@guardcore/core 1.0.0

package/dist/index.d.cts

@@ -0,0 +1,898 @@
+import { z } from 'zod';
+
+interface RedisHandlerProtocol {
+    getKey(namespace: string, key: string): Promise<unknown>;
+    setKey(namespace: string, key: string, value: unknown, ttl?: number | null): Promise<boolean | null>;
+    delete(namespace: string, key: string): Promise<number | null>;
+    keys(pattern: string): Promise<string[] | null>;
+    initialize(): Promise<void>;
+    getConnection(): AsyncDisposable;
+}
+
+interface AgentHandlerProtocol {
+    initializeRedis(redisHandler: RedisHandlerProtocol): Promise<void>;
+    sendEvent(event: unknown): Promise<void>;
+    sendMetric(metric: unknown): Promise<void>;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    flushBuffer(): Promise<void>;
+    getDynamicRules(): Promise<unknown | null>;
+    healthCheck(): Promise<boolean>;
+}
+
+interface GeoIPHandler {
+    readonly isInitialized: boolean;
+    initialize(): Promise<void>;
+    initializeRedis(redisHandler: RedisHandlerProtocol): Promise<void>;
+    initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+    getCountry(ip: string): string | null;
+}
+
+interface GuardRequestState {
+    guardRouteId?: string;
+    guardEndpointId?: string;
+    guardDecorator?: unknown;
+    [key: string]: unknown;
+}
+interface GuardRequest {
+    readonly urlPath: string;
+    readonly urlScheme: string;
+    readonly urlFull: string;
+    urlReplaceScheme(scheme: string): string;
+    readonly method: string;
+    readonly clientHost: string | null;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly queryParams: Readonly<Record<string, string>>;
+    body(): Promise<Uint8Array>;
+    readonly state: GuardRequestState;
+    readonly scope: Readonly<Record<string, unknown>>;
+}
+
+interface GuardResponse {
+    readonly statusCode: number;
+    readonly headers: Record<string, string>;
+    setHeader(name: string, value: string): void;
+    readonly body: Uint8Array | null;
+    readonly bodyText: string | null;
+}
+interface GuardResponseFactory {
+    createResponse(content: string, statusCode: number): GuardResponse;
+    createRedirectResponse(url: string, statusCode: number): GuardResponse;
+}
+
+interface Logger {
+    info(message: string, ...args: unknown[]): void;
+    warn(message: string, ...args: unknown[]): void;
+    error(message: string, ...args: unknown[]): void;
+    debug(message: string, ...args: unknown[]): void;
+}
+declare const defaultLogger: Logger;
+
+declare const SecurityConfigSchema: z.ZodObject<{
+    trustedProxies: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    trustedProxyDepth: z.ZodDefault<z.ZodNumber>;
+    trustXForwardedProto: z.ZodDefault<z.ZodBoolean>;
+    passiveMode: z.ZodDefault<z.ZodBoolean>;
+    geoIpHandler: z.ZodOptional<z.ZodCustom<GeoIPHandler, GeoIPHandler>>;
+    geoResolver: z.ZodOptional<z.ZodCustom<(ip: string) => string | null, (ip: string) => string | null>>;
+    enableRedis: z.ZodDefault<z.ZodBoolean>;
+    redisUrl: z.ZodDefault<z.ZodString>;
+    redisPrefix: z.ZodDefault<z.ZodString>;
+    whitelist: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+    blacklist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    whitelistCountries: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    blockedCountries: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    blockedUserAgents: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    autoBanThreshold: z.ZodDefault<z.ZodNumber>;
+    autoBanDuration: z.ZodDefault<z.ZodNumber>;
+    logger: z.ZodOptional<z.ZodCustom<Logger, Logger>>;
+    customLogFile: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    logSuspiciousLevel: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+        INFO: "INFO";
+        DEBUG: "DEBUG";
+        WARNING: "WARNING";
+        ERROR: "ERROR";
+        CRITICAL: "CRITICAL";
+    }>>>;
+    logRequestLevel: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+        INFO: "INFO";
+        DEBUG: "DEBUG";
+        WARNING: "WARNING";
+        ERROR: "ERROR";
+        CRITICAL: "CRITICAL";
+    }>>>;
+    logFormat: z.ZodDefault<z.ZodEnum<{
+        text: "text";
+        json: "json";
+    }>>;
+    customErrorResponses: z.ZodDefault<z.ZodRecord<z.ZodCoercedNumber<unknown>, z.ZodString>>;
+    rateLimit: z.ZodDefault<z.ZodNumber>;
+    rateLimitWindow: z.ZodDefault<z.ZodNumber>;
+    enforceHttps: z.ZodDefault<z.ZodBoolean>;
+    securityHeaders: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        hsts: z.ZodOptional<z.ZodObject<{
+            maxAge: z.ZodDefault<z.ZodNumber>;
+            includeSubdomains: z.ZodDefault<z.ZodBoolean>;
+            preload: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        csp: z.ZodDefault<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>>;
+        frameOptions: z.ZodDefault<z.ZodEnum<{
+            DENY: "DENY";
+            SAMEORIGIN: "SAMEORIGIN";
+        }>>;
+        contentTypeOptions: z.ZodDefault<z.ZodString>;
+        xssProtection: z.ZodDefault<z.ZodString>;
+        referrerPolicy: z.ZodDefault<z.ZodString>;
+        permissionsPolicy: z.ZodDefault<z.ZodString>;
+        custom: z.ZodDefault<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    }, z.core.$strip>>>;
+    customRequestCheck: z.ZodOptional<z.ZodCustom<(req: GuardRequest) => Promise<GuardResponse | null>, (req: GuardRequest) => Promise<GuardResponse | null>>>;
+    customResponseModifier: z.ZodOptional<z.ZodCustom<(res: GuardResponse) => Promise<GuardResponse>, (res: GuardResponse) => Promise<GuardResponse>>>;
+    enableCors: z.ZodDefault<z.ZodBoolean>;
