@resq-systems/security 1.0.0

package/lib/validators.mjs

@@ -0,0 +1,487 @@
+import { assertNever } from "@resq-systems/types";
+//#region src/validators.ts
+/**
+* Copyright 2026 ResQ Systems, Inc.
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+/**
+* XSS attack patterns
+* Detects script injection, event handlers, and dangerous URIs
+*/
+const XSS_PATTERNS = [
+	/<script\b/gi,
+	/\bon\w+\s*=/gi,
+	/javascript\s*:/gi,
+	/data\s*:\s*text\/html/gi,
+	/data\s*:\s*application\/javascript/gi,
+	/expression\s*\(/gi,
+	/vbscript\s*:/gi,
+	/<iframe\b/gi,
+	/<object\b/gi,
+	/<embed\b/gi,
+	/<style\b/gi,
+	/document\s*\.\s*(cookie|domain|write|location)/gi,
+	/window\s*\.\s*(location|open|eval)/gi,
+	/\beval\s*\(/gi,
+	/\bnew\s+Function\s*\(/gi,
+	/\.innerHTML\s*=/gi,
+	/__proto__/gi,
+	/constructor\s*\[/gi
+];
+/**
+* SQL injection patterns
+* Detects common SQL attack vectors
+*/
+const SQL_INJECTION_PATTERNS = [
+	/\bUNION\s+(ALL\s+)?SELECT\b/gi,
+	/\bDROP\s+(TABLE|DATABASE|INDEX|VIEW)\b/gi,
+	/\bDELETE\s+FROM\b/gi,
+	/\bTRUNCATE\s+TABLE\b/gi,
+	/--\s*$/gm,
+	/\/\*[\s\S]*?\*\//g,
+	/'\s*OR\s+'[\d\w]+'\s*=\s*'[\d\w]+/gi,
+	/'\s*OR\s+\d+\s*=\s*\d+/gi,
+	/"\s*OR\s+"[\d\w]+"\s*=\s*"[\d\w]+/gi,
+	/1\s*=\s*1/g,
+	/;\s*(SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|UNION)/gi,
+	/SLEEP\s*\(\s*\d+\s*\)/gi,
+	/WAITFOR\s+DELAY/gi,
+	/BENCHMARK\s*\(/gi,
+	/INFORMATION_SCHEMA/gi,
+	/0x[0-9a-f]+/gi,
+	/\bEXEC(UTE)?\s*\(/gi,
+	/\bxp_\w+/gi
+];
+/**
+* NoSQL injection patterns
+* Detects MongoDB and other NoSQL attack vectors
+*/
+const NOSQL_INJECTION_PATTERNS = [
+	/\$(?:gt|gte|lt|lte|ne|eq|in|nin|and|or|not|nor|exists|type|mod|regex|text|where|all|elemMatch|size|slice|expr|jsonSchema|meta)\b/gi,
+	/\$where\s*:/gi,
+	/\$function\s*:/gi,
+	/\{\s*\$[a-z]+\s*:/gi,
+	/\[\s*\$[a-z]+\s*\]/gi
+];
+/**
+* Path traversal patterns
+* Detects directory traversal attacks
+*/
+const PATH_TRAVERSAL_PATTERNS = [
+	/\.\.[/\\]/g,
+	/%2e%2e[%2f%5c]/gi,
+	/%252e%252e%252f/gi,
+	/\.\.%2f/gi,
+	/\.\.%5c/gi,
+	/%00/g,
+	/\/etc\/passwd/gi,
+	/\/etc\/shadow/gi,
+	/\/proc\/self/gi,
+	/C:\\Windows/gi,
+	/C:\\System32/gi
+];
+/**
+* Homoglyph patterns
+* Detects Unicode characters that look like ASCII but aren't
+* Used in phishing and IDN homograph attacks
+*/
+const HOMOGLYPH_MAP = {
+	a: [
+		"а",
+		"ɑ",
+		"α",
+		"а"
+	],
+	c: [
+		"с",
+		"ϲ",
+		"ⅽ"
+	],
+	e: [
+		"е",
+		"ε",
+		"ė"
+	],
+	o: [
+		"о",
+		"ο",
+		"ᴏ",
+		"०"
+	],
+	p: ["р", "ρ"],
+	s: ["ѕ", "ꜱ"],
+	x: ["х", "χ"],
+	y: ["у", "γ"],
+	B: ["В", "Β"],
+	H: ["Н", "Η"],
+	K: ["К", "Κ"],
+	M: ["М", "Μ"],
+	P: ["Р", "Ρ"],
+	T: ["Т", "Τ"]
+};
+/**
+* Detect XSS-style payloads (script tags, event handlers, dangerous
+* URI schemes, prototype pollution, …) in a UTF-8 input.
+*
+* Inputs longer than 100 000 characters are truncated before scanning
+* to bound regex evaluation cost and prevent ReDoS on crafted
+* payloads. Returns at most one finding — the regex catalog is
+* exhaustive enough that the first hit is sufficient for a
+* reject-or-sanitize decision.
+*
+* @param input - String to scan.
+* @returns Empty array when nothing matches, or a single
+*   {@link ThreatFinding} of type `"xss"`.
+*
+* @example
+* ```ts
+* containsXSSPatterns(`<img src=x onerror="alert(1)">`);
+* // → [{ type: "xss", description: "...", matchedPattern: "onerror=" }]
+* ```
+*/
+function containsXSSPatterns(input) {
+	const findings = [];
+	const bounded = input.length > 1e5 ? input.slice(0, 1e5) : input;
+	for (const pattern of XSS_PATTERNS) {
+		const match = bounded.match(pattern);
+		if (match) {
+			findings.push({
+				type: "xss",
+				description: "Potential cross-site scripting (XSS) detected",
+				matchedPattern: match[0].slice(0, 50)
+			});
+			break;
+		}
+	}
+	return findings;
+}
+/**
+* Detect SQL-injection patterns (UNION SELECT, DROP TABLE,
+* comment-based bypasses, always-true tautologies, stacked queries)
+* in input.
+*
+* **Not a replacement for parameterised queries.** Use this as a
+* defense-in-depth signal in addition to a properly bound prepared
+* statement, never as the only barrier.
+*
+* @param input - String to scan. Truncated at 100 000 characters.
+* @returns Empty array, or one finding of type `"sql_injection"`.
+*/
+function containsSQLInjection(input) {
+	const findings = [];
+	const bounded = input.length > 1e5 ? input.slice(0, 1e5) : input;
+	for (const pattern of SQL_INJECTION_PATTERNS) {
+		const match = bounded.match(pattern);
+		if (match) {
+			findings.push({
+				type: "sql_injection",
+				description: "Potential SQL injection detected",
+				matchedPattern: match[0].slice(0, 50)
+			});
+			break;
+		}
+	}
+	return findings;
+}
+/**
+* Detect NoSQL-injection patterns — Mongo-style operator injection
+* (`$where`, `$ne`, `$regex`), JavaScript-in-query payloads, and
+* structural manipulators that can bypass auth filters in document
+* stores.
+*
+* @param input - String to scan.
+* @returns Empty array, or one finding of type `"nosql_injection"`.
