@zintrust/core 0.1.0 → 0.1.2

package/src/scripts/TemplateSync.js

@@ -4,14 +4,13 @@
  * Runs during npm run build
  */
 import { TemplateRegistry } from '../templates/TemplateRegistry.js';
+import { ensureDir, esmDirname } from '../common/index';
 import { Logger } from '../config/logger';
 import { ErrorFactory } from '../exceptions/ZintrustError';
 import * as crypto from '../node-singletons/crypto';
 import fs from '../node-singletons/fs';
-import { fileURLToPath } from '../node-singletons/url';
-import * as path from 'node:path';
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
+import * as path from '../node-singletons/path';
+const __dirname = esmDirname(import.meta.url);
 const ROOT_DIR = path.resolve(__dirname, '../../');
 /**
  * Calculate SHA1 hash of file content
@@ -48,14 +47,6 @@ function extractTemplateContent(filePath) {
         throw ErrorFactory.createTryCatchError(`Failed to extract template from: ${filePath}`, error);
     }
 }
-/**
- * Ensure directory exists, create if needed
- */
-function ensureDir(dirPath) {
-    if (!fs.existsSync(dirPath)) {
-        fs.mkdirSync(dirPath, { recursive: true });
-    }
-}
 const shouldSkipEntry = (name) => {
     return (name === 'node_modules' ||
         name === 'dist' ||
@@ -117,64 +108,28 @@ const syncProjectTemplateDir = (params) => {
     }
     return { updated, skipped, total: files.length };
 };
-/**
- * Load existing checksums from JSON file
- */
-function loadChecksums() {
-    const checksumPath = path.join(ROOT_DIR, '.template-checksums.json');
-    if (fs.existsSync(checksumPath)) {
-        try {
-            const content = fs.readFileSync(checksumPath, 'utf8');
-            return JSON.parse(content);
-        }
-        catch (error) {
-            Logger.error('Could not parse .template-checksums.json, starting fresh', error);
-            return {};
-        }
-    }
-    return {};
-}
-/**
- * Save checksums to JSON file
- */
-function saveChecksums(checksums) {
-    const checksumPath = path.join(ROOT_DIR, '.template-checksums.json');
-    fs.writeFileSync(checksumPath, JSON.stringify(checksums, null, 2));
-}
-/**
- * Main sync function
- */
-// eslint-disable-next-line @typescript-eslint/require-await
-async function syncTemplates() {
-    Logger.info('🔄 Syncing templates...\n');
-    const checksums = loadChecksums();
-    const mappings = TemplateRegistry.getMappings();
+const syncRegistryMappings = (params) => {
     let updated = 0;
     let skipped = 0;
-    for (const mapping of mappings) {
+    for (const mapping of params.mappings) {
         const basePath = path.join(ROOT_DIR, mapping.basePath);
         const templatePath = path.join(ROOT_DIR, mapping.templatePath);
-        // Check if base file exists
         if (!fs.existsSync(basePath)) {
             Logger.warn(`⚠️  Base file not found: ${mapping.basePath}`);
             continue;
         }
-        // Calculate current hash
         const currentHash = hashFile(basePath);
-        const storedHash = checksums[mapping.basePath];
-        // Check if update is needed
+        const storedHash = params.checksums[mapping.basePath];
         if (currentHash === storedHash && fs.existsSync(templatePath)) {
             Logger.info(`✓ ${mapping.description} (in sync)`);
             skipped++;
             continue;
         }
-        // Extract and write template
         try {
             const templateContent = extractTemplateContent(basePath);
             ensureDir(path.dirname(templatePath));
             fs.writeFileSync(templatePath, templateContent, 'utf8');
-            // Update checksum
-            checksums[mapping.basePath] = currentHash;
+            params.checksums[mapping.basePath] = currentHash;
             Logger.info(`✓ Updated: ${mapping.description}`);
             updated++;
         }
@@ -183,46 +138,130 @@ async function syncTemplates() {
             process.exit(1);
         }
     }
-    // Sync starter project templates (basic) from base framework folders.
-    // Spec: app/* -> app/*, src/config/* -> config/*, src/database/* -> database/*, routes/* -> routes/*
-    // plus .env (generated from .env.example with sensitive values blanked).
-    Logger.info('');
-    Logger.info('🔄 Syncing starter project templates (basic)...');
-    const projectRoot = 'src/templates/project/basic';
+    return { updated, skipped };
+};
+const syncStarterEnvTemplate = (params) => {
+    const envExampleAbs = fs.existsSync(path.join(ROOT_DIR, '.env.example'))
+        ? path.join(ROOT_DIR, '.env.example')
+        : path.join(ROOT_DIR, '.env.example.generated');
+    const envTemplateAbs = path.join(ROOT_DIR, params.projectRoot, '.env.tpl');
+    const envChecksumKey = 'starter/.env';
+    if (!fs.existsSync(envExampleAbs)) {
+        Logger.warn('⚠️  .env.example not found; skipping starter .env template generation');
+        return { updated: 0, skipped: 0, total: 1 };
+    }
+    const currentHash = hashFile(envExampleAbs);