+    corsAllowOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    corsAllowMethods: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    corsAllowHeaders: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    corsAllowCredentials: z.ZodDefault<z.ZodBoolean>;
+    corsExposeHeaders: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    corsMaxAge: z.ZodDefault<z.ZodNumber>;
+    blockCloudProviders: z.ZodPipe<z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        AWS: "AWS";
+        GCP: "GCP";
+        Azure: "Azure";
+    }>>>, z.ZodTransform<Set<"AWS" | "GCP" | "Azure">, ("AWS" | "GCP" | "Azure")[]>>;
+    cloudIpRefreshInterval: z.ZodDefault<z.ZodNumber>;
+    excludePaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    enableIpBanning: z.ZodDefault<z.ZodBoolean>;
+    enableRateLimiting: z.ZodDefault<z.ZodBoolean>;
+    enablePenetrationDetection: z.ZodDefault<z.ZodBoolean>;
+    emergencyMode: z.ZodDefault<z.ZodBoolean>;
+    emergencyWhitelist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    endpointRateLimits: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>>>;
+    detectionCompilerTimeout: z.ZodDefault<z.ZodNumber>;
+    detectionMaxContentLength: z.ZodDefault<z.ZodNumber>;
+    detectionPreserveAttackPatterns: z.ZodDefault<z.ZodBoolean>;
+    detectionSemanticThreshold: z.ZodDefault<z.ZodNumber>;
+    detectionAnomalyThreshold: z.ZodDefault<z.ZodNumber>;
+    detectionSlowPatternThreshold: z.ZodDefault<z.ZodNumber>;
+    detectionMonitorHistorySize: z.ZodDefault<z.ZodNumber>;
+    detectionMaxTrackedPatterns: z.ZodDefault<z.ZodNumber>;
+    enableAgent: z.ZodDefault<z.ZodBoolean>;
+    agentApiKey: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    agentEndpoint: z.ZodDefault<z.ZodString>;
+    agentProjectId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    agentBufferSize: z.ZodDefault<z.ZodNumber>;
+    agentFlushInterval: z.ZodDefault<z.ZodNumber>;
+    agentEnableEvents: z.ZodDefault<z.ZodBoolean>;
+    agentEnableMetrics: z.ZodDefault<z.ZodBoolean>;
+    agentTimeout: z.ZodDefault<z.ZodNumber>;
+    agentRetryAttempts: z.ZodDefault<z.ZodNumber>;
+    enableDynamicRules: z.ZodDefault<z.ZodBoolean>;
+    dynamicRuleInterval: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+type SecurityConfig = z.input<typeof SecurityConfigSchema>;
+type ResolvedSecurityConfig = z.output<typeof SecurityConfigSchema>;
+
+interface GuardMiddlewareProtocol {
+    readonly config: ResolvedSecurityConfig;
+    readonly logger: Logger;
+    lastCloudIpRefresh: number;
+    suspiciousRequestCounts: Map<string, number>;
+    readonly eventBus: unknown;
+    readonly routeResolver: unknown;
+    readonly responseFactory: unknown;
+    readonly rateLimitHandler: unknown;
+    readonly agentHandler: AgentHandlerProtocol | null;
+    readonly geoIpHandler: GeoIPHandler | null;
+    readonly guardResponseFactory: GuardResponseFactory;
+    createErrorResponse(statusCode: number, defaultMessage: string): Promise<GuardResponse>;
+    refreshCloudIpRanges(): Promise<void>;
+}
+
+type BehaviorRuleType = 'usage' | 'return_pattern' | 'frequency';
+type BehaviorAction = 'ban' | 'log' | 'throttle' | 'alert';
+declare class BehaviorRule {
+    readonly ruleType: BehaviorRuleType;
+    readonly threshold: number;
+    readonly window: number;
+    readonly pattern: string | null;
+    readonly action: BehaviorAction;
+    readonly customAction: ((...args: unknown[]) => unknown) | null;
+    constructor(ruleType: BehaviorRuleType, threshold: number, window?: number, pattern?: string | null, action?: BehaviorAction, customAction?: ((...args: unknown[]) => unknown) | null);
+}
+
+declare const DynamicRulesSchema: z.ZodObject<{
+    ruleId: z.ZodString;
+    version: z.ZodNumber;
+    timestamp: z.ZodString;
+    expiresAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    ttl: z.ZodDefault<z.ZodNumber>;
+    ipBlacklist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    ipWhitelist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    ipBanDuration: z.ZodDefault<z.ZodNumber>;
+    blockedCountries: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    whitelistCountries: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    globalRateLimit: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    globalRateWindow: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    endpointRateLimits: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>>>;
+    blockedCloudProviders: z.ZodPipe<z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        AWS: "AWS";
+        GCP: "GCP";
+        Azure: "Azure";
+    }>>>, z.ZodTransform<Set<"AWS" | "GCP" | "Azure">, ("AWS" | "GCP" | "Azure")[]>>;
+    blockedUserAgents: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    suspiciousPatterns: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    enablePenetrationDetection: z.ZodDefault<z.ZodNullable<z.ZodBoolean>>;
+    enableIpBanning: z.ZodDefault<z.ZodNullable<z.ZodBoolean>>;
+    enableRateLimiting: z.ZodDefault<z.ZodNullable<z.ZodBoolean>>;
+    emergencyMode: z.ZodDefault<z.ZodBoolean>;
+    emergencyWhitelist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+type DynamicRules = z.output<typeof DynamicRulesSchema>;
+
+declare class RouteConfig {
+    rateLimit: number | null;
+    rateLimitWindow: number | null;
+    ipWhitelist: string[] | null;
+    ipBlacklist: string[] | null;
+    blockedCountries: string[] | null;
+    whitelistCountries: string[] | null;
+    bypassedChecks: Set<string>;
+    requireHttps: boolean;
+    authRequired: string | null;
+    customValidators: Array<(request: GuardRequest) => Promise<GuardResponse | null>>;
+    blockedUserAgents: string[];
