@de-otio/trellis 0.7.0 → 0.9.0

package/dist/lib/audit-logger.js

@@ -1,326 +0,0 @@
-"use strict";
-/**
- * Audit Logger Module
- *
- * Provides audit logging for data access and user actions with region tracking.
- *
- * Security: All audit events are stored in database with region/dataRegion tracking
- * for compliance and data residency verification.
- *
- * Uses existing Logger for application logging and SecurityEvent table for persistence.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuditLogger = void 0;
-exports.createAuditLogger = createAuditLogger;
-const logger_1 = require("./logger");
-const region_detection_1 = require("./region-detection");
-/**
- * Audit Logger class
- *
- * Provides audit logging with region tracking for compliance.
- */
-class AuditLogger {
-    logger;
-    requestId;
-    constructor(env, requestId) {
-        this.logger = logger_1.Logger.getInstance(env);
-        this.requestId = requestId;
-    }
-    /**
-     * Create audit logger with request ID for correlation
-     */
-    withRequestId(requestId) {
-        return new AuditLogger({ LOG_LEVEL: this.logger.getLogLevel() }, requestId);
-    }
-    /**
-     * Log data access event
-     *
-     * Use this for read operations (GET, SELECT).
-     *
-     * @param event - Audit event details
-     * @param env - Environment variables
-     */
-    async logDataAccess(event, env) {
-        const auditEvent = {
-            type: event.type || "data_access",
-            action: event.action,
-            resource: event.resource,
-            resourceId: event.resourceId,
-            userId: event.userId,
-            region: event.region,
-            dataRegion: event.dataRegion,
-            ipAddress: event.ipAddress,
-            userAgent: event.userAgent,
-            metadata: event.metadata,
-            severity: event.severity || "low",
-            success: event.success,
-        };
-        await this.logAuditEvent(auditEvent, env);
-    }
-    /**
-     * Log user action event
-     *
-     * Use this for user-initiated actions (create, update, delete).
-     *
-     * @param event - Audit event details
-     * @param env - Environment variables
-     */
-    async logUserAction(event, env) {
-        const auditEvent = {
-            type: event.type || "user_action",
-            action: event.action,
-            resource: event.resource,
-            resourceId: event.resourceId,
-            userId: event.userId,
-            region: event.region,
-            dataRegion: event.dataRegion,
-            ipAddress: event.ipAddress,
-            userAgent: event.userAgent,
-            metadata: event.metadata,
-            severity: event.severity || "medium", // User actions are typically medium severity
-            success: event.success,
-        };
-        await this.logAuditEvent(auditEvent, env);
-    }
-    /**
-     * Log authentication event
-     *
-     * @param event - Audit event details
-     * @param env - Environment variables
-     */
-    async logAuthentication(event, env) {
-        const auditEvent = {
-            type: event.type || "authentication",
-            action: event.action,
-            resource: event.resource || "user",
-            resourceId: event.resourceId,
-            userId: event.userId,
-            region: event.region,
-            dataRegion: event.dataRegion,
-            ipAddress: event.ipAddress,
-            userAgent: event.userAgent,
-            metadata: event.metadata,
-            severity: event.severity || (event.success ? "low" : "high"), // Failed auth is high severity
-            success: event.success,
-        };
-        await this.logAuditEvent(auditEvent, env);
-    }
-    /**
-     * Log authorization event
-     *
-     * @param event - Audit event details
-     * @param env - Environment variables
-     */
-    async logAuthorization(event, env) {
-        const auditEvent = {
-            type: event.type || "authorization",
-            action: event.action,
-            resource: event.resource,
-            resourceId: event.resourceId,
-            userId: event.userId,
-            region: event.region,
-            dataRegion: event.dataRegion,
-            ipAddress: event.ipAddress,
-            userAgent: event.userAgent,
-            metadata: event.metadata,
-            severity: event.severity || (event.success ? "low" : "high"), // Failed authz is high severity
-            success: event.success,
-        };
-        await this.logAuditEvent(auditEvent, env);
-    }
-    /**
-     * Generic log method that routes to the appropriate specific log method
-     *
-     * @param event - Audit event details
-     * @param env - Environment variables
-     */
-    async log(event, env) {
-        const eventType = event.type || "user_action";
-        switch (eventType) {
-            case "data_access":
-                await this.logDataAccess(event, env);
-                break;
-            case "user_action":
-                await this.logUserAction(event, env);
-                break;
-            case "authentication":
-                await this.logAuthentication(event, env);
-                break;
-            case "authorization":
-                await this.logAuthorization(event, env);
-                break;
-            default:
-                // Default to user_action for unknown types
-                await this.logUserAction(event, env);
-        }
-    }
-    /**
-     * Log audit event to database and application logs
-     *
-     * Security: All audit events are stored in database with region/dataRegion tracking.
-     *
-     * @param event - Audit event to log
-     * @param env - Environment variables
-     */
-    async logAuditEvent(event, env) {
-        try {
-            // CRITICAL: Validate region before logging
