@de-otio/trellis 0.4.0

package/dist/lib/rate-limit.d.ts

@@ -0,0 +1,95 @@
+import type { KVNamespace } from "../types/cloudflare-compat";
+/**
+ * Rate Limiting
+ *
+ * Simple in-memory rate limiting using request identifiers.
+ *
+ * ⚠️ SECURITY NOTE: This in-memory implementation has limitations:
+ * - Resets on worker restart (can be bypassed)
+ * - Not shared across worker instances (DDoS vulnerability)
+ * - Memory leak potential with no cleanup
+ *
+ * For production, migrate to:
+ * - Cloudflare KV (recommended for distributed rate limiting)
+ * - Durable Objects (for strict per-key rate limiting)
+ */
+import { type LoggerEnv } from "./logger";
+interface RateLimitEnv {
+    RATE_LIMIT_KV?: KVNamespace;
+}
+/**
+ * Rate Limiter class for managing rate limiting
+ */
+export declare class RateLimiter {
+    private rateLimitStore;
+    /**
+     * Get identifier for rate limiting
+     *
+     * PREPARATORY CHANGE: Enhanced to prefer user ID over IP address for better privacy.
+     * This makes future privacy-preserving rate limiting easier to implement.
+     *
+     * Priority order (most privacy-preserving first):
+     * 1. User ID (if provided) - FUTURE USE: Most privacy-preserving for authenticated users
+     * 2. Session ID (if authenticated)
+     * 3. Email (for email-based endpoints like magic links)
+     * 4. IP address (fallback for unauthenticated requests)
+     */
+    private getRateLimitKey;
+    /**
+     * Check rate limit (in-memory)
+     *
+     * PREPARATORY CHANGE: Added userId parameter for future privacy-preserving rate limiting.
+     *
+     * @param request Request object
+     * @param endpoint Endpoint identifier (e.g., '/auth/authorize')
+     * @param limit Maximum requests allowed
+     * @param windowSeconds Time window in seconds
+     * @param sessionId Optional session ID for authenticated users
+     * @param email Optional email for email-based endpoints
+     * @param userId Optional user ID (PREPARATORY: for future privacy-preserving rate limiting)
+     * @returns Rate limit result
+     */
+    checkRateLimit(request: Request, endpoint: string, limit: number, windowSeconds: number, sessionId?: string, email?: string, userId?: string): {
+        allowed: boolean;
+        remaining: number;
+        resetAt: number;
+    };
+    /**
+     * Apply rate limiting to a response (in-memory)
+     * Returns 429 if rate limit exceeded
+     *
+     * PREPARATORY CHANGE: Added userId parameter for future privacy-preserving rate limiting.
+     */
+    applyRateLimit(request: Request, endpoint: string, limit: number, windowSeconds: number, sessionId?: string, email?: string, userId?: string): Response | null;
+    /**
+     * Check rate limit using Cloudflare KV (production-ready)
+     * Falls back to in-memory implementation if KV not available (dev mode)
+     *
+     * PREPARATORY CHANGE: Added userId parameter for future privacy-preserving rate limiting.
+     *
+     * @param env Environment with optional RATE_LIMIT_KV binding
+     * @param request Request object
+     * @param endpoint Endpoint identifier (e.g., '/auth/authorize')
+     * @param limit Maximum requests allowed
+     * @param windowSeconds Time window in seconds
+     * @param sessionId Optional session ID for authenticated users
+     * @param email Optional email for email-based endpoints
+     * @param userId Optional user ID (PREPARATORY: for future privacy-preserving rate limiting)
+     * @returns Rate limit result
+     */
+    checkRateLimitKV(env: RateLimitEnv, request: Request, endpoint: string, limit: number, windowSeconds: number, sessionId?: string, email?: string, userId?: string): Promise<{
+        allowed: boolean;
+        remaining: number;
+        resetAt: number;
+    }>;
+    /**
+     * Apply rate limiting with KV support (production-ready)
+     * Returns 429 if rate limit exceeded
+     * Falls back to in-memory if KV unavailable
+     *
+     * PREPARATORY CHANGE: Added userId parameter for future privacy-preserving rate limiting.
