain: string, region: string, env: Env): Promise<void>;
+    /**
+     * Unblock a domain (admin action)
+     *
+     * @param domain - Domain name
+     * @param region - Region code
+     * @param env - Environment variables
+     */
+    unblockDomain(domain: string, region: string, env: Env): Promise<void>;
+    /**
+     * Add domain to allowlist (admin action)
+     *
+     * @param domain - Domain name
+     * @param region - Region code
+     * @param env - Environment variables
+     */
+    addToAllowlist(domain: string, region: string, env: Env): Promise<void>;
+    /**
+     * Check if domain should be auto-blocked based on report count
+     *
+     * @param domain - Domain name
+     * @param region - Region code
+     * @param env - Environment variables
+     * @returns True if domain should be auto-blocked
+     */
+    shouldAutoBlock(domain: string, region: string, env: Env): Promise<boolean>;
+    /**
+     * Apply reputation decay over time
+     * (Called periodically by a background job)
+     *
+     * @param region - Region code
+     * @param env - Environment variables
+     * @param decayRate - Reputation points to decay per day (default: 1)
+     */
+    applyReputationDecay(region: string, env: Env, decayRate?: number): Promise<void>;
+    /**
+     * Normalize domain name (lowercase, remove www, etc.)
+     *
+     * @param domain - Domain name
+     * @returns Normalized domain
+     */
+    private normalizeDomain;
+}
+//# sourceMappingURL=domain-reputation-service.d.ts.map

package/dist/lib/domain-reputation-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-reputation-service.d.ts","sourceRoot":"","sources":["../../src/lib/domain-reputation-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAG/D,MAAM,WAAW,GAAI,SAAQ,aAAa;CAGzC;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,gBAAgB,GACxB,uBAAuB,GACvB,uBAAuB,GACvB,aAAa,GACb,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,aAAa,GACb,YAAY,GACZ,cAAc,CAAC;AAEnB;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,IAAI,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,MAAM,CAAS;IAGvB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAO;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAK;IAGxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAM;IACrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAO;IACzC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAO;IAGzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAU7B;IAGF,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAK;gBAErC,GAAG,CAAC,EAAE,GAAG;IAIrB;;;;;;;OAOG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,sBAAsB,CAAC;IAoDlC;;;;;;;;OAQG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,GAAG,EACR,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,IAAI,CAAC;IAuEhB;;;;;;OAMG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1E;;;;;;OAMG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B5E;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC;IAOhB;;;;;;;OAOG;IACG,eAAe,CACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,OAAO,CAAC;IAqCnB;;;;;;;OAOG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,GAAG,EACR,SAAS,GAAE,MAAU,GACpB,OAAO,CAAC,IAAI,CAAC;IAsEhB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;CAoBxB"}

package/dist/lib/domain-reputation-service.js

@@ -0,0 +1,344 @@
+"use strict";
+/**
+ * Domain Reputation Service
+ *
+ * Manages domain reputation scoring, blocklists, and allowlists for link security.