+    const storedHash = params.checksums[envChecksumKey];
+    if (currentHash === storedHash && fs.existsSync(envTemplateAbs)) {
+        return { updated: 0, skipped: 1, total: 1 };
+    }
+    const raw = fs.readFileSync(envExampleAbs, 'utf8');
+    const lines = raw.split(/\r?\n/);
+    const rendered = lines
+        .map((line) => {
+        if (line.trim() === '' || line.startsWith('#'))
+            return line;
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            return line;
+        const key = line.slice(0, eq).trim();
+        if (key === '')
+            return line;
+        if (key === 'NODE_ENV')
+            return 'NODE_ENV=development';
+        return `${key}=`;
+    })
+        .join('\n') + '\n';
+    ensureDir(path.dirname(envTemplateAbs));
+    fs.writeFileSync(envTemplateAbs, rendered, 'utf8');
+    params.checksums[envChecksumKey] = currentHash;
+    Logger.info('✓ Starter project .env (generated)');
+    return { updated: 1, skipped: 0, total: 1 };
+};
+const syncStarterProjectTemplates = (params) => {
     const s1 = syncProjectTemplateDir({
-        checksums,
+        checksums: params.checksums,
         baseDirRel: 'app',
-        templateDirRel: `${projectRoot}/app`,
+        templateDirRel: `${params.projectRoot}/app`,
         description: 'Starter project app/*',
     });
     const s2 = syncProjectTemplateDir({
-        checksums,
+        checksums: params.checksums,
         baseDirRel: 'src/config',
-        templateDirRel: `${projectRoot}/config`,
+        templateDirRel: `${params.projectRoot}/config`,
         description: 'Starter project config/* (from src/config/*)',
     });
     const s3 = syncProjectTemplateDir({
-        checksums,
+        checksums: params.checksums,
         baseDirRel: 'src/database',
-        templateDirRel: `${projectRoot}/database`,
+        templateDirRel: `${params.projectRoot}/database`,
         description: 'Starter project database/* (from src/database/*)',
     });
     const s4 = syncProjectTemplateDir({
-        checksums,
+        checksums: params.checksums,
         baseDirRel: 'routes',
-        templateDirRel: `${projectRoot}/routes`,
+        templateDirRel: `${params.projectRoot}/routes`,
         description: 'Starter project routes/*',
     });
-    const s5 = { updated: 0, skipped: 0 };
-    updated += s1.updated + s2.updated + s3.updated + s4.updated + s5.updated;
-    skipped += s1.skipped + s2.skipped + s3.skipped + s4.skipped + s5.skipped;
+    const s5 = syncStarterEnvTemplate({
+        checksums: params.checksums,
+        projectRoot: params.projectRoot,
+    });
+    return {
+        updated: s1.updated + s2.updated + s3.updated + s4.updated + s5.updated,
+        skipped: s1.skipped + s2.skipped + s3.skipped + s4.skipped + s5.skipped,
+        total: s1.total + s2.total + s3.total + s4.total + s5.total,
+    };
+};
+/**
+ * Load existing checksums from JSON file
+ */
+function loadChecksums() {
+    const checksumPath = path.join(ROOT_DIR, '.template-checksums.json');
+    if (fs.existsSync(checksumPath)) {
+        try {
+            const content = fs.readFileSync(checksumPath, 'utf8');
+            return JSON.parse(content);
+        }
+        catch (error) {
+            Logger.error('Could not parse .template-checksums.json, starting fresh', error);
+            return {};
+        }
+    }
+    return {};
+}
+/**
+ * Save checksums to JSON file
+ */
+function saveChecksums(checksums) {
+    const checksumPath = path.join(ROOT_DIR, '.template-checksums.json');
+    fs.writeFileSync(checksumPath, JSON.stringify(checksums, null, 2));
+}
+/**
+ * Main sync function
+ */
+// eslint-disable-next-line @typescript-eslint/require-await
+async function syncTemplates() {
+    Logger.info('🔄 Syncing templates...\n');
+    const checksums = loadChecksums();
+    const mappings = TemplateRegistry.getMappings();
+    const registry = syncRegistryMappings({ checksums, mappings });
+    // Sync starter project templates (basic) from base framework folders.
+    // Spec: app/* -> app/*, src/config/* -> config/*, src/database/* -> database/*, routes/* -> routes/*
+    // plus .env (generated from .env.example with sensitive values blanked).
+    Logger.info('');
+    Logger.info('🔄 Syncing starter project templates (basic)...');
+    const projectRoot = 'src/templates/project/basic';
+    const starter = syncStarterProjectTemplates({ checksums, projectRoot });
     // Save updated checksums
     saveChecksums(checksums);
     // Summary
+    const updated = registry.updated + starter.updated;
+    const skipped = registry.skipped + starter.skipped;
     Logger.info(`\n📦 Template sync complete`);
     Logger.info(`   Updated: ${updated}`);
     Logger.info(`   Skipped: ${skipped}`);
-    Logger.info(`   Total: ${mappings.length + s1.total + s2.total + s3.total + s4.total}\n`);
+    Logger.info(`   Total: ${mappings.length + starter.total}\n`);
 }
 // Run sync
 try {