-            if (!(0, region_detection_1.isValidRegion)(event.region)) {
-                this.logger.error("[AuditLogger] Invalid region in audit event", {
-                    region: event.region,
-                    action: event.action,
-                });
-                return; // Don't log invalid events
-            }
-            // Calculate retention date based on severity
-            const retentionUntil = this.calculateRetentionUntil(event.severity || "low");
-            // Prepare audit event details (JSON string)
-            const details = JSON.stringify({
-                action: event.action,
-                resource: event.resource,
-                resourceId: event.resourceId,
-                region: event.region,
-                dataRegion: event.dataRegion,
-                ...event.metadata,
-            });
-            // Store in SecurityEvent table (using Prisma create for compatibility with driver adapters)
-            // Note: Using SecurityEvent table since AuditLog table doesn't exist yet
-            // The type field distinguishes audit events from security events
-            // Using retry logic with exponential backoff for connection resilience
-            const severity = event.severity || "low";
-            try {
-                const { sharedDatabaseConnectionManager } = await Promise.resolve().then(() => __importStar(require("./database-connection-manager")));
-                const { withQueryTimeoutAndRetry, QueryTimeoutPresets } = await Promise.resolve().then(() => __importStar(require("./db-query-helper")));
-                await withQueryTimeoutAndRetry(sharedDatabaseConnectionManager, event.region, env, async (db) => {
-                    return await db.securityEvent.create({
-                        data: {
-                            type: `audit_${event.type}`, // Prefix with 'audit_' to distinguish from security events
-                            severity: severity,
-                            userId: event.userId || null,
-                            tenantId: null, // T7 will populate this with the tenant context. (renamed from partnerId in T1)
-                            ipAddress: event.ipAddress || null,
-                            userAgent: event.userAgent || null,
-                            details: details,
-                            retentionUntil: retentionUntil,
-                        },
-                    });
-                }, {
-                    ...QueryTimeoutPresets.BACKGROUND, // Audit logging is background operation
-                    maxRetries: 3,
-                    baseDelayMs: 100,
-                    context: {
-                        operation: "audit_log",
-                        userId: event.userId,
-                        action: event.action,
-                    },
-                });
-            }
-            catch (dbError) {
-                // Table might not exist yet - log to console for now
-                // This is expected until migration is run
-                this.logger.warn("[AuditLogger] Database logging failed (table may not exist, migration needed)", { error: dbError, action: event.action });
-            }
-            // Also log to application logs (using existing Logger)
-            const logMessage = `[Audit] ${event.action} on ${event.resource}${event.resourceId ? ` (${event.resourceId})` : ""} in region ${event.region}${event.dataRegion ? ` (dataRegion: ${event.dataRegion})` : ""}`;
-            if (event.success) {
-                this.logger.info(logMessage, {
-                    type: event.type,
-                    action: event.action,
-                    resource: event.resource,
-                    region: event.region,
-                    dataRegion: event.dataRegion,
-                    userId: event.userId,
-                });
-            }
-            else {
-                this.logger.warn(logMessage, {
-                    type: event.type,
-                    action: event.action,
-                    resource: event.resource,
-                    region: event.region,
-                    dataRegion: event.dataRegion,
-                    userId: event.userId,
-                    error: event.metadata?.error,
-                });
-            }
-        }
-        catch (error) {
-            // Don't fail the request if audit logging fails
-            // But log the error for monitoring
-            this.logger.error("[AuditLogger] Failed to log audit event", {
-                error,
-                action: event.action,
-                resource: event.resource,
-            });
-        }
-    }
-    /**
-     * Calculate retention date based on severity
-     *
-     * Retention periods:
-     * - critical: 365 days (1 year)
-     * - high: 90 days
-     * - medium: 30 days
-     * - low: 7 days
-     *
-     * @param severity - Event severity level
-     * @returns Date when the event should be deleted, or null if retention is disabled
-     */
-    calculateRetentionUntil(severity) {
-        const retentionDays = {
-            critical: 365, // Keep critical events for 1 year
-            high: 90, // Keep high severity for 90 days
-            medium: 30, // Keep medium for 30 days
-            low: 7, // Keep low for 7 days
-        };
-        const days = retentionDays[severity] || 30;
-        const date = new Date();
-        date.setDate(date.getDate() + days);
-        return date;
-    }
-}
-exports.AuditLogger = AuditLogger;
-/**
- * Create an audit logger instance
- *
- * @param env - Environment variables
- * @param requestId - Optional request ID for correlation
- * @returns AuditLogger instance
- */
-function createAuditLogger(env, requestId) {
-    return new AuditLogger(env, requestId);
-}
-//# sourceMappingURL=audit-logger.js.map

