fullshield 0.4.0 → 1.0.1

package/dist/runtime/fastify.js

@@ -1,579 +1 @@
-// src/runtime/dlp/index.ts
-var DLP_FLAG = "FULLSHIELD_EXPERIMENTAL_DLP";
-var DLP_MAX_BYTES = 64 * 1024;
-var DLP_GENERIC = { error: "internal error" };
-var SECRET_RES = [
-  /\bAKIA[0-9A-Z]{16}\b/g,
-  /\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/g,
-  /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b/g,
-  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
-  /\bAIza[0-9A-Za-z_-]{35}\b/g,
-  /\bsk-ant-[A-Za-z0-9_-]{16,}\b|\bsk-[A-Za-z0-9_-]{20,}\b/g,
-  /-----BEGIN (?:[A-Z]+ )*PRIVATE KEY-----/g,
-  /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|amqp):\/\/[^\s'"@/:]+:[^\s'"@]+@/g
-];
-var STACK_RE = /(?:Error|Exception|TypeError|ReferenceError|SyntaxError|RangeError)[^\n]{0,240}(?:\n|\r\n|\\n)[ \t]*at[ \t]+\S+[^\n]{0,320}(?:\n|\r\n|\\n)[ \t]*at[ \t]+/g;
-var INTERNAL_IP_RE = /\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})\b/g;
-var HOST_TLDS = [".internal", ".corp", ".lan", ".local"];
-var BULK_EMAILS = 5;
-var PII_LEARN = 2;
-var REDACT = "[REDACTED]";
-var EMPTY_HITS = [];
-function isDlpEnabled() {
-  return process.env[DLP_FLAG] === "1";
-}
-function allMatches(re, text) {
-  re.lastIndex = 0;
-  return [...text.matchAll(re)];
-}
-function maskSample(value) {
-  if (value.length <= 4) return "****";
-  return `${value.slice(0, 4)}****`.slice(0, 40);
-}
-function luhnOk(digits) {
-  if (digits.length < 13 || digits.length > 19) return false;
-  const first = digits.charCodeAt(0) - 48;
-  if (first < 3 || first > 6) return false;
-  if (digits.split("").every((c) => c === digits[0])) return false;
-  let sum = 0;
-  let alt = false;
-  for (let i = digits.length - 1; i >= 0; i -= 1) {
-    let n = digits.charCodeAt(i) - 48;
-    if (alt) {
-      n *= 2;
-      if (n > 9) n -= 9;
-    }
-    sum += n;
-    alt = !alt;
-  }
-  return sum % 10 === 0;
-}
-var SECRET_MARKERS = [
-  "AKIA",
-  "sk_",
-  "ghp_",
-  "gho_",
-  "ghu_",
-  "ghs_",
-  "ghr_",
-  "xox",
-  "AIza",
-  "sk-",
-  "BEGIN ",
-  "postgres",
-  "mysql",
-  "mariadb",
-  "mongodb",
-  "redis",
-  "amqp"
-];
-function hasAny(text, markers) {
-  for (const m of markers) {
-    if (text.includes(m)) return true;
-  }
-  return false;
-}
-function collectSpans(text) {
-  const spans = [];
-  if (hasAny(text, SECRET_MARKERS)) {
-    for (const re of SECRET_RES) {
-      for (const m of allMatches(re, text)) {
-        if (m[0] === void 0 || m.index === void 0) continue;
-        if (re.source.includes("postgres") && /\$\{|^<[^>]+>$|^\{[^}]+\}$/.test(m[0])) continue;
-        spans.push({ start: m.index, end: m.index + m[0].length, ruleId: "DLP-SECRET-001", text: m[0] });
-      }
-    }
-  }
-  if (text.includes(" at ") || text.includes("Error") || text.includes("Exception")) {
-    for (const m of allMatches(STACK_RE, text)) {
-      if (m[0] === void 0 || m.index === void 0) continue;
-      spans.push({ start: m.index, end: m.index + m[0].length, ruleId: "DLP-STACK-001", text: m[0] });
-    }
-  }
-  if (/\d/.test(text)) {
-    for (const m of allMatches(INTERNAL_IP_RE, text)) {
-      if (m[0] === void 0 || m.index === void 0) continue;
-      spans.push({ start: m.index, end: m.index + m[0].length, ruleId: "DLP-INTERNAL-001", text: m[0] });
-    }
-    spans.push(...findCards(text));
-  }
-  if (text.includes("localhost") || text.includes("LOCALHOST")) {
-    spans.push(...findLocalhost(text));
-  }
-  if (text.includes(".internal") || text.includes(".corp") || text.includes(".lan") || text.includes(".local") || text.includes(".INTERNAL") || text.includes(".CORP") || text.includes(".LAN") || text.includes(".LOCAL")) {
-    spans.push(...findInternalHosts(text));
