@virusis/api-client 0.1.17 → 0.1.20

package/dist/rx.d.ts

@@ -15,9 +15,24 @@ type ClientCtor<T> = new (cfg: ApiClientConfig, baseUrl?: string, http?: {
 export declare function createAllClients(cfg: ApiClientConfig, baseUrl?: string, http?: {
     fetch(url: RequestInfo, init?: RequestInit): Promise<Response>;
 }): {
+    AdminBillingCustomersClient: ClientCtors.AdminBillingCustomersClient;
+    AdminBillingCustomersService: ClientCtors.AdminBillingCustomersClient;
+    adminBillingCustomersService: ClientCtors.AdminBillingCustomersClient;
     AdminPanelConfigsClient: ClientCtors.AdminPanelConfigsClient;
     AdminPanelConfigsService: ClientCtors.AdminPanelConfigsClient;
     adminPanelConfigsService: ClientCtors.AdminPanelConfigsClient;
+    AdminPrivateApiClientsClient: ClientCtors.AdminPrivateApiClientsClient;
+    AdminPrivateApiClientsService: ClientCtors.AdminPrivateApiClientsClient;
+    adminPrivateApiClientsService: ClientCtors.AdminPrivateApiClientsClient;
+    AdminWebhookDeliveriesClient: ClientCtors.AdminWebhookDeliveriesClient;
+    AdminWebhookDeliveriesService: ClientCtors.AdminWebhookDeliveriesClient;
+    adminWebhookDeliveriesService: ClientCtors.AdminWebhookDeliveriesClient;
+    AdminWebhookRotationClient: ClientCtors.AdminWebhookRotationClient;
+    AdminWebhookRotationService: ClientCtors.AdminWebhookRotationClient;
+    adminWebhookRotationService: ClientCtors.AdminWebhookRotationClient;
+    ApiKeyIntrospectionClient: ClientCtors.ApiKeyIntrospectionClient;
+    ApiKeyIntrospectionService: ClientCtors.ApiKeyIntrospectionClient;
+    apiKeyIntrospectionService: ClientCtors.ApiKeyIntrospectionClient;
     ApplicationsClient: ClientCtors.ApplicationsClient;
     ApplicationsService: ClientCtors.ApplicationsClient;
     applicationsService: ClientCtors.ApplicationsClient;
@@ -30,18 +45,21 @@ export declare function createAllClients(cfg: ApiClientConfig, baseUrl?: string,
     BaseUserDevicesClient: ClientCtors.BaseUserDevicesClient;
     BaseUserDevicesService: ClientCtors.BaseUserDevicesClient;
     baseUserDevicesService: ClientCtors.BaseUserDevicesClient;
+    BillingSyncClient: ClientCtors.BillingSyncClient;
+    BillingSyncService: ClientCtors.BillingSyncClient;
+    billingSyncService: ClientCtors.BillingSyncClient;
     CurlTasksClient: ClientCtors.CurlTasksClient;
     CurlTasksService: ClientCtors.CurlTasksClient;
     curlTasksService: ClientCtors.CurlTasksClient;
     DevicesClient: ClientCtors.DevicesClient;
     DevicesService: ClientCtors.DevicesClient;
     devicesService: ClientCtors.DevicesClient;
+    DiagnosticsClient: ClientCtors.DiagnosticsClient;
+    DiagnosticsService: ClientCtors.DiagnosticsClient;
+    diagnosticsService: ClientCtors.DiagnosticsClient;
     FeedbacksClient: ClientCtors.FeedbacksClient;
     FeedbacksService: ClientCtors.FeedbacksClient;
     feedbacksService: ClientCtors.FeedbacksClient;
-    ApiClient: ClientCtors.ApiClient;
-    ApiService: ClientCtors.ApiClient;
-    apiService: ClientCtors.ApiClient;
     InteractionTrackersClient: ClientCtors.InteractionTrackersClient;
     InteractionTrackersService: ClientCtors.InteractionTrackersClient;
     interactionTrackersService: ClientCtors.InteractionTrackersClient;
@@ -54,21 +72,27 @@ export declare function createAllClients(cfg: ApiClientConfig, baseUrl?: string,
     MenusClient: ClientCtors.MenusClient;
     MenusService: ClientCtors.MenusClient;