+    requiredHeaders: Record<string, string>;
+    behaviorRules: BehaviorRule[];
+    blockCloudProviders: Set<string>;
+    maxRequestSize: number | null;
+    allowedContentTypes: string[] | null;
+    timeRestrictions: {
+        start: string;
+        end: string;
+    } | null;
+    enableSuspiciousDetection: boolean;
+    requireReferrer: string[] | null;
+    apiKeyRequired: boolean;
+    sessionLimits: Record<string, number> | null;
+    geoRateLimits: Record<string, [number, number]> | null;
+}
+
+interface MatchResult {
+    [index: number]: string | undefined;
+    index: number;
+    input: string;
+    length: number;
+    groups?: Record<string, string>;
+}
+interface RE2Instance {
+    exec(str: string): MatchResult | null;
+    lastIndex: number;
+}
+declare class PatternCompiler {
+    private readonly defaultTimeoutMs;
+    private readonly maxCacheSize;
+    private cache;
+    private cacheOrder;
+    private re2Available;
+    constructor(defaultTimeoutMs?: number, maxCacheSize?: number);
+    private ensureRE2;
+    compile(pattern: string, flags?: string): Promise<RE2Instance | RegExp>;
+    compileSync(pattern: string, flags?: string): RegExp;
+    safeMatch(pattern: string, content: string, timeoutMs?: number): Promise<MatchResult | null>;
+    private fallbackMatch;
+    validatePatternSafety(pattern: string, testStrings?: string[]): [boolean, string];
+    batchCompile(patterns: string[], validate?: boolean): Promise<Map<string, RE2Instance | RegExp>>;
+    clearCache(): Promise<void>;
+}
+
+declare class ContentPreprocessor {
+    private readonly maxContentLength;
+    private readonly preserveAttackPatterns;
+    constructor(maxContentLength?: number, preserveAttackPatterns?: boolean);
+    normalizeUnicode(content: string): string;
+    removeNullBytes(content: string): string;
+    removeExcessiveWhitespace(content: string): string;
+    decodeCommonEncodings(content: string): string;
+    private decodeHtmlEntities;
+    extractAttackRegions(content: string): Array<[number, number]>;
+    truncateSafely(content: string): string;
+    preprocess(content: string): Promise<string>;
+    preprocessBatch(contents: string[]): Promise<string[]>;
+}
+
+interface PerformanceMetric {
+    pattern: string;
+    executionTime: number;
+    contentLength: number;
+    timestamp: Date;
+    matched: boolean;
+    timeout: boolean;
+}
+interface PatternStats {
+    pattern: string;
+    totalExecutions: number;
+    totalMatches: number;
+    totalTimeouts: number;
+    avgExecutionTime: number;
+    maxExecutionTime: number;
+    minExecutionTime: number;
+    recentTimes: number[];
+}
+interface PatternReport {
+    pattern: string;
+    patternHash: string;
+    totalExecutions: number;
+    totalMatches: number;
+    totalTimeouts: number;
+    matchRate: number;
+    timeoutRate: number;
+    avgExecutionTime: number;
+    maxExecutionTime: number;
+    minExecutionTime: number;
+    issue?: string;
+}
+type AnomalyCallback = (anomaly: Record<string, unknown>) => void;
+declare class PerformanceMonitor {
+    private readonly anomalyThreshold;
+    private readonly slowPatternThreshold;
+    private readonly historySize;
+    private readonly maxTrackedPatterns;
+    private patternStats;
+    private recentMetrics;
+    private anomalyCallbacks;
+    constructor(anomalyThreshold?: number, slowPatternThreshold?: number, historySize?: number, maxTrackedPatterns?: number);
+    recordMetric(pattern: string, executionTime: number, contentLength: number, matched: boolean, timeout?: boolean, agentHandler?: AgentHandlerProtocol | null, correlationId?: string | null): Promise<void>;
+    private checkAnomalies;
+    getPatternReport(pattern: string): PatternReport | null;
+    getSlowPatterns(limit?: number): PatternReport[];
+    getProblematicPatterns(): PatternReport[];
+    getSummaryStats(): Record<string, unknown>;
+    registerAnomalyCallback(callback: AnomalyCallback): void;
+    clearStats(): Promise<void>;
+    removePatternStats(pattern: string): Promise<void>;
+}
+
+interface SemanticAnalysis {
+    attackProbabilities: Record<string, number>;
+    entropy: number;
+    encodingLayers: number;
+    isObfuscated: boolean;
+    suspiciousPatterns: Array<{
+        type: string;
+        pattern: string;
+        position: number;
+        context: string;
+    }>;
+    codeInjectionRisk: number;
+    tokenCount: number;
+}
+declare class SemanticAnalyzer {
+    extractTokens(content: string): string[];
+    calculateEntropy(content: string): number;
+    detectEncodingLayers(content: string): number;
+    analyzeAttackProbability(content: string): Record<string, number>;
+    detectObfuscation(content: string): boolean;
+    extractSuspiciousPatterns(content: string): SemanticAnalysis['suspiciousPatterns'];
+    analyzeCodeInjectionRisk(content: string): number;
+    analyze(content: string): SemanticAnalysis;
+    getThreatScore(analysis: SemanticAnalysis): number;
+}
+
+declare class SecurityEventBus {
+    private readonly agentHandler;
+    private readonly config;
+    private readonly logger;
+    private readonly geoIpHandler;
+    constructor(agentHandler: AgentHandlerProtocol | null, config: ResolvedSecurityConfig, logger: Logger, geoIpHandler?: GeoIPHandler | null);
+    sendMiddlewareEvent(eventType: string, request: GuardRequest, actionTaken: string, reason: string, metadata?: Record<string, unknown>): Promise<void>;
+    sendHttpsViolationEvent(request: GuardRequest, isRouteSpecific: boolean): Promise<void>;
+    sendCloudDetectionEvents(request: GuardRequest, clientIp: string, providers: string[], passiveMode: boolean): Promise<void>;
