@vorionsys/security 1.0.0

package/dist/security/index.js

@@ -0,0 +1,267 @@
+/**
+ * Security Hardening Module
+ *
+ * Comprehensive security controls for CAR ID specification compliance.
+ * Implements critical security hardening requirements including:
+ *
+ * - DPoP (Demonstrating Proof-of-Possession) - RFC 9449
+ * - TEE (Trusted Execution Environment) binding
+ * - Pairwise DID generation for privacy
+ * - Revocation management with SLA enforcement
+ * - Token lifetime validation
+ * - Token introspection (RFC 7662)
+ *
+ * Security Conformance Levels:
+ * - SH-1 (Basic): DPoP required, short-lived tokens (T2)
+ * - SH-2 (Standard): SH-1 + pairwise DIDs, recursive revocation (T3)
+ * - SH-3 (Hardened): SH-2 + TEE binding, sync revocation checks (T4-T5)
+ *
+ * @packageDocumentation
+ * @module security
+ */
+// =============================================================================
+// Types
+// =============================================================================
+export { 
+// Trust Tier
+TrustTier, trustTierSchema, 
+// Security Conformance
+SecurityConformanceLevel, securityConformanceLevelSchema, dpopProofSchema, dpopHeaderSchema, dpopConfigSchema, dpopVerificationResultSchema, 
+// TEE Types
+TEEPlatform, teePlatformSchema, teeAttestationSchema, teeKeyBindingSchema, teeConfigSchema, teeVerificationResultSchema, 
+// Pairwise DID Types
+DataClassification, PairwiseDerivationAlgorithm, dataClassificationSchema, pairwiseDerivationAlgorithmSchema, pairwiseDIDConfigSchema, pairwiseDerivationSchema, 
+// Revocation Types
+RevocationStatusEnum, DEFAULT_REVOCATION_SLAS, revocationSLASchema, revocationPropagationPolicySchema, revocationPropagationSchema, revocationResultSchema, revocationStatusSchema, revocationEventSchema, DEFAULT_TOKEN_LIFETIME_CONFIG, tokenLifetimeConfigSchema, introspectionResultSchema, agentIdentitySchema, actionRequestSchema, securityContextSchema, securityValidationResultSchema, securityValidationErrorSchema, preRequestResultSchema, highValueCheckResultSchema, securityRequirementsSchema, incomingRequestSchema, securityPluginOptionsSchema, 
+// Utility Functions
+getSecurityRequirementsForTier, } from './types.js';
+// =============================================================================
+// DPoP Service
+// =============================================================================
+export { DPoPService, DPoPError, createDPoPService, } from './dpop.js';
+// =============================================================================
+// TEE Service
+// =============================================================================
+export { TEEBindingService, TEEError, TEEAttestationError, TEEKeyBindingError, createTEEBindingService, } from './tee.js';
+// =============================================================================
+// Pairwise DID Service
+// =============================================================================
+export { PairwiseDIDService, PairwiseDIDError, createPairwiseDIDService, } from './pairwise-did.js';
+// =============================================================================
+// Revocation Service
+// =============================================================================
+export { RevocationService, RevocationError, AgentRevokedError, createRevocationService, } from './revocation.js';
+// =============================================================================
+// Token Lifetime Service
+// =============================================================================
+export { TokenLifetimeService, TokenLifetimeError, TokenExpiredError, TokenTTLTooLongError, createTokenLifetimeService, HIGH_VALUE_OPERATIONS, } from './token-lifetime.js';
+// =============================================================================
+// Token Introspection Service
+// =============================================================================
+export { TokenIntrospectionService, IntrospectionError, TokenInactiveError, createTokenIntrospectionService, createMockIntrospectionService, } from './introspection.js';
+// =============================================================================
+// Security Service (Main Coordinator)
+// =============================================================================
+export { SecurityService, SecurityValidationError as SecurityServiceValidationError, createSecurityService, } from './security-service.js';
+// =============================================================================
+// Fastify Middleware
+// =============================================================================
+export { 
+// Middleware factories
+dpopMiddleware, introspectionMiddleware, revocationMiddleware, securityContextMiddleware, markHighValueOperation, requireTier, requireDPoP, 