+*/
+function containsNoSQLInjection(input) {
+	const findings = [];
+	for (const pattern of NOSQL_INJECTION_PATTERNS) {
+		const match = input.match(pattern);
+		if (match) {
+			findings.push({
+				type: "nosql_injection",
+				description: "Potential NoSQL injection detected",
+				matchedPattern: match[0].slice(0, 50)
+			});
+			break;
+		}
+	}
+	return findings;
+}
+/**
+* Detect shell command-injection patterns: command substitution
+* (`$(...)`, backticks), chained dangerous commands (`; rm`, `; curl`,
+* …) and shell-piped exec (`| sh`, `| bash`).
+*
+* **Off by default in {@link detectThreatPatterns}** — these patterns
+* occasionally fire on legitimate user content. Enable explicitly
+* (`checkCommandInjection: true`) only when input flows into a child
+* process or shell.
+*
+* @param input - String to scan. Truncated at 100 000 characters.
+* @returns Empty array, or one finding of type `"command_injection"`.
+*/
+function containsCommandInjection(input) {
+	const findings = [];
+	const dangerousPatterns = [
+		/\$\([^)]{1,200}\)/g,
+		/`[^`]{1,200}`/g,
+		/;\s*(rm|del|cat|wget|curl|nc)\b/gi,
+		/\|\s*(sh|bash|cmd)\b/gi
+	];
+	const bounded = input.length > 1e5 ? input.slice(0, 1e5) : input;
+	for (const pattern of dangerousPatterns) {
+		const match = bounded.match(pattern);
+		if (match) {
+			findings.push({
+				type: "command_injection",
+				description: "Potential command injection detected",
+				matchedPattern: match[0].slice(0, 50)
+			});
+			break;
+		}
+	}
+	return findings;
+}
+/**
+* Detect path-traversal payloads — `../`, encoded dots, raw absolute
+* paths trying to escape a base directory. Pair with `path.resolve()`
+* + a `startsWith()` containment check on the canonicalised path
+* before reading or writing the file.
+*
+* @param input - String to scan.
+* @returns Empty array, or one finding of type `"path_traversal"`.
+*/
+function containsPathTraversal(input) {
+	const findings = [];
+	for (const pattern of PATH_TRAVERSAL_PATTERNS) {
+		const match = input.match(pattern);
+		if (match) {
+			findings.push({
+				type: "path_traversal",
+				description: "Potential path traversal attack detected",
+				matchedPattern: match[0].slice(0, 50)
+			});
+			break;
+		}
+	}
+	return findings;
+}
+/**
+* Detect lookalike Unicode characters (Cyrillic / Greek glyphs that
+* render identically to common ASCII letters). The classic phishing
+* trick is `paypaӏ.com` (`ӏ` instead of `l`); this detector catches
+* the building blocks.
+*
+* Use {@link normalizeUnicode} to *replace* homoglyphs with their
+* ASCII equivalents — this function only flags their presence.
+*
+* @param input - String to scan.
+* @returns Empty array, or one finding of type `"homoglyph"` (the
+*   first matched lookalike).
+*/
+function containsHomoglyphs(input) {
+	const findings = [];
+	for (const [, homoglyphs] of Object.entries(HOMOGLYPH_MAP)) for (const homoglyph of homoglyphs) if (input.includes(homoglyph)) {
+		findings.push({
+			type: "homoglyph",
+			description: "Suspicious lookalike Unicode character detected",
+			matchedPattern: homoglyph
+		});
+		return findings;
+	}
+	return findings;
+}
+const DEFAULT_CONFIG = {
+	checkXSS: true,
+	checkSQLInjection: true,
+	checkNoSQLInjection: true,
+	checkCommandInjection: false,
+	checkPathTraversal: true,
+	checkHomoglyphs: true
+};
+/**
+* Run every enabled detector against `input` and aggregate findings.
+*
+* Returns early-but-not-immediately: each individual detector still
+* runs to completion, but each detector returns at most one finding,
+* so the aggregate threats array is small (≤ 6 entries).
+*
+* Non-string inputs (`null`, `undefined`, numbers, …) are treated as
+* safe — wrap caller-side validation around this if you want to
+* reject non-strings.
+*
+* @param input - The candidate string.
+* @param config - Detector toggles. Defaults turn on everything
+*   except command-injection.
+* @returns `{ isSafe, threats }`.
+*
+* @example
+* ```ts
+* const result = detectThreatPatterns(req.body.query);
+* if (!result.isSafe) return new Response(getThreatErrorMessage(result), { status: 400 });
+* ```
+*/
+function detectThreatPatterns(input, config = DEFAULT_CONFIG) {
+	if (!input || typeof input !== "string") return {
+		isSafe: true,
+		threats: []
+	};
+	const threats = [];
+	if (config.checkXSS !== false) threats.push(...containsXSSPatterns(input));
+	if (config.checkSQLInjection !== false) threats.push(...containsSQLInjection(input));
+	if (config.checkNoSQLInjection !== false) threats.push(...containsNoSQLInjection(input));
+	if (config.checkCommandInjection) threats.push(...containsCommandInjection(input));
+	if (config.checkPathTraversal !== false) threats.push(...containsPathTraversal(input));
+	if (config.checkHomoglyphs !== false) threats.push(...containsHomoglyphs(input));
+	return {
+		isSafe: threats.length === 0,
+		threats
+	};
+}
+/**
+* Boolean shortcut over {@link detectThreatPatterns} — discards the
+* findings list when you only need a yes/no decision.
+*
+* @param input - String to test.
+* @param config - Optional detector toggles.
+* @returns `true` when no detector fires.
+*/
+function isSafeInput(input, config) {
+	return detectThreatPatterns(input, config).isSafe;
+}
+/**
+* HTML-entity escape `&`, `<`, `>`, `"`, `'`, and `/` for safe
+* insertion into HTML text and attribute contexts.
+*
+* **Limited scope.** This is appropriate for plain text destined for
+* `textContent` or attribute values, not for unfiltered HTML
+* rendering. For rich-text use a vetted sanitizer (DOMPurify on the
+* client, sanitize-html or similar on the server).
+*
+* Returns `""` for non-string or empty input.
+*
+* @param input - Untrusted string.
+* @returns Entity-escaped output safe to interpolate into HTML.
+*/
+function sanitizeForDisplay(input) {
+	if (!input || typeof input !== "string") return "";
+	return input.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;").replace(/\//g, "&#x2F;");
+}
+/**
+* Canonicalise a string for safe equality checks against ASCII.
+*
+* Two-pass:
+* 1. Normalize to NFC (composed form) so combining-character
+*    sequences don't compare differently from their pre-composed
+*    counterparts.
+* 2. Replace known homoglyphs (Cyrillic `А`, Greek `Ε`, …) with their
+*    ASCII equivalents (`A`, `E`, …).
+*
+* Use before storing user-controlled identifiers (usernames, domain
+* names) and before comparing them to a denylist or to each other.
+*
+* Returns `""` for non-string or empty input.
+*
+* @param input - Raw string from an untrusted source.
+* @returns ASCII-normalized, NFC-composed string.
