secure-ui-components 0.2.3 → 0.2.5

package/dist/core/security-config.js

@@ -13,245 +13,4 @@
  *
  * @module security-config
  * @license MIT
- */
-/**
- * Security tier enumeration
- * These constants should be used throughout the library to reference security levels
- */
-export const SecurityTier = Object.freeze({
-    /** PUBLIC: Non-sensitive data (e.g., search queries, public comments) */
-    PUBLIC: 'public',
-    /** AUTHENTICATED: User-specific but non-sensitive data (e.g., display names, preferences) */
-    AUTHENTICATED: 'authenticated',
-    /** SENSITIVE: Personally identifiable information (e.g., email, phone, address) */
-    SENSITIVE: 'sensitive',
-    /** CRITICAL: High-risk data (e.g., passwords, SSN, payment info) */
-    CRITICAL: 'critical'
-});
-/**
- * Default configuration for each security tier
- *
- * Security Note: These defaults implement defense-in-depth by progressively
- * adding security controls at each tier. When in doubt, components should
- * default to CRITICAL tier behavior.
- */
-export const TIER_CONFIG = Object.freeze({
-    [SecurityTier.PUBLIC]: Object.freeze({
-        name: 'Public',
-        level: 1,
-        validation: Object.freeze({
-            required: false,
-            strict: false,
-            maxLength: 5000,
-            pattern: null,
-            sanitizeHtml: true
-        }),
-        masking: Object.freeze({
-            enabled: false,
-            character: '•',
-            partial: false
-        }),
-        storage: Object.freeze({
-            allowAutocomplete: true,
-            allowCache: true,
-            allowHistory: true
-        }),
-        audit: Object.freeze({
-            logAccess: false,
-            logChanges: false,
-            logSubmission: false,
-            includeMetadata: false
-        }),
-        rateLimit: Object.freeze({
-            enabled: false,
-            maxAttempts: 0,
-            windowMs: 0
-        })
-    }),
-    [SecurityTier.AUTHENTICATED]: Object.freeze({
-        name: 'Authenticated',
-        level: 2,
-        validation: Object.freeze({
-            required: true,
-            strict: false,
-            maxLength: 1000,
-            pattern: null,
-            sanitizeHtml: true
-        }),
-        masking: Object.freeze({
-            enabled: false,
-            character: '•',
-            partial: false
-        }),
-        storage: Object.freeze({
-            allowAutocomplete: true,
-            allowCache: false,
-            allowHistory: false
-        }),
-        audit: Object.freeze({
-            logAccess: false,
-            logChanges: true,
-            logSubmission: true,
-            includeMetadata: true
-        }),
-        rateLimit: Object.freeze({
-            enabled: false,
-            maxAttempts: 0,
-            windowMs: 0
-        })
-    }),
-    [SecurityTier.SENSITIVE]: Object.freeze({
-        name: 'Sensitive',
-        level: 3,
-        validation: Object.freeze({
-            required: true,
-            strict: true,
-            maxLength: 500,
-            pattern: null,
-            sanitizeHtml: true
-        }),
-        masking: Object.freeze({
-            enabled: true,
-            character: '•',
-            partial: true
-        }),
-        storage: Object.freeze({
-            allowAutocomplete: false,
-            allowCache: false,
-            allowHistory: false
-        }),
-        audit: Object.freeze({
-            logAccess: true,
-            logChanges: true,
-            logSubmission: true,
-            includeMetadata: true
