@secfn/core 0.0.1

package/README.md

@@ -0,0 +1,334 @@
+# SecFn
+
+> Comprehensive self-hosted security platform for developers
+
+SecFn is a developer-first security solution that combines vulnerability scanning, access control, secrets management, and security monitoring into a single self-hosted platform.
+
+## Features
+
+- 🔐 **Secrets Vault** - AES-256-GCM encrypted secret storage with rotation and access logging
+- 🔍 **Secret Scanning** - Pattern-based detection of 20+ secret types in code and git history
+- 🛡️ **Access Control** - Role-based permissions (RBAC) with caching and inheritance
+- ⏱️ **Rate Limiting** - Token bucket algorithm with multi-level limits
+- 📊 **Security Monitoring** - Event logging, metrics, and anomaly detection
+- 🗄️ **Self-Hosted** - IndexedDB storage, no external dependencies
+- 🚀 **Developer-Friendly** - Simple API, TypeScript support, works locally
+
+## Installation
+
+```bash
+npm install secfn
+```
+
+## Quick Start
+
+```typescript
+import { createSecFn } from 'secfn';
+
+const secFn = createSecFn({
+  namespace: 'my-app',
+  masterKey: process.env.MASTER_KEY,
+});
+
+await secFn.initialize();
+
+const vault = secFn.createSecretsVault();
+await vault.set('api_key', 'secret-value', {
+  tags: ['production'],
+  environment: 'production',
+});
+
+const secret = await vault.get('api_key');
+console.log('Retrieved:', secret);
+
+await secFn.destroy();
+```
+
+## Core Components
+
+### 1. Secrets Vault
+
+Encrypted storage and management of application secrets.
+
+```typescript
+const vault = secFn.createSecretsVault();
+
+await vault.set('stripe_api_key', 'sk_live_...', {
+  tags: ['payment', 'production'],
+  environment: 'production',
+  expiresAt: Date.now() + 90 * 24 * 60 * 60 * 1000,
+  rotateEvery: 90 * 24 * 60 * 60 * 1000,
+});
+
+const key = await vault.get('stripe_api_key');
+
+const secrets = await vault.list({ environment: 'production' });
+
+await vault.rotate('stripe_api_key', 'sk_live_new...');
+
+const accessLog = await vault.getAccessLog('stripe_api_key', 100);
+```
+
+### 2. Secret Scanner
+
+Detect hardcoded secrets in source code with 20+ built-in patterns.
+
+```typescript
+const scanner = secFn.createSecretScanner({
+  excludePaths: ['node_modules/**', 'dist/**'],
+  minEntropy: 3.5,
+});
+
+const results = await scanner.scanDirectory('./src');
+
+results.forEach(result => {
+  console.log(`${result.severity}: ${result.pattern} in ${result.file}:${result.line}`);
+  console.log(`  Match: ${result.redactedMatch}`);
+});
+
+const gitResults = await scanner.scanGitHistory({
+  branch: 'main',
+  commits: 100,
+});
+
+scanner.addPattern({
+  name: 'Custom Secret',
+  pattern: /custom_secret_[a-zA-Z0-9]{32}/g,
+  entropy: 4.0,
+  description: 'Custom application secret',
+  severity: 'high',
+});
+```
+
+**Built-in Secret Patterns:**
+- AWS Access Keys, Secret Keys
+- GitHub Tokens
+- Stripe API Keys
+- OpenAI & Anthropic API Keys
+- Google API Keys
+- Slack Tokens
+- NPM Tokens
+- JWT Tokens
+- Database Connection Strings
+- Private Keys (RSA, OpenSSH, DSA, EC, PGP)
+- And many more...
+
+### 3. Access Control (RBAC)
+
+Fine-grained role-based access control with permission caching.
+
+```typescript
+const access = secFn.createAccessControl();
+
+await access.createRole({
+  name: 'editor',
+  description: 'Can edit projects and files',
+  permissions: ['project:read', 'project:write', 'file:read', 'file:write'],
+});
+
+await access.createRole({
+  name: 'admin',
+  description: 'Full system access',
+  permissions: ['*:*'],
+});
+
+await access.assignRole('user_123', 'editor', {
+  resourceIds: ['project_abc', 'project_def'],
+});
+
+const allowed = await access.check({
+  userId: 'user_123',
+  action: 'project:write',
+  resourceId: 'project_abc',
+});
+
+const permissions = await access.getUserPermissions('user_123');
+```
+
+### 4. Rate Limiting
+
+Protect against brute force and API abuse with token bucket algorithm.
+
+```typescript
+const limiter = secFn.createRateLimiter({
+  rules: {
+    global: { requests: 1000, window: 60000 },
+    perUser: { requests: 100, window: 60000 },
+    perIP: { requests: 50, window: 60000, blockDuration: 300000 },
