@jodetx_dev/secureshield-web 0.0.0-stage → 4.0.0

package/dist/index.d.cts

@@ -0,0 +1,1421 @@
+interface DetectorItem {
+    id: string;
+    triggered: boolean;
+    severity: number;
+    category: string;
+    event: string;
+    confidence?: number;
+    fpRiskTier?: 'LOW' | 'MEDIUM' | 'HIGH';
+    evasionDifficulty?: 'LOW' | 'MEDIUM' | 'HIGH';
+    requiresConsent?: boolean;
+    implementationCost?: 'LOW' | 'MEDIUM' | 'HIGH';
+    status?: 'PASSED' | 'FAILED' | 'INCONCLUSIVE' | 'SKIPPED_NO_CONSENT';
+    name?: string;
+    executionTimeMs?: number;
+    evidence?: Record<string, any>;
+}
+interface SecurityAuditReport {
+    scan_id: string;
+    device_id_hash: string;
+    session_id: string;
+    os_name: string;
+    os_version: string;
+    app_id: string;
+    app_version: string;
+    sdk_version: string;
+    verdict?: 'SECURE' | 'BLOCKED' | 'PENDING_BACKEND_INGESTION' | 'SKIPPED';
+    risk_score?: number;
+    risk_tier?: 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' | 'NONE' | 'UNKNOWN';
+    decision_action?: 'ALLOW' | 'BLOCK' | 'PENDING_BACKEND_INGESTION' | 'SKIPPED' | 'PAUSED';
+    scoring_authority?: 'SERVER_AUTHORITATIVE' | 'CLIENT_LOCAL_OFFLINE' | 'NONE';
+    authoritative_verdict?: 'PENDING_BACKEND_INGESTION' | 'APPROVED' | 'REJECTED' | 'PASSED' | 'BLOCKED' | 'SECURE' | 'SKIPPED';
+    total_detectors: number;
+    passed: number;
+    failed: number;
+    tenant_id: string;
+    environment: string;
+    items: DetectorItem[];
+}
+declare const SDK_VERSION: string;
+type ServerSecurityVerdict = SecurityAuditReport & {
+    status?: string;
+    verdict?: string;
+    deviceStatus?: any;
+    threatScore?: number;
+    decision_action?: string;
+    trustScore?: number;
+    [key: string]: any;
+};
+declare class TelemetrySerializer {
+    private static generateDeviceIdHash;
+    private static formatOsVersion;
+    static createReport(items: DetectorItem[], tenantId?: string, appId?: string, environment?: string, appVersion?: string): SecurityAuditReport;
+}
+
+interface OriginValidationResult {
+    isValid: boolean;
+    currentOrigin: string;
+    currentHostname: string;
+    isFramed: boolean;
+    mismatchReason?: string;
+}
+declare class OriginValidator {
+    static normalizeDomain(input: string): string;
+    static matchesDomain(currentHostname: string, targetPattern: string): boolean;
+    static isLoopback(input: string): boolean;
+    static parseIPv4(ipStr: string): number[] | null;
+    static isPrivateOrRestrictedIPv4(octets: number[]): boolean;
+    static parseIPv6(ipStr: string): {
+        words: number[];
+        embeddedV4: number[] | null;
+    } | null;
+    static isPrivateOrRestrictedIPv6(parsedV6: {
+        words: number[];
+        embeddedV4: number[] | null;
+    }): boolean;
+    static isPrivateOrRestrictedHost(hostname: string): boolean;
+    static canonicalizeOrigin(input: string): string;
+    static matchesOrigin(originA: string, originB: string): boolean;
+    static isFramed(): boolean;
+    static getCurrentContext(): {
+        origin: string;
+        hostname: string;
+    };
+    static validate(allowedOrigins?: string[]): OriginValidationResult;
+}
+
+/**
+ * RemediationManager: Over-The-Air Threat Remediation & Action Dispatcher
+ *
+ * Implements automated client-side remediation for server decision actions:
+ * - PAUSED: Dynamically suspends SDK probes and background listeners.
+ * - WIPE_LOCAL_KEYS: Purges non-exportable IndexedDB vault, session tokens, and cached credentials.
+ * - TERMINATE_APP / BLOCK_DEVICE: Performs complete lockdown (vault wipe + DOM lockout overlay + URL redirect).
+ */
+interface RemediationOptions {
+    blockRedirectUrl?: string | null;
+    enableDomLockoutOverlay?: boolean;
+    onRemediationTriggered?: (action: string, reason?: string) => void;
+    onWipeKeys?: () => void;
+    requireSignature?: boolean;
+}
+interface RemediationResult {
+    action: string;
+    enforced: boolean;
+    details?: string;
+}
+declare class RemediationManager {
+    private options;
+    constructor(options?: RemediationOptions);
+    /**
+     * Purges all non-exportable IndexedDB keys, session storage, and cached auth credentials.
+     */
+    wipeLocalKeys(): Promise<void>;
+    /**
+     * Processes a server-returned decision action and applies immediate client remediation.
+     */
+    handleDecisionAction(rawAction?: string, reason?: string, verified?: boolean): Promise<RemediationResult>;
+}
+
+/**
+ * TabBlurShield: Browser Tab Switcher & Visibility Privacy Shield
+ *
+ * Web equivalent of Android FLAG_SECURE / recent-apps snapshot masking.
+ * Automatically obscures confidential DOM data when the tab is blurred, minimized, or switched,
+ * preventing shoulder surfing, OS window switcher thumbnail leakage, and screen recording capture.
+ */
+interface TabBlurOptions {
+    blurFilter?: string;
+    maskMessage?: string;
+    maskSubtitle?: string;
+    listenToWindowBlur?: boolean;
+    customOverlayId?: string;
+}
+declare class TabBlurShield {
+    static DEFAULT_OVERLAY_ID: string;
+    private static activeOptions;
+    private static isListening;
+    private static isCurrentlyMasked;
+    private static activeSubscribers;
+    private static onVisibilityChangeHandler;
+    private static onWindowBlurHandler;
+    private static onWindowFocusHandler;
+    /**
+     * Enables automatic tab blur & visibilitychange masking.
+     */
+    static enable(options?: TabBlurOptions): void;
+    /**
+     * Disables tab blur masking and restores DOM visibility.
+     */
+    static disable(force?: boolean): void;
+    static isListenerActive(): boolean;
+    static getActiveSubscribers(): number;
+    /**
+     * Mounts the privacy blur shield over the viewport.
+     */
+    static mask(): void;
+    /**
+     * Unmasks and removes the privacy blur shield.
+     */
+    static unmask(): void;
+    static isMasked(): boolean;
+    static isEnabled(): boolean;
+}
+
+/**
+ * SecureUiHardening: DOM Input Hardening, Leak Mitigation & Dynamic Security Watermarking
+ *
+ * Provides client-side defense in depth against UI scraping, physical camera photo leaks,
+ * and browser form field credential caching.
+ */
+interface WatermarkOptions {
+    opacity?: number;
+    color?: string;
+    fontSize?: number;
+    elementId?: string;
+}
+declare class SecureUiHardening {
+    static DEFAULT_WATERMARK_ID: string;
+    /**
+     * Renders a non-intrusive diagonal repeating security watermark across the entire browser viewport.
