@de-otio/trellis 0.7.0 → 0.9.0

package/dist/lib/session-awareness.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-awareness.js","sourceRoot":"","sources":["../../src/lib/session-awareness.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAuBH,oDAqBC;AAUD,0CA2CC;AAjFD;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO;gBACL,iBAAiB,EAAE,EAAE;gBACrB,kBAAkB,EAAE,EAAE;gBACtB,gBAAgB,EAAE,EAAE;aACrB,CAAC;QACJ,KAAK,MAAM;YACT,OAAO;gBACL,iBAAiB,EAAE,EAAE;gBACrB,kBAAkB,EAAE,EAAE;gBACtB,gBAAgB,EAAE,IAAI;aACvB,CAAC;QACJ,KAAK,OAAO;YACV,OAAO;gBACL,iBAAiB,EAAE,EAAE;gBACrB,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,eAAe,CAC7B,sBAA8B,EAC9B,OAAgB;IAEhB,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAEjD,4CAA4C;IAC5C,IACE,UAAU,CAAC,gBAAgB,KAAK,IAAI;QACpC,sBAAsB,IAAI,UAAU,CAAC,gBAAgB,EACrD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,wCAAwC,UAAU,CAAC,gBAAgB,4BAA4B;YACxG,cAAc,EAAE,sBAAsB;SACvC,CAAC;IACJ,CAAC;IAED,qBAAqB;IACrB,IACE,UAAU,CAAC,kBAAkB,KAAK,IAAI;QACtC,sBAAsB,IAAI,UAAU,CAAC,kBAAkB,EACvD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4BAA4B,sBAAsB,6BAA6B;YACxF,cAAc,EAAE,sBAAsB;SACvC,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,IACE,UAAU,CAAC,iBAAiB,KAAK,IAAI;QACrC,sBAAsB,IAAI,UAAU,CAAC,iBAAiB,EACtD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4BAA4B,sBAAsB,oCAAoC;YAC/F,cAAc,EAAE,sBAAsB;SACvC,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"session-awareness.js","sourceRoot":"","sources":["../../src/lib/session-awareness.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO;gBACL,iBAAiB,EAAE,EAAE;gBACrB,kBAAkB,EAAE,EAAE;gBACtB,gBAAgB,EAAE,EAAE;aACrB,CAAC;QACJ,KAAK,MAAM;YACT,OAAO;gBACL,iBAAiB,EAAE,EAAE;gBACrB,kBAAkB,EAAE,EAAE;gBACtB,gBAAgB,EAAE,IAAI;aACvB,CAAC;QACJ,KAAK,OAAO;YACV,OAAO;gBACL,iBAAiB,EAAE,EAAE;gBACrB,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,sBAA8B,EAC9B,OAAgB;IAEhB,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAEjD,4CAA4C;IAC5C,IACE,UAAU,CAAC,gBAAgB,KAAK,IAAI;QACpC,sBAAsB,IAAI,UAAU,CAAC,gBAAgB,EACrD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,wCAAwC,UAAU,CAAC,gBAAgB,4BAA4B;YACxG,cAAc,EAAE,sBAAsB;SACvC,CAAC;IACJ,CAAC;IAED,qBAAqB;IACrB,IACE,UAAU,CAAC,kBAAkB,KAAK,IAAI;QACtC,sBAAsB,IAAI,UAAU,CAAC,kBAAkB,EACvD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4BAA4B,sBAAsB,6BAA6B;YACxF,cAAc,EAAE,sBAAsB;SACvC,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,IACE,UAAU,CAAC,iBAAiB,KAAK,IAAI;QACrC,sBAAsB,IAAI,UAAU,CAAC,iBAAiB,EACtD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4BAA4B,sBAAsB,oCAAoC;YAC/F,cAAc,EAAE,sBAAsB;SACvC,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/session-config.js

@@ -1,18 +1,10 @@
-"use strict";
 /**
  * Session Configuration
  *
  * Provides configurable session timeout settings following security best practices.
  * Reads from environment variables with sensible defaults.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SessionConfigManager = void 0;
-exports.getSessionConfig = getSessionConfig;
-exports.calculateSessionExpiration = calculateSessionExpiration;
-exports.calculateCookieMaxAge = calculateCookieMaxAge;
-exports.shouldRefreshSession = shouldRefreshSession;
-exports.isSessionExpired = isSessionExpired;
-const logger_1 = require("./logger");
+import { getLogger } from "./logger.js";
 /**
  * Session Configuration Manager class
  *
@@ -23,11 +15,11 @@ const logger_1 = require("./logger");
  * - SESSION_REFRESH_THRESHOLD_HOURS (default: 1)
  * - SESSION_INACTIVITY_TIMEOUT_MINUTES (default: 60)
  */
-class SessionConfigManager {
+export class SessionConfigManager {
     config;
     logger;
     constructor(env) {
-        this.logger = logger_1.Logger.getInstance(env);
+        this.logger = getLogger();
         this.config = this.loadConfig(env);
     }
     /**
@@ -120,19 +112,18 @@ class SessionConfigManager {
         return sessionExpiresAt < Date.now();
     }
 }
-exports.SessionConfigManager = SessionConfigManager;
 /**
  * Legacy function for backward compatibility
  * @deprecated Use new SessionConfigManager class instead
  */
-function getSessionConfig(env) {
+export function getSessionConfig(env) {
     return new SessionConfigManager(env).getConfig();
 }
 /**
  * Legacy function for backward compatibility
  * @deprecated Use new SessionConfigManager class instead
  */
-function calculateSessionExpiration(config, sessionType) {
+export function calculateSessionExpiration(config, sessionType) {
     const manager = new SessionConfigManager({});
     manager["config"] = config; // Set config directly for compatibility
     return manager.calculateSessionExpiration(sessionType);
@@ -141,7 +132,7 @@ function calculateSessionExpiration(config, sessionType) {
  * Legacy function for backward compatibility
  * @deprecated Use new SessionConfigManager class instead
  */
-function calculateCookieMaxAge(config, sessionType) {
+export function calculateCookieMaxAge(config, sessionType) {
     const manager = new SessionConfigManager({});
     manager["config"] = config; // Set config directly for compatibility
     return manager.calculateCookieMaxAge(sessionType);
@@ -150,7 +141,7 @@ function calculateCookieMaxAge(config, sessionType) {
  * Legacy function for backward compatibility
  * @deprecated Use new SessionConfigManager class instead
  */
-function shouldRefreshSession(sessionExpiresAt, config) {
+export function shouldRefreshSession(sessionExpiresAt, config) {
     const manager = new SessionConfigManager({});
     manager["config"] = config; // Set config directly for compatibility
     return manager.shouldRefreshSession(sessionExpiresAt);
@@ -159,7 +150,7 @@ function shouldRefreshSession(sessionExpiresAt, config) {
  * Legacy function for backward compatibility
  * @deprecated Use new SessionConfigManager class instead
  */
-function isSessionExpired(sessionExpiresAt) {
+export function isSessionExpired(sessionExpiresAt) {
     return sessionExpiresAt < Date.now();
 }
 //# sourceMappingURL=session-config.js.map