+ * Integrates with threat intelligence and user reports to build domain reputation over time.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DomainReputationService = void 0;
+const data_router_1 = require("./data-router");
+const logger_1 = require("./logger");
+/**
+ * Service for managing domain reputation
+ */
+class DomainReputationService {
+    logger;
+    // Reputation scoring constants
+    MAX_REPUTATION = 100;
+    MIN_REPUTATION = -100;
+    DEFAULT_REPUTATION = 0;
+    // Status thresholds
+    SAFE_THRESHOLD = 20; // Reputation >= 20 = safe
+    WARNING_THRESHOLD = -10; // Reputation < -10 = warning
+    BLOCKED_THRESHOLD = -50; // Reputation < -50 = blocked
+    // Signal weights for reputation calculation
+    SIGNAL_WEIGHTS = {
+        threat_intel_positive: +30,
+        threat_intel_negative: -50,
+        user_report: -10,
+        many_users: +5,
+        no_reports: +2,
+        admin_block: -100, // Immediate block
+        admin_allow: +50, // High positive signal
+        auto_block: -80,
+        auto_unblock: +20,
+    };
+    // Auto-block threshold (number of reports before auto-blocking)
+    AUTO_BLOCK_REPORT_THRESHOLD = 5;
+    constructor(env) {
+        this.logger = logger_1.Logger.getInstance(env);
+    }
+    /**
+     * Get domain reputation
+     *
+     * @param domain - Domain name (e.g., "example.com")
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @returns Domain reputation result
+     */
+    async getReputation(domain, region, env) {
+        const normalizedDomain = this.normalizeDomain(domain);
+        const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+        try {
+            let reputation = await db.domainReputation.findUnique({
+                where: { domain: normalizedDomain },
+            });
+            // If domain doesn't exist, create with default reputation
+            if (!reputation) {
+                reputation = await db.domainReputation.create({
+                    data: {
+                        domain: normalizedDomain,
+                        reputation: this.DEFAULT_REPUTATION,
+                        status: "unknown",
+                        lastChecked: new Date(),
+                    },
+                });
+            }
+            // Check if domain is in blocklist/allowlist (stored in status)
+            const isBlocklisted = reputation.status === "blocked";
+            const isAllowlisted = reputation.status === "safe" &&
+                reputation.reputation >= this.SAFE_THRESHOLD;
+            return {
+                domain: normalizedDomain,
+                reputation: reputation.reputation,
+                status: reputation.status,
+                lastChecked: reputation.lastChecked,
+                isBlocklisted,
+                isAllowlisted,
+            };
+        }
+        catch (error) {
+            this.logger.error(`[DomainReputationService] Error getting reputation for ${normalizedDomain}:`, error);
+            // Return default reputation on error
+            return {
+                domain: normalizedDomain,
+                reputation: this.DEFAULT_REPUTATION,
+                status: "unknown",
+                lastChecked: new Date(),
+                isBlocklisted: false,
+                isAllowlisted: false,
+            };
+        }
+    }
+    /**
+     * Update domain reputation based on a signal
+     *
+     * @param domain - Domain name
+     * @param signal - Reputation signal type
+     * @param region - Region code
+     * @param env - Environment variables
+     * @param metadata - Optional metadata (e.g., report count, user count)
+     */
+    async updateReputation(domain, signal, region, env, metadata) {
+        const normalizedDomain = this.normalizeDomain(domain);
+        const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+        try {
+            // Get current reputation
+            let reputation = await db.domainReputation.findUnique({
+                where: { domain: normalizedDomain },
+            });
+            if (!reputation) {
+                // Create new reputation record
+                reputation = await db.domainReputation.create({
+                    data: {
+                        domain: normalizedDomain,
+                        reputation: this.DEFAULT_REPUTATION,
+                        status: "unknown",
+                        lastChecked: new Date(),
+                    },
+                });
+            }
+            // Calculate reputation change
+            const signalWeight = this.SIGNAL_WEIGHTS[signal];
+            const newReputation = Math.max(this.MIN_REPUTATION, Math.min(this.MAX_REPUTATION, reputation.reputation + signalWeight));
+            // Determine new status based on reputation
+            let newStatus = reputation.status;
+            if (signal === "admin_block" || signal === "auto_block") {
+                newStatus = "blocked";
+            }
+            else if (signal === "admin_allow") {
+                newStatus = "safe";
+            }
+            else {
+                // Auto-determine status based on reputation score
+                if (newReputation >= this.SAFE_THRESHOLD) {
+                    newStatus = "safe";
+                }
+                else if (newReputation <= this.BLOCKED_THRESHOLD) {
+                    newStatus = "blocked";
+                }
+                else if (newReputation < this.WARNING_THRESHOLD) {
+                    newStatus = "warning";
+                }
+                else {
+                    newStatus = "unknown";
+                }
+            }
+            // Update reputation
+            await db.domainReputation.update({
+                where: { domain: normalizedDomain },
+                data: {
+                    reputation: newReputation,
+                    status: newStatus,
+                    lastChecked: new Date(),
+                    updatedAt: new Date(),
+                },
+            });
+            this.logger.debug(`[DomainReputationService] Updated reputation for ${normalizedDomain}: ${reputation.reputation} -> ${newReputation} (${signal})`);
+        }
+        catch (error) {
+            this.logger.error(`[DomainReputationService] Error updating reputation for ${normalizedDomain}:`, error);
+            throw error;
+        }
+    }
+    /**
+     * Block a domain (admin action)