+     */
+    static renderSecurityWatermark(watermarkText?: string, options?: WatermarkOptions): void;
+    /**
+     * Removes the active security watermark from the DOM.
+     */
+    static removeSecurityWatermark(elementId?: string): void;
+    /**
+     * Hardens form input elements against browser caching, autofill exfiltration, and spellcheck sniffing.
+     */
+    static protectFormFields(containerSelector?: string): void;
+}
+
+declare class DevToolsDetector {
+    static scan(): DetectorItem;
+}
+
+declare class HeadlessBrowserDetector {
+    static scan(): DetectorItem;
+}
+
+declare class BrowserFingerprintDetector {
+    static scan(): Record<string, any>;
+}
+
+/**
+ * BrowserVersionIntegrityDetector: P4 Informational / Environment Security Detector.
+ *
+ * Cross-checks `navigator.userAgentData` (Client Hints) brands and versions against
+ * `navigator.userAgent` and engine features to identify contradictory version spoofing.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (String extraction and regex comparison)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None exfiltrated
+ * - Evasion Limits: If Client Hints API is entirely absent (e.g. Firefox/Safari), version audit relies on UA pattern parsing.
+ */
+declare class BrowserVersionIntegrityDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * BrowserCapabilitySpoofingDetector: P4 Informational / Environment Security Detector.
+ *
+ * Detects inconsistencies between reported browser engine claims (in userAgent/vendor)
+ * and actual Web API features supported by the underlying JavaScript rendering engine.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (Direct property and feature checks)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None exfiltrated
+ * - Evasion Limits: Custom Chromium forks with modified user-agents may trigger informational mismatches.
+ */
+declare class BrowserCapabilitySpoofingDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * UserAgentTamperingDetector: P4 Informational / Mandatory Baseline Detector.
+ *
+ * Audits `navigator.userAgent`, `navigator.platform`, `navigator.vendor`, and `navigator.appVersion`
+ * for property descriptor monkey-patching, userland getter overrides, and platform contradictions.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (Property descriptor inspection & cross-audit)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None exfiltrated
+ * - Evasion Limits: CDP (Chrome DevTools Protocol) user-agent overrides set before V8 context creation
+ *   must be caught by contradiction detection against underlying engine features.
+ */
+declare class UserAgentTamperingDetector {
+    static scan(): DetectorItem;
+}
+
+declare class NavigatorPropertyIntegrityDetector {
+    static scan(): Record<string, any>;
+}
+
+/**
+ * TimeManipulationDetector: P2 Medium Regulatory Baseline Detector.
+ *
+ * Compares wall-clock time (`Date.now()`) drift against monotonic high-resolution
+ * timers (`performance.now()`) and verified server timestamps to identify client
+ * system clock tampering, replay attack preparation, and token expiration bypass attempts.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.01ms (Simple arithmetic subtraction between timestamps)
+ * - Execution Model: On-demand synchronous comparison
+ * - Sensitive Data: None read or exfiltrated
+ * - Evasion Limits: If a client's system clock was already distorted before the browser
+ *   tab was opened AND no server timestamp anchor has been received yet, monotonic
+ *   performance.now() only catches clock adjustments that occur WHILE the session is active.
+ *   Receiving an anchor via `setServerTimeAnchor()` provides true global clock skew verification.
+ */
+interface TimeManipulationOptions {
+    maxAllowedDriftMs?: number;
+}
+declare class TimeManipulationDetector {
+    private static serverAnchorTimeMs;
+    private static serverAnchorPerfMs;
+    /**
+     * Anchors a trusted server timestamp (e.g. from backend attestation or policy response)
+     */
+    static setServerTimeAnchor(serverTimestampMs: number): void;
+    static scan(options?: TimeManipulationOptions): DetectorItem;
+}
+
+declare class AutomationEnvironmentDetector {
+    static scan(): Record<string, any>;
+}
+
+declare class VirtualBrowserDetector {
+    static scan(): DetectorItem;
+}
+
+declare class ConsoleTamperingDetector {
+    static scan(): DetectorItem;
+}
+
+declare class DomTamperingDetector {
+    static scan(): DetectorItem;
+}
+
+declare class DynamicEvalDetector {
+    static scan(): DetectorItem;
+}
+
+declare class RuntimeHookDetector {
+    static scan(): Record<string, any>;
+}
+
+declare class FunctionPrototypeTamperingDetector {
+    static scan(): DetectorItem;
+}
+
+declare class NativeApiOverrideDetector {
+    static scan(): DetectorItem;
+}
+
+declare class WasmIntegrityDetector {
+    static scan(): Record<string, any>;
+}
+
+/**
+ * ScriptInjectionDetector: P0 Critical Regulatory Baseline Detector.
+ *
+ * Scans the DOM for unauthorized script tags, inline scripts with encoded/eval payloads,
+ * unapproved external script origins, and DOM-based XSS injection artifacts.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.05ms for typical DOM (<100 script tags); MutationObserver uses microtask batching
+ * - Execution Model: On-demand synchronous DOM sweep + optional continuous MutationObserver
+ * - Sensitive Data: Matched suspicious payload strings are hashed/redacted before reporting
+ * - Evasion Limits: Highly sophisticated XSS attacks using multi-stage WebSocket payloads
+ *   or pure DOM property manipulation without eval/atob signatures may evade static pattern matching.
+ *   This detector serves as defense-in-depth alongside strict Content-Security-Policy (CSP) headers.
+ */
+interface ScriptInjectionOptions {
+    allowedScriptOrigins?: string[];
+    blockInlineEvalPatterns?: boolean;
+}
+declare class ScriptInjectionDetector {
+    private static defaultAllowedOrigins;
+    /**
+     * Configures global allowed script origins
+     */
+    static setAllowedOrigins(origins: string[]): void;
+    /**
+     * Initializes a background MutationObserver on document to catch runtime script injections
+     */
+    static initObserver(options?: ScriptInjectionOptions): void;
+    /**
+     * Analyzes an individual script source & content for suspicious patterns
+     */
+    static analyzeScript(src: string, content: string, allowedOrigins?: string[]): {
+        flagged: boolean;
+        reason: string;
+        severity: number;
+    };
+    static scan(options?: ScriptInjectionOptions): DetectorItem;
+    /**
+     * Resets recorded mutation observer injections (useful for test isolations)
+     */
+    static clearObservedMutations(): void;
+}
+
+/**
+ * RuntimeFunctionHookDetector: Detects dynamic function wrapping, proxying,
+ * and stealth monkey patching across critical JavaScript runtime entrypoints.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.04ms (String signature and toString-of-toString recursion checks)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None read or exfiltrated
+ * - Evasion Limits: A sophisticated attacker could implement a transparent Proxy that returns
+ *   pristine toString results, catches all trap handler evaluations, and patches Function.prototype.toString.
+ *   Note: In a pure client-side environment without multi-realm iframe isolation, an identical Proxy
+ *   wrapper with perfect trap reflection cannot be 100% distinguished from native code.