package/dist/lib/session-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-config.js","sourceRoot":"","sources":["../../src/lib/session-config.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA8JH,4CAEC;AAMD,gEAOC;AAMD,sDAOC;AAMD,oDAOC;AAMD,4CAEC;AA7MD,qCAAkC;AAmBlC;;;;;;;;;GASG;AACH,MAAa,oBAAoB;IACvB,MAAM,CAAgB;IACtB,MAAM,CAAS;IAEvB,YAAY,GAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAA2B;QAC5C,2DAA2D;QAC3D,IAAI,MAAM,GAA2B,EAAE,CAAC;QAExC,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;oBACpC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;oBAChC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;gBAEzB,MAAM,GAAG;oBACP,sBAAsB,EAAE,MAAM,CAAC,yBAAyB;oBACxD,qBAAqB,EAAE,MAAM,CAAC,wBAAwB;oBACtD,4BAA4B,EAAE,MAAM,CAAC,+BAA+B;oBACpE,qBAAqB,EAAE,MAAM,CAAC,uBAAuB;oBACrD,wBAAwB,EAAE,MAAM,CAAC,0BAA0B;iBAC5D,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gEAAgE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,OAAO;YACL,sBAAsB,EACpB,MAAM,CAAC,sBAAsB;gBAC7B,QAAQ,CAAC,GAAG,CAAC,yBAAyB,IAAI,IAAI,EAAE,EAAE,CAAC;YAErD,qBAAqB,EACnB,MAAM,CAAC,qBAAqB;gBAC5B,QAAQ,CAAC,GAAG,CAAC,wBAAwB,IAAI,GAAG,EAAE,EAAE,CAAC;YAEnD,4BAA4B,EAC1B,MAAM,CAAC,4BAA4B;gBACnC,QAAQ,CAAC,GAAG,CAAC,+BAA+B,IAAI,IAAI,EAAE,EAAE,CAAC;YAE3D,qBAAqB,EACnB,MAAM,CAAC,qBAAqB;gBAC5B,QAAQ,CAAC,GAAG,CAAC,+BAA+B,IAAI,GAAG,EAAE,EAAE,CAAC;YAE1D,wBAAwB,EACtB,MAAM,CAAC,wBAAwB;gBAC/B,QAAQ,CAAC,GAAG,CAAC,kCAAkC,IAAI,IAAI,EAAE,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,0BAA0B,CACxB,WAAyC;QAEzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,MAAM;gBACT,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACxE,KAAK,KAAK;gBACR,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACvE,KAAK,WAAW;gBACd,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACzE;gBACE,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC1E,CAAC;IACH,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,WAAyC;QAC7D,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YAC3D,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YAC1D,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,MAAM,CAAC,4BAA4B,GAAG,EAAE,GAAG,EAAE,CAAC;YAC5D;gBACE,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,gBAAwB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,GAAG,CAAC;QACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAE5E,OAAO,mBAAmB,GAAG,CAAC,IAAI,mBAAmB,GAAG,gBAAgB,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,gBAAwB;QACvC,OAAO,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF;AAzHD,oDAyHC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,GAA2B;IAC1D,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAgB,0BAA0B,CACxC,MAAqB,EACrB,WAAyC;IAEzC,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,wCAAwC;IACpE,OAAO,OAAO,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CACnC,MAAqB,EACrB,WAAyC;IAEzC,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,wCAAwC;IACpE,OAAO,OAAO,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,gBAAwB,EACxB,MAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,wCAAwC;IACpE,OAAO,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,gBAAwB;IACvD,OAAO,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"session-config.js","sourceRoot":"","sources":["../../src/lib/session-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAU,MAAM,aAAa,CAAC;AAmBhD;;;;;;;;;GASG;AACH,MAAM,OAAO,oBAAoB;IACvB,MAAM,CAAgB;IACtB,MAAM,CAAS;IAEvB,YAAY,GAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAA2B;QAC5C,2DAA2D;QAC3D,IAAI,MAAM,GAA2B,EAAE,CAAC;QAExC,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;oBACpC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;oBAChC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;gBAEzB,MAAM,GAAG;oBACP,sBAAsB,EAAE,MAAM,CAAC,yBAAyB;oBACxD,qBAAqB,EAAE,MAAM,CAAC,wBAAwB;oBACtD,4BAA4B,EAAE,MAAM,CAAC,+BAA+B;oBACpE,qBAAqB,EAAE,MAAM,CAAC,uBAAuB;oBACrD,wBAAwB,EAAE,MAAM,CAAC,0BAA0B;iBAC5D,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gEAAgE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,OAAO;YACL,sBAAsB,EACpB,MAAM,CAAC,sBAAsB;gBAC7B,QAAQ,CAAC,GAAG,CAAC,yBAAyB,IAAI,IAAI,EAAE,EAAE,CAAC;YAErD,qBAAqB,EACnB,MAAM,CAAC,qBAAqB;gBAC5B,QAAQ,CAAC,GAAG,CAAC,wBAAwB,IAAI,GAAG,EAAE,EAAE,CAAC;YAEnD,4BAA4B,EAC1B,MAAM,CAAC,4BAA4B;gBACnC,QAAQ,CAAC,GAAG,CAAC,+BAA+B,IAAI,IAAI,EAAE,EAAE,CAAC;YAE3D,qBAAqB,EACnB,MAAM,CAAC,qBAAqB;gBAC5B,QAAQ,CAAC,GAAG,CAAC,+BAA+B,IAAI,GAAG,EAAE,EAAE,CAAC;YAE1D,wBAAwB,EACtB,MAAM,CAAC,wBAAwB;gBAC/B,QAAQ,CAAC,GAAG,CAAC,kCAAkC,IAAI,IAAI,EAAE,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,0BAA0B,CACxB,WAAyC;QAEzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,MAAM;gBACT,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACxE,KAAK,KAAK;gBACR,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACvE,KAAK,WAAW;gBACd,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACzE;gBACE,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC1E,CAAC;IACH,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,WAAyC;QAC7D,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YAC3D,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YAC1D,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,MAAM,CAAC,4BAA4B,GAAG,EAAE,GAAG,EAAE,CAAC;YAC5D;gBACE,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,gBAAwB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,GAAG,CAAC;QACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAE5E,OAAO,mBAAmB,GAAG,CAAC,IAAI,mBAAmB,GAAG,gBAAgB,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,gBAAwB;QACvC,OAAO,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAA2B;IAC1D,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAqB,EACrB,WAAyC;IAEzC,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,wCAAwC;IACpE,OAAO,OAAO,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAqB,EACrB,WAAyC;IAEzC,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,wCAAwC;IACpE,OAAO,OAAO,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,gBAAwB,EACxB,MAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,wCAAwC;IACpE,OAAO,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,gBAAwB;IACvD,OAAO,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACvC,CAAC"}