+}
+
+declare class MetricsCollector {
+    private readonly agentHandler;
+    private readonly config;
+    private readonly logger;
+    constructor(agentHandler: AgentHandlerProtocol | null, config: ResolvedSecurityConfig, logger: Logger);
+    sendMetric(metricType: string, value: number, tags?: Record<string, string>): Promise<void>;
+    collectRequestMetrics(request: GuardRequest, responseTime: number, statusCode: number): Promise<void>;
+}
+
+type RedisClient = {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string, ...args: unknown[]): Promise<unknown>;
+    setex(key: string, ttl: number, value: string): Promise<unknown>;
+    incr(key: string): Promise<number>;
+    expire(key: string, seconds: number): Promise<number>;
+    exists(key: string): Promise<number>;
+    del(...keys: string[]): Promise<number>;
+    keys(pattern: string): Promise<string[]>;
+    ping(): Promise<string>;
+    quit(): Promise<string>;
+    eval(script: string, numkeys: number, ...args: unknown[]): Promise<unknown>;
+    evalsha(sha: string, numkeys: number, ...args: unknown[]): Promise<unknown>;
+    script(cmd: string, ...args: unknown[]): Promise<any>;
+    zadd(key: string, ...args: unknown[]): Promise<number>;
+    zremrangebyscore(key: string, min: number | string, max: number | string): Promise<number>;
+    zcard(key: string): Promise<number>;
+};
+declare class RedisManager implements RedisHandlerProtocol {
+    private readonly config;
+    private readonly logger;
+    private client;
+    private closed;
+    private agentHandler;
+    private readonly prefix;
+    constructor(config: ResolvedSecurityConfig, logger: Logger);
+    initialize(): Promise<void>;
+    close(): Promise<void>;
+    initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+    getConnection(): AsyncDisposable;
+    private formatKey;
+    getKey(namespace: string, key: string): Promise<unknown>;
+    setKey(namespace: string, key: string, value: unknown, ttl?: number | null): Promise<boolean | null>;
+    incr(namespace: string, key: string, ttl?: number): Promise<number | null>;
+    exists(namespace: string, key: string): Promise<boolean | null>;
+    delete(namespace: string, key: string): Promise<number | null>;
+    keys(pattern: string): Promise<string[] | null>;
+    deletePattern(pattern: string): Promise<number | null>;
+    getRawClient(): RedisClient | null;
+}
+
+declare class BehaviorTracker {
+    private readonly config;
+    private readonly logger;
+    private usageCounts;
+    private returnPatterns;
+    private redisHandler;
+    private agentHandler;
+    constructor(config: ResolvedSecurityConfig, logger: Logger);
+    initializeRedis(redisHandler: RedisManager): Promise<void>;
+    initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+    trackEndpointUsage(endpointId: string, clientIp: string, rule: BehaviorRule): Promise<boolean>;
+    trackReturnPattern(endpointId: string, clientIp: string, response: GuardResponse, rule: BehaviorRule): Promise<boolean>;
+    private checkResponsePattern;
+    applyAction(rule: BehaviorRule, clientIp: string, endpointId: string, details: string): Promise<void>;
+    reset(): Promise<void>;
+}
+
+declare class CloudHandler {
+    private readonly logger;
+    private ipRanges;
+    private lastUpdated;
+    private redisHandler;
+    private agentHandler;
+    constructor(logger: Logger);
+    initializeRedis(redisHandler: RedisManager, providers: Set<string>, ttl?: number): Promise<void>;
+    initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+    refreshAsync(providers: Set<string>, ttl?: number): Promise<void>;
+    private fetchProviderRanges;
+    private fetchAwsRanges;
+    private fetchGcpRanges;
+    private fetchAzureRanges;
+    isCloudIp(ip: string, providers: Set<string>): boolean;
+    getCloudProviderDetails(ip: string, providers: Set<string>): [string, string] | null;
+    reset(): Promise<void>;
+}
+
+declare class DynamicRuleManager {
+    private readonly config;
+    private readonly logger;
+    private currentRules;
+    private updateTimer;
+    private lastUpdate;
+    private agentHandler;
+    private redisHandler;
+    constructor(config: ResolvedSecurityConfig, logger: Logger);
+    initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+    initializeRedis(redisHandler: RedisManager): Promise<void>;
+    private startUpdateLoop;
+    updateRules(): Promise<void>;
+    getCurrentRules(): DynamicRules | null;
+    forceUpdate(): Promise<void>;
+    stop(): Promise<void>;
+}
+
+declare class IPBanManager {
+    private readonly logger;
+    private bannedIps;
+    private redisHandler;
+    private agentHandler;
+    private readonly maxSize;
+    constructor(logger: Logger);
+    initializeRedis(redisHandler: RedisManager): Promise<void>;
+    initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+    banIp(ip: string, duration: number, reason: string): Promise<void>;
+    isIpBanned(ip: string): Promise<boolean>;
+    unbanIp(ip: string): Promise<void>;
+    reset(): Promise<void>;
+}
+
+declare class RateLimitManager {
+    private readonly logger;
+    private requestTimestamps;
+    private redisHandler;
+    private agentHandler;
+    private rateLimitScriptSha;
+    constructor(logger: Logger);
+    initializeRedis(redisHandler: RedisManager): Promise<void>;
+    initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+    checkRateLimit(request: GuardRequest, clientIp: string, createErrorResponse: (statusCode: number, message: string) => Promise<GuardResponse>, endpointPath?: string | null, rateLimit?: number, rateLimitWindow?: number): Promise<GuardResponse | null>;