+    perEndpoint: {
+      '/api/login': { requests: 5, window: 300000 },
+      '/api/search': { requests: 100, window: 60000 },
+    },
+  },
+  onLimitExceeded: async (violation) => {
+    console.warn(`Rate limit exceeded for ${violation.ip}`);
+  },
+});
+
+const result = await limiter.check({
+  userId: 'user_123',
+  ip: '192.168.1.1',
+  endpoint: '/api/search',
+});
+
+if (!result.allowed) {
+  throw new Error(`Rate limit exceeded. Retry after ${result.retryAfter}ms`);
+}
+
+await limiter.resetUser('user_123');
+await limiter.unblock('ip:192.168.1.1');
+```
+
+### 5. Security Monitoring
+
+Comprehensive event logging with metrics and anomaly detection.
+
+```typescript
+const monitoring = secFn.createMonitoring({
+  retention: 90 * 24 * 60 * 60 * 1000,
+  anomalyDetection: {
+    enabled: true,
+    sensitivity: 0.8,
+  },
+});
+
+await monitoring.logEvent({
+  type: 'auth_failure',
+  severity: 'medium',
+  userId: 'user_123',
+  ip: '192.168.1.1',
+  resource: '/api/login',
+  action: 'login',
+  metadata: {
+    reason: 'invalid_password',
+    attemptCount: 3,
+  },
+});
+
+const events = await monitoring.queryEvents({
+  type: 'auth_failure',
+  severity: ['high', 'critical'],
+  startDate: Date.now() - 24 * 60 * 60 * 1000,
+});
+
+const metrics = await monitoring.getMetrics({
+  start: Date.now() - 7 * 24 * 60 * 60 * 1000,
+  end: Date.now(),
+});
+
+console.log('Total events:', metrics.totalEvents);
+console.log('Events by type:', metrics.eventsByType);
+console.log('Anomalies:', metrics.anomalies);
+
+await monitoring.resolveEvent('event_123', {
+  resolvedBy: 'admin_456',
+  notes: 'False positive',
+});
+```
+
+## Storage
+
+SecFn uses IndexedDB for browser/local storage with no external dependencies.
+
+```typescript
+const secFn = createSecFn({
+  storage: {
+    type: 'indexeddb',
+    dbName: 'my-app-security',
+    retentionDays: 90,
+  },
+});
+```
+
+**Storage Schema:**
+- `secfn_secrets` - Encrypted secrets
+- `secfn_secret_access` - Access logs
+- `secfn_roles` - Role definitions
+- `secfn_user_roles` - User-role assignments
+- `secfn_security_events` - Security events
+- `secfn_rate_limits` - Rate limit tracking
+- `secfn_scan_results` - Secret scan results
+
+## Performance
+
+**V0 Benchmarks:**
+- Scan 10,000 files for secrets: <10s
+- Rate limit check: <5ms
+- Access control check: <10ms (with cache)
+- Log 1,000 security events: <500ms
+- Query 10,000 events: <100ms
+- Encrypt/decrypt secret: <10ms
+
+## Examples
+
+See `examples/basic-usage.ts` for a comprehensive demonstration of all features.
+
+```bash
+npm run build
+node dist/examples/basic-usage.js
+```
+
+## Development
+
+```bash
+npm install
+
+npm run build
+
+npm run build:watch
+
+npm test
+
+npm run test:watch
+
+npm run test:coverage
+
+npm run typecheck
+
+npm run lint
+```
+
+## Architecture
+
+```
+secfn/
+├── storage/           # IndexedDB persistence
+├── secrets/           # Vault & encryption
+├── scanning/          # Secret detection
+├── access-control/    # RBAC system
+├── rate-limiting/     # Request throttling
+├── monitoring/        # Event logging
+└── core/              # Main orchestrator
+```
+
+## Security Best Practices
+
+1. **Master Key**: Always use a strong, randomly generated master key in production
+2. **Rotation**: Enable automatic secret rotation for sensitive credentials
+3. **Monitoring**: Review security events and anomalies regularly
+4. **Access Control**: Apply principle of least privilege
+5. **Rate Limiting**: Configure appropriate limits for your use case
+6. **Scanning**: Integrate secret scanning into your CI/CD pipeline
+
+## Roadmap
+
+- [ ] File system storage backend
+- [ ] Database adapter support (@superfunctions/db)
+- [ ] Vulnerability scanning (SQL injection, XSS, etc.)
+- [ ] Security middleware for Express/Hono/Fastify
+- [ ] HTML security dashboard
+- [ ] CLI tools
+- [ ] Real-time alert notifications
+- [ ] Advanced anomaly detection with ML
+
+## License
+
+MIT
+
+## Contributing
+
+Contributions welcome! This is part of the super-functions ecosystem.
+
+## Support
+
+For issues and questions, please open an issue on GitHub.