+// Fastify plugin
+securityHardeningPlugin, } from './middleware.js';
+// =============================================================================
+// Security Configuration Validator
+// =============================================================================
+export { 
+// Audit functions
+runSecurityAudit, assertSecureConfig, getSecurityAuditSummary, 
+// Utilities
+calculateEntropy, } from './config-validator.js';
+// =============================================================================
+// Security Mode (New)
+// =============================================================================
+export { getSecurityMode, getSecurityConfig, isProductionGrade, isDevelopmentMode, requireProductionSecurity, assertSecurityCondition, isSecurityFeatureAllowed, devOnlyDefault, allowEphemeralKey, validateSecretStrength, } from '../common/security-mode.js';
+// =============================================================================
+// Session Management (New)
+// =============================================================================
+export { SessionStore, getSessionStore, createSessionStore, } from './session-store.js';
+export { SessionManager, getSessionManager, createSessionManager, extractFingerprintHeaders, } from './session-manager.js';
+// =============================================================================
+// CSRF Protection (New)
+// =============================================================================
+export { CSRFProtection, getCSRFProtection, resetCSRFProtection, } from './csrf.js';
+// =============================================================================
+// Fingerprint Service (New)
+// =============================================================================
+export { FingerprintService, getFingerprintService, resetFingerprintService, } from './fingerprint-service.js';
+// =============================================================================
+// Injection Detection (New)
+// =============================================================================
+export { InjectionDetector, createInjectionDetectionMiddleware, InjectionType, hasInjection, sanitizeInput, } from './injection-detector.js';
+// =============================================================================
+// Brute Force Protection (New)
+// =============================================================================
+export { BruteForceProtection, getBruteForceProtection, resetBruteForceProtection, createBruteForceMiddleware, } from './brute-force.js';
+// =============================================================================
+// Password Policy (New)
+// =============================================================================
+export { PasswordPolicyEngine, getPasswordPolicyEngine, resetPasswordPolicyEngine, DEFAULT_PASSWORD_POLICY, NIST_PASSWORD_POLICY, } from './password-policy.js';
+// =============================================================================
+// Key Rotation (New)
+// =============================================================================
+export { KeyRotationManager, getKeyRotationManager, resetKeyRotationManager, } from './key-rotation.js';
+// =============================================================================
+// MFA (Multi-Factor Authentication)
+// =============================================================================
+export { 
+// Types
+MfaMethod, MfaStatus, MFA_DEFAULTS, 
+// Service
+MfaService, getMfaService, resetMfaService, createMfaService, MfaError, EnrollmentExpiredError, ChallengeExpiredError, TooManyAttemptsError, 
+// Store
+MfaStore, getMfaStore, resetMfaStore, createMfaStore, 
+// Middleware
+requireMfa, mfaContextMiddleware, requireMfaEnabled, 
+// Schemas
+mfaMethodSchema, mfaStatusSchema, mfaEnrollmentResponseSchema, mfaEnrollmentCompleteResponseSchema, mfaStatusResponseSchema, mfaChallengeResponseSchema, mfaVerifyResponseSchema, mfaBackupCodesResponseSchema, mfaServiceConfigSchema, } from './mfa/index.js';
+// =============================================================================
+// Request Integrity (New)
+// =============================================================================
+export { RequestIntegrity, getRequestIntegrity, resetRequestIntegrity, createSignatureHeaders, extractSignatureFromHeaders, INTEGRITY_HEADERS, DEFAULT_REQUEST_INTEGRITY_CONFIG, } from './request-integrity.js';
+// =============================================================================
+// Secure Memory (New)
+// =============================================================================