+ */
+declare class RuntimeFunctionHookDetector {
+    static scan(): DetectorItem;
+}
+
+declare class GlobalObjectTamperingDetector {
+    static scan(): Record<string, any>;
+}
+
+declare class MemoryLeakExploitationDetector {
+    static scan(): Record<string, any>;
+}
+
+/**
+ * DebuggerDetectionDetector: Timing-based anti-debugging and breakpoint detection probe.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (High-resolution timer micro-benchmark)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None read or exfiltrated
+ * - Evasion Limits: Developers who disable breakpoints or attackers stepping through with
+ *   automated CDP (Chrome DevTools Protocol) without pausing will not generate timing gaps.
+ * - False Positive Considerations: Heavy CPU throttling or main thread event-loop delays
+ *   could cause minor execution time spikes. The threshold is set conservatively (>100ms)
+ *   and emits a low-severity informational signal (severity: 2) rather than blocking the host.
+ */
+declare class DebuggerDetectionDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * ExtensionInjectionDetector: P4 Informational / Extension Security Detector.
+ *
+ * Scans DOM `<head>` and `<body>` elements for `<script>`, `<link>`, or `<iframe>` tags
+ * loaded directly from browser extension protocol schemes (`chrome-extension://`, `moz-extension://`).
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.03ms (DOM protocol scheme query)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None read or exfiltrated
+ * - Evasion Limits: Extensions using pure programmatic message passing without
+ *   inserting DOM elements cannot be detected via DOM sweeping.
+ */
+declare class ExtensionInjectionDetector {
+    static scan(): DetectorItem;
+}
+
+declare class MaliciousExtensionDetector {
+    static scan(): DetectorItem;
+}
+
+declare class ContentScriptInjectionDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * ExtensionPermissionAbuseDetector: P4 Informational / Form Security Detector.
+ *
+ * Audits sensitive form fields (password, credit card, OTP, PIN) for unauthorized
+ * value reading closures, rogue event listeners, or shadow property interceptors.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.03ms (Targeted input element selector sweep)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: Never reads or records field contents; only checks listeners and descriptor integrity
+ * - Evasion Limits: If an extension content script injects an isolated world listener that doesn't
+ *   pollute the main execution realm's property descriptors, detection relies on mutation observer alerts.
+ */
+declare class ExtensionPermissionAbuseDetector {
+    static scan(): DetectorItem;
+}
+
+declare class AdInjectionDetector {
+    static scan(): DetectorItem;
+}
+
+declare class CryptoMinerDetector {
+    static scan(): Record<string, any>;
+}
+
+/**
+ * ClipboardHijackingDetector: P4 Informational / Extension Security Detector.
+ *
+ * Audits `navigator.clipboard.writeText` and `document.execCommand` for unauthorized
+ * monkey-patching and detects rogue `copy`/`cut` event listeners replacing clipboard content.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (Clipboard API descriptor and native inspection)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: Never reads user clipboard data directly
+ * - Evasion Limits: Native OS-level keyloggers/clipboard managers cannot be observed via Web APIs.
+ */
+declare class ClipboardHijackingDetector {
+    static scan(): DetectorItem;
+}
+
+declare class PluginIntegrityDetector {
+    static scan(): Record<string, any>;
+}
+
+declare class WebStoragePlaintextDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * SessionStorageSecretsDetector: P4 Informational / Storage Security Detector.
+ *
+ * Scans sessionStorage items for unencrypted JWT tokens, private keys, API secrets,
+ * or password credentials stored in plaintext without cryptographic envelope protection.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (Direct storage key/value regex inspection)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: Matched secret values are REDACTED/HASHED; raw tokens are never recorded in telemetry.
+ * - Evasion Limits: Encrypted payloads stored under benign key names cannot be inspected without keys.
+ */
+declare class SessionStorageSecretsDetector {
+    static scan(): DetectorItem;
+}
+
+declare class CookiePolicyDetector {
+    static scan(): Record<string, any>;
+}
+
+declare class IndexedDbIntegrityDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * ServiceWorkerIntegrityDetector: P4 Informational / Application Integrity Detector.
+ *
+ * Audits `navigator.serviceWorker.register` and active Service Worker registrations
+ * to identify rogue service workers registered from unapproved scopes or external scripts.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (Registration API descriptor and scope inspection)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None read or recorded
+ * - Evasion Limits: Service Workers already registered on different subpaths before
+ *   the page load require asynchronous `navigator.serviceWorker.getRegistrations()` audit.
+ */
+declare class ServiceWorkerIntegrityDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * ManifestIntegrityDetector: P4 Informational / Application Integrity Detector.
+ *
+ * Validates Web App Manifest (`<link rel="manifest">`) link tags, checks origin
+ * conformity, and flags malicious URI schemes or untrusted third-party manifest hosts.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (Single DOM link query)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None read or exfiltrated
+ * - Evasion Limits: Manifests loaded dynamically via service worker fetch hooks
+ *   require service worker network interceptor audits.
+ */
+declare class ManifestIntegrityDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * ClientConfigTamperingDetector: P4 Informational / Application Integrity Detector.
+ *
+ * Audits client-side global configuration stores (`window.__CONFIG__`, `window.__ENV__`, `window.SecureShieldConfig`)
+ * for unexpected runtime property mutation, prototype injection, or tampering with critical endpoint URLs.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (Config store property audit)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: Config values are audited for structure without exfiltrating secrets
+ * - Evasion Limits: If config stores are modified before SDK initialization, baseline freezing is recommended.
+ */
+declare class ClientConfigTamperingDetector {
+    static scan(): DetectorItem;
+}
+
+declare class SriComplianceDetector {
+    static scan(): Record<string, any>;
+}
+
+/**
+ * SslValidationDetector: P4 Informational / Network Security Detector.
+ *
+ * Audits SSL/TLS transport context, verifies `window.isSecureContext` status,
+ * and checks for insecure WebSocket connections created within a secure origin.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.01ms (Secure context flag and protocol check)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None exfiltrated
+ * - Evasion Limits: Localhost development testing environments are granted secure context equivalence.
+ */
+declare class SslValidationDetector {
+    static scan(): DetectorItem;
+}
+
+declare class WebCertificatePinningDetector {
+    static scan(): Record<string, any>;
+}
+
+/**
+ * HttpsEnforcementDetector: P4 Informational / Network Security Detector.
+ *
+ * Verifies that the web application is running over encrypted transport (HTTPS)
+ * and flags unencrypted HTTP sessions that expose user credentials to MITM interception.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.01ms (Simple protocol and hostname check)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None exfiltrated
+ * - Evasion Limits: Local loopback hosts (localhost, 127.0.0.1) are granted development exemptions.
+ */
+declare class HttpsEnforcementDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * MixedContentDetector: P4 Informational / Network Security Detector.
+ *
+ * Scans DOM resource URLs (scripts, stylesheets, iframes, images, forms) for unencrypted
+ * `http://` resources loaded within a secure HTTPS origin context (Active/Passive Mixed Content).
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.03ms (DOM resource attribute sweep)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None exfiltrated
+ * - Evasion Limits: Mixed content fetched dynamically inside Web Workers requires CSP upgrade-insecure-requests.