+     *
+     * @param domain - Domain name
+     * @param region - Region code
+     * @param env - Environment variables
+     */
+    async blockDomain(domain, region, env) {
+        await this.updateReputation(domain, "admin_block", region, env);
+        this.logger.info(`[DomainReputationService] Domain blocked: ${domain}`);
+    }
+    /**
+     * Unblock a domain (admin action)
+     *
+     * @param domain - Domain name
+     * @param region - Region code
+     * @param env - Environment variables
+     */
+    async unblockDomain(domain, region, env) {
+        const normalizedDomain = this.normalizeDomain(domain);
+        const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+        try {
+            // Reset reputation to neutral and set status to unknown
+            await db.domainReputation.update({
+                where: { domain: normalizedDomain },
+                data: {
+                    reputation: this.DEFAULT_REPUTATION,
+                    status: "unknown",
+                    lastChecked: new Date(),
+                    updatedAt: new Date(),
+                },
+            });
+            this.logger.info(`[DomainReputationService] Domain unblocked: ${domain}`);
+        }
+        catch (error) {
+            this.logger.error(`[DomainReputationService] Error unblocking domain ${normalizedDomain}:`, error);
+            throw error;
+        }
+    }
+    /**
+     * Add domain to allowlist (admin action)
+     *
+     * @param domain - Domain name
+     * @param region - Region code
+     * @param env - Environment variables
+     */
+    async addToAllowlist(domain, region, env) {
+        await this.updateReputation(domain, "admin_allow", region, env);
+        this.logger.info(`[DomainReputationService] Domain added to allowlist: ${domain}`);
+    }
+    /**
+     * Check if domain should be auto-blocked based on report count
+     *
+     * @param domain - Domain name
+     * @param region - Region code
+     * @param env - Environment variables
+     * @returns True if domain should be auto-blocked
+     */
+    async shouldAutoBlock(domain, region, env) {
+        const normalizedDomain = this.normalizeDomain(domain);
+        const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+        try {
+            // Count pending/reviewed reports for this domain
+            const reportCount = await db.linkReport.count({
+                where: {
+                    domain: normalizedDomain,
+                    status: {
+                        in: ["pending", "reviewed"],
+                    },
+                },
+            });
+            // Check if threshold exceeded
+            if (reportCount >= this.AUTO_BLOCK_REPORT_THRESHOLD) {
+                // Check current status - don't auto-block if already blocked
+                const reputation = await db.domainReputation.findUnique({
+                    where: { domain: normalizedDomain },
+                });
+                if (reputation && reputation.status !== "blocked") {
+                    return true;
+                }
+            }
+            return false;
+        }
+        catch (error) {
+            this.logger.error(`[DomainReputationService] Error checking auto-block for ${normalizedDomain}:`, error);
+            return false;
+        }
+    }
+    /**
+     * Apply reputation decay over time
+     * (Called periodically by a background job)
+     *
+     * @param region - Region code
+     * @param env - Environment variables
+     * @param decayRate - Reputation points to decay per day (default: 1)
+     */
+    async applyReputationDecay(region, env, decayRate = 1) {
+        const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+        try {
+            // Get all domains that haven't been checked recently (30+ days)
+            const thirtyDaysAgo = new Date();
+            thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+            const staleDomains = await db.domainReputation.findMany({
+                where: {
+                    lastChecked: {
+                        lt: thirtyDaysAgo,
+                    },
+                    // Only decay domains that aren't explicitly blocked or allowlisted
+                    status: {
+                        not: "blocked",
+                    },
+                },
+            });
+            for (const domain of staleDomains) {
+                // Decay reputation towards neutral (0)
+                const daysSinceCheck = Math.floor((Date.now() - domain.lastChecked.getTime()) / (1000 * 60 * 60 * 24));
+                const decayAmount = daysSinceCheck * decayRate;
+                let newReputation = domain.reputation;
+                if (domain.reputation > 0) {
+                    // Decay positive reputation
+                    newReputation = Math.max(0, domain.reputation - decayAmount);
+                }
+                else if (domain.reputation < 0) {
+                    // Decay negative reputation (move towards 0)
+                    newReputation = Math.min(0, domain.reputation + decayAmount);
+                }
+                // Update status based on new reputation
+                let newStatus = domain.status;
+                if (newReputation >= this.SAFE_THRESHOLD) {
+                    newStatus = "safe";
+                }
+                else if (newReputation <= this.BLOCKED_THRESHOLD) {
+                    newStatus = "blocked";
+                }
+                else if (newReputation < this.WARNING_THRESHOLD) {
+                    newStatus = "warning";
+                }
+                else {
+                    newStatus = "unknown";
+                }
+                await db.domainReputation.update({
+                    where: { id: domain.id },
+                    data: {
+                        reputation: newReputation,
+                        status: newStatus,
+                        updatedAt: new Date(),
+                    },
+                });
+            }
+            this.logger.debug(`[DomainReputationService] Applied reputation decay to ${staleDomains.length} domains`);
+        }
+        catch (error) {
+            this.logger.error("[DomainReputationService] Error applying reputation decay:", error);
+            throw error;
+        }
+    }
+    /**
+     * Normalize domain name (lowercase, remove www, etc.)