     menusService: ClientCtors.MenusClient;
+    MyApiKeysClient: ClientCtors.MyApiKeysClient;
+    MyApiKeysService: ClientCtors.MyApiKeysClient;
+    myApiKeysService: ClientCtors.MyApiKeysClient;
     NotificationsClient: ClientCtors.NotificationsClient;
     NotificationsService: ClientCtors.NotificationsClient;
     notificationsService: ClientCtors.NotificationsClient;
     OperationClaimsClient: ClientCtors.OperationClaimsClient;
     OperationClaimsService: ClientCtors.OperationClaimsClient;
     operationClaimsService: ClientCtors.OperationClaimsClient;
+    PortalCatalogClient: ClientCtors.PortalCatalogClient;
+    PortalCatalogService: ClientCtors.PortalCatalogClient;
+    portalCatalogService: ClientCtors.PortalCatalogClient;
+    PortalTrackingClient: ClientCtors.PortalTrackingClient;
+    PortalTrackingService: ClientCtors.PortalTrackingClient;
+    portalTrackingService: ClientCtors.PortalTrackingClient;
     QueueMonitorClient: ClientCtors.QueueMonitorClient;
     QueueMonitorService: ClientCtors.QueueMonitorClient;
     queueMonitorService: ClientCtors.QueueMonitorClient;
-    MetricsClient: ClientCtors.MetricsClient;
-    MetricsService: ClientCtors.MetricsClient;
-    metricsService: ClientCtors.MetricsClient;
-    HealthClient: ClientCtors.HealthClient;
-    HealthService: ClientCtors.HealthClient;
-    healthService: ClientCtors.HealthClient;
+    RiskClient: ClientCtors.RiskClient;
+    RiskService: ClientCtors.RiskClient;
+    riskService: ClientCtors.RiskClient;
     ScanApiBusSourcesClient: ClientCtors.ScanApiBusSourcesClient;
     ScanApiBusSourcesService: ClientCtors.ScanApiBusSourcesClient;
     scanApiBusSourcesService: ClientCtors.ScanApiBusSourcesClient;
@@ -135,12 +159,12 @@ export declare function createAllClients(cfg: ApiClientConfig, baseUrl?: string,
     ScanEnginesClient: ClientCtors.ScanEnginesClient;
     ScanEnginesService: ClientCtors.ScanEnginesClient;
     scanEnginesService: ClientCtors.ScanEnginesClient;
-    Scan_ingestionClient: ClientCtors.Scan_ingestionClient;
-    Scan_ingestionService: ClientCtors.Scan_ingestionClient;
-    scan_ingestionService: ClientCtors.Scan_ingestionClient;
-    ScanClient: ClientCtors.ScanClient;
-    ScanService: ClientCtors.ScanClient;
-    scanService: ClientCtors.ScanClient;
+    ScanIngestionClient: ClientCtors.ScanIngestionClient;
+    ScanIngestionService: ClientCtors.ScanIngestionClient;
+    scanIngestionService: ClientCtors.ScanIngestionClient;
+    ScanProxyClient: ClientCtors.ScanProxyClient;
+    ScanProxyService: ClientCtors.ScanProxyClient;
+    scanProxyService: ClientCtors.ScanProxyClient;
     ScansClient: ClientCtors.ScansClient;
     ScansService: ClientCtors.ScansClient;
     scansService: ClientCtors.ScansClient;
@@ -189,9 +213,9 @@ export declare function createAllClients(cfg: ApiClientConfig, baseUrl?: string,
     ScanVisibilityTypesClient: ClientCtors.ScanVisibilityTypesClient;
     ScanVisibilityTypesService: ClientCtors.ScanVisibilityTypesClient;
     scanVisibilityTypesService: ClientCtors.ScanVisibilityTypesClient;
-    InternalClient: ClientCtors.InternalClient;
-    InternalService: ClientCtors.InternalClient;
-    internalService: ClientCtors.InternalClient;
+    ShareLinksClient: ClientCtors.ShareLinksClient;
+    ShareLinksService: ClientCtors.ShareLinksClient;
+    shareLinksService: ClientCtors.ShareLinksClient;