-  }
-  return spans;
-}
-function isWord(c) {
-  return c !== void 0 && /[A-Za-z0-9-]/.test(c);
-}
-function findIgnoreCase(hay, needle, from) {
-  const n = needle.length;
-  outer: for (let i = from; i <= hay.length - n; i += 1) {
-    for (let j = 0; j < n; j += 1) {
-      const a = hay.charCodeAt(i + j);
-      const b = needle.charCodeAt(j);
-      if (a !== b && a !== b - 32 && a !== b + 32) continue outer;
-    }
-    return i;
-  }
-  return -1;
-}
-function findLocalhost(text) {
-  const spans = [];
-  let from = 0;
-  while (from < text.length) {
-    const idx = findIgnoreCase(text, "localhost", from);
-    if (idx < 0) break;
-    if (!isWord(text[idx - 1]) && !isWord(text[idx + 9])) {
-      spans.push({ start: idx, end: idx + 9, ruleId: "DLP-INTERNAL-001", text: text.slice(idx, idx + 9) });
-    }
-    from = idx + 9;
-  }
-  return spans;
-}
-function findInternalHosts(text) {
-  const spans = [];
-  for (const tld of HOST_TLDS) {
-    let from = 0;
-    while (from < text.length) {
-      const idx = findIgnoreCase(text, tld, from);
-      if (idx < 0) break;
-      let start = idx - 1;
-      while (start >= 0 && /[A-Za-z0-9.-]/.test(text[start] ?? "")) start -= 1;
-      start += 1;
-      const label = text.slice(start, idx).toLowerCase();
-      const end = idx + tld.length;
-      if (label.length > 0 && /^[a-z0-9-]+(?:\.[a-z0-9-]+)*$/.test(label) && !isWord(text[end])) {
-        spans.push({ start, end, ruleId: "DLP-INTERNAL-001", text: text.slice(start, end) });
-      }
-      from = idx + tld.length;
-    }
-  }
-  return spans;
-}
-function findCards(text) {
-  const spans = [];
-  let i = 0;
-  while (i < text.length) {
-    const code = text.charCodeAt(i);
-    if (code < 48 || code > 57) {
-      i += 1;
-      continue;
-    }
-    let j = i;
-    let digits = "";
-    while (j < text.length) {
-      const c = text.charCodeAt(j);
-      if (c >= 48 && c <= 57) {
-        digits += text[j] ?? "";
-        j += 1;
-      } else if (c === 32 || c === 9 || c === 45) {
-        j += 1;
-      } else {
-        break;
-      }
-    }
-    if (luhnOk(digits)) {
-      spans.push({ start: i, end: j, ruleId: "DLP-CARD-001", text: text.slice(i, j) });
-    }
-    i = j > i ? j : i + 1;
-  }
-  return spans;
-}
-function findEmails(text) {
-  const spans = [];
-  let from = 0;
-  while (from < text.length) {
-    const at = text.indexOf("@", from);
-    if (at < 0) break;
-    let start = at - 1;
-    while (start >= 0 && /[A-Za-z0-9._%+-]/.test(text[start] ?? "")) start -= 1;
-    start += 1;
-    let end = at + 1;
-    while (end < text.length && /[A-Za-z0-9.-]/.test(text[end] ?? "")) end += 1;
-    const local = text.slice(start, at);
-    const domain = text.slice(at + 1, end);
-    const dot = domain.lastIndexOf(".");
-    const tld = dot > 0 ? domain.slice(dot + 1) : "";
-    if (local.length >= 1 && local.length <= 64 && domain.length >= 3 && domain.length <= 255 && /^[A-Za-z]{2,24}$/.test(tld)) {
-      spans.push({ start, end, ruleId: "DLP-PII-001", text: text.slice(start, end) });
-    }
-    from = at + 1;
-  }
-  return spans;
-}
-function countEmails(text) {
-  if (!text.includes("@")) return { count: 0, spans: [] };
-  const spans = findEmails(text);
-  return { count: spans.length, spans };
-}
-function redact(text, spans) {
-  const ordered = [...spans].sort((a, b) => b.start - a.start);
-  let out = text;
-  const taken = [];
-  for (const s of ordered) {
-    if (taken.some(([a, b]) => s.start < b && s.end > a)) continue;
-    taken.push([s.start, s.end]);
-    out = `${out.slice(0, s.start)}${REDACT}${out.slice(s.end)}`;
-  }
-  return out;
-}
-function uniqueHits(spans) {
-  const seen = /* @__PURE__ */ new Set();