+     *
+     * @param domain - Domain name
+     * @returns Normalized domain
+     */
+    normalizeDomain(domain) {
+        let normalized = domain.toLowerCase().trim();
+        // Remove protocol if present (do this first)
+        normalized = normalized.replace(/^https?:\/\//, "");
+        // Remove www. prefix
+        if (normalized.startsWith("www.")) {
+            normalized = normalized.substring(4);
+        }
+        // Remove trailing slash
+        normalized = normalized.replace(/\/$/, "");
+        // Remove path, query, fragment
+        const urlParts = normalized.split("/");
+        normalized = urlParts[0];
+        return normalized;
+    }
+}
+exports.DomainReputationService = DomainReputationService;
+//# sourceMappingURL=domain-reputation-service.js.map

package/dist/lib/domain-reputation-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-reputation-service.js","sourceRoot":"","sources":["../../src/lib/domain-reputation-service.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,+CAA+D;AAC/D,qCAAkC;AAsClC;;GAEG;AACH,MAAa,uBAAuB;IAC1B,MAAM,CAAS;IAEvB,+BAA+B;IACd,cAAc,GAAG,GAAG,CAAC;IACrB,cAAc,GAAG,CAAC,GAAG,CAAC;IACtB,kBAAkB,GAAG,CAAC,CAAC;IAExC,oBAAoB;IACH,cAAc,GAAG,EAAE,CAAC,CAAC,0BAA0B;IAC/C,iBAAiB,GAAG,CAAC,EAAE,CAAC,CAAC,6BAA6B;IACtD,iBAAiB,GAAG,CAAC,EAAE,CAAC,CAAC,6BAA6B;IAEvE,4CAA4C;IAC3B,cAAc,GAAqC;QAClE,qBAAqB,EAAE,CAAC,EAAE;QAC1B,qBAAqB,EAAE,CAAC,EAAE;QAC1B,WAAW,EAAE,CAAC,EAAE;QAChB,UAAU,EAAE,CAAC,CAAC;QACd,UAAU,EAAE,CAAC,CAAC;QACd,WAAW,EAAE,CAAC,GAAG,EAAE,kBAAkB;QACrC,WAAW,EAAE,CAAC,EAAE,EAAE,uBAAuB;QACzC,UAAU,EAAE,CAAC,EAAE;QACf,YAAY,EAAE,CAAC,EAAE;KAClB,CAAC;IAEF,gEAAgE;IAC/C,2BAA2B,GAAG,CAAC,CAAC;IAEjD,YAAY,GAAS;QACnB,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,MAAc,EACd,GAAQ;QAER,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,wBAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAExD,IAAI,CAAC;YACH,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC;gBACpD,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE;aACpC,CAAC,CAAC;YAEH,0DAA0D;YAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,UAAU,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;oBAC5C,IAAI,EAAE;wBACJ,MAAM,EAAE,gBAAgB;wBACxB,UAAU,EAAE,IAAI,CAAC,kBAAkB;wBACnC,MAAM,EAAE,SAAS;wBACjB,WAAW,EAAE,IAAI,IAAI,EAAE;qBACxB;iBACF,CAAC,CAAC;YACL,CAAC;YAED,+DAA+D;YAC/D,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC;YACtD,MAAM,aAAa,GACjB,UAAU,CAAC,MAAM,KAAK,MAAM;gBAC5B,UAAU,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,CAAC;YAE/C,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,MAAM,EAAE,UAAU,CAAC,MAAsB;gBACzC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,aAAa;gBACb,aAAa;aACd,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0DAA0D,gBAAgB,GAAG,EAC7E,KAAK,CACN,CAAC;YACF,qCAAqC;YACrC,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,UAAU,EAAE,IAAI,CAAC,kBAAkB;gBACnC,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,IAAI,IAAI,EAAE;gBACvB,aAAa,EAAE,KAAK;gBACpB,aAAa,EAAE,KAAK;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,gBAAgB,CACpB,MAAc,EACd,MAAwB,EACxB,MAAc,EACd,GAAQ,EACR,QAAkC;QAElC,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,wBAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAExD,IAAI,CAAC;YACH,yBAAyB;YACzB,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC;gBACpD,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE;aACpC,CAAC,CAAC;YAEH,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,+BAA+B;gBAC/B,UAAU,