@secfn/core 0.0.1 → 0.0.2

package/README.md

@@ -1,334 +1,42 @@
-# SecFn
+# @secfn/core
 
-> Comprehensive self-hosted security platform for developers
+Core contracts and pure utilities for SecFn V1.
 
-SecFn is a developer-first security solution that combines vulnerability scanning, access control, secrets management, and security monitoring into a single self-hosted platform.
+`@secfn/core` intentionally contains no database adapter, HTTP router, or framework integration. It provides the shared types that `@secfn/server`, `@secfn/runtime`, and `@secfn/cli` build on.
 
-## Features
+## Exports
 
-- 🔐 **Secrets Vault** - AES-256-GCM encrypted secret storage with rotation and access logging
-- 🔍 **Secret Scanning** - Pattern-based detection of 20+ secret types in code and git history
-- 🛡️ **Access Control** - Role-based permissions (RBAC) with caching and inheritance
-- ⏱️ **Rate Limiting** - Token bucket algorithm with multi-level limits
-- 📊 **Security Monitoring** - Event logging, metrics, and anomaly detection
-- 🗄️ **Self-Hosted** - IndexedDB storage, no external dependencies
-- 🚀 **Developer-Friendly** - Simple API, TypeScript support, works locally
+- Encryption primitives using AES-256-GCM with per-record IV and salt.
+- `KeyProvider` and `createStaticKeyProvider` for default env/master-key workflows.
+- AAD helpers binding encrypted versions to tenant, namespace, secret id, and version.
+- Scanner interfaces, default secret rule pack, scanner engine, and table/JSON/SARIF reporters.
+- RBAC, audit event, secret, service token, runtime, and server config types.
+- `SecFnError` variants.
+- `getSecFnSchema()` for `@superfunctions/db` schema discovery.
 
-## Installation
+## Example
 
-```bash
-npm install secfn
-```
-
-## Quick Start
-
-```typescript
-import { createSecFn } from 'secfn';
-
-const secFn = createSecFn({
-  namespace: 'my-app',
-  masterKey: process.env.MASTER_KEY,
-});
-
-await secFn.initialize();
-
-const vault = secFn.createSecretsVault();
-await vault.set('api_key', 'secret-value', {
-  tags: ['production'],
-  environment: 'production',
-});
-
-const secret = await vault.get('api_key');
-console.log('Retrieved:', secret);
-
-await secFn.destroy();
-```
-
-## Core Components
-
-### 1. Secrets Vault
+```ts
+import {
+  buildSecretAad,
+  createStaticKeyProvider,
+  decryptSecret,
+  encryptSecret,
+  getSecFnSchema,
+} from "@secfn/core";
 
-Encrypted storage and management of application secrets.
+const keyProvider = createStaticKeyProvider(process.env.SECFN_MASTER_KEY!, "env:main");
 
-```typescript
-const vault = secFn.createSecretsVault();
-
-await vault.set('stripe_api_key', 'sk_live_...', {
-  tags: ['payment', 'production'],
-  environment: 'production',
-  expiresAt: Date.now() + 90 * 24 * 60 * 60 * 1000,
-  rotateEvery: 90 * 24 * 60 * 60 * 1000,
+const aad = buildSecretAad({
+  tenantId: "acme",
+  namespace: "web",
+  secretId: "secret_123",
+  version: 1,
 });
 
