mitigator 1.0.0

package/dist/bin/mitigator-audit.js

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+import {
+  __require,
+  scanForSecrets
+} from "../chunk-TT2DUALY.js";
+
+// src/bin/mitigator-audit.ts
+import { readFileSync, readdirSync, statSync } from "fs";
+import { join, extname } from "path";
+var findFiles = (dir, fileList = []) => {
+  try {
+    const files = readdirSync(dir);
+    for (const file of files) {
+      if (file === "node_modules" || file === ".git" || file === "dist" || file === "coverage")
+        continue;
+      const filePath = join(dir, file);
+      const stat = statSync(filePath);
+      if (stat.isDirectory()) {
+        findFiles(filePath, fileList);
+      } else {
+        const ext = extname(file);
+        if ([".js", ".ts", ".json", ".env", ".yml", ".yaml"].includes(ext)) {
+          fileList.push(filePath);
+        }
+      }
+    }
+  } catch {
+  }
+  return fileList;
+};
+var auditFile = (filePath) => {
+  const result = { filePath, vulnerabilities: [] };
+  try {
+    const content = readFileSync(filePath, "utf8");
+    const ext = extname(filePath);
+    if (ext !== ".json") {
+      const lines = content.split(/\r?\n/);
+      lines.forEach((line, idx) => {
+        if (scanForSecrets(line)) {
+          result.vulnerabilities.push({
+            type: "Hardcoded Secret",
+            severity: "HIGH",
+            message: `Potential plaintext API key or credential leak detected.`,
+            line: idx + 1
+          });
+        }
+      });
+    }
+    if (ext === ".js" || ext === ".ts") {
+      const traversalRegex = /fs\.(readFileSync|writeFileSync|readFile|writeFile)\(.*req\.(query|body|params)\./;
+      if (traversalRegex.test(content)) {
+        result.vulnerabilities.push({
+          type: "Potential Path Traversal",
+          severity: "HIGH",
+          message: "Direct user input passed to a file system operation without path lock validation."
+        });
+      }
+      if (content.includes("Object.assign(") || content.includes("JSON.parse(")) {
+        if (!content.includes("safeMerge") && !content.includes("safeJson") && !content.includes("lockdownPrototypes")) {
+          result.vulnerabilities.push({
+            type: "Prototype Pollution Risk",
+            severity: "MEDIUM",
+            message: "Raw JSON parsing or object assignment used without Prototype Pollution defense."
+          });
+        }
+      }
+      if (content.includes("express()") && !content.includes("presets.expressMiddleware") && !content.includes("helmet")) {
+        result.vulnerabilities.push({
+          type: "Missing Security Headers",
+          severity: "MEDIUM",
+          message: "Express application instance created but no security middleware preset detected."
+        });
+      }
+    }
+  } catch {
+  }
+  return result;
+};
+var runAudit = (targetDir = ".") => {
+  const files = findFiles(targetDir);
+  const results = [];
+  for (const file of files) {
+    const res = auditFile(file);
+    if (res.vulnerabilities.length > 0) {
+      results.push(res);
+    }
+  }
+  return results;
+};
+var main = () => {
+  const args = process.argv.slice(2);
+  const target = args[0] || ".";
+  console.log(
+    `\u{1F6E1}\uFE0F  Mitigator Security Audit: Scanning [${target}] for vulnerabilities and configuration drifts...
