@shieldpress/tracker 1.0.0

package/dist/nextjs.js

@@ -0,0 +1,1551 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/nextjs.ts
+var nextjs_exports = {};
+__export(nextjs_exports, {
+  ShieldPressTracker: () => ShieldPressTracker,
+  getTracker: () => getTracker,
+  initTracker: () => initTracker,
+  withShieldPress: () => withShieldPress,
+  withTracking: () => withTracking
+});
+module.exports = __toCommonJS(nextjs_exports);
+
+// src/config.ts
+var DEFAULT_API_URL = "https://api.shieldpress.net";
+function resolveConfig(config) {
+  if (!config.apiKey) throw new Error("[ShieldPress] apiKey is required");
+  if (!config.siteId) throw new Error("[ShieldPress] siteId is required");
+  return {
+    apiKey: config.apiKey,
+    siteId: config.siteId,
+    apiUrl: config.apiUrl || DEFAULT_API_URL,
+    reportInterval: config.reportInterval ?? 60,
+    systemMetrics: config.systemMetrics ?? true,
+    httpTracking: config.httpTracking ?? true,
+    errorTracking: config.errorTracking ?? true,
+    securityTracking: config.securityTracking ?? true,
+    depAudit: config.depAudit ?? true,
+    depAuditInterval: config.depAuditInterval ?? 3600,
+    runtimeMetrics: config.runtimeMetrics ?? true,
+    envSecurity: config.envSecurity ?? true,
+    heartbeat: config.heartbeat ?? true,
+    appName: config.appName || "node-app",
+    appVersion: config.appVersion || "0.0.0",
+    environment: config.environment || process.env.NODE_ENV || "production",
+    tags: config.tags || {},
+    ignorePaths: config.ignorePaths || [
+      "/health",
+      "/healthz",
+      "/ready",
+      "/favicon.ico",
+      "/_next/static/*",
+      "/_next/image/*"
+    ],
+    maxErrorBuffer: config.maxErrorBuffer ?? 100,
+    maxSecurityBuffer: config.maxSecurityBuffer ?? 500,
+    debug: config.debug ?? false
+  };
+}
+
+// src/logger.ts
+function createLogger(debug) {
+  return {
+    info: (...args) => {
+      if (debug) console.log("[ShieldPress]", ...args);
+    },
+    warn: (...args) => {
+      console.warn("[ShieldPress]", ...args);
+    },
+    error: (...args) => {
+      console.error("[ShieldPress]", ...args);
+    }
+  };
+}
+
+// src/collectors/system.ts
+var import_os = __toESM(require("os"));
+var import_fs = require("fs");
+function getPrivateIp() {
+  try {
+    const nets = (0, import_os.networkInterfaces)();
+    for (const name of Object.keys(nets)) {
+      for (const net of nets[name] || []) {
+        if (net.family === "IPv4" && !net.internal) {
+          return net.address;
+        }
+      }
+    }
+    return "";
+  } catch {
+    return "";
+  }
+}
+var cachedPublicIp = "";
+var publicIpLastFetch = 0;
+function getPublicIpCached() {
+  if (Date.now() - publicIpLastFetch > 6e5) {
+    publicIpLastFetch = Date.now();
+    try {
+      const http2 = require("https");
+      const req = http2.get("https://api.ipify.org", { timeout: 3e3 }, (res) => {
+        let data = "";
+        res.on("data", (chunk) => {
+          data += chunk;
+        });
+        res.on("end", () => {
+          cachedPublicIp = data.trim();
+        });
+      });
+      req.on("error", () => {
+      });
+      req.on("timeout", () => {
+        req.destroy();
+      });
+    } catch {
+    }
+  }
+  return cachedPublicIp;
+}
+function getDiskUsage() {
+  try {
+    if (typeof import_fs.statfsSync === "function") {
+      const root = import_os.default.platform() === "win32" ? "C:\\" : "/";
+      const stats = (0, import_fs.statfsSync)(root);
+      const totalBytes = stats.blocks * stats.bsize;
+      const freeBytes = stats.bfree * stats.bsize;
+      const usedBytes = totalBytes - freeBytes;
+      return {
+        totalGb: Math.round(totalBytes / 1073741824 * 100) / 100,
+        usedGb: Math.round(usedBytes / 1073741824 * 100) / 100,
+        percent: totalBytes > 0 ? Math.round(usedBytes / totalBytes * 1e4) / 100 : 0
+      };
+    }
+    if (import_os.default.platform() !== "win32") {
+      const { execSync } = require("child_process");
+      const output = execSync("df -k / 2>/dev/null", { timeout: 3e3, encoding: "utf-8" });
+      const lines = output.trim().split("\n");
+      if (lines.length >= 2) {
+        const parts = lines[1].split(/\s+/);
+        const totalKb = parseInt(parts[1]) || 0;
+        const usedKb = parseInt(parts[2]) || 0;
+        return {
+          totalGb: Math.round(totalKb / 1048576 * 100) / 100,
+          usedGb: Math.round(usedKb / 1048576 * 100) / 100,
+          percent: totalKb > 0 ? Math.round(usedKb / totalKb * 1e4) / 100 : 0
+        };
+      }
+    }
+    return { usedGb: 0, totalGb: 0, percent: 0 };
+  } catch {
+    return { usedGb: 0, totalGb: 0, percent: 0 };
+  }
+}
+function getLinuxOsInfo() {
+  try {
+    const content = (0, import_fs.readFileSync)("/etc/os-release", "utf-8");
+    const lines = content.split("\n");
+    let name = "Linux";
+    let version = "";
+    for (const line of lines) {
+      if (line.startsWith("NAME=")) {
+        name = line.split("=")[1]?.replace(/"/g, "") || "Linux";
+      }
+      if (line.startsWith("VERSION_ID=")) {
+        version = line.split("=")[1]?.replace(/"/g, "") || "";
+      }
+    }
+    return { name, version };
+  } catch {
+    return { name: "Linux", version: "" };
+  }
+}
+function getOsInfo() {
+  const platform = import_os.default.platform();
+  if (platform === "linux") {
+    return getLinuxOsInfo();
+  }
+  if (platform === "darwin") {
+    return { name: "macOS", version: import_os.default.release() };
+  }
+  if (platform === "win32") {
+    return { name: "Windows", version: import_os.default.release() };
+  }
+  return { name: platform, version: import_os.default.release() };
+}
+var prevCpuTimes = null;
+function getCpuPercent() {
+  const cpus = import_os.default.cpus();
+  let idle = 0;
+  let total = 0;
+  for (const cpu of cpus) {
+    idle += cpu.times.idle;
+    total += cpu.times.user + cpu.times.nice + cpu.times.sys + cpu.times.idle + cpu.times.irq;
+  }
+  if (!prevCpuTimes) {
+    prevCpuTimes = { idle, total };
+    return 0;
+  }
+  const idleDiff = idle - prevCpuTimes.idle;
+  const totalDiff = total - prevCpuTimes.total;
+  prevCpuTimes = { idle, total };
+  if (totalDiff === 0) return 0;
+  return Math.round((1 - idleDiff / totalDiff) * 1e4) / 100;
+}
+function collectSystemMetrics() {
+  try {
+    const mem = process.memoryUsage();
+    const totalMem = import_os.default.totalmem();
+    const freeMem = import_os.default.freemem();