package/dist/lib/audit-logger.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/lib/audit-logger.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqYH,8CAKC;AAxYD,qCAAqE;AAErE,yDAAgE;AA8ChE;;;;GAIG;AACH,MAAa,WAAW;IACd,MAAM,CAAS;IACf,SAAS,CAAU;IAE3B,YAAY,GAAe,EAAE,SAAkB;QAC7C,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAiB;QAC7B,OAAO,IAAI,WAAW,CACpB,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAe,EACrD,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,6CAA6C;YACnF,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,gBAAgB;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,MAAM;YAClC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,+BAA+B;YAC7F,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CACpB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe;YACnC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,gCAAgC;YAC9F,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CACP,KAAuE,EACvE,GAAmB;QAEnB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,IAAI,aAAa,CAAC;QAE9C,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,aAAa;gBAChB,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACrC,MAAM;YACR,KAAK,aAAa;gBAChB,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACrC,MAAM;YACR,KAAK,gBAAgB;gBACnB,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACzC,MAAM;YACR,KAAK,eAAe;gBAClB,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACxC,MAAM;YACR;gBACE,2CAA2C;gBAC3C,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,KAAiB,EACjB,GAAmB;QAEnB,IAAI,CAAC;YACH,2CAA2C;YAC3C,IAAI,CAAC,IAAA,gCAAa,EAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;oBAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;gBACH,OAAO,CAAC,2BAA2B;YACrC,CAAC;YAED,6CAA6C;YAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,uBAAuB,CACjD,KAAK,CAAC,QAAQ,IAAI,KAAK,CACxB,CAAC;YAEF,4CAA4C;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,GAAG,KAAK,CAAC,QAAQ;aAClB,CAAC,CAAC;YAEH,4FAA4F;YAC5F,yEAAyE;YACzE,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,+BAA+B,EAAE,GAAG,wDAC1C,+BAA+B,GAChC,CAAC;gBACF,MAAM,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,GAAG,wDACxD,mBAAmB,GACpB,CAAC;gBAEF,MAAM,wBAAwB,CAC5B,+BAA+B,EAC/B,KAAK,CAAC,MAAM,EACZ,GAAG,EACH,KAAK,EAAE,EAAE,EAAE,EAAE;oBACX,OAAO,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;wBACnC,IAAI,EAAE;4BACJ,IAAI,EAAE,SAAS,KAAK,CAAC,IAAI,EAAE,EAAE,2DAA2D;4BACxF,QAAQ,EAAE,QAAQ;4BAClB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;4BAC5B,QAAQ,EAAE,IAAI,EAAE,gFAAgF;4BAChG,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;4BAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;4BAClC,OAAO,EAAE,OAAO;4BAChB,cAAc,EAAE,cAAc;yBAC/B;qBACF,CAAC,CAAC;gBACL,CAAC,EACD;oBACE,GAAG,mBAAmB,CAAC,UAAU,EAAE,wCAAwC;oBAC3E,UAAU,EAAE,CAAC;oBACb,WAAW,EAAE,GAAG;oBAChB,OAAO,EAAE;wBACP,SAAS,EAAE,WAAW;wBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB;iBACF,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,qDAAqD;gBACrD,0CAA0C;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+EAA+E,EAC/E,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzC,CAAC;YACJ,CAAC;YAED,uDAAuD;YACvD,MAAM,UAAU,GAAG,WAAW,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAE9M,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE;oBAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE;oBAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gDAAgD;YAChD,mCAAmC;YACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE;gBAC3D,KAAK;gBACL,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uBAAuB,CAAC,QAA4B;QAC1D,MAAM,aAAa,GAAuC;YACxD,QAAQ,EAAE,GAAG,EAAE,kCAAkC;YACjD,IAAI,EAAE,EAAE,EAAE,iCAAiC;YAC3C,MAAM,EAAE,EAAE,EAAE,0BAA0B;YACtC,GAAG,EAAE,CAAC,EAAE,sBAAsB;SAC/B,CAAC;QAEF,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AArUD,kCAqUC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAC/B,GAAe,EACf,SAAkB;IAElB,OAAO,IAAI,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC"}