-  const hits = [];
-  for (const s of spans) {
-    if (seen.has(s.ruleId)) continue;
-    seen.add(s.ruleId);
-    hits.push({ ruleId: s.ruleId, sample: maskSample(s.text) });
-  }
-  return hits;
-}
-function toText(body) {
-  if (body === null || body === void 0) return void 0;
-  if (typeof body === "string") return { text: body, kind: "string" };
-  if (typeof body === "number" || typeof body === "boolean") return { text: String(body), kind: "string" };
-  if (typeof Buffer !== "undefined" && Buffer.isBuffer(body)) return void 0;
-  try {
-    return { text: JSON.stringify(body), kind: "json" };
-  } catch {
-    return void 0;
-  }
-}
-function createDlpInspector(options = {}) {
-  if (!isDlpEnabled() || options.dlp === void 0) return void 0;
-  const mode = options.dlp.mode;
-  const maxBytes = options.dlp.maxBytes ?? DLP_MAX_BYTES;
-  const routes = /* @__PURE__ */ new Map();
-  let skipped = 0;
-  const inspect = (body, ctx) => {
-    const ct = ctx.contentType ?? "";
-    if (ct.length > 0 && !/json|text|javascript|xml/i.test(ct)) {
-      return { action: "allow", body, hits: [], skippedOverCap: false };
-    }
-    const serialized = toText(body);
-    if (serialized === void 0) {
-      return { action: "allow", body, hits: [], skippedOverCap: false };
-    }
-    if (serialized.text.length > maxBytes) {
-      skipped += 1;
-      return { action: "skip", body, hits: [], skippedOverCap: true };
-    }
-    const spans = collectSpans(serialized.text);
-    const emails = countEmails(serialized.text);
-    let pii = routes.get(ctx.path);
-    if (pii === void 0) {
-      pii = { samples: 0, seenLow: false, seenHigh: false };
-      routes.set(ctx.path, pii);
-    }
-    if (pii.samples < PII_LEARN) {
-      pii.samples += 1;
-      if (emails.count <= 1) pii.seenLow = true;
-      if (emails.count >= BULK_EMAILS) pii.seenHigh = true;
-    } else if (pii.seenLow && !pii.seenHigh && emails.count >= BULK_EMAILS) {
-      spans.push(...emails.spans);
-    }
-    const hits = uniqueHits(spans);
-    if (hits.length === 0) {
-      return { action: "allow", body, hits: EMPTY_HITS, skippedOverCap: false };
-    }
-    const ip = ctx.ip ?? "unknown";
-    for (const hit of hits) {
-      const event = { ruleId: hit.ruleId, path: ctx.path, ip, sample: hit.sample };
-      options.onEvent?.(event);
-    }
-    if (mode === "monitor") {
-      return { action: "allow", body, hits, skippedOverCap: false };
-    }
-    if (mode === "block") {
-      return { action: "block", body: { ...DLP_GENERIC }, hits, skippedOverCap: false };
-    }
-    const maskedText = redact(serialized.text, spans);
-    let masked = maskedText;
-    if (serialized.kind === "json") {
-      try {
-        masked = JSON.parse(maskedText);
-      } catch {
-        masked = maskedText;
-      }
-    }
-    return { action: "mask", body: masked, hits, skippedOverCap: false };
-  };
-  const api = inspect;
-  Object.defineProperty(api, "inspect", { value: inspect });
-  Object.defineProperty(api, "skippedOverCap", { get: () => skipped });
-  return api;
-}
-function applyDlpWrite(dlp, body, ctx) {
-  const result = dlp.inspect(body, ctx);
-  return { body: result.body, block: result.action === "block" };
-}
-
-// src/runtime/signatures.ts
-var SQLI = /('\s*or\s+'?1'?\s*='?1)|union\s+select|;\s*drop\s+table|;\s*delete\s+from/i;
-var XSS = /<\s*script\b|javascript:\s*|onerror\s*=/i;
-var PATH = /(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\\)/i;
-function flattenValues(value, out = [], depth = 0) {
-  if (depth > 8 || out.length > 200) return out;
-  if (typeof value === "string") {
-    out.push(value);
-    return out;
-  }
-  if (Array.isArray(value)) {