+    const loadAvg = import_os.default.loadavg();
+    const osInfo = getOsInfo();
+    const disk = getDiskUsage();
+    return {
+      cpuPercent: getCpuPercent(),
+      cpuCount: import_os.default.cpus().length,
+      memUsedMb: Math.round((totalMem - freeMem) / 1048576),
+      memTotalMb: Math.round(totalMem / 1048576),
+      memPercent: Math.round((totalMem - freeMem) / totalMem * 1e4) / 100,
+      heapUsedMb: Math.round(mem.heapUsed / 1048576),
+      heapTotalMb: Math.round(mem.heapTotal / 1048576),
+      externalMb: Math.round(mem.external / 1048576),
+      rss: Math.round(mem.rss / 1048576),
+      uptimeSeconds: Math.round(process.uptime()),
+      loadAvg,
+      platform: import_os.default.platform(),
+      nodeVersion: process.version,
+      pid: process.pid,
+      osName: osInfo.name,
+      osVersion: osInfo.version,
+      osKernel: import_os.default.release(),
+      osArch: import_os.default.arch(),
+      osRelease: (() => {
+        try {
+          return import_os.default.version();
+        } catch {
+          return import_os.default.release();
+        }
+      })(),
+      diskUsedGb: disk.usedGb,
+      diskTotalGb: disk.totalGb,
+      diskPercent: disk.percent,
+      // Network
+      publicIp: getPublicIpCached(),
+      privateIp: getPrivateIp(),
+      hostname: import_os.default.hostname(),
+      // Process details
+      ppid: process.ppid || 0,
+      uid: process.getuid?.() ?? null,
+      cwd: process.cwd(),
+      execPath: process.execPath,
+      nodeArgs: process.execArgv.join(" ")
+    };
+  } catch {
+    return {
+      cpuPercent: 0,
+      cpuCount: 0,
+      memUsedMb: 0,
+      memTotalMb: 0,
+      memPercent: 0,
+      heapUsedMb: 0,
+      heapTotalMb: 0,
+      externalMb: 0,
+      rss: 0,
+      uptimeSeconds: 0,
+      loadAvg: [0, 0, 0],
+      platform: process.platform || "unknown",
+      nodeVersion: process.version || "unknown",
+      pid: process.pid || 0,
+      osName: "unknown",
+      osVersion: "",
+      osKernel: "",
+      osArch: "",
+      osRelease: "",
+      diskUsedGb: 0,
+      diskTotalGb: 0,
+      diskPercent: 0,
+      publicIp: "",
+      privateIp: "",
+      hostname: "",
+      ppid: 0,
+      uid: null,
+      cwd: "",
+      execPath: "",
+      nodeArgs: ""
+    };
+  }
+}
+
+// src/collectors/http.ts
+var HttpCollector = class {
+  constructor() {
+    this.records = [];
+    this.windowStart = Date.now();
+  }
+  record(req) {
+    try {
+      if (this.records.length >= 1e4) {
+        this.records.splice(0, 1e3);
+      }
+      this.records.push({ ...req, timestamp: Date.now() });
+    } catch {
+    }
+  }
+  flush() {
+    try {
+      return this._flush();
+    } catch {
+      this.records = [];
+      return null;
+    }
+  }
+  _flush() {
+    if (this.records.length === 0) return null;
+    const records = this.records;
+    this.records = [];
+    const windowMs = Date.now() - this.windowStart;
+    this.windowStart = Date.now();
+    const durations = records.map((r) => r.durationMs).sort((a, b) => a - b);
+    const statusCodes = {};
+    const pathMap = /* @__PURE__ */ new Map();
+    for (const r of records) {
+      const key = `${r.statusCode}`;
+      statusCodes[key] = (statusCodes[key] || 0) + 1;
+      const pathKey = `${r.method}:${r.path}`;
+      if (!pathMap.has(pathKey)) pathMap.set(pathKey, []);
+      pathMap.get(pathKey).push(r);
+    }
+    const topPaths = [...pathMap.entries()].map(([key, recs]) => {
+      const [method, path] = key.split(":", 2);
+      const pathDurations = recs.map((r) => r.durationMs).sort((a, b) => a - b);
+      return {
+        path,
+        method,
+        count: recs.length,
+        avgMs: Math.round(pathDurations.reduce((a, b) => a + b, 0) / recs.length),
+        p95Ms: percentile(pathDurations, 95),
+        errorCount: recs.filter((r) => r.statusCode >= 400).length
+      };
+    }).sort((a, b) => b.count - a.count).slice(0, 20);
+    return {
+      totalRequests: records.length,
+      totalErrors: records.filter((r) => r.statusCode >= 500).length,
+      avgResponseMs: Math.round(durations.reduce((a, b) => a + b, 0) / durations.length),
+      p50ResponseMs: percentile(durations, 50),
+      p95ResponseMs: percentile(durations, 95),
+      p99ResponseMs: percentile(durations, 99),
+      maxResponseMs: durations[durations.length - 1] || 0,
+      statusCodes,
+      topPaths,
+      requestsPerSecond: Math.round(records.length / (windowMs / 1e3) * 100) / 100
+    };
+  }
+};
+function percentile(sorted, p) {
+  if (sorted.length === 0) return 0;
+  const idx = Math.ceil(p / 100 * sorted.length) - 1;
+  return sorted[Math.max(0, idx)];
+}
+
+// src/collectors/errors.ts
+var ErrorCollector = class {
+  constructor(maxBuffer) {
+    this.buffer = [];
+    this.maxBuffer = maxBuffer;
+  }
+  capture(error, meta) {
+    try {
+      if (this.buffer.length >= this.maxBuffer) {
+        this.buffer.shift();
+      }
+      const err = typeof error === "string" ? new Error(error) : error;
+      const message = (err.message || "").slice(0, 4096);
+      const stack = err.stack ? err.stack.slice(0, 4096) : void 0;
+      this.buffer.push({
+        message,
+        stack,
+        type: err.constructor.name || "Error",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        url: meta?.url ? String(meta.url).slice(0, 2048) : void 0,
+        method: meta?.method ? String(meta.method).slice(0, 10) : void 0,
+        statusCode: meta?.statusCode,
+        meta: meta ? Object.fromEntries(
+          Object.entries(meta).filter(([k]) => !["url", "method", "statusCode"].includes(k))
+        ) : void 0
+      });
+    } catch {
+    }
+  }
+  flush() {
+    const errors = this.buffer;
+    this.buffer = [];
+    return errors;
+  }
+  get size() {
+    return this.buffer.length;
+  }
+};
+
+// src/collectors/security.ts
+var SQL_INJECTION_PATTERNS = [
+  /(\b(union|select|insert|update|delete|drop|alter|create|exec|execute)\b.*\b(from|into|table|database|where)\b)/i,
+  /(--|;|\/\*|\*\/|xp_|sp_|0x[0-9a-f]+)/i,
+  /('|\"|`).*(\bor\b|\band\b).*('|\"|`).*=/i,
+  /(\bwaitfor\b\s+\bdelay\b|\bsleep\b\s*\(|\bbenchmark\b\s*\()/i
+];
+var XSS_PATTERNS = [
+  /<script[\s>]/i,
+  /javascript\s*:/i,
+  /on(load|error|click|mouseover|focus|blur|submit|change|input)\s*=/i,
+  /<(iframe|object|embed|form|img)\b[^>]*(src|data|action)\s*=\s*['"]/i,
+  /\beval\s*\(/i,
+  /\bdocument\.(cookie|location|write)/i
+];