+`
+  );
+  const results = runAudit(target);
+  let totalHigh = 0;
+  let totalMedium = 0;
+  if (results.length === 0) {
+    console.log("\u2705 No security vulnerabilities or drifts found. Keep up the high standard!");
+    process.exit(0);
+  }
+  results.forEach((res) => {
+    console.log(`\u{1F4C2} File: ${res.filePath}`);
+    res.vulnerabilities.forEach((vuln) => {
+      const color = vuln.severity === "HIGH" ? "\x1B[31m[HIGH]\x1B[0m" : "\x1B[33m[MEDIUM]\x1B[0m";
+      if (vuln.severity === "HIGH") totalHigh++;
+      if (vuln.severity === "MEDIUM") totalMedium++;
+      const lineStr = vuln.line ? ` (line ${vuln.line})` : "";
+      console.log(`  ${color} ${vuln.type}: ${vuln.message}${lineStr}`);
+    });
+    console.log("");
+  });
+  console.log(
+    `\u{1F4CA} Audit Summary: Found ${totalHigh} HIGH and ${totalMedium} MEDIUM severity alerts.`
+  );
+  if (totalHigh > 0) {
+    console.log(
+      "\x1B[31m\u274C Audit Failed: Critical vulnerabilities must be resolved before merging.\x1B[0m"
+    );
+    process.exit(1);
+  } else {
+    console.log("\x1B[32m\u26A0\uFE0F  Audit Passed with warnings.\x1B[0m");
+    process.exit(0);
+  }
+};
+if (typeof __require !== "undefined" && __require.main === module || process.argv[1] && (process.argv[1].endsWith("mitigator-audit") || process.argv[1].endsWith("mitigator-audit.js") || process.argv[1].endsWith("mitigator-audit.ts"))) {
+  main();
+}
+export {
+  main,
+  runAudit
+};
+//# sourceMappingURL=mitigator-audit.js.map

package/dist/bin/mitigator-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/bin/mitigator-audit.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { readFileSync, readdirSync, statSync } from 'node:fs';\nimport { join, extname } from 'node:path';\nimport { scanForSecrets } from '../validate/index.js';\n\ninterface AuditResult {\n  filePath: string;\n  vulnerabilities: {\n    type: string;\n    severity: 'HIGH' | 'MEDIUM' | 'LOW';\n    message: string;\n    line?: number;\n  }[];\n}\n\nconst findFiles = (dir: string, fileList: string[] = []): string[] => {\n  try {\n    const files = readdirSync(dir);\n    for (const file of files) {\n      if (file === 'node_modules' || file === '.git' || file === 'dist' || file === 'coverage')\n        continue;\n      const filePath = join(dir, file);\n      const stat = statSync(filePath);\n      if (stat.isDirectory()) {\n        findFiles(filePath, fileList);\n      } else {\n        const ext = extname(file);\n        if (['.js', '.ts', '.json', '.env', '.yml', '.yaml'].includes(ext)) {\n          fileList.push(filePath);\n        }\n      }\n    }\n  } catch {}\n  return fileList;\n};\n\nconst auditFile = (filePath: string): AuditResult => {\n  const result: AuditResult = { filePath, vulnerabilities: [] };\n  try {\n    const content = readFileSync(filePath, 'utf8');\n    const ext = extname(filePath);\n\n    // 1. Plaintext Secret Scanning\n    if (ext !== '.json') {\n      const lines = content.split(/\\r?\\n/);\n      lines.forEach((line, idx) => {\n        if (scanForSecrets(line)) {\n          result.vulnerabilities.push({\n            type: 'Hardcoded Secret',\n            severity: 'HIGH',\n            message: `Potential plaintext API key or credential leak detected.