@angular-helpers/security 21.2.0 → 21.4.1

package/fesm2022/angular-helpers-security.mjs

@@ -1,6 +1,8 @@
 import * as i0 from '@angular/core';
-import { inject, DestroyRef, Injectable, PLATFORM_ID, InjectionToken, makeEnvironmentProviders } from '@angular/core';
-import { isPlatformBrowser } from '@angular/common';
+import { inject, DestroyRef, Injectable, PLATFORM_ID, InjectionToken, signal, computed, NgZone, Injector, makeEnvironmentProviders } from '@angular/core';
+import { isPlatformBrowser, DOCUMENT } from '@angular/common';
+import { Observable, Subject, fromEvent, merge } from 'rxjs';
+import { throttleTime } from 'rxjs/operators';
 
 /**
  * Security service for regular expressions that prevents ReDoS
@@ -64,10 +66,10 @@ class RegexSecurityService {
                 message: 'Nested quantifiers (catastrophic backtracking)',
             },
             { pattern: /\+\+/, risk: 'high', message: 'Nested plus quantifiers' },
-            { pattern: /\(\?\=/, risk: 'medium', message: 'Lookahead assertions' },
-            { pattern: /\(\?\!/, risk: 'medium', message: 'Negative lookahead' },
-            { pattern: /\(\?\:/, risk: 'low', message: 'Non-capturing groups' },
-            { pattern: /\(\?\</, risk: 'high', message: 'Lookbehind assertions' },
+            { pattern: /\(\?=/, risk: 'medium', message: 'Lookahead assertions' },
+            { pattern: /\(\?!/, risk: 'medium', message: 'Negative lookahead' },
+            { pattern: /\(\?:/, risk: 'low', message: 'Non-capturing groups' },
+            { pattern: /\(\?</, risk: 'high', message: 'Lookbehind assertions' },
             { pattern: /\(\?\(\?\)/, risk: 'critical', message: 'Recursive patterns' },
             { pattern: /(\{(\d+,)?\d+\})/, risk: 'medium', message: 'Quantified repetition' },
             {
@@ -247,9 +249,9 @@ class RegexSecurityService {
         complexity += (pattern.match(/\+\+/g) || []).length * 5;
         complexity += (pattern.match(/\?\?/g) || []).length * 3;
         // Lookaheads/lookbehinds
-        complexity += (pattern.match(/\(\?\=/g) || []).length * 2;
-        complexity += (pattern.match(/\(\?\!/g) || []).length * 2;
-        complexity += (pattern.match(/\(\?\</g) || []).length * 3;
+        complexity += (pattern.match(/\(\?=/g) || []).length * 2;
+        complexity += (pattern.match(/\(\?!/g) || []).length * 2;
+        complexity += (pattern.match(/\(\?</g) || []).length * 3;
         // Nested groups
         const openParens = (pattern.match(/\(/g) || []).length;
         complexity += openParens * 0.5;
@@ -725,7 +727,185 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.4", ngImpor
             type: Injectable
         }], ctorParameters: () => [] });
 
-const SANITIZER_CONFIG = new InjectionToken('SANITIZER_CONFIG');
+/**
+ * Internal validator helpers shared by both Reactive Forms validators
+ * (`SecurityValidators`) and Signal Forms validators (`@angular-helpers/security/signal-forms`).
+ *
+ * All helpers in this module are pure and side-effect free. Browser-only helpers
+ * (those using DOMParser) are clearly marked and throw when called outside a browser.
+ *
+ * This module is INTERNAL — not part of the public API surface.
+ */
+const COMMON_PASSWORDS = new Set([
+    'password',
+    '123456',
+    'qwerty',
+    'letmein',
+    'admin',
+    'welcome',
+    '111111',
+    'abc123',
+    'monkey',
+    'master',
+    'login',
+    'pass',
+]);
+const ALPHA_SEQUENCES = 'abcdefghijklmnopqrstuvwxyz';
+const DIGIT_SEQUENCES = '0123456789';
+const KEYBOARD_ROWS = ['qwertyuiop', 'asdfghjkl', 'zxcvbnm'];
+const SCORE_LABELS = {
+    0: 'very-weak',
+    1: 'weak',
+    2: 'fair',
+    3: 'strong',
+    4: 'very-strong',
+};
+/**
+ * Entropy-based password assessment. Pure function — safe to call outside Angular context.
+ *
+ * Thresholds (bits of entropy):
+ * - 0 (very-weak):  < 28
+ * - 1 (weak):       28–35
+ * - 2 (fair):       36–49
+ * - 3 (strong):     50–69
+ * - 4 (very-strong): ≥ 70
+ */
+function assessPasswordStrength(password) {
+    if (!password) {
+        return {
+            score: 0,
+            label: 'very-weak',
+            entropy: 0,
+            feedback: ['Password cannot be empty'],
+        };
+    }
+    const feedback = [];
+    const chars = [...password];
+    const length = chars.length;
+    const hasLower = /[a-z]/.test(password);
+    const hasUpper = /[A-Z]/.test(password);
+    const hasDigit = /[0-9]/.test(password);
+    const hasSymbol = /[!@#$%^&*()\-_=+[\]{}|;:'",.<>/?\\`~]/.test(password);
+    const hasExtended = chars.some((c) => c.codePointAt(0) > 127);
+    let poolSize = 0;
+    if (hasLower)
+        poolSize += 26;
+    if (hasUpper)
+        poolSize += 26;
+    if (hasDigit)
+        poolSize += 10;
+    if (hasSymbol)
+        poolSize += 32;
+    if (hasExtended)
+        poolSize += 64;
+    if (poolSize === 0)
+        poolSize = 26;
+    let entropy = length * Math.log2(poolSize);
+    const hasAlphaSeq = containsSequence(password.toLowerCase(), ALPHA_SEQUENCES, 3);
+    const hasDigitSeq = containsSequence(password, DIGIT_SEQUENCES, 3);
+    const hasRepeat = /(.)\1{2,}/.test(password);
+    const hasKeyboard = KEYBOARD_ROWS.some((row) => containsSequence(password.toLowerCase(), row, 4));
+    if (hasAlphaSeq || hasDigitSeq) {
+        entropy *= 0.8;
+        feedback.push('Avoid predictable sequences (abc, 123)');
+    }
+    if (hasRepeat) {
+        entropy *= 0.9;
+        feedback.push('Avoid repeated characters');
+    }
+    if (hasKeyboard) {
+        entropy *= 0.85;
+        feedback.push('Avoid keyboard patterns (qwerty, asdf)');
+    }
+    if (length < 8) {
+        feedback.push('Use at least 8 characters');
+    }
+    if (!hasUpper)
+        feedback.push('Add uppercase letters');
+    if (!hasDigit)
+        feedback.push('Add numbers');
+    if (!hasSymbol)
+        feedback.push('Add special characters');
+    const isCommon = COMMON_PASSWORDS.has(password.toLowerCase());
+    let score = entropyToScore(entropy);
+    if (isCommon) {
+        score = Math.min(score, 1);
+        if (!feedback.includes('Use at least 8 characters')) {
+            feedback.push('This is a commonly used password');
+        }
+    }
+    return {
+        score,
+        label: SCORE_LABELS[score],
+        entropy: Math.round(entropy * 100) / 100,
+        feedback,
+    };
+}
+function entropyToScore(entropy) {
+    if (entropy < 28)
+        return 0;
+    if (entropy < 36)
+        return 1;
+    if (entropy < 50)
+        return 2;
+    if (entropy < 70)
+        return 3;
+    return 4;
+}
+function containsSequence(input, sequence, minLength) {
+    for (let i = 0; i <= sequence.length - minLength; i++) {
+        if (input.includes(sequence.substring(i, i + minLength)))
+            return true;
+    }
+    return false;
+}
+/**
+ * URL safety check. Returns the normalized URL when the scheme is allowed, `null` otherwise.