-const key = await vault.get('stripe_api_key');
-
-const secrets = await vault.list({ environment: 'production' });
-
-await vault.rotate('stripe_api_key', 'sk_live_new...');
-
-const accessLog = await vault.getAccessLog('stripe_api_key', 100);
+const encrypted = await encryptSecret("plain", keyProvider, aad);
+const plain = await decryptSecret(encrypted, keyProvider, aad);
+const schema = getSecFnSchema();
 ```
 
-### 2. Secret Scanner
-
-Detect hardcoded secrets in source code with 20+ built-in patterns.
-
-```typescript
-const scanner = secFn.createSecretScanner({
-  excludePaths: ['node_modules/**', 'dist/**'],
-  minEntropy: 3.5,
-});
-
-const results = await scanner.scanDirectory('./src');
-
-results.forEach(result => {
-  console.log(`${result.severity}: ${result.pattern} in ${result.file}:${result.line}`);
-  console.log(`  Match: ${result.redactedMatch}`);
-});
-
-const gitResults = await scanner.scanGitHistory({
-  branch: 'main',
-  commits: 100,
-});
-
-scanner.addPattern({
-  name: 'Custom Secret',
-  pattern: /custom_secret_[a-zA-Z0-9]{32}/g,
-  entropy: 4.0,
-  description: 'Custom application secret',
-  severity: 'high',
-});
-```
-
-**Built-in Secret Patterns:**
-- AWS Access Keys, Secret Keys
-- GitHub Tokens
-- Stripe API Keys
-- OpenAI & Anthropic API Keys
-- Google API Keys
-- Slack Tokens
-- NPM Tokens
-- JWT Tokens
-- Database Connection Strings
-- Private Keys (RSA, OpenSSH, DSA, EC, PGP)
-- And many more...
-
-### 3. Access Control (RBAC)
-
-Fine-grained role-based access control with permission caching.
-
-```typescript
-const access = secFn.createAccessControl();
-
-await access.createRole({
-  name: 'editor',
-  description: 'Can edit projects and files',
-  permissions: ['project:read', 'project:write', 'file:read', 'file:write'],
-});
-
-await access.createRole({
-  name: 'admin',
-  description: 'Full system access',
-  permissions: ['*:*'],
-});
-
-await access.assignRole('user_123', 'editor', {
-  resourceIds: ['project_abc', 'project_def'],
-});
-
-const allowed = await access.check({
-  userId: 'user_123',
-  action: 'project:write',
-  resourceId: 'project_abc',
-});
-
-const permissions = await access.getUserPermissions('user_123');
-```
-
-### 4. Rate Limiting
-
-Protect against brute force and API abuse with token bucket algorithm.
-
-```typescript
-const limiter = secFn.createRateLimiter({
-  rules: {
-    global: { requests: 1000, window: 60000 },
-    perUser: { requests: 100, window: 60000 },
-    perIP: { requests: 50, window: 60000, blockDuration: 300000 },
-    perEndpoint: {
-      '/api/login': { requests: 5, window: 300000 },
-      '/api/search': { requests: 100, window: 60000 },
-    },
-  },
-  onLimitExceeded: async (violation) => {
-    console.warn(`Rate limit exceeded for ${violation.ip}`);
-  },
-});
-
-const result = await limiter.check({
-  userId: 'user_123',
-  ip: '192.168.1.1',
-  endpoint: '/api/search',
-});
-
-if (!result.allowed) {
-  throw new Error(`Rate limit exceeded. Retry after ${result.retryAfter}ms`);
-}
-
-await limiter.resetUser('user_123');
-await limiter.unblock('ip:192.168.1.1');
-```
-
-### 5. Security Monitoring
-
-Comprehensive event logging with metrics and anomaly detection.
-
-```typescript
-const monitoring = secFn.createMonitoring({
-  retention: 90 * 24 * 60 * 60 * 1000,
-  anomalyDetection: {
-    enabled: true,
-    sensitivity: 0.8,
-  },
-});
-
-await monitoring.logEvent({
-  type: 'auth_failure',
-  severity: 'medium',
-  userId: 'user_123',
-  ip: '192.168.1.1',
-  resource: '/api/login',
-  action: 'login',
-  metadata: {
-    reason: 'invalid_password',
-    attemptCount: 3,
-  },
-});
-
-const events = await monitoring.queryEvents({
-  type: 'auth_failure',
-  severity: ['high', 'critical'],
-  startDate: Date.now() - 24 * 60 * 60 * 1000,
-});
-
-const metrics = await monitoring.getMetrics({
-  start: Date.now() - 7 * 24 * 60 * 60 * 1000,
-  end: Date.now(),
-});
-
-console.log('Total events:', metrics.totalEvents);
-console.log('Events by type:', metrics.eventsByType);
-console.log('Anomalies:', metrics.anomalies);
-
-await monitoring.resolveEvent('event_123', {
-  resolvedBy: 'admin_456',
-  notes: 'False positive',
-});
-```
-
-## Storage
-
-SecFn uses IndexedDB for browser/local storage with no external dependencies.
-
-```typescript
-const secFn = createSecFn({
-  storage: {
-    type: 'indexeddb',
-    dbName: 'my-app-security',
-    retentionDays: 90,
-  },
-});
-```
-
-**Storage Schema:**