-    for (const item of value) flattenValues(item, out, depth + 1);
-    return out;
-  }
-  if (value !== null && typeof value === "object") {
-    for (const item of Object.values(value)) {
-      flattenValues(item, out, depth + 1);
-    }
-  }
-  return out;
-}
-function detectAttack(text) {
-  if (PATH.test(text)) return "path";
-  if (XSS.test(text)) return "xss";
-  if (SQLI.test(text)) return "sqli";
-  return void 0;
-}
-function inspectValues(values) {
-  for (const value of values) {
-    const hit = detectAttack(value);
-    if (hit !== void 0) return hit;
-  }
-  return void 0;
-}
-
-// src/runtime/lru.ts
-var LruMap = class {
-  constructor(max) {
-    this.max = max;
-    if (max < 1) throw new Error("LruMap max must be >= 1");
-  }
-  max;
-  map = /* @__PURE__ */ new Map();
-  get size() {
-    return this.map.size;
-  }
-  has(key) {
-    return this.map.has(key);
-  }
-  get(key) {
-    if (!this.map.has(key)) return void 0;
-    const value = this.map.get(key);
-    this.map.delete(key);
-    this.map.set(key, value);
-    return value;
-  }
-  set(key, value) {
-    if (this.map.has(key)) this.map.delete(key);
-    this.map.set(key, value);
-    while (this.map.size > this.max) {
-      const oldest = this.map.keys().next().value;
-      if (oldest === void 0) break;
-      this.map.delete(oldest);
-    }
-    return this;
-  }
-};
-
-// src/runtime/rateLimit.ts
-var DEFAULT_MAX_KEYS = 1e4;
-function createRateLimiter(options) {
-  const maxKeys = options.maxKeys ?? DEFAULT_MAX_KEYS;
-  const hits = new LruMap(maxKeys);
-  return {
-    allow(key, now = Date.now()) {
-      const windowStart = now - options.windowMs;
-      const prev = hits.get(key);
-      if (prev === void 0) {
-        hits.set(key, [now]);
-        return true;
-      }
-      let keep = 0;
-      for (let i = 0; i < prev.length; i += 1) {
-        const t = prev[i];
-        if (t !== void 0 && t > windowStart) {
-          prev[keep] = t;
-          keep += 1;
-        }
-      }
-      prev.length = keep;
-      if (prev.length >= options.max) {
-        hits.set(key, prev);
-        return false;
-      }
-      prev.push(now);
-      hits.set(key, prev);
-      return true;
-    },
-    get size() {
-      return hits.size;
-    },
-    get maxKeys() {
-      return maxKeys;
-    }
-  };
-}
-
-// src/runtime/inspect.ts
-var RULE = {
-  sqli: "RUNTIME-SQLI-001",
-  xss: "RUNTIME-XSS-001",
-  path: "RUNTIME-PATH-001"
-};
-function bodyStats(value, depth = 0) {
-  if (value === null || value === void 0) return { bytes: 0, depth, keys: 0 };
-  if (typeof value === "string") return { bytes: value.length, depth, keys: 0 };
-  if (typeof value === "number" || typeof value === "boolean") {
-    return { bytes: String(value).length, depth, keys: 0 };
-  }
-  if (typeof value !== "object") return { bytes: 0, depth, keys: 0 };
-  const entries = Object.entries(value);
-  let bytes = 2;
-  let keys = entries.length;
-  let maxDepth = depth;
-  for (const [k, v] of entries) {
-    bytes += k.length;
-    const inner = bodyStats(v, depth + 1);
-    bytes += inner.bytes;
-    keys += inner.keys;
-    if (inner.depth > maxDepth) maxDepth = inner.depth;
-  }
-  return { bytes, depth: maxDepth, keys };
-}
-var DEFAULT_MAX_ROUTES = 1e3;
-var DEFAULT_MAX_PARAM_NAMES = 200;
-function keysOf(value) {
-  if (value === null || value === void 0 || typeof value !== "object") return [];
-  return Object.keys(value);
-}
-function createInspector(options = {}) {
-  const mode = options.mode ?? "monitor";
-  const authRoutes = new Set(options.authRoutes ?? ["/login"]);
-  const limiter = createRateLimiter(options.rateLimit ?? { windowMs: 6e4, max: 20 });