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;oBAC5C,IAAI,EAAE;wBACJ,MAAM,EAAE,gBAAgB;wBACxB,UAAU,EAAE,IAAI,CAAC,kBAAkB;wBACnC,MAAM,EAAE,SAAS;wBACjB,WAAW,EAAE,IAAI,IAAI,EAAE;qBACxB;iBACF,CAAC,CAAC;YACL,CAAC;YAED,8BAA8B;YAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,UAAU,GAAG,YAAY,CAAC,CACpE,CAAC;YAEF,2CAA2C;YAC3C,IAAI,SAAS,GAAiB,UAAU,CAAC,MAAsB,CAAC;YAChE,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBACxD,SAAS,GAAG,SAAS,CAAC;YACxB,CAAC;iBAAM,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;gBACpC,SAAS,GAAG,MAAM,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,kDAAkD;gBAClD,IAAI,aAAa,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBACzC,SAAS,GAAG,MAAM,CAAC;gBACrB,CAAC;qBAAM,IAAI,aAAa,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACnD,SAAS,GAAG,SAAS,CAAC;gBACxB,CAAC;qBAAM,IAAI,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAClD,SAAS,GAAG,SAAS,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,SAAS,GAAG,SAAS,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,oBAAoB;YACpB,MAAM,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAC/B,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE;gBACnC,IAAI,EAAE;oBACJ,UAAU,EAAE,aAAa;oBACzB,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,IAAI,IAAI,EAAE;oBACvB,SAAS,EAAE,IAAI,IAAI,EAAE;iBACtB;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,oDAAoD,gBAAgB,KAAK,UAAU,CAAC,UAAU,OAAO,aAAa,KAAK,MAAM,GAAG,CACjI,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,2DAA2D,gBAAgB,GAAG,EAC9E,KAAK,CACN,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,MAAc,EAAE,GAAQ;QACxD,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,MAAc,EAAE,GAAQ;QAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,wBAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAExD,IAAI,CAAC;YACH,wDAAwD;YACxD,MAAM,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAC/B,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE;gBACnC,IAAI,EAAE;oBACJ,UAAU,EAAE,IAAI,CAAC,kBAAkB;oBACnC,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,IAAI,IAAI,EAAE;oBACvB,SAAS,EAAE,IAAI,IAAI,EAAE;iBACtB;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qDAAqD,gBAAgB,GAAG,EACxE,KAAK,CACN,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,MAAc,EACd,GAAQ;QAER,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,MAAM,EAAE,CACjE,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,MAAc,EACd,GAAQ;QAER,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,wBAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAExD,IAAI,CAAC;YACH,iDAAiD;YACjD,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;gBAC5C,KAAK,EAAE;oBACL,MAAM,EAAE,gBAAgB;oBACxB,MAAM,EAAE;wBACN,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;qBAC5B;iBACF;aACF,CAAC,CAAC;YAEH,8BAA8B;YAC9B,IAAI,WAAW,IAAI,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACpD,6DAA6D;gBAC7D,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC;oBACtD,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE;iBACpC,CAAC,CAAC;gBAEH,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAClD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,2DAA2D,gBAAgB,GAAG,EAC9E,KAAK,CACN,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,GAAQ,EACR,YAAoB,CAAC;QAErB,MAAM,EAAE,GAAG,wBAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAExD,IAAI,CAAC;YACH,gEAAgE;YAChE,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC;YACjC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAEpD,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC;gBACtD,KAAK,EAAE;oBACL,WAAW,EAAE;wBACX,EAAE,EAAE,aAAa;qBAClB;oBACD,mEAAmE;oBACnE,MAAM,EAAE;wBACN,GAAG,EAAE,SAAS;qBACf;iBACF;aACF,CAAC,CAAC;YAEH,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;gBAClC,uCAAuC;gBACvC,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAC/B,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CACpE,CAAC;gBACF,MAAM,WAAW,GAAG,cAAc,GAAG,SAAS,CAAC;gBAE/C,IAAI,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC;gBACtC,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;oBAC1B,4BAA4B;oBAC5B,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,CAAC;gBAC/D,CAAC;qBAAM,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;oBACjC,6CAA6C;oBAC7C,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,CAAC;gBAC/D,CAAC;gBAED,wCAAwC;gBACxC,IAAI,SAAS,GAAiB,MAAM,CAAC,MAAsB,CAAC;gBAC5D,IAAI,aAAa,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBACzC,SAAS,GAAG,MAAM,CAAC;gBACrB,CAAC;qBAAM,IAAI,aAAa,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACnD,SAAS,GAAG,SAAS,CAAC;gBACxB,CAAC;qBAAM,IAAI,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAClD,SAAS,GAAG,SAAS,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,SAAS,GAAG,SAAS,CAAC;gBACxB,CAAC;gBAED,MAAM,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;oBAC/B,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;oBACxB,IAAI,EAAE;wBACJ,UAAU,EAAE,aAAa;wBACzB,MAAM,EAAE,SAAS;wBACjB,SAAS,EAAE,IAAI,IAAI,EAAE;qBACtB;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yDAAyD,YAAY,CAAC,MAAM,UAAU,CACvF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,4DAA4D,EAC5D,KAAK,CACN,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,MAAc;QACpC,IAAI,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAE7C,6CAA6C;QAC7C,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAEpD,qBAAqB;QACrB,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;QAED,wBAAwB;QACxB,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAE3C,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAEzB,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AAnZD,0DAmZC"}

package/dist/lib/email-privacy.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Email Privacy Utilities
+ *
+ * PREPARATORY: Border Safety Mode - Email hashing for privacy
+ *
+ * Provides utilities for hashing emails to support zero-knowledge architecture.
+ * Email hashes allow lookups without exposing plaintext emails to the server.
+ *
+ * FUTURE USE: When zero-knowledge architecture is implemented, email hashes will:
+ * - Enable email lookups without server seeing plaintext
+ * - Support account recovery without exposing email
+ * - Enable anonymous account linking
+ *
+ * @see doc/01-business/features/b2c-features/border-safety-mode/preparatory-design-changes/07-privacy.md
+ */
+/**
+ * Hash an email address using SHA-256
+ *
+ * PREPARATORY: Creates a consistent hash of an email address for privacy-preserving lookups.
+ * The email is normalized (lowercased and trimmed) before hashing to ensure consistent results.
+ *
+ * Uses the shared cryptographic library (@de-otio/trellis (inlined crypto)) for consistent hashing.
+ *
+ * FUTURE USE: When zero-knowledge architecture is implemented, this hash will be used for:
+ * - Email lookups without exposing plaintext
+ * - Account recovery workflows
+ * - Anonymous account linking
+ *
+ * NOTE: This function uses plain SHA-256. For enhanced security with pepper,
+ * consider using EncryptionService.hashEmail(email, pepper) instead.