-- `secfn_secrets` - Encrypted secrets
-- `secfn_secret_access` - Access logs
-- `secfn_roles` - Role definitions
-- `secfn_user_roles` - User-role assignments
-- `secfn_security_events` - Security events
-- `secfn_rate_limits` - Rate limit tracking
-- `secfn_scan_results` - Secret scan results
-
-## Performance
-
-**V0 Benchmarks:**
-- Scan 10,000 files for secrets: <10s
-- Rate limit check: <5ms
-- Access control check: <10ms (with cache)
-- Log 1,000 security events: <500ms
-- Query 10,000 events: <100ms
-- Encrypt/decrypt secret: <10ms
-
-## Examples
-
-See `examples/basic-usage.ts` for a comprehensive demonstration of all features.
-
-```bash
-npm run build
-node dist/examples/basic-usage.js
-```
-
-## Development
-
-```bash
-npm install
-
-npm run build
-
-npm run build:watch
-
-npm test
-
-npm run test:watch
-
-npm run test:coverage
-
-npm run typecheck
-
-npm run lint
-```
-
-## Architecture
-
-```
-secfn/
-├── storage/           # IndexedDB persistence
-├── secrets/           # Vault & encryption
-├── scanning/          # Secret detection
-├── access-control/    # RBAC system
-├── rate-limiting/     # Request throttling
-├── monitoring/        # Event logging
-└── core/              # Main orchestrator
-```
-
-## Security Best Practices
-
-1. **Master Key**: Always use a strong, randomly generated master key in production
-2. **Rotation**: Enable automatic secret rotation for sensitive credentials
-3. **Monitoring**: Review security events and anomalies regularly
-4. **Access Control**: Apply principle of least privilege
-5. **Rate Limiting**: Configure appropriate limits for your use case
-6. **Scanning**: Integrate secret scanning into your CI/CD pipeline
-
-## Roadmap
-
-- [ ] File system storage backend
-- [ ] Database adapter support (@superfunctions/db)
-- [ ] Vulnerability scanning (SQL injection, XSS, etc.)
-- [ ] Security middleware for Express/Hono/Fastify
-- [ ] HTML security dashboard
-- [ ] CLI tools
-- [ ] Real-time alert notifications
-- [ ] Advanced anomaly detection with ML
-
-## License
-
-MIT
-
-## Contributing
-
-Contributions welcome! This is part of the super-functions ecosystem.
-
-## Support
-
-For issues and questions, please open an issue on GitHub.
+Production storage, admin routes, runtime routes, RBAC services, rate limiting, and audit persistence live in `@secfn/server`.

package/dist/encryption.d.ts

@@ -0,0 +1,8 @@
+import type { EncryptedSecretPayload, KeyProvider, SecretAadInput } from "./types.js";
+export declare function createStaticKeyProvider(secret: string | Uint8Array, keyId?: string): KeyProvider;
+export declare function buildSecretAad(input: SecretAadInput): string;
+export declare function encryptSecret(plaintext: string, keyProvider: KeyProvider, aad: string): Promise<EncryptedSecretPayload>;
+export declare function decryptSecret(payload: EncryptedSecretPayload, keyProvider: KeyProvider, aad: string): Promise<string>;
+export declare function hashToken(token: string): string;
+export declare function verifyTokenHash(token: string, expectedHash: string): boolean;
+//# sourceMappingURL=encryption.d.ts.map

package/dist/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../src/encryption.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,sBAAsB,EAEtB,WAAW,EACX,cAAc,EACf,MAAM,YAAY,CAAC;AAQpB,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,KAAK,SAAY,GAAG,WAAW,CAInG;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAO5D;AAED,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,WAAW,EACxB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,sBAAsB,CAAC,CAqBjC;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,sBAAsB,EAC/B,WAAW,EAAE,WAAW,EACxB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAI5E"}

package/dist/encryption.js

@@ -0,0 +1,76 @@
+import { createCipheriv, createDecipheriv, pbkdf2Sync, randomBytes, timingSafeEqual, createHash, } from "node:crypto";
+import { SecFnEncryptionError } from "./errors.js";
+const ALGORITHM = "aes-256-gcm";
+const ITERATIONS = 210_000;
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+const SALT_LENGTH = 16;
+export function createStaticKeyProvider(secret, keyId = "default") {
+    return {
+        resolveKey: () => ({ keyId, secret }),
+    };
+}
+export function buildSecretAad(input) {
+    return JSON.stringify({
+        tenantId: input.tenantId ?? null,
+        namespace: input.namespace ?? null,
+        secretId: input.secretId,
+        version: input.version,
+    });