+ */
+declare class MixedContentDetector {
+    static scan(): DetectorItem;
+}
+
+declare class WebDnsManipulationDetector {
+    static scan(): Record<string, any>;
+}
+
+declare class WebProxyDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * WebVpnDetector: P4 Informational / Network Security Detector.
+ *
+ * Audits WebRTC RTCPeerConnection interfaces and compares timezone offset consistency
+ * against navigator languages and locales to detect VPN tunneling and proxy routing nodes.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (Timezone and WebRTC interface inspection)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None exfiltrated
+ * - Evasion Limits: Commercial VPNs that spoof both system timezone and WebRTC routes
+ *   require IP-based threat intelligence matching on the backend.
+ */
+declare class WebVpnDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * NetworkLatencyDetector: P4 Informational / Network Security Detector.
+ *
+ * Analyzes round-trip network request latency, TCP connect times, and performance timing metrics
+ * to identify proxy relay delays, throttled debugging proxies (Burp Suite, Charles), or synthetic latency injection.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (Performance timing entry inspection)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None exfiltrated
+ * - Evasion Limits: Fast upstream proxies with minimal latency overhead cannot be differentiated from normal network jitter without backend RTT corroboration.
+ */
+declare class NetworkLatencyDetector {
+    static scan(): DetectorItem;
+}
+
+declare class IframeClickjackingDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * UiOverlayDetector: P4 Informational / UI Security Detector.
+ *
+ * Detects transparent, fixed, or absolute overlay elements (`opacity: 0`, `z-index: >1000`)
+ * layered over interactive buttons and form inputs designed for UI tapjacking or clickjacking.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.04ms (Fixed/Absolute element geometry check)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None read or exfiltrated
+ * - Evasion Limits: Overlays added dynamically upon hover and immediately removed
+ *   after click may evade discrete polling scans.
+ */
+declare class UiOverlayDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * HiddenElementDetector: P4 Informational / UI Security Detector.
+ *
+ * Identifies hidden DOM elements, zero-width inputs, and invisible iframe overlays
+ * placed outside the viewport or with transparent opacity used in clickjacking or credential harvesting.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.04ms (DOM input & iframe style audit)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None read or exfiltrated
+ * - Evasion Limits: Highly dynamic opacity toggling immediately before user click
+ *   requires ongoing pointer event interception.
+ */
+declare class HiddenElementDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * ScreenCaptureDetector: P4 Informational / UI Security Detector.
+ *
+ * Detects active screen capture APIs (`navigator.mediaDevices.getDisplayMedia`),
+ * screen sharing sessions, and unauthorized capture attempts during sensitive user operations.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (API inspection and stream check)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None read or recorded
+ * - Evasion Limits: OS-level screen capture software (OBS, native OS snipping tools)
+ *   that does not invoke WebRTC `getDisplayMedia` cannot be detected directly by browser JS.
+ */
+declare class ScreenCaptureDetector {
+    static scan(): DetectorItem;
+}
+
+declare class WindowFocusDetector {
+    static scan(): Record<string, any>;
+}
+
+declare class BotBehaviorDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * MouseDynamicsDetector: P4 Informational / Behavioral Biometrics Detector.
+ *
+ * ⚖️ LEGAL REVIEW & PRIVACY COMPLIANCE GATE (GDPR Art. 9, CCPA, BIPA, India DPDP Act):
+ * - Requires explicit user consent before activating mouse tracking (`requiresConsent: true`).
+ * - ZERO coordinate logging in telemetry: Never transmits (x, y) coordinates or path trajectories.
+ *   Only evaluates mathematical curvature entropy and acceleration delta statistics locally.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.03ms (Curvature cross-product computation on 50-point ring buffer)
+ * - Execution Model: Event-driven ring buffer + on-demand synchronous scan
+ * - Sensitive Data: Never exfiltrates screen positions or cursor path coordinates
+ * - Evasion Limits: Sophisticated Bezier curve generation algorithms with human noise simulation.
+ */
+interface MouseDynamicsOptions {
+    consentGranted?: boolean;
+}
+declare class MouseDynamicsDetector {
+    static readonly requiresConsent = true;
+    static initListener(options?: MouseDynamicsOptions): void;
+    static removeListener(force?: boolean): void;
+    static isListenerActive(): boolean;
+    static getActiveSubscribers(): number;
+    static scan(options?: MouseDynamicsOptions): DetectorItem;
+    static recordSyntheticCollinearPoints(): void;
+    static clearPoints(): void;
+}
+
+/**
+ * KeyboardDynamicsDetector: P4 Informational / Behavioral Biometrics Detector.
+ *
+ * ⚖️ LEGAL REVIEW & PRIVACY COMPLIANCE GATE (GDPR Art. 9, CCPA, BIPA, India DPDP Act):
+ * - Requires explicit user consent (`requiresConsent: true`).
+ * - STRICT PRIVACY ENFORCEMENT: Never reads, logs, or stores raw keystrokes, ASCII characters,
+ *   or keyCode/key values. ONLY computes numerical timing intervals (inter-keystroke flight times).
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.03ms (Statistical variance calculation on sliding float window)
+ * - Execution Model: Event-driven interval logging + on-demand synchronous scan
+ * - Sensitive Data: ZERO character or key data recorded. Only interval float arrays.
+ * - Evasion Limits: Bots that inject randomized Gaussian timing delays between send_keys calls.
+ */
+interface KeyboardDynamicsOptions {
+    consentGranted?: boolean;
+}
+declare class KeyboardDynamicsDetector {
+    static readonly requiresConsent = true;
+    static initListeners(options?: KeyboardDynamicsOptions): void;
+    static removeListeners(force?: boolean): void;
+    static isListenerActive(): boolean;
+    static getActiveSubscribers(): number;
+    static scan(options?: KeyboardDynamicsOptions): DetectorItem;
+    static addFlightTimeSample(intervalMs: number): void;
+    static clearSamples(): void;
+}
+
+/**
+ * TouchEventDetector: P4 Informational / Behavioral Biometrics Detector.
+ *
+ * ⚖️ LEGAL REVIEW & PRIVACY COMPLIANCE GATE (GDPR Art. 9, CCPA, BIPA, India DPDP Act):
+ * - Requires explicit user consent before activating persistent touch event listeners (`requiresConsent: true`).
+ * - ZERO coordinate tracking: Evaluates only touch physical properties (radiusX, radiusY, force, touchType).
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (Touch property inspection)
+ * - Execution Model: Event-driven property audit + on-demand synchronous scan
+ * - Sensitive Data: Never records touch locations or screen tap coordinates
+ * - Evasion Limits: Desktop browser emulators that simulate realistic radiusX/radiusY touch properties.
+ */
+interface TouchEventOptions {
+    consentGranted?: boolean;
+}
+declare class TouchEventDetector {
+    static readonly requiresConsent = true;
+    static initListeners(options?: TouchEventOptions): void;
+    static removeListeners(force?: boolean): void;
+    static isListenerActive(): boolean;
+    static getActiveSubscribers(): number;
+    static scan(options?: TouchEventOptions): DetectorItem;
+    static recordSyntheticTouch(isSynthetic: boolean): void;
+    static resetTouchData(): void;
+}
+
+/**
+ * HumanInteractionDetector: P4 Informational / Behavioral Biometrics Detector.
