security: harden CSPRNG, SQL injection guard, error handling, and info disclosure

[Copilot]

Defensive security pass across src/ addressing six distinct vulnerability classes without altering public API behavior.

Changes

Insecure Randomness (hash-id.ts)

Replaced Math.random() with crypto.randomInt(). The module is documented as suitable for one-time codes — it must use a CSPRNG.

SQL Injection via Identifier Interpolation (cleaner.ts)

dataset, table, timestamp, and column were interpolated directly into a BigQuery DML template literal. Added validateIdentifier() enforcing ^[a-zA-Z_][a-zA-Z0-9_]*$ on all four before SQL is built.

// Before — no validation:
return `DELETE FROM \`${filter.dataset}.${filter.table}\` WHERE STRUCT(id, ${filter.timestamp} ...`;

// After — identifier validated first:
validateIdentifier(filter.dataset, 'dataset');
validateIdentifier(filter.table, 'table');
validateIdentifier(filter.timestamp, 'timestamp');

Unguarded JSON.parse (global.ts)

getPublicUrl and getUrlAndGs called JSON.parse(process.env.FIREBASE_CONFIG) with no error handling — a missing or malformed env var produced cryptic SyntaxError crashes. Extracted a parseFirebaseConfig() helper that validates presence and catches parse errors with descriptive messages.

Non-JSON Error Body (api-request.ts)

response.json() in the non-ok path had no fallback; a non-JSON error body would surface an unhandled SyntaxError. Wrapped in try/catch with 'unknown error' fallback. Also removed a console.log that leaked content-type headers on every request.

User Input in Error Messages (validate-url.ts)

throw new Error(\Invalid URL: ${url}`)reflected raw user input into error messages, enabling log injection. Simplified tothrow new Error('Invalid URL')`.

Primitive String Throws (user.ts)

Two catch blocks used throw \template literal`— losing stack traces and breakinginstanceof Errorchecks. Both now usethrow new Error(message, { cause: error })`.