package/dist/lib/{session-manager.d.ts → session-cookie.d.ts}

@@ -2,9 +2,21 @@
  * Session Management
  *
  * Handles encrypted cookie-based session storage for authentication.
- * Uses Supabase Auth.
+ *
+ * Crypto is delegated to `@de-otio/saas-foundation/session`'s
+ * `SessionCookie` (AES-256-GCM, 96-bit random IV, PBKDF2-SHA256 with
+ * the OWASP-2023 600k-iteration minimum). The envelope format is
+ * base64([IV || ciphertext+tag]) — identical in shape to the previous
+ * hand-rolled implementation, only the derived key is stronger.
+ *
+ * This module is a thin trellis-flavoured wrapper: it preserves the
+ * `SessionManager` public surface (so the ~60 call sites only change
+ * their import path), owns the trellis `Session` shape + custom-claim
+ * validation (foundation is payload-agnostic), and keeps the AUTH-5
+ * token-revocation blocklist (which has no foundation equivalent).
  */
 import type { AgeTier } from "@prisma/client";
+import { MIN_SALT_LENGTH, MIN_SECRET_LENGTH } from "@de-otio/saas-foundation/session";
 export type UserRole = "END_USER" | "B2B_PARTNER" | "PARTNER_ADMIN" | "INTERNAL" | "CONTENT_CREATOR" | "SUPER_ADMIN";
 export interface Session {
     userId: string;
@@ -24,37 +36,50 @@ export interface Session {
     ageTier?: AgeTier;
 }
 /**
- * Session Manager class for handling encrypted sessions
+ * Session Manager class for handling encrypted sessions.
  */
 export declare class SessionManager {
     private static readonly COOKIE_NAME;
     hadLegacySessionCookie: boolean;
     hadInvalidSessionCookie: boolean;
     /**
-     * Get session configuration from environment
+     * Cache of foundation `SessionCookie` instances, keyed by the
+     * secret/fallback/salt triple. `SessionCookie` caches its derived
+     * key on the instance, so reusing the instance avoids re-paying the
+     * 600k-iteration PBKDF2 cost on warm invocations.
      */
-    private getSessionConfig;
+    private readonly cookieCache;
     /**
-     * Derive encryption key from secret using PBKDF2
-     * This provides proper key stretching and consistent key size
+     * Get (or lazily construct + cache) the foundation `SessionCookie`
+     * for a given secret/fallback/salt triple.
      *
-     * Environment Variables:
-     * - SESSION_SALT: Custom salt for PBKDF2 (REQUIRED — must be set in environment)
+     * `salt` is REQUIRED (trellis fails closed without it, mirroring
+     * foundation's MIN_SALT_LENGTH constraint).
+     */
+    private getCookie;
+    /**
+     * Get session configuration from environment
      */
-    private deriveKey;
+    private getSessionConfig;
     /**
-     * Encrypt session data using Web Crypto API (AES-GCM)
+     * Encrypt session data using foundation's AES-256-GCM SessionCookie.
+     *
+     * `salt` is required (mirrors foundation MIN_SALT_LENGTH); omitting
+     * it fails closed with a SESSION_SALT error.
      */
     encryptSession(data: string, secret: string, salt?: string): Promise<string>;
     /**
-     * Decrypt session data
+     * Decrypt session data. Returns null on any decryption failure
+     * (bad MAC, wrong key, malformed input).
      */
     decryptSession(encryptedData: string, secret: string, salt?: string): Promise<string | null>;
     /**
-     * Parse cookies from Cookie header with proper URL decoding
-     * Handles edge cases and malformed cookies securely
+     * Validate and narrow a decrypted/parsed payload into a trellis
+     * `Session`. Returns null (and sets `hadInvalidSessionCookie`) when
+     * the payload is not a valid Supabase session, or is a legacy
+     * BlueSky/AT-Protocol session.
      */
-    private parseCookies;
+    private narrowSession;
     /**
      * Get session from request
      * Checks Authorization header first (for localStorage token), then falls back to cookie
@@ -66,6 +91,20 @@ export declare class SessionManager {
     getSession(request: Request, secret: string, env?: {
         [key: string]: any;
     }): Promise<Session | null>;
+    /**
+     * Narrow a payload parsed from the Authorization-header path. This
+     * path historically accepted any object with userId + email and did
+     * NOT set hadInvalidSessionCookie, so we keep that behaviour distinct
+     * from the cookie path's narrowSession.
+     */
+    private narrowSessionForAuthHeader;
+    /**
+     * Decrypt a token trying the primary secret first, then the fallback
+     * secret (zero-downtime rotation). Foundation's `SessionCookie`
+     * already tries primary→fallback internally when both are configured
+     * on one instance, so we construct a single cookie with both.
+     */
+    private unsealWithRotation;
     /**
      * Set session cookie in response (alias for setSession)
      */
@@ -96,9 +135,13 @@ export declare class SessionManager {
     /**
      * AUTH-5: Revoke a session token by adding it to the blocklist.
      * Call this on logout to prevent token reuse.
+     *
+     * No foundation equivalent exists — this composes over the trellis
+     * blocklist KV store and is kept verbatim.
      */
     revokeSession(request: Request, env: {
         [key: string]: any;
     }): Promise<void>;
 }
-//# sourceMappingURL=session-manager.d.ts.map
+export { MIN_SECRET_LENGTH, MIN_SALT_LENGTH };
+//# sourceMappingURL=session-cookie.d.ts.map

package/dist/lib/session-cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cookie.d.ts","sourceRoot":"","sources":["../../src/lib/session-cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,EAIlB,MAAM,kCAAkC,CAAC;AAG1C,MAAM,MAAM,QAAQ,GAChB,UAAU,GACV,aAAa,GACb,eAAe,GACf,UAAU,GACV,iBAAiB,GACjB,aAAa,CAAC;AAElB,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC;IAOnB,cAAc,EAAE,SAAS,GAAG,OAAO,CAAC;IAKpC,SAAS,CAAC,EAAE,MAAM,CAAC;IAInB,WAAW,CAAC,EAAE,OAAO,CAAC;IAItB,aAAa,CAAC,EAAE,MAAM,CAAC;IAGvB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAkBD;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,sBAAsB,UAAS;IAC/B,uBAAuB,UAAS;IAEvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAEhE;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;IAyBjB;;OAEG;YACW,gBAAgB;IAM9B;;;;;OAKG;IACG,cAAc,CAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IAIlB;;;OAGG;IACG,cAAc,CAClB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASzB;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAgCrB;;;;;;;OAOG;IACG,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,GAC3B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAuL1B;;;;;OAKG;IACH,OAAO,CAAC,0BAA0B;IAclC;;;;;OAKG;YACW,kBAAkB;IAchC;;OAEG;IACG,gBAAgB,CACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EACrB,GAAG,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,GAC3B,OAAO,CAAC,QAAQ,CAAC;IAIpB;;;OAGG;IACG,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EACrB,GAAG,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,GAC3B,OAAO,CAAC,QAAQ,CAAC;IAmDpB;;OAEG;IACH,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ;IAIhD;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ;IA0CjE;;OAEG;YACW,SAAS;IAQvB;;;;;;OAMG;IACG,aAAa,CACjB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,GAC1B,OAAO,CAAC,IAAI,CAAC;CA0BjB;AAID,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC"}