+ *
+ * ⚖️ LEGAL REVIEW & PRIVACY COMPLIANCE GATE (GDPR Art. 9, CCPA, BIPA, India DPDP Act):
+ * - Requires explicit user consent before activating persistent biometric tracking (`requiresConsent: true`).
+ * - ZERO raw event payload logging: Only aggregate interaction counts and presence flags are evaluated.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (Event counter inspection)
+ * - Execution Model: Event-driven counter accumulation with on-demand synchronous scan
+ * - Sensitive Data: Never records input data, cursor coordinates, or target elements
+ * - Evasion Limits: Bots that simulate fake random pointerdown events can satisfy interaction counts.
+ */
+interface BiometricConsentOptions {
+    consentGranted?: boolean;
+}
+declare class HumanInteractionDetector {
+    static readonly requiresConsent = true;
+    /**
+     * Initializes lightweight interaction listeners upon user consent
+     */
+    static initListeners(options?: BiometricConsentOptions): void;
+    static removeListeners(force?: boolean): void;
+    static isListenerActive(): boolean;
+    static getActiveSubscribers(): number;
+    static scan(options?: BiometricConsentOptions): DetectorItem;
+    static recordSyntheticInteraction(count?: number): void;
+    static resetInteractions(): void;
+}
+
+declare class WebSessionHijackDetector {
+    static scan(): Record<string, any>;
+}
+
+declare class CredentialStuffingDetector {
+    static scan(): Record<string, any>;
+}
+
+declare class ImpossibleNavigationDetector {
+    static scan(): Record<string, any>;
+}
+
+/**
+ * SessionAnomalyDetector: P4 Informational / Bot Intelligence & Session Detector.
+ *
+ * Audits tab duplication, multiple conflicting session IDs in the same origin,
+ * or concurrent session collision markers indicative of automated session hijacking or cloning.
+ *
+ * CROSS-CUTTING METRICS:
+ * - Performance Cost: ~0.02ms (Storage session token and lock check)
+ * - Execution Model: On-demand synchronous scan
+ * - Sensitive Data: None exfiltrated; session IDs are hashed/redacted.
+ * - Evasion Limits: Multi-tab sessions opened in isolated incognito profiles cannot be correlated locally.
+ */
+declare class SessionAnomalyDetector {
+    static scan(): DetectorItem;
+}
+
+declare class WebglRendererVendorDetector {
+    static scan(): DetectorItem;
+}
+
+declare class WebgpuSubsystemDetector {
+    static scan(): DetectorItem;
+}
+
+declare class CanvasFingerprintIntegrityDetector {
+    static scan(): DetectorItem;
+}
+
+declare class BatterySubsystemDetector {
+    static scan(): DetectorItem;
+}
+
+declare class ScreenGeometryDetector {
+    static scan(): DetectorItem;
+}
+
+declare class HardwareTopologyDetector {
+    static scan(): DetectorItem;
+}
+
+declare class PrototypeChainIntegrityDetector {
+    static scan(): DetectorItem;
+}
+
+declare class AutomationArtifactsDetector {
+    static scan(): DetectorItem;
+}
+
+declare class LocalstorageSecretsDetector {
+    static scan(): DetectorItem;
+}
+
+declare class WasmBytecodeIntegrityDetector {
+    static scan(): DetectorItem;
+}
+
+declare class ClientHintsConsistencyDetector {
+    static scan(): DetectorItem;
+}
+
+declare class PermissionsApiSweepDetector {
+    static scan(): DetectorItem;
+}
+
+declare class WebAuthnHardwareAuthenticatorDetector {
+    static scan(): DetectorItem;
+}
+
+declare class InputPointerMediaQueryDetector {
+    static scan(): DetectorItem;
+}
+
+declare class IntlLocaleFingerprintDetector {
+    static scan(): DetectorItem;
+}
+
+declare class ErrorStackFormatDetector {
+    static scan(): DetectorItem;
+}
+
+declare class FontLoadingEnumerationDetector {
+    static scan(): DetectorItem;
+}
+
+declare class MathFpPrecisionDetector {
+    static scan(): DetectorItem;
+}
+
+declare class MediaCapabilitiesCodecDetector {
+    static scan(): DetectorItem;
+}
+
+declare class StorageQuotaEstimateDetector {
+    static scan(): DetectorItem;
+}
+
+declare class CssEngineFeatureMatrixDetector {
+    static scan(): DetectorItem;
+}
+
+declare class AdblockerPresenceDetector {
+    static scan(): DetectorItem;
+}
+
+declare class GlobalPrivacyControlDetector {
+    static scan(): DetectorItem;
+}
+
+/**
+ * PayloadSecurityHelper: Web Crypto API End-to-End Encryption & Telemetry Envelope Manager
+ *
+ * Implements ephemeral ECDH (P-256/secp256r1) key agreement, RFC 5869 HKDF-SHA256 key derivation,
+ * AES-256-GCM authenticated payload encryption, and HMAC-SHA256 envelope signing.
+ *
+ * Fully aligned with Android SDK (PayloadSecurityHelper.kt) and Portal Ingest Gateway (payload_security.js).
+ */
+interface SecurityEnvelopeHeader {
+    signature: string;
+    timestamp: number;
+    iv: string;
+    nonce: string;
+    ephemeral_pub_key: string;
+    crypto_mode: string;
+}
+interface SecurityEnvelope {
+    header: SecurityEnvelopeHeader;
+    body: string;
+}
+declare class PayloadSecurityHelper {
+    static DEFAULT_SERVER_PUBLIC_KEY_BASE64: string;
+    static DEFAULT_HMAC_KEY_HEX: string;
+    private static serverPublicKeyBase64;
+    private static hmacKeyHex;
+    static setServerPublicKey(base64PublicKey: string): void;
+    static setHmacKey(hexHmacKey: string): void;
+    /**
+     * Helper: Resolves standard Web Crypto instance across Browser & Node environments
+     */
+    private static getSubtleCrypto;
+    /**
+     * Helper: Fills a TypedArray buffer with zeros (best-effort JS memory scrubbing)
+     */
+    static scrubBuffer(buffer: ArrayBufferView | ArrayBuffer): void;
+    /**
+     * Binary Encoding Utilities (Universal Web standards, no Node Buffer required)
+     */
+    static bytesToBase64(bytes: Uint8Array): string;
+    static base64ToBytes(base64: string): Uint8Array;
+    static hexToBytes(hex: string): Uint8Array;
+    static bytesToHex(bytes: Uint8Array): string;
+    /**
+     * Generates a cryptographically random UUID v4 string without dashes
+     */
+    static generateNonce(): string;
+    /**
+     * Encrypts and cryptographically signs raw JSON telemetry report using End-to-End
+     * ECDH-P256 Ephemeral Key Exchange + RFC 5869 HKDF-SHA256 + AES-256-GCM + HMAC-SHA256.