-  const maxBodyBytes = options.maxBodyBytes ?? 1e6;
-  const maxBodyDepth = options.maxBodyDepth ?? 8;
-  const maxBodyKeys = options.maxBodyKeys ?? 200;
-  const anomaly = options.anomaly;
-  const maxRoutes = anomaly?.maxRoutes ?? DEFAULT_MAX_ROUTES;
-  const maxParamNames = anomaly?.maxParamNames ?? DEFAULT_MAX_PARAM_NAMES;
-  const routes = new LruMap(maxRoutes);
-  let windowStart;
-  const inspect = ((req) => {
-    const path = req.path ?? req.url?.split("?")[0] ?? "/";
-    const ip = req.ip ?? "unknown";
-    const emit = (ruleId, sample, shouldBlock) => {
-      const event = { ruleId, path, ip, sample: sample.slice(0, 40) };
-      options.onEvent?.(event);
-      if (shouldBlock) options.onBlock?.(event);
-      return { block: shouldBlock, event };
-    };
-    if (authRoutes.has(path) && !limiter.allow(`${ip}:${path}`)) {
-      return emit("RUNTIME-RATELIMIT-001", path, mode === "block");
-    }
-    const stats = bodyStats(req.body);
-    if (stats.bytes > maxBodyBytes || stats.depth > maxBodyDepth || stats.keys > maxBodyKeys) {
-      return emit("RUNTIME-BODY-001", "oversized-body", mode === "block");
-    }
-    const values = [
-      ...flattenValues(req.query),
-      ...flattenValues(req.body),
-      ...flattenValues(req.params)
-    ];
-    const kind = inspectValues(values);
-    if (kind !== void 0) {
-      return emit(RULE[kind], kind, mode === "block");
-    }
-    if (anomaly !== void 0) {
-      const now = anomaly.now ?? Date.now;
-      const t = now();
-      if (windowStart === void 0) windowStart = t;
-      const learning = t - windowStart < anomaly.learnMinutes * 6e4;
-      let baseline = routes.get(path);
-      if (baseline === void 0) {
-        baseline = {
-          count: 0,
-          bodySum: 0,
-          paramNames: new LruMap(maxParamNames),
-          status401: 0,
-          status404: 0,
-          recent404: 0
-        };
-        routes.set(path, baseline);
-      }
-      const names = [...keysOf(req.query), ...keysOf(req.body), ...keysOf(req.params)];
-      const status = req.statusCode;
-      if (learning) {
-        baseline.count += 1;
-        baseline.bodySum += stats.bytes;
-        for (const n of names) baseline.paramNames.set(n, true);
-        if (status === 401) baseline.status401 += 1;
-        if (status === 404) baseline.status404 += 1;
-      } else {
-        const newParam = names.some((n) => !baseline.paramNames.has(n));
-        const spike401 = status === 401 && baseline.status401 === 0 && baseline.count > 0;
-        if (status === 404) baseline.recent404 += 1;
-        else baseline.recent404 = 0;
-        const burst404 = baseline.recent404 >= 3 && baseline.status404 === 0 && baseline.count > 0;
-        if (newParam || spike401 || burst404) {
-          const event = {
-            ruleId: "RUNTIME-ANOMALY-001",
-            path,
-            ip,
-            sample: newParam ? "new-param" : spike401 ? "401-spike" : "404-burst"
-          };
-          anomaly.onAnomaly?.(event);
-          options.onEvent?.(event);
-          return { block: false, event };
-        }
-      }
-    }
-    return { block: false };
-  });
-  Object.defineProperty(inspect, "limiterSize", { get: () => limiter.size });
-  Object.defineProperty(inspect, "routeCount", { get: () => routes.size });
-  inspect.paramCount = (path) => routes.get(path)?.paramNames.size ?? 0;
-  return inspect;
-}
-
-// src/runtime/fastify.ts
-function shieldGuard(options = {}) {
-  const inspect = createInspector(options);
-  const dlp = createDlpInspector(options);
-  return function fullshieldFastify(instance, _opts, done) {
-    instance.addHook("preHandler", (req, reply, next) => {
-      const result = inspect({