+var CMD_INJECTION_PATTERNS = [
+  /[;&|`$]\s*(cat|ls|rm|mv|cp|wget|curl|nc|bash|sh|python|perl|ruby|node)\b/i,
+  /\$\(.*\)/,
+  /`[^`]*`/,
+  /\|\|\s*\w+/,
+  /&&\s*(rm|cat|wget|curl)/i
+];
+var PATH_TRAVERSAL_PATTERNS = [
+  /\.\.\//,
+  /\.\.\\/,
+  /%2e%2e/i,
+  /%252e%252e/i,
+  /\.\.\%00/
+];
+var SUSPICIOUS_PATHS = [
+  /\/(wp-admin|wp-login|xmlrpc|wp-content|wp-includes)\b/i,
+  /\/(phpmyadmin|adminer|phpinfo|server-status|server-info)\b/i,
+  /\.(env|git|svn|htaccess|htpasswd|bak|sql|dump|log|ini|cfg|conf)$/i,
+  /\/(\.git|\.svn|\.env|\.aws|\.ssh|\.docker)\b/,
+  /\/(config|backup|admin|debug|console|shell|cmd)\b/i,
+  /\/(actuator|swagger|api-docs|graphiql)\b/i
+];
+var BOT_USER_AGENTS = [
+  /sqlmap/i,
+  /nikto/i,
+  /nmap/i,
+  /masscan/i,
+  /zap\//i,
+  /burp/i,
+  /dirbuster/i,
+  /gobuster/i,
+  /wfuzz/i,
+  /hydra/i,
+  /metasploit/i,
+  /nessus/i,
+  /openvas/i,
+  /acunetix/i,
+  /qualys/i,
+  /nuclei/i,
+  /whatweb/i,
+  /wpscan/i,
+  /joomscan/i,
+  /skipfish/i
+];
+var SENSITIVE_DATA_PATTERNS = [
+  // API keys / tokens
+  /(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token|secret[_-]?key)\s*[=:]\s*['"][a-zA-Z0-9_\-]{20,}/i,
+  // AWS keys
+  /AKIA[0-9A-Z]{16}/,
+  // Private keys
+  /-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----/,
+  // JWT tokens
+  /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/,
+  // Passwords in URLs
+  /[?&](password|passwd|pwd|secret|token)=[^&\s]{3,}/i
+];
+var SecurityCollector = class {
+  constructor(maxBuffer) {
+    this.events = [];
+    this.ipCounter = /* @__PURE__ */ new Map();
+    this.maxBuffer = maxBuffer;
+  }
+  /** Record a security event directly */
+  record(event) {
+    if (this.events.length >= this.maxBuffer) {
+      this.events.shift();
+    }
+    this.events.push({ ...event, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
+    if (event.ip) this.trackIp(event.ip, event.type);
+  }
+  /** Analyze an incoming HTTP request for security threats */
+  analyzeRequest(req) {
+    try {
+      this._analyzeRequest(req);
+    } catch {
+    }
+  }
+  _analyzeRequest(req) {
+    const ip = req.ip || "unknown";
+    const ua = (typeof req.headers["user-agent"] === "string" ? req.headers["user-agent"] : "") || "";
+    const url = req.url;
+    const fullInput = `${url} ${req.body || ""} ${JSON.stringify(req.query || {})}`;
+    for (const pattern of PATH_TRAVERSAL_PATTERNS) {
+      if (pattern.test(url)) {
+        this.record({
+          type: "suspicious_path",
+          severity: "high",
+          message: `Path traversal attempt: ${url.slice(0, 200)}`,
+          ip,
+          userAgent: ua,
+          url,
+          method: req.method
+        });
+        break;
+      }
+    }
+    for (const pattern of SUSPICIOUS_PATHS) {
+      if (pattern.test(url)) {
+        this.record({
+          type: "suspicious_path",
+          severity: "medium",
+          message: `Suspicious path access: ${url.slice(0, 200)}`,
+          ip,
+          userAgent: ua,
+          url,
+          method: req.method
+        });
+        break;
+      }
+    }
+    for (const pattern of SQL_INJECTION_PATTERNS) {
+      if (pattern.test(fullInput)) {
+        this.record({
+          type: "sql_injection",
+          severity: "critical",
+          message: `SQL injection pattern detected in request`,
+          ip,
+          userAgent: ua,
+          url,
+          method: req.method,
+          payload: fullInput.slice(0, 500)
+        });
+        break;
+      }
+    }
+    for (const pattern of XSS_PATTERNS) {
+      if (pattern.test(fullInput)) {
+        this.record({
+          type: "xss_attempt",
+          severity: "high",
+          message: `XSS payload detected in request`,
+          ip,
+          userAgent: ua,
+          url,
+          method: req.method,
+          payload: fullInput.slice(0, 500)
+        });
+        break;
+      }
+    }
+    for (const pattern of CMD_INJECTION_PATTERNS) {
+      if (pattern.test(fullInput)) {
+        this.record({
+          type: "command_injection",
+          severity: "critical",
+          message: `Command injection pattern detected`,
+          ip,
+          userAgent: ua,
+          url,
+          method: req.method,
+          payload: fullInput.slice(0, 500)
+        });
+        break;
+      }
+    }
+    for (const pattern of BOT_USER_AGENTS) {
+      if (pattern.test(ua)) {
+        this.record({
+          type: "bot_detected",
+          severity: "medium",
+          message: `Security scanner/bot detected: ${ua.slice(0, 100)}`,
+          ip,
+          userAgent: ua,
+          url,
+          method: req.method
+        });
+        break;
+      }
+    }
+    const contentLength = parseInt(String(req.headers["content-length"] || "0"), 10);
+    if (contentLength > 10 * 1024 * 1024) {
+      this.record({
+        type: "oversized_payload",
+        severity: "medium",
+        message: `Oversized request: ${(contentLength / 1024 / 1024).toFixed(1)}MB`,
+        ip,
+        userAgent: ua,
+        url,
+        method: req.method
+      });
+    }
+    for (const pattern of SENSITIVE_DATA_PATTERNS) {
+      if (pattern.test(url)) {
+        this.record({
+          type: "api_key_exposed",
+          severity: "critical",
+          message: `Sensitive data exposed in URL`,
+          ip,
+          url: url.slice(0, 100) + "...[REDACTED]",
+          method: req.method
+        });
+        break;
+      }
+    }
+    this.checkBruteForce(ip);
+  }
+  /** Analyze response for sensitive data leaks */
+  analyzeResponse(data) {
+    try {
+      if (!data.body) return;
+      const contentType = data.headers?.["content-type"] || "";
+      if (!contentType.includes("json") && !contentType.includes("html") && !contentType.includes("text")) return;
+      const sample = data.body.slice(0, 10240);
+      for (const pattern of SENSITIVE_DATA_PATTERNS) {
+        if (pattern.test(sample)) {
+          this.record({
+            type: "sensitive_data_exposed",
+            severity: "critical",
+            message: `Sensitive data detected in response body for ${data.url}`,
+            url: data.url,
+            meta: { statusCode: data.statusCode }
+          });
+          break;
+        }
+      }
+    } catch {
+    }
+  }
+  /** Record an authentication failure */
+  recordAuthFailure(data) {
+    this.record({
+      type: "auth_failure",
+      severity: "medium",