+*/
+function normalizeUnicode(input) {
+	if (!input || typeof input !== "string") return "";
+	let normalized = input.normalize("NFC");
+	for (const [ascii, homoglyphs] of Object.entries(HOMOGLYPH_MAP)) for (const homoglyph of homoglyphs) normalized = normalized.replace(new RegExp(homoglyph, "g"), ascii);
+	return normalized;
+}
+/**
+* Generic user-facing fallback message. Render this verbatim when a
+* detector fires but you don't want to expose which one. Prefer
+* {@link getThreatErrorMessage} for category-specific messages.
+*/
+const THREAT_DETECTED_MESSAGE = "Input contains potentially unsafe content";
+/**
+* Boolean refinement helper for use with `zod.string().refine(...)`,
+* `effect/Schema.filter(...)`, or any predicate-based validator.
+*
+* Equivalent to `isSafeInput(input)` with default config.
+*/
+function validateSafeText(input) {
+	return isSafeInput(input);
+}
+/**
+* Refinement for human name fields. More permissive than
+* {@link validateSafeText} — allows international letters,
+* combining marks, hyphens, apostrophes, and spaces — but still
+* rejects HTML/SQL/NoSQL injection patterns and homoglyph forgeries.
+*
+* Suitable for first/last/full-name inputs in registration forms.
+*
+* @returns `true` when the name passes both the threat detectors and
+*   the name-shape regex.
+*/
+function validateSafeName(input) {
+	const normalized = input.normalize("NFC");
+	if (!isSafeInput(normalized, { checkCommandInjection: false })) return false;
+	return /^[\p{L}\p{M}'\-\s.]+$/u.test(normalized);
+}
+/**
+* Refinement for email fields. Combines:
+*
+* 1. RFC-style format check (length-bounded to ≤ 254 chars to
+*    prevent ReDoS).
+* 2. XSS / SQL / NoSQL / homoglyph detectors — emails are extremely
+*    constrained and should never legitimately contain HTML or query
+*    operators.
+*
+* @returns `true` when both checks pass.
+*/
+function validateSafeEmail(input) {
+	if (input.length > 254) return false;
+	if (!/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test(input)) return false;
+	return detectThreatPatterns(input, {
+		checkXSS: true,
+		checkSQLInjection: true,
+		checkNoSQLInjection: true,
+		checkCommandInjection: false,
+		checkPathTraversal: false,
+		checkHomoglyphs: true
+	}).isSafe;
+}
+/**
+* Map a {@link ThreatDetectionResult} into a user-facing error
+* message string suitable for an HTTP 400 response or form
+* validation error. Returns `""` when the result is safe (so
+* `error || undefined` works).
+*
+* Uses only the **first** finding for the message — exposing every
+* threat type to the user can leak information about the detection
+* rules. For full diagnostics, log `result.threats` server-side
+* rather than returning them.
+*/
+function getThreatErrorMessage(result) {
+	if (result.isSafe) return "";
+	const threat = result.threats[0];
+	if (!threat) return THREAT_DETECTED_MESSAGE;
+	switch (threat.type) {
+		case "xss": return "Input contains potentially malicious script content";
+		case "sql_injection": return "Input contains potentially malicious database commands";
+		case "nosql_injection": return "Input contains potentially malicious query operators";
+		case "command_injection": return "Input contains potentially malicious system commands";
+		case "path_traversal": return "Input contains potentially malicious file path characters";
+		case "homoglyph": return "Input contains suspicious lookalike characters";
+		default: return assertNever(threat.type);
+	}
+}
+//#endregion
+export { THREAT_DETECTED_MESSAGE, containsCommandInjection, containsHomoglyphs, containsNoSQLInjection, containsPathTraversal, containsSQLInjection, containsXSSPatterns, detectThreatPatterns, getThreatErrorMessage, isSafeInput, normalizeUnicode, sanitizeForDisplay, validateSafeEmail, validateSafeName, validateSafeText };
+
+//# sourceMappingURL=validators.mjs.map

package/lib/validators.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.mjs","names":[],"sources":["../src/validators.ts"],"sourcesContent":["/**\n * Copyright 2026 ResQ Systems, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { assertNever } from \"@resq-systems/types\";\n\n// ============================================\n// Threat Pattern Definitions\n// ============================================\n\n/**\n * XSS attack patterns\n * Detects script injection, event handlers, and dangerous URIs\n */\nconst XSS_PATTERNS = [\n\t// Script tags (opening only — avoids ReDoS from greedy cross-tag matching)\n\t/<script\\b/gi,\n\t// Event handlers\n\t/\\bon\\w+\\s*=/gi,\n\t// JavaScript URIs\n\t/javascript\\s*:/gi,\n\t// Data URIs with script content\n\t/data\\s*:\\s*text\\/html/gi,\n\t/data\\s*:\\s*application\\/javascript/gi,\n\t// Expression evaluation\n\t/expression\\s*\\(/gi,\n\t// VBScript\n\t/vbscript\\s*:/gi,\n\t// Iframe injection\n\t/<iframe\\b/gi,\n\t// Object/embed injection\n\t/<object\\b/gi,\n\t/<embed\\b/gi,\n\t// Style-based attacks\n\t/<style\\b/gi,\n\t// Document manipulation\n\t/document\\s*\\.\\s*(cookie|domain|write|location)/gi,\n\t// Window manipulation\n\t/window\\s*\\.