-        method: req.method,
-        url: req.url,
-        path: req.url?.split("?")[0],
-        ip: req.ip,
-        query: req.query,
-        body: req.body,
-        params: req.params,
-        headers: req.headers
-      });
-      if (result.block) {
-        reply.code(403).send({ error: "blocked", ruleId: result.event?.ruleId });
-        return;
-      }
-      next();
-    });
-    if (dlp !== void 0) {
-      instance.addHook("onSend", (req, reply, payload, sendDone) => {
-        const path = req.url?.split("?")[0] ?? "/";
-        const out = applyDlpWrite(dlp, payload, { path, ip: req.ip });
-        if (out.block) {
-          reply.code(500);
-          sendDone?.(null, JSON.stringify({ error: "internal error" }));
-          return;
-        }
-        sendDone?.(null, typeof out.body === "string" ? out.body : JSON.stringify(out.body));
-      });
-    }
-    done();
-  };
-}
-
-export { shieldGuard };
+var U="FULLSHIELD_EXPERIMENTAL_DLP";var Z={error:"internal error"},F=[/\bAKIA[0-9A-Z]{16}\b/g,/\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/g,/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b/g,/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,/\bAIza[0-9A-Za-z_-]{35}\b/g,/\bsk-ant-[A-Za-z0-9_-]{16,}\b|\bsk-[A-Za-z0-9_-]{20,}\b/g,/-----BEGIN (?:[A-Z]+ )*PRIVATE KEY-----/g,/\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|amqp):\/\/[^\s'"@/:]+:[^\s'"@]+@/g],$=/(?:Error|Exception|TypeError|ReferenceError|SyntaxError|RangeError)[^\n]{0,240}(?:\n|\r\n|\\n)[ \t]*at[ \t]+\S+[^\n]{0,320}(?:\n|\r\n|\\n)[ \t]*at[ \t]+/g,V=/\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})\b/g,X=[".internal",".corp",".lan",".local"],N=5,Y=2,q="[REDACTED]",J=[];function W(){return process.env[U]==="1"}function D(n,e){return n.lastIndex=0,[...e.matchAll(n)]}function Q(n){return n.length<=4?"****":`${n.slice(0,4)}****`.slice(0,40)}function nn(n){if(n.length<13||n.length>19)return  false;let e=n.charCodeAt(0)-48;if(e<3||e>6||n.split("").every(r=>r===n[0]))return  false;let t=0,s=false;for(let r=n.length-1;r>=0;r-=1){let o=n.charCodeAt(r)-48;s&&(o*=2,o>9&&(o-=9)),t+=o,s=!s;}return t%10===0}var en=["AKIA","sk_","ghp_","gho_","ghu_","ghs_","ghr_","xox","AIza","sk-","BEGIN ","postgres","mysql","mariadb","mongodb","redis","amqp"];function tn(n,e){for(let t of e)if(n.includes(t))return  true;return  false}function sn(n){let e=[];if(tn(n,en))for(let t of F)for(let s of D(t,n))s[0]===void 0||s.index===void 0||t.source.includes("postgres")&&/\$\{|^<[^>]+>$|^\{[^}]+\}$/.test(s[0])||e.push({start:s.index,end:s.index+s[0].length,ruleId:"DLP-SECRET-001",text:s[0]});if(n.includes(" at ")||n.includes("Error")||n.includes("Exception"))for(let t of D($,n))t[0]===void 0||t.index===void 0||e.push({start:t.index,end:t.index+t[0].length,ruleId:"DLP-STACK-001",text:t[0]});if(/\d/.test(n)){for(let t of D(V,n))t[0]===void 0||t.index===void 0||e.push({start:t.index,end:t.index+t[0].length,ruleId:"DLP-INTERNAL-001",text:t[0]});e.push(...an(n));}return (n.includes("localhost")||n.includes("LOCALHOST"))&&e.push(...rn(n)),(n.includes(".internal")||n.includes(".corp")||n.includes(".lan")||n.includes(".local")||n.includes(".INTERNAL")||n.includes(".CORP")||n.includes(".LAN")||n.includes(".LOCAL"))&&e.push(...on(n)),e}function O(n){return n!==void 0&&/[A-Za-z0-9-]/.test(n)}function M(n,e,t){let s=e.length;n:for(let r=t;r<=n.length-s;r+=1){for(let o=0;o<s;o+=1){let a=n.charCodeAt(r+o),i=e.charCodeAt(o);if(a!==i&&a!==i-32&&a!==i+32)continue n}return r}return  -1}function rn(n){let e=[],t=0;for(;t<n.length;){let s=M(n,"localhost",t);if(s<0)break;!O(n[s-1])&&!O(n[s+9])&&e.push({start:s,end:s+9,ruleId:"DLP-INTERNAL-001",text:n.slice(s,s+9)}),t=s+9;}return e}function on(n){let e=[];for(let t of X){let s=0;for(;s<n.length;){let r=M(n,t,s);if(r<0)break;let o=r-1;for(;o>=0&&/[A-Za-z0-9.