package/src/security/CsrfTokenManager.js

@@ -3,7 +3,7 @@
  * Generate, validate, and bind CSRF tokens to sessions
  */
 import { Env } from '../config/env';
-import { randomBytes } from 'node:crypto';
+import { randomBytes } from '../node-singletons/crypto';
 /**
  * Create a new CSRF token manager instance
  */

package/src/security/Encryptor.js

@@ -4,7 +4,7 @@
  */
 import { Logger } from '../config/logger';
 import { ErrorFactory } from '../exceptions/ZintrustError';
-import { pbkdf2Sync, randomBytes } from 'node:crypto';
+import { pbkdf2Sync, randomBytes } from '../node-singletons/crypto';
 function isBcryptModule(value) {
     if (typeof value !== 'object' || value === null)
         return false;

package/src/security/Hash.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Hash
+ * bcrypt-based password hashing utility.
+ *
+ * Runtime-aware: uses dynamic import for bcrypt.
+ */
+export declare const Hash: Readonly<{
+    isValidHash(hash: string): boolean;
+    hash(plaintext: string): Promise<string>;
+    hashWithRounds(plaintext: string, rounds: number): Promise<string>;
+    verify(plaintext: string, hashed: string): Promise<boolean>;
+}>;
+export default Hash;
+//# sourceMappingURL=Hash.d.ts.map