+export { SecureString, SecureBuffer, secureEnv, requireSecureEnv, secureRandomBytes, secureCompare, secureCompareBuffers, withSecureString, withSecureStringAsync, withSecureBuffer, withSecureBufferAsync, SecureMemoryError, MissingEnvironmentError, } from './secure-memory.js';
+// =============================================================================
+// Error Sanitization (New)
+// =============================================================================
+export { ErrorSanitizer, getErrorSanitizer, resetErrorSanitizer, createErrorSanitizer, createErrorHandler, errorSanitizerPlugin, sanitizeErrorMessage, classifyError, generateSafeMessage, SENSITIVE_PATTERNS, DEFAULT_ERROR_MAPPINGS, } from './error-sanitizer.js';
+// =============================================================================
+// API Key Management
+// =============================================================================
+export { 
+// Types
+ApiKeyScope, apiKeyScopeSchema, API_KEY_SCOPES, ApiKeyStatus, apiKeyStatusSchema, apiKeyRateLimitSchema, DEFAULT_API_KEY_RATE_LIMIT, apiKeySchema, createApiKeyInputSchema, updateApiKeyInputSchema, ApiKeyValidationErrorCode, apiKeyValidationResultSchema, apiKeyListFiltersSchema, ApiKeyAuditEventType, API_KEY_PREFIX, API_KEY_PREFIX_LENGTH, API_KEY_SECRET_LENGTH, API_KEY_PATTERN, InMemoryApiKeyStore, getApiKeyStore, createApiKeyStore, resetApiKeyStore, 
+// Service
+ApiKeyService, ApiKeyError, ApiKeyValidationError, ApiKeyRateLimitError, getApiKeyService, createApiKeyService, resetApiKeyService, 
+// Middleware
+apiKeyMiddleware, requireScopes, requireReadScope, requireWriteScope, requireAdminScope, requireWebhookScope, requireIntegrationScope, apiKeyPlugin, getApiKey, getApiKeyTenantId, hasApiKey, getApiKeyScopes, } from './api-keys/index.js';
+// =============================================================================
+// Security Headers Management
+// =============================================================================
+export { 
+// Schemas
+cspSourceValueSchema, cspSandboxValueSchema, cspDirectivesSchema, cspReportingConfigSchema, hstsConfigSchema, HSTS_MIN_MAX_AGE_FOR_PRELOAD, HSTS_RECOMMENDED_MAX_AGE, corsConfigSchema, permissionsPolicyValueSchema, permissionsPolicyConfigSchema, securityHeadersConfigSchema, validationIssueSchema, headerValidationResultSchema, cspViolationReportSchema, 
+// CSP
+CSPBuilder, generateNonce, formatNonce, STRICT_CSP_PRESET, MODERATE_CSP_PRESET, RELAXED_CSP_PRESET, API_CSP_PRESET, getCSPPreset, createStrictCSP, createModerateCSP, createAPICSP, createDevelopmentCSP, buildCSPString, parseCSPString, 
+// HSTS
+HSTSManager, HSTS_HEADER_NAME, HSTS_MIN_RECOMMENDED_MAX_AGE, HSTS_MAX_SENSIBLE_MAX_AGE, createProductionHSTS, createPreloadHSTS, createDevelopmentHSTS, createHSTS, buildHSTSHeader, parseHSTSHeader, validateHSTSHeader, 
+// Permissions Policy
+PermissionsPolicyManager, PERMISSIONS_POLICY_HEADER, KNOWN_FEATURES, HIGH_RISK_FEATURES, SENSOR_FEATURES, STRICT_PERMISSIONS_PRESET, MODERATE_PERMISSIONS_PRESET, API_PERMISSIONS_PRESET, createStrictPermissionsPolicy, createModeratePermissionsPolicy, createAPIPermissionsPolicy, createPermissionsPolicy, buildPermissionsPolicyHeader, parsePermissionsPolicyHeader, getSecureDefault, 
+// Validation
+validateSecurityHeaders, assertValidSecurityHeaders, getSecurityHeadersSummary, 
+// Middleware/Plugin
+securityHeadersPlugin, createStrictSecurityHeaders, createAPISecurityHeaders, createDevelopmentSecurityHeaders, createSecurityHeaders, } from './headers/index.js';
+// =============================================================================
+// Distributed State Provider
+// =============================================================================
+export { RedisStateProvider, getRedisStateProvider, resetRedisStateProvider, createRedisStateProvider, DEFAULT_REDIS_STATE_CONFIG, } from './distributed-state.js';
+// =============================================================================
+// WebAuthn/Passkeys
+// =============================================================================
+export { 
+// Service
+WebAuthnService, WebAuthnError, WebAuthnRegistrationError, WebAuthnAuthenticationError, getWebAuthnService, createWebAuthnService, resetWebAuthnService, InMemoryWebAuthnStore, RedisWebAuthnStore, getWebAuthnStore, createWebAuthnStore, createRedisWebAuthnStore, resetWebAuthnStore, enableRedisWebAuthnStore, RegistrationErrorCode, AuthenticationErrorCode, WebAuthnAuditEventType, DEFAULT_WEBAUTHN_CONFIG, } from './webauthn/index.js';
+// =============================================================================
+// Refresh Token Service
+// =============================================================================
+export { RefreshTokenService, RefreshTokenError, TokenReuseError, RefreshTokenExpiredError, RefreshTokenRevokedError, RefreshTokenInvalidError, getRefreshTokenService, createRefreshTokenService, resetRefreshTokenService, } from './refresh-token.js';