+    private getRedisRequestCount;
+    private getInMemoryRequestCount;
+    private handleRateLimitExceeded;
+    reset(): Promise<void>;
+}
+
+declare class SecurityHeadersManager {
+    private readonly logger;
+    private headersCache;
+    private defaultHeaders;
+    private customHeaders;
+    private cspConfig;
+    private hstsConfig;
+    private corsConfig;
+    private redisHandler;
+    private agentHandler;
+    private cacheMaxSize;
+    private cacheTtlMs;
+    private cacheTimestamps;
+    constructor(logger: Logger);
+    initializeRedis(redisHandler: RedisManager): Promise<void>;
+    initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+    private loadCachedConfig;
+    configure(options: {
+        enabled?: boolean | undefined;
+        csp?: Record<string, string[]> | null | undefined;
+        hstsMaxAge?: number | undefined;
+        hstsIncludeSubdomains?: boolean | undefined;
+        hstsPreload?: boolean | undefined;
+        frameOptions?: string | undefined;
+        contentTypeOptions?: string | undefined;
+        xssProtection?: string | undefined;
+        referrerPolicy?: string | undefined;
+        permissionsPolicy?: string | undefined;
+        customHeaders?: Record<string, string> | null | undefined;
+        corsOrigins?: string[] | undefined;
+        corsAllowCredentials?: boolean | undefined;
+        corsAllowMethods?: string[] | undefined;
+        corsAllowHeaders?: string[] | undefined;
+    }): void;
+    private cacheConfiguration;
+    private buildCsp;
+    private buildHsts;
+    getHeaders(requestPath: string): Promise<Record<string, string>>;
+    getCorsHeaders(origin: string): Record<string, string>;
+    reset(): Promise<void>;
+}
+
+interface DetectionResult {
+    isThreat: boolean;
+    threatScore: number;
+    threats: Array<{
+        pattern: string;
+        context: string;
+        matchedContent: string;
+        detectionMethod: string;
+    }>;
+    executionTime: number;
+    timeouts: string[];
+    correlationId: string | null;
+    originalLength: number;
+    processedLength: number;
+}
+declare class SusPatternsManager {
+    private readonly logger;
+    private compiler;
+    private preprocessor;
+    private semantic;
+    private monitor;
+    private customPatterns;
+    private compiledCustomContexts;
+    private redisHandler;
+    private agentHandler;
+    private semanticThreshold;
+    constructor(config: ResolvedSecurityConfig, logger: Logger);
+    initializeRedis(redisHandler: RedisManager): Promise<void>;
+    initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+    private normalizeContext;
+    detect(content: string, ipAddress: string, context?: string, correlationId?: string | null): Promise<DetectionResult>;
+    detectPatternMatch(content: string, ipAddress: string, context?: string, correlationId?: string | null): Promise<[boolean, string | null]>;
+    addPattern(pattern: string, custom?: boolean): Promise<void>;
+    removePattern(pattern: string): Promise<void>;
+    getDefaultPatterns(): string[];
+    getCustomPatterns(): string[];
+    getAllPatterns(): string[];
+    getPerformanceStats(): Promise<Record<string, unknown> | null>;
+    getComponentStatus(): Record<string, boolean>;
+    configureSemanticThreshold(threshold: number): Promise<void>;
+    reset(): Promise<void>;
+}
+
+interface HandlerRegistry {
+    redisHandler: RedisManager | null;
+    ipBanHandler: IPBanManager;
+    rateLimitHandler: RateLimitManager;
+    cloudHandler: CloudHandler;
+    susPatternsHandler: SusPatternsManager;
+    securityHeadersHandler: SecurityHeadersManager;
+    behaviorTracker: BehaviorTracker;
+    dynamicRuleHandler: DynamicRuleManager;
+    geoIpHandler: GeoIPHandler | null;
+}
+
+declare class RequestValidator {
+    private readonly config;
+    private readonly logger;
+    private readonly eventBus;
+    constructor(config: ResolvedSecurityConfig, logger: Logger, eventBus: SecurityEventBus);
+    isRequestHttps(request: GuardRequest): boolean;
+    isTrustedProxy(connectingIp: string): boolean;
+    checkTimeWindow(timeRestrictions: {
+        start: string;
+        end: string;
+    }): Promise<boolean>;
+    isPathExcluded(request: GuardRequest): Promise<boolean>;
+}
+
+declare class RouteConfigResolver {
+    private readonly config;
+    private guardDecorator;
+    constructor(config: ResolvedSecurityConfig);
+    setGuardDecorator(decorator: unknown): void;
+    getRouteConfig(request: GuardRequest): RouteConfig | null;
+    shouldBypassCheck(checkName: string, routeConfig: RouteConfig | null): boolean;
+    getCloudProvidersToCheck(routeConfig: RouteConfig | null): string[] | null;
+}
+
+declare class ErrorResponseFactory {
+    private readonly config;
+    private readonly logger;
+    private readonly metricsCollector;
+    private readonly guardResponseFactory;
+    private readonly securityHeadersManager;
+    private readonly agentHandler;
+    constructor(config: ResolvedSecurityConfig, logger: Logger, metricsCollector: MetricsCollector, guardResponseFactory: GuardResponseFactory, securityHeadersManager: SecurityHeadersManager, agentHandler?: AgentHandlerProtocol | null);
+    createErrorResponse(statusCode: number, defaultMessage: string): Promise<GuardResponse>;
+    createHttpsRedirect(request: GuardRequest): Promise<GuardResponse>;
+    applySecurityHeaders(response: GuardResponse, requestPath?: string): Promise<GuardResponse>;
+    applyCorsHeaders(response: GuardResponse, origin: string): Promise<GuardResponse>;
+    applyModifier(response: GuardResponse): Promise<GuardResponse>;