`,\n            line: idx + 1,\n          });\n        }\n      });\n    }\n\n    // 2. Dangerous File Sync / Path Traversal\n    if (ext === '.js' || ext === '.ts') {\n      const traversalRegex =\n        /fs\\.(readFileSync|writeFileSync|readFile|writeFile)\\(.*req\\.(query|body|params)\\./;\n      if (traversalRegex.test(content)) {\n        result.vulnerabilities.push({\n          type: 'Potential Path Traversal',\n          severity: 'HIGH',\n          message:\n            'Direct user input passed to a file system operation without path lock validation.',\n        });\n      }\n\n      // 3. Unsafe Merging without prototype check\n      if (content.includes('Object.assign(') || content.includes('JSON.parse(')) {\n        if (\n          !content.includes('safeMerge') &&\n          !content.includes('safeJson') &&\n          !content.includes('lockdownPrototypes')\n        ) {\n          result.vulnerabilities.push({\n            type: 'Prototype Pollution Risk',\n            severity: 'MEDIUM',\n            message:\n              'Raw JSON parsing or object assignment used without Prototype Pollution defense.',\n          });\n        }\n      }\n\n      // 4. Missing secure headers in standard http/express setups\n      if (\n        content.includes('express()') &&\n        !content.includes('presets.expressMiddleware') &&\n        !content.includes('helmet')\n      ) {\n        result.vulnerabilities.push({\n          type: 'Missing Security Headers',\n          severity: 'MEDIUM',\n          message:\n            'Express application instance created but no security middleware preset detected.',\n        });\n      }\n    }\n  } catch {}\n  return result;\n};\n\nexport const runAudit = (targetDir: string = '.'): AuditResult[] => {\n  const files = findFiles(targetDir);\n  const results: AuditResult[] = [];\n  for (const file of files) {\n    const res = auditFile(file);\n    if (res.vulnerabilities.length > 0) {\n      results.push(res);\n    }\n  }\n  return results;\n};\n\n// Main Execution\nexport const main = () => {\n  const args = process.argv.slice(2);\n  const target = args[0] || '.';\n  console.log(\n    `🛡️  Mitigator Security Audit: Scanning [${target}] for vulnerabilities and configuration drifts...\\n`,\n  );\n\n  const results = runAudit(target);\n  let totalHigh = 0;\n  let totalMedium = 0;\n\n  if (results.length === 0) {\n    console.log('✅ No security vulnerabilities or drifts found. Keep up the high standard!');\n    process.exit(0);\n  }\n\n  results.forEach((res) => {\n    console.log(`📂 File: ${res.filePath}`);\n    res.vulnerabilities.forEach((vuln) => {\n      const color = vuln.severity === 'HIGH' ? '\\x1b[31m[HIGH]\\x1b[0m' : '\\x1b[33m[MEDIUM]\\x1b[0m';\n      if (vuln.severity === 'HIGH') totalHigh++;\n      if (vuln.severity === 'MEDIUM') totalMedium++;\n      const lineStr = vuln.line ? ` (line ${vuln.line})` : '';\n      console.log(`  ${color} ${vuln.type}: ${vuln.message}${lineStr}`);\n    });\n    console.log('');\n  });\n\n  console.log(\n    `📊 Audit Summary: Found ${totalHigh} HIGH and ${totalMedium} MEDIUM severity alerts.