-        }),
-        rateLimit: Object.freeze({
-            enabled: true,
-            maxAttempts: 10,
-            windowMs: 60000
-        })
-    }),
-    [SecurityTier.CRITICAL]: Object.freeze({
-        name: 'Critical',
-        level: 4,
-        validation: Object.freeze({
-            required: true,
-            strict: true,
-            maxLength: 256,
-            pattern: null,
-            sanitizeHtml: true
-        }),
-        masking: Object.freeze({
-            enabled: true,
-            character: '•',
-            partial: false
-        }),
-        storage: Object.freeze({
-            allowAutocomplete: false,
-            allowCache: false,
-            allowHistory: false
-        }),
-        audit: Object.freeze({
-            logAccess: true,
-            logChanges: true,
-            logSubmission: true,
-            includeMetadata: true
-        }),
-        rateLimit: Object.freeze({
-            enabled: true,
-            maxAttempts: 5,
-            windowMs: 60000
-        })
-    })
-});
-/**
- * Get configuration for a specific security tier
- *
- * Security Note: If an invalid tier is provided, this function fails secure
- * by returning the CRITICAL tier configuration.
- */
-export function getTierConfig(tier) {
-    if (!tier || !TIER_CONFIG[tier]) {
-        console.warn(`Invalid security tier "${tier}", defaulting to CRITICAL`);
-        return TIER_CONFIG[SecurityTier.CRITICAL];
-    }
-    return TIER_CONFIG[tier];
-}
-/**
- * Validate that a tier value is valid
- */
-export function isValidTier(tier) {
-    return Object.values(SecurityTier).includes(tier);
-}
-/**
- * Compare two security tiers
- *
- * @returns -1 if tier1 < tier2, 0 if equal, 1 if tier1 > tier2
- */
-export function compareTiers(tier1, tier2) {
-    const config1 = getTierConfig(tier1);
-    const config2 = getTierConfig(tier2);
-    return Math.sign(config1.level - config2.level);
-}
-/**
- * Get the more secure of two tiers
- */
-export function getMoreSecureTier(tier1, tier2) {
-    return compareTiers(tier1, tier2) >= 0 ? tier1 : tier2;
-}
-/**
- * Content Security Policy recommendations for each tier
- */
-export const CSP_RECOMMENDATIONS = Object.freeze({
-    [SecurityTier.PUBLIC]: Object.freeze({
-        'default-src': ["'self'"],
-        'script-src': ["'self'"],
-        'style-src': ["'self'"]
-    }),
-    [SecurityTier.AUTHENTICATED]: Object.freeze({
-        'default-src': ["'self'"],
-        'script-src': ["'self'"],
-        'style-src': ["'self'"],
-        'form-action': ["'self'"]
-    }),
-    [SecurityTier.SENSITIVE]: Object.freeze({
-        'default-src': ["'self'"],
-        'script-src': ["'self'"],
-        'style-src': ["'self'"],
-        'form-action': ["'self'"],
-        'frame-ancestors': ["'none'"],
-        'upgrade-insecure-requests': []
-    }),
-    [SecurityTier.CRITICAL]: Object.freeze({
-        'default-src': ["'self'"],
-        'script-src': ["'self'"],
-        'style-src': ["'self'"],
-        'form-action': ["'self'"],
-        'frame-ancestors': ["'none'"],
-        'upgrade-insecure-requests': [],
-        'block-all-mixed-content': [],
-        'base-uri': ["'none'"]
-    })
-});
-/**
- * Default security headers recommendations
- */
-export const SECURITY_HEADERS = Object.freeze({
-    'X-Content-Type-Options': 'nosniff',
-    'X-Frame-Options': 'DENY',
-    'X-XSS-Protection': '1; mode=block',
-    'Referrer-Policy': 'strict-origin-when-cross-origin',
-    'Permissions-Policy': 'geolocation=(), microphone=(), camera=()'
-});
-export default {
-    SecurityTier,