package/dist/lib/session-cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cookie.js","sourceRoot":"","sources":["../../src/lib/session-cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AA8CxC,6EAA6E;AAC7E,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAEpD;;;;GAIG;AACH,SAAS,QAAQ,CACf,OAAe,EACf,QAA4B,EAC5B,IAAY;IAEZ,OAAO,GAAG,OAAO,IAAI,QAAQ,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,MAAM,CAAU,WAAW,GAAG,iBAAiB,CAAC;IACjD,sBAAsB,GAAG,KAAK,CAAC;IAC/B,uBAAuB,GAAG,KAAK,CAAC;IAEvC;;;;;OAKG;IACc,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEhE;;;;;;OAMG;IACK,SAAS,CACf,aAAqB,EACrB,IAAwB,EACxB,cAAuB;QAEvB,0DAA0D;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,iDAAiD;gBAC/C,oEAAoE,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QAC1D,IAAI,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,aAAa,CAAC;gBACzB,aAAa;gBACb,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,IAAI;aACL,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAA2B;QACxD,oDAAoD;QACpD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACjE,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,IAAY,EACZ,MAAc,EACd,IAAa;QAEb,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAClB,aAAqB,EACrB,MAAc,EACd,IAAa;QAEb,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,aAAa,CAAC,MAAe;QACnC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,MAAiC,CAAC;QAElD,8EAA8E;QAC9E,IACE,OAAO,CAAC,GAAG;YACX,OAAO,CAAC,MAAM;YACd,OAAO,CAAC,SAAS;YACjB,OAAO,CAAC,UAAU,EAClB,CAAC;YACD,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sCAAsC;QACtC,IACE,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAClC,OAAO,CAAC,MAAM;YACd,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YACjC,OAAO,CAAC,KAAK,EACb,CAAC;YACD,OAAO,OAA6B,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACd,OAAgB,EAChB,MAAc,EACd,GAA4B;QAE5B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,EAAE,YAAkC,CAAC;QACrD,MAAM,cAAc,GAAG,GAAG,EAAE,uBAA6C,CAAC;QAE1E,8CAA8C;QAC9C,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,sEAAsE;QACtE,IAAI,MAAM,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YAC9C,MAAM,CAAC,KAAK,CACV,sEAAsE,CACvE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,sBAAsB,GAAG,KAAK,CAAC;QACpC,IAAI,CAAC,uBAAuB,GAAG,KAAK,CAAC;QAErC,+CAA+C;QAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;YAEjE,+FAA+F;YAC/F,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;oBACnE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;oBAC7C,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;wBACpD,GAAG,EAAE,MAAM,CAAC,GAAG;wBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;qBAC1B,CAAC,CAAC;oBACH,oEAAoE;oBACpE,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;oBACtC,IAAI,CAAC;wBACH,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CACrC,CAAC;wBACtB,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC;4BACnB,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC;wBACrE,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,8DAA8D;oBAChE,CAAC;oBAED,MAAM,YAAY,GAAG,MAA4C,CAAC;oBAClE,OAAO;wBACL,MAAM,EAAE,MAAM,CAAC,GAAG;wBAClB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ;wBACtC,IAAI,EAAG,YAAY,CAAC,aAAa,CAAc,IAAI,UAAU;wBAC7D,SAAS;wBACT,UAAU,EACP,YAAY,CAAC,mBAAmB,CAAY,IAAI,IAAI;wBACvD,cAAc,EAAE,SAAS;wBACzB,OAAO,EACJ,YAAY,CAAC,gBAAgB,CAAa,IAAI,OAAO;qBACvC,CAAC;gBACtB,CAAC;gBAAC,OAAO,MAAM,EAAE,CAAC;oBAChB,MAAM,CAAC,KAAK,CACV,4EAA4E,EAC5E,MAAM,CACP,CAAC;oBACF,6CAA6C;gBAC/C,CAAC;YACH,CAAC;YAED,iFAAiF;YACjF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC7C,KAAK,EACL,MAAM,EACN,IAAI,EACJ,cAAc,CACf,CAAC;YAEF,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;oBACxD,IAAI,OAAO,EAAE,CAAC;wBACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;wBACvB,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;4BACjD,MAAM,CAAC,KAAK,CACV,4DAA4D,CAC7D,CAAC;4BACF,OAAO,IAAI,CAAC;wBACd,CAAC;wBACD,OAAO,OAAO,CAAC;oBACjB,CAAC;gBACH,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,CAAC,KAAK,CACV,4EAA4E,EAC5E,UAAU,CACX,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CACV,oEAAoE,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gFAAgF;QAChF,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAEhD,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QACjE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC;gBACnC,MAAM,CAAC,KAAK,CACV,+EAA+E,CAChF,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC7C,YAAY,EACZ,MAAM,EACN,IAAI,EACJ,cAAc,CACf,CAAC;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,mFAAmF,CACpF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,mBAAmB;YACnB,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACjD,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBACjD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,yCAAyC;YACzC,IAAI,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAChD,IAAI,MAAM,CAAC,wBAAwB,GAAG,CAAC,EAAE,CAAC;oBACxC,MAAM,iBAAiB,GAAG,MAAM,CAAC,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;oBACtE,MAAM,qBAAqB,GAAG,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;oBAC3D,IAAI,qBAAqB,GAAG,iBAAiB,EAAE,CAAC;wBAC9C,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;wBACnE,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iCAAiC;YACjC,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC;YAE7B,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,0BAA0B,CAAC,MAAe;QAChD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAiC,CAAC;QAClD,IACE,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAClC,OAAO,CAAC,MAAM;YACd,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YACjC,OAAO,CAAC,KAAK,EACb,CAAC;YACD,OAAO,OAA6B,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kBAAkB,CAC9B,KAAa,EACb,MAAc,EACd,IAAwB,EACxB,cAAkC;QAElC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,QAAkB,EAClB,OAAgB,EAChB,MAAc,EACd,YAAqB,EACrB,GAA4B;QAE5B,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CACd,QAAkB,EAClB,OAAgB,EAChB,MAAc,EACd,YAAqB,EACrB,GAA4B;QAE5B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,EAAE,YAAkC,CAAC;QACrD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CACzC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACvB,MAAM,EACN,IAAI,CACL,CAAC;QAEF,wEAAwE;QACxE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC;QAElD,mEAAmE;QACnE,IAAI,YAAoB,CAAC;QACzB,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAChD,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACtE,YAAY,GAAG,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;QAC9C,CAAC;QAED,mBAAmB;QACnB,8DAA8D;QAC9D,wEAAwE;QACxE,wDAAwD;QACxD,MAAM,WAAW,GAAG,CAAC,YAAY,IAAI,YAAY,KAAK,EAAE,CAAC;QACzD,MAAM,WAAW,GAAG,kBAAkB,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,EAAE;YAC5E,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YACtC,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,YAAY;YACpB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CACV,mDAAmD;YACjD,SAAS,CAAC,MAAM;YAChB,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CACN,CAAC;QAEF,sCAAsC;QACtC,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1D,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAEtD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,QAAkB;QACnC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,QAAkB,EAAE,YAAqB;QACpD,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE1D,+EAA+E;QAC/E,yEAAyE;QACzE,wFAAwF;QACxF,gEAAgE;QAChE,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAE5B,MAAM,UAAU,GAAG;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,MAAe;YACzB,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,OAAO;SACjB,CAAC;QAEF,yCAAyC;QACzC,WAAW,CAAC,OAAO,CAAC,MAAM,CACxB,YAAY,EACZ,kBAAkB,CAAC,UAAU,EAAE,EAAE,EAAE,UAAU,CAAC,CAC/C,CAAC;QAEF,+CAA+C;QAC/C,IAAI,YAAY,EAAE,CAAC;YACjB,WAAW,CAAC,OAAO,CAAC,MAAM,CACxB,YAAY,EACZ,kBAAkB,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAC5E,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,WAAW,CAAC,OAAO,CAAC,MAAM,CACxB,YAAY,EACZ,kBAAkB,CAAC,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,CAC9C,CAAC;QAEF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS,CAAC,KAAa;QACnC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,OAAgB,EAChB,GAA2B;QAE3B,MAAM,OAAO,GAAI,GAA6H,CAAC,oBAAoB,CAAC;QACpK,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,6BAA6B;QAEnD,yCAAyC;QACzC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,KAAK,GAAkB,IAAI,CAAC;QAEhC,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;gBAChD,KAAK,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;YACtD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO;QAEnB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9C,yDAAyD;QACzD,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,SAAS,EAAE,EAAE,GAAG,EAAE;YAC7C,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;;AAGH,iEAAiE;AACjE,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC"}