+// =============================================================================
+// Token Lifecycle Management (Unified Revocation)
+// =============================================================================
+export { TokenLifecycleService, TokenLifecycleError, getTokenLifecycleService, createTokenLifecycleService, resetTokenLifecycleService, } from './token-lifecycle.js';
+// =============================================================================
+// Revocation Check Middleware (Bloom Filter)
+// =============================================================================
+export { RevocationCheckService, revocationCheckMiddleware, getRevocationCheckService, createRevocationCheckService, resetRevocationCheckService, } from './revocation-check.js';
+// =============================================================================
+// Security Alerting System
+// =============================================================================
+export { 
+// Enums
+AlertSeverity, AlertChannel, SecurityEventType, ConditionOperator, 
+// Schemas
+alertSeveritySchema, alertChannelSchema, securityEventTypeSchema, conditionOperatorSchema, alertContextSchema, securityAlertSchema, createAlertInputSchema, alertConditionSchema, alertThresholdSchema, channelConfigSchema, alertRuleSchema, maintenanceWindowSchema, escalationPolicySchema, alertConfigSchema, alertDeliveryResultSchema, 
+// Defaults
+DEFAULT_ALERT_CONFIG, 
+// Detector
+SecurityAlertDetector, getSecurityAlertDetector, resetSecurityAlertDetector, createSecurityAlertDetector, DEFAULT_BUILTIN_DETECTOR_CONFIG, 
+// Service
+SecurityAlertService, getSecurityAlertService, resetSecurityAlertService, createSecurityAlertService, 
+// Channels
+SlackAlertChannel, createSlackChannel, PagerDutyAlertChannel, createPagerDutyChannel, EmailAlertChannel, createEmailChannel, WebhookAlertChannel, createWebhookChannel, createSignedWebhookChannel, SNSAlertChannel, createSNSChannel, 
+// Convenience helpers
+SecurityAlerts, } from './alerting/index.js';
+// =============================================================================
+// Bot Detection (Threat Intel)
+// =============================================================================
+export { BotDetectionService, getBotDetectionService, resetBotDetectionService, botDetectionMiddleware, botDetectionPlugin, DEFAULT_BOT_DETECTION_CONFIG, } from './threat-intel/bot-detection.js';
+// =============================================================================
+// Data Loss Prevention (DLP)
+// =============================================================================
+export { 
+// Scanner class
+DLPScanner, 
+// Enums and types
+DataType, 
+// Schemas
+dlpScannerConfigSchema, 
+// Default configuration
+DEFAULT_DLP_CONFIG, 
+// Error classes
+DLPError, SensitiveDataBlockedError, DLPScanTimeoutError, 
+// Middleware
+dlpRequestScanner, dlpResponseScanner, 
+// Plugin
+dlpPlugin, 
+// Singleton management
+getDLPScanner, resetDLPScanner, createDLPScanner, } from './dlp/index.js';
+// =============================================================================
+// Service-to-Service Authentication
+// =============================================================================
+export { 
+// Service Account Types
+ServiceAccountStatus, serviceAccountSchema, createServiceAccountInputSchema, updateServiceAccountInputSchema, 
+// Service Account Errors
+ServiceAccountError, ServiceAccountNotFoundError, ServiceAccountRevokedError, ServiceAccountSuspendedError, 
+// Service Account Constants
+SERVICE_CLIENT_ID_PREFIX, 
+// Service Account Utilities
+generateClientSecret, generateClientId, hashClientSecret, verifyClientSecret, InMemoryServiceAccountStore, 
+// Service Account Manager
+ServiceAccountManager, 
+// Service Account Singletons
+getServiceAccountStore, setServiceAccountStore, getServiceAccountManager, createServiceAccountManager, resetServiceAccountSingletons, serviceTokenPayloadSchema, serviceSignatureSchema, tokenVerificationResultSchema, 
+// Service Token Errors
+ServiceTokenError, TokenExpiredError as ServiceTokenExpiredError, InvalidSignatureError, SignatureTimestampError, 
+// Service Token Constants
+DEFAULT_TOKEN_TTL_SECONDS, MAX_CLOCK_SKEW_SECONDS, MIN_TOKEN_TTL_SECONDS, MAX_TOKEN_TTL_SECONDS, SERVICE_TOKEN_ISSUER, SERVICE_AUTH_HEADERS, 
+// Service Token Service
+ServiceTokenService, serviceTokenServiceConfigSchema, 
+// Service Token Singletons
+initializeServiceTokenService, getServiceTokenService, createServiceTokenService, resetServiceTokenService, 
+// Service Token Utilities
+createServiceAuthHeaders, extractServiceIdFromBearer, 