-]/.test(n[o]??"");)o-=1;o+=1;let a=n.slice(o,r).toLowerCase(),i=r+t.length;a.length>0&&/^[a-z0-9-]+(?:\.[a-z0-9-]+)*$/.test(a)&&!O(n[i])&&e.push({start:o,end:i,ruleId:"DLP-INTERNAL-001",text:n.slice(o,i)}),s=r+t.length;}}return e}function an(n){let e=[],t=0;for(;t<n.length;){let s=n.charCodeAt(t);if(s<48||s>57){t+=1;continue}let r=t,o="";for(;r<n.length;){let a=n.charCodeAt(r);if(a>=48&&a<=57)o+=n[r]??"",r+=1;else if(a===32||a===9||a===45)r+=1;else break}nn(o)&&e.push({start:t,end:r,ruleId:"DLP-CARD-001",text:n.slice(t,r)}),t=r>t?r:t+1;}return e}function un(n){let e=[],t=0;for(;t<n.length;){let s=n.indexOf("@",t);if(s<0)break;let r=s-1;for(;r>=0&&/[A-Za-z0-9._%+-]/.test(n[r]??"");)r-=1;r+=1;let o=s+1;for(;o<n.length&&/[A-Za-z0-9.-]/.test(n[o]??"");)o+=1;let a=n.slice(r,s),i=n.slice(s+1,o),u=i.lastIndexOf("."),p=u>0?i.slice(u+1):"";a.length>=1&&a.length<=64&&i.length>=3&&i.length<=255&&/^[A-Za-z]{2,24}$/.test(p)&&e.push({start:r,end:o,ruleId:"DLP-PII-001",text:n.slice(r,o)}),t=s+1;}return e}function cn(n){if(!n.includes("@"))return {count:0,spans:[]};let e=un(n);return {count:e.length,spans:e}}function ln(n,e){let t=[...e].sort((o,a)=>a.start-o.start),s=n,r=[];for(let o of t)r.some(([a,i])=>o.start<i&&o.end>a)||(r.push([o.start,o.end]),s=`${s.slice(0,o.start)}${q}${s.slice(o.end)}`);return s}function dn(n){let e=new Set,t=[];for(let s of n)e.has(s.ruleId)||(e.add(s.ruleId),t.push({ruleId:s.ruleId,sample:Q(s.text)}));return t}function pn(n){if(n!=null){if(typeof n=="string")return {text:n,kind:"string"};if(typeof n=="number"||typeof n=="boolean")return {text:String(n),kind:"string"};if(!(typeof Buffer<"u"&&Buffer.isBuffer(n)))try{return {text:JSON.stringify(n),kind:"json"}}catch{return}}}function P(n={}){if(!W()||n.dlp===void 0)return;let e=n.dlp.mode,t=n.dlp.maxBytes??65536,s=new Map,r=0,o=(i,u)=>{let p=u.contentType??"";if(p.length>0&&!/json|text|javascript|xml/i.test(p))return {action:"allow",body:i,hits:[],skippedOverCap:false};let d=pn(i);if(d===void 0)return {action:"allow",body:i,hits:[],skippedOverCap:false};if(d.text.length>t)return r+=1,{action:"skip",body:i,hits:[],skippedOverCap:true};let g=sn(d.text),f=cn(d.text),c=s.get(u.path);c===void 0&&(c={samples:0,seenLow:false,seenHigh:false},s.set(u.path,c)),c.samples<Y?(c.samples+=1,f.count<=1&&(c.seenLow=true),f.count>=N&&(c.seenHigh=true)):c.seenLow&&!c.seenHigh&&f.count>=N&&g.push(...f.spans);let m=dn(g);if(m.length===0)return {action:"allow",body:i,hits:J,skippedOverCap:false};let E=u.ip??"unknown";for(let A of m){let w={ruleId:A.ruleId,path:u.path,ip:E,sample:A.sample};n.onEvent?.(w);}if(e==="monitor")return {action:"allow",body:i,hits:m,skippedOverCap:false};if(e==="block")return {action:"block",body:{...Z},hits:m,skippedOverCap:false};let b=ln(d.text,g),h=b;if(d.kind==="json")try{h=JSON.parse(b);}catch{h=b;}return {action:"mask",body:h,hits:m,skippedOverCap:false}},a=o;return Object.defineProperty(a,"inspect",{value:o}),Object.defineProperty(a,"skippedOverCap",{get:()=>r}),a}function z(n,e,t){let s=n.inspect(e,t);return {body:s.body,block:s.action==="block"}}var fn=/('\s*or\s+'?1'?\s*='?1)|union\s+select|;\s*drop\s+table|;\s*delete\s+from/i,mn=/<\s*script\b|javascript:\s*|onerror\s*=/i,gn=/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\\)/i;function k(n,e=[],t=0){if(t>8||e.length>200)return e;if(typeof n=="string")return e.push(n),e;if(Array.isArray(n)){for(let s of n)k(s,e,t+1);return e}if(n!==null&&typeof n=="object")for(let s of Object.values(n))k(s,e,t+1);return e}function hn(n){if(gn.test(n))return "path";if(mn.test(n))return "xss";if(fn.test(n))return "sqli"}function B(n){for(let e of n){let t=hn(e);if(t!