+      message: `Authentication failed${data.reason ? `: ${data.reason}` : ""}`,
+      ...data
+    });
+  }
+  /** Record a rate limit event */
+  recordRateLimit(data) {
+    this.record({
+      type: "rate_limit_hit",
+      severity: "low",
+      message: `Rate limit triggered${data.limit ? ` (limit: ${data.limit})` : ""}`,
+      ...data
+    });
+  }
+  /** Record a CORS violation */
+  recordCorsViolation(data) {
+    this.record({
+      type: "cors_violation",
+      severity: "medium",
+      message: `CORS policy blocked request from origin: ${data.origin || "unknown"}`,
+      ...data
+    });
+  }
+  /** Record a custom security event */
+  recordCustom(type, severity, message, meta) {
+    this.record({ type, severity, message, meta });
+  }
+  /** Flush and return aggregated security metrics */
+  flush() {
+    try {
+      if (this.events.length === 0 && this.ipCounter.size === 0) return null;
+      const events = this.events;
+      this.events = [];
+      const bySeverity = {
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0,
+        info: 0
+      };
+      const byType = {};
+      for (const e of events) {
+        bySeverity[e.severity]++;
+        byType[e.type] = (byType[e.type] || 0) + 1;
+      }
+      const topOffendingIps = [...this.ipCounter.entries()].map(([ip, data]) => ({ ip, count: data.count, types: [...data.types] })).sort((a, b) => b.count - a.count).slice(0, 10);
+      const cutoff = Date.now() - 36e5;
+      for (const [ip, data] of this.ipCounter.entries()) {
+        if (data.firstSeen < cutoff) this.ipCounter.delete(ip);
+      }
+      return {
+        totalEvents: events.length,
+        bySeverity,
+        byType,
+        topOffendingIps,
+        events: events.slice(-50)
+        // Send last 50 events per report
+      };
+    } catch {
+      this.events = [];
+      return null;
+    }
+  }
+  trackIp(ip, type) {
+    const entry = this.ipCounter.get(ip);
+    if (entry) {
+      entry.count++;
+      entry.types.add(type);
+    } else {
+      this.ipCounter.set(ip, { count: 1, types: /* @__PURE__ */ new Set([type]), firstSeen: Date.now() });
+    }
+  }
+  checkBruteForce(ip) {
+    const entry = this.ipCounter.get(ip);
+    if (!entry) return;
+    if (entry.count === 50) {
+      this.record({
+        type: "auth_brute_force",
+        severity: "critical",
+        message: `Possible brute-force/scan from IP: ${ip} (${entry.count} events)`,
+        ip
+      });
+    }
+  }
+};
+
+// src/collectors/dep-audit.ts
+var import_child_process = require("child_process");
+var import_promises = require("fs/promises");
+var import_path = require("path");
+var DepAuditCollector = class {
+  constructor(auditIntervalMs, logger) {
+    this.lastResult = null;
+    this.lastAuditTime = 0;
+    this.auditing = false;
+    this.auditIntervalMs = auditIntervalMs;
+    this.logger = logger;
+  }
+  /** Run npm audit and parse results */
+  async collect() {
+    if (Date.now() - this.lastAuditTime < this.auditIntervalMs) {
+      return this.lastResult;
+    }
+    if (this.auditing) return this.lastResult;
+    this.auditing = true;
+    try {
+      const [auditResult, pkgInfo] = await Promise.all([
+        this.runNpmAudit(),
+        this.readPackageInfo()
+      ]);
+      this.lastResult = {
+        totalDeps: pkgInfo.totalDeps,
+        totalVulnerabilities: auditResult.vulnerabilities.length,
+        bySeverity: auditResult.bySeverity,
+        vulnerabilities: auditResult.vulnerabilities.slice(0, 50),
+        // Top 50
+        outdatedCount: pkgInfo.outdatedCount,
+        lastAuditAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      this.lastAuditTime = Date.now();
+      this.logger.info(`Dep audit: ${this.lastResult.totalVulnerabilities} vulnerabilities found`);
+      return this.lastResult;
+    } catch (err) {
+      this.logger.error("Dep audit failed:", err instanceof Error ? err.message : err);
+      return this.lastResult;
+    } finally {
+      this.auditing = false;
+    }
+  }
+  runNpmAudit() {
+    return new Promise((resolve) => {
+      (0, import_child_process.execFile)("npm", ["audit", "--json"], { timeout: 3e4, maxBuffer: 5 * 1024 * 1024 }, (err, stdout) => {
+        try {
+          const data = JSON.parse(stdout || "{}");
+          const vulnerabilities = [];
+          const bySeverity = { critical: 0, high: 0, moderate: 0, low: 0 };
+          if (data.vulnerabilities) {
+            for (const [name, vuln] of Object.entries(data.vulnerabilities)) {
+              const severity = vuln.severity || "low";
+              bySeverity[severity] = (bySeverity[severity] || 0) + 1;
+              vulnerabilities.push({
+                package: name,
+                installedVersion: vuln.range || "unknown",
+                severity,
+                title: vuln.title || vuln.name || name,
+                url: vuln.url,
+                patchedVersions: vuln.fixAvailable?.version,
+                cwe: vuln.cwe ? Array.isArray(vuln.cwe) ? vuln.cwe : [vuln.cwe] : void 0
+              });
+            }
+          }
+          const severityOrder = { critical: 0, high: 1, moderate: 2, low: 3 };
+          vulnerabilities.sort(
+            (a, b) => (severityOrder[a.severity] ?? 4) - (severityOrder[b.severity] ?? 4)
+          );
+          resolve({ vulnerabilities, bySeverity });
+        } catch {
+          resolve({ vulnerabilities: [], bySeverity: {} });
+        }
+      });
+    });
+  }
+  async readPackageInfo() {
+    try {
+      const lockPath = (0, import_path.join)(process.cwd(), "package-lock.json");
+      const content = await (0, import_promises.readFile)(lockPath, "utf-8");
+      const lock = JSON.parse(content);
+      const packages = lock.packages || {};
+      const totalDeps = Object.keys(packages).filter((k) => k !== "").length;
+      return { totalDeps, outdatedCount: 0 };
+    } catch {
+      try {
+        const pkgPath = (0, import_path.join)(process.cwd(), "package.json");
+        const content = await (0, import_promises.readFile)(pkgPath, "utf-8");
+        const pkg = JSON.parse(content);
+        const deps = Object.keys(pkg.dependencies || {}).length;
+        const devDeps = Object.keys(pkg.devDependencies || {}).length;
+        return { totalDeps: deps + devDeps, outdatedCount: 0 };
+      } catch {
+        return { totalDeps: 0, outdatedCount: 0 };
+      }
+    }
+  }
+};
+
+// src/collectors/runtime.ts
+var import_v8 = __toESM(require("v8"));