+// Service Auth Middleware Errors
+ServiceAuthError, MissingAuthHeadersError, InvalidServiceSignatureError, IpNotAllowedError, InsufficientPermissionsError, 
+// Service Auth Middleware Factory
+createServiceAuthMiddleware, 
+// Service Auth Helper Middleware
+requireServicePermissions, requireAnyServicePermission, requireServiceTenant, 
+// Service Auth Request Helpers
+getServiceAuth, requireServiceAuth, hasServiceAuth, getServiceClientId, getServiceTenantId, getServicePermissions, serviceHasPermission, 
+// Service Auth Fastify Plugin
+serviceAuthPlugin, } from './service-auth/index.js';
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,gFAAgF;AAChF,QAAQ;AACR,gFAAgF;AAEhF,OAAO;AACL,aAAa;AACb,SAAS,EACT,eAAe;AAEf,uBAAuB;AACvB,wBAAwB,EACxB,8BAA8B,EAO9B,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,4BAA4B;AAE5B,YAAY;AACZ,WAAW,EAKX,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,2BAA2B;AAE3B,qBAAqB;AACrB,kBAAkB,EAClB,2BAA2B,EAG3B,wBAAwB,EACxB,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB;AAExB,mBAAmB;AACnB,oBAAoB,EAOpB,uBAAuB,EACvB,mBAAmB,EACnB,iCAAiC,EACjC,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EAIrB,6BAA6B,EAC7B,yBAAyB,EAIzB,yBAAyB,EAczB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,EAC9B,6BAA6B,EAC7B,sBAAsB,EACtB,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,2BAA2B;AAE3B,oBAAoB;AACpB,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AAEpB,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,OAAO,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,UAAU,CAAC;AAElB,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GAKxB,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAI1B,qBAAqB,GAEtB,MAAM,qBAAqB,CAAC;AAE7B,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,GAE/B,MAAM,oBAAoB,CAAC;AAE5B,gFAAgF;AAChF,sCAAsC;AACtC,gFAAgF;AAEhF,OAAO,EACL,eAAe,EACf,uBAAuB,IAAI,8BAA8B,EACzD,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAE/B,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,OAAO;AACL,uBAAuB;AACvB,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,WAAW,EACX,WAAW;AAEX,iBAAiB;AACjB,uBAAuB,GAKxB,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAChF,mCAAmC;AACnC,gFAAgF;AAEhF,OAAO;AAOL,kBAAkB;AAClB,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB;AAEvB,YAAY;AACZ,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,EACd,iBAAiB,EACjB,sBAAsB,GAGvB,MAAM,4BAA4B,CAAC;AAEpC,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,OAAO,EACL,YAAY,EACZ,eAAe,EACf,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,yBAAyB,GAO1B,MAAM,sBAAsB,CAAC;AAE9B,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,mBAAmB,GAIpB,MAAM,WAAW,CAAC;AAEnB,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,GAKxB,MAAM,0BAA0B,CAAC;AAElC,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF,OAAO,EACL,iBAAiB,EACjB,kCAAkC,EAClC,aAAa,EACb,YAAY,EACZ,aAAa,GAGd,MAAM,yBAAyB,CAAC;AAEjC,gFAAgF;AAChF,+BAA+B;AAC/B,gFAAgF;AAEhF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,GAI3B,MAAM,kBAAkB,CAAC;AAE1B,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GAGrB,MAAM,sBAAsB,CAAC;AAE9B,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,GAMxB,MAAM,mBAAmB,CAAC;AAE3B,gFAAgF;AAChF,oCAAoC;AACpC,gFAAgF;AAEhF,OAAO;AACL,QAAQ;AACR,SAAS,EACT,SAAS,EACT,YAAY;AAcZ,UAAU;AACV,UAAU,EACV,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,QAAQ,EACR,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB;AAEpB,QAAQ;AACR,QAAQ,EACR,WAAW,EACX,aAAa,EACb,cAAc;AAEd,aAAa;AACb,UAAU,EACV,oBAAoB,EACpB,iBAAiB;AAEjB,UAAU;AACV,eAAe,EACf,eAAe,EACf,2BAA2B,EAC3B,mCAAmC,EACnC,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,gCAAgC,GAMjC,MAAM,wBAAwB,CAAC;AAEhC,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,GAMvB,MAAM,sBAAsB,CAAC;AAE9B,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,OAAO;AACL,QAAQ;AACR,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAElB,qBAAqB,EACrB,0BAA0B,EAE1B,YAAY,EAEZ,uBAAuB,EAEvB,uBAAuB,EAEvB,yBAAyB,EACzB,4BAA4B,EAK5B,uBAAuB,EACvB,oBAAoB,EAEpB,cAAc,EACd,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EAIf,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,gBAAgB;AAEhB,UAAU;AACV,aAAa,EACb,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EAGpB,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB;AAElB,aAAa;AACb,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,YAAY,EACZ,SAAS,EACT,iBAAiB,EACjB,SAAS,EACT,eAAe,GAKhB,MAAM,qBAAqB,CAAC;AAE7B,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,OAAO;AA+BL,UAAU;AACV,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,4BAA4B,EAC5B,wBAAwB,EACxB,gBAAgB,EAChB,4BAA4B,EAC5B,6BAA6B,EAC7B,2BAA2B,EAC3B,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB;AAExB,MAAM;AACN,UAAU,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,cAAc;AAEd,OAAO;AACP,WAAW,EACX,gBAAgB,EAChB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,eAAe,EACf,eAAe,EACf,kBAAkB;AAElB,qBAAqB;AACrB,wBAAwB,EACxB,yBAAyB,EACzB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,4BAA4B,EAC5B,4BAA4B,EAC5B,gBAAgB;AAEhB,aAAa;AACb,uBAAuB,EACvB,0BAA0B,EAC1B,yBAAyB;AAEzB,oBAAoB;AACpB,qBAAqB,EACrB,2BAA2B,EAC3B,wBAAwB,EACxB,gCAAgC,EAChC,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EAMxB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAEhC,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,OAAO;AACL,UAAU;AACV,eAAe,EACf,aAAa,EACb,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EAMpB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,EAUxB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,GAQzB,MAAM,oBAAoB,CAAC;AAE5B,gFAAgF;AAChF,kDAAkD;AAClD,gFAAgF;AAEhF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,0BAA0B,GAO3B,MAAM,sBAAsB,CAAC;AAE9B,gFAAgF;AAChF,6CAA6C;AAC7C,gFAAgF;AAEhF,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,GAG5B,MAAM,uBAAuB,CAAC;AAE/B,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,OAAO;AACL,QAAQ;AACR,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,iBAAiB;AAuBjB,UAAU;AACV,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,yBAAyB;AAEzB,WAAW;AACX,oBAAoB;AAEpB,WAAW;AACX,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,2BAA2B,EAK3B,+BAA+B;AAE/B,UAAU;AACV,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B;AAG1B,WAAW;AACX,iBAAiB,EACjB,kBAAkB,EAElB,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EACjB,kBAAkB,EAElB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAE1B,eAAe,EACf,gBAAgB;AAIhB,sBAAsB;AACtB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAE7B,gFAAgF;AAChF,+BAA+B;AAC/B,gFAAgF;AAEhF,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,GAQ7B,MAAM,iCAAiC,CAAC;AAEzC,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF,OAAO;AACL,gBAAgB;AAChB,UAAU;AAEV,kBAAkB;AAClB,QAAQ;AAOR,UAAU;AACV,sBAAsB;AAEtB,wBAAwB;AACxB,kBAAkB;AAElB,gBAAgB;AAChB,QAAQ,EACR,yBAAyB,EACzB,mBAAmB;AAEnB,aAAa;AACb,iBAAiB,EACjB,kBAAkB;AAIlB,SAAS;AACT,SAAS;AAGT,uBAAuB;AACvB,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,oCAAoC;AACpC,gFAAgF;AAEhF,OAAO;AACL,wBAAwB;AACxB,oBAAoB,EAEpB,oBAAoB,EAEpB,+BAA+B,EAI/B,+BAA+B;AAE/B,yBAAyB;AACzB,mBAAmB,EACnB,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B;AAE5B,4BAA4B;AAC5B,wBAAwB;AAExB,4BAA4B;AAC5B,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAIlB,2BAA2B;AAE3B,0BAA0B;AAC1B,qBAAqB;AAGrB,6BAA6B;AAC7B,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,2BAA2B,EAC3B,6BAA6B,EAI7B,yBAAyB,EAEzB,sBAAsB,EAEtB,6BAA6B;AAG7B,uBAAuB;AACvB,iBAAiB,EACjB,iBAAiB,IAAI,wBAAwB,EAC7C,qBAAqB,EACrB,uBAAuB;AAEvB,0BAA0B;AAC1B,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB;AAEpB,wBAAwB;AACxB,mBAAmB,EAEnB,+BAA+B;AAE/B,2BAA2B;AAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB;AAExB,0BAA0B;AAC1B,wBAAwB,EACxB,0BAA0B;AAO1B,iCAAiC;AACjC,gBAAgB,EAChB,uBAAuB,EACvB,4BAA4B,EAC5B,iBAAiB,EACjB,4BAA4B;AAE5B,kCAAkC;AAClC,2BAA2B;AAE3B,iCAAiC;AACjC,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB;AAEpB,+BAA+B;AAC/B,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB;AAEpB,8BAA8B;AAC9B,iBAAiB,GAElB,MAAM,yBAAyB,CAAC"}

package/dist/security/injection-detector.d.ts

@@ -0,0 +1,375 @@
+/**
+ * Injection Detection System
+ *
+ * Comprehensive detection and prevention of injection attacks including:
+ * - SQL Injection
+ * - Cross-Site Scripting (XSS)
+ * - Command Injection
+ * - Template Injection
+ * - Path Traversal
+ * - LDAP Injection
+ * - XML Injection (XXE)
+ * - NoSQL Injection
+ *
+ * Provides configurable detection, allowlisting, and Fastify middleware integration.
+ *
+ * @packageDocumentation
+ */
+import type { FastifyPluginCallback, preHandlerHookHandler } from 'fastify';
+import { ValidationError } from '../common/validation.js';
+/**
+ * Types of injection attacks that can be detected
+ */
+export declare enum InjectionType {
+    /** SQL Injection - attacks targeting SQL databases */
+    SQL = "SQL",
+    /** Cross-Site Scripting - malicious script injection */
+    XSS = "XSS",
+    /** Command Injection - OS command execution */
+    COMMAND = "COMMAND",
+    /** Template Injection - server-side template manipulation */
+    TEMPLATE = "TEMPLATE",
+    /** Path Traversal - unauthorized file system access */
+    PATH_TRAVERSAL = "PATH_TRAVERSAL",
+    /** LDAP Injection - directory service attacks */
+    LDAP = "LDAP",
+    /** XML Injection - XML External Entity attacks */
+    XML = "XML",
+    /** NoSQL Injection - attacks targeting NoSQL databases */
+    NOSQL = "NOSQL"
+}
+/**
+ * Comprehensive regex patterns for detecting various injection attacks.
+ * Patterns are designed to minimize false positives while catching common attack vectors.