\\s*(location|open|eval)/gi,\n\t// Eval and Function constructor\n\t/\\beval\\s*\\(/gi,\n\t/\\bnew\\s+Function\\s*\\(/gi,\n\t// innerHTML manipulation\n\t/\\.innerHTML\\s*=/gi,\n\t// Prototype pollution\n\t/__proto__/gi,\n\t/constructor\\s*\\[/gi,\n];\n\n/**\n * SQL injection patterns\n * Detects common SQL attack vectors\n */\nconst SQL_INJECTION_PATTERNS = [\n\t// UNION-based injection\n\t/\\bUNION\\s+(ALL\\s+)?SELECT\\b/gi,\n\t// DROP/DELETE/TRUNCATE attacks\n\t/\\bDROP\\s+(TABLE|DATABASE|INDEX|VIEW)\\b/gi,\n\t/\\bDELETE\\s+FROM\\b/gi,\n\t/\\bTRUNCATE\\s+TABLE\\b/gi,\n\t// Comment-based attacks\n\t/--\\s*$/gm,\n\t/\\/\\*[\\s\\S]*?\\*\\//g,\n\t// Always-true conditions\n\t/'\\s*OR\\s+'[\\d\\w]+'\\s*=\\s*'[\\d\\w]+/gi,\n\t/'\\s*OR\\s+\\d+\\s*=\\s*\\d+/gi,\n\t/\"\\s*OR\\s+\"[\\d\\w]+\"\\s*=\\s*\"[\\d\\w]+/gi,\n\t/1\\s*=\\s*1/g,\n\t// Stacked queries\n\t/;\\s*(SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|UNION)/gi,\n\t// Time-based blind injection\n\t/SLEEP\\s*\\(\\s*\\d+\\s*\\)/gi,\n\t/WAITFOR\\s+DELAY/gi,\n\t/BENCHMARK\\s*\\(/gi,\n\t// Information schema access\n\t/INFORMATION_SCHEMA/gi,\n\t// Hex encoding bypass\n\t/0x[0-9a-f]+/gi,\n\t// EXEC/EXECUTE\n\t/\\bEXEC(UTE)?\\s*\\(/gi,\n\t// xp_ procedures (SQL Server)\n\t/\\bxp_\\w+/gi,\n];\n\n/**\n * NoSQL injection patterns\n * Detects MongoDB and other NoSQL attack vectors\n */\nconst NOSQL_INJECTION_PATTERNS = [\n\t// MongoDB operators\n\t/\\$(?:gt|gte|lt|lte|ne|eq|in|nin|and|or|not|nor|exists|type|mod|regex|text|where|all|elemMatch|size|slice|expr|jsonSchema|meta)\\b/gi,\n\t// JavaScript execution in MongoDB\n\t/\\$where\\s*:/gi,\n\t/\\$function\\s*:/gi,\n\t// Operator injection\n\t/\\{\\s*\\$[a-z]+\\s*:/gi,\n\t// Array injection\n\t/\\[\\s*\\$[a-z]+\\s*\\]/gi,\n];\n\n/**\n * Path traversal patterns\n * Detects directory traversal attacks\n */\nconst PATH_TRAVERSAL_PATTERNS = [\n\t// Directory traversal\n\t/\\.\\.[/\\\\]/g,\n\t// URL-encoded traversal\n\t/%2e%2e[%2f%5c]/gi,\n\t/%252e%252e%252f/gi,\n\t// Double-encoded\n\t/\\.\\.%2f/gi,\n\t/\\.\\.%5c/gi,\n\t// Null byte injection\n\t/%00/g,\n\t// Common sensitive paths\n\t/\\/etc\\/passwd/gi,\n\t/\\/etc\\/shadow/gi,\n\t/\\/proc\\/self/gi,\n\t/C:\\\\Windows/gi,\n\t/C:\\\\System32/gi,\n];\n\n/**\n * Homoglyph patterns\n * Detects Unicode characters that look like ASCII but aren't\n * Used in phishing and IDN homograph attacks\n */\nconst HOMOGLYPH_MAP: Record<string, string[]> = {\n\ta: [\"а\", \"ɑ\", \"α\", \"а\"], // Cyrillic а, Latin alpha, Greek alpha\n\tc: [\"с\", \"ϲ\", \"ⅽ\"], // Cyrillic с, Greek lunate sigma\n\te: [\"е\", \"ε\", \"ė\"], // Cyrillic е, Greek epsilon\n\to: [\"о\", \"ο\", \"ᴏ\", \"०\"], // Cyrillic о, Greek omicron\n\tp: [\"р\", \"ρ\"], // Cyrillic р, Greek rho\n\ts: [\"ѕ\", \"ꜱ\"], // Cyrillic ѕ\n\tx: [\"х\", \"χ\"], // Cyrillic х, Greek chi\n\ty: [\"у\", \"γ\"], // Cyrillic у, Greek gamma\n\tB: [\"В\", \"Β\"], // Cyrillic В, Greek Beta\n\tH: [\"Н\", \"Η\"], // Cyrillic Н, Greek Eta\n\tK: [\"К\", \"Κ\"], // Cyrillic К, Greek Kappa\n\tM: [\"М\", \"Μ\"], // Cyrillic М, Greek Mu\n\tP: [\"Р\", \"Ρ\"], // Cyrillic Р, Greek Rho\n\tT: [\"Т\", \"Τ\"], // Cyrillic Т, Greek Tau\n};\n\n// ============================================\n// Detection Functions\n// ============================================\n\n/**\n * Outcome of {@link detectThreatPatterns}.\n *\n * `isSafe` is the boolean shortcut; `threats` is the full list of\n * findings (one per detector that fired). Use\n * {@link getThreatErrorMessage} to render a user-facing message for\n * the first finding.\n */\nexport interface ThreatDetectionResult {\n\t/** `true` when no detectors fired. Equivalent to `threats.length === 0`. */\n\tisSafe: boolean;\n\t/** All findings produced by enabled detectors, in detector order. */\n\tthreats: ThreatFinding[];\n}\n\n/**\n * A single detector hit. Detectors that fire return at most one\n * finding per call (one example is enough to reject the input).\n */\nexport interface ThreatFinding {\n\t/** Which detector matched. */\n\ttype: ThreatType;\n\t/** Human-readable description suitable for log lines (not for end users — use {@link getThreatErrorMessage} instead). */\n\tdescription: string;\n\t/** First 50 chars of the matching substring, for diagnostics. Truncated to prevent leaking large payloads in logs. */\n\tmatchedPattern?: string;\n}\n\n/**\n * The closed set of threat categories the validators recognize. Add\n * new categories here when adding a new detector.\n */\nexport type ThreatType =\n\t| \"xss\"\n\t| \"sql_injection\"\n\t| \"nosql_injection\"\n\t| \"command_injection\"\n\t| \"path_traversal\"\n\t| \"homoglyph\";\n\n/**\n * Detect XSS-style payloads (script tags, event handlers, dangerous\n * URI schemes, prototype pollution, …) in a UTF-8 input.\n *\n * Inputs longer than 100 000 characters are truncated before scanning\n * to bound regex evaluation cost and prevent ReDoS on crafted\n * payloads. Returns at most one finding — the regex catalog is\n * exhaustive enough that the first hit is sufficient for a\n * reject-or-sanitize decision.\n *\n * @param input - String to scan.\n * @returns Empty array when nothing matches, or a single\n *   {@link ThreatFinding} of type `\"xss\"`.\n *\n * @example\n * ```ts\n * containsXSSPatterns(`<img src=x onerror=\"alert(1)\">`);\n * // → [{ type: \"xss\", description: \"...