package/src/security/Hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Hash.d.ts","sourceRoot":"","sources":["../../../src/security/Hash.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA+CH,eAAO,MAAM,IAAI;sBACG,MAAM,GAAG,OAAO;oBAIZ,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;8BAUd,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;sBAgBhD,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;EAWjE,CAAC;AAEH,eAAe,IAAI,CAAC"}

package/src/security/Hash.js

@@ -0,0 +1,81 @@
+/**
+ * Hash
+ * bcrypt-based password hashing utility.
+ *
+ * Runtime-aware: uses dynamic import for bcrypt.
+ */
+import { Logger } from '../config/logger';
+import { ErrorFactory } from '../exceptions/ZintrustError';
+function isBcryptModule(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const record = value;
+    return typeof record['hash'] === 'function' && typeof record['compare'] === 'function';
+}
+let bcrypt;
+let loadingPromise;
+async function loadBcrypt() {
+    const imported = await import('bcrypt');
+    const module = imported;
+    const candidate = module.default ?? module;
+    if (!isBcryptModule(candidate)) {
+        throw ErrorFactory.createConfigError('Invalid bcrypt module shape');
+    }
+    bcrypt = candidate;
+}
+async function ensureBcrypt() {
+    if (bcrypt !== undefined)
+        return bcrypt;
+    loadingPromise ??= loadBcrypt().catch((error) => {
+        Logger.error('bcrypt unavailable', error);
+        throw ErrorFactory.createConfigError('bcrypt unavailable', error);
+    });
+    await loadingPromise;
+    if (bcrypt === undefined) {
+        throw ErrorFactory.createConfigError('bcrypt unavailable');
+    }
+    return bcrypt;
+}
+const BCRYPT_HASH_RE = /^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/;
+export const Hash = Object.freeze({
+    isValidHash(hash) {
+        return BCRYPT_HASH_RE.test(hash);
+    },
+    async hash(plaintext) {
+        const bcryptModule = await ensureBcrypt();
+        try {
+            return await bcryptModule.hash(plaintext, 12);
+        }
+        catch (error) {
+            Logger.error('Password hashing failed', error);
+            throw ErrorFactory.createSecurityError('Password hashing failed', error);
+        }
+    },
+    async hashWithRounds(plaintext, rounds) {
+        const bcryptModule = await ensureBcrypt();
+        const normalizedRounds = Number.isFinite(rounds) ? Math.trunc(rounds) : 0;
+        if (normalizedRounds <= 0) {
+            throw ErrorFactory.createConfigError('Invalid bcrypt rounds', { rounds });
+        }
+        try {
+            return await bcryptModule.hash(plaintext, normalizedRounds);
+        }
+        catch (error) {
+            Logger.error('Password hashing failed', error);
+            throw ErrorFactory.createSecurityError('Password hashing failed', error);
+        }
+    },
+    async verify(plaintext, hashed) {
+        if (!Hash.isValidHash(hashed))
+            return false;
+        try {
+            const bcryptModule = await ensureBcrypt();
+            return await bcryptModule.compare(plaintext, hashed);
+        }
+        catch (error) {
+            Logger.error('Password verify failed', error);
+            return false;
+        }
+    },
+});
+export default Hash;

package/src/security/StartupSecretValidation.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Startup Secret Validation
+ *
+ * Validates critical secrets early at boot time so production misconfiguration
+ * fails fast and predictably.
+ */
+export type StartupSecretValidationError = {
+    key: string;
+    message: string;
+};
+export type StartupSecretValidationResult = {
+    valid: boolean;
+    errors: StartupSecretValidationError[];
+};
+export declare const StartupSecretValidation: Readonly<{
+    validate(): StartupSecretValidationResult;
+    assertValid(): void;
+}>;
+export default StartupSecretValidation;
+//# sourceMappingURL=StartupSecretValidation.d.ts.map