     ThreatConceptsClient: ClientCtors.ThreatConceptsClient;
     ThreatConceptsService: ClientCtors.ThreatConceptsClient;
     threatConceptsService: ClientCtors.ThreatConceptsClient;
@@ -207,15 +231,9 @@ export declare function createAllClients(cfg: ApiClientConfig, baseUrl?: string,
     ThreatRuleVersionsClient: ClientCtors.ThreatRuleVersionsClient;
     ThreatRuleVersionsService: ClientCtors.ThreatRuleVersionsClient;
     threatRuleVersionsService: ClientCtors.ThreatRuleVersionsClient;
-    AnonClient: ClientCtors.AnonClient;
-    AnonService: ClientCtors.AnonClient;
-    anonService: ClientCtors.AnonClient;
     TrialAuthClient: ClientCtors.TrialAuthClient;
     TrialAuthService: ClientCtors.TrialAuthClient;
     trialAuthService: ClientCtors.TrialAuthClient;
-    SessionsClient: ClientCtors.SessionsClient;
-    SessionsService: ClientCtors.SessionsClient;
-    sessionsService: ClientCtors.SessionsClient;
     TrialUserOperationClaimsClient: ClientCtors.TrialUserOperationClaimsClient;
     TrialUserOperationClaimsService: ClientCtors.TrialUserOperationClaimsClient;
     trialUserOperationClaimsService: ClientCtors.TrialUserOperationClaimsClient;
@@ -245,9 +263,24 @@ export declare function createRxClientFactory<T extends object>(Ctor: ClientCtor
 export declare function createAllRxClients(cfg: ApiClientConfig, baseUrl?: string, http?: {
     fetch(url: RequestInfo, init?: RequestInit): Promise<Response>;
 }): {
+    AdminBillingCustomersClient: Rxified<ClientCtors.AdminBillingCustomersClient>;
+    AdminBillingCustomersService: Rxified<ClientCtors.AdminBillingCustomersClient>;
+    adminBillingCustomersService: Rxified<ClientCtors.AdminBillingCustomersClient>;
     AdminPanelConfigsClient: Rxified<ClientCtors.AdminPanelConfigsClient>;
     AdminPanelConfigsService: Rxified<ClientCtors.AdminPanelConfigsClient>;
     adminPanelConfigsService: Rxified<ClientCtors.AdminPanelConfigsClient>;
+    AdminPrivateApiClientsClient: Rxified<ClientCtors.AdminPrivateApiClientsClient>;
+    AdminPrivateApiClientsService: Rxified<ClientCtors.AdminPrivateApiClientsClient>;
+    adminPrivateApiClientsService: Rxified<ClientCtors.AdminPrivateApiClientsClient>;
+    AdminWebhookDeliveriesClient: Rxified<ClientCtors.AdminWebhookDeliveriesClient>;
+    AdminWebhookDeliveriesService: Rxified<ClientCtors.AdminWebhookDeliveriesClient>;
+    adminWebhookDeliveriesService: Rxified<ClientCtors.AdminWebhookDeliveriesClient>;
+    AdminWebhookRotationClient: Rxified<ClientCtors.AdminWebhookRotationClient>;
+    AdminWebhookRotationService: Rxified<ClientCtors.AdminWebhookRotationClient>;
+    adminWebhookRotationService: Rxified<ClientCtors.AdminWebhookRotationClient>;
+    ApiKeyIntrospectionClient: Rxified<ClientCtors.ApiKeyIntrospectionClient>;
+    ApiKeyIntrospectionService: Rxified<ClientCtors.ApiKeyIntrospectionClient>;
+    apiKeyIntrospectionService: Rxified<ClientCtors.ApiKeyIntrospectionClient>;
     ApplicationsClient: Rxified<ClientCtors.ApplicationsClient>;
     ApplicationsService: Rxified<ClientCtors.ApplicationsClient>;
     applicationsService: Rxified<ClientCtors.ApplicationsClient>;
@@ -260,18 +293,21 @@ export declare function createAllRxClients(cfg: ApiClientConfig, baseUrl?: strin
     BaseUserDevicesClient: Rxified<ClientCtors.BaseUserDevicesClient>;
     BaseUserDevicesService: Rxified<ClientCtors.BaseUserDevicesClient>;