+     */
+    applyRateLimitKV(env: RateLimitEnv & LoggerEnv, request: Request, endpoint: string, limit: number, windowSeconds: number, sessionId?: string, email?: string, userId?: string): Promise<Response | null>;
+}
+export {};
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/lib/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/lib/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,4BAA4B,CAAC;AACzF;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AASlD,UAAU,YAAY;IACpB,aAAa,CAAC,EAAE,WAAW,CAAC;CAC7B;AAED;;GAEG;AACH,qBAAa,WAAW;IAGtB,OAAO,CAAC,cAAc,CAAsB;IAE5C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,eAAe;IAqCvB;;;;;;;;;;;;;OAaG;IACH,cAAc,CACZ,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAoD3D;;;;;OAKG;IACH,cAAc,CACZ,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,QAAQ,GAAG,IAAI;IAmClB;;;;;;;;;;;;;;;OAeG;IACG,gBAAgB,CACpB,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAyFpE;;;;;;OAMG;IACG,gBAAgB,CACpB,GAAG,EAAE,YAAY,GAAG,SAAS,EAC7B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;CAmD5B"}

package/dist/lib/rate-limit.js

@@ -0,0 +1,247 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RateLimiter = void 0;
+/**
+ * Rate Limiting
+ *
+ * Simple in-memory rate limiting using request identifiers.
+ *
+ * ⚠️ SECURITY NOTE: This in-memory implementation has limitations:
+ * - Resets on worker restart (can be bypassed)
+ * - Not shared across worker instances (DDoS vulnerability)
+ * - Memory leak potential with no cleanup
+ *
+ * For production, migrate to:
+ * - Cloudflare KV (recommended for distributed rate limiting)
+ * - Durable Objects (for strict per-key rate limiting)
+ */
+const logger_1 = require("./logger");
+/**
+ * Rate Limiter class for managing rate limiting
+ */
+class RateLimiter {
+    // In-memory store (resets on worker restart)
+    // TODO: Migrate to Cloudflare KV for production
+    rateLimitStore = {};
+    /**
+     * Get identifier for rate limiting
+     *
+     * PREPARATORY CHANGE: Enhanced to prefer user ID over IP address for better privacy.
+     * This makes future privacy-preserving rate limiting easier to implement.
+     *
+     * Priority order (most privacy-preserving first):
+     * 1. User ID (if provided) - FUTURE USE: Most privacy-preserving for authenticated users
+     * 2. Session ID (if authenticated)
+     * 3. Email (for email-based endpoints like magic links)
+     * 4. IP address (fallback for unauthenticated requests)
+     */
+    getRateLimitKey(request, endpoint, sessionId, email, userId) {
+        // FUTURE USE: Prefer user ID (most privacy-preserving for authenticated users)
+        // This avoids storing IP addresses for rate limiting when user is authenticated
+        if (userId) {
+            return `ratelimit:${endpoint}:user:${userId}`;
+        }
+        // Use session ID if authenticated
+        if (sessionId) {
+            return `ratelimit:${endpoint}:session:${sessionId}`;
+        }
+        // For email-based endpoints (like magic link), use email if provided
+        if (email) {
+            // Normalize email (lowercase) for consistent rate limiting
+            return `ratelimit:${endpoint}:email:${email.toLowerCase()}`;
+        }
+        // For unauthenticated requests, use IP (least privacy-preserving)
+        // FUTURE USE: When IP scrubbing is enabled, this will use scrubbed IPs
+        // In Cloudflare Workers, use CF-Connecting-IP header
+        const cfIp = request.headers.get("CF-Connecting-IP");
+        const forwardedFor = request.headers.get("X-Forwarded-For");
+        const ip = cfIp ||
+            (forwardedFor ? forwardedFor.split(",")[0]?.trim() : null) ||
+            "unknown";
+        return `ratelimit:${endpoint}:ip:${ip}`;
+    }
+    /**
+     * Check rate limit (in-memory)
+     *
+     * PREPARATORY CHANGE: Added userId parameter for future privacy-preserving rate limiting.