package/dist/lib/circuit-breaker.d.ts

@@ -1,27 +0,0 @@
-/**
- * Circuit Breaker - Detects runaway requests
- *
- * Protects against:
- * - Infinite loops
- * - Uncontrolled recursion
- * - Excessive CPU time per request
- */
-export interface CircuitBreakerContext {
-    request: Request;
-    recursionDepth?: number;
-    startTime?: number;
-}
-export declare class CircuitBreaker {
-    private readonly MAX_CPU_TIME_MS;
-    private readonly MAX_RECURSION_DEPTH;
-    private readonly MAX_REQUEST_SIZE;
-    /**
-     * Wrap request handler with circuit breaker protection
-     */
-    execute<T>(handler: () => Promise<T>, context: CircuitBreakerContext): Promise<T>;
-    /**
-     * Trigger emergency stop — logs the event for alerting.
-     */
-    private triggerEmergencyStop;
-}
-//# sourceMappingURL=circuit-breaker.d.ts.map

package/dist/lib/circuit-breaker.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"circuit-breaker.d.ts","sourceRoot":"","sources":["../../src/lib/circuit-breaker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAM;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoB;IAErD;;OAEG;IACG,OAAO,CAAC,CAAC,EACb,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACzB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,CAAC,CAAC;IA0Cb;;OAEG;YACW,oBAAoB;CAWnC"}

package/dist/lib/circuit-breaker.js

@@ -1,63 +0,0 @@
-"use strict";
-/**
- * Circuit Breaker - Detects runaway requests
- *
- * Protects against:
- * - Infinite loops
- * - Uncontrolled recursion
- * - Excessive CPU time per request
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CircuitBreaker = void 0;
-const logger_1 = require("./logger");
-class CircuitBreaker {
-    MAX_CPU_TIME_MS = 30000; // 30 seconds max per request
-    MAX_RECURSION_DEPTH = 50;
-    MAX_REQUEST_SIZE = 10 * 1024 * 1024; // 10MB
-    /**
-     * Wrap request handler with circuit breaker protection
-     */
-    async execute(handler, context) {
-        const startTime = context.startTime || Date.now();
-        const recursionDepth = context.recursionDepth || 0;
-        // Check CPU time (approximate via wall clock)
-        const elapsed = Date.now() - startTime;
-        if (elapsed > this.MAX_CPU_TIME_MS) {
-            throw new Error(`Request exceeded maximum CPU time (${this.MAX_CPU_TIME_MS}ms)`);
-        }
-        // Check recursion depth
-        if (recursionDepth > this.MAX_RECURSION_DEPTH) {
-            throw new Error(`Maximum recursion depth exceeded (${this.MAX_RECURSION_DEPTH})`);
-        }
-        // Check request size
-        const contentLength = context.request.headers.get("content-length");
-        if (contentLength && parseInt(contentLength) > this.MAX_REQUEST_SIZE) {
-            throw new Error(`Request size exceeds maximum (${this.MAX_REQUEST_SIZE} bytes)`);
-        }
-        try {
-            return await handler();
-        }
-        catch (error) {
-            // If error indicates runaway condition, trigger emergency stop
-            if (error.message?.includes("timeout") ||
-                error.message?.includes("recursion") ||
-                error.message?.includes("CPU time")) {
-                await this.triggerEmergencyStop(context.request, error);
-            }
-            throw error;
-        }
-    }
-    /**
-     * Trigger emergency stop — logs the event for alerting.
-     */
-    async triggerEmergencyStop(request, error) {
-        logger_1.Logger.getInstance().error("[CircuitBreaker] Emergency stop triggered:", {
-            url: request.url,
-            method: request.method,
-            error: error.message,
-            timestamp: new Date().toISOString(),
-        });
-    }
-}
-exports.CircuitBreaker = CircuitBreaker;
-//# sourceMappingURL=circuit-breaker.js.map