\", matchedPattern: \"onerror=\" }]\n * ```\n */\nexport function containsXSSPatterns(input: string): ThreatFinding[] {\n\tconst findings: ThreatFinding[] = [];\n\t// Limit input length to prevent ReDoS on crafted payloads\n\tconst bounded = input.length > 100_000 ? input.slice(0, 100_000) : input;\n\n\tfor (const pattern of XSS_PATTERNS) {\n\t\tconst match = bounded.match(pattern);\n\t\tif (match) {\n\t\t\tfindings.push({\n\t\t\t\ttype: \"xss\",\n\t\t\t\tdescription: \"Potential cross-site scripting (XSS) detected\",\n\t\t\t\tmatchedPattern: match[0].slice(0, 50),\n\t\t\t});\n\t\t\tbreak; // One finding per type is enough\n\t\t}\n\t}\n\n\treturn findings;\n}\n\n/**\n * Detect SQL-injection patterns (UNION SELECT, DROP TABLE,\n * comment-based bypasses, always-true tautologies, stacked queries)\n * in input.\n *\n * **Not a replacement for parameterised queries.** Use this as a\n * defense-in-depth signal in addition to a properly bound prepared\n * statement, never as the only barrier.\n *\n * @param input - String to scan. Truncated at 100 000 characters.\n * @returns Empty array, or one finding of type `\"sql_injection\"`.\n */\nexport function containsSQLInjection(input: string): ThreatFinding[] {\n\tconst findings: ThreatFinding[] = [];\n\tconst bounded = input.length > 100_000 ? input.slice(0, 100_000) : input;\n\n\tfor (const pattern of SQL_INJECTION_PATTERNS) {\n\t\tconst match = bounded.match(pattern);\n\t\tif (match) {\n\t\t\tfindings.push({\n\t\t\t\ttype: \"sql_injection\",\n\t\t\t\tdescription: \"Potential SQL injection detected\",\n\t\t\t\tmatchedPattern: match[0].slice(0, 50),\n\t\t\t});\n\t\t\tbreak;\n\t\t}\n\t}\n\n\treturn findings;\n}\n\n/**\n * Detect NoSQL-injection patterns — Mongo-style operator injection\n * (`$where`, `$ne`, `$regex`), JavaScript-in-query payloads, and\n * structural manipulators that can bypass auth filters in document\n * stores.\n *\n * @param input - String to scan.\n * @returns Empty array, or one finding of type `\"nosql_injection\"`.\n */\nexport function containsNoSQLInjection(input: string): ThreatFinding[] {\n\tconst findings: ThreatFinding[] = [];\n\n\tfor (const pattern of NOSQL_INJECTION_PATTERNS) {\n\t\tconst match = input.match(pattern);\n\t\tif (match) {\n\t\t\tfindings.push({\n\t\t\t\ttype: \"nosql_injection\",\n\t\t\t\tdescription: \"Potential NoSQL injection detected\",\n\t\t\t\tmatchedPattern: match[0].slice(0, 50),\n\t\t\t});\n\t\t\tbreak;\n\t\t}\n\t}\n\n\treturn findings;\n}\n\n/**\n * Detect shell command-injection patterns: command substitution\n * (`$(...)`, backticks), chained dangerous commands (`; rm`, `; curl`,\n * …) and shell-piped exec (`| sh`, `| bash`).\n *\n * **Off by default in {@link detectThreatPatterns}** — these patterns\n * occasionally fire on legitimate user content. Enable explicitly\n * (`checkCommandInjection: true`) only when input flows into a child\n * process or shell.\n *\n * @param input - String to scan. Truncated at 100 000 characters.\n * @returns Empty array, or one finding of type `\"command_injection\"`.\n */\nexport function containsCommandInjection(input: string): ThreatFinding[] {\n\tconst findings: ThreatFinding[] = [];\n\n\t// Only check for the most dangerous patterns, not all shell chars\n\tconst dangerousPatterns = [\n\t\t/\\$\\([^)]{1,200}\\)/g, // Command substitution (bounded)\n\t\t/`[^`]{1,200}`/g, // Backtick command substitution (bounded)\n\t\t/;\\s*(rm|del|cat|wget|curl|nc)\\b/gi, // Chained dangerous commands\n\t\t/\\|\\s*(sh|bash|cmd)\\b/gi, // Piped to shell\n\t];\n\n\tconst bounded = input.length > 100_000 ? input.slice(0, 100_000) : input;\n\n\tfor (const pattern of dangerousPatterns) {\n\t\tconst match = bounded.match(pattern);\n\t\tif (match) {\n\t\t\tfindings.push({\n\t\t\t\ttype: \"command_injection\",\n\t\t\t\tdescription: \"Potential command injection detected\",\n\t\t\t\tmatchedPattern: match[0].slice(0, 50),\n\t\t\t});\n\t\t\tbreak;\n\t\t}\n\t}\n\n\treturn findings;\n}\n\n/**\n * Detect path-traversal payloads — `../`, encoded dots, raw absolute\n * paths trying to escape a base directory. Pair with `path.resolve()`\n * + a `startsWith()` containment check on the canonicalised path\n * before reading or writing the file.\n *\n * @param input - String to scan.\n * @returns Empty array, or one finding of type `\"path_traversal\"`.\n */\nexport function containsPathTraversal(input: string): ThreatFinding[] {\n\tconst findings: ThreatFinding[] = [];\n\n\tfor (const pattern of PATH_TRAVERSAL_PATTERNS) {\n\t\tconst match = input.match(pattern);\n\t\tif (match) {\n\t\t\tfindings.push({\n\t\t\t\ttype: \"path_traversal\",\n\t\t\t\tdescription: \"Potential path traversal attack detected\",\n\t\t\t\tmatchedPattern: match[0].slice(0, 50),\n\t\t\t});\n\t\t\tbreak;\n\t\t}\n\t}\n\n\treturn findings;\n}\n\n/**\n * Detect lookalike Unicode characters (Cyrillic / Greek glyphs that\n * render identically to common ASCII letters). The classic phishing\n * trick is `paypaӏ.com` (`ӏ` instead of `l`); this detector catches\n * the building blocks.\n *\n * Use {@link normalizeUnicode} to *replace* homoglyphs with their\n * ASCII equivalents — this function only flags their presence.\n *\n * @param input - String to scan.\n * @returns Empty array, or one finding of type `\"homoglyph\"` (the\n *   first matched lookalike).