+}
+export async function encryptSecret(plaintext, keyProvider, aad) {
+    const material = await keyProvider.resolveKey({ purpose: "encrypt" });
+    const salt = randomBytes(SALT_LENGTH);
+    const iv = randomBytes(IV_LENGTH);
+    const key = deriveKey(material, salt);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    cipher.setAAD(Buffer.from(aad, "utf8"));
+    const ciphertext = Buffer.concat([
+        cipher.update(plaintext, "utf8"),
+        cipher.final(),
+    ]);
+    return {
+        algorithm: "AES-256-GCM",
+        keyId: material.keyId,
+        iv: iv.toString("base64url"),
+        salt: salt.toString("base64url"),
+        authTag: cipher.getAuthTag().toString("base64url"),
+        ciphertext: ciphertext.toString("base64url"),
+    };
+}
+export async function decryptSecret(payload, keyProvider, aad) {
+    try {
+        const material = await keyProvider.resolveKey({
+            keyId: payload.keyId,
+            purpose: "decrypt",
+        });
+        const key = deriveKey(material, Buffer.from(payload.salt, "base64url"));
+        const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(payload.iv, "base64url"));
+        decipher.setAAD(Buffer.from(aad, "utf8"));
+        decipher.setAuthTag(Buffer.from(payload.authTag, "base64url"));
+        return Buffer.concat([
+            decipher.update(Buffer.from(payload.ciphertext, "base64url")),
+            decipher.final(),
+        ]).toString("utf8");
+    }
+    catch (error) {
+        throw new SecFnEncryptionError("Secret decryption failed", {
+            cause: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+export function hashToken(token) {
+    return createHash("sha256").update(token, "utf8").digest("hex");
+}
+export function verifyTokenHash(token, expectedHash) {
+    const actual = Buffer.from(hashToken(token), "hex");
+    const expected = Buffer.from(expectedHash, "hex");
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+function deriveKey(material, salt) {
+    const secret = typeof material.secret === "string"
+        ? Buffer.from(material.secret, "utf8")
+        : Buffer.from(material.secret);
+    return pbkdf2Sync(secret, salt, ITERATIONS, KEY_LENGTH, "sha256");
+}
+//# sourceMappingURL=encryption.js.map

package/dist/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../src/encryption.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,eAAe,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAQnD,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,UAAU,GAAG,OAAO,CAAC;AAC3B,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,UAAU,uBAAuB,CAAC,MAA2B,EAAE,KAAK,GAAG,SAAS;IACpF,OAAO;QACL,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,WAAwB,EACxB,GAAW;IAEX,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAExC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,OAAO;QACL,SAAS,EAAE,aAAa;QACxB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClD,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA+B,EAC/B,WAAwB,EACxB,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC;YAC5C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,SAAS,EACT,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CACrC,CAAC;QACF,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1C,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAE/D,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAC7D,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,EAAE;YACzD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,YAAoB;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,QAAqB,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;QAChD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACpE,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,24 @@
+export declare class SecFnError extends Error {
+    readonly code: string;
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(message: string, code: string, details?: Record<string, unknown> | undefined);
+}
+export declare class SecFnConfigError extends SecFnError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
+export declare class SecFnUnauthorizedError extends SecFnError {
+    constructor(message?: string, details?: Record<string, unknown>);
+}
+export declare class SecFnForbiddenError extends SecFnError {
+    constructor(message?: string, details?: Record<string, unknown>);
+}
+export declare class SecFnNotFoundError extends SecFnError {
+    constructor(message?: string, details?: Record<string, unknown>);
+}