+ */
+export declare const INJECTION_PATTERNS: Record<InjectionType, RegExp[]>;
+/**
+ * Configuration options for the injection detector
+ */
+export interface InjectionDetectorConfig {
+    /** Enable SQL injection detection */
+    enableSQLDetection: boolean;
+    /** Enable XSS detection */
+    enableXSSDetection: boolean;
+    /** Enable command injection detection */
+    enableCommandDetection: boolean;
+    /** Enable template injection detection */
+    enableTemplateDetection: boolean;
+    /** Enable path traversal detection */
+    enablePathTraversalDetection: boolean;
+    /** Enable LDAP injection detection */
+    enableLDAPDetection: boolean;
+    /** Enable XML/XXE injection detection */
+    enableXMLDetection: boolean;
+    /** Enable NoSQL injection detection */
+    enableNoSQLDetection: boolean;
+    /** Custom regex patterns to check */
+    customPatterns: RegExp[];
+    /** Known safe patterns to allowlist (bypass detection) */
+    allowlist: string[];
+    /** Whether to log detection events */
+    logDetections: boolean;
+    /** Whether to block requests on detection (vs just logging) */
+    blockOnDetection: boolean;
+}
+/**
+ * Result of injection detection analysis
+ */
+export interface InjectionDetectionResult {
+    /** Whether any injection was detected */
+    detected: boolean;
+    /** Types of injections detected */
+    types: InjectionType[];
+    /** String representations of patterns that matched */
+    patterns: string[];
+    /** Sanitized version of input if sanitization was applied */
+    sanitized?: string;
+    /** Original input for reference */
+    originalInput?: string;
+    /** Timestamp of detection */
+    detectedAt?: string;
+}
+/**
+ * Options for the injection detection middleware
+ */
+export interface InjectionDetectionMiddlewareOptions {
+    /** Injection detector configuration */
+    config?: Partial<InjectionDetectorConfig>;
+    /** Paths to skip detection for */
+    skipPaths?: string[];
+    /** HTTP methods to skip */
+    skipMethods?: string[];
+    /** Whether to check query parameters */
+    checkQuery?: boolean;
+    /** Whether to check request body */
+    checkBody?: boolean;
+    /** Whether to check headers */
+    checkHeaders?: boolean;
+    /** Headers to skip checking */
+    skipHeaders?: string[];
+    /** Custom error response */
+    errorResponse?: {
+        statusCode: number;
+        code: string;
+        message: string;
+    };
+}
+/**
+ * Default injection detector configuration with all detections enabled
+ */
+export declare const DEFAULT_INJECTION_DETECTOR_CONFIG: InjectionDetectorConfig;
+/**
+ * Injection attack detector with comprehensive pattern matching
+ *
+ * Provides detection, sanitization, and allowlisting capabilities for
+ * protecting against various injection attack vectors.
+ *
+ * @example
+ * ```typescript
+ * const detector = new InjectionDetector({
+ *   enableSQLDetection: true,
+ *   enableXSSDetection: true,
+ *   logDetections: true,
+ * });
+ *
+ * const result = detector.detect("SELECT * FROM users WHERE id = '1' OR '1'='1'");
+ * if (result.detected) {
+ *   console.log('Injection detected:', result.types);
+ * }
+ * ```
+ */
+export declare class InjectionDetector {
+    private config;
+    private allowlistPatterns;
+    /**
+     * Create a new InjectionDetector instance
+     *
+     * @param config - Configuration options (merged with defaults)
+     */
+    constructor(config?: Partial<InjectionDetectorConfig>);
+    /**
+     * Detect injection attacks in an input string
+     *
+     * Checks the input against all enabled detection patterns and returns
+     * detailed information about any matches found.
+     *
+     * @param input - The string to analyze for injection patterns
+     * @returns Detection result with matched types and patterns
+     *
+     * @example
+     * ```typescript
+     * const result = detector.detect("<script>alert('xss')</script>");
+     * // result.detected === true
+     * // result.types includes InjectionType.XSS
+     * ```
+     */
+    detect(input: string): InjectionDetectionResult;
+    /**
+     * Detect injection attacks in all string values of an object
+     *
+     * Recursively traverses an object and checks all string values for
+     * injection patterns. Returns a map of field paths to detection results.
+     *
+     * @param obj - The object to analyze
+     * @param prefix - Internal prefix for tracking nested paths
+     * @returns Map of field paths to their detection results
+     *
+     * @example
+     * ```typescript
+     * const results = detector.detectInObject({
+     *   username: "admin",
+     *   query: "SELECT * FROM users",
+     *   nested: { field: "<script>xss</script>" }
+     * });
+     *
+     * for (const [field, result] of results) {
+     *   if (result.detected) {
+     *     console.log(`Injection in ${field}:`, result.types);
+     *   }
+     * }
+     * ```
+     */
+    detectInObject(obj: Record<string, unknown>, prefix?: string): Map<string, InjectionDetectionResult>;
+    /**
+     * Sanitize an input string by removing or escaping dangerous patterns
+     *
+     * Applies multiple sanitization techniques to neutralize potential
+     * injection attacks while preserving legitimate content where possible.
+     *
+     * @param input - The string to sanitize
+     * @returns Sanitized string
+     *
+     * @example
+     * ```typescript
+     * const sanitized = detector.sanitize("<script>alert('xss')</script>Hello");
+     * // sanitized === "&lt;script&gt;alert('xss')&lt;/script&gt;Hello"
+     * ```
+     */
+    sanitize(input: string): string;
+    /**
+     * Check if an input string is in the allowlist
+     *
+     * Allowlisted strings bypass injection detection entirely.
+     * Use sparingly for known-safe patterns.