     baseUserDevicesService: Rxified<ClientCtors.BaseUserDevicesClient>;
+    BillingSyncClient: Rxified<ClientCtors.BillingSyncClient>;
+    BillingSyncService: Rxified<ClientCtors.BillingSyncClient>;
+    billingSyncService: Rxified<ClientCtors.BillingSyncClient>;
     CurlTasksClient: Rxified<ClientCtors.CurlTasksClient>;
     CurlTasksService: Rxified<ClientCtors.CurlTasksClient>;
     curlTasksService: Rxified<ClientCtors.CurlTasksClient>;
     DevicesClient: Rxified<ClientCtors.DevicesClient>;
     DevicesService: Rxified<ClientCtors.DevicesClient>;
     devicesService: Rxified<ClientCtors.DevicesClient>;
+    DiagnosticsClient: Rxified<ClientCtors.DiagnosticsClient>;
+    DiagnosticsService: Rxified<ClientCtors.DiagnosticsClient>;
+    diagnosticsService: Rxified<ClientCtors.DiagnosticsClient>;
     FeedbacksClient: Rxified<ClientCtors.FeedbacksClient>;
     FeedbacksService: Rxified<ClientCtors.FeedbacksClient>;
     feedbacksService: Rxified<ClientCtors.FeedbacksClient>;
-    ApiClient: Rxified<ClientCtors.ApiClient>;
-    ApiService: Rxified<ClientCtors.ApiClient>;
-    apiService: Rxified<ClientCtors.ApiClient>;
     InteractionTrackersClient: Rxified<ClientCtors.InteractionTrackersClient>;
     InteractionTrackersService: Rxified<ClientCtors.InteractionTrackersClient>;
     interactionTrackersService: Rxified<ClientCtors.InteractionTrackersClient>;
@@ -284,21 +320,27 @@ export declare function createAllRxClients(cfg: ApiClientConfig, baseUrl?: strin
     MenusClient: Rxified<ClientCtors.MenusClient>;
     MenusService: Rxified<ClientCtors.MenusClient>;
     menusService: Rxified<ClientCtors.MenusClient>;
+    MyApiKeysClient: Rxified<ClientCtors.MyApiKeysClient>;
+    MyApiKeysService: Rxified<ClientCtors.MyApiKeysClient>;
+    myApiKeysService: Rxified<ClientCtors.MyApiKeysClient>;
     NotificationsClient: Rxified<ClientCtors.NotificationsClient>;
     NotificationsService: Rxified<ClientCtors.NotificationsClient>;
     notificationsService: Rxified<ClientCtors.NotificationsClient>;
     OperationClaimsClient: Rxified<ClientCtors.OperationClaimsClient>;
     OperationClaimsService: Rxified<ClientCtors.OperationClaimsClient>;
     operationClaimsService: Rxified<ClientCtors.OperationClaimsClient>;
+    PortalCatalogClient: Rxified<ClientCtors.PortalCatalogClient>;
+    PortalCatalogService: Rxified<ClientCtors.PortalCatalogClient>;
+    portalCatalogService: Rxified<ClientCtors.PortalCatalogClient>;
+    PortalTrackingClient: Rxified<ClientCtors.PortalTrackingClient>;
+    PortalTrackingService: Rxified<ClientCtors.PortalTrackingClient>;
+    portalTrackingService: Rxified<ClientCtors.PortalTrackingClient>;
     QueueMonitorClient: Rxified<ClientCtors.QueueMonitorClient>;
     QueueMonitorService: Rxified<ClientCtors.QueueMonitorClient>;
     queueMonitorService: Rxified<ClientCtors.QueueMonitorClient>;
-    MetricsClient: Rxified<ClientCtors.MetricsClient>;
-    MetricsService: Rxified<ClientCtors.MetricsClient>;
-    metricsService: Rxified<ClientCtors.MetricsClient>;
-    HealthClient: Rxified<ClientCtors.HealthClient>;
-    HealthService: Rxified<ClientCtors.HealthClient>;
-    healthService: Rxified<ClientCtors.HealthClient>;
+    RiskClient: Rxified<ClientCtors.RiskClient>;
+    RiskService: Rxified<ClientCtors.RiskClient>;
+    riskService: Rxified<ClientCtors.RiskClient>;
     ScanApiBusSourcesClient: Rxified<ClientCtors.ScanApiBusSourcesClient>;