package/dist/lib/circuit-breaker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"circuit-breaker.js","sourceRoot":"","sources":["../../src/lib/circuit-breaker.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,qCAAkD;AAQlD,MAAa,cAAc;IACR,eAAe,GAAG,KAAK,CAAC,CAAC,6BAA6B;IACtD,mBAAmB,GAAG,EAAE,CAAC;IACzB,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;IAE7D;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,OAAyB,EACzB,OAA8B;QAE9B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAClD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;QAEnD,8CAA8C;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACvC,IAAI,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,CAAC,eAAe,KAAK,CAChE,CAAC;QACJ,CAAC;QAED,wBAAwB;QACxB,IAAI,cAAc,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,mBAAmB,GAAG,CACjE,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACpE,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,gBAAgB,SAAS,CAChE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,+DAA+D;YAC/D,IACE,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC;gBAClC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC;gBACpC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,EACnC,CAAC;gBACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,oBAAoB,CAChC,OAAgB,EAChB,KAAY;QAEZ,eAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,4CAA4C,EAAE;YACvE,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO;YACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;CACF;AAnED,wCAmEC"}

package/dist/lib/graph/dual-write-service.d.ts

@@ -1,116 +0,0 @@
-/**
- * Dual-Write Service Implementation
- *
- * Manages the consistency between Postgres (source of truth) and the graph
- * database (Neo4j AuraDB / Docker Neo4j locally). Handlers call DualWriteService methods
- * after a successful Prisma write to sync the corresponding graph state.
- *
- * Key responsibilities:
- * - Inline retry with exponential backoff + jitter
- * - Critical vs non-critical operation distinction
- * - Async retry queue fallback for non-critical failures
- * - In-memory failure tracking for MVP (SQS integration later)
- *
- * @see ./dual-write-strategy.md for the full design rationale
- * @see ./dual-write.ts for the interface definition
- */
-import type { GraphService } from "./graph-service";
-import type { DualWriteConfig, DualWriteFailure, DualWriteService, DualWriteSyncResult, ReconciliationProgress, ReconciliationResult, ConsistencyCheckResult } from "./dual-write";
-import type { SyncUserInput, SyncEntityInput, SyncPostInput, SyncPostSubjectsInput, SyncOwnershipInput } from "./types";
-/**
- * Default implementation of the DualWriteService interface.
- *
- * Wraps a GraphService instance with retry logic and failure handling.
- * Handlers call this instead of GraphService.sync* directly, so that
- * retry, logging, and async fallback are centralized.
- */
-export declare class DualWriteServiceImpl implements DualWriteService {
-    private readonly graphService;
-    private readonly maxRetries;
-    private readonly baseRetryDelayMs;
-    private readonly enableAsyncRetry;
-    /**
-     * In-memory queue of failed syncs for async retry.
-     * In production this would be backed by SQS (GRAPH_SYNC_QUEUE).
-     * For MVP, failures are accumulated here and can be processed via
-     * processRetry() or reconciliation.
-     */
-    private readonly failureQueue;
-    /**
-     * @param graphService - The underlying GraphService instance
-     * @param config - Optional retry and queue configuration
-     */
-    constructor(graphService: GraphService, config?: DualWriteConfig);
-    /** @inheritdoc */
-    syncUser(input: SyncUserInput): Promise<DualWriteSyncResult>;
-    /** @inheritdoc */
-    syncEntity(input: SyncEntityInput): Promise<DualWriteSyncResult>;
-    /** @inheritdoc */
-    syncPost(input: SyncPostInput): Promise<DualWriteSyncResult>;
-    /** @inheritdoc */
-    syncPostSubjects(input: SyncPostSubjectsInput): Promise<DualWriteSyncResult>;
-    /** @inheritdoc */
-    removeUser(userId: string): Promise<void>;