+ *
+ * @param email - Email address to hash
+ * @returns SHA-256 hash of the normalized email as a hex string
+ * @throws Error if email is empty or invalid after normalization
+ *
+ * @example
+ * ```typescript
+ * const hash = hashEmail('  User@Example.com  ');
+ * // Returns: hash of 'user@example.com'
+ * ```
+ */
+export declare function hashEmail(email: string): Promise<string>;
+/**
+ * Synchronous version of hashEmail (for compatibility)
+ *
+ * Note: This uses the async Web Crypto API but provides a synchronous interface
+ * by returning a Promise. Use hashEmail() directly for better clarity.
+ *
+ * @deprecated Use hashEmail() instead
+ * @param email - Email address to hash
+ * @returns Promise that resolves to SHA-256 hash as hex string
+ */
+export declare function hashEmailSync(email: string): Promise<string>;
+//# sourceMappingURL=email-privacy.d.ts.map

package/dist/lib/email-privacy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-privacy.d.ts","sourceRoot":"","sources":["../../src/lib/email-privacy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAc9D;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAElE"}

package/dist/lib/email-privacy.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * Email Privacy Utilities
+ *
+ * PREPARATORY: Border Safety Mode - Email hashing for privacy
+ *
+ * Provides utilities for hashing emails to support zero-knowledge architecture.
+ * Email hashes allow lookups without exposing plaintext emails to the server.
+ *
+ * FUTURE USE: When zero-knowledge architecture is implemented, email hashes will:
+ * - Enable email lookups without server seeing plaintext
+ * - Support account recovery without exposing email
+ * - Enable anonymous account linking
+ *
+ * @see doc/01-business/features/b2c-features/border-safety-mode/preparatory-design-changes/07-privacy.md
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashEmail = hashEmail;
+exports.hashEmailSync = hashEmailSync;
+const index_js_1 = require("./crypto/index.js");
+/**
+ * Hash an email address using SHA-256
+ *
+ * PREPARATORY: Creates a consistent hash of an email address for privacy-preserving lookups.
+ * The email is normalized (lowercased and trimmed) before hashing to ensure consistent results.
+ *
+ * Uses the shared cryptographic library (@de-otio/trellis (inlined crypto)) for consistent hashing.
+ *
+ * FUTURE USE: When zero-knowledge architecture is implemented, this hash will be used for:
+ * - Email lookups without exposing plaintext
+ * - Account recovery workflows
+ * - Anonymous account linking
+ *
+ * NOTE: This function uses plain SHA-256. For enhanced security with pepper,
+ * consider using EncryptionService.hashEmail(email, pepper) instead.
+ *
+ * @param email - Email address to hash
+ * @returns SHA-256 hash of the normalized email as a hex string
+ * @throws Error if email is empty or invalid after normalization
+ *
+ * @example
+ * ```typescript
+ * const hash = hashEmail('  User@Example.com  ');
+ * // Returns: hash of 'user@example.com'
+ * ```
+ */
+async function hashEmail(email) {
+    if (!email || typeof email !== "string") {
+        throw new Error("Email must be a non-empty string");
+    }
+    // Normalize email: lowercase and trim whitespace
+    const normalizedEmail = email.toLowerCase().trim();
+    if (normalizedEmail.length === 0) {
+        throw new Error("Email cannot be empty after normalization");
+    }
+    // Use shared cryptographic library for consistent hashing
+    return await index_js_1.EncryptionService.hash(normalizedEmail);
+}
+/**
+ * Synchronous version of hashEmail (for compatibility)
+ *
+ * Note: This uses the async Web Crypto API but provides a synchronous interface
+ * by returning a Promise. Use hashEmail() directly for better clarity.
+ *
+ * @deprecated Use hashEmail() instead
+ * @param email - Email address to hash
+ * @returns Promise that resolves to SHA-256 hash as hex string
+ */
+async function hashEmailSync(email) {
+    return hashEmail(email);
+}
+//# sourceMappingURL=email-privacy.js.map

package/dist/lib/email-privacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-privacy.js","sourceRoot":"","sources":["../../src/lib/email-privacy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AA8BH,8BAcC;AAYD,sCAEC;AAxDD,gDAAsD;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACI,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,iDAAiD;IACjD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEnD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,0DAA0D;IAC1D,OAAO,MAAM,4BAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC"}