+     *
+     * @param request Request object
+     * @param endpoint Endpoint identifier (e.g., '/auth/authorize')
+     * @param limit Maximum requests allowed
+     * @param windowSeconds Time window in seconds
+     * @param sessionId Optional session ID for authenticated users
+     * @param email Optional email for email-based endpoints
+     * @param userId Optional user ID (PREPARATORY: for future privacy-preserving rate limiting)
+     * @returns Rate limit result
+     */
+    checkRateLimit(request, endpoint, limit, windowSeconds, sessionId, email, userId) {
+        const key = this.getRateLimitKey(request, endpoint, sessionId, email, userId);
+        const now = Date.now();
+        const resetAt = now + windowSeconds * 1000;
+        const entry = this.rateLimitStore[key];
+        // Clean up expired entries
+        if (entry && entry.resetAt < now) {
+            delete this.rateLimitStore[key];
+        }
+        const current = this.rateLimitStore[key];
+        if (!current) {
+            // First request
+            this.rateLimitStore[key] = {
+                count: 1,
+                resetAt,
+            };
+            return {
+                allowed: true,
+                remaining: limit - 1,
+                resetAt,
+            };
+        }
+        if (current.count >= limit) {
+            // Rate limit exceeded
+            return {
+                allowed: false,
+                remaining: 0,
+                resetAt: current.resetAt,
+            };
+        }
+        // Increment count
+        current.count++;
+        return {
+            allowed: true,
+            remaining: limit - current.count,
+            resetAt: current.resetAt,
+        };
+    }
+    /**
+     * Apply rate limiting to a response (in-memory)
+     * Returns 429 if rate limit exceeded
+     *
+     * PREPARATORY CHANGE: Added userId parameter for future privacy-preserving rate limiting.
+     */
+    applyRateLimit(request, endpoint, limit, windowSeconds, sessionId, email, userId) {
+        const result = this.checkRateLimit(request, endpoint, limit, windowSeconds, sessionId, email, userId);
+        if (!result.allowed) {
+            const retryAfter = Math.ceil((result.resetAt - Date.now()) / 1000);
+            return new Response(JSON.stringify({
+                error: "Rate limit exceeded",
+                retryAfter,
+            }), {
+                status: 429,
+                headers: {
+                    "content-type": "application/json",
+                    "Retry-After": retryAfter.toString(),
+                    "X-RateLimit-Limit": limit.toString(),
+                    "X-RateLimit-Remaining": "0",
+                    "X-RateLimit-Reset": new Date(result.resetAt).toISOString(),
+                },
+            });
+        }
+        return null;
+    }
+    /**
+     * Check rate limit using Cloudflare KV (production-ready)
+     * Falls back to in-memory implementation if KV not available (dev mode)
+     *
+     * PREPARATORY CHANGE: Added userId parameter for future privacy-preserving rate limiting.
+     *
+     * @param env Environment with optional RATE_LIMIT_KV binding
+     * @param request Request object
+     * @param endpoint Endpoint identifier (e.g., '/auth/authorize')
+     * @param limit Maximum requests allowed
+     * @param windowSeconds Time window in seconds
+     * @param sessionId Optional session ID for authenticated users
+     * @param email Optional email for email-based endpoints
+     * @param userId Optional user ID (PREPARATORY: for future privacy-preserving rate limiting)
+     * @returns Rate limit result
+     */
+    async checkRateLimitKV(env, request, endpoint, limit, windowSeconds, sessionId, email, userId) {
+        // If KV not available, fall back to in-memory (dev mode or KV not configured)
+        if (!env.RATE_LIMIT_KV) {
+            return this.checkRateLimit(request, endpoint, limit, windowSeconds, sessionId, email, userId);
+        }
+        const key = this.getRateLimitKey(request, endpoint, sessionId, email, userId);
+        const now = Date.now();
+        const resetAt = now + windowSeconds * 1000;
+        try {
+            // Try to get current count from KV
+            const existing = (await env.RATE_LIMIT_KV.get(key, "json"));
+            if (!existing || existing.resetAt < now) {
+                // First request or window expired - start new window
+                const newEntry = { count: 1, resetAt };