+     *
+     * @param rawJsonStr The raw JSON string containing the security audit report
+     * @param customServerPubKeyBase64 Optional override for Server Public Key SPKI
+     * @param customHmacKeyHex Optional override for HMAC Key Hex
+     * @returns JSON string representing the full SecurityEnvelope
+     */
+    static encryptAndSignPayload(rawJsonStr: string, customServerPubKeyBase64?: string, customHmacKeyHex?: string): Promise<string>;
+    /**
+     * Constructs the structured SecurityEnvelope object
+     */
+    static createSecurityEnvelope(rawJsonStr: string, customServerPubKeyBase64?: string, customHmacKeyHex?: string): Promise<SecurityEnvelope>;
+}
+
+/**
+ * IndexedDbLeaseVault: Non-Exportable Cryptographic Vault & Offline Session Lease Manager
+ *
+ * Implements hardware-adjacent browser key storage using standard IndexedDB + Web Crypto API.
+ * The master encryption key is generated with extractable=false (non-exportable), meaning raw key bytes
+ * never enter userland JavaScript memory and cannot be exfiltrated via devtools or script injection.
+ *
+ * Provides offline session grace lease caching mirroring Android KeyStore / EncryptedSharedPreferences.
+ */
+interface SignedLeaseEnvelope {
+    protected: string;
+    payload: string;
+    signature: string;
+    public_key_jwk?: any;
+}
+interface CachedLeasePayload {
+    appId: string;
+    tenantId: string;
+    origin: string;
+    policy?: any;
+    sessionToken?: string;
+    deviceToken?: string;
+    leaseExpiryMs: number;
+    cachedAt: number;
+    lastSeenTimestamp?: number;
+    signedEnvelope?: SignedLeaseEnvelope;
+}
+interface EncryptedLeaseRecord {
+    id: string;
+    iv: string;
+    ciphertext: string;
+    timestamp: number;
+}
+interface LeaseVerificationResult {
+    isValid: boolean;
+    lease?: CachedLeasePayload;
+    reason?: string;
+    needsOnlineRefresh?: boolean;
+}
+declare class IndexedDbLeaseVault {
+    static DB_NAME: string;
+    static DB_VERSION: number;
+    static STORE_KEYS: string;
+    static STORE_LEASES: string;
+    static MASTER_KEY_ID: string;
+    static LEASE_RECORD_ID: string;
+    private static memoryKeyStore;
+    private static memoryLeaseStore;
+    /**
+     * Helper: Resolves standard Web Crypto instance
+     */
+    private static getSubtleCrypto;
+    /**
+     * Helper: Checks if native browser IndexedDB is accessible
+     */
+    private static isIndexedDbAvailable;
+    /**
+     * Opens or initializes the IndexedDB database instance
+     */
+    private static openDatabase;
+    /**
+     * Retrieves existing non-exportable CryptoKey or generates a new one.
+     * Key is generated with extractable=false so raw bytes cannot be exported.
+     */
+    static getOrCreateMasterKey(): Promise<CryptoKey>;
+    /**
+     * Encrypts and persists a verified session lease in the vault.
+     */
+    static saveLease(payload: CachedLeasePayload): Promise<void>;
+    /**
+     * Decrypts and retrieves the cached session lease from the vault.
+     */
+    static getLease(): Promise<CachedLeasePayload | null>;
+    /**
+     * Verifies if an active, non-expired offline grace lease exists for the current appId and origin.
+     */
+    static verifyOfflineLease(appId: string, currentOrigin: string, clockOffsetMs?: number, customKeys?: Record<string, JsonWebKey>, isProduction?: boolean, strictBindings?: boolean): Promise<LeaseVerificationResult>;
+    /**
+     * Completely clears all keys and leases from the vault (used during remote threat remediation / WIPE_LOCAL_KEYS).
+     */
+    static clearVault(): Promise<void>;
+    /**
+     * Universal Base64 Helpers
+     */
+    private static bytesToBase64;
+    private static base64ToBytes;
+}
+
+/**
+ * SecurityLockoutOverlay: DOM Lockout & Threat Remediation Screen Overlay
+ * Renders an un-dismissible, high-contrast security lockout shield over the DOM.
+ * Fortified with MutationObservers against DOM tampering, removal, or CSS suppression (N-9).
+ */
+declare class SecurityLockoutOverlay {
+    static OVERLAY_ELEMENT_ID: string;
+    private static readonly EVTS;
+    private static isCapturingEvents;
+    private static isLockoutEnforced;
+    private static isMutating;
+    private static bodyObserver;
+    private static overlayObserver;
+    private static lastTitle;
+    private static lastMessage;
+    private static lastIncidentId?;
+    private static eventSuppressor;
+    static renderLockoutOverlay(title?: string, message?: string, incidentId?: string): void;
+    private static attachObservers;
+    private static ensureOverlayStyles;
+    static dismissLockoutOverlay(): void;
+    static isLockoutActive(): boolean;
+}
+
+/**
+ * SecureClipboard: Timed Auto-Wipe & Sensitive Input Exfiltration Shield
+ *
+ * Web equivalent of Android KeyStore clipboard data scrubbing.
+ * Allows applications to place sensitive data (OTP codes, private keys, credit cards)
+ * on the system clipboard with an automated time-to-live (TTL) auto-wipe timer.
+ */
+interface ClipboardCopyResult {
+    success: boolean;
+    wipeAfterMs: number;
+    cancelWipe: () => void;
+}
+declare class SecureClipboard {
+    private static activeWipeTimer;
+    private static lastCopiedSensitiveHash;
+    /**
+     * Writes sensitive text to the clipboard and starts an automatic wipe countdown timer.
+     */
+    static copy(text: string, wipeAfterMs?: number): Promise<ClipboardCopyResult>;
+    /**
+     * Immediately clears/overwrites the system clipboard.
+     */
+    static wipeNow(): Promise<boolean>;
+    /**
+     * Cancels any pending auto-wipe countdown timer.
+     */
+    static cancelActiveWipe(): void;
+    /**
+     * Hardens designated sensitive input elements against unauthorized cut/copy/drag exfiltration.
+     */
+    static protectSensitiveInputs(selector?: string): void;
+}
+
+/**
+ * MemoryScrubber: Best-Effort TypedArray & Buffer Memory Zeroing Engine
+ *
+ * Web equivalent of native C/C++ memset_s / explicit_bzero.
+ * While JavaScript strings are immutable and garbage-collected, binary memory
+ * represented by TypedArrays (Uint8Array, ArrayBuffer, DataView) can and must be explicitly
+ * sanitized to reduce plaintext credential exposure in heap snapshots and memory dumps.
+ */
+declare class MemoryScrubber {
+    /**
+     * Performs a multi-pass cryptographic overwrite and zeroing on any TypedArray or ArrayBuffer.
+     */
+    static zero(target: ArrayBufferView | ArrayBuffer | null | undefined): void;
+    /**
+     * Recursively traverses an object or array and wipes all contained TypedArrays / ArrayBuffers.