-    TIER_CONFIG,
-    getTierConfig,
-    isValidTier,
-    compareTiers,
-    getMoreSecureTier,
-    CSP_RECOMMENDATIONS,
-    SECURITY_HEADERS
-};
-//# sourceMappingURL=security-config.js.map
+ */const t=Object.freeze({PUBLIC:"public",AUTHENTICATED:"authenticated",SENSITIVE:"sensitive",CRITICAL:"critical"}),a=Object.freeze({[t.PUBLIC]:Object.freeze({name:"Public",level:1,validation:Object.freeze({required:!1,strict:!1,maxLength:5e3,pattern:null,sanitizeHtml:!0}),masking:Object.freeze({enabled:!1,character:"\u2022",partial:!1}),storage:Object.freeze({allowAutocomplete:!0,allowCache:!0,allowHistory:!0}),audit:Object.freeze({logAccess:!1,logChanges:!1,logSubmission:!1,includeMetadata:!1}),rateLimit:Object.freeze({enabled:!1,maxAttempts:0,windowMs:0})}),[t.AUTHENTICATED]:Object.freeze({name:"Authenticated",level:2,validation:Object.freeze({required:!0,strict:!1,maxLength:1e3,pattern:null,sanitizeHtml:!0}),masking:Object.freeze({enabled:!1,character:"\u2022",partial:!1}),storage:Object.freeze({allowAutocomplete:!0,allowCache:!1,allowHistory:!1}),audit:Object.freeze({logAccess:!1,logChanges:!0,logSubmission:!0,includeMetadata:!0}),rateLimit:Object.freeze({enabled:!1,maxAttempts:0,windowMs:0})}),[t.SENSITIVE]:Object.freeze({name:"Sensitive",level:3,validation:Object.freeze({required:!0,strict:!0,maxLength:500,pattern:null,sanitizeHtml:!0}),masking:Object.freeze({enabled:!0,character:"\u2022",partial:!0}),storage:Object.freeze({allowAutocomplete:!1,allowCache:!1,allowHistory:!1}),audit:Object.freeze({logAccess:!0,logChanges:!0,logSubmission:!0,includeMetadata:!0}),rateLimit:Object.freeze({enabled:!0,maxAttempts:10,windowMs:6e4})}),[t.CRITICAL]:Object.freeze({name:"Critical",level:4,validation:Object.freeze({required:!0,strict:!0,maxLength:256,pattern:null,sanitizeHtml:!0}),masking:Object.freeze({enabled:!0,character:"\u2022",partial:!1}),storage:Object.freeze({allowAutocomplete:!1,allowCache:!1,allowHistory:!1}),audit:Object.freeze({logAccess:!0,logChanges:!0,logSubmission:!0,includeMetadata:!0}),rateLimit:Object.freeze({enabled:!0,maxAttempts:5,windowMs:6e4})})});function l(e){return!e||!a[e]?(console.warn(`Invalid security tier "${e}", defaulting to CRITICAL`),a[t.CRITICAL]):a[e]}function n(e){return Object.values(t).includes(e)}function s(e,r){const c=l(e),i=l(r);return Math.sign(c.level-i.level)}function o(e,r){return s(e,r)>=0?e:r}const f=Object.freeze({[t.PUBLIC]:Object.freeze({"default-src":["'self'"],"script-src":["'self'"],"style-src":["'self'"]}),[t.AUTHENTICATED]:Object.freeze({"default-src":["'self'"],"script-src":["'self'"],"style-src":["'self'"],"form-action":["'self'"]}),[t.SENSITIVE]:Object.freeze({"default-src":["'self'"],"script-src":["'self'"],"style-src":["'self'"],"form-action":["'self'"],"frame-ancestors":["'none'"],"upgrade-insecure-requests":[]}),[t.CRITICAL]:Object.freeze({"default-src":["'self'"],"script-src":["'self'"],"style-src":["'self'"],"form-action":["'self'"],"frame-ancestors":["'none'"],"upgrade-insecure-requests":[],"block-all-mixed-content":[],"base-uri":["'none'"]})}),u=Object.freeze({"X-Content-Type-Options":"nosniff","X-Frame-Options":"DENY","X-XSS-Protection":"1; mode=block","Referrer-Policy":"strict-origin-when-cross-origin","Permissions-Policy":"geolocation=(), microphone=(), camera=()"});var b={SecurityTier:t,TIER_CONFIG:a,getTierConfig:l,isValidTier:n,compareTiers:s,getMoreSecureTier:o,CSP_RECOMMENDATIONS:f,SECURITY_HEADERS:u};export{f as CSP_RECOMMENDATIONS,u as SECURITY_HEADERS,t as SecurityTier,a as TIER_CONFIG,s as compareTiers,b as default,o as getMoreSecureTier,l as getTierConfig,n as isValidTier};