+                // KV requires minimum 60 seconds TTL
+                await env.RATE_LIMIT_KV.put(key, JSON.stringify(newEntry), { expirationTtl: Math.max(60, windowSeconds) });
+                return {
+                    allowed: true,
+                    remaining: limit - 1,
+                    resetAt,
+                };
+            }
+            if (existing.count >= limit) {
+                // Rate limit exceeded
+                return {
+                    allowed: false,
+                    remaining: 0,
+                    resetAt: existing.resetAt,
+                };
+            }
+            // Increment count
+            existing.count++;
+            const ttlRemaining = Math.ceil((existing.resetAt - now) / 1000);
+            // KV requires minimum 60 seconds TTL
+            await env.RATE_LIMIT_KV.put(key, JSON.stringify(existing), { expirationTtl: Math.max(60, ttlRemaining) });
+            return {
+                allowed: true,
+                remaining: limit - existing.count,
+                resetAt: existing.resetAt,
+            };
+        }
+        catch (error) {
+            // If KV operation fails, fall back to in-memory (graceful degradation)
+            logger_1.Logger.getInstance(env).error("KV rate limit check failed, falling back to in-memory:", error);
+            return this.checkRateLimit(request, endpoint, limit, windowSeconds, sessionId, email, userId);
+        }
+    }
+    /**
+     * Apply rate limiting with KV support (production-ready)
+     * Returns 429 if rate limit exceeded
+     * Falls back to in-memory if KV unavailable
+     *
+     * PREPARATORY CHANGE: Added userId parameter for future privacy-preserving rate limiting.
+     */
+    async applyRateLimitKV(env, request, endpoint, limit, windowSeconds, sessionId, email, userId) {
+        const result = await this.checkRateLimitKV(env, request, endpoint, limit, windowSeconds, sessionId, email, userId);
+        if (!result.allowed) {
+            const retryAfter = Math.ceil((result.resetAt - Date.now()) / 1000);
+            // Log rate limit violation for telemetry/monitoring
+            const logger = logger_1.Logger.getInstance(env);
+            logger.warn("[RateLimit] Rate limit exceeded", {
+                endpoint,
+                limit,
+                windowSeconds,
+                userId,
+                sessionId,
+                email,
+                retryAfter,
+                ipAddress: request.headers.get("CF-Connecting-IP") ||
+                    request.headers.get("X-Forwarded-For")?.split(",")[0]?.trim() ||
+                    "unknown",
+            });
+            return new Response(JSON.stringify({
+                error: "Rate limit exceeded",
+                retryAfter,
+            }), {
+                status: 429,
+                headers: {
+                    "content-type": "application/json",
+                    "Retry-After": retryAfter.toString(),
+                    "X-RateLimit-Limit": limit.toString(),
+                    "X-RateLimit-Remaining": "0",
+                    "X-RateLimit-Reset": new Date(result.resetAt).toISOString(),
+                },
+            });
+        }
+        return null;
+    }
+}
+exports.RateLimiter = RateLimiter;
+//# sourceMappingURL=rate-limit.js.map

package/dist/lib/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/lib/rate-limit.ts"],"names":[],"mappings":";;;AACA;;;;;;;;;;;;;GAaG;AAGH,qCAAkD;AAalD;;GAEG;AACH,MAAa,WAAW;IACtB,6CAA6C;IAC7C,gDAAgD;IACxC,cAAc,GAAmB,EAAE,CAAC;IAE5C;;;;;;;;;;;OAWG;IACK,eAAe,CACrB,OAAgB,EAChB,QAAgB,EAChB,SAAkB,EAClB,KAAc,EACd,MAAe;QAEf,+EAA+E;QAC/E,gFAAgF;QAChF,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,aAAa,QAAQ,SAAS,MAAM,EAAE,CAAC;QAChD,CAAC;QAED,kCAAkC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,aAAa,QAAQ,YAAY,SAAS,EAAE,CAAC;QACtD,CAAC;QAED,qEAAqE;QACrE,IAAI,KAAK,EAAE,CAAC;YACV,2DAA2D;YAC3D,OAAO,aAAa,QAAQ,UAAU,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9D,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,qDAAqD;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC5D,MAAM,EAAE,GACN,IAAI;YACJ,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,SAAS,CAAC;QAEZ,OAAO,aAAa,QAAQ,OAAO,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,cAAc,CACZ,OAAgB,EAChB,QAAgB,EAChB,KAAa,EACb,aAAqB,EACrB,SAAkB,EAClB,KAAc,EACd,MAAe;QAEf,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAC9B,OAAO,EACP,QAAQ,EACR,SAAS,EACT,KAAK,EACL,MAAM,CACP,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