+ * Malformed URLs, relative URLs, and blocked schemes all return `null`.
+ */
+function sanitizeUrlString(input, allowedSchemes = ['http:', 'https:']) {
+    if (!input)
+        return null;
+    try {
+        const url = new URL(input);
+        return allowedSchemes.includes(url.protocol) ? url.toString() : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Boolean helper around `sanitizeUrlString`. `true` when the URL is well-formed and allowed.
+ */
+function isUrlSafe(input, allowedSchemes = ['http:', 'https:']) {
+    return sanitizeUrlString(input, allowedSchemes) !== null;
+}
+const SCRIPT_INJECTION_PATTERN = /<\s*script\b|javascript:|on\w+\s*=/i;
+/**
+ * Lightweight check for common script-injection sentinels. Complements (does NOT replace)
+ * a full HTML sanitizer or Content Security Policy.
+ */
+function containsScriptInjection(input) {
+    if (!input)
+        return false;
+    return SCRIPT_INJECTION_PATTERN.test(input);
+}
+const SQL_HINT_PATTERNS = [
+    /'\s*or\s+'?1'?\s*=\s*'?1/i,
+    /--\s*$/m,
+    /;\s*--/,
+    /\/\*/,
+    /\bunion\s+select\b/i,
+];
+/**
+ * Heuristic check for SQL-injection sentinel strings.
+ * Intended as defense-in-depth for client-side form inputs; never a substitute for parameterized queries.
+ */
+function containsSqlInjectionHints(input) {
+    if (!input)
+        return false;
+    return SQL_HINT_PATTERNS.some((pattern) => pattern.test(input));
+}
 const DEFAULT_ALLOWED_TAGS = [
     'b',
     'i',
@@ -742,13 +922,81 @@ const DEFAULT_ALLOWED_TAGS = [
 const DEFAULT_ALLOWED_ATTRIBUTES = {
     a: ['href'],
 };
-const SAFE_URL_SCHEMES = ['http:', 'https:'];
+/**
+ * Sanitizes an HTML string by allowlist. Browser-only: requires DOMParser.
+ *
+ * @throws {Error} When called in a non-browser environment.
+ */
+function sanitizeHtmlString(input, options = {}) {
+    if (!input)
+        return '';
+    if (typeof DOMParser === 'undefined') {
+        throw new Error('sanitizeHtmlString requires a browser environment (DOMParser unavailable)');
+    }
+    const allowedTags = new Set(options.allowedTags ?? DEFAULT_ALLOWED_TAGS);
+    const allowedAttributes = options.allowedAttributes ?? DEFAULT_ALLOWED_ATTRIBUTES;
+    const parser = new DOMParser();
+    const doc = parser.parseFromString(input, 'text/html');
+    processHtmlNode(doc.body, allowedTags, allowedAttributes);
+    return doc.body.innerHTML;
+}
+/**
+ * Returns `true` when sanitizing `input` produces the same string (i.e. nothing was stripped).
+ * Empty strings are considered safe.
+ *
+ * @throws {Error} When called in a non-browser environment.
+ */
+function isHtmlSafe(input, options = {}) {
+    if (!input)
+        return true;
+    return sanitizeHtmlString(input, options) === input;
+}
+function processHtmlNode(node, allowedTags, allowedAttributes) {
+    const children = Array.from(node.childNodes);
+    for (const child of children) {
+        if (child.nodeType !== Node.ELEMENT_NODE)
+            continue;
+        const element = child;
+        const tagName = element.tagName.toLowerCase();
+        if (!allowedTags.has(tagName)) {
+            const text = element.textContent ?? '';
+            node.replaceChild(document.createTextNode(text), element);
+            continue;
+        }
+        sanitizeElementAttributes(element, tagName, allowedAttributes);
+        processHtmlNode(element, allowedTags, allowedAttributes);
+    }
+}
+function sanitizeElementAttributes(element, tagName, allowedAttributes) {
+    const attrsToRemove = [];
+    const allowed = allowedAttributes[tagName] ?? [];
+    for (let i = 0; i < element.attributes.length; i++) {
+        const attr = element.attributes[i];
+        if (attr.name.startsWith('on')) {
+            attrsToRemove.push(attr.name);
+            continue;
+        }
+        if (!allowed.includes(attr.name)) {
+            attrsToRemove.push(attr.name);
+            continue;
+        }
+        if (attr.name === 'href' && sanitizeUrlString(attr.value) === null) {
+            attrsToRemove.push(attr.name);
+        }
+    }
+    attrsToRemove.forEach((name) => element.removeAttribute(name));
+}
+
+const SANITIZER_CONFIG = new InjectionToken('SANITIZER_CONFIG');
 /**
  * Service for structured input sanitization to defend against XSS, URL injection, and unsafe HTML.
  *
  * This service is defense-in-depth and DOES NOT replace a Content Security Policy (CSP).
  * Always configure a proper CSP alongside using this service.
  *
+ * Delegates to shared pure helpers in `internal/validators-core` so Signal Forms and Reactive Forms
+ * validators share the exact same sanitization logic.
+ *
  * @example
  * const clean = sanitizer.sanitizeHtml('<b>Hello</b><script>alert(1)</script>');
  * // → '<b>Hello</b>'
@@ -763,7 +1011,7 @@ class InputSanitizerService {
     allowedAttributes;
     constructor() {
         const config = inject(SANITIZER_CONFIG, { optional: true }) ?? {};
-        this.allowedTags = new Set(config.allowedTags ?? DEFAULT_ALLOWED_TAGS);
+        this.allowedTags = config.allowedTags ?? DEFAULT_ALLOWED_TAGS;
         this.allowedAttributes = config.allowedAttributes ?? DEFAULT_ALLOWED_ATTRIBUTES;
     }
     isSupported() {
@@ -779,12 +1027,10 @@ class InputSanitizerService {
         if (!this.isSupported()) {
             throw new Error('sanitizeHtml requires a browser environment (DOMParser unavailable)');
         }
-        if (!input)
-            return '';
-        const parser = new DOMParser();
-        const doc = parser.parseFromString(input, 'text/html');
-        this.processNode(doc.body);
-        return doc.body.innerHTML;
+        return sanitizeHtmlString(input, {
+            allowedTags: this.allowedTags,
+            allowedAttributes: this.allowedAttributes,
+        });
     }
     /**
      * Validates and normalizes a URL string.