package/dist/core/types.js

@@ -3,5 +3,3 @@
  * @module types
  * @license MIT
  */
-export {};
-//# sourceMappingURL=types.js.map

package/dist/index.js

@@ -3,20 +3,4 @@
  *
  * @module @anthropic/secure-ui-components
  * @license MIT
- */
-// Core
-export { SecureBaseComponent } from './core/base-component.js';
-export { SecurityTier, TIER_CONFIG, getTierConfig, isValidTier, compareTiers, getMoreSecureTier, CSP_RECOMMENDATIONS, SECURITY_HEADERS } from './core/security-config.js';
-// Components
-export { SecureInput } from './components/secure-input/secure-input.js';
-export { SecureTextarea } from './components/secure-textarea/secure-textarea.js';
-export { SecureSelect } from './components/secure-select/secure-select.js';
-export { SecureForm } from './components/secure-form/secure-form.js';
-export { SecureFileUpload } from './components/secure-file-upload/secure-file-upload.js';
-export { SecureDateTime } from './components/secure-datetime/secure-datetime.js';
-export { SecureTable } from './components/secure-table/secure-table.js';
-export { SecureSubmitButton } from './components/secure-submit-button/secure-submit-button.js';
-export { SecureCard } from './components/secure-card/secure-card.js';
-export { SecureTelemetryProvider } from './components/secure-telemetry-provider/secure-telemetry-provider.js';
-export { SecurePasswordConfirm } from './components/secure-password-confirm/secure-password-confirm.js';
-//# sourceMappingURL=index.js.map
+ */import{SecureBaseComponent as o}from"./core/base-component.js";import{SecurityTier as m,TIER_CONFIG as S,getTierConfig as p,isValidTier as u,compareTiers as c,getMoreSecureTier as f,CSP_RECOMMENDATIONS as i,SECURITY_HEADERS as x}from"./core/security-config.js";import{SecureInput as a}from"./components/secure-input/secure-input.js";import{SecureTextarea as l}from"./components/secure-textarea/secure-textarea.js";import{SecureSelect as E}from"./components/secure-select/secure-select.js";import{SecureForm as s}from"./components/secure-form/secure-form.js";import{SecureFileUpload as R}from"./components/secure-file-upload/secure-file-upload.js";import{SecureDateTime as D}from"./components/secure-datetime/secure-datetime.js";import{SecureTable as M}from"./components/secure-table/secure-table.js";import{SecureSubmitButton as O}from"./components/secure-submit-button/secure-submit-button.js";import{SecureCard as _}from"./components/secure-card/secure-card.js";import{SecureTelemetryProvider as y}from"./components/secure-telemetry-provider/secure-telemetry-provider.js";import{SecurePasswordConfirm as B}from"./components/secure-password-confirm/secure-password-confirm.js";export{i as CSP_RECOMMENDATIONS,x as SECURITY_HEADERS,o as SecureBaseComponent,_ as SecureCard,D as SecureDateTime,R as SecureFileUpload,s as SecureForm,a as SecureInput,B as SecurePasswordConfirm,E as SecureSelect,O as SecureSubmitButton,M as SecureTable,y as SecureTelemetryProvider,l as SecureTextarea,m as SecurityTier,S as TIER_CONFIG,c as compareTiers,f as getMoreSecureTier,p as getTierConfig,u as isValidTier};

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secure-ui-components",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Security-first web component library with zero dependencies",
   "type": "module",
   "main": "./index.js",
@@ -33,7 +33,8 @@
     "typecheck": "tsc --noEmit",
     "build:ts": "tsc",
     "build:css": "node build/css-inliner.js",
-    "build": "npm run clean && npm run build:ts && npm run build:css",
+    "build:minify": "node build/js-minifier.js",
+    "build": "npm run clean && npm run build:ts && npm run build:css && npm run build:minify",
     "build:dev": "npm run build:ts && node build/dev-build.js",
     "serve": "node server.js",
     "serve:dev": "node --watch server.js",
@@ -81,6 +82,7 @@
     "@vitest/coverage-v8": "^4.0.18",
     "axe-core": "^4.11.1",
     "cors": "^2.8.5",
+    "esbuild": "^0.28.0",
     "eslint-plugin-security": "^4.0.0",
     "express": "^4.18.2",
     "happy-dom": "^20.4.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secure-ui-components",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Security-first web component library with zero dependencies",
   "type": "module",
   "main": "./dist/index.js",
@@ -75,7 +75,8 @@
     "typecheck": "tsc --noEmit",
     "build:ts": "tsc",
     "build:css": "node build/css-inliner.js",
-    "build": "npm run clean && npm run build:ts && npm run build:css",
+    "build:minify": "node build/js-minifier.js",
+    "build": "npm run clean && npm run build:ts && npm run build:css && npm run build:minify",
     "build:dev": "npm run build:ts && node build/dev-build.js",
     "serve": "node server.js",
     "serve:dev": "node --watch server.js",
@@ -123,6 +124,7 @@
     "@vitest/coverage-v8": "^4.0.18",
     "axe-core": "^4.11.1",
     "cors": "^2.8.5",
+    "esbuild": "^0.28.0",
     "eslint-plugin-security": "^4.0.0",
     "express": "^4.18.2",
     "happy-dom": "^20.4.0",