+var lastLagCheck = process.hrtime.bigint();
+var lagSamples = [];
+function startLagSampling() {
+  const interval = setInterval(() => {
+    const now = process.hrtime.bigint();
+    const expectedMs = 100;
+    const actualMs = Number(now - lastLagCheck) / 1e6;
+    const lag = Math.max(0, actualMs - expectedMs);
+    lagSamples.push(lag);
+    if (lagSamples.length > 600) lagSamples.shift();
+    lastLagCheck = now;
+  }, 100);
+  interval.unref();
+  return interval;
+}
+function collectRuntimeMetrics() {
+  try {
+    const heapSpaces = import_v8.default.getHeapSpaceStatistics();
+    const sortedLag = [...lagSamples].sort((a, b) => a - b);
+    const avgLag = sortedLag.length > 0 ? sortedLag.reduce((a, b) => a + b, 0) / sortedLag.length : 0;
+    const p99Lag = sortedLag.length > 0 ? sortedLag[Math.ceil(sortedLag.length * 0.99) - 1] : 0;
+    lagSamples = [];
+    let activeHandles = 0;
+    let activeRequests = 0;
+    try {
+      activeHandles = process._getActiveHandles?.()?.length ?? 0;
+      activeRequests = process._getActiveRequests?.()?.length ?? 0;
+    } catch {
+    }
+    let gcPausesMsTotal = 0;
+    let gcPausesCount = 0;
+    try {
+      const { performance: performance2 } = require("perf_hooks");
+      const entries = performance2.getEntriesByType("gc");
+      for (const entry of entries) {
+        gcPausesMsTotal += entry.duration;
+        gcPausesCount++;
+      }
+      performance2.clearMarks();
+    } catch {
+    }
+    const heapSpaceInfos = heapSpaces.map((space) => ({
+      name: space.space_name,
+      sizeMb: Math.round(space.space_size / 1048576 * 100) / 100,
+      usedMb: Math.round(space.space_used_size / 1048576 * 100) / 100,
+      availableMb: Math.round(space.space_available_size / 1048576 * 100) / 100
+    }));
+    return {
+      eventLoopLagMs: Math.round(avgLag * 100) / 100,
+      eventLoopLagP99Ms: Math.round(p99Lag * 100) / 100,
+      activeHandles,
+      activeRequests,
+      gcPausesMsTotal: Math.round(gcPausesMsTotal * 100) / 100,
+      gcPausesCount,
+      heapSpaces: heapSpaceInfos
+    };
+  } catch {
+    lagSamples = [];
+    return {
+      eventLoopLagMs: 0,
+      eventLoopLagP99Ms: 0,
+      activeHandles: 0,
+      activeRequests: 0,
+      gcPausesMsTotal: 0,
+      gcPausesCount: 0,
+      heapSpaces: []
+    };
+  }
+}
+
+// src/collectors/env-security.ts
+var import_promises2 = require("fs/promises");
+var import_path2 = require("path");
+var import_child_process2 = require("child_process");
+var SENSITIVE_ENV_PATTERNS = [
+  /^(DATABASE_URL|DB_PASSWORD|DB_HOST)/i,
+  /^(AWS_SECRET|AWS_ACCESS_KEY|AWS_SESSION_TOKEN)/i,
+  /^(STRIPE_SECRET|PAYPAL_SECRET)/i,
+  /^(PRIVATE_KEY|SECRET_KEY|ENCRYPTION_KEY|JWT_SECRET)/i,
+  /^(SMTP_PASSWORD|MAIL_PASSWORD|EMAIL_PASSWORD)/i,
+  /^(GITHUB_TOKEN|GITLAB_TOKEN|NPM_TOKEN)/i,
+  /^(REDIS_PASSWORD|REDIS_URL)/i,
+  /^(SENTRY_DSN)/i,
+  /^(TWILIO_AUTH_TOKEN|SENDGRID_API_KEY)/i
+];
+var EOL_NODE_MAJOR = [0, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 19, 21];
+var RECOMMENDED_HEADERS = [
+  { header: "strict-transport-security", recommendation: "Add HSTS header: max-age=31536000; includeSubDomains" },
+  { header: "x-content-type-options", recommendation: "Set to 'nosniff' to prevent MIME sniffing" },
+  { header: "x-frame-options", recommendation: "Set to 'DENY' or 'SAMEORIGIN' to prevent clickjacking" },
+  { header: "x-xss-protection", recommendation: "Set to '0' (let CSP handle it) or '1; mode=block'" },
+  { header: "content-security-policy", recommendation: "Add CSP header to prevent XSS and data injection" },
+  { header: "referrer-policy", recommendation: "Set to 'strict-origin-when-cross-origin'" },
+  { header: "permissions-policy", recommendation: "Restrict browser features: camera, microphone, geolocation" },
+  { header: "x-dns-prefetch-control", recommendation: "Set to 'off' for security-sensitive apps" },
+  { header: "cross-origin-opener-policy", recommendation: "Set to 'same-origin' for cross-origin isolation" },
+  { header: "cross-origin-resource-policy", recommendation: "Set to 'same-origin' or 'cross-origin' as needed" }
+];
+function getMemoryLimit() {
+  try {
+    for (const arg of process.execArgv) {
+      const match = arg.match(/--max-old-space-size=(\d+)/);
+      if (match) return parseInt(match[1]);
+    }
+    const v82 = require("v8");
+    const heapStats = v82.getHeapStatistics();
+    return Math.round(heapStats.heap_size_limit / 1048576);
+  } catch {
+    return null;
+  }
+}
+function getDnsServers() {
+  try {
+    const dns = require("dns");
+    return dns.getServers?.() || [];
+  } catch {
+    return [];
+  }
+}
+var EnvSecurityCollector = class {
+  constructor() {
+    this.cachedReport = null;
+    this.lastCheck = 0;
+  }
+  /** Collect environment security report (cached for 5 minutes) */
+  async collect() {
+    if (this.cachedReport && Date.now() - this.lastCheck < 3e5) {
+      return this.cachedReport;
+    }
+    const nodeVersion = process.version;
+    const nodeMajor = parseInt(nodeVersion.replace("v", ""), 10);
+    const nodeVersionSecure = !EOL_NODE_MAJOR.includes(nodeMajor);
+    const envVarWarnings = this.checkEnvVars();
+    const debugModeEnabled = this.checkDebugMode();
+    const sourceMapExposed = await this.checkSourceMaps();
+    const frameworkInfo = await this.detectFramework();
+    const npmVersion = await this.getNpmVersion();
+    this.cachedReport = {
+      nodeVersion,
+      nodeVersionSecure,
+      npmVersion,
+      frameworkName: frameworkInfo.name,
+      frameworkVersion: frameworkInfo.version,
+      securityHeaders: [],
+      // Populated by response analysis
+      envVarWarnings,
+      debugModeEnabled,
+      sourceMapExposed,
+      // Runtime details
+      v8Version: process.versions.v8 || "",
+      uvVersion: process.versions.uv || "",
+      opensslVersion: process.versions.openssl || "",
+      zlibVersion: process.versions.zlib || "",
+      icuVersion: process.versions.icu || "",
+      // Process config
+      nodeEnv: process.env.NODE_ENV || "",
+      tz: process.env.TZ || Intl.DateTimeFormat().resolvedOptions().timeZone || "",
+      memoryLimitMb: getMemoryLimit(),
+      // Server info (detect from env/process)
+      port: parseInt(process.env.PORT || "0") || null,
+      host: process.env.HOST || process.env.HOSTNAME || "",
+      // DNS
+      dnsServers: getDnsServers()
+    };
+    this.lastCheck = Date.now();
+    return this.cachedReport;