`,\n  );\n  if (totalHigh > 0) {\n    console.log(\n      '\\x1b[31m❌ Audit Failed: Critical vulnerabilities must be resolved before merging.\\x1b[0m',\n    );\n    process.exit(1);\n  } else {\n    console.log('\\x1b[32m⚠️  Audit Passed with warnings.\\x1b[0m');\n    process.exit(0);\n  }\n};\n\n// Only execute when run directly\n/* v8 ignore next 11 */\nif (\n  (typeof require !== 'undefined' && require.main === module) ||\n  (process.argv[1] &&\n    (process.argv[1].endsWith('mitigator-audit') ||\n      process.argv[1].endsWith('mitigator-audit.js') ||\n      process.argv[1].endsWith('mitigator-audit.ts')))\n) {\n  main();\n}\n"],"mappings":";;;;;;;AACA,SAAS,cAAc,aAAa,gBAAgB;AACpD,SAAS,MAAM,eAAe;AAa9B,IAAM,YAAY,CAAC,KAAa,WAAqB,CAAC,MAAgB;AACpE,MAAI;AACF,UAAM,QAAQ,YAAY,GAAG;AAC7B,eAAW,QAAQ,OAAO;AACxB,UAAI,SAAS,kBAAkB,SAAS,UAAU,SAAS,UAAU,SAAS;AAC5E;AACF,YAAM,WAAW,KAAK,KAAK,IAAI;AAC/B,YAAM,OAAO,SAAS,QAAQ;AAC9B,UAAI,KAAK,YAAY,GAAG;AACtB,kBAAU,UAAU,QAAQ;AAAA,MAC9B,OAAO;AACL,cAAM,MAAM,QAAQ,IAAI;AACxB,YAAI,CAAC,OAAO,OAAO,SAAS,QAAQ,QAAQ,OAAO,EAAE,SAAS,GAAG,GAAG;AAClE,mBAAS,KAAK,QAAQ;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AAEA,IAAM,YAAY,CAAC,aAAkC;AACnD,QAAM,SAAsB,EAAE,UAAU,iBAAiB,CAAC,EAAE;AAC5D,MAAI;AACF,UAAM,UAAU,aAAa,UAAU,MAAM;AAC7C,UAAM,MAAM,QAAQ,QAAQ;AAG5B,QAAI,QAAQ,SAAS;AACnB,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,CAAC,MAAM,QAAQ;AAC3B,YAAI,eAAe,IAAI,GAAG;AACxB,iBAAO,gBAAgB,KAAK;AAAA,YAC1B,MAAM;AAAA,YACN,UAAU;AAAA,YACV,SAAS;AAAA,YACT,MAAM,MAAM;AAAA,UACd,CAAC;AAAA,QACH;AAAA,MACF,CAAC;AAAA,IACH;AAGA,QAAI,QAAQ,SAAS,QAAQ,OAAO;AAClC,YAAM,iBACJ;AACF,UAAI,eAAe,KAAK,OAAO,GAAG;AAChC,eAAO,gBAAgB,KAAK;AAAA,UAC1B,MAAM;AAAA,UACN,UAAU;AAAA,UACV,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AAGA,UAAI,QAAQ,SAAS,gBAAgB,KAAK,QAAQ,SAAS,aAAa,GAAG;AACzE,YACE,CAAC,QAAQ,SAAS,WAAW,KAC7B,CAAC,QAAQ,SAAS,UAAU,KAC5B,CAAC,QAAQ,SAAS,oBAAoB,GACtC;AACA,iBAAO,gBAAgB,KAAK;AAAA,YAC1B,MAAM;AAAA,YACN,UAAU;AAAA,YACV,SACE;AAAA,UACJ,CAAC;AAAA,QACH;AAAA,MACF;AAGA,UACE,QAAQ,SAAS,WAAW,KAC5B,CAAC,QAAQ,SAAS,2BAA2B,KAC7C,CAAC,QAAQ,SAAS,QAAQ,GAC1B;AACA,eAAO,gBAAgB,KAAK;AAAA,UAC1B,MAAM;AAAA,UACN,UAAU;AAAA,UACV,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AAEO,IAAM,WAAW,CAAC,YAAoB,QAAuB;AAClE,QAAM,QAAQ,UAAU,SAAS;AACjC,QAAM,UAAyB,CAAC;AAChC,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,UAAU,IAAI;AAC1B,QAAI,IAAI,gBAAgB,SAAS,GAAG;AAClC,cAAQ,KAAK,GAAG;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AACT;AAGO,IAAM,OAAO,MAAM;AACxB,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,QAAM,SAAS,KAAK,CAAC,KAAK;AAC1B,UAAQ;AAAA,IACN,wDAA4C,MAAM;AAAA;AAAA,EACpD;AAEA,QAAM,UAAU,SAAS,MAAM;AAC/B,MAAI,YAAY;AAChB,MAAI,cAAc;AAElB,MAAI,QAAQ,WAAW,GAAG;AACxB,YAAQ,IAAI,gFAA2E;AACvF,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,UAAQ,QAAQ,CAAC,QAAQ;AACvB,YAAQ,IAAI,mBAAY,IAAI,QAAQ,EAAE;AACtC,QAAI,gBAAgB,QAAQ,CAAC,SAAS;AACpC,YAAM,QAAQ,KAAK,aAAa,SAAS,0BAA0B;AACnE,UAAI,KAAK,aAAa,OAAQ;AAC9B,UAAI,KAAK,aAAa,SAAU;AAChC,YAAM,UAAU,KAAK,OAAO,UAAU,KAAK,IAAI,MAAM;AACrD,cAAQ,IAAI,KAAK,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,OAAO,GAAG,OAAO,EAAE;AAAA,IAClE,CAAC;AACD,YAAQ,IAAI,EAAE;AAAA,EAChB,CAAC;AAED,UAAQ;AAAA,IACN,kCAA2B,SAAS,aAAa,WAAW;AAAA,EAC9D;AACA,MAAI,YAAY,GAAG;AACjB,YAAQ;AAAA,MACN;AAAA,IACF;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB,OAAO;AACL,YAAQ,IAAI,0DAAgD;AAC5D,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;AAIA,IACG,OAAO,cAAY,eAAe,UAAQ,SAAS,UACnD,QAAQ,KAAK,CAAC,MACZ,QAAQ,KAAK,CAAC,EAAE,SAAS,iBAAiB,KACzC,QAAQ,KAAK,CAAC,EAAE,SAAS,oBAAoB,KAC7C,QAAQ,KAAK,CAAC,EAAE,SAAS,oBAAoB,IACjD;AACA,OAAK;AACP;","names":[]}

