mitigator 1.0.0

package/dist/index.cjs

@@ -0,0 +1,1643 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  auth: () => auth_exports,
+  crypto: () => crypto_exports,
+  fs: () => fs_exports,
+  headers: () => headers_exports,
+  http: () => http_exports,
+  presets: () => presets_exports,
+  rateLimit: () => rate_limit_exports,
+  safeJson: () => safe_json_exports,
+  safeMerge: () => safe_merge_exports,
+  sanitize: () => sanitize_exports,
+  telemetry: () => telemetry_exports,
+  utils: () => utils_exports,
+  validate: () => validate_exports
+});
+module.exports = __toCommonJS(index_exports);
+
+// node_modules/tsup/assets/cjs_shims.js
+var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
+var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
+
+// src/sanitize/index.ts
+var sanitize_exports = {};
+__export(sanitize_exports, {
+  ALLOWLIST: () => ALLOWLIST,
+  escapeHtml: () => escapeHtml,
+  isSafeUrl: () => isSafeUrl,
+  preventDOMClobbering: () => preventDOMClobbering,
+  sanitizeHtml: () => sanitizeHtml,
+  sanitizeMediaTags: () => sanitizeMediaTags,
+  stripTags: () => stripTags
+});
+var import_sanitize_html = __toESM(require("sanitize-html"), 1);
+var escapeHtml = (input) => {
+  const map = {
+    "&": "&",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#39;"
+  };
+  return input.replaceAll(/[&<>"']/g, (m) => map[m]);
+};
+var stripTags = (input) => {
+  return input.replaceAll(/<[^>]*>?/gm, "");
+};
+var ALLOWLIST = {
+  b: [],
+  i: [],
+  em: [],
+  strong: [],
+  p: ["style"],
+  a: ["href", "title", "target"],
+  ul: [],
+  ol: [],
+  li: [],
+  br: [],
+  span: ["style"]
+};
+var sanitizeHtml = (html, rules = ALLOWLIST) => {
+  return (0, import_sanitize_html.default)(html, {
+    allowedTags: Object.keys(rules),
+    allowedAttributes: rules,
+    allowedSchemes: ["http", "https", "mailto", "tel"],
+    allowProtocolRelative: false,
+    enforceHtmlBoundary: true
+  });
+};
+var preventDOMClobbering = (html, prefix = "sk-") => {
+  const attrRegex = /(\s(id|name)\s*=\s*)(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
+  return html.replaceAll(attrRegex, (_match, attrPrefix, _attrName, val1, val2, val3) => {
+    const value = val1 || val2 || val3;
+    let quote;
+    if (val3) {
+      quote = "";
+    } else if (val1) {
+      quote = '"';
+    } else {
+      quote = "'";
+    }
+    return `${attrPrefix}${quote}${prefix}${