added vector store

.changeset/giant-pots-double.md

@@ -0,0 +1,5 @@
+---
+"@fake-scope/fake-pkg": patch
+---
+
+added vector store

.github/co-pilot-instruction.md

@@ -0,0 +1,16 @@
+# Project general coding guidelines
+
+## Code Style
+- Use semantic HTML5 elements (header, main, section, article, etc.)
+- Prefer modern JavaScript (ES6+) features like const/let, arrow functions, and template literals
+
+## Naming Conventions
+- Use PascalCase for component names, interfaces, and type aliases
+- Use camelCase for variables, functions, and methods
+- Prefix private class members with underscore (_)
+- Use ALL_CAPS for constants
+
+## Code Quality
+- Use meaningful variable and function names that clearly describe their purpose
+- Include helpful comments for complex logic
+- Add error handling for user inputs and API calls

.github/dependabot.yml

@@ -1 +1,59 @@
-
+# .github/dependabot.yml - COMPLETE VERSION
+version: 2
+updates:
+  # Root dependencies
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      root-deps:
+        patterns: ["*"]
+
+  # Frontend workspace
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+    groups:
+      frontend-deps:
+        patterns: ["*"]
+
+  # Backend workspace
+  - package-ecosystem: "npm"
+    directory: "/backend"
+    schedule:
+      interval: "weekly"
+
+  # Services
+  - package-ecosystem: "npm"
+    directory: "/services/deafauth"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "npm"
+    directory: "/services/pinksync"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "npm"
+    directory: "/services/fibonrose"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "npm"
+    directory: "/services/accessibility-nodes"
+    schedule:
+      interval: "weekly"
+
+  # AI workspace
+  - package-ecosystem: "npm"
+    directory: "/ai"
+    schedule:
+      interval: "weekly"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"