@@ -792,15 +1038,7 @@ class InputSanitizerService {
      * Returns `null` for `javascript:`, `data:`, `vbscript:`, relative URLs, or malformed input.
      */
     sanitizeUrl(input) {
-        if (!input)
-            return null;
-        try {
-            const url = new URL(input);
-            return SAFE_URL_SCHEMES.includes(url.protocol) ? url.toString() : null;
-        }
-        catch {
-            return null;
-        }
+        return sanitizeUrlString(input);
     }
     /**
      * Escapes HTML special characters for safe text interpolation.
@@ -830,41 +1068,6 @@ class InputSanitizerService {
             return null;
         }
     }
-    processNode(node) {
-        const children = Array.from(node.childNodes);
-        for (const child of children) {
-            if (child.nodeType !== Node.ELEMENT_NODE)
-                continue;
-            const element = child;
-            const tagName = element.tagName.toLowerCase();
-            if (!this.allowedTags.has(tagName)) {
-                const text = element.textContent ?? '';
-                node.replaceChild(document.createTextNode(text), element);
-                continue;
-            }
-            this.sanitizeAttributes(element, tagName);
-            this.processNode(element);
-        }
-    }
-    sanitizeAttributes(element, tagName) {
-        const attrsToRemove = [];
-        const allowed = this.allowedAttributes[tagName] ?? [];
-        for (let i = 0; i < element.attributes.length; i++) {
-            const attr = element.attributes[i];
-            if (attr.name.startsWith('on')) {
-                attrsToRemove.push(attr.name);
-                continue;
-            }
-            if (!allowed.includes(attr.name)) {
-                attrsToRemove.push(attr.name);
-                continue;
-            }
-            if (attr.name === 'href' && this.sanitizeUrl(attr.value) === null) {
-                attrsToRemove.push(attr.name);
-            }
-        }
-        attrsToRemove.forEach((name) => element.removeAttribute(name));
-    }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: InputSanitizerService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: InputSanitizerService });
 }
@@ -872,34 +1075,13 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.4", ngImpor
             type: Injectable
         }], ctorParameters: () => [] });
 
-const COMMON_PASSWORDS = new Set([
-    'password',
-    '123456',
-    'qwerty',
-    'letmein',
-    'admin',
-    'welcome',
-    '111111',
-    'abc123',
-    'monkey',
-    'master',
-    'login',
-    'pass',
-]);
-const ALPHA_SEQUENCES = 'abcdefghijklmnopqrstuvwxyz';
-const DIGIT_SEQUENCES = '0123456789';
-const KEYBOARD_ROWS = ['qwertyuiop', 'asdfghjkl', 'zxcvbnm'];
-const SCORE_LABELS = {
-    0: 'very-weak',
-    1: 'weak',
-    2: 'fair',
-    3: 'strong',
-    4: 'very-strong',
-};
 /**
  * Service for entropy-based password strength evaluation.
  * All methods are synchronous and side-effect free — safely wrappable in Angular `computed()`.
  *
+ * Delegates to the shared {@link assessPasswordStrength} helper so Reactive Forms validators,
+ * Signal Forms validators, and direct service consumers all share identical logic.
+ *
  * Score thresholds (bits of entropy):
  * - 0 (very-weak):  < 28 bits
  * - 1 (weak):       28–35 bits
@@ -919,99 +1101,849 @@ class PasswordStrengthService {
      * Never throws — returns score 0 for empty or null-like input.
      */
     assess(password) {
-        if (!password) {
-            return {
-                score: 0,
-                label: 'very-weak',
-                entropy: 0,
-                feedback: ['Password cannot be empty'],
+        return assessPasswordStrength(password);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: PasswordStrengthService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: PasswordStrengthService });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: PasswordStrengthService, decorators: [{
+            type: Injectable
+        }] });
+
+/**
+ * Thrown when a string is not a well-formed JWT (wrong number of segments,
+ * malformed base64url payload, or non-JSON payload).
+ */
+class InvalidJwtError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InvalidJwtError';
+    }
+}
+/**
+ * Client-side JWT inspection utilities.
+ *
+ * **This service decodes JWT payloads for client-side inspection only. Signature verification
+ * MUST happen server-side** — this service never validates signatures, issuer, audience,
+ * or any trust-related property.
+ *
+ * Use cases:
+ * - Reading the expiration to schedule refresh
+ * - Extracting user-facing claims (e.g. `name`, `email`) for UX
+ * - Detecting expired tokens to redirect to login
+ *
+ * @example
+ * const token = localStorage.getItem('access_token');
+ * if (!token || jwt.isExpired(token, 30)) {
+ *   router.navigate(['/login']);
+ * }
+ * const userId = jwt.claim<string>(token, 'sub');
+ */
+class JwtService {
+    /**
+     * Decodes the payload segment of a JWT and returns it typed.
+     *
+     * @throws {InvalidJwtError} When the token is not three dot-separated segments,
+     *   or when the payload cannot be base64url-decoded and parsed as JSON.
+     */
+    decode(token) {
+        if (typeof token !== 'string' || token.length === 0) {
+            throw new InvalidJwtError('JWT is empty');
+        }
+        const segments = token.split('.');
+        if (segments.length !== 3) {
+            throw new InvalidJwtError(`JWT must have 3 segments, got ${segments.length}`);
+        }
+        const payloadSegment = segments[1];
+        let json;
+        try {
+            json = base64UrlDecode(payloadSegment);
+        }
+        catch (cause) {
+            throw new InvalidJwtError(`JWT payload is not valid base64url: ${cause instanceof Error ? cause.message : 'unknown'}`);
+        }
+        try {
+            return JSON.parse(json);
+        }
+        catch (cause) {
+            throw new InvalidJwtError(`JWT payload is not valid JSON: ${cause instanceof Error ? cause.message : 'unknown'}`);
+        }
+    }
+    /**
+     * Returns `true` when the token is expired relative to `Date.now()`.
+     * Missing or non-numeric `exp` counts as expired (fail-secure).
+     *
+     * @param leewaySeconds Optional clock-skew tolerance in seconds. Default: `0`.
+     */
+    isExpired(token, leewaySeconds = 0) {
+        let payload;
+        try {
+            payload = this.decode(token);
+        }
+        catch {
+            return true;
+        }
+        if (typeof payload.exp !== 'number')
+            return true;
+        const expiresAtMs = payload.exp * 1000;
+        return expiresAtMs <= Date.now() - leewaySeconds * 1000;
+    }
+    /**
+     * Returns milliseconds until the token expires.
+     * Negative when already expired. `0` when `exp` is missing.
+     */
+    expiresIn(token) {
+        let payload;
+        try {
+            payload = this.decode(token);
+        }
+        catch {
+            return -1;
+        }
+        if (typeof payload.exp !== 'number')
+            return 0;
+        return payload.exp * 1000 - Date.now();
+    }
+    /**
+     * Extracts a single claim from the payload. Returns `null` when the claim is absent
+     * or the token is malformed.