     ScanApiBusSourcesService: Rxified<ClientCtors.ScanApiBusSourcesClient>;
     scanApiBusSourcesService: Rxified<ClientCtors.ScanApiBusSourcesClient>;
@@ -365,12 +407,12 @@ export declare function createAllRxClients(cfg: ApiClientConfig, baseUrl?: strin
     ScanEnginesClient: Rxified<ClientCtors.ScanEnginesClient>;
     ScanEnginesService: Rxified<ClientCtors.ScanEnginesClient>;
     scanEnginesService: Rxified<ClientCtors.ScanEnginesClient>;
-    Scan_ingestionClient: Rxified<ClientCtors.Scan_ingestionClient>;
-    Scan_ingestionService: Rxified<ClientCtors.Scan_ingestionClient>;
-    scan_ingestionService: Rxified<ClientCtors.Scan_ingestionClient>;
-    ScanClient: Rxified<ClientCtors.ScanClient>;
-    ScanService: Rxified<ClientCtors.ScanClient>;
-    scanService: Rxified<ClientCtors.ScanClient>;
+    ScanIngestionClient: Rxified<ClientCtors.ScanIngestionClient>;
+    ScanIngestionService: Rxified<ClientCtors.ScanIngestionClient>;
+    scanIngestionService: Rxified<ClientCtors.ScanIngestionClient>;
+    ScanProxyClient: Rxified<ClientCtors.ScanProxyClient>;
+    ScanProxyService: Rxified<ClientCtors.ScanProxyClient>;
+    scanProxyService: Rxified<ClientCtors.ScanProxyClient>;
     ScansClient: Rxified<ClientCtors.ScansClient>;
     ScansService: Rxified<ClientCtors.ScansClient>;
     scansService: Rxified<ClientCtors.ScansClient>;
@@ -419,9 +461,9 @@ export declare function createAllRxClients(cfg: ApiClientConfig, baseUrl?: strin
     ScanVisibilityTypesClient: Rxified<ClientCtors.ScanVisibilityTypesClient>;
     ScanVisibilityTypesService: Rxified<ClientCtors.ScanVisibilityTypesClient>;
     scanVisibilityTypesService: Rxified<ClientCtors.ScanVisibilityTypesClient>;
-    InternalClient: Rxified<ClientCtors.InternalClient>;
-    InternalService: Rxified<ClientCtors.InternalClient>;
-    internalService: Rxified<ClientCtors.InternalClient>;
+    ShareLinksClient: Rxified<ClientCtors.ShareLinksClient>;
+    ShareLinksService: Rxified<ClientCtors.ShareLinksClient>;
+    shareLinksService: Rxified<ClientCtors.ShareLinksClient>;
     ThreatConceptsClient: Rxified<ClientCtors.ThreatConceptsClient>;
     ThreatConceptsService: Rxified<ClientCtors.ThreatConceptsClient>;
     threatConceptsService: Rxified<ClientCtors.ThreatConceptsClient>;
@@ -437,15 +479,9 @@ export declare function createAllRxClients(cfg: ApiClientConfig, baseUrl?: strin
     ThreatRuleVersionsClient: Rxified<ClientCtors.ThreatRuleVersionsClient>;
     ThreatRuleVersionsService: Rxified<ClientCtors.ThreatRuleVersionsClient>;
     threatRuleVersionsService: Rxified<ClientCtors.ThreatRuleVersionsClient>;
-    AnonClient: Rxified<ClientCtors.AnonClient>;
-    AnonService: Rxified<ClientCtors.AnonClient>;
-    anonService: Rxified<ClientCtors.AnonClient>;
     TrialAuthClient: Rxified<ClientCtors.TrialAuthClient>;
     TrialAuthService: Rxified<ClientCtors.TrialAuthClient>;
     trialAuthService: Rxified<ClientCtors.TrialAuthClient>;
-    SessionsClient: Rxified<ClientCtors.SessionsClient>;
-    SessionsService: Rxified<ClientCtors.SessionsClient>;
-    sessionsService: Rxified<ClientCtors.SessionsClient>;
     TrialUserOperationClaimsClient: Rxified<ClientCtors.TrialUserOperationClaimsClient>;
     TrialUserOperationClaimsService: Rxified<ClientCtors.TrialUserOperationClaimsClient>;
     trialUserOperationClaimsService: Rxified<ClientCtors.TrialUserOperationClaimsClient>;