-    /** @inheritdoc */
-    removeEntity(entityId: string): Promise<void>;
-    /** @inheritdoc */
-    removePost(postId: string): Promise<DualWriteSyncResult>;
-    /** @inheritdoc */
-    syncOwnership(input: SyncOwnershipInput): Promise<void>;
-    /** @inheritdoc */
-    removeOwnership(entityId: string, userId: string): Promise<void>;
-    /** @inheritdoc */
-    processRetry(failure: DualWriteFailure): Promise<void>;
-    /** @inheritdoc */
-    reconcile(_options?: {
-        batchSize?: number;
-        maxRecordsPerModel?: number;
-        clearFirst?: boolean;
-        onProgress?: (progress: ReconciliationProgress) => void;
-    }): Promise<ReconciliationResult>;
-    /** @inheritdoc */
-    checkConsistency(_sampleSize?: number): Promise<ConsistencyCheckResult>;
-    /**
-     * Get a snapshot of the in-memory failure queue.
-     * In production, this would read from SQS instead.
-     */
-    getFailureQueue(): ReadonlyArray<DualWriteFailure>;
-    /**
-     * Get the number of queued failures.
-     */
-    getFailureCount(): number;
-    /**
-     * Execute a non-critical graph sync with inline retry and async fallback.
-     *
-     * On success: returns { status: "synced" }.
-     * On failure after retries: enqueues for async retry and returns
-     * { status: "queued", failureId } or { status: "failed", error }.
-     */
-    private executeNonCritical;
-    /**
-     * Execute a critical graph sync with inline retry.
-     *
-     * On success: returns void.
-     * On failure after retries: enqueues for async retry AND throws GraphSyncError.
-     */
-    private executeCritical;
-    /**
-     * Execute a function with inline retry (exponential backoff + jitter).
-     *
-     * @returns Success/failure result with attempt count and last error message.
-     */
-    private executeWithRetry;
-    /**
-     * Enqueue a failed sync for async retry.
-     *
-     * MVP: stores in an in-memory array (bounded to MAX_FAILURE_QUEUE_SIZE).
-     * Production: would send to SQS GRAPH_SYNC_QUEUE.
-     */
-    private enqueueFailure;
-    /**
-     * Map a DualWritePayload to the corresponding GraphService method call.
-     * Used by processRetry() to replay failed operations.
-     */
-    private getGraphServiceCall;
-}
-//# sourceMappingURL=dual-write-service.d.ts.map

package/dist/lib/graph/dual-write-service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dual-write-service.d.ts","sourceRoot":"","sources":["../../../src/lib/graph/dual-write-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAGhB,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,SAAS,CAAC;AA+DjB;;;;;;GAMG;AACH,qBAAa,oBAAqB,YAAW,gBAAgB;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAE3C;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IAEvD;;;OAGG;gBACS,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,eAAe;IAWhE,kBAAkB;IACZ,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMlE,kBAAkB;IACZ,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMtE,kBAAkB;IACZ,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMlE,kBAAkB;IACZ,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAYlF,kBAAkB;IACZ,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/C,kBAAkB;IACZ,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnD,kBAAkB;IACZ,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAU9D,kBAAkB;IACZ,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ7D,kBAAkB;IACZ,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYtE,kBAAkB;IACZ,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAS5D,kBAAkB;IACZ,SAAS,CAAC,QAAQ,CAAC,EAAE;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,sBAAsB,KAAK,IAAI,CAAC;KACzD,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAUjC,kBAAkB;IACZ,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAY7E;;;OAGG;IACH,eAAe,IAAI,aAAa,CAAC,gBAAgB,CAAC;IAIlD;;OAEG;IACH,eAAe,IAAI,MAAM;IAQzB;;;;;;OAMG;YACW,kBAAkB;IAoBhC;;;;;OAKG;YACW,eAAe;IAmB7B;;;;OAIG;YACW,gBAAgB;IAuD9B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAgCtB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;CA2B5B"}