+export declare class SecFnValidationError extends SecFnError {
+    constructor(message?: string, details?: Record<string, unknown>);
+}
+export declare class SecFnEncryptionError extends SecFnError {
+    constructor(message?: string, details?: Record<string, unknown>);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,UAAW,SAAQ,KAAK;IAGjC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAF1C,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAK7C;AAED,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED,qBAAa,sBAAuB,SAAQ,UAAU;gBACxC,OAAO,SAAiB,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAIxE;AAED,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,OAAO,SAAc,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAIrE;AAED,qBAAa,kBAAmB,SAAQ,UAAU;gBACpC,OAAO,SAAc,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAIrE;AAED,qBAAa,oBAAqB,SAAQ,UAAU;gBACtC,OAAO,SAAkB,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAIzE;AAED,qBAAa,oBAAqB,SAAQ,UAAU;gBACtC,OAAO,SAA6B,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAIpF"}

package/dist/errors.js

@@ -0,0 +1,47 @@
+export class SecFnError extends Error {
+    code;
+    details;
+    constructor(message, code, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = "SecFnError";
+    }
+}
+export class SecFnConfigError extends SecFnError {
+    constructor(message, details) {
+        super(message, "SECFN_CONFIG_INVALID", details);
+        this.name = "SecFnConfigError";
+    }
+}
+export class SecFnUnauthorizedError extends SecFnError {
+    constructor(message = "Unauthorized", details) {
+        super(message, "SECFN_UNAUTHORIZED", details);
+        this.name = "SecFnUnauthorizedError";
+    }
+}
+export class SecFnForbiddenError extends SecFnError {
+    constructor(message = "Forbidden", details) {
+        super(message, "SECFN_FORBIDDEN", details);
+        this.name = "SecFnForbiddenError";
+    }
+}
+export class SecFnNotFoundError extends SecFnError {
+    constructor(message = "Not found", details) {
+        super(message, "SECFN_NOT_FOUND", details);
+        this.name = "SecFnNotFoundError";
+    }
+}
+export class SecFnValidationError extends SecFnError {
+    constructor(message = "Invalid input", details) {
+        super(message, "SECFN_VALIDATION_FAILED", details);
+        this.name = "SecFnValidationError";
+    }
+}
+export class SecFnEncryptionError extends SecFnError {
+    constructor(message = "Secret encryption failed", details) {
+        super(message, "SECFN_ENCRYPTION_FAILED", details);
+        this.name = "SecFnEncryptionError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGxB;IACA;IAHX,YACE,OAAe,EACN,IAAY,EACZ,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAQ;QACZ,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,UAAU;IACpD,YAAY,OAAO,GAAG,cAAc,EAAE,OAAiC;QACrE,KAAK,CAAC,OAAO,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD,YAAY,OAAO,GAAG,WAAW,EAAE,OAAiC;QAClE,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,YAAY,OAAO,GAAG,WAAW,EAAE,OAAiC;QAClE,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD,YAAY,OAAO,GAAG,eAAe,EAAE,OAAiC;QACtE,KAAK,CAAC,OAAO,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD,YAAY,OAAO,GAAG,0BAA0B,EAAE,OAAiC;QACjF,KAAK,CAAC,OAAO,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF"}

package/dist/id.d.ts

@@ -0,0 +1,3 @@
+export declare function generateId(prefix: string): string;
+export declare function nowIso(): string;
+//# sourceMappingURL=id.d.ts.map

package/dist/id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAEA,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKjD;AAED,wBAAgB,MAAM,IAAI,MAAM,CAE/B"}

package/dist/id.js

@@ -0,0 +1,11 @@
+import { randomBytes, randomUUID } from "node:crypto";
+export function generateId(prefix) {
+    if (typeof randomUUID === "function") {
+        return `${prefix}_${randomUUID().replace(/-/g, "")}`;
+    }
+    return `${prefix}_${randomBytes(16).toString("hex")}`;
+}
+export function nowIso() {
+    return new Date().toISOString();
+}
+//# sourceMappingURL=id.js.map

package/dist/id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id.js","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,GAAG,MAAM,IAAI,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC"}

package/dist/index.d.ts

@@ -1,12 +1,10 @@
-export { SecFn, createSecFn, type SecFnConfig } from './core/secfn.js';
-export { SecretsVault, type SecretsVaultConfig, type SetSecretOptions } from './secrets/vault.js';