+     */
+    claim(token, name) {
+        let payload;
+        try {
+            payload = this.decode(token);
+        }
+        catch {
+            return null;
+        }
+        return payload[name] ?? null;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: JwtService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: JwtService });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: JwtService, decorators: [{
+            type: Injectable
+        }] });
+function base64UrlDecode(input) {
+    const padded = input.replace(/-/g, '+').replace(/_/g, '/');
+    const padLength = (4 - (padded.length % 4)) % 4;
+    const base64 = padded + '='.repeat(padLength);
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return new TextDecoder().decode(bytes);
+}
+
+class ClipboardUnsupportedError extends Error {
+    constructor() {
+        super('Clipboard API not available in this environment');
+        this.name = 'ClipboardUnsupportedError';
+    }
+}
+const DEFAULT_CLEAR_MS = 15_000;
+/**
+ * Copies sensitive strings to the clipboard with automatic, verified clearing.
+ *
+ * Mirrors the behaviour of password managers (1Password, Bitwarden): the clipboard is
+ * cleared only when its current content still matches what we wrote, preventing clobbering
+ * of unrelated user copies.
+ *
+ * Requires a secure context and `navigator.clipboard`. The auto-clear step additionally
+ * requires `navigator.clipboard.readText()` permission; when denied, the clear is skipped
+ * and the status emits `'read-denied'`.
+ *
+ * Any pending clear timer is cancelled automatically when the owning injector is destroyed.
+ *
+ * @example
+ * await sensitiveClipboard.copy(password, { clearAfterMs: 15_000 });
+ */
+class SensitiveClipboardService {
+    platformId = inject(PLATFORM_ID);
+    destroyRef = inject(DestroyRef);
+    pendingTimer = null;
+    constructor() {
+        this.destroyRef.onDestroy(() => this.cancelPendingClear());
+    }
+    isSupported() {
+        return (isPlatformBrowser(this.platformId) &&
+            typeof navigator !== 'undefined' &&
+            typeof navigator.clipboard?.writeText === 'function');
+    }
+    /**
+     * Writes `text` to the clipboard and schedules an auto-clear.
+     *
+     * @throws {ClipboardUnsupportedError} When the Clipboard API is unavailable.
+     */
+    async copy(text, options = {}) {
+        if (!this.isSupported()) {
+            throw new ClipboardUnsupportedError();
+        }
+        const clearAfterMs = options.clearAfterMs ?? DEFAULT_CLEAR_MS;
+        await navigator.clipboard.writeText(text);
+        this.cancelPendingClear();
+        if (clearAfterMs <= 0)
+            return;
+        this.pendingTimer = setTimeout(() => {
+            void this.safeClear(text);
+        }, clearAfterMs);
+    }
+    /**
+     * Reactive variant of {@link copy}. Emits `'copied'` immediately after writing, then
+     * `'cleared'` | `'read-denied'` | `'error'` once the auto-clear completes (or is skipped).
+     */
+    copy$(text, options = {}) {
+        return new Observable((subscriber) => {
+            if (!this.isSupported()) {
+                subscriber.error(new ClipboardUnsupportedError());
+                return () => {
+                    /* no teardown */
+                };
+            }
+            const clearAfterMs = options.clearAfterMs ?? DEFAULT_CLEAR_MS;
+            let cleared = false;
+            let timer = null;
+            navigator.clipboard
+                .writeText(text)
+                .then(() => {
+                subscriber.next('copied');
+                if (clearAfterMs <= 0) {
+                    subscriber.complete();
+                    return;
+                }
+                timer = setTimeout(async () => {
+                    const status = await this.safeClear(text);
+                    cleared = true;
+                    subscriber.next(status);
+                    subscriber.complete();
+                }, clearAfterMs);
+            })
+                .catch(() => {
+                subscriber.next('error');
+                subscriber.complete();
+            });
+            return () => {
+                if (!cleared && timer !== null)
+                    clearTimeout(timer);
             };
+        });
+    }
+    /**
+     * Cancels any pending auto-clear timer. The clipboard content is not modified.
+     */
+    cancelPendingClear() {
+        if (this.pendingTimer !== null) {
+            clearTimeout(this.pendingTimer);
+            this.pendingTimer = null;
+        }
+    }
+    async safeClear(expected) {
+        try {
+            const current = await navigator.clipboard.readText();
+            if (current !== expected)
+                return 'read-denied';
+            await navigator.clipboard.writeText('');
+            return 'cleared';
+        }
+        catch {
+            return 'read-denied';
+        }
+    }
+    /**
+     * Forcefully clears the clipboard unconditionally.
+     */
+    async clear() {
+        if (!this.isSupported())
+            return;
+        this.cancelPendingClear();
+        try {
+            await navigator.clipboard.writeText('');
+        }
+        catch {
+            // ignore
         }
-        const feedback = [];
-        const chars = [...password];
-        const length = chars.length;
-        const hasLower = /[a-z]/.test(password);
-        const hasUpper = /[A-Z]/.test(password);
-        const hasDigit = /[0-9]/.test(password);
-        const hasSymbol = /[!@#$%^&*()\-_=+[\]{}|;:'",.<>/?\\`~]/.test(password);
-        const hasExtended = chars.some((c) => c.codePointAt(0) > 127);
-        let poolSize = 0;
-        if (hasLower)
-            poolSize += 26;
-        if (hasUpper)
-            poolSize += 26;
-        if (hasDigit)
-            poolSize += 10;
-        if (hasSymbol)
-            poolSize += 32;
-        if (hasExtended)
-            poolSize += 64;
-        if (poolSize === 0)
-            poolSize = 26;
-        let entropy = length * Math.log2(poolSize);
-        const hasAlphaSeq = this.containsSequence(password.toLowerCase(), ALPHA_SEQUENCES, 3);
-        const hasDigitSeq = this.containsSequence(password, DIGIT_SEQUENCES, 3);
-        const hasRepeat = /(.)\1{2,}/.test(password);
-        const hasKeyboard = KEYBOARD_ROWS.some((row) => this.containsSequence(password.toLowerCase(), row, 4));
-        if (hasAlphaSeq || hasDigitSeq) {
-            entropy *= 0.8;
-            feedback.push('Avoid predictable sequences (abc, 123)');
-        }
-        if (hasRepeat) {
-            entropy *= 0.9;
-            feedback.push('Avoid repeated characters');
-        }
-        if (hasKeyboard) {
-            entropy *= 0.85;
-            feedback.push('Avoid keyboard patterns (qwerty, asdf)');
-        }
-        if (length < 8) {
-            feedback.push('Use at least 8 characters');
-        }
-        if (!hasUpper)
-            feedback.push('Add uppercase letters');
-        if (!hasDigit)
-            feedback.push('Add numbers');
-        if (!hasSymbol)
-            feedback.push('Add special characters');
-        const isCommon = COMMON_PASSWORDS.has(password.toLowerCase());
-        let score = this.entropyToScore(entropy);
-        if (isCommon) {
-            score = Math.min(score, 1);
-            if (!feedback.includes('Use at least 8 characters')) {
-                feedback.push('This is a commonly used password');
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: SensitiveClipboardService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: SensitiveClipboardService });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: SensitiveClipboardService, decorators: [{
+            type: Injectable
+        }], ctorParameters: () => [] });
+
+const HIBP_CONFIG = new InjectionToken('HIBP_CONFIG');
+const DEFAULT_ENDPOINT = 'https://api.pwnedpasswords.com/range/';
+/**
+ * Checks whether a password appears in the Have I Been Pwned breach corpus using the
+ * k-anonymity API. Only the first 5 hex characters of the SHA-1 hash leave the browser;
+ * the full password is never transmitted.