package/dist/security/index.d.ts

@@ -0,0 +1,4 @@
+export type { InputPolicyKind, ThreatType, ThreatDetail, InputSecurityResult, InputSecurityPolicy, } from "./input-security-policy.js";
+export { sanitize, detect } from "./input-security-service.js";
+export { validatePath, validateAbsoluteUrl, sanitizeBody, sanitizeFormDataFileName, sanitizeHeaderValue, } from "./request-sanitizer.js";
+export type { SanitizeBodyResult } from "./request-sanitizer.js";

package/dist/security/index.js

@@ -0,0 +1,2 @@
+export { sanitize, detect } from "./input-security-service.js";
+export { validatePath, validateAbsoluteUrl, sanitizeBody, sanitizeFormDataFileName, sanitizeHeaderValue, } from "./request-sanitizer.js";

package/dist/security/input-security-policy.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Input Security Policy types for the API client.
+ * Aligned with VirusProof-main Core InputPolicyKind.
+ */
+export type InputPolicyKind = "scanName" | "url" | "ip" | "sha256" | "sha1" | "md5" | "email" | "freeTextShort" | "freeTextLong" | "scanDisplayName" | "otp" | "captchaToken" | "password" | "enum" | "date" | "fileName" | "routeSegment" | "queryText" | "headerValue" | "guid" | "scanMode" | "engineIdsJson" | "analysisIdsJson" | "workerPayload" | "jsonPayload";
+export type ThreatType = "xss" | "sql-injection" | "nosql-injection" | "ssti" | "command-injection" | "path-traversal" | "log-injection" | "header-injection" | "ssrf" | "prototype-pollution";
+export interface ThreatDetail {
+    type: ThreatType;
+    severity: "low" | "medium" | "high" | "critical";
+    message: string;
+}
+export interface InputSecurityResult {
+    sanitized: string;
+    modified: boolean;
+    blocked: boolean;
+    detectedThreats: ThreatDetail[];
+}
+export interface InputSecurityPolicy {
+    kind: InputPolicyKind;
+    maxLength: number;
+    sanitizerChain: ThreatType[];
+    blockOnDetection: boolean;
+}

package/dist/security/input-security-policy.js

@@ -0,0 +1,5 @@
+/**
+ * Input Security Policy types for the API client.
+ * Aligned with VirusProof-main Core InputPolicyKind.
+ */
+export {};

package/dist/security/input-security-service.d.ts

@@ -0,0 +1,3 @@
+import type { InputPolicyKind, InputSecurityResult, ThreatDetail } from "./input-security-policy.js";
+export declare function sanitize(kind: InputPolicyKind, value: string | null | undefined, fieldName?: string): InputSecurityResult;
+export declare function detect(kind: InputPolicyKind, value: string): ThreatDetail[];