package/src/security/StartupSecretValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StartupSecretValidation.d.ts","sourceRoot":"","sources":["../../../src/security/StartupSecretValidation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,MAAM,MAAM,4BAA4B,GAAG;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,4BAA4B,EAAE,CAAC;CACxC,CAAC;AA6BF,eAAO,MAAM,uBAAuB;gBACtB,6BAA6B;mBAe1B,IAAI;EAQnB,CAAC;AAEH,eAAe,uBAAuB,CAAC"}

package/src/security/StartupSecretValidation.js

@@ -0,0 +1,61 @@
+/**
+ * Startup Secret Validation
+ *
+ * Validates critical secrets early at boot time so production misconfiguration
+ * fails fast and predictably.
+ */
+import { appConfig } from '../config/app';
+import { securityConfig } from '../config/security';
+import { startupConfig } from '../config/startup';
+import { ErrorFactory } from '../exceptions/ZintrustError';
+const validateApiKeySecret = () => {
+    if (!securityConfig.apiKey.enabled)
+        return null;
+    const secret = (securityConfig.apiKey.secret ?? '').trim();
+    if (secret.length > 0)
+        return null;
+    return {
+        key: 'API_KEY_SECRET',
+        message: 'API_KEY_SECRET must be set when API key auth is enabled',
+    };
+};
+const validateJwtSecret = () => {
+    if (!securityConfig.jwt.enabled)
+        return null;
+    try {
+        const secret = securityConfig.jwt.secret.trim();
+        if (secret.length === 0) {
+            return { key: 'JWT_SECRET', message: 'JWT_SECRET must be set when JWT is enabled' };
+        }
+        return null;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        return { key: 'JWT_SECRET', message };
+    }
+};
+export const StartupSecretValidation = Object.freeze({
+    validate() {
+        if (!startupConfig.validateSecrets)
+            return { valid: true, errors: [] };
+        if (!appConfig.isProduction())
+            return { valid: true, errors: [] };
+        const errors = [];
+        const jwtError = validateJwtSecret();
+        if (jwtError !== null)
+            errors.push(jwtError);
+        const apiKeyError = validateApiKeySecret();
+        if (apiKeyError !== null)
+            errors.push(apiKeyError);
+        return { valid: errors.length === 0, errors };
+    },
+    assertValid() {
+        const result = StartupSecretValidation.validate();
+        if (result.valid)
+            return;
+        throw ErrorFactory.createConfigError('Invalid startup secret configuration', {
+            errors: result.errors,
+        });
+    },
+});
+export default StartupSecretValidation;

package/src/security/UrlValidator.d.ts

@@ -3,7 +3,6 @@
  * Mitigates SSRF (SonarQube S5144)
  */
 export interface IUrlValidator {
-    validate(url: string, allowedDomains?: string[]): void;
     validateUrl(url: string, allowedDomains?: string[]): void;
 }
 /**

package/src/security/UrlValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UrlValidator.d.ts","sourceRoot":"","sources":["../../../src/security/UrlValidator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvD,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC3D;AAED;;;GAGG;AACH,QAAA,MAAM,QAAQ,GAAI,KAAK,MAAM,EAAE,iBAAgB,MAAM,EAA+B,KAAG,IAyBtF,CAAC;AAEF,QAAA,MAAM,WAAW,GAAI,KAAK,MAAM,EAAE,iBAAiB,MAAM,EAAE,KAAG,IAE7D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,aAGzB,CAAC;AAGH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"UrlValidator.d.ts","sourceRoot":"","sources":["../../../src/security/UrlValidator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC3D;AAED;;;GAGG;AACH,QAAA,MAAM,QAAQ,GAAI,KAAK,MAAM,EAAE,iBAAgB,MAAM,EAA+B,KAAG,IAyBtF,CAAC;AAEF,QAAA,MAAM,WAAW,GAAI,KAAK,MAAM,EAAE,iBAAiB,MAAM,EAAE,KAAG,IAE7D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,aAGzB,CAAC;AAGH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC"}