package/dist/lib/signup-metadata.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Signup-metadata capture (Surveillance-hardening Phase 0, E2 / P3).
+ *
+ * This module is the ONE choke point through which signup metadata is written.
+ * Every path that creates a `User` row (the Cognito PostConfirmation Lambda, the
+ * dev/test user-creation seam, and any future passwordless/invite path) MUST go
+ * through `signupUserData()` to populate `User.signupMethod` / `User.invitationId`
+ * and through `emitSignupSecurityEvent()` to record the client signals. Spreading
+ * this logic across call sites is a review-surface and data-minimization hazard
+ * (07-data-minimization.md): keep it here so there is exactly one place to audit.
+ *
+ * Data-minimization rules enforced here:
+ *
+ *  1. Client signals (IP / User-Agent) are NEVER written as columns on `User`.
+ *     They live only on a retention-bound `SecurityEvent` row (raw, deliberate —
+ *     security forensics), pruned by the hourly cron's `retentionUntil`
+ *     deleteMany. `retentionUntil` is NON-NULLABLE (P1): a missing bound would
+ *     escape pruning forever, exactly the unbounded client-metadata log the
+ *     threat model forbids. We always compute it from config.
+ *
+ *  2. A signup with no request context (e.g. a seed script) gets `signupMethod`
+ *     but NO fabricated IP/UA — we record only what actually exists.
+ *
+ *  3. Fail-open: the SecurityEvent write must never block account creation. A
+ *     telemetry failure is logged and swallowed; the user is still created.
+ *
+ * ── INVITATION-CHAIN INVARIANT (Phase 0, E2 — do not weaken) ──────────────────
+ * `User.invitationId` → `Invitation.createdBy` makes the who-invited-whom tree
+ * cheaply traversable. That is useful for Phase 2 cluster detection, but under
+ * legal compulsion it maps a community's entire introduction network
+ * (01-threat-landscape.md §4). The chain was already reconstructable via
+ * `Invitation.usedBy`; this FK only lowers the cost.
+ *
+ *   INVARIANT: NO API endpoint — user-facing OR admin — exposes transitive
+ *   invitation chains. Traversal of the invitation graph is reserved for the
+ *   Phase 2 detection path and nothing else. Whether to null out `invitationId`
+ *   after the detection window is an open Phase 2 decision (recorded there, not
+ *   silently resolved here).
+ * ──────────────────────────────────────────────────────────────────────────────
+ */
+import type { SignupMethod } from "@prisma/client";
+/**
+ * Default retention for `signup` SecurityEvents: 180 days. Longer than
+ * InteractionEvent (signup cohorts are the slowest-moving abuse signal) but
+ * still bounded. The exact number is config-driven per the threshold-secrecy
+ * invariant — see `env.SIGNUP_EVENT_RETENTION_DAYS`.
+ */
+export declare const DEFAULT_SIGNUP_EVENT_RETENTION_DAYS = 180;
+/** Minimal config surface this module needs (a slice of `Env`). */
+export interface SignupRetentionConfig {
+    /** Retention window in days for `signup` SecurityEvents. */
+    SIGNUP_EVENT_RETENTION_DAYS?: string | number;
+}
+/**
+ * Resolve the configured retention window for `signup` events, in days.
+ * Falls back to {@link DEFAULT_SIGNUP_EVENT_RETENTION_DAYS} when unset or
+ * non-positive / non-numeric (never returns an unbounded / zero retention).
+ */
+export declare function resolveSignupRetentionDays(config: SignupRetentionConfig | undefined): number;
+/** Compute the absolute `retentionUntil` date from config (now + N days). */
+export declare function computeSignupRetentionUntil(config: SignupRetentionConfig | undefined, now?: Date): Date;
+/** The signup-metadata fields written onto a new `User` row. */
+export interface SignupUserData {
+    signupMethod: SignupMethod;
+    /** Prisma `Invitation.id` redeemed at signup, or null when not invite-based. */
+    invitationId: string | null;
+}
+/**
+ * Build the `User`-row signup-metadata fragment. This is the ONLY place these
+ * two columns are populated. `invitationId` is set only for INVITE signups and
+ * must be a real `Invitation.id` (the FK is enforced at the DB; see schema).
+ */
+export declare function signupUserData(input: {
+    method: SignupMethod;
+    invitationId?: string | null;
+}): SignupUserData;
+/** Client signals captured for a signup, where a request context exists. */
+export interface SignupClientSignals {
+    /** Source IP, if a request context provided one (Lambda triggers may not). */
+    ipAddress?: string | null;
+    /** User-Agent, if present. */
+    userAgent?: string | null;
+}
+/**
+ * Minimal Prisma surface needed to write a SecurityEvent (test-friendly).
+ *
+ * `create` is intentionally loosely typed (`data: any`) so the real, far more
+ * strictly typed Prisma `securityEvent.create` (and a plain `vi.fn()` mock)
+ * both satisfy it. The concrete `data` shape is constrained where we build it
+ * in {@link emitSignupSecurityEvent}.
+ */
+export interface SecurityEventWriter {
+    securityEvent: {
+        create: (args: {
+            data: any;
+        }) => Promise<unknown>;
+    };
+}
+/** Minimal logger surface (console-style). */
+export interface SignupLogger {
+    warn: (...args: unknown[]) => void;
+}
+export interface EmitSignupEventInput {
+    db: SecurityEventWriter;
+    userId: string;
+    method: SignupMethod;
+    /** Prisma `Invitation.id` if INVITE, else null/undefined. */
+    invitationId?: string | null;
+    /** Tenant scope, if known at signup (personal/org tenant). */
+    tenantId?: string | null;
+    /** Client signals — omitted entirely when there is no request context. */
+    signals?: SignupClientSignals;
+    config: SignupRetentionConfig | undefined;
+    logger?: SignupLogger;
+    /** Injectable clock for deterministic tests. */
+    now?: Date;
+}
+/**
+ * Emit exactly one `signup`-type SecurityEvent for a freshly created user.
+ *
+ * FAIL-OPEN: any failure writing the event is logged and swallowed — account
+ * creation must never be blocked by telemetry. Callers MUST invoke this AFTER
+ * the user row is committed (so a telemetry hiccup can't roll back the signup).
+ *
+ * Returns `true` if the event was written, `false` if it failed (and was
+ * swallowed) — useful for tests / metrics, never to gate the signup.
+ */
+export declare function emitSignupSecurityEvent(input: EmitSignupEventInput): Promise<boolean>;
+//# sourceMappingURL=signup-metadata.d.ts.map