+     */
+    static scrubObject(obj: any, maxDepth?: number): void;
+}
+/**
+ * SecureMemoryBuffer: RAII-style scoped memory wrapper that guarantees
+ * automatic buffer scrubbing upon scope exit (even during errors).
+ */
+declare class SecureMemoryBuffer {
+    /**
+     * Allocates or wraps a buffer, executes the provided consumer closure,
+     * and guarantees that the buffer is completely zeroed upon exit.
+     */
+    static use<R>(buffer: Uint8Array | ArrayBuffer, action: (buf: Uint8Array) => R | Promise<R>): Promise<R>;
+}
+
+interface StorageLeakItem {
+    storage: 'localStorage' | 'sessionStorage';
+    key: string;
+    reason: string;
+    namespace?: string;
+    category?: 'token' | 'key' | 'password' | 'credential' | 'secret';
+}
+interface StorageLeakReport {
+    leaksFound: number;
+    leakingKeys: StorageLeakItem[];
+    inspectedCount: number;
+}
+declare class StorageScrubber {
+    static readonly UUID_REGEX: RegExp;
+    static readonly JWT_REGEX: RegExp;
+    static readonly BEARER_REGEX: RegExp;
+    static readonly PEM_REGEX: RegExp;
+    static readonly HEX64_REGEX: RegExp;
+    static readonly API_KEY_REGEX: RegExp;
+    static readonly SENSITIVE_KEY_REGEX: RegExp;
+    static readonly SAFE_KEY_REGEX: RegExp;
+    static scanForPlaintextLeaks(): StorageLeakReport;
+    static purgePlaintextLeaks(whitelistKeys?: string[]): StorageLeakReport;
+    static wipeVolatileStorage(): void;
+    static evaluatePotentialLeak(key: string, value: string): string | null;
+}
+
+/**
+ * RuntimeIntegrityGuardian: Prototype Hardening, Proxy Traps & Native API Integrity Guardian
+ *
+ * Web equivalent of Android native code integrity verification and syscall bootstrapping.
+ * Protects JavaScript runtime intrinsics from monkey-patching, prototype pollution,
+ * and rogue extension injection while maintaining pristine, unpoisonable function pointers.
+ */
+interface TamperedApiItem {
+    apiName: string;
+    isNative: boolean;
+    reason: string;
+}
+interface RuntimeIntegrityReport {
+    isClean: boolean;
+    tamperedCount: number;
+    tamperedApis: TamperedApiItem[];
+    auditedCount: number;
+}
+declare class RuntimeIntegrityGuardian {
+    private static NATIVE_CODE_REGEX;
+    /**
+     * Exposes cached pristine intrinsics for internal SDK use
+     */
+    static pristine: {
+        toString: () => string;
+        defineProperty: <T>(o: T, p: PropertyKey, attributes: PropertyDescriptor & ThisType<any>) => T;
+        freeze: {
+            <T extends Function>(f: T): T;
+            <T extends {
+                [idx: string]: U | null | undefined | object;
+            }, U extends string | bigint | number | boolean | symbol>(o: T): Readonly<T>;
+            <T>(o: T): Readonly<T>;
+        };
+        getOwnPropertyDescriptor: (o: any, p: PropertyKey) => PropertyDescriptor | undefined;
+        stringify: {
+            (value: any, replacer?: (this: any, key: string, value: any) => any, space?: string | number): string;
+            (value: any, replacer?: (number | string)[] | null, space?: string | number): string;
+        };
+        now: () => number;
+    };
+    /**
+     * Evaluates whether a given function is a genuine C++ browser native function
+     * rather than a userland wrapper, proxy, or closure.
+     */
+    static isNativeFunction(fn: any): boolean;
+    /**
+     * Recursively seals and freezes target ECMAScript built-in prototypes to block prototype pollution.
+     */
+    static freezePrototypes(targets?: any[]): {
+        frozenCount: number;
+        errors: string[];
+    };
+    /**
+     * Wraps a sensitive SDK object or configuration in strict Proxy traps to prevent runtime mutation
+     * from external userland scripts while allowing internal methods to operate on the raw instance.
+     */
+    static createTamperProofProxy<T extends object>(target: T, name?: string, onTamper?: (action: string, prop: string) => void): T;
+    /**
+     * Performs an active runtime audit of critical browser primitives to detect hooks and overrides.
+     */
+    static auditRuntimeIntegrity(): RuntimeIntegrityReport;
+}
+
+declare class DeviceFingerprintEngine {
+    static scan(): DetectorItem;
+}
+
+declare function isServerEnvironment(): boolean;
+interface SecureShieldConfig {
+    tenantId?: string;
+    appId?: string;
+    appVersion?: string;
+    appToken?: string;
+    enableDeviceFingerprinting?: boolean;
+    headerKey?: string;
+    encryptionKey?: string;
+    initializationKey?: string;
+    serverUrl?: string;
+    publicKeyPem?: string;
+    serverPublicKeyBase64?: string;
+    hmacKeyHex?: string;
+    enableE2eeEncryption?: boolean;
+    allowedOrigins?: string[];
+    offlineGracePeriodMs?: number;
+    skipHandshake?: boolean;
+    blockRedirectUrl?: string | null;
+    enableDomLockoutOverlay?: boolean;
+    onRemediationTriggered?: (action: string, reason?: string) => void;
+    onWipeKeys?: () => void;
+    enableTabBlurShield?: boolean;
+    tabBlurOptions?: TabBlurOptions;
+    enableWatermark?: boolean;
+    watermarkText?: string;
+    watermarkOptions?: WatermarkOptions;
+    defaultClipboardWipeTimeoutMs?: number;
+    enableStorageLeakScrubber?: boolean;
+    storageWhitelistKeys?: string[];
+    enablePrototypeFreezing?: boolean;
+    enableRuntimeIntegrityWatchdog?: boolean;
+    onTamperDetected?: (api: string, details: string) => void;
+    autoIngest?: boolean;
+    environment?: 'production' | 'staging' | 'development';
+    consent?: {
+        behavioralBiometrics?: boolean;
+    };
+    /**
+     * @deprecated Use `consent: { behavioralBiometrics: true }` to explicitly grant consent under GDPR/DPDP.
+     */
+    enableBehavioralBiometrics?: boolean;
+    /**
+     * Optional custom public keys to verify remote policy signatures against (enterprise key pinning or test overrides).
+     */
+    customPolicyKeys?: Record<string, JsonWebKey>;
+    /**
+     * Optional custom public keys to verify offline grace leases against (enterprise key pinning or test overrides).
+     */
+    customLeaseKeys?: Record<string, JsonWebKey>;
+    /**
+     * @deprecated N-12: appToken transmission via URL query string has been completely removed.
+     * appToken is now transmitted strictly via the x-app-token header.
+     * This option is retained as a no-op for backward compatibility.
+     */
+    preferHeaderAppToken?: boolean;
+    disabledDetectors?: string[];
+    /**
+     * Gates strict cryptographic lease binding enforcement (NEW-1).
+     * When true (default), leases lacking signed app_id, origin, iat, or exp are rejected fail-closed.