package/dist/security/input-security-service.js

@@ -0,0 +1,153 @@
+/**
+ * Lightweight client-side input security service.
+ * NOT authoritative — server is the trust boundary.
+ * This provides early rejection and UX feedback.
+ */
+// ─── Pattern definitions ────────────────────────────────────────
+const XSS_PATTERNS = [
+    /<script\b/i,
+    /javascript\s*:/i,
+    /on(?:load|error|click|mouse|focus|blur|change|submit)\s*=/i,
+    /<\s*(?:iframe|object|embed|svg|math|form|input)\b/i,
+    /expression\s*\(/i,
+];
+const SQL_PATTERNS = [
+    /'\s*(?:OR|AND)\s+.+?(?:=|--|;)/i,
+    /;\s*(?:DROP|ALTER|DELETE|INSERT|UPDATE|EXEC)\b/i,
+    /\bUNION\s+(?:ALL\s+)?SELECT\b/i,
+    /\b(?:WAITFOR\s+DELAY|BENCHMARK\s*\(|SLEEP\s*\()/i,
+    /\bINFORMATION_SCHEMA\b/i,
+    /\b(?:OrderBy|Where|FromSqlRaw|ExecuteSqlRaw)\s*\(/i,
+];
+const NOSQL_PATTERNS = [
+    /\$\s*(?:ne|gt|gte|lt|lte|in|nin|exists|regex|where|or|and)\b/i,
+    /\{\s*"\$/,
+];
+const SSTI_PATTERNS = [/\{\{.*?\}\}/, /\$\{.*?\}/, /\{%.*?%\}/];
+const CMD_PATTERNS = [
+    /[;&|`]/,
+    /\$\(/,
+    /\b(?:whoami|cat|wget|curl|bash|sh|rm|nc)\b/i,
+];
+const PATH_PATTERNS = [
+    /\.\.[/\\]/,
+    /%2e%2e[%2f%5c/\\]/i,
+    /%00/,
+    /\x00/,
+];
+const CRLF_PATTERN = /[\r\n]/;
+const CONTROL_CHARS = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/;
+const PROTOTYPE_POLLUTION_PATTERNS = [
+    /"__proto__"\s*:/,
+    /"constructor"\s*:/,
+    /"prototype"\s*:/,
+    /__proto__/,
+];
+const SSRF_PATTERNS = [
+    /^(?:javascript|data|file|vbscript|ftp|gopher|dict|ldap):/i,
+    /:\/\/(?:localhost|127\.0\.0\.1|\[::1\])/i,
+    /:\/\/169\.254\.169\.254/,
+    /:\/\/100\.100\.100\.200/,
+    /:\/\/metadata\.google\.internal/i,
+    /:\/\/10\.\d{1,3}\.\d{1,3}\.\d{1,3}/,
+    /:\/\/172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}/,
+    /:\/\/192\.168\.\d{1,3}\.\d{1,3}/,
+    /:\/\/[^/]*@/, // user:pass@host
+];
+const POLICIES = {
+    scanName: { maxLength: 128, block: true, checks: ["xss", "sql-injection", "command-injection", "ssti", "path-traversal", "log-injection", "header-injection"] },
+    url: { maxLength: 2048, block: true, checks: ["xss", "command-injection", "path-traversal", "header-injection", "ssrf"] },
+    ip: { maxLength: 45, block: true, checks: ["command-injection", "log-injection"] },
+    sha256: { maxLength: 64, block: true, checks: ["xss", "sql-injection", "command-injection", "path-traversal", "log-injection"] },
+    sha1: { maxLength: 40, block: true, checks: ["xss", "sql-injection", "command-injection", "path-traversal", "log-injection"] },
+    md5: { maxLength: 32, block: true, checks: ["xss", "sql-injection", "command-injection", "path-traversal", "log-injection"] },
+    email: { maxLength: 254, block: true, checks: ["xss", "sql-injection", "command-injection", "header-injection"] },
+    freeTextShort: { maxLength: 256, block: false, checks: ["xss", "sql-injection", "nosql-injection", "ssti", "command-injection", "path-traversal", "log-injection", "header-injection"] },
+    freeTextLong: { maxLength: 5000, block: false, checks: ["xss", "sql-injection", "nosql-injection", "ssti", "command-injection", "path-traversal", "log-injection", "header-injection"] },
+    scanDisplayName: { maxLength: 512, block: false, checks: ["xss", "sql-injection", "nosql-injection", "ssti", "command-injection", "path-traversal", "log-injection", "header-injection"] },
+    otp: { maxLength: 10, block: true, checks: ["sql-injection", "header-injection"] },
+    captchaToken: { maxLength: 4096, block: false, checks: [] },
+    password: { maxLength: 256, block: false, checks: [] },
+    enum: { maxLength: 64, block: true, checks: ["sql-injection", "command-injection", "log-injection"] },
+    date: { maxLength: 32, block: true, checks: ["sql-injection", "command-injection"] },
+    fileName: { maxLength: 255, block: true, checks: ["path-traversal", "command-injection", "xss", "log-injection"] },
+    routeSegment: { maxLength: 256, block: true, checks: ["path-traversal", "sql-injection", "command-injection", "header-injection"] },
+    queryText: { maxLength: 512, block: false, checks: ["xss", "sql-injection", "nosql-injection", "ssti", "command-injection", "path-traversal"] },
+    headerValue: { maxLength: 8192, block: true, checks: ["header-injection", "log-injection"] },