package/dist/lib/signup-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup-metadata.d.ts","sourceRoot":"","sources":["../../src/lib/signup-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,2BAA2B,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/C;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,qBAAqB,GAAG,SAAS,GACxC,MAAM,CAOR;AAED,6EAA6E;AAC7E,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,GAAG,GAAE,IAAiB,GACrB,IAAI,CAKN;AAED,gEAAgE;AAChE,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,YAAY,CAAC;IAC3B,gFAAgF;IAChF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,MAAM,EAAE,YAAY,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GAAG,cAAc,CAMjB;AAED,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE;QAEb,MAAM,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,GAAG,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KACnD,CAAC;CACH;AAED,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,mBAAmB,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC1C,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,gDAAgD;IAChD,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAgDlB"}

package/dist/lib/signup-metadata.js

@@ -0,0 +1,127 @@
+/**
+ * Signup-metadata capture (Surveillance-hardening Phase 0, E2 / P3).
+ *
+ * This module is the ONE choke point through which signup metadata is written.
+ * Every path that creates a `User` row (the Cognito PostConfirmation Lambda, the
+ * dev/test user-creation seam, and any future passwordless/invite path) MUST go
+ * through `signupUserData()` to populate `User.signupMethod` / `User.invitationId`
+ * and through `emitSignupSecurityEvent()` to record the client signals. Spreading
+ * this logic across call sites is a review-surface and data-minimization hazard
+ * (07-data-minimization.md): keep it here so there is exactly one place to audit.
+ *
+ * Data-minimization rules enforced here:
+ *
+ *  1. Client signals (IP / User-Agent) are NEVER written as columns on `User`.
+ *     They live only on a retention-bound `SecurityEvent` row (raw, deliberate —
+ *     security forensics), pruned by the hourly cron's `retentionUntil`
+ *     deleteMany. `retentionUntil` is NON-NULLABLE (P1): a missing bound would
+ *     escape pruning forever, exactly the unbounded client-metadata log the
+ *     threat model forbids. We always compute it from config.
+ *
+ *  2. A signup with no request context (e.g. a seed script) gets `signupMethod`
+ *     but NO fabricated IP/UA — we record only what actually exists.
+ *
+ *  3. Fail-open: the SecurityEvent write must never block account creation. A
+ *     telemetry failure is logged and swallowed; the user is still created.
+ *
+ * ── INVITATION-CHAIN INVARIANT (Phase 0, E2 — do not weaken) ──────────────────
+ * `User.invitationId` → `Invitation.createdBy` makes the who-invited-whom tree
+ * cheaply traversable. That is useful for Phase 2 cluster detection, but under
+ * legal compulsion it maps a community's entire introduction network
+ * (01-threat-landscape.md §4). The chain was already reconstructable via
+ * `Invitation.usedBy`; this FK only lowers the cost.
+ *
+ *   INVARIANT: NO API endpoint — user-facing OR admin — exposes transitive
+ *   invitation chains. Traversal of the invitation graph is reserved for the
+ *   Phase 2 detection path and nothing else. Whether to null out `invitationId`
+ *   after the detection window is an open Phase 2 decision (recorded there, not
+ *   silently resolved here).
+ * ──────────────────────────────────────────────────────────────────────────────
+ */
+/**
+ * Default retention for `signup` SecurityEvents: 180 days. Longer than
+ * InteractionEvent (signup cohorts are the slowest-moving abuse signal) but
+ * still bounded. The exact number is config-driven per the threshold-secrecy
+ * invariant — see `env.SIGNUP_EVENT_RETENTION_DAYS`.
+ */
+export const DEFAULT_SIGNUP_EVENT_RETENTION_DAYS = 180;
+/**
+ * Resolve the configured retention window for `signup` events, in days.
+ * Falls back to {@link DEFAULT_SIGNUP_EVENT_RETENTION_DAYS} when unset or
+ * non-positive / non-numeric (never returns an unbounded / zero retention).
+ */
+export function resolveSignupRetentionDays(config) {
+    const raw = config?.SIGNUP_EVENT_RETENTION_DAYS;
+    const parsed = typeof raw === "number" ? raw : Number.parseInt(String(raw ?? ""), 10);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        return DEFAULT_SIGNUP_EVENT_RETENTION_DAYS;
+    }
+    return parsed;
+}
+/** Compute the absolute `retentionUntil` date from config (now + N days). */
+export function computeSignupRetentionUntil(config, now = new Date()) {
+    const days = resolveSignupRetentionDays(config);
+    const date = new Date(now.getTime());
+    date.setDate(date.getDate() + days);
+    return date;
+}
+/**
+ * Build the `User`-row signup-metadata fragment. This is the ONLY place these
+ * two columns are populated. `invitationId` is set only for INVITE signups and
+ * must be a real `Invitation.id` (the FK is enforced at the DB; see schema).
+ */
+export function signupUserData(input) {
+    return {
+        signupMethod: input.method,
+        // Only INVITE signups carry an invitation FK; never fabricate one.
+        invitationId: input.method === "INVITE" ? input.invitationId ?? null : null,
+    };
+}
+/**
+ * Emit exactly one `signup`-type SecurityEvent for a freshly created user.
+ *
+ * FAIL-OPEN: any failure writing the event is logged and swallowed — account
+ * creation must never be blocked by telemetry. Callers MUST invoke this AFTER
+ * the user row is committed (so a telemetry hiccup can't roll back the signup).
+ *
+ * Returns `true` if the event was written, `false` if it failed (and was
+ * swallowed) — useful for tests / metrics, never to gate the signup.
+ */
+export async function emitSignupSecurityEvent(input) {
+    const { db, userId, method, invitationId, tenantId, signals, config, logger, now, } = input;
+    try {
+        const retentionUntil = computeSignupRetentionUntil(config, now);
+        await db.securityEvent.create({
+            data: {
+                type: "signup",
+                // `signup` is a low-severity informational forensic record, not an alert.
+                severity: "low",
+                userId,
+                tenantId: tenantId ?? null,
+                // No fabricated client signals: only what the request context actually
+                // carried. Lambda triggers (Cognito PostConfirmation) expose no source
+                // IP/UA, so these stay null there.
+                ipAddress: signals?.ipAddress ?? null,
+                userAgent: signals?.userAgent ?? null,
+                details: JSON.stringify({
+                    signupMethod: method,
+                    invitationId: invitationId ?? null,
+                }),
+                // NON-NULLABLE (P1): always set, config-driven.
+                retentionUntil,
+            },
+        });
+        return true;
+    }
+    catch (error) {
+        // FAIL-OPEN — log and continue. The user is already created.
+        (logger ?? console).warn(JSON.stringify({
+            event: "signup.security_event_failed",
+            userId,
+            signupMethod: method,
+            reason: error.name ?? "unknown",
+        }));
+        return false;
+    }
+}
+//# sourceMappingURL=signup-metadata.js.map