+ *
+ * The service is fail-open: network errors return `{ leaked: false, error: 'network' }`
+ * to avoid blocking form submissions when HIBP is unreachable. Use this signal to
+ * *complement* entropy-based checks, never as the sole gate.
+ *
+ * @example
+ * const { leaked, count } = await hibp.isPasswordLeaked(password);
+ * if (leaked) alert(`This password has appeared in ${count} breaches`);
+ */
+class HibpService {
+    platformId = inject(PLATFORM_ID);
+    webCrypto = inject(WebCryptoService);
+    endpoint;
+    constructor() {
+        const config = inject(HIBP_CONFIG, { optional: true }) ?? {};
+        this.endpoint = config.endpoint ?? DEFAULT_ENDPOINT;
+    }
+    isSupported() {
+        return (isPlatformBrowser(this.platformId) &&
+            typeof fetch === 'function' &&
+            this.webCrypto.isSupported());
+    }
+    /**
+     * Returns whether the given password is present in the HIBP breach corpus.
+     * Never throws: network failures return `{ leaked: false, error: 'network' }`,
+     * unsupported environments return `{ leaked: false, error: 'unsupported' }`.
+     */
+    async isPasswordLeaked(password) {
+        if (!this.isSupported()) {
+            return { leaked: false, count: 0, error: 'unsupported' };
+        }
+        if (!password) {
+            return { leaked: false, count: 0 };
+        }
+        let hashHex;
+        try {
+            hashHex = (await this.webCrypto.hash(password, 'SHA-1')).toUpperCase();
+        }
+        catch {
+            return { leaked: false, count: 0, error: 'unsupported' };
+        }
+        const prefix = hashHex.slice(0, 5);
+        const suffix = hashHex.slice(5);
+        let body;
+        try {
+            const response = await fetch(`${this.endpoint}${prefix}`, {
+                method: 'GET',
+                headers: { 'Add-Padding': 'true' },
+            });
+            if (response.status === 404) {
+                return { leaked: false, count: 0 };
             }
+            if (!response.ok) {
+                return { leaked: false, count: 0, error: 'network' };
+            }
+            body = await response.text();
         }
-        return {
-            score,
-            label: SCORE_LABELS[score],
-            entropy: Math.round(entropy * 100) / 100,
-            feedback,
-        };
+        catch {
+            return { leaked: false, count: 0, error: 'network' };
+        }
+        const match = findSuffixMatch(body, suffix);
+        return match > 0 ? { leaked: true, count: match } : { leaked: false, count: 0 };
     }
-    entropyToScore(entropy) {
-        if (entropy < 28)
-            return 0;
-        if (entropy < 36)
-            return 1;
-        if (entropy < 50)
-            return 2;
-        if (entropy < 70)
-            return 3;
-        return 4;
-    }
-    containsSequence(input, sequence, minLength) {
-        for (let i = 0; i <= sequence.length - minLength; i++) {
-            if (input.includes(sequence.substring(i, i + minLength)))
-                return true;
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: HibpService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: HibpService });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: HibpService, decorators: [{
+            type: Injectable
+        }], ctorParameters: () => [] });
+function findSuffixMatch(body, suffix) {
+    const lines = body.split(/\r?\n/);
+    for (const line of lines) {
+        const separatorIndex = line.indexOf(':');
+        if (separatorIndex === -1)
+            continue;
+        const lineSuffix = line.slice(0, separatorIndex).trim().toUpperCase();
+        if (lineSuffix !== suffix)
+            continue;
+        const count = parseInt(line.slice(separatorIndex + 1).trim(), 10);
+        // Padding rows (not in breach) have count 0; treat them as no match.
+        return Number.isFinite(count) && count > 0 ? count : 0;
+    }
+    return 0;
+}
+
+const RATE_LIMITER_CONFIG = new InjectionToken('RATE_LIMITER_CONFIG');
+/**
+ * Thrown by {@link RateLimiterService.consume} when the configured capacity is exhausted.
+ */
+class RateLimitExceededError extends Error {
+    key;
+    retryAfterMs;
+    constructor(key, retryAfterMs) {
+        super(`Rate limit exceeded for "${key}". Retry after ${retryAfterMs}ms.`);
+        this.key = key;
+        this.retryAfterMs = retryAfterMs;
+        this.name = 'RateLimitExceededError';
+    }
+}
+/**
+ * Client-side rate limiter with per-key policies. Use to protect the user's own backend
+ * from accidental bursts (search-as-you-type, button mashing, automated retries) or to
+ * pace client-side operations.
+ *
+ * Two policies are supported:
+ * - **Token bucket**: smooth rate limiting with burst capacity.
+ * - **Sliding window**: strict max operations per time window.
+ *
+ * Unknown keys are fail-open: `canExecute` returns `true`, `consume` is a no-op. Register
+ * policies explicitly with {@link configure} or via the `RATE_LIMITER_CONFIG` token.
+ *
+ * All state is kept in memory for the lifetime of the service instance — cross-tab
+ * synchronization is out of scope for v1.
+ *
+ * @example
+ * rateLimiter.configure('search', { type: 'token-bucket', capacity: 5, refillPerSecond: 1 });
+ *
+ * async search(query: string) {
+ *   await rateLimiter.consume('search'); // throws RateLimitExceededError when exhausted
+ *   return this.api.search(query);
+ * }
+ */
+class RateLimiterService {
+    destroyRef = inject(DestroyRef);
+    buckets = new Map();
+    constructor() {
+        const config = inject(RATE_LIMITER_CONFIG, { optional: true });
+        if (config?.defaults) {
+            for (const [key, policy] of Object.entries(config.defaults)) {
+                this.configure(key, policy);
+            }
         }
-        return false;
+        this.destroyRef.onDestroy(() => this.buckets.clear());
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: PasswordStrengthService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: PasswordStrengthService });
+    /**
+     * Registers or updates the policy for `key`. Re-configuring an existing key resets its state.