==void 0)return t}}var y=class{constructor(e){this.max=e;if(e<1)throw new Error("LruMap max must be >= 1")}max;map=new Map;get size(){return this.map.size}has(e){return this.map.has(e)}get(e){if(!this.map.has(e))return;let t=this.map.get(e);return this.map.delete(e),this.map.set(e,t),t}set(e,t){for(this.map.has(e)&&this.map.delete(e),this.map.set(e,t);this.map.size>this.max;){let s=this.map.keys().next().value;if(s===void 0)break;this.map.delete(s);}return this}};var bn=1e4;function K(n){let e=n.maxKeys??bn,t=new y(e);return {allow(s,r=Date.now()){let o=r-n.windowMs,a=t.get(s);if(a===void 0)return t.set(s,[r]),true;let i=0;for(let u=0;u<a.length;u+=1){let p=a[u];p!==void 0&&p>o&&(a[i]=p,i+=1);}return a.length=i,a.length>=n.max?(t.set(s,a),false):(a.push(r),t.set(s,a),true)},get size(){return t.size},get maxKeys(){return e}}}var yn={sqli:"RUNTIME-SQLI-001",xss:"RUNTIME-XSS-001",path:"RUNTIME-PATH-001"};function G(n,e=0){if(n==null)return {bytes:0,depth:e,keys:0};if(typeof n=="string")return {bytes:n.length,depth:e,keys:0};if(typeof n=="number"||typeof n=="boolean")return {bytes:String(n).length,depth:e,keys:0};if(typeof n!="object")return {bytes:0,depth:e,keys:0};let t=Object.entries(n),s=2,r=t.length,o=e;for(let[a,i]of t){s+=a.length;let u=G(i,e+1);s+=u.bytes,r+=u.keys,u.depth>o&&(o=u.depth);}return {bytes:s,depth:o,keys:r}}var kn=1e3,En=200;function _(n){return n==null||typeof n!="object"?[]:Object.keys(n)}function H(n={}){let e=n.mode??"monitor",t=new Set(n.authRoutes??["/login"]),s=K(n.rateLimit??{windowMs:6e4,max:20}),r=n.maxBodyBytes??1e6,o=n.maxBodyDepth??8,a=n.maxBodyKeys??200,i=n.anomaly,u=i?.maxRoutes??kn,p=i?.maxParamNames??En,d=new y(u),g,f=(c=>{let m=c.path??c.url?.split("?")[0]??"/",E=c.ip??"unknown",b=(T,R,S)=>{let l={ruleId:T,path:m,ip:E,sample:R.slice(0,40)};return n.onEvent?.(l),S&&n.onBlock?.(l),{block:S,event:l}};if(t.has(m)&&!s.allow(`${E}:${m}`))return b("RUNTIME-RATELIMIT-001",m,e==="block");let h=G(c.body);if(h.bytes>r||h.depth>o||h.keys>a)return b("RUNTIME-BODY-001","oversized-body",e==="block");let A=[...k(c.query),...k(c.body),...k(c.params)],w=B(A);if(w!==void 0)return b(yn[w],w,e==="block");if(i!==void 0){let R=(i.now??Date.now)();g===void 0&&(g=R);let S=R-g<i.learnMinutes*6e4,l=d.get(m);l===void 0&&(l={count:0,bodySum:0,paramNames:new y(p),status401:0,status404:0,recent404:0},d.set(m,l));let v=[..._(c.query),..._(c.body),..._(c.params)],x=c.statusCode;if(S){l.count+=1,l.bodySum+=h.bytes;for(let L of v)l.paramNames.set(L,true);x===401&&(l.status401+=1),x===404&&(l.status404+=1);}else {let L=v.some(I=>!l.paramNames.has(I)),C=x===401&&l.status401===0&&l.count>0;x===404?l.recent404+=1:l.recent404=0;let j=l.recent404>=3&&l.status404===0&&l.count>0;if(L||C||j){let I={ruleId:"RUNTIME-ANOMALY-001",path:m,ip:E,sample:L?"new-param":C?"401-spike":"404-burst"};return i.onAnomaly?.(I),n.onEvent?.(I),{block:false,event:I}}}}return {block:false}});return Object.defineProperty(f,"limiterSize",{get:()=>s.size}),Object.defineProperty(f,"routeCount",{get:()=>d.size}),f.paramCount=c=>d.get(c)?.paramNames.size??0,f}function vn(n={}){let e=H(n),t=P(n);return function(r,o,a){r.addHook("preHandler",(i,u,p)=>{let d=e({method:i.method,url:i.url,path:i.url?.split("?")[0],ip:i.ip,query:i.query,body:i.body,params:i.params,headers:i.headers});if(d.block){u.code(403).send({error:"blocked",ruleId:d.event?.ruleId});return}p();}),t!==void 0&&r.addHook("onSend",(i,u,p,d)=>{let g=i.url?.split("?")[0]??"/",f=z(t,p,{path:g,ip:i.ip});if(f.block){u.code(500),d?.(null,JSON.stringify({error:"internal error"}));return}d?.(null,typeof f.body=="string"?f.body:JSON.stringify(f.body));}),a();}}export{vn as shieldGuard};