,GAAG,aAAa,GAAG,IAAI,CAAC;QAE3C,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAEvC,2BAA2B;QAC3B,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,gBAAgB;YAChB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG;gBACzB,KAAK,EAAE,CAAC;gBACR,OAAO;aACR,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,KAAK,GAAG,CAAC;gBACpB,OAAO;aACR,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC;YAC3B,sBAAsB;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC;QACJ,CAAC;QAED,kBAAkB;QAClB,OAAO,CAAC,KAAK,EAAE,CAAC;QAEhB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,cAAc,CACZ,OAAgB,EAChB,QAAgB,EAChB,KAAa,EACb,aAAqB,EACrB,SAAkB,EAClB,KAAc,EACd,MAAe;QAEf,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAChC,OAAO,EACP,QAAQ,EACR,KAAK,EACL,aAAa,EACb,SAAS,EACT,KAAK,EACL,MAAM,CACP,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAEnE,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,qBAAqB;gBAC5B,UAAU;aACX,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,CAAC,QAAQ,EAAE;oBACpC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE;oBACrC,uBAAuB,EAAE,GAAG;oBAC5B,mBAAmB,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;iBAC5D;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,gBAAgB,CACpB,GAAiB,EACjB,OAAgB,EAChB,QAAgB,EAChB,KAAa,EACb,aAAqB,EACrB,SAAkB,EAClB,KAAc,EACd,MAAe;QAEf,8EAA8E;QAC9E,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,cAAc,CACxB,OAAO,EACP,QAAQ,EACR,KAAK,EACL,aAAa,EACb,SAAS,EACT,KAAK,EACL,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAC9B,OAAO,EACP,QAAQ,EACR,SAAS,EACT,KAAK,EACL,MAAM,CACP,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,GAAG,aAAa,GAAG,IAAI,CAAC;QAE3C,IAAI,CAAC;YACH,mCAAmC;YACnC,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAGlD,CAAC;YAET,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;gBACxC,qDAAqD;gBACrD,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;gBACvC,qCAAqC;gBACrC,MAAM,GAAG,CAAC,aAAa,CAAC,GAAG,CACzB,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EACxB,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,CAC/C,CAAC;gBACF,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,KAAK,GAAG,CAAC;oBACpB,OAAO;iBACR,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC;gBAC5B,sBAAsB;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,CAAC;oBACZ,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC;YACJ,CAAC;YAED,kBAAkB;YAClB,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAChE,qCAAqC;YACrC,MAAM,GAAG,CAAC,aAAa,CAAC,GAAG,CACzB,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EACxB,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAC9C,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,KAAK,GAAG,QAAQ,CAAC,KAAK;gBACjC,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,wDAAwD,EACxD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC,cAAc,CACxB,OAAO,EACP,QAAQ,EACR,KAAK,EACL,aAAa,EACb,SAAS,EACT,KAAK,EACL,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CACpB,GAA6B,EAC7B,OAAgB,EAChB,QAAgB,EAChB,KAAa,EACb,aAAqB,EACrB,SAAkB,EAClB,KAAc,EACd,MAAe;QAEf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CACxC,GAAG,EACH,OAAO,EACP,QAAQ,EACR,KAAK,EACL,aAAa,EACb,SAAS,EACT,KAAK,EACL,MAAM,CACP,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAEnE,oDAAoD;YACpD,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAC7C,QAAQ;gBACR,KAAK;gBACL,aAAa;gBACb,MAAM;gBACN,SAAS;gBACT,KAAK;gBACL,UAAU;gBACV,SAAS,EACP,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;oBACvC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;oBAC7D,SAAS;aACZ,CAAC,CAAC;YAEH,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,qBAAqB;gBAC5B,UAAU;aACX,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,CAAC,QAAQ,EAAE;oBACpC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE;oBACrC,uBAAuB,EAAE,GAAG;oBAC5B,mBAAmB,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;iBAC5D;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAtWD,kCAsWC"}

package/dist/lib/reaction-handler.d.ts

@@ -0,0 +1,68 @@
+import type { KVNamespace } from "../types/cloudflare-compat";
+import type { Session } from "./session-manager";
+import type { RequestContext } from "./request-context";
+export interface Env {
+    DATABASE_URL: string;
+    US_DATABASE_URL?: string;
+    EU_DATABASE_URL?: string;
+    CN_DATABASE_URL?: string;
+    FEED_CACHE_KV?: KVNamespace;
+    DEFAULT_REGION?: string;
+}
+export declare class ReactionHandler {
+    /**
+     * Add or update sentiment reaction on a post
+     *
+     * PREPARATORY: Uses DataRouter for region-aware operations.