+  }
+  /** Check response headers against security recommendations */
+  checkResponseHeaders(headers) {
+    const normalizedHeaders = {};
+    for (const [key, val] of Object.entries(headers)) {
+      normalizedHeaders[key.toLowerCase()] = Array.isArray(val) ? val.join(", ") : val || "";
+    }
+    return RECOMMENDED_HEADERS.map(({ header, recommendation }) => ({
+      header,
+      present: header in normalizedHeaders,
+      value: normalizedHeaders[header],
+      recommendation: header in normalizedHeaders ? void 0 : recommendation
+    }));
+  }
+  checkEnvVars() {
+    const warnings = [];
+    const envKeys = Object.keys(process.env);
+    for (const key of envKeys) {
+      for (const pattern of SENSITIVE_ENV_PATTERNS) {
+        if (pattern.test(key)) {
+          warnings.push(`Sensitive env var '${key}' is set \u2014 ensure it's not exposed to client`);
+          break;
+        }
+      }
+    }
+    if (process.getuid && process.getuid() === 0) {
+      warnings.push("Process is running as root \u2014 use a non-privileged user");
+    }
+    if (!process.env.NODE_ENV || process.env.NODE_ENV === "development") {
+      warnings.push("NODE_ENV is not set to 'production' \u2014 ensure proper security config");
+    }
+    return warnings;
+  }
+  checkDebugMode() {
+    return !!(process.env.DEBUG || process.env.NODE_DEBUG || process.execArgv.some((arg) => arg.includes("--inspect") || arg.includes("--debug")));
+  }
+  async checkSourceMaps() {
+    const paths = [
+      (0, import_path2.join)(process.cwd(), ".next", "static"),
+      (0, import_path2.join)(process.cwd(), "dist"),
+      (0, import_path2.join)(process.cwd(), "build")
+    ];
+    for (const dir of paths) {
+      try {
+        await (0, import_promises2.access)(dir);
+        return process.env.NODE_ENV === "production" && !!process.env.GENERATE_SOURCEMAP;
+      } catch {
+        continue;
+      }
+    }
+    return false;
+  }
+  async detectFramework() {
+    try {
+      const pkgPath = (0, import_path2.join)(process.cwd(), "package.json");
+      const content = await (0, import_promises2.readFile)(pkgPath, "utf-8");
+      const pkg = JSON.parse(content);
+      const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+      if (allDeps.next) return { name: "next", version: allDeps.next };
+      if (allDeps.nuxt) return { name: "nuxt", version: allDeps.nuxt };
+      if (allDeps.express) return { name: "express", version: allDeps.express };
+      if (allDeps.fastify) return { name: "fastify", version: allDeps.fastify };
+      if (allDeps.koa) return { name: "koa", version: allDeps.koa };
+      if (allDeps.hono) return { name: "hono", version: allDeps.hono };
+      if (allDeps["@nestjs/core"]) return { name: "nestjs", version: allDeps["@nestjs/core"] };
+      if (allDeps.remix || allDeps["@remix-run/node"]) return { name: "remix", version: allDeps["@remix-run/node"] || allDeps.remix };
+      if (allDeps.astro) return { name: "astro", version: allDeps.astro };
+      if (allDeps["@sveltejs/kit"]) return { name: "sveltekit", version: allDeps["@sveltejs/kit"] };
+      if (allDeps.svelte) return { name: "svelte", version: allDeps.svelte };
+      if (allDeps["@adonisjs/core"]) return { name: "adonisjs", version: allDeps["@adonisjs/core"] };
+      if (allDeps.meteor) return { name: "meteor", version: allDeps.meteor };
+      if (allDeps.strapi) return { name: "strapi", version: allDeps.strapi };
+      if (allDeps.keystone) return { name: "keystonejs", version: allDeps.keystone };
+      if (allDeps.payload) return { name: "payload", version: allDeps.payload };
+      return {};
+    } catch {
+      return {};
+    }
+  }
+  getNpmVersion() {
+    return new Promise((resolve) => {
+      (0, import_child_process2.execFile)("npm", ["--version"], { timeout: 5e3 }, (err, stdout) => {
+        resolve(err ? void 0 : stdout.trim());
+      });
+    });
+  }
+};
+
+// src/reporter.ts
+var import_http = __toESM(require("http"));
+var import_https = __toESM(require("https"));
+var import_url = require("url");
+var MAX_PAYLOAD_BYTES = 512 * 1024;
+var MAX_STRING_LENGTH = 4096;
+var MAX_ARRAY_LENGTH = 200;
+function maskApiKey(key) {
+  if (key.length <= 6) return "***";
+  return key.slice(0, 6) + "***";
+}
+function truncStr(s, maxLen) {
+  if (s == null) return s;
+  return s.length > maxLen ? s.slice(0, maxLen) + "...[truncated]" : s;
+}
+function boundArray(arr, maxLen) {
+  if (!arr) return arr;
+  return arr.length > maxLen ? arr.slice(0, maxLen) : arr;
+}
+function sanitizePayload(payload) {
+  const p = { ...payload };
+  if (p.errors) {
+    p.errors = boundArray(p.errors, MAX_ARRAY_LENGTH);
+    for (let i = 0; i < p.errors.length; i++) {
+      const e = { ...p.errors[i] };
+      e.message = truncStr(e.message, MAX_STRING_LENGTH) || "";
+      e.stack = truncStr(e.stack, MAX_STRING_LENGTH);
+      p.errors[i] = e;
+    }
+  }
+  if (p.security) {
+    p.security = { ...p.security };
+    p.security.events = boundArray(p.security.events, 50) || [];
+    for (let i = 0; i < p.security.events.length; i++) {
+      const ev = { ...p.security.events[i] };
+      ev.message = truncStr(ev.message, MAX_STRING_LENGTH) || "";
+      ev.payload = truncStr(ev.payload, 500);
+      p.security.events[i] = ev;
+    }
+    p.security.topOffendingIps = boundArray(p.security.topOffendingIps, 10) || [];
+  }
+  if (p.depAudit) {
+    p.depAudit = { ...p.depAudit };
+    p.depAudit.vulnerabilities = boundArray(p.depAudit.vulnerabilities, 50) || [];
+  }
+  if (p.http) {
+    p.http = { ...p.http };
+    p.http.topPaths = boundArray(p.http.topPaths, 20) || [];
+  }
+  if (p.runtime) {
+    p.runtime = { ...p.runtime };
+    p.runtime.heapSpaces = boundArray(p.runtime.heapSpaces, 20);
+  }
+  if (p.envSecurity) {
+    p.envSecurity = { ...p.envSecurity };
+    p.envSecurity.envVarWarnings = boundArray(p.envSecurity.envVarWarnings, 50) || [];
+    p.envSecurity.securityHeaders = boundArray(p.envSecurity.securityHeaders, 20) || [];
+  }
+  return p;
+}
+var Reporter = class {
+  constructor(apiUrl, apiKey, logger) {
+    this.queue = [];
+    this.sending = false;
+    this.apiUrl = apiUrl.replace(/\/$/, "");
+    this.apiKey = apiKey;
+    this.logger = logger;
+  }
+  async send(payload) {
+    try {
+      this.queue.push(payload);
+      if (this.sending) return true;
+      this.sending = true;
+      try {
+        while (this.queue.length > 0) {