+    processResponse(request: GuardRequest, response: GuardResponse, responseTime: number, routeConfig: RouteConfig | null, processBehavioralRules?: (request: GuardRequest, response: GuardResponse, clientIp: string, routeConfig: RouteConfig) => Promise<void>): Promise<GuardResponse>;
+}
+
+declare class BypassHandler {
+    private readonly config;
+    private readonly eventBus;
+    private readonly routeResolver;
+    private readonly responseFactory;
+    private readonly validator;
+    constructor(config: ResolvedSecurityConfig, eventBus: SecurityEventBus, routeResolver: RouteConfigResolver, responseFactory: ErrorResponseFactory, validator: RequestValidator);
+    handlePassthrough(request: GuardRequest, callNext: (req: GuardRequest) => Promise<GuardResponse>): Promise<GuardResponse | null>;
+    handleSecurityBypass(request: GuardRequest, callNext: (req: GuardRequest) => Promise<GuardResponse>, routeConfig: RouteConfig | null): Promise<GuardResponse | null>;
+}
+
+declare class BehavioralProcessor {
+    private readonly logger;
+    private readonly eventBus;
+    private guardDecorator;
+    constructor(logger: Logger, eventBus: SecurityEventBus);
+    setGuardDecorator(decorator: {
+        behaviorTracker: BehaviorTracker;
+    }): void;
+    processUsageRules(request: GuardRequest, clientIp: string, routeConfig: RouteConfig): Promise<void>;
+    processReturnRules(request: GuardRequest, response: GuardResponse, clientIp: string, routeConfig: RouteConfig): Promise<void>;
+    getEndpointId(request: GuardRequest): string;
+}
+
+declare abstract class SecurityCheck {
+    protected readonly middleware: GuardMiddlewareProtocol;
+    constructor(middleware: GuardMiddlewareProtocol);
+    abstract check(request: GuardRequest): Promise<GuardResponse | null>;
+    abstract get checkName(): string;
+    protected get config(): ResolvedSecurityConfig;
+    protected get logger(): Logger;
+    sendEvent(type: string, request: GuardRequest, action: string, reason: string, meta?: Record<string, unknown>): Promise<void>;
+    createErrorResponse(statusCode: number, message: string): Promise<GuardResponse>;
+    isPassiveMode(): boolean;
+}
+
+declare class SecurityCheckPipeline {
+    private checks;
+    private readonly logger;
+    constructor(checks: SecurityCheck[], logger: Logger);
+    execute(request: GuardRequest): Promise<GuardResponse | null>;
+    add(check: SecurityCheck): void;
+    insert(index: number, check: SecurityCheck): void;
+    remove(name: string): boolean;
+    getCheckNames(): string[];
+    get length(): number;
+}
+
+interface SecurityMiddlewareComponents {
+    registry: HandlerRegistry;
+    pipeline: SecurityCheckPipeline;
+    eventBus: SecurityEventBus;
+    metricsCollector: MetricsCollector;
+    validator: RequestValidator;
+    routeResolver: RouteConfigResolver;
+    bypassHandler: BypassHandler;
+    errorResponseFactory: ErrorResponseFactory;
+    behavioralProcessor: BehavioralProcessor;
+    middlewareProtocol: GuardMiddlewareProtocol;
+}
+declare function initializeSecurityMiddleware(config: ResolvedSecurityConfig, logger: Logger, guardResponseFactory: GuardResponseFactory, agentHandler?: AgentHandlerProtocol | null, geoIpHandler?: GeoIPHandler | null, guardDecorator?: unknown): Promise<SecurityMiddlewareComponents>;
+
+declare class BaseSecurityDecorator {
+    routeConfigs: Map<string, RouteConfig>;
+    behaviorTracker: BehaviorTracker;
+    agentHandler: AgentHandlerProtocol | null;
+    readonly config: ResolvedSecurityConfig;
+    readonly logger: Logger;
+    constructor(config: ResolvedSecurityConfig, logger?: Logger);
+    getRouteConfig(routeId: string): RouteConfig | undefined;
+    ensureRouteConfig(fn: Function): RouteConfig;
+    applyRouteConfig<T extends Function>(fn: T): T;
+    getRouteId(fn: Function): string;
+    initializeBehaviorTracking(redisHandler?: RedisHandlerProtocol): Promise<void>;
+    initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+    sendDecoratorEvent(eventType: string, _request: GuardRequest, actionTaken: string, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+    sendAccessDeniedEvent(request: GuardRequest, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+    sendAuthenticationFailedEvent(request: GuardRequest, reason: string, authType: string, meta?: Record<string, unknown>): Promise<void>;
+    sendRateLimitEvent(request: GuardRequest, limit: number, window: number, meta?: Record<string, unknown>): Promise<void>;
+    sendDecoratorViolationEvent(request: GuardRequest, violationType: string, reason: string, meta?: Record<string, unknown>): Promise<void>;
+}
+declare function getRouteDecoratorConfig(request: GuardRequest, decoratorHandler: BaseSecurityDecorator): RouteConfig | undefined;
+
+declare const SecurityDecorator: {
+    new (...args: any[]): {
+        timeWindow(startTime: string, endTime: string, _timezone?: string): <F extends Function>(fn: F) => F;
+        suspiciousDetection(enabled?: boolean): <F extends Function>(fn: F) => F;
+        honeypotDetection(trapFields: string[]): <F extends Function>(fn: F) => F;
+        routeConfigs: Map<string, RouteConfig>;
+        behaviorTracker: BehaviorTracker;
+        agentHandler: AgentHandlerProtocol | null;
+        readonly config: ResolvedSecurityConfig;
+        readonly logger: Logger;
+        getRouteConfig(routeId: string): RouteConfig | undefined;
+        ensureRouteConfig(fn: Function): RouteConfig;
+        applyRouteConfig<T extends Function>(fn: T): T;
+        getRouteId(fn: Function): string;
+        initializeBehaviorTracking(redisHandler?: RedisHandlerProtocol): Promise<void>;