package/dist/lib/signup-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup-metadata.js","sourceRoot":"","sources":["../../src/lib/signup-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAQvD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAyC;IAEzC,MAAM,GAAG,GAAG,MAAM,EAAE,2BAA2B,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,mCAAmC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,2BAA2B,CACzC,MAAyC,EACzC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,IAAI,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAG9B;IACC,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,mEAAmE;QACnE,YAAY,EAAE,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;KAC5E,CAAC;AACJ,CAAC;AA8CD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAA2B;IAE3B,MAAM,EACJ,EAAE,EACF,MAAM,EACN,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,MAAM,EACN,MAAM,EACN,GAAG,GACJ,GAAG,KAAK,CAAC;IAEV,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,2BAA2B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;YAC5B,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,0EAA0E;gBAC1E,QAAQ,EAAE,KAAK;gBACf,MAAM;gBACN,QAAQ,EAAE,QAAQ,IAAI,IAAI;gBAC1B,uEAAuE;gBACvE,uEAAuE;gBACvE,mCAAmC;gBACnC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;gBACrC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;gBACrC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;oBACtB,YAAY,EAAE,MAAM;oBACpB,YAAY,EAAE,YAAY,IAAI,IAAI;iBACnC,CAAC;gBACF,gDAAgD;gBAChD,cAAc;aACf;SACF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6DAA6D;QAC7D,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,CACtB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,8BAA8B;YACrC,MAAM;YACN,YAAY,EAAE,MAAM;YACpB,MAAM,EAAG,KAA2B,CAAC,IAAI,IAAI,SAAS;SACvD,CAAC,CACH,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/lib/sso-auth-handler.js

@@ -1,12 +1,9 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SSOAuthHandler = void 0;
 /**
  * SSO Auth Handler stub — legacy Supabase/SAML SSO is no longer supported.
  * Authentication is handled by AWS Cognito + Amplify SDK.
  * This stub exists to satisfy test mocks that reference this module.
  */
-class SSOAuthHandler {
+export class SSOAuthHandler {
     async initiateSSO(..._args) {
         return new Response(JSON.stringify({ error: "Deprecated" }), { status: 410 });
     }
@@ -20,5 +17,4 @@ class SSOAuthHandler {
         return new Response(JSON.stringify({ error: "Deprecated" }), { status: 410 });
     }
 }
-exports.SSOAuthHandler = SSOAuthHandler;
 //# sourceMappingURL=sso-auth-handler.js.map

package/dist/lib/sso-auth-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-auth-handler.js","sourceRoot":"","sources":["../../src/lib/sso-auth-handler.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,MAAa,cAAc;IACzB,KAAK,CAAC,WAAW,CAAC,GAAG,KAAgB;QACnC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,GAAG,KAAgB;QACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,GAAG,KAAgB;QACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,mBAAmB,CAAC,GAAG,KAAgB;QAC3C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;CACF;AAbD,wCAaC"}
+{"version":3,"file":"sso-auth-handler.js","sourceRoot":"","sources":["../../src/lib/sso-auth-handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,cAAc;IACzB,KAAK,CAAC,WAAW,CAAC,GAAG,KAAgB;QACnC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,GAAG,KAAgB;QACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,GAAG,KAAgB;QACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,mBAAmB,CAAC,GAAG,KAAgB;QAC3C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;CACF"}

package/dist/lib/tag-suggestions-handler.d.ts

@@ -4,7 +4,7 @@
  * Provides tag suggestions for posts based on content analysis.
  * Currently implements keyword-based suggestions; ML-based suggestions can be added later.
  */
-import { TaxonomyHandler } from "./taxonomy-handler";
+import { TaxonomyHandler } from "./taxonomy-handler.js";
 export interface TagSuggestion {
     taxonId: string;
     displayName: string;

package/dist/lib/tag-suggestions-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tag-suggestions-handler.d.ts","sourceRoot":"","sources":["../../src/lib/tag-suggestions-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,eAAe,CAAkB;gBAE7B,eAAe,EAAE,eAAe;IAI5C;;;;;;OAMG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;KACnB,GACL,OAAO,CAAC,aAAa,EAAE,CAAC;IAsF3B;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0EvB;;;;;OAKG;IACG,cAAc,CAAC,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAMlE;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAW,GACjB,OAAO,CAAC,aAAa,EAAE,CAAC;CAK5B"}
+{"version":3,"file":"tag-suggestions-handler.d.ts","sourceRoot":"","sources":["../../src/lib/tag-suggestions-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,eAAe,CAAkB;gBAE7B,eAAe,EAAE,eAAe;IAI5C;;;;;;OAMG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;KACnB,GACL,OAAO,CAAC,aAAa,EAAE,CAAC;IAsF3B;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0EvB;;;;;OAKG;IACG,cAAc,CAAC,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAMlE;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAW,GACjB,OAAO,CAAC,aAAa,EAAE,CAAC;CAK5B"}

package/dist/lib/tag-suggestions-handler.js

@@ -1,13 +1,10 @@
-"use strict";
 /**
  * Tag Suggestions Handler
  *
  * Provides tag suggestions for posts based on content analysis.
  * Currently implements keyword-based suggestions; ML-based suggestions can be added later.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TagSuggestionsHandler = void 0;
-class TagSuggestionsHandler {
+export class TagSuggestionsHandler {
     taxonomyHandler;
     constructor(taxonomyHandler) {
         this.taxonomyHandler = taxonomyHandler;
@@ -191,5 +188,4 @@ class TagSuggestionsHandler {
         return [];
     }
 }
-exports.TagSuggestionsHandler = TagSuggestionsHandler;
 //# sourceMappingURL=tag-suggestions-handler.js.map