\n */\nexport function containsHomoglyphs(input: string): ThreatFinding[] {\n\tconst findings: ThreatFinding[] = [];\n\n\tfor (const [, homoglyphs] of Object.entries(HOMOGLYPH_MAP)) {\n\t\tfor (const homoglyph of homoglyphs) {\n\t\t\tif (input.includes(homoglyph)) {\n\t\t\t\tfindings.push({\n\t\t\t\t\ttype: \"homoglyph\",\n\t\t\t\t\tdescription: \"Suspicious lookalike Unicode character detected\",\n\t\t\t\t\tmatchedPattern: homoglyph,\n\t\t\t\t});\n\t\t\t\treturn findings; // One finding is enough\n\t\t\t}\n\t\t}\n\t}\n\n\treturn findings;\n}\n\n// ============================================\n// Main Validation Functions\n// ============================================\n\n/**\n * Per-detector toggles for {@link detectThreatPatterns}.\n *\n * Defaults: XSS, SQL, NoSQL, path-traversal, and homoglyph detectors\n * are **on**; command injection is **off** (false-positive prone).\n * Pass `false` to disable a detector or `true` to force-enable\n * `checkCommandInjection`.\n */\nexport interface ThreatDetectionConfig {\n\t/** Default `true`. */\n\tcheckXSS?: boolean;\n\t/** Default `true`. */\n\tcheckSQLInjection?: boolean;\n\t/** Default `true`. */\n\tcheckNoSQLInjection?: boolean;\n\t/** Default `false` — opt in only when input reaches a shell. */\n\tcheckCommandInjection?: boolean;\n\t/** Default `true`. */\n\tcheckPathTraversal?: boolean;\n\t/** Default `true`. */\n\tcheckHomoglyphs?: boolean;\n}\n\nconst DEFAULT_CONFIG: ThreatDetectionConfig = {\n\tcheckXSS: true,\n\tcheckSQLInjection: true,\n\tcheckNoSQLInjection: true,\n\tcheckCommandInjection: false, // Off by default, can cause false positives\n\tcheckPathTraversal: true,\n\tcheckHomoglyphs: true,\n};\n\n/**\n * Run every enabled detector against `input` and aggregate findings.\n *\n * Returns early-but-not-immediately: each individual detector still\n * runs to completion, but each detector returns at most one finding,\n * so the aggregate threats array is small (≤ 6 entries).\n *\n * Non-string inputs (`null`, `undefined`, numbers, …) are treated as\n * safe — wrap caller-side validation around this if you want to\n * reject non-strings.\n *\n * @param input - The candidate string.\n * @param config - Detector toggles. Defaults turn on everything\n *   except command-injection.\n * @returns `{ isSafe, threats }`.\n *\n * @example\n * ```ts\n * const result = detectThreatPatterns(req.body.query);\n * if (!result.isSafe) return new Response(getThreatErrorMessage(result), { status: 400 });\n * ```\n */\nexport function detectThreatPatterns(\n\tinput: string,\n\tconfig: ThreatDetectionConfig = DEFAULT_CONFIG,\n): ThreatDetectionResult {\n\tif (!input || typeof input !== \"string\") {\n\t\treturn { isSafe: true, threats: [] };\n\t}\n\n\tconst threats: ThreatFinding[] = [];\n\n\tif (config.checkXSS !== false) {\n\t\tthreats.push(...containsXSSPatterns(input));\n\t}\n\n\tif (config.checkSQLInjection !== false) {\n\t\tthreats.push(...containsSQLInjection(input));\n\t}\n\n\tif (config.checkNoSQLInjection !== false) {\n\t\tthreats.push(...containsNoSQLInjection(input));\n\t}\n\n\tif (config.checkCommandInjection) {\n\t\tthreats.push(...containsCommandInjection(input));\n\t}\n\n\tif (config.checkPathTraversal !== false) {\n\t\tthreats.push(...containsPathTraversal(input));\n\t}\n\n\tif (config.checkHomoglyphs !== false) {\n\t\tthreats.push(...containsHomoglyphs(input));\n\t}\n\n\treturn {\n\t\tisSafe: threats.length === 0,\n\t\tthreats,\n\t};\n}\n\n/**\n * Boolean shortcut over {@link detectThreatPatterns} — discards the\n * findings list when you only need a yes/no decision.\n *\n * @param input - String to test.\n * @param config - Optional detector toggles.\n * @returns `true` when no detector fires.\n */\nexport function isSafeInput(input: string, config?: ThreatDetectionConfig): boolean {\n\treturn detectThreatPatterns(input, config).isSafe;\n}\n\n/**\n * HTML-entity escape `&`, `<`, `>`, `\"`, `'`, and `/` for safe\n * insertion into HTML text and attribute contexts.\n *\n * **Limited scope.** This is appropriate for plain text destined for\n * `textContent` or attribute values, not for unfiltered HTML\n * rendering. For rich-text use a vetted sanitizer (DOMPurify on the\n * client, sanitize-html or similar on the server).\n *\n * Returns `\"\"` for non-string or empty input.\n *\n * @param input - Untrusted string.\n * @returns Entity-escaped output safe to interpolate into HTML.\n */\nexport function sanitizeForDisplay(input: string): string {\n\tif (!input || typeof input !== \"string\") return \"\";\n\n\treturn input\n\t\t.replace(/&/g, \"&amp;\")\n\t\t.replace(/</g, \"&lt;\")\n\t\t.replace(/>/g, \"&gt;\")\n\t\t.replace(/\"/g, \"&quot;\")\n\t\t.replace(/'/g, \"&#x27;\")\n\t\t.replace(/\\//g, \"&#x2F;\");\n}\n\n/**\n * Canonicalise a string for safe equality checks against ASCII.\n *\n * Two-pass:\n * 1. Normalize to NFC (composed form) so combining-character\n *    sequences don't compare differently from their pre-composed\n *    counterparts.\n * 2. Replace known homoglyphs (Cyrillic `А`, Greek `Ε`, …) with their\n *    ASCII equivalents (`A`, `E`, …).\n *\n * Use before storing user-controlled identifiers (usernames, domain\n * names) and before comparing them to a denylist or to each other.\n *\n * Returns `\"\"` for non-string or empty input.\n *\n * @param input - Raw string from an untrusted source.\n * @returns ASCII-normalized, NFC-composed string.\n */\nexport function normalizeUnicode(input: string): string {\n\tif (!input || typeof input !