+          const batch = this.queue.splice(0, 10);
+          await this.transmit(batch);
+        }
+        return true;
+      } finally {
+        this.sending = false;
+      }
+    } catch (err) {
+      this.logger.error(
+        `Failed to send report (key=${maskApiKey(this.apiKey)}):`,
+        err instanceof Error ? err.message : err
+      );
+      return false;
+    }
+  }
+  async transmit(payloads) {
+    const url = `${this.apiUrl}/api/tracker/report`;
+    const sanitized = payloads.map(sanitizePayload);
+    let body = JSON.stringify(sanitized.length === 1 ? sanitized[0] : { batch: sanitized });
+    if (body.length > MAX_PAYLOAD_BYTES) {
+      this.logger.warn(
+        `Payload too large (${body.length} bytes), truncating arrays (key=${maskApiKey(this.apiKey)})`
+      );
+      for (const p of sanitized) {
+        if (p.security) {
+          p.security.events = p.security.events.slice(0, 10);
+        }
+        if (p.errors) {
+          p.errors = p.errors.slice(0, 20);
+        }
+        if (p.depAudit) {
+          p.depAudit.vulnerabilities = p.depAudit.vulnerabilities.slice(0, 10);
+        }
+      }
+      body = JSON.stringify(sanitized.length === 1 ? sanitized[0] : { batch: sanitized });
+    }
+    this.logger.info(
+      `Sending report to ${url} (${payloads.length} payload(s), ${body.length} bytes, key=${maskApiKey(this.apiKey)})`
+    );
+    return new Promise((resolve, reject) => {
+      try {
+        const parsed = new import_url.URL(url);
+        const isHttps = parsed.protocol === "https:";
+        const mod = isHttps ? import_https.default : import_http.default;
+        const options = {
+          hostname: parsed.hostname,
+          port: parsed.port || (isHttps ? 443 : 80),
+          path: parsed.pathname + parsed.search,
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "Content-Length": Buffer.byteLength(body, "utf-8"),
+            Authorization: `Bearer ${this.apiKey}`,
+            "User-Agent": "shieldpress-tracker/1.0.0"
+          },
+          timeout: 1e4
+        };
+        const req = mod.request(options, (res) => {
+          let data = "";
+          res.on("data", (chunk) => {
+            if (data.length < 1024) {
+              data += chunk;
+            }
+          });
+          res.on("end", () => {
+            const statusCode = res.statusCode || 0;
+            if (statusCode >= 200 && statusCode < 300) {
+              this.logger.info("Report sent successfully");
+              resolve();
+            } else {
+              reject(new Error(`HTTP ${statusCode}: ${data.slice(0, 200)}`));
+            }
+          });
+          res.on("error", (err) => {
+            reject(new Error(`Response error: ${err.message}`));
+          });
+        });
+        req.setTimeout(1e4, () => {
+          req.destroy(new Error("Request timed out after 10000ms"));
+        });
+        req.on("error", (err) => {
+          reject(new Error(`Request error: ${err.message}`));
+        });
+        req.write(body);
+        req.end();
+      } catch (err) {
+        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+    });
+  }
+};
+
+// src/tracker.ts
+var ShieldPressTracker = class {
+  constructor(userConfig) {
+    this.timer = null;
+    this.lagTimer = null;
+    this.started = false;
+    this.headersChecked = false;
+    this.config = resolveConfig(userConfig);
+    this.logger = createLogger(this.config.debug);
+    this.reporter = new Reporter(this.config.apiUrl, this.config.apiKey, this.logger);
+    this.httpCollector = new HttpCollector();
+    this.errorCollector = new ErrorCollector(this.config.maxErrorBuffer);
+    this.securityCollector = new SecurityCollector(this.config.maxSecurityBuffer);
+    this.depAuditCollector = new DepAuditCollector(this.config.depAuditInterval * 1e3, this.logger);
+    this.envSecurityCollector = new EnvSecurityCollector();
+  }
+  /** Start the tracker — begins periodic reporting */
+  start() {
+    if (this.started) return this;
+    this.started = true;
+    this.logger.info(
+      `Starting tracker for site=${this.config.siteId} env=${this.config.environment} interval=${this.config.reportInterval}s`
+    );
+    if (this.config.errorTracking) {
+      process.on("uncaughtException", (err) => {
+        this.errorCollector.capture(err, { type: "uncaughtException" });
+        this.flush().catch(() => {
+        });
+      });
+      process.on("unhandledRejection", (reason) => {
+        const err = reason instanceof Error ? reason : new Error(String(reason));
+        this.errorCollector.capture(err, { type: "unhandledRejection" });
+      });
+    }
+    if (this.config.systemMetrics) {
+      collectSystemMetrics();
+    }
+    if (this.config.runtimeMetrics) {
+      this.lagTimer = startLagSampling();
+    }
+    this.timer = setInterval(() => {
+      this.flush().catch((err) => {
+        this.logger.error("Flush failed:", err);
+      });
+    }, this.config.reportInterval * 1e3);
+    this.timer.unref();
+    const shutdown = () => {
+      this.flush().catch(() => {
+      }).finally(() => process.exit(0));
+    };
+    process.on("SIGTERM", shutdown);
+    process.on("SIGINT", shutdown);
+    return this;
+  }
+  /** Stop the tracker */
+  stop() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+    if (this.lagTimer) {
+      clearInterval(this.lagTimer);
+      this.lagTimer = null;
+    }
+    this.started = false;
+    this.logger.info("Tracker stopped");
+  }
+  /** Manually record an HTTP request */
+  recordRequest(data) {
+    if (!this.config.httpTracking) return;
+    if (this.shouldIgnorePath(data.path)) return;
+    this.httpCollector.record(data);
+  }
+  /** Analyze an incoming request for security threats */
+  analyzeRequest(req) {
+    if (!this.config.securityTracking) return;
+    if (this.shouldIgnorePath(req.url)) return;
+    this.securityCollector.analyzeRequest(req);
+  }
+  /** Analyze a response for security issues (headers, data leaks) */
+  analyzeResponse(data) {
+    if (!this.config.securityTracking) return;
+    if (!this.headersChecked && data.headers && this.config.envSecurity) {
+      const headerChecks = this.envSecurityCollector.checkResponseHeaders(data.headers);
+      this.headersChecked = true;
+      this.envSecurityCollector.collect().then((report) => {
+        report.securityHeaders = headerChecks;
+      }).catch(() => {
+      });
+    }
+    this.securityCollector.analyzeResponse(data);
+  }