+     */
+    configure(key, policy) {
+        validatePolicy(policy);
+        const now = Date.now();
+        const initialRemaining = policy.type === 'token-bucket' ? policy.capacity : policy.max;
+        this.buckets.set(key, {
+            policy,
+            tokens: policy.type === 'token-bucket' ? policy.capacity : 0,
+            lastRefillAt: now,
+            timestamps: [],
+            remaining: signal(initialRemaining),
+        });
+    }
+    /**
+     * Attempts to consume `tokens` units from the bucket. Resolves on success; rejects with
+     * {@link RateLimitExceededError} when the bucket is exhausted.
+     *
+     * For undeclared keys, this method resolves immediately without consuming anything
+     * (fail-open behaviour — intentional to avoid silent failures when a policy is missing).
+     */
+    async consume(key, tokens = 1) {
+        const bucket = this.buckets.get(key);
+        if (!bucket)
+            return;
+        const now = Date.now();
+        if (bucket.policy.type === 'token-bucket') {
+            this.refillTokenBucket(bucket, now);
+            if (tokens > bucket.policy.capacity) {
+                throw new RateLimitExceededError(key, Infinity);
+            }
+            if (bucket.tokens < tokens) {
+                const deficit = tokens - bucket.tokens;
+                const retryAfterMs = Math.ceil((deficit / bucket.policy.refillPerSecond) * 1000);
+                throw new RateLimitExceededError(key, retryAfterMs);
+            }
+            bucket.tokens -= tokens;
+            bucket.remaining.set(Math.floor(bucket.tokens));
+            return;
+        }
+        // sliding-window
+        const windowStart = now - bucket.policy.windowMs;
+        bucket.timestamps = bucket.timestamps.filter((t) => t > windowStart);
+        if (bucket.timestamps.length + tokens > bucket.policy.max) {
+            const oldest = bucket.timestamps[0] ?? now;
+            const retryAfterMs = Math.max(0, oldest + bucket.policy.windowMs - now);
+            throw new RateLimitExceededError(key, retryAfterMs);
+        }
+        for (let i = 0; i < tokens; i++)
+            bucket.timestamps.push(now);
+        bucket.remaining.set(bucket.policy.max - bucket.timestamps.length);
+    }
+    /**
+     * Reactive signal indicating whether a single unit can be consumed from `key` right now.
+     * For undeclared keys, returns `signal(true)`.
+     */
+    canExecute(key) {
+        const bucket = this.buckets.get(key);
+        if (!bucket)
+            return signal(true).asReadonly();
+        return computed(() => bucket.remaining() >= 1);
+    }
+    /**
+     * Reactive signal holding the remaining capacity for `key`.
+     * For undeclared keys, returns `signal(Infinity)`.
+     */
+    remaining(key) {
+        const bucket = this.buckets.get(key);
+        if (!bucket)
+            return signal(Number.POSITIVE_INFINITY).asReadonly();
+        return bucket.remaining.asReadonly();
+    }
+    /**
+     * Resets the counter for `key` to its maximum. No-op for undeclared keys.
+     */
+    reset(key) {
+        const bucket = this.buckets.get(key);
+        if (!bucket)
+            return;
+        bucket.timestamps = [];
+        if (bucket.policy.type === 'token-bucket') {
+            bucket.tokens = bucket.policy.capacity;
+            bucket.lastRefillAt = Date.now();
+            bucket.remaining.set(bucket.policy.capacity);
+        }
+        else {
+            bucket.remaining.set(bucket.policy.max);
+        }
+    }
+    refillTokenBucket(bucket, now) {
+        if (bucket.policy.type !== 'token-bucket')
+            return;
+        const elapsedSec = (now - bucket.lastRefillAt) / 1000;
+        if (elapsedSec <= 0)
+            return;
+        const refilled = elapsedSec * bucket.policy.refillPerSecond;
+        bucket.tokens = Math.min(bucket.policy.capacity, bucket.tokens + refilled);
+        bucket.lastRefillAt = now;
+        bucket.remaining.set(Math.floor(bucket.tokens));
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: RateLimiterService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: RateLimiterService });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: PasswordStrengthService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: RateLimiterService, decorators: [{
             type: Injectable
+        }], ctorParameters: () => [] });
+function validatePolicy(policy) {
+    if (policy.type === 'token-bucket') {
+        if (policy.capacity <= 0 || policy.refillPerSecond <= 0) {
+            throw new RangeError('Token-bucket policy requires capacity > 0 and refillPerSecond > 0');
+        }
+        return;
+    }
+    if (policy.max <= 0 || policy.windowMs <= 0) {
+        throw new RangeError('Sliding-window policy requires max > 0 and windowMs > 0');
+    }
+}
+
+const CSRF_CONFIG = new InjectionToken('CSRF_CONFIG');
+const DEFAULT_STORAGE_KEY = '__csrf_token__';
+const DEFAULT_TOKEN_BYTES = 32;
+/**
+ * CSRF token helper using the double-submit cookie / header pattern.
+ *
+ * The service stores a cryptographically secure token in the configured storage and exposes
+ * it to HTTP interceptors ({@link withCsrfHeader}). Token lifecycle (creation, rotation,
+ * clearing) is the application's responsibility — typically the token is issued by the
+ * backend at login and stored via {@link storeToken}.
+ *
+ * Use a different header name than Angular's built-in XSRF ({@link `X-XSRF-TOKEN`}) to avoid
+ * interaction with `HttpClientXsrfModule`. Default: {@link `X-CSRF-Token`}.
+ */
+class CsrfService {
+    platformId = inject(PLATFORM_ID);
+    webCrypto = inject(WebCryptoService);
+    storageKey;
+    storageTarget;
+    constructor() {
+        const config = inject(CSRF_CONFIG, { optional: true }) ?? {};
+        this.storageKey = config.storageKey ?? DEFAULT_STORAGE_KEY;
+        this.storageTarget = config.storage ?? 'session';
+    }
+    isSupported() {
+        return isPlatformBrowser(this.platformId) && typeof window !== 'undefined';
+    }
+    /**
+     * Generates a new CSRF token as a 32-byte hex string. The token is NOT persisted
+     * automatically — call {@link storeToken} to save it.
+     */
+    generateToken() {
+        const bytes = this.webCrypto.generateRandomBytes(DEFAULT_TOKEN_BYTES);
+        return Array.from(bytes)
+            .map((b) => b.toString(16).padStart(2, '0'))
+            .join('');
+    }
+    /**
+     * Persists the token to the configured storage.
+     */
+    storeToken(token) {
+        if (!this.isSupported())
+            return;
+        this.nativeStorage.setItem(this.storageKey, token);
+    }
+    /**
+     * Returns the stored token, or `null` when unset or outside a browser environment.
+     */
+    getToken() {
+        if (!this.isSupported())
+            return null;
+        return this.nativeStorage.getItem(this.storageKey);
+    }
+    /**
+     * Removes the stored token.
+     */
+    clearToken() {
+        if (!this.isSupported())
+            return;
+        this.nativeStorage.removeItem(this.storageKey);
+    }
+    get nativeStorage() {
+        return this.storageTarget === 'session' ? sessionStorage : localStorage;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: CsrfService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: CsrfService });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: CsrfService, decorators: [{
+            type: Injectable
+        }], ctorParameters: () => [] });
+const DEFAULT_HEADER_NAME = 'X-CSRF-Token';
+const DEFAULT_METHODS = ['POST', 'PUT', 'PATCH', 'DELETE'];
+/**
+ * Functional HTTP interceptor that injects the current CSRF token as a request header on
+ * state-changing methods. When the token is absent, the header is omitted silently.