package/dist/access-control/rbac.d.ts

@@ -0,0 +1,48 @@
+import type { Role, AccessRequest } from '../types/index.js';
+import type { IndexedDBStorage } from '../storage/indexeddb-storage.js';
+export interface AccessControlConfig {
+    storage: IndexedDBStorage;
+    cache?: {
+        ttl: number;
+        maxSize: number;
+    };
+}
+export interface CreateRoleOptions {
+    name: string;
+    description: string;
+    permissions: string[];
+    inherits?: string[];
+    metadata?: Record<string, unknown>;
+}
+export interface AssignRoleOptions {
+    resourceIds?: string[];
+    expiresAt?: number;
+}
+export declare class AccessControl {
+    private storage;
+    private cache;
+    private cacheTTL;
+    private maxCacheSize;
+    constructor(config: AccessControlConfig);
+    createRole(options: CreateRoleOptions): Promise<string>;
+    getRole(id: string): Promise<Role | null>;
+    getRoleByName(name: string): Promise<Role | null>;
+    listRoles(): Promise<Role[]>;
+    updateRole(id: string, updates: Partial<CreateRoleOptions>): Promise<void>;
+    deleteRole(id: string): Promise<void>;
+    assignRole(userId: string, roleId: string, options?: AssignRoleOptions): Promise<void>;
+    removeRole(userId: string, roleId: string): Promise<void>;
+    getUserRoles(userId: string): Promise<Role[]>;
+    getUserPermissions(userId: string): Promise<string[]>;
+    check(request: AccessRequest): Promise<boolean>;
+    private evaluateAccess;
+    private checkRolePermission;
+    private collectPermissions;
+    private matchesPermission;
+    private getCacheKey;
+    private getCached;
+    private setCached;
+    private invalidateCache;
+    private invalidateCacheForUser;
+}
+//# sourceMappingURL=rbac.d.ts.map

package/dist/access-control/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/access-control/rbac.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAY,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGxE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAOD,qBAAa,aAAa;IACxB,OAAO,CAAC,OAAO,CAAmB;IAClC,OAAO,CAAC,KAAK,CAA0B;IACvC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAS;gBAEjB,MAAM,EAAE,mBAAmB;IAOjC,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBvD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAIzC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAKjD,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAI5B,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB1E,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB1F,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAkB7C,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWrD,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;YAcvC,cAAc;YA0Bd,mBAAmB;YAanB,kBAAkB;IAehC,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,SAAS;IAajB,OAAO,CAAC,SAAS;IAYjB,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,sBAAsB;CAO/B"}