+        initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+        sendDecoratorEvent(eventType: string, _request: GuardRequest, actionTaken: string, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendAccessDeniedEvent(request: GuardRequest, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendAuthenticationFailedEvent(request: GuardRequest, reason: string, authType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendRateLimitEvent(request: GuardRequest, limit: number, window: number, meta?: Record<string, unknown>): Promise<void>;
+        sendDecoratorViolationEvent(request: GuardRequest, violationType: string, reason: string, meta?: Record<string, unknown>): Promise<void>;
+    };
+} & {
+    new (...args: any[]): {
+        blockUserAgents(patterns: string[]): <F extends Function>(fn: F) => F;
+        contentTypeFilter(allowedTypes: string[]): <F extends Function>(fn: F) => F;
+        maxRequestSize(sizeBytes: number): <F extends Function>(fn: F) => F;
+        requireReferrer(allowedDomains: string[]): <F extends Function>(fn: F) => F;
+        customValidation(validator: (request: GuardRequest) => Promise<GuardResponse | null>): <F extends Function>(fn: F) => F;
+        routeConfigs: Map<string, RouteConfig>;
+        behaviorTracker: BehaviorTracker;
+        agentHandler: AgentHandlerProtocol | null;
+        readonly config: ResolvedSecurityConfig;
+        readonly logger: Logger;
+        getRouteConfig(routeId: string): RouteConfig | undefined;
+        ensureRouteConfig(fn: Function): RouteConfig;
+        applyRouteConfig<T extends Function>(fn: T): T;
+        getRouteId(fn: Function): string;
+        initializeBehaviorTracking(redisHandler?: RedisHandlerProtocol): Promise<void>;
+        initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+        sendDecoratorEvent(eventType: string, _request: GuardRequest, actionTaken: string, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendAccessDeniedEvent(request: GuardRequest, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendAuthenticationFailedEvent(request: GuardRequest, reason: string, authType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendRateLimitEvent(request: GuardRequest, limit: number, window: number, meta?: Record<string, unknown>): Promise<void>;
+        sendDecoratorViolationEvent(request: GuardRequest, violationType: string, reason: string, meta?: Record<string, unknown>): Promise<void>;
+    };
+} & {
+    new (...args: any[]): {
+        usageMonitor(maxCalls: number, window?: number, action?: BehaviorAction): <F extends Function>(fn: F) => F;
+        returnMonitor(pattern: string, maxOccurrences: number, window?: number, action?: BehaviorAction): <F extends Function>(fn: F) => F;
+        behaviorAnalysis(rules: BehaviorRule[]): <F extends Function>(fn: F) => F;
+        suspiciousFrequency(maxFrequency: number, window?: number, action?: BehaviorAction): <F extends Function>(fn: F) => F;
+        routeConfigs: Map<string, RouteConfig>;
+        behaviorTracker: BehaviorTracker;
+        agentHandler: AgentHandlerProtocol | null;
+        readonly config: ResolvedSecurityConfig;
+        readonly logger: Logger;
+        getRouteConfig(routeId: string): RouteConfig | undefined;
+        ensureRouteConfig(fn: Function): RouteConfig;
+        applyRouteConfig<T extends Function>(fn: T): T;
+        getRouteId(fn: Function): string;
+        initializeBehaviorTracking(redisHandler?: RedisHandlerProtocol): Promise<void>;
+        initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+        sendDecoratorEvent(eventType: string, _request: GuardRequest, actionTaken: string, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendAccessDeniedEvent(request: GuardRequest, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendAuthenticationFailedEvent(request: GuardRequest, reason: string, authType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendRateLimitEvent(request: GuardRequest, limit: number, window: number, meta?: Record<string, unknown>): Promise<void>;
+        sendDecoratorViolationEvent(request: GuardRequest, violationType: string, reason: string, meta?: Record<string, unknown>): Promise<void>;
+    };
+} & {
+    new (...args: any[]): {
+        requireHttps(): <F extends Function>(fn: F) => F;
+        requireAuth(type?: string): <F extends Function>(fn: F) => F;
+        apiKeyAuth(headerName?: string): <F extends Function>(fn: F) => F;
+        requireHeaders(headers: Record<string, string>): <F extends Function>(fn: F) => F;
+        routeConfigs: Map<string, RouteConfig>;
+        behaviorTracker: BehaviorTracker;
+        agentHandler: AgentHandlerProtocol | null;
+        readonly config: ResolvedSecurityConfig;
+        readonly logger: Logger;
+        getRouteConfig(routeId: string): RouteConfig | undefined;
+        ensureRouteConfig(fn: Function): RouteConfig;
+        applyRouteConfig<T extends Function>(fn: T): T;
+        getRouteId(fn: Function): string;
+        initializeBehaviorTracking(redisHandler?: RedisHandlerProtocol): Promise<void>;
+        initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+        sendDecoratorEvent(eventType: string, _request: GuardRequest, actionTaken: string, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendAccessDeniedEvent(request: GuardRequest, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendAuthenticationFailedEvent(request: GuardRequest, reason: string, authType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendRateLimitEvent(request: GuardRequest, limit: number, window: number, meta?: Record<string, unknown>): Promise<void>;
+        sendDecoratorViolationEvent(request: GuardRequest, violationType: string, reason: string, meta?: Record<string, unknown>): Promise<void>;