.github/workflows/Security-hardening.yml

@@ -0,0 +1,208 @@
+name: Security Hardening
+
+on:
+  pull_request:
+    branches: [ "main", "develop" ]
+  push:
+    branches: [ "main" ]
+  schedule:
+    # Run security checks daily at 2 AM UTC
+    - cron: '0 2 * * *'
+
+jobs:
+  security-audit:
+    name: Security Audit and Dependency Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run npm audit
+        run: |
+          echo "Running npm audit..."
+          npm audit --audit-level=high
+        continue-on-error: false
+
+      - name: Check for banned imports in /api
+        run: |
+          echo "Checking for banned database imports in /api directory..."
+          if grep -r "import.*drizzle" ./api/ 2>/dev/null; then
+            echo "ERROR: Direct drizzle imports found in /api directory"
+            exit 1
+          fi
+          if grep -r "import.*pg\>" ./api/ 2>/dev/null; then
+            echo "ERROR: Direct pg imports found in /api directory"
+            exit 1
+          fi
+          if grep -r "from ['\"]drizzle" ./api/ 2>/dev/null; then
+            echo "ERROR: Direct drizzle imports found in /api directory"
+            exit 1
+          fi
+          echo "✓ No banned imports found in /api directory"
+
+      - name: Check for committed secrets
+        run: |
+          echo "Checking for accidentally committed secrets..."
+          # Check for common secret patterns
+          if grep -r "sk_live_" . --exclude-dir=node_modules --exclude-dir=.git 2>/dev/null; then
+            echo "ERROR: Stripe live secret key found in repository"
+            exit 1
+          fi
+          if grep -r "sk_test_" . --exclude-dir=node_modules --exclude-dir=.git --exclude=".env.example" 2>/dev/null; then
+            echo "WARNING: Stripe test secret key found - should be in environment variables"
+          fi
+          if grep -r "PRIVATE_KEY" . --exclude-dir=node_modules --exclude-dir=.git --exclude="*.md" 2>/dev/null | grep -v "PRIVATE_KEY_PATH"; then
+            echo "ERROR: Private key found in repository"
+            exit 1
+          fi
+          echo "✓ No obvious secrets found in repository"
+
+      - name: Check SECURITY.md exists
+        run: |
+          if [ ! -f "SECURITY.md" ]; then
+            echo "ERROR: SECURITY.md not found in repository root"
+            exit 1
+          fi
+          echo "✓ SECURITY.md exists"
+
+      - name: Check agents.md exists
+        run: |
+          if [ ! -f "agents.md" ]; then
+            echo "ERROR: agents.md not found in repository root"
+            exit 1
+          fi
+          echo "✓ agents.md exists"
+
+      - name: Verify TypeScript compilation
+        run: |
+          echo "Checking TypeScript compilation..."
+          npm run check || echo "TypeScript errors found - review before merge"
+        continue-on-error: true
+
+  api-security:
+    name: API Security Checks
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check API routes for content-type enforcement
+        run: |
+          echo "Checking API routes for proper content-type handling..."
+          # Check for HTML responses in API routes (potential security issue)
+          if grep -r "text/html\|<html\|<body" ./server/routes.ts ./server/api/ --exclude="*.test.*" 2>/dev/null; then
+            echo "WARNING: HTML content detected in API routes - API should return JSON only"
+          fi
+          echo "✓ API content-type check complete"
+
+      - name: Check for SQL injection vulnerabilities
+        run: |
+          echo "Checking for potential SQL injection patterns..."
+          if grep -r "db.query.*\${" ./server/ --exclude-dir=node_modules 2>/dev/null; then
+            echo "WARNING: Template literal found in db.query - verify parameterized queries are used"
+          fi
+          echo "✓ SQL injection check complete"
+
+  pii-detection:
+    name: PII and Sensitive Data Detection
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Check for PII in test files
+        run: |
+          echo "Checking for real PII in test files..."
+          # Look for real SSN patterns (not test data)
+          if grep -r "[0-9]\{3\}-[0-9]\{2\}-[0-9]\{4\}" ./test* --exclude-dir=node_modules 2>/dev/null | grep -v "000-00-0000" | grep -v "123-45-6789"; then
+            echo "WARNING: Real SSN patterns found in tests - use synthetic data only"
+          fi
+          echo "✓ PII detection check complete"
+
+      - name: Check for hardcoded credentials
+        run: |
+          echo "Checking for hardcoded credentials..."
+          if grep -ri "password\s*=\s*['\"][^'\"]*['\"]" . --exclude-dir=node_modules --exclude-dir=.git --exclude="*.md" 2>/dev/null; then
+            echo "WARNING: Hardcoded passwords found - use environment variables"
+          fi
+          echo "✓ Credential check complete"
+
+  dependency-pinning:
+    name: Verify Dependency Pinning
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Check for unpinned dependencies
+        run: |
+          echo "Checking package.json for unpinned dependencies..."
+          if grep -E '"\^|"~' package.json; then
+            echo "WARNING: Unpinned dependencies found in package.json"
+            echo "For production, consider using exact versions (remove ^ and ~)"
+          fi
+          echo "✓ Dependency pinning check complete"
+
+  rate-limit-check:
+    name: Verify Rate Limiting
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Check for rate limiting implementation
+        run: |
+          echo "Checking for rate limiting in API routes..."
+          if ! grep -r "rateLimit\|rate-limit" ./server/ 2>/dev/null; then
+            echo "WARNING: No rate limiting implementation detected"
+            echo "Consider adding express-rate-limit or similar middleware"
+          else
+            echo "✓ Rate limiting implementation found"
+          fi
+
+  summary:
+    name: Security Check Summary
+    runs-on: ubuntu-latest
+    needs: [security-audit, api-security, pii-detection, dependency-pinning, rate-limit-check]
+    if: always()
+
+    steps:
+      - name: Summary
+        run: |
+          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+          echo "Security Hardening Checks Complete"
+          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+          echo ""
+          echo "Review any warnings above and ensure:"
+          echo "  ✓ No high/critical vulnerabilities in dependencies"
+          echo "  ✓ No banned imports in /api directory"
+          echo "  ✓ SECURITY.md and agents.md are present"
+          echo "  ✓ No secrets committed to repository"
+          echo "  ✓ API routes enforce proper content-types"
+          echo "  ✓ Rate limiting is implemented"
+          echo ""
+          echo "For security concerns, contact: security@mbtq.dev"
+          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"