+     * When false (staged rollout / migration mode), incomplete leases are treated as requiring
+     * an online refresh with an operational warning, without falling back to unsigned data.
+     * Default: true.
+     */
+    strictLeaseBindingEnforcement?: boolean;
+}
+declare function normalizeEnvironment(env?: unknown): 'production' | 'staging' | 'development';
+declare function getBaseApiUrl(u: string): string;
+declare class SecureShield {
+    #private;
+    private tenantId;
+    private appId;
+    private appToken?;
+    private appVersion;
+    private headerKey?;
+    private encryptionKey?;
+    private initializationKey?;
+    private sessionToken?;
+    private deviceToken?;
+    private serverUrl;
+    private publicKeyPem?;
+    private serverPublicKeyBase64?;
+    private hmacKeyHex?;
+    private enableE2eeEncryption;
+    private allowedOrigins?;
+    private offlineGracePeriodMs;
+    private remediationManager;
+    private autoIngest;
+    private isHandshakeApproved;
+    private isOfflineMode;
+    private hasBiometricConsent;
+    private preferHeaderAppToken;
+    private strictLeaseBindingEnforcement;
+    private customPolicyKeys?;
+    private customLeaseKeys?;
+    private enableDeviceFingerprinting;
+    private isDestroyed;
+    private hasTabBlurShield;
+    private constructor();
+    static readonly OriginValidator: typeof OriginValidator;
+    static validateProductionServerUrl(serverUrl?: string): void;
+    static init(config?: SecureShieldConfig): Promise<SecureShield>;
+    getHandshakeUrl(): string;
+    getSdkInitializeUrl(): string;
+    initializeWithKeys(isRetry?: boolean): Promise<boolean>;
+    getSessionToken(): string | undefined;
+    getDeviceToken(): string | undefined;
+    isInitialized(): boolean;
+    clearSession(): Promise<void>;
+    executeSdkHandshake(isRetry?: boolean): Promise<boolean>;
+    private checkOfflineGraceLease;
+    isApproved(response?: any): boolean;
+    isHandshakeActive(): boolean;
+    getLatestAuditReport(): SecurityAuditReport | null;
+    grantConsent(category: 'behavioralBiometrics'): void;
+    revokeConsent(category: 'behavioralBiometrics'): void;
+    hasConsent(category: 'behavioralBiometrics'): boolean;
+    private initBiometricListeners;
+    private teardownBiometricListeners;
+    isOperatingOffline(): boolean;
+    getIngestUrl(): string;
+    getPolicyUrl(): string;
+    fetchSignedRemotePolicy(): Promise<void>;
+    private getFailClosedDefaultPolicy;
+    evaluateSecurityState(): Promise<SecurityAuditReport & {
+        trustScore: number;
+    }>;
+    ingestTelemetry(reportPayload?: SecurityAuditReport): Promise<any>;
+    isPaused(): boolean;
+    setPaused(paused: boolean): void;
+    getRemediationManager(): RemediationManager;
+    destroy(): void;
+    runScan(options?: {
+        ingest?: boolean;
+    }): SecurityAuditReport;
+    scan(options?: {
+        ingest?: boolean;
+    }): SecurityAuditReport;
+    getDetailedDeviceSecurityScan(): string;
+}
+
+export { AdInjectionDetector, AdblockerPresenceDetector, AutomationArtifactsDetector, AutomationEnvironmentDetector, BatterySubsystemDetector, type BiometricConsentOptions, BotBehaviorDetector, BrowserCapabilitySpoofingDetector, BrowserFingerprintDetector, BrowserVersionIntegrityDetector, type CachedLeasePayload, CanvasFingerprintIntegrityDetector, ClientConfigTamperingDetector, ClientHintsConsistencyDetector, type ClipboardCopyResult, ClipboardHijackingDetector, ConsoleTamperingDetector, ContentScriptInjectionDetector, CookiePolicyDetector, CredentialStuffingDetector, CryptoMinerDetector, CssEngineFeatureMatrixDetector, DebuggerDetectionDetector, type DetectorItem, DevToolsDetector, DeviceFingerprintEngine, DomTamperingDetector, DynamicEvalDetector, type EncryptedLeaseRecord, ErrorStackFormatDetector, ExtensionInjectionDetector, ExtensionPermissionAbuseDetector, FontLoadingEnumerationDetector, FunctionPrototypeTamperingDetector, GlobalObjectTamperingDetector, GlobalPrivacyControlDetector, HardwareTopologyDetector, HeadlessBrowserDetector, HiddenElementDetector, HttpsEnforcementDetector, HumanInteractionDetector, IframeClickjackingDetector, ImpossibleNavigationDetector, IndexedDbIntegrityDetector, IndexedDbLeaseVault, InputPointerMediaQueryDetector, IntlLocaleFingerprintDetector, KeyboardDynamicsDetector, type KeyboardDynamicsOptions, type LeaseVerificationResult, LocalstorageSecretsDetector, MaliciousExtensionDetector, ManifestIntegrityDetector, MathFpPrecisionDetector, MediaCapabilitiesCodecDetector, MemoryLeakExploitationDetector, MemoryScrubber, MixedContentDetector, MouseDynamicsDetector, type MouseDynamicsOptions, NativeApiOverrideDetector, NavigatorPropertyIntegrityDetector, NetworkLatencyDetector, type OriginValidationResult, OriginValidator, PayloadSecurityHelper, PermissionsApiSweepDetector, PluginIntegrityDetector, PrototypeChainIntegrityDetector, RemediationManager, type RemediationOptions, type RemediationResult, RuntimeFunctionHookDetector, RuntimeHookDetector, RuntimeIntegrityGuardian, type RuntimeIntegrityReport, SDK_VERSION, ScreenCaptureDetector, ScreenGeometryDetector, ScriptInjectionDetector, type ScriptInjectionOptions, SecureClipboard, SecureMemoryBuffer, SecureShield, type SecureShieldConfig, SecureUiHardening, type SecurityAuditReport, type SecurityEnvelope, type SecurityEnvelopeHeader, SecurityLockoutOverlay, type ServerSecurityVerdict, ServiceWorkerIntegrityDetector, SessionAnomalyDetector, SessionStorageSecretsDetector, type SignedLeaseEnvelope, SriComplianceDetector, SslValidationDetector, type StorageLeakItem, type StorageLeakReport, StorageQuotaEstimateDetector, StorageScrubber, type TabBlurOptions, TabBlurShield, type TamperedApiItem, TelemetrySerializer, TimeManipulationDetector, type TimeManipulationOptions, TouchEventDetector, type TouchEventOptions, UiOverlayDetector, UserAgentTamperingDetector, VirtualBrowserDetector, WasmBytecodeIntegrityDetector, WasmIntegrityDetector, type WatermarkOptions, WebAuthnHardwareAuthenticatorDetector, WebCertificatePinningDetector, WebDnsManipulationDetector, WebProxyDetector, WebSessionHijackDetector, WebStoragePlaintextDetector, WebVpnDetector, WebglRendererVendorDetector, WebgpuSubsystemDetector, WindowFocusDetector, SecureShield as default, getBaseApiUrl, isServerEnvironment, normalizeEnvironment };