package/dist/access-control/rbac.js

@@ -0,0 +1,203 @@
+import { generateId } from '../utils/helpers.js';
+export class AccessControl {
+    storage;
+    cache;
+    cacheTTL;
+    maxCacheSize;
+    constructor(config) {
+        this.storage = config.storage;
+        this.cache = new Map();
+        this.cacheTTL = config.cache?.ttl || 300000;
+        this.maxCacheSize = config.cache?.maxSize || 1000;
+    }
+    async createRole(options) {
+        const role = {
+            id: generateId('role'),
+            name: options.name,
+            description: options.description,
+            permissions: options.permissions,
+            inherits: options.inherits,
+            metadata: options.metadata,
+            createdAt: Date.now(),
+            updatedAt: Date.now(),
+        };
+        await this.storage.saveRole(role);
+        return role.id;
+    }
+    async getRole(id) {
+        return await this.storage.getRole(id);
+    }
+    async getRoleByName(name) {
+        const roles = await this.storage.listRoles();
+        return roles.find(r => r.name === name) || null;
+    }
+    async listRoles() {
+        return await this.storage.listRoles();
+    }
+    async updateRole(id, updates) {
+        const role = await this.storage.getRole(id);
+        if (!role) {
+            throw new Error(`Role ${id} not found`);
+        }
+        if (updates.name)
+            role.name = updates.name;
+        if (updates.description)
+            role.description = updates.description;
+        if (updates.permissions)
+            role.permissions = updates.permissions;
+        if (updates.inherits)
+            role.inherits = updates.inherits;
+        if (updates.metadata)
+            role.metadata = updates.metadata;
+        role.updatedAt = Date.now();
+        await this.storage.saveRole(role);
+        this.invalidateCache();
+    }
+    async deleteRole(id) {
+        await this.storage.deleteRole(id);
+        this.invalidateCache();
+    }
+    async assignRole(userId, roleId, options = {}) {
+        const role = await this.storage.getRole(roleId);
+        if (!role) {
+            throw new Error(`Role ${roleId} not found`);
+        }
+        const userRole = {
+            userId,
+            roleId,
+            resourceIds: options.resourceIds,
+            expiresAt: options.expiresAt,
+            assignedAt: Date.now(),
+        };
+        await this.storage.assignUserRole(userRole);
+        this.invalidateCacheForUser(userId);
+    }
+    async removeRole(userId, roleId) {
+        await this.storage.removeUserRole(userId, roleId);
+        this.invalidateCacheForUser(userId);
+    }
+    async getUserRoles(userId) {
+        const userRoles = await this.storage.getUserRoles(userId);
+        const roles = [];
+        for (const userRole of userRoles) {
+            if (userRole.expiresAt && Date.now() > userRole.expiresAt) {
+                continue;
+            }
+            const role = await this.storage.getRole(userRole.roleId);
+            if (role) {
+                roles.push(role);
+            }
+        }
+        return roles;
+    }
+    async getUserPermissions(userId) {
+        const roles = await this.getUserRoles(userId);
+        const permissions = new Set();
+        for (const role of roles) {
+            await this.collectPermissions(role, permissions);
+        }
+        return Array.from(permissions);
+    }
+    async check(request) {
+        const cacheKey = this.getCacheKey(request);
+        const cached = this.getCached(cacheKey);
+        if (cached !== null) {
+            return cached;
+        }
+        const allowed = await this.evaluateAccess(request);
+        this.setCached(cacheKey, allowed);
+        return allowed;
+    }
+    async evaluateAccess(request) {
+        const userRoles = await this.storage.getUserRoles(request.userId);
+        for (const userRole of userRoles) {
+            if (userRole.expiresAt && Date.now() > userRole.expiresAt) {
+                continue;
+            }
+            if (userRole.resourceIds && request.resourceId) {
+                if (!userRole.resourceIds.includes(request.resourceId)) {
+                    continue;
+                }
+            }
+            const role = await this.storage.getRole(userRole.roleId);
+            if (!role)
+                continue;
+            const hasPermission = await this.checkRolePermission(role, request);
+            if (hasPermission) {
+                return true;
+            }
+        }
+        return false;
+    }
+    async checkRolePermission(role, request) {
+        const allPermissions = new Set();
+        await this.collectPermissions(role, allPermissions);
+        for (const permission of allPermissions) {
+            if (this.matchesPermission(permission, request.action)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    async collectPermissions(role, collected) {
+        for (const permission of role.permissions) {
+            collected.add(permission);
+        }
+        if (role.inherits) {
+            for (const inheritedRoleId of role.inherits) {
+                const inheritedRole = await this.storage.getRole(inheritedRoleId);
+                if (inheritedRole) {
+                    await this.collectPermissions(inheritedRole, collected);
+                }
+            }
+        }
+    }
+    matchesPermission(permission, action) {
+        if (permission === '*:*')
+            return true;
+        const [permResource, permAction] = permission.split(':');
+        const [reqResource, reqAction] = action.split(':');
+        if (!permResource || !permAction || !reqResource || !reqAction) {
+            return false;
+        }
+        const resourceMatch = permResource === '*' || permResource === reqResource;
+        const actionMatch = permAction === '*' || permAction === reqAction;
+        return resourceMatch && actionMatch;
+    }
+    getCacheKey(request) {
+        return `${request.userId}:${request.action}:${request.resourceId || '*'}`;
+    }
+    getCached(key) {
+        const entry = this.cache.get(key);
+        if (!entry)
+            return null;
+        const age = Date.now() - entry.timestamp;
+        if (age > this.cacheTTL) {
+            this.cache.delete(key);
+            return null;
+        }
+        return entry.allowed;
+    }
+    setCached(key, allowed) {
+        if (this.cache.size >= this.maxCacheSize) {
+            const firstKey = this.cache.keys().next().value;
+            if (firstKey)
+                this.cache.delete(firstKey);
+        }
+        this.cache.set(key, {
+            allowed,
+            timestamp: Date.now(),
+        });
+    }
+    invalidateCache() {
+        this.cache.clear();
+    }
+    invalidateCacheForUser(userId) {
+        for (const [key] of this.cache) {
+            if (key.startsWith(`${userId}:`)) {
+                this.cache.delete(key);
+            }
+        }
+    }
+}
+//# sourceMappingURL=rbac.js.map