package/dist/lib/tag-suggestions-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"tag-suggestions-handler.js","sourceRoot":"","sources":["../../src/lib/tag-suggestions-handler.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAaH,MAAa,qBAAqB;IACxB,eAAe,CAAkB;IAEzC,YAAY,eAAgC;QAC1C,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,QAAgB,EAChB,UAGI,EAAE;QAEN,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC;QAEnD,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEhD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,sCAAsC;QACtC,MAAM,WAAW,GAAoB,EAAE,CAAC;QAExC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,0CAA0C;YAC1C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,EAAE;gBACtE,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;YAEH,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,2CAA2C;gBAC3C,IAAI,UAAU,GAAG,GAAG,CAAC,CAAC,kBAAkB;gBACxC,IAAI,MAAM,GAAG,oBAAoB,OAAO,GAAG,CAAC;gBAE5C,mDAAmD;gBACnD,IAAI,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBACpE,UAAU,GAAG,GAAG,CAAC;oBACjB,MAAM,GAAG,0BAA0B,OAAO,GAAG,CAAC;gBAChD,CAAC;gBAED,wCAAwC;gBACxC,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAoB,CAAC;oBAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;wBACpE,UAAU,GAAG,GAAG,CAAC;wBACjB,MAAM,GAAG,mBAAmB,OAAO,GAAG,CAAC;oBACzC,CAAC;gBACH,CAAC;gBAED,0CAA0C;gBAC1C,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;oBACtD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAqB,CAAC;oBAC9C,IACE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,EAChE,CAAC;wBACD,UAAU,GAAG,IAAI,CAAC;wBAClB,MAAM,GAAG,qBAAqB,OAAO,GAAG,CAAC;oBAC3C,CAAC;gBACH,CAAC;gBAED,gDAAgD;gBAChD,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CACnC,CAAC;gBAEF,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;oBACvB,8BAA8B;oBAC9B,IAAI,UAAU,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC;wBACvD,WAAW,CAAC,aAAa,CAAC,GAAG;4BAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;4BACtB,WAAW,EAAE,KAAK,CAAC,WAAW;4BAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;4BAC9B,UAAU;4BACV,MAAM;yBACP,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC;wBACf,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC9B,UAAU;wBACV,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,aAAa,CAAC;aAC5C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;aAC3C,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,IAAY;QAClC,kCAAkC;QAClC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;YACxB,KAAK;YACL,GAAG;YACH,IAAI;YACJ,KAAK;YACL,IAAI;YACJ,KAAK;YACL,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,KAAK;YACL,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,IAAI;YACJ,KAAK;YACL,KAAK;YACL,MAAM;YACN,MAAM;YACN,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,IAAI;YACJ,MAAM;YACN,KAAK;YACL,MAAM;YACN,OAAO;YACP,OAAO;YACP,QAAQ;YACR,KAAK;YACL,OAAO;YACP,MAAM;YACN,KAAK;YACL,MAAM;YACN,MAAM;YACN,OAAO;YACP,OAAO;YACP,GAAG;YACH,KAAK;YACL,IAAI;YACJ,KAAK;YACL,IAAI;YACJ,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,OAAO;YACP,IAAI;YACJ,KAAK;YACL,IAAI;YACJ,MAAM;SACP,CAAC,CAAC;QAEH,sDAAsD;QACtD,MAAM,KAAK,GAAG,IAAI;aACf,WAAW,EAAE;aACb,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,kCAAkC;aAC5D,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAE9D,+BAA+B;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE;QACrC,2CAA2C;QAC3C,kEAAkE;QAClE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,MAAc,EACd,QAAgB,EAAE;QAElB,8CAA8C;QAC9C,uEAAuE;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AArND,sDAqNC"}
+{"version":3,"file":"tag-suggestions-handler.js","sourceRoot":"","sources":["../../src/lib/tag-suggestions-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,MAAM,OAAO,qBAAqB;IACxB,eAAe,CAAkB;IAEzC,YAAY,eAAgC;QAC1C,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,QAAgB,EAChB,UAGI,EAAE;QAEN,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC;QAEnD,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEhD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,sCAAsC;QACtC,MAAM,WAAW,GAAoB,EAAE,CAAC;QAExC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,0CAA0C;YAC1C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,EAAE;gBACtE,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;YAEH,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,2CAA2C;gBAC3C,IAAI,UAAU,GAAG,GAAG,CAAC,CAAC,kBAAkB;gBACxC,IAAI,MAAM,GAAG,oBAAoB,OAAO,GAAG,CAAC;gBAE5C,mDAAmD;gBACnD,IAAI,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBACpE,UAAU,GAAG,GAAG,CAAC;oBACjB,MAAM,GAAG,0BAA0B,OAAO,GAAG,CAAC;gBAChD,CAAC;gBAED,wCAAwC;gBACxC,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAoB,CAAC;oBAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;wBACpE,UAAU,GAAG,GAAG,CAAC;wBACjB,MAAM,GAAG,mBAAmB,OAAO,GAAG,CAAC;oBACzC,CAAC;gBACH,CAAC;gBAED,0CAA0C;gBAC1C,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;oBACtD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAqB,CAAC;oBAC9C,IACE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,EAChE,CAAC;wBACD,UAAU,GAAG,IAAI,CAAC;wBAClB,MAAM,GAAG,qBAAqB,OAAO,GAAG,CAAC;oBAC3C,CAAC;gBACH,CAAC;gBAED,gDAAgD;gBAChD,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CACnC,CAAC;gBAEF,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;oBACvB,8BAA8B;oBAC9B,IAAI,UAAU,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC;wBACvD,WAAW,CAAC,aAAa,CAAC,GAAG;4BAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;4BACtB,WAAW,EAAE,KAAK,CAAC,WAAW;4BAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;4BAC9B,UAAU;4BACV,MAAM;yBACP,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC;wBACf,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC9B,UAAU;wBACV,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,aAAa,CAAC;aAC5C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;aAC3C,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,IAAY;QAClC,kCAAkC;QAClC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;YACxB,KAAK;YACL,GAAG;YACH,IAAI;YACJ,KAAK;YACL,IAAI;YACJ,KAAK;YACL,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,KAAK;YACL,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,IAAI;YACJ,KAAK;YACL,KAAK;YACL,MAAM;YACN,MAAM;YACN,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,IAAI;YACJ,MAAM;YACN,KAAK;YACL,MAAM;YACN,OAAO;YACP,OAAO;YACP,QAAQ;YACR,KAAK;YACL,OAAO;YACP,MAAM;YACN,KAAK;YACL,MAAM;YACN,MAAM;YACN,OAAO;YACP,OAAO;YACP,GAAG;YACH,KAAK;YACL,IAAI;YACJ,KAAK;YACL,IAAI;YACJ,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,OAAO;YACP,IAAI;YACJ,KAAK;YACL,IAAI;YACJ,MAAM;SACP,CAAC,CAAC;QAEH,sDAAsD;QACtD,MAAM,KAAK,GAAG,IAAI;aACf,WAAW,EAAE;aACb,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,kCAAkC;aAC5D,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAE9D,+BAA+B;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE;QACrC,2CAA2C;QAC3C,kEAAkE;QAClE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,MAAc,EACd,QAAgB,EAAE;QAElB,8CAA8C;QAC9C,uEAAuE;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}