+     */
+    addPostSentiment(postId: string, sentiment: string, session: Session, env: Env, requestContext: RequestContext): Promise<Response>;
+    /**
+     * Remove sentiment reaction from a post
+     *
+     * PREPARATORY: Uses DataRouter for region-aware operations.
+     */
+    removePostSentiment(postId: string, session: Session, env: Env, requestContext: RequestContext): Promise<Response>;
+    /**
+     * Get sentiment counts for a post
+     *
+     * PREPARATORY: Uses DataRouter for region-aware operations.
+     */
+    getPostSentiments(postId: string, session: Session | null, env: Env, requestContext: RequestContext): Promise<Response>;
+    /**
+     * Add or update sentiment reaction on a comment
+     *
+     * PREPARATORY: Uses DataRouter for region-aware operations.
+     */
+    addCommentSentiment(commentId: string, sentiment: string, session: Session, env: Env, requestContext: RequestContext): Promise<Response>;
+    /**
+     * Remove sentiment reaction from a comment
+     *
+     * PREPARATORY: Uses DataRouter for region-aware operations.
+     */
+    removeCommentSentiment(commentId: string, session: Session, env: Env, requestContext: RequestContext): Promise<Response>;
+    /**
+     * Get sentiment counts for a comment
+     *
+     * PREPARATORY: Uses DataRouter for region-aware operations.
+     */
+    getCommentSentiments(commentId: string, env: Env, requestContext: RequestContext): Promise<Response>;
+    /**
+     * Invalidate sentiment cache
+     */
+    private invalidateSentimentCache;
+    /**
+     * Invalidate comment sentiment cache
+     */
+    private invalidateCommentSentimentCache;
+    /**
+     * Get users who reacted to a post ("who reacted" feature)
+     *
+     * Two modes:
+     * 1. Summary mode (sentiment = null): Returns counts + top 3 users per sentiment
+     * 2. Detailed mode (sentiment provided): Returns paginated list of users for that sentiment
+     *
+     * Uses window functions for optimal performance (eliminates N+1 queries)
+     */
+    getPostSentimentUsers(postId: string, sentiment: string | null, limit: number, cursor: string | null, session: Session | null, env: Env, requestContext: RequestContext): Promise<Response>;
+}
+//# sourceMappingURL=reaction-handler.d.ts.map

package/dist/lib/reaction-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reaction-handler.d.ts","sourceRoot":"","sources":["../../src/lib/reaction-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,4BAA4B,CAAC;AAWzF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAKxD,MAAM,WAAW,GAAG;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAgBD,qBAAa,eAAe;IAG1B;;;;OAIG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IA0HpB;;;;OAIG;IACG,mBAAmB,CACvB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAuEpB;;;;OAIG;IACG,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GAAG,IAAI,EACvB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAoJpB;;;;OAIG;IACG,mBAAmB,CACvB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IA6GpB;;;;OAIG;IACG,sBAAsB,CAC1B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IA2FpB;;;;OAIG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAgIpB;;OAEG;YACW,wBAAwB;IAiBtC;;OAEG;YACW,+BAA+B;IAiB7C;;;;;;;;OAQG;IACG,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,EAAE,OAAO,GAAG,IAAI,EACvB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;CAgWrB"}