package/dist/access-control/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/access-control/rbac.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AA4BjD,MAAM,OAAO,aAAa;IAChB,OAAO,CAAmB;IAC1B,KAAK,CAA0B;IAC/B,QAAQ,CAAS;IACjB,YAAY,CAAS;IAE7B,YAAY,MAA2B;QACrC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,MAAM,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAA0B;QACzC,MAAM,IAAI,GAAS;YACjB,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS;QACb,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,OAAmC;QAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,OAAO,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC3C,IAAI,OAAO,CAAC,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAChE,IAAI,OAAO,CAAC,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAChE,IAAI,OAAO,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACvD,IAAI,OAAO,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACvD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE5B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,MAAc,EAAE,UAA6B,EAAE;QAC9E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,YAAY,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,QAAQ,GAAa;YACzB,MAAM;YACN,MAAM;YACN,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,MAAc;QAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAW,EAAE,CAAC;QAEzB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC1D,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzD,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAsB;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAElC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAAsB;QACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAElE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC1D,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC/C,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;oBACvD,SAAS;gBACX,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpE,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,IAAU,EAAE,OAAsB;QAClE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAEpD,KAAK,MAAM,UAAU,IAAI,cAAc,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,IAAU,EAAE,SAAsB;QACjE,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,MAAM,eAAe,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBAClE,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,UAAkB,EAAE,MAAc;QAC1D,IAAI,UAAU,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAEtC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEnD,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,YAAY,KAAK,GAAG,IAAI,YAAY,KAAK,WAAW,CAAC;QAC3E,MAAM,WAAW,GAAG,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,SAAS,CAAC;QAEnE,OAAO,aAAa,IAAI,WAAW,CAAC;IACtC,CAAC;IAEO,WAAW,CAAC,OAAsB;QACxC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;IAC5E,CAAC;IAEO,SAAS,CAAC,GAAW;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;QACzC,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAEO,SAAS,CAAC,GAAW,EAAE,OAAgB;QAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAChD,IAAI,QAAQ;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAEO,sBAAsB,CAAC,MAAc;QAC3C,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/core/secfn.d.ts

@@ -0,0 +1,28 @@
+import { IndexedDBStorage } from '../storage/indexeddb-storage.js';
+import { SecretsVault, type SecretsVaultConfig } from '../secrets/vault.js';
+import { SecretScanner, type SecretScannerConfig } from '../scanning/scanner.js';
+import { AccessControl, type AccessControlConfig } from '../access-control/rbac.js';
+import { RateLimiter, type RateLimiterConfig } from '../rate-limiting/rate-limiter.js';
+import { SecurityMonitor, type MonitoringConfig } from '../monitoring/security-monitor.js';
+import type { StorageConfig } from '../types/index.js';
+export interface SecFnConfig {
+    storage?: StorageConfig;
+    masterKey?: string;
+    namespace?: string;
+}
+export declare class SecFn {
+    private storage;
+    private masterKey?;
+    private initialized;
+    constructor(config?: SecFnConfig);
+    initialize(): Promise<void>;
+    createSecretsVault(config?: Partial<Omit<SecretsVaultConfig, 'storage'>>): SecretsVault;
+    createSecretScanner(config?: Partial<Omit<SecretScannerConfig, 'storage'>>): SecretScanner;
+    createAccessControl(config?: Partial<Omit<AccessControlConfig, 'storage'>>): AccessControl;
+    createRateLimiter(config: Omit<RateLimiterConfig, 'storage'>): RateLimiter;
+    createMonitoring(config?: Partial<Omit<MonitoringConfig, 'storage'>>): SecurityMonitor;
+    destroy(): Promise<void>;
+    getStorage(): IndexedDBStorage;
+}
+export declare function createSecFn(config?: SecFnConfig): SecFn;
+//# sourceMappingURL=secfn.d.ts.map

package/dist/core/secfn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secfn.d.ts","sourceRoot":"","sources":["../../src/core/secfn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,KAAK;IAChB,OAAO,CAAC,OAAO,CAAmB;IAClC,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,WAAW,CAAkB;gBAEzB,MAAM,GAAE,WAAgB;IAM9B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAMjC,kBAAkB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC,GAAG,YAAY;IAgBvF,mBAAmB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC,GAAG,aAAa;IAO1F,mBAAmB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC,GAAG,aAAa;IAO1F,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG,WAAW;IAQ1E,gBAAgB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,GAAG,eAAe;IAQhF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAK9B,UAAU,IAAI,gBAAgB;CAG/B;AAED,wBAAgB,WAAW,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,KAAK,CAEvD"}