+     *
+     * @param input - The string to check
+     * @returns True if the string is allowlisted
+     *
+     * @example
+     * ```typescript
+     * const detector = new InjectionDetector({
+     *   allowlist: ['SELECT count(*) FROM users']
+     * });
+     *
+     * detector.isAllowlisted('SELECT count(*) FROM users'); // true
+     * detector.isAllowlisted('SELECT * FROM users');        // false
+     * ```
+     */
+    isAllowlisted(input: string): boolean;
+    /**
+     * Add a pattern to the allowlist at runtime
+     *
+     * @param pattern - The pattern string to allowlist
+     */
+    addToAllowlist(pattern: string): void;
+    /**
+     * Add a custom detection pattern at runtime
+     *
+     * @param pattern - The regex pattern to add
+     */
+    addCustomPattern(pattern: RegExp): void;
+    /**
+     * Get the current configuration
+     *
+     * @returns Current detector configuration
+     */
+    getConfig(): InjectionDetectorConfig;
+    /**
+     * Update configuration at runtime
+     *
+     * @param updates - Partial configuration updates
+     */
+    updateConfig(updates: Partial<InjectionDetectorConfig>): void;
+}
+/**
+ * Error thrown when an injection attack is detected
+ */
+export declare class InjectionDetectedError extends ValidationError {
+    /** Types of injections detected */
+    injectionTypes: InjectionType[];
+    /** Detection result details */
+    detectionResult: InjectionDetectionResult;
+    constructor(message: string, detectionResult: InjectionDetectionResult, field?: string);
+}
+/**
+ * Fastify middleware type
+ */
+export type FastifyMiddleware = preHandlerHookHandler;
+/**
+ * Create a Fastify middleware for injection detection
+ *
+ * Automatically checks request query parameters, body, and headers
+ * for injection attacks based on configuration.
+ *
+ * @param options - Middleware configuration options
+ * @returns Fastify preHandler hook function
+ *
+ * @example
+ * ```typescript
+ * import Fastify from 'fastify';
+ * import { createInjectionDetectionMiddleware } from './injection-detector.js';
+ *
+ * const fastify = Fastify();
+ *
+ * fastify.addHook('preHandler', createInjectionDetectionMiddleware({
+ *   config: {
+ *     enableSQLDetection: true,
+ *     enableXSSDetection: true,
+ *     logDetections: true,
+ *     blockOnDetection: true,
+ *   },
+ *   skipPaths: ['/health', '/metrics'],
+ *   checkQuery: true,
+ *   checkBody: true,
+ *   checkHeaders: false,
+ * }));
+ * ```
+ */
+export declare function createInjectionDetectionMiddleware(options?: InjectionDetectionMiddlewareOptions): FastifyMiddleware;
+/**
+ * Fastify plugin options
+ */
+export interface InjectionDetectionPluginOptions extends InjectionDetectionMiddlewareOptions {
+    /** Register the detector as a request decorator */
+    decorateRequest?: boolean;
+}
+/**
+ * Fastify plugin for comprehensive injection detection
+ *
+ * Provides automatic injection detection on all routes with
+ * configurable options.
+ *
+ * @example
+ * ```typescript
+ * import Fastify from 'fastify';
+ * import { injectionDetectionPlugin } from './injection-detector.js';
+ *
+ * const fastify = Fastify();
+ *
+ * await fastify.register(injectionDetectionPlugin, {
+ *   config: {
+ *     enableSQLDetection: true,
+ *     enableXSSDetection: true,
+ *     blockOnDetection: true,
+ *   },
+ *   skipPaths: ['/health', '/metrics'],
+ * });
+ * ```
+ */
+export declare const injectionDetectionPlugin: FastifyPluginCallback<InjectionDetectionPluginOptions>;
+declare module 'fastify' {
+    interface FastifyInstance {
+        injectionDetector?: InjectionDetector;
+    }
+}
+/**
+ * Create a pre-configured detector for SQL-only detection
+ *
+ * @returns InjectionDetector configured for SQL injection only
+ */
+export declare function createSQLInjectionDetector(): InjectionDetector;
+/**
+ * Create a pre-configured detector for XSS-only detection
+ *
+ * @returns InjectionDetector configured for XSS detection only
+ */
+export declare function createXSSDetector(): InjectionDetector;
+/**
+ * Create a pre-configured detector for API security (SQL, NoSQL, Command)
+ *
+ * @returns InjectionDetector configured for common API attack vectors
+ */
+export declare function createAPISecurityDetector(): InjectionDetector;
+/**
+ * Quick check function for ad-hoc injection detection
+ *
+ * @param input - String to check
+ * @param types - Specific injection types to check (default: all)
+ * @returns True if any injection patterns are detected
+ *
+ * @example
+ * ```typescript
+ * if (hasInjection(userInput, [InjectionType.SQL, InjectionType.XSS])) {
+ *   throw new Error('Invalid input');
+ * }
+ * ```
+ */
+export declare function hasInjection(input: string, types?: InjectionType[]): boolean;
+/**
+ * Quick sanitize function for ad-hoc input sanitization
+ *
+ * @param input - String to sanitize
+ * @returns Sanitized string
+ */
+export declare function sanitizeInput(input: string): string;
+//# sourceMappingURL=injection-detector.d.ts.map