package/src/security/UrlValidator.js

@@ -2,7 +2,6 @@
  * Security Utilities
  * Mitigates SSRF (SonarQube S5144)
  */
-import { Env } from '../config/env';
 import { ErrorFactory } from '../exceptions/ZintrustError';
 /**
  * Validate URL for SSRF protection
@@ -15,7 +14,7 @@ const validate = (url, allowedDomains = ['localhost', '127.0.0.1']) => {
         // In a real microservices environment, we would check against a service registry
         // For now, we allow localhost and any domain in the allowed list
         const isAllowed = allowedDomains.some((domain) => hostname === domain || hostname.endsWith(`.${domain}`));
-        if (!isAllowed && Env.NODE_ENV === 'production') {
+        if (!isAllowed) {
             throw ErrorFactory.createValidationError(`URL hostname '${hostname}' is not allowed (SSRF Protection)`, { hostname });
         }
     }

package/src/security/Xss.d.ts

@@ -0,0 +1,14 @@
+/**
+ * XSS Sanitizer
+ * Recursive, zero-dependency input sanitization utility.
+ *
+ * This is intentionally conservative:
+ * - Strings: strip tags, then escape HTML entities.
+ * - Arrays/Objects: sanitize recursively.
+ */
+export interface IXss {
+    sanitize(input: unknown): unknown;
+}
+export declare const Xss: IXss;
+export default Xss;
+//# sourceMappingURL=Xss.d.ts.map

package/src/security/Xss.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Xss.d.ts","sourceRoot":"","sources":["../../../src/security/Xss.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwDH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CACnC;AAED,eAAO,MAAM,GAAG,EAAE,IAIhB,CAAC;AAEH,eAAe,GAAG,CAAC"}

package/src/security/Xss.js

@@ -0,0 +1,57 @@
+/**
+ * XSS Sanitizer
+ * Recursive, zero-dependency input sanitization utility.
+ *
+ * This is intentionally conservative:
+ * - Strings: strip tags, then escape HTML entities.
+ * - Arrays/Objects: sanitize recursively.
+ */
+import { XssProtection } from './XssProtection';
+const stripTags = (value) => {
+    // Remove all HTML tags in linear time (no regex backtracking / ReDoS risk).
+    let out = '';
+    let inTag = false;
+    for (const element of value) {
+        const ch = element;
+        if (ch === '<') {
+            inTag = true;
+            continue;
+        }
+        if (inTag) {
+            if (ch === '>')
+                inTag = false;
+            continue;
+        }
+        out += ch;
+    }
+    return out;
+};
+const sanitizeRecursive = (input, seen) => {
+    if (typeof input === 'string') {
+        return XssProtection.escape(stripTags(input));
+    }
+    if (Array.isArray(input)) {
+        if (seen.has(input))
+            return input;
+        seen.add(input);
+        return input.map((item) => sanitizeRecursive(item, seen));
+    }
+    if (typeof input === 'object' && input !== null) {
+        const obj = input;
+        if (seen.has(obj))
+            return input;
+        seen.add(obj);
+        const out = {};
+        for (const [key, value] of Object.entries(obj)) {
+            out[key] = sanitizeRecursive(value, seen);
+        }
+        return out;
+    }
+    return input;
+};
+export const Xss = Object.freeze({
+    sanitize(input) {
+        return sanitizeRecursive(input, new WeakSet());
+    },
+});
+export default Xss;

package/src/security/XssProtection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"XssProtection.d.ts","sourceRoot":"","sources":["../../../src/security/XssProtection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAyIH;;GAEG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,OAAO,KAAG,MAGzC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,cAO1B,CAAC"}
+{"version":3,"file":"XssProtection.d.ts","sourceRoot":"","sources":["../../../src/security/XssProtection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoSH;;GAEG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,OAAO,KAAG,MAGzC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,cAO1B,CAAC"}