+    };
+} & {
+    new (...args: any[]): {
+        rateLimit(requests: number, window?: number): <// eslint-disable-next-line @typescript-eslint/no-explicit-any -- TS mixin composition requires any[]
+        F extends Function>(fn: F) => F;
+        geoRateLimit(limits: Record<string, [number, number]>): <F extends Function>(fn: F) => F;
+        routeConfigs: Map<string, RouteConfig>;
+        behaviorTracker: BehaviorTracker;
+        agentHandler: AgentHandlerProtocol | null;
+        readonly config: ResolvedSecurityConfig;
+        readonly logger: Logger;
+        getRouteConfig(routeId: string): RouteConfig | undefined;
+        ensureRouteConfig(fn: Function): RouteConfig;
+        applyRouteConfig<T extends Function>(fn: T): T;
+        getRouteId(fn: Function): string;
+        initializeBehaviorTracking(redisHandler?: RedisHandlerProtocol): Promise<void>;
+        initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+        sendDecoratorEvent(eventType: string, _request: GuardRequest, actionTaken: string, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendAccessDeniedEvent(request: GuardRequest, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendAuthenticationFailedEvent(request: GuardRequest, reason: string, authType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendRateLimitEvent(request: GuardRequest, limit: number, window: number, meta?: Record<string, unknown>): Promise<void>;
+        sendDecoratorViolationEvent(request: GuardRequest, violationType: string, reason: string, meta?: Record<string, unknown>): Promise<void>;
+    };
+} & {
+    new (...args: any[]): {
+        requireIp(whitelist?: string[], blacklist?: string[]): <F extends Function>(fn: F) => F;
+        blockCountries(countries: string[]): <F extends Function>(fn: F) => F;
+        allowCountries(countries: string[]): <F extends Function>(fn: F) => F;
+        blockClouds(providers?: string[]): <F extends Function>(fn: F) => F;
+        bypass(checks: string[]): <F extends Function>(fn: F) => F;
+        routeConfigs: Map<string, RouteConfig>;
+        behaviorTracker: BehaviorTracker;
+        agentHandler: AgentHandlerProtocol | null;
+        readonly config: ResolvedSecurityConfig;
+        readonly logger: Logger;
+        getRouteConfig(routeId: string): RouteConfig | undefined;
+        ensureRouteConfig(fn: Function): RouteConfig;
+        applyRouteConfig<T extends Function>(fn: T): T;
+        getRouteId(fn: Function): string;
+        initializeBehaviorTracking(redisHandler?: RedisHandlerProtocol): Promise<void>;
+        initializeAgent(agentHandler: AgentHandlerProtocol): Promise<void>;
+        sendDecoratorEvent(eventType: string, _request: GuardRequest, actionTaken: string, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendAccessDeniedEvent(request: GuardRequest, reason: string, decoratorType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendAuthenticationFailedEvent(request: GuardRequest, reason: string, authType: string, meta?: Record<string, unknown>): Promise<void>;
+        sendRateLimitEvent(request: GuardRequest, limit: number, window: number, meta?: Record<string, unknown>): Promise<void>;
+        sendDecoratorViolationEvent(request: GuardRequest, violationType: string, reason: string, meta?: Record<string, unknown>): Promise<void>;
+    };
+} & (new (...args: any[]) => BaseSecurityDecorator);
+type SecurityDecorator = InstanceType<typeof SecurityDecorator>;
+
+declare function sanitizeForLog(value: string): string;
+declare function sendAgentEvent(agentHandler: AgentHandlerProtocol | null, eventType: string, ipAddress: string, actionTaken: string, reason: string, request?: GuardRequest | null, metadata?: Record<string, unknown>): Promise<void>;
+declare function extractClientIp(request: GuardRequest, config: ResolvedSecurityConfig, agentHandler?: AgentHandlerProtocol | null): Promise<string>;
+declare function isUserAgentAllowed(userAgent: string, config: ResolvedSecurityConfig): Promise<boolean>;
+declare function checkIpCountry(ip: string, config: ResolvedSecurityConfig, geoIpHandler: GeoIPHandler): Promise<boolean>;
+declare function isIpAllowed(ip: string, config: ResolvedSecurityConfig, geoIpHandler?: GeoIPHandler | null): Promise<boolean>;
+declare function detectPenetrationAttempt(request: GuardRequest): Promise<[boolean, string]>;
+declare function logActivity(request: GuardRequest, logger: Logger, logType?: string, reason?: string, passiveMode?: boolean, triggerInfo?: string, level?: 'INFO' | 'DEBUG' | 'WARNING' | 'ERROR' | 'CRITICAL' | null): void;
+
+export { type AgentHandlerProtocol, BaseSecurityDecorator, type BehaviorAction, BehaviorRule, type BehaviorRuleType, BehavioralProcessor, BypassHandler, ContentPreprocessor, type DynamicRules, DynamicRulesSchema, ErrorResponseFactory, type GeoIPHandler, type GuardMiddlewareProtocol, type GuardRequest, type GuardRequestState, type GuardResponse, type GuardResponseFactory, type HandlerRegistry, type Logger, MetricsCollector, PatternCompiler, type PatternReport, type PatternStats, type PerformanceMetric, PerformanceMonitor, type RedisHandlerProtocol, RequestValidator, type ResolvedSecurityConfig, RouteConfig, RouteConfigResolver, SecurityCheckPipeline, type SecurityConfig, SecurityConfigSchema, SecurityDecorator, SecurityEventBus, type SecurityMiddlewareComponents, type SemanticAnalysis, SemanticAnalyzer, checkIpCountry, defaultLogger, detectPenetrationAttempt, extractClientIp, getRouteDecoratorConfig, initializeSecurityMiddleware, isIpAllowed, isUserAgentAllowed, logActivity, sanitizeForLog, sendAgentEvent };