== \"string\") return \"\";\n\n\t// Normalize to NFC (composed form)\n\tlet normalized = input.normalize(\"NFC\");\n\n\t// Replace known homoglyphs with ASCII equivalents\n\tfor (const [ascii, homoglyphs] of Object.entries(HOMOGLYPH_MAP)) {\n\t\tfor (const homoglyph of homoglyphs) {\n\t\t\tnormalized = normalized.replace(new RegExp(homoglyph, \"g\"), ascii);\n\t\t}\n\t}\n\n\treturn normalized;\n}\n\n// ============================================\n// Zod Validation Helpers\n// ============================================\n\n/**\n * Generic user-facing fallback message. Render this verbatim when a\n * detector fires but you don't want to expose which one. Prefer\n * {@link getThreatErrorMessage} for category-specific messages.\n */\nexport const THREAT_DETECTED_MESSAGE = \"Input contains potentially unsafe content\";\n\n/**\n * Boolean refinement helper for use with `zod.string().refine(...)`,\n * `effect/Schema.filter(...)`, or any predicate-based validator.\n *\n * Equivalent to `isSafeInput(input)` with default config.\n */\nexport function validateSafeText(input: string): boolean {\n\treturn isSafeInput(input);\n}\n\n/**\n * Refinement for human name fields. More permissive than\n * {@link validateSafeText} — allows international letters,\n * combining marks, hyphens, apostrophes, and spaces — but still\n * rejects HTML/SQL/NoSQL injection patterns and homoglyph forgeries.\n *\n * Suitable for first/last/full-name inputs in registration forms.\n *\n * @returns `true` when the name passes both the threat detectors and\n *   the name-shape regex.\n */\nexport function validateSafeName(input: string): boolean {\n\t// Normalize first to handle combining characters\n\tconst normalized = input.normalize(\"NFC\");\n\n\t// Names shouldn't contain HTML or script patterns\n\tif (!isSafeInput(normalized, { checkCommandInjection: false })) {\n\t\treturn false;\n\t}\n\n\t// Additional check: names should be primarily letters, spaces, hyphens, apostrophes\n\t// This allows international names while blocking obvious injection attempts\n\tconst namePattern = /^[\\p{L}\\p{M}'\\-\\s.]+$/u;\n\treturn namePattern.test(normalized);\n}\n\n/**\n * Refinement for email fields. Combines:\n *\n * 1. RFC-style format check (length-bounded to ≤ 254 chars to\n *    prevent ReDoS).\n * 2. XSS / SQL / NoSQL / homoglyph detectors — emails are extremely\n *    constrained and should never legitimately contain HTML or query\n *    operators.\n *\n * @returns `true` when both checks pass.\n */\nexport function validateSafeEmail(input: string): boolean {\n\t// Standard format check — bounded length to prevent ReDoS\n\tif (input.length > 254) return false;\n\tconst emailPattern =\n\t\t/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;\n\tif (!emailPattern.test(input)) {\n\t\treturn false;\n\t}\n\n\t// Check for injection patterns in email\n\t// Emails shouldn't have HTML, SQL commands, etc.\n\tconst result = detectThreatPatterns(input, {\n\t\tcheckXSS: true,\n\t\tcheckSQLInjection: true,\n\t\tcheckNoSQLInjection: true,\n\t\tcheckCommandInjection: false,\n\t\tcheckPathTraversal: false,\n\t\tcheckHomoglyphs: true,\n\t});\n\n\treturn result.isSafe;\n}\n\n/**\n * Map a {@link ThreatDetectionResult} into a user-facing error\n * message string suitable for an HTTP 400 response or form\n * validation error. Returns `\"\"` when the result is safe (so\n * `error || undefined` works).\n *\n * Uses only the **first** finding for the message — exposing every\n * threat type to the user can leak information about the detection\n * rules. For full diagnostics, log `result.threats` server-side\n * rather than returning them.\n */\nexport function getThreatErrorMessage(result: ThreatDetectionResult): string {\n\tif (result.isSafe) return \"\";\n\n\tconst threat = result.threats[0];\n\tif (!threat) return THREAT_DETECTED_MESSAGE;\n\n\tswitch (threat.type) {\n\t\tcase \"xss\":\n\t\t\treturn \"Input contains potentially malicious script content\";\n\t\tcase \"sql_injection\":\n\t\t\treturn \"Input contains potentially malicious database commands\";\n\t\tcase \"nosql_injection\":\n\t\t\treturn \"Input contains potentially malicious query operators\";\n\t\tcase \"command_injection\":\n\t\t\treturn \"Input contains potentially malicious system commands\";\n\t\tcase \"path_traversal\":\n\t\t\treturn \"Input contains potentially malicious file path characters\";\n\t\tcase \"homoglyph\":\n\t\t\treturn \"Input contains suspicious lookalike characters\";\n\t\tdefault:\n\t\t\treturn assertNever(threat.type);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA0BA,MAAM,eAAe;CAEpB;CAEA;CAEA;CAEA;CACA;CAEA;CAEA;CAEA;CAEA;CACA;CAEA;CAEA;CAEA;CAEA;CACA;CAEA;CAEA;CACA;CACA;;;;;AAMD,MAAM,yBAAyB;CAE9B;CAEA;CACA;CACA;CAEA;CACA;CAEA;CACA;CACA;CACA;CAEA;CAEA;CACA;CACA;CAEA;CAEA;CAEA;CAEA;CACA;;;;;AAMD,MAAM,2BAA2B;CAEhC;CAEA;CACA;CAEA;CAEA;CACA;;;;;AAMD,MAAM,0BAA0B;CAE/B;CAEA;CACA;CAEA;CACA;CAEA;CAEA;CACA;CACA;CACA;CACA;CACA;;;;;;AAOD,MAAM,gBAA0C;CAC/C,GAAG;EAAC;EAAK;EAAK;EAAK;EAAI;CACvB,GAAG;EAAC;EAAK;EAAK;EAAI;CAClB,GAAG;EAAC;EAAK;EAAK;EAAI;CAClB,GAAG;EAAC;EAAK;EAAK;EAAK;EAAI;CACvB,GAAG,CAAC,KAAK,IAAI;CACb,GAAG,CAAC,KAAK,IAAI;CACb,GAAG,CAAC,KAAK,IAAI;CACb,GAAG,CAAC,KAAK,IAAI;CACb,GAAG,CAAC,KAAK,IAAI;CACb,GAAG,CAAC,KAAK,IAAI;CACb,GAAG,CAAC,KAAK,IAAI;CACb,GAAG,CAAC,KAAK,IAAI;CACb,GAAG,CAAC,KAAK,IAAI;CACb,GAAG,CAAC,KAAK,IAAI;CACb;;;;;;;;;;;;;;;;;;;;;AAkED,SAAgB,oBAAoB,OAAgC;CACnE,MAAM,WAA4B,EAAE;CAEpC,MAAM,UAAU,MAAM,SAAS,MAAU,MAAM,MAAM,GAAG,IAAQ,GAAG;AAEnE,MAAK,MAAM,WAAW,cAAc;EACnC,MAAM,QAAQ,QAAQ,MAAM,QAAQ;AACpC,MAAI,OAAO;AACV,YAAS,KAAK;IACb,MAAM;IACN,aAAa;IACb,gBAAgB,MAAM,GAAG,MAAM,GAAG,GAAG;IACrC,CAAC;AACF;;;AAIF,QAAO;;;;;;;;;;;;;;AAeR,SAAgB,qBAAqB,OAAgC;CACpE,MAAM,WAA4B,EAAE;CACpC,MAAM,UAAU,MAAM,SAAS,MAAU,MAAM,MAAM,GAAG,IAAQ,GAAG;AAEnE,MAAK,MAAM,WAAW,wBAAwB;EAC7C,MAAM,QAAQ,QAAQ,MAAM,QAAQ;AACpC,MAAI,OAAO;AACV,YAAS,KAAK;IACb,MAAM;IACN,aAAa;IACb,gBAAgB,MAAM,GAAG,MAAM,GAAG,GAAG;IACrC,CAAC;AACF;;;AAIF,QAAO;;;;;;;;;;;AAYR,SAAgB,uBAAuB,OAAgC;CACtE,MAAM,WAA4B,EAAE;AAEpC,MAAK,MAAM,WAAW,0BAA0B;EAC/C,MAAM,QAAQ,MAAM,MAAM,QAAQ;AAClC,MAAI,OAAO;AACV,YAAS,KAAK;IACb,MAAM;IACN,aAAa;IACb,gBAAgB,MAAM,GAAG,MAAM,GAAG,GAAG;IACrC,CAAC;AACF;;;AAIF,QAAO;;;;;;;;;;;;;;;AAgBR,SAAgB,yBAAyB,OAAgC;CACxE,MAAM,WAA4B,EAAE;CAGpC,MAAM,oBAAoB;EACzB;EACA;EACA;EACA;EACA;CAED,MAAM,UAAU,MAAM,SAAS,MAAU,MAAM,MAAM,GAAG,IAAQ,GAAG;AAEnE,MAAK,MAAM,WAAW,mBAAmB;EACxC,MAAM,QAAQ,QAAQ,MAAM,QAAQ;AACpC,MAAI,OAAO;AACV,YAAS,KAAK;IACb,MAAM;IACN,aAAa;IACb,gBAAgB,MAAM,GAAG,MAAM,GAAG,GAAG;IACrC,CAAC;AACF;;;AAIF,QAAO;;;;;;;;;;;AAYR,SAAgB,sBAAsB,OAAgC;CACrE,MAAM,WAA4B,EAAE;AAEpC,MAAK,MAAM,WAAW,yBAAyB;EAC9C,MAAM,QAAQ,MAAM,MAAM,QAAQ;AAClC,MAAI,OAAO;AACV,YAAS,KAAK;IACb,MAAM;IACN,aAAa;IACb,gBAAgB,MAAM,GAAG,MAAM,GAAG,GAAG;IACrC,CAAC;AACF;;;AAIF,QAAO;;;;;;;;;;;;;;;AAgBR,SAAgB,mBAAmB,OAAgC;CAClE,MAAM,WAA4B,EAAE;AAEpC,MAAK,MAAM,GAAG,eAAe,OAAO,QAAQ,cAAc,CACzD,MAAK,MAAM,aAAa,WACvB,KAAI,MAAM,SAAS,UAAU,EAAE;AAC9B,WAAS,KAAK;GACb,MAAM;GACN,aAAa;GACb,gBAAgB;GAChB,CAAC;AACF,SAAO;;AAKV,QAAO;;AA8BR,MAAM,iBAAwC;CAC7C,UAAU;CACV,mBAAmB;CACnB,qBAAqB;CACrB,uBAAuB;CACvB,oBAAoB;CACpB,iBAAiB;CACjB;;;;;;;;;;;;;;;;;;;;;;;AAwBD,SAAgB,qBACf,OACA,SAAgC,gBACR;AACxB,KAAI,CAAC,SAAS,OAAO,UAAU,SAC9B,QAAO;EAAE,QAAQ;EAAM,SAAS,EAAE;EAAE;CAGrC,MAAM,UAA2B,EAAE;AAEnC,KAAI,OAAO,aAAa,MACvB,SAAQ,KAAK,GAAG,oBAAoB,MAAM,CAAC;AAG5C,KAAI,OAAO,sBAAsB,MAChC,SAAQ,KAAK,GAAG,qBAAqB,MAAM,CAAC;AAG7C,KAAI,OAAO,wBAAwB,MAClC,SAAQ,KAAK,GAAG,uBAAuB,MAAM,CAAC;AAG/C,KAAI,OAAO,sBACV,SAAQ,KAAK,GAAG,yBAAyB,MAAM,CAAC;AAGjD,KAAI,OAAO,uBAAuB,MACjC,SAAQ,KAAK,GAAG,sBAAsB,MAAM,CAAC;AAG9C,KAAI,OAAO,oBAAoB,MAC9B,SAAQ,KAAK,GAAG,mBAAmB,MAAM,CAAC;AAG3C,QAAO;EACN,QAAQ,QAAQ,WAAW;EAC3B;EACA;;;;;;;;;;AAWF,SAAgB,YAAY,OAAe,QAAyC;AACnF,QAAO,qBAAqB,OAAO,OAAO,CAAC;;;;;;;;;;;;;;;;AAiB5C,SAAgB,mBAAmB,OAAuB;AACzD,KAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAEhD,QAAO,MACL,QAAQ,MAAM,QAAQ,CACtB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,SAAS,CACvB,QAAQ,MAAM,SAAS,CACvB,QAAQ,OAAO,SAAS;;;;;;;;;;;;;;;;;;;;AAqB3B,SAAgB,iBAAiB,OAAuB;AACvD,KAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;CAGhD,IAAI,aAAa,MAAM,UAAU,MAAM;AAGvC,MAAK,MAAM,CAAC,OAAO,eAAe,OAAO,QAAQ,cAAc,CAC9D,MAAK,MAAM,aAAa,WACvB,cAAa,WAAW,QAAQ,IAAI,OAAO,WAAW,IAAI,EAAE,MAAM;AAIpE,QAAO;;;;;;;AAYR,MAAa,0BAA0B;;;;;;;AAQvC,SAAgB,iBAAiB,OAAwB;AACxD,QAAO,YAAY,MAAM;;;;;;;;;;;;;AAc1B,SAAgB,iBAAiB,OAAwB;CAExD,MAAM,aAAa,MAAM,UAAU,MAAM;AAGzC,KAAI,CAAC,YAAY,YAAY,EAAE,uBAAuB,OAAO,CAAC,CAC7D,QAAO;AAMR,QAAO,yBAAY,KAAK,WAAW;;;;;;;;;;;;;AAcpC,SAAgB,kBAAkB,OAAwB;AAEzD,KAAI,MAAM,SAAS,IAAK,QAAO;AAG/B,KAAI,CAAC,uIAAa,KAAK,MAAM,CAC5B,QAAO;AAcR,QATe,qBAAqB,OAAO;EAC1C,UAAU;EACV,mBAAmB;EACnB,qBAAqB;EACrB,uBAAuB;EACvB,oBAAoB;EACpB,iBAAiB;EACjB,CAEY,CAAC;;;;;;;;;;;;;AAcf,SAAgB,sBAAsB,QAAuC;AAC5E,KAAI,OAAO,OAAQ,QAAO;CAE1B,MAAM,SAAS,OAAO,QAAQ;AAC9B,KAAI,CAAC,OAAQ,QAAO;AAEpB,SAAQ,OAAO,MAAf;EACC,KAAK,MACJ,QAAO;EACR,KAAK,gBACJ,QAAO;EACR,KAAK,kBACJ,QAAO;EACR,KAAK,oBACJ,QAAO;EACR,KAAK,iBACJ,QAAO;EACR,KAAK,YACJ,QAAO;EACR,QACC,QAAO,YAAY,OAAO,KAAK"}

package/package.json

@@ -0,0 +1,86 @@
+{
+	"name": "@resq-systems/security",
+	"version": "1.0.0",
+	"description": "Security utilities: encryption, input validation, schemas, and PII sanitization",
+	"license": "Apache-2.0",
+	"type": "module",
+	"exports": {
+		".": {
+			"types": "./lib/index.d.mts",
+			"import": "./lib/index.mjs",
+			"default": "./lib/index.mjs"
+		},
+		"./sanitize": {
+			"types": "./lib/sanitize.d.mts",
+			"import": "./lib/sanitize.mjs",
+			"default": "./lib/sanitize.mjs"
+		},
+		"./validators": {
+			"types": "./lib/validators.d.mts",
+			"import": "./lib/validators.mjs",
+			"default": "./lib/validators.mjs"
+		},
+		"./crypto": {
+			"types": "./lib/crypto.d.mts",
+			"import": "./lib/crypto.mjs",
+			"default": "./lib/crypto.mjs"
+		},
+		"./package.json": "./package.json"
+	},
+	"main": "lib/index.mjs",
+	"types": "lib/index.d.mts",
+	"files": [
+		"lib",
+		"README.md"
+	],
+	"scripts": {
+		"build": "tsdown",
+		"test": "vitest run"
+	},
+	"peerDependencies": {
+		"effect": ">=4.0.0-beta.78",
+		"jsdom": ">=22.0.0"
+	},
+	"peerDependenciesMeta": {
+		"effect": {
+			"optional": true
+		},
+		"jsdom": {
+			"optional": true
+		}
+	},
+	"devDependencies": {
+		"@total-typescript/ts-reset": "^0.6.1",
+		"@types/node": "^26.1.1",
+		"effect": "4.0.0-beta.97",
+		"jsdom": "^29.1.1",
+		"tsdown": "^0.22.4",
+		"typescript": "7.0.2",
+		"vitest": "4.1.10"
+	},
+	"publishConfig": {
+		"access": "public",
+		"provenance": true,
+		"registry": "https://registry.npmjs.org/"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/resq-software/npm.git",
+		"directory": "packages/security"
+	},
+	"keywords": [
+		"security",
+		"encryption",
+		"validation",
+		"sanitize",
+		"xss",
+		"pii"
+	],
+	"engines": {
+		"node": ">=20.19.0"
+	},
+	"dependencies": {
+		"@resq-systems/types": "workspace:*",
+		"dompurify": "^3.4.11"
+	}
+}