-export { SecretEncryption } from './secrets/encryption.js';
-export { SecretScanner, type SecretScannerConfig, type ScanOptions, type GitScanOptions } from './scanning/scanner.js';
-export { DEFAULT_PATTERNS } from './scanning/patterns.js';
-export { AccessControl, type AccessControlConfig, type CreateRoleOptions, type AssignRoleOptions } from './access-control/rbac.js';
-export { RateLimiter, type RateLimiterConfig, type RateLimitCheckRequest } from './rate-limiting/rate-limiter.js';
-export { SecurityMonitor, type MonitoringConfig, type LogEventOptions, type ResolveEventOptions } from './monitoring/security-monitor.js';
-export { IndexedDBStorage } from './storage/indexeddb-storage.js';
-export * from './types/index.js';
-export { generateId, calculateEntropy, redactSecret, isExpired, delay, sanitizeForLog, parseTimeWindow, } from './utils/helpers.js';
+export * from "./types.js";
+export * from "./errors.js";
+export * from "./id.js";
+export * from "./encryption.js";
+export * from "./schema.js";
+export * from "./scanner/scanner.js";
+export * from "./scanner/rules.js";
+export * from "./scanner/reporters.js";
+export * from "./scanner/utils.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,KAAK,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvH,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAEnI,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAElH,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE1I,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,cAAc,kBAAkB,CAAC;AAEjC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,KAAK,EACL,cAAc,EACd,eAAe,GAChB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -1,12 +1,10 @@
-export { SecFn, createSecFn } from './core/secfn.js';
-export { SecretsVault } from './secrets/vault.js';
-export { SecretEncryption } from './secrets/encryption.js';
-export { SecretScanner } from './scanning/scanner.js';
-export { DEFAULT_PATTERNS } from './scanning/patterns.js';
-export { AccessControl } from './access-control/rbac.js';
-export { RateLimiter } from './rate-limiting/rate-limiter.js';
-export { SecurityMonitor } from './monitoring/security-monitor.js';
-export { IndexedDBStorage } from './storage/indexeddb-storage.js';
-export * from './types/index.js';
-export { generateId, calculateEntropy, redactSecret, isExpired, delay, sanitizeForLog, parseTimeWindow, } from './utils/helpers.js';
+export * from "./types.js";
+export * from "./errors.js";
+export * from "./id.js";
+export * from "./encryption.js";
+export * from "./schema.js";
+export * from "./scanner/scanner.js";
+export * from "./scanner/rules.js";
+export * from "./scanner/reporters.js";
+export * from "./scanner/utils.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAoB,MAAM,iBAAiB,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAkD,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAmE,MAAM,uBAAuB,CAAC;AACvH,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAA4E,MAAM,0BAA0B,CAAC;AAEnI,OAAO,EAAE,WAAW,EAAsD,MAAM,iCAAiC,CAAC;AAElH,OAAO,EAAE,eAAe,EAAyE,MAAM,kCAAkC,CAAC;AAE1I,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,cAAc,kBAAkB,CAAC;AAEjC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,KAAK,EACL,cAAc,EACd,eAAe,GAChB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC"}

package/dist/scanner/reporters.d.ts

@@ -0,0 +1,14 @@
+import type { SecurityFinding } from "../types.js";
+declare const SEVERITY_ORDER: {
+    readonly info: 0;
+    readonly low: 1;
+    readonly medium: 2;
+    readonly high: 3;
+    readonly critical: 4;
+};
+export declare function findingMeetsSeverity(finding: SecurityFinding, minimum: keyof typeof SEVERITY_ORDER): boolean;
+export declare function formatFindingsTable(findings: SecurityFinding[]): string;
+export declare function formatFindingsJson(findings: SecurityFinding[]): string;
+export declare function formatFindingsSarif(findings: SecurityFinding[]): string;
+export {};
+//# sourceMappingURL=reporters.d.ts.map

package/dist/scanner/reporters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporters.d.ts","sourceRoot":"","sources":["../../src/scanner/reporters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,QAAA,MAAM,cAAc;;;;;;CAMV,CAAC;AAEX,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,OAAO,cAAc,GAAG,OAAO,CAE5G;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CAcvE;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CAEtE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CAkDvE"}