+  /** Record an authentication failure */
+  recordAuthFailure(data) {
+    if (!this.config.securityTracking) return;
+    this.securityCollector.recordAuthFailure(data);
+  }
+  /** Record a rate limit event */
+  recordRateLimit(data) {
+    if (!this.config.securityTracking) return;
+    this.securityCollector.recordRateLimit(data);
+  }
+  /** Record a CORS violation */
+  recordCorsViolation(data) {
+    if (!this.config.securityTracking) return;
+    this.securityCollector.recordCorsViolation(data);
+  }
+  /** Manually capture an error */
+  captureError(error, meta) {
+    if (!this.config.errorTracking) return;
+    this.errorCollector.capture(error, meta);
+  }
+  /** Flush all collected data and send report */
+  async flush() {
+    const payload = {
+      siteId: this.config.siteId,
+      appName: this.config.appName,
+      appVersion: this.config.appVersion,
+      environment: this.config.environment,
+      tags: this.config.tags,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    if (this.config.systemMetrics) {
+      payload.system = collectSystemMetrics();
+    }
+    if (this.config.httpTracking) {
+      const httpMetrics = this.httpCollector.flush();
+      if (httpMetrics) payload.http = httpMetrics;
+    }
+    if (this.config.errorTracking) {
+      const errors = this.errorCollector.flush();
+      if (errors.length > 0) payload.errors = errors;
+    }
+    if (this.config.securityTracking) {
+      const security = this.securityCollector.flush();
+      if (security) payload.security = security;
+    }
+    if (this.config.depAudit) {
+      const depAudit = await this.depAuditCollector.collect().catch(() => null);
+      if (depAudit) payload.depAudit = depAudit;
+    }
+    if (this.config.runtimeMetrics) {
+      payload.runtime = collectRuntimeMetrics();
+    }
+    if (this.config.envSecurity) {
+      const envReport = await this.envSecurityCollector.collect().catch(() => null);
+      if (envReport) payload.envSecurity = envReport;
+    }
+    if (this.config.heartbeat) {
+      payload.heartbeat = true;
+    }
+    return this.reporter.send(payload);
+  }
+  shouldIgnorePath(path) {
+    return this.config.ignorePaths.some((pattern) => {
+      if (pattern.endsWith("/*")) {
+        return path.startsWith(pattern.slice(0, -1));
+      }
+      return path === pattern;
+    });
+  }
+};
+
+// src/nextjs.ts
+var globalTracker = null;
+function initTracker(config) {
+  if (globalTracker) return globalTracker;
+  globalTracker = new ShieldPressTracker(config).start();
+  return globalTracker;
+}
+function getTracker() {
+  return globalTracker;
+}
+function withShieldPress(handler) {
+  return async function shieldPressMiddleware(request) {
+    const start = performance.now();
+    const headers = {};
+    request.headers.forEach((value, key) => {
+      headers[key] = value;
+    });
+    globalTracker?.analyzeRequest({
+      url: request.nextUrl.pathname + request.nextUrl.search,
+      method: request.method,
+      headers,
+      ip: request.headers.get("x-forwarded-for") || request.headers.get("x-real-ip") || void 0,
+      query: Object.fromEntries(request.nextUrl.searchParams)
+    });
+    let response;
+    try {
+      if (handler) {
+        response = await handler(request);
+      } else {
+        const { NextResponse: NR } = await import("next/server");
+        response = NR.next();
+      }
+    } catch (err) {
+      globalTracker?.captureError(err instanceof Error ? err : new Error(String(err)), {
+        url: request.nextUrl.pathname,
+        method: request.method
+      });
+      throw err;
+    }
+    const durationMs = performance.now() - start;
+    globalTracker?.recordRequest({
+      path: request.nextUrl.pathname,
+      method: request.method,
+      statusCode: response.status,
+      durationMs: Math.round(durationMs * 100) / 100
+    });
+    if (response.status === 401) {
+      globalTracker?.recordAuthFailure({
+        ip: request.headers.get("x-forwarded-for") || void 0,
+        userAgent: request.headers.get("user-agent") || void 0,
+        url: request.nextUrl.pathname,
+        method: request.method,
+        reason: "HTTP 401 Unauthorized"
+      });
+    }
+    const responseHeaders = {};
+    response.headers.forEach((value, key) => {
+      responseHeaders[key] = value;
+    });
+    globalTracker?.analyzeResponse({
+      url: request.nextUrl.pathname,
+      statusCode: response.status,
+      headers: responseHeaders
+    });
+    return response;
+  };
+}
+function withTracking(handler) {
+  return async function trackedHandler(request, context) {
+    const start = performance.now();
+    const headers = {};
+    request.headers.forEach((value, key) => {
+      headers[key] = value;
+    });
+    globalTracker?.analyzeRequest({
+      url: request.nextUrl.pathname + request.nextUrl.search,
+      method: request.method,
+      headers,
+      ip: request.headers.get("x-forwarded-for") || request.headers.get("x-real-ip") || void 0,
+      query: Object.fromEntries(request.nextUrl.searchParams)
+    });
+    let statusCode = 200;
+    try {
+      const response = await handler(request, context);
+      statusCode = response.status;
+      const durationMs = performance.now() - start;
+      globalTracker?.recordRequest({
+        path: request.nextUrl.pathname,
+        method: request.method,
+        statusCode,
+        durationMs: Math.round(durationMs * 100) / 100
+      });
+      if (statusCode === 401) {
+        globalTracker?.recordAuthFailure({
+          ip: request.headers.get("x-forwarded-for") || void 0,
+          url: request.nextUrl.pathname,
+          method: request.method,
+          reason: "HTTP 401 Unauthorized"
+        });
+      }
+      return response;
+    } catch (err) {
+      statusCode = 500;
+      const durationMs = performance.now() - start;
+      globalTracker?.recordRequest({
+        path: request.nextUrl.pathname,
+        method: request.method,
+        statusCode,
+        durationMs: Math.round(durationMs * 100) / 100
+      });
+      globalTracker?.captureError(err instanceof Error ? err : new Error(String(err)), {
+        url: request.nextUrl.pathname,
+        method: request.method,
+        statusCode
+      });
+      throw err;
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ShieldPressTracker,
+  getTracker,
+  initTracker,
+  withShieldPress,
+  withTracking
+});
+//# sourceMappingURL=nextjs.js.map