+    guid: { maxLength: 36, block: true, checks: ["sql-injection", "log-injection"] },
+    scanMode: { maxLength: 16, block: true, checks: ["sql-injection", "command-injection", "log-injection"] },
+    engineIdsJson: { maxLength: 4096, block: true, checks: ["nosql-injection", "sql-injection", "xss", "command-injection", "log-injection", "prototype-pollution"] },
+    analysisIdsJson: { maxLength: 8192, block: true, checks: ["nosql-injection", "sql-injection", "xss", "command-injection", "log-injection", "prototype-pollution"] },
+    workerPayload: { maxLength: 65536, block: true, checks: ["sql-injection", "nosql-injection", "command-injection", "xss", "ssti", "log-injection", "header-injection", "prototype-pollution"] },
+    jsonPayload: { maxLength: 65536, block: false, checks: ["sql-injection", "nosql-injection", "xss", "ssti", "command-injection", "log-injection", "prototype-pollution"] },
+};
+// ─── Core logic ─────────────────────────────────────────────────
+function checkPatterns(input, type) {
+    const patterns = type === "xss" ? XSS_PATTERNS
+        : type === "sql-injection" ? SQL_PATTERNS
+            : type === "nosql-injection" ? NOSQL_PATTERNS
+                : type === "ssti" ? SSTI_PATTERNS
+                    : type === "command-injection" ? CMD_PATTERNS
+                        : type === "path-traversal" ? PATH_PATTERNS
+                            : type === "log-injection" ? [CRLF_PATTERN]
+                                : type === "header-injection" ? [CRLF_PATTERN, CONTROL_CHARS]
+                                    : type === "ssrf" ? SSRF_PATTERNS
+                                        : type === "prototype-pollution" ? PROTOTYPE_POLLUTION_PATTERNS
+                                            : [];
+    for (const p of patterns) {
+        if (p.test(input)) {
+            return {
+                type,
+                severity: type === "sql-injection" || type === "command-injection" || type === "ssrf" || type === "prototype-pollution" ? "critical" : "high",
+                message: `${type} pattern detected`,
+            };
+        }
+    }
+    return null;
+}
+export function sanitize(kind, value, fieldName = "") {
+    if (!value) {
+        return { sanitized: value ?? "", modified: false, blocked: false, detectedThreats: [] };
+    }
+    const policy = POLICIES[kind];
+    let current = value.trim();
+    let modified = false;
+    // Max length
+    if (current.length > policy.maxLength) {
+        current = current.slice(0, policy.maxLength);
+        modified = true;
+    }
+    // CR/LF sanitize for all
+    if (CRLF_PATTERN.test(current)) {
+        current = current.replace(/[\r\n]/g, " ");
+        modified = true;
+    }
+    if (CONTROL_CHARS.test(current)) {
+        current = current.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "");
+        modified = true;
+    }
+    // Run checks
+    const threats = [];
+    for (const check of policy.checks) {
+        const threat = checkPatterns(current, check);
+        if (threat)
+            threats.push(threat);
+    }
+    const blocked = policy.block && threats.length > 0;
+    return {
+        sanitized: blocked ? "" : current,
+        modified: modified || current !== value,
+        blocked,
+        detectedThreats: threats,
+    };
+}
+export function detect(kind, value) {
+    const policy = POLICIES[kind];
+    const threats = [];
+    for (const check of policy.checks) {
+        const threat = checkPatterns(value, check);
+        if (threat)
+            threats.push(threat);
+    }
+    return threats;
+}

package/dist/security/request-sanitizer.d.ts

@@ -0,0 +1,18 @@
+import type { InputSecurityResult } from "./input-security-policy.js";
+export declare function validatePath(path: string): {
+    safe: boolean;
+    sanitized: string;
+};
+export declare function validateAbsoluteUrl(url: string, trustedHosts: string[]): {
+    safe: boolean;
+    reason?: string;
+};
+export interface SanitizeBodyResult {
+    body: Record<string, unknown>;
+    modified: boolean;
+    blocked: boolean;
+    threats: InputSecurityResult[];
+}
+export declare function sanitizeBody(body: Record<string, unknown>, depth?: number, visited?: WeakSet<object>): SanitizeBodyResult;
+export declare function sanitizeFormDataFileName(filename: string): string;
+export declare function sanitizeHeaderValue(value: string): string;