+ *
+ * Register via `provideHttpClient(withInterceptors([withCsrfHeader()]))`.
+ *
+ * @example
+ * bootstrapApplication(App, {
+ *   providers: [
+ *     provideSecurity({ enableCsrf: true }),
+ *     provideHttpClient(withInterceptors([withCsrfHeader()])),
+ *   ],
+ * });
+ */
+function withCsrfHeader(options = {}) {
+    const headerName = options.headerName ?? DEFAULT_HEADER_NAME;
+    const methods = new Set(options.methods ?? DEFAULT_METHODS);
+    return (request, next) => {
+        if (!methods.has(request.method.toUpperCase())) {
+            return next(request);
+        }
+        const csrf = inject(CsrfService);
+        const token = csrf.getToken();
+        if (!token)
+            return next(request);
+        return next(request.clone({ setHeaders: { [headerName]: token } }));
+    };
+}
+
+const DEFAULT_EVENTS = ['mousemove', 'keydown', 'mousedown', 'touchstart', 'scroll'];
+class SessionIdleService {
+    ngZone = inject(NgZone);
+    document = inject(DOCUMENT);
+    injector = inject(Injector);
+    destroyRef = inject(DestroyRef);
+    _isIdle = signal(false, ...(ngDevMode ? [{ debugName: "_isIdle" }] : /* istanbul ignore next */ []));
+    _isWarning = signal(false, ...(ngDevMode ? [{ debugName: "_isWarning" }] : /* istanbul ignore next */ []));
+    _timeRemaining = signal(null, ...(ngDevMode ? [{ debugName: "_timeRemaining" }] : /* istanbul ignore next */ []));
+    _timeoutSubject = new Subject();
+    isIdle = this._isIdle.asReadonly();
+    isWarning = this._isWarning.asReadonly();
+    timeRemaining = this._timeRemaining.asReadonly();
+    onTimeout = this._timeoutSubject.asObservable();
+    config = null;
+    lastActivityTime = 0;
+    timerInterval = null;
+    eventSubscription;
+    constructor() {
+        this.destroyRef.onDestroy(() => this.stop());
+    }
+    start(config) {
+        this.stop();
+        this.config = config;
+        this._isIdle.set(false);
+        this._isWarning.set(false);
+        this._timeRemaining.set(config.timeoutMs);
+        this.lastActivityTime = Date.now();
+        const eventsToTrack = config.events || DEFAULT_EVENTS;
+        this.ngZone.runOutsideAngular(() => {
+            const observables = eventsToTrack.map((ev) => fromEvent(this.document, ev));
+            this.eventSubscription = merge(...observables)
+                .pipe(throttleTime(500))
+                .subscribe(() => {
+                this.lastActivityTime = Date.now();
+            });
+            this.timerInterval = setInterval(() => this.checkIdle(), 1000);
+        });
+    }
+    stop() {
+        if (this.timerInterval) {
+            clearInterval(this.timerInterval);
+            this.timerInterval = null;
+        }
+        if (this.eventSubscription) {
+            this.eventSubscription.unsubscribe();
+            this.eventSubscription = undefined;
+        }
+        this.config = null;
+        this._timeRemaining.set(null);
+        this._isIdle.set(false);
+        this._isWarning.set(false);
+    }
+    reset() {
+        if (!this.config)
+            return;
+        this.lastActivityTime = Date.now();
+        this._timeRemaining.set(this.config.timeoutMs);
+        this._isIdle.set(false);
+        this._isWarning.set(false);
+    }
+    checkIdle() {
+        if (!this.config || this._isIdle())
+            return;
+        const elapsed = Date.now() - this.lastActivityTime;
+        const remaining = Math.max(0, this.config.timeoutMs - elapsed);
+        if (remaining === 0) {
+            this.triggerTimeout();
+        }
+        else {
+            const warningThreshold = this.config.warningThresholdMs || 0;
+            const shouldBeWarning = remaining <= warningThreshold;
+            this.ngZone.run(() => {
+                this._timeRemaining.set(remaining);
+                if (this._isWarning() !== shouldBeWarning) {
+                    this._isWarning.set(shouldBeWarning);
+                }
+            });
+        }
+    }
+    triggerTimeout() {
+        const config = this.config;
+        this.stop();
+        // Restore config temporarily to check for autoClear flags
+        this.config = config;
+        this.ngZone.run(() => {
+            this._timeRemaining.set(0);
+            this._isIdle.set(true);
+            this._timeoutSubject.next();
+            if (this.config?.autoClearStorage) {
+                const storage = this.injector.get(SecureStorageService, null);
+                if (storage)
+                    storage.clear();
+            }
+            if (this.config?.autoClearClipboard) {
+                const clipboard = this.injector.get(SensitiveClipboardService, null);
+                if (clipboard)
+                    clipboard.clear();
+            }
+            this.config = null;
+        });
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: SessionIdleService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: SessionIdleService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: SessionIdleService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root',
+                }]
+        }], ctorParameters: () => [] });
+
+const REPLAY_WINDOW_MS = 30_000;
+class SecureMessageService {
+    ngZone = inject(NgZone);
+    platformId = inject(PLATFORM_ID);
+    document = inject(DOCUMENT);
+    crypto = inject(WebCryptoService);
+    config = null;
+    _lastMessage = signal(null, ...(ngDevMode ? [{ debugName: "_lastMessage" }] : /* istanbul ignore next */ []));
+    _messages$ = new Subject();
+    messageHandler = null;
+    get targetWindow() {
+        return this.document.defaultView;
+    }
+    /** Returns a new HMAC-SHA-256 CryptoKey ready to use in `configure()`. */
+    generateChannelKey() {
+        return this.crypto.generateHmacKey('HMAC-SHA-256');
+    }
+    /**
+     * Configures the service with a signing key and allowed origins.
+     * Starts listening for incoming messages.
+     */
+    configure(config) {
+        this.destroy();
+        this.config = config;
+        if (!isPlatformBrowser(this.platformId))
+            return;
+        this.ngZone.runOutsideAngular(() => {
+            this.messageHandler = (event) => this.handleMessage(event);
+            this.targetWindow.addEventListener('message', this.messageHandler);
+        });
+    }
+    /**
+     * Signs and sends a payload to a target window.
+     * @throws if `targetOrigin` is `'*'`
+     */
+    async send(target, payload, targetOrigin) {
+        if (targetOrigin === '*') {
+            throw new Error('SecureMessageService: targetOrigin must be an explicit origin, not "*".');
+        }
+        if (!this.config) {
+            throw new Error('SecureMessageService: call configure() before send().');
+        }
+        const timestamp = Date.now();
+        const nonce = this.targetWindow.crypto.randomUUID();
+        const body = { payload, timestamp, nonce };
+        const signature = await this.crypto.sign(this.config.signingKey, JSON.stringify(body));
+        const envelope = { __signed: true, ...body, signature };
+        target.postMessage(envelope, targetOrigin);
+    }
+    /** Observable of verified incoming messages. */
+    messages$() {
+        return this._messages$.asObservable();
+    }
+    /** Signal with the last verified incoming message (null before first message). */
+    lastMessage() {
+        return this._lastMessage;
+    }
+    /** Removes the window listener and completes the internal Subject. */
+    destroy() {
+        if (this.messageHandler && isPlatformBrowser(this.platformId)) {
+            this.targetWindow.removeEventListener('message', this.messageHandler);
+            this.messageHandler = null;
+        }
+        this.config = null;
+    }
+    async handleMessage(event) {
+        if (!this.config)
+            return;
+        // 1. Origin whitelist
+        if (!this.config.allowedOrigins.includes(event.origin))
+            return;
+        // 2. Envelope shape
+        const env = event.data;
+        if (env?.__signed !== true)
+            return;
+        const { payload, timestamp, nonce, signature } = env;
+        if (!payload || !timestamp || !nonce || !signature)
+            return;
+        // 3. Replay window
+        if (Date.now() - timestamp > REPLAY_WINDOW_MS)
+            return;
+        // 4. Signature verification
+        const body = { payload, timestamp, nonce };
+        const valid = await this.crypto.verify(this.config.signingKey, JSON.stringify(body), signature);
+        if (!valid)
+            return;
+        // 5. Emit inside NgZone so signals trigger CD
+        this.ngZone.run(() => {
+            const message = { data: payload, origin: event.origin, timestamp };
+            this._lastMessage.set(message);
+            this._messages$.next(message);
+        });
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: SecureMessageService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: SecureMessageService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.4", ngImport: i0, type: SecureMessageService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root',
+                }]
         }] });
 
 const defaultSecurityConfig = {
@@ -1020,27 +1952,45 @@ const defaultSecurityConfig = {
     enableSecureStorage: false,
     enableInputSanitizer: false,
     enablePasswordStrength: false,
+    enableJwt: false,
+    enableSensitiveClipboard: false,
+    enableHibp: false,
+    enableRateLimiter: false,
+    enableCsrf: false,
+    enableSessionIdle: false,
+    enableSecureMessage: false,
     defaultTimeout: 5000,
     safeMode: false,
 };
 function provideSecurity(config = {}) {
     const mergedConfig = { ...defaultSecurityConfig, ...config };
     const providers = [];
-    if (mergedConfig.enableRegexSecurity) {
+    if (mergedConfig.enableRegexSecurity)
         providers.push(RegexSecurityService);
-    }
-    if (mergedConfig.enableWebCrypto) {
+    if (mergedConfig.enableWebCrypto)
         providers.push(WebCryptoService);
-    }
-    if (mergedConfig.enableSecureStorage) {
+    if (mergedConfig.enableSecureStorage)
         providers.push(SecureStorageService);
-    }
-    if (mergedConfig.enableInputSanitizer) {
+    if (mergedConfig.enableInputSanitizer)
         providers.push(InputSanitizerService);
-    }
-    if (mergedConfig.enablePasswordStrength) {
+    if (mergedConfig.enablePasswordStrength)
         providers.push(PasswordStrengthService);
-    }
+    if (mergedConfig.enableJwt)
+        providers.push(JwtService);
+    if (mergedConfig.enableSensitiveClipboard)
+        providers.push(SensitiveClipboardService);
+    if (mergedConfig.enableHibp) {
+        providers.push(WebCryptoService, HibpService);
+    }
+    if (mergedConfig.enableRateLimiter)
+        providers.push(RateLimiterService);
+    if (mergedConfig.enableCsrf) {
+        providers.push(WebCryptoService, CsrfService);
+    }
+    if (mergedConfig.enableSessionIdle)
+        providers.push(SessionIdleService);
+    if (mergedConfig.enableSecureMessage)
+        providers.push(SecureMessageService);
     return makeEnvironmentProviders(providers);
 }
 function provideRegexSecurity() {
@@ -1064,9 +2014,41 @@ function provideInputSanitizer(config) {
 function providePasswordStrength() {
     return makeEnvironmentProviders([PasswordStrengthService]);
 }
+function provideJwt() {
+    return makeEnvironmentProviders([JwtService]);
+}
+function provideSensitiveClipboard() {
+    return makeEnvironmentProviders([SensitiveClipboardService]);
+}
+function provideHibp(config) {
+    return makeEnvironmentProviders([
+        WebCryptoService,
+        HibpService,
+        ...(config ? [{ provide: HIBP_CONFIG, useValue: config }] : []),
+    ]);
+}
+function provideRateLimiter(config) {
+    return makeEnvironmentProviders([
+        RateLimiterService,
+        ...(config ? [{ provide: RATE_LIMITER_CONFIG, useValue: config }] : []),
+    ]);
+}
+function provideCsrf(config) {
+    return makeEnvironmentProviders([
+        WebCryptoService,
+        CsrfService,
+        ...(config ? [{ provide: CSRF_CONFIG, useValue: config }] : []),
+    ]);
+}
+function provideSessionIdle() {
+    return makeEnvironmentProviders([SessionIdleService]);
+}
+function provideSecureMessage() {
+    return makeEnvironmentProviders([WebCryptoService, SecureMessageService]);
+}
 
 /**
  * Generated bundle index. Do not edit.
  */
 
-export { InputSanitizerService, PasswordStrengthService, RegexSecurityBuilder, RegexSecurityService, SANITIZER_CONFIG, SECURE_STORAGE_CONFIG, SecureStorageService, WebCryptoService, defaultSecurityConfig, provideInputSanitizer, providePasswordStrength, provideRegexSecurity, provideSecureStorage, provideSecurity, provideWebCrypto };
+export { CSRF_CONFIG, ClipboardUnsupportedError, CsrfService, DEFAULT_ALLOWED_ATTRIBUTES, DEFAULT_ALLOWED_TAGS, HIBP_CONFIG, HibpService, InputSanitizerService, InvalidJwtError, JwtService, PasswordStrengthService, RATE_LIMITER_CONFIG, RateLimitExceededError, RateLimiterService, RegexSecurityBuilder, RegexSecurityService, SANITIZER_CONFIG, SECURE_STORAGE_CONFIG, SecureMessageService, SecureStorageService, SensitiveClipboardService, SessionIdleService, WebCryptoService, assessPasswordStrength, containsScriptInjection, containsSqlInjectionHints, defaultSecurityConfig, isHtmlSafe, isUrlSafe, provideCsrf, provideHibp, provideInputSanitizer, provideJwt, providePasswordStrength, provideRateLimiter, provideRegexSecurity, provideSecureMessage, provideSecureStorage, provideSecurity, provideSensitiveClipboard, provideSessionIdle, provideWebCrypto, sanitizeHtmlString, sanitizeUrlString, withCsrfHeader };