package/dist/chunk-TT2DUALY.js

@@ -0,0 +1,123 @@
+var __defProp = Object.defineProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/validate/index.ts
+var validate_exports = {};
+__export(validate_exports, {
+  SECRET_PATTERNS: () => SECRET_PATTERNS,
+  checkPwnedPassword: () => checkPwnedPassword,
+  enforceSchema: () => enforceSchema,
+  hasInjectionPattern: () => hasInjectionPattern,
+  isEmail: () => isEmail,
+  isType: () => isType,
+  isWeakPassword: () => isWeakPassword,
+  scanForSecrets: () => scanForSecrets
+});
+import { createHash } from "crypto";
+import * as https from "https";
+var checkPwnedPassword = (password) => {
+  return new Promise((resolve) => {
+    const hash = createHash("sha1").update(password).digest("hex").toUpperCase();
+    const prefix = hash.slice(0, 5);
+    const suffix = hash.slice(5);
+    https.get(`https://api.pwnedpasswords.com/range/${prefix}`, (res) => {
+      let data = "";
+      res.on("data", (chunk) => data += chunk);
+      res.on("end", () => {
+        const lines = data.split("\n");
+        for (const line of lines) {
+          const [hashSuffix, count] = line.split(":");
+          if (hashSuffix === suffix) {
+            return resolve({ count: Number.parseInt(count.trim()), apiAvailable: true });
+          }
+        }
+        resolve({ count: 0, apiAvailable: true });
+      });
+    }).on("error", (err) => {
+      console.error("Mitigator: HIBP API connection error.", err);
+      resolve({ count: 0, apiAvailable: false });
+    });
+  });
+};
+var SECRET_PATTERNS = [
+  /AKIA[0-9A-Z]{16}/,
+  /-----BEGIN (RSA|OPENSSH|EC|PGP) PRIVATE KEY-----/,
+  /ghp_[a-zA-Z0-9]{36}/,
+  /sk_live_[a-zA-Z0-9]{24}/
+];
+var scanForSecrets = (input) => {
+  if (typeof input === "string") {
+    return SECRET_PATTERNS.some((pattern) => pattern.test(input));
+  }
+  if (typeof input === "object" && input !== null) {
+    return Object.values(input).some(scanForSecrets);
+  }
+  return false;
+};
+var isWeakPassword = (password) => {
+  if (password.length < 8) return true;
+  const hasLower = /[a-z]/.test(password);
+  const hasUpper = /[A-Z]/.test(password);
+  const hasNumber = /\d/.test(password);
+  const hasSpecial = /[^a-zA-Z0-9]/.test(password);
+  const types = [hasLower, hasUpper, hasNumber, hasSpecial].filter(Boolean).length;
+  if (types < 2) return true;
+  const common = ["password", "123456", "qwerty", "admin123", "password123", "12345678"];
+  if (common.includes(password.toLowerCase())) return true;
+  return false;
+};
+var isType = (val, type) => {
+  if (type === "array") return Array.isArray(val);
+  return typeof val === type && val !== null;
+};
+var enforceSchema = (data, schema) => {
+  if (typeof data !== "object" || data === null || Array.isArray(data)) return null;
+  const result = {};
+  for (const key of Object.keys(schema)) {
+    const expectedType = schema[key];
+    const value = data[key];
+    if (value === void 0 || !isType(value, expectedType)) return null;
+    result[key] = value;
+  }
+  return result;
+};
+var isEmail = (input) => {
+  return /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test(
+    input
+  );
+};
+var hasInjectionPattern = (input) => {
+  if (typeof input !== "string") return false;
+  const dangerousPatterns = [
+    // SQL Injection
+    /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|EXEC|UNION|ALL|ANY|SOME)\b.*\b(FROM|INTO|SET|TABLE|DATABASE)\b)/i,
+    /'\s*OR\s+'?1'?\s*=\s*'?1/i,
+    /"\s*OR\s+"?1"?\s*=\s*"?1/i,
+    /--\s*$/,
+    /;\s*(WAITFOR|DELAY|SLEEP)/i,
+    /;\s*(EXEC|EXECUTE)\b/i,
+    // NoSQL Injection
+    /\$(where|gt|lt|gte|lte|ne|in|nin|regex|expr|eq)/i,
+    /\{\s*\$ne\s*:/i,
+    // Command Injection
+    /(;|\||&&|\|\||`|\$)\s*(cat|ls|pwd|whoami|id|echo|bash|sh|ping|curl|wget)/i
+  ];
+  return dangerousPatterns.some((pattern) => pattern.test(input));
+};
+
+export {
+  __require,
+  __export,
+  scanForSecrets,
+  validate_exports
+};
+//# sourceMappingURL=chunk-TT2DUALY.js.map

package/dist/chunk-TT2DUALY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/validate/index.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport * as https from 'node:https';\n\n/**\n * Result returned by `checkPwnedPassword`.\n * Always resolves (never rejects) to preserve fail-open availability semantics.\n */\nexport interface CheckPwnedResult {\n  /** Number of times this password appeared in known data breaches. 0 if not found. */\n  count: number;\n  /**\n   * Whether the HIBP API was reachable during this check.\n   * If `false`, the result is inconclusive — the password may or may not be compromised.\n   * Callers should treat `apiAvailable: false` as a signal to retry or log a warning.\n   */\n  apiAvailable: boolean;\n}\n\n/**\n * Checks if a password has been leaked in a data breach using the Have I Been Pwned (HIBP) API.\n * Uses k-Anonymity (sending only the first 5 characters of the SHA-1 hash) to ensure\n * the password is never exposed to the API.\n *\n * Always resolves — never rejects. If the API is unreachable, `apiAvailable` will be `false`\n * and `count` will be `0` (inconclusive). Callers should check `apiAvailable` before\n * treating a zero count as \"password is clean\".\n *\n * @param password The password to check.\n * @returns {Promise<CheckPwnedResult>} Structured result with breach count and API availability.\n *\n * @example\n * const { count, apiAvailable } = await checkPwnedPassword('hunter2');\n * if (!apiAvailable) logger.warn('HIBP API unreachable — skipping pwned check');\n * else if (count > 0) throw new Error('Password found in data breaches');\n */\nexport const checkPwnedPassword = (password: string): Promise<CheckPwnedResult> => {\n  return new Promise((resolve) => {\n    const hash = createHash('sha1').update(password).digest('hex').toUpperCase();\n    const prefix = hash.slice(0, 5);\n    const suffix = hash.slice(5);\n\n    https\n      .get(`https://api.pwnedpasswords.com/range/${prefix}`, (res) => {\n        let data = '';\n        res.on('data', (chunk) => (data += chunk));\n        res.on('end', () => {\n          const lines = data.split('\\n');\n          for (const line of lines) {\n            const [hashSuffix, count] = line.split(':');\n            if (hashSuffix === suffix) {\n              return resolve({ count: Number.parseInt(count.trim()), apiAvailable: true });\n            }\n          }\n          resolve({ count: 0, apiAvailable: true });\n        });\n      })\n      .on('error', (err) => {\n        // Fail-open: don't block authentication when HIBP is unreachable.\n        // apiAvailable: false lets the caller decide how to handle the degraded state.\n        console.error('Mitigator: HIBP API connection error.', err);\n        resolve({ count: 0, apiAvailable: false });\n      });\n  });\n};\n\n/**\n * Patterns for secrets.\n */\nexport const SECRET_PATTERNS = [\n  /AKIA[0-9A-Z]{16}/,\n  /-----BEGIN (RSA|OPENSSH|EC|PGP) PRIVATE KEY-----/,\n  /ghp_[a-zA-Z0-9]{36}/,\n  /sk_live_[a-zA-Z0-9]{24}/,\n];\n\n/**\n * Scans for secrets.\n */\nexport const scanForSecrets = (input: any): boolean => {\n  if (typeof input === 'string') {\n    return SECRET_PATTERNS.some((pattern) => pattern.test(input));\n  }\n  if (typeof input === 'object' && input !== null) {\n    return Object.values(input).some(scanForSecrets);\n  }\n  return false;\n};\n\n/**\n * Weak password check.\n */\nexport const isWeakPassword = (password: string): boolean => {\n  if (password.length < 8) return true;\n  const hasLower = /[a-z]/.test(password);\n  const hasUpper = /[A-Z]/.test(password);\n  const hasNumber = /\\d/.test(password);\n  const hasSpecial = /[^a-zA-Z0-9]/.test(password);\n  const types = [hasLower, hasUpper, hasNumber, hasSpecial].filter(Boolean).length;\n  if (types < 2) return true;\n  const common = ['password', '123456', 'qwerty', 'admin123', 'password123', '12345678'];\n  if (common.includes(password.toLowerCase())) return true;\n  return false;\n};\n\n/**\n * Schema types.\n */\nexport type Schema = {\n  [key: string]: 'string' | 'number' | 'boolean' | 'object' | 'array';\n};\n\n/**\n * Type validation.\n */\nexport const isType = (val: any, type: Schema[keyof Schema]): boolean => {\n  if (type === 'array') return Array.isArray(val);\n  return typeof val === type && val !== null;\n};\n\n/**\n * Schema enforcement.\n */\nexport const enforceSchema = <T extends Record<string, any>>(\n  data: any,\n  schema: Schema,\n): T | null => {\n  if (typeof data !== 'object' || data === null || Array.isArray(data)) return null;\n  const result: any = {};\n  for (const key of Object.keys(schema)) {\n    const expectedType = schema[key];\n    const value = data[key];\n    if (value === undefined || !isType(value, expectedType)) return null;\n    result[key] = value;\n  }\n  return result;\n};\n\n/**\n * Email validation.\n */\nexport const isEmail = (input: string): boolean => {\n  return /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test(\n    input,\n  );\n};\n\n/**\n * Injection pattern detection (Heuristic).\n * Detects common SQL, NoSQL, and Command Injection payloads.\n */\nexport const hasInjectionPattern = (input: string): boolean => {\n  if (typeof input !== 'string') return false;\n\n  const dangerousPatterns = [\n    // SQL Injection\n    /(\\b(SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|EXEC|UNION|ALL|ANY|SOME)\\b.*\\b(FROM|INTO|SET|TABLE|DATABASE)\\b)/i,\n    /'\\s*OR\\s+'?1'?\\s*=\\s*'?1/i,\n    /\"\\s*OR\\s+\"?1\"?\\s*=\\s*\"?1/i,\n    /--\\s*$/,\n    /;\\s*(WAITFOR|DELAY|SLEEP)/i,\n    /;\\s*(EXEC|EXECUTE)\\b/i,\n    // NoSQL Injection\n    /\\$(where|gt|lt|gte|lte|ne|in|nin|regex|expr|eq)/i,\n    /\\{\\s*\\$ne\\s*:/i,\n    // Command Injection\n    /(;|\\||&&|\\|\\||`|\\$)\\s*(cat|ls|pwd|whoami|id|echo|bash|sh|ping|curl|wget)/i,\n  ];\n  return dangerousPatterns.some((pattern) => pattern.test(input));\n};\n"],"mappings":";;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAS,kBAAkB;AAC3B,YAAY,WAAW;AAkChB,IAAM,qBAAqB,CAAC,aAAgD;AACjF,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,OAAO,WAAW,MAAM,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK,EAAE,YAAY;AAC3E,UAAM,SAAS,KAAK,MAAM,GAAG,CAAC;AAC9B,UAAM,SAAS,KAAK,MAAM,CAAC;AAE3B,IACG,UAAI,wCAAwC,MAAM,IAAI,CAAC,QAAQ;AAC9D,UAAI,OAAO;AACX,UAAI,GAAG,QAAQ,CAAC,UAAW,QAAQ,KAAM;AACzC,UAAI,GAAG,OAAO,MAAM;AAClB,cAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,mBAAW,QAAQ,OAAO;AACxB,gBAAM,CAAC,YAAY,KAAK,IAAI,KAAK,MAAM,GAAG;AAC1C,cAAI,eAAe,QAAQ;AACzB,mBAAO,QAAQ,EAAE,OAAO,OAAO,SAAS,MAAM,KAAK,CAAC,GAAG,cAAc,KAAK,CAAC;AAAA,UAC7E;AAAA,QACF;AACA,gBAAQ,EAAE,OAAO,GAAG,cAAc,KAAK,CAAC;AAAA,MAC1C,CAAC;AAAA,IACH,CAAC,EACA,GAAG,SAAS,CAAC,QAAQ;AAGpB,cAAQ,MAAM,yCAAyC,GAAG;AAC1D,cAAQ,EAAE,OAAO,GAAG,cAAc,MAAM,CAAC;AAAA,IAC3C,CAAC;AAAA,EACL,CAAC;AACH;AAKO,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKO,IAAM,iBAAiB,CAAC,UAAwB;AACrD,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,gBAAgB,KAAK,CAAC,YAAY,QAAQ,KAAK,KAAK,CAAC;AAAA,EAC9D;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,WAAO,OAAO,OAAO,KAAK,EAAE,KAAK,cAAc;AAAA,EACjD;AACA,SAAO;AACT;AAKO,IAAM,iBAAiB,CAAC,aAA8B;AAC3D,MAAI,SAAS,SAAS,EAAG,QAAO;AAChC,QAAM,WAAW,QAAQ,KAAK,QAAQ;AACtC,QAAM,WAAW,QAAQ,KAAK,QAAQ;AACtC,QAAM,YAAY,KAAK,KAAK,QAAQ;AACpC,QAAM,aAAa,eAAe,KAAK,QAAQ;AAC/C,QAAM,QAAQ,CAAC,UAAU,UAAU,WAAW,UAAU,EAAE,OAAO,OAAO,EAAE;AAC1E,MAAI,QAAQ,EAAG,QAAO;AACtB,QAAM,SAAS,CAAC,YAAY,UAAU,UAAU,YAAY,eAAe,UAAU;AACrF,MAAI,OAAO,SAAS,SAAS,YAAY,CAAC,EAAG,QAAO;AACpD,SAAO;AACT;AAYO,IAAM,SAAS,CAAC,KAAU,SAAwC;AACvE,MAAI,SAAS,QAAS,QAAO,MAAM,QAAQ,GAAG;AAC9C,SAAO,OAAO,QAAQ,QAAQ,QAAQ;AACxC;AAKO,IAAM,gBAAgB,CAC3B,MACA,WACa;AACb,MAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,EAAG,QAAO;AAC7E,QAAM,SAAc,CAAC;AACrB,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,UAAM,eAAe,OAAO,GAAG;AAC/B,UAAM,QAAQ,KAAK,GAAG;AACtB,QAAI,UAAU,UAAa,CAAC,OAAO,OAAO,YAAY,EAAG,QAAO;AAChE,WAAO,GAAG,IAAI;AAAA,EAChB;AACA,SAAO;AACT;AAKO,IAAM,UAAU,CAAC,UAA2B;AACjD,SAAO,uIAAuI;AAAA,IAC5I;AAAA,EACF;AACF;AAMO,IAAM,sBAAsB,CAAC,UAA2B;AAC7D,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,oBAAoB;AAAA;AAAA,IAExB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IAEA;AAAA,IACA;AAAA;AAAA,IAEA;AAAA,EACF;AACA,SAAO,kBAAkB,KAAK,CAAC,YAAY,QAAQ,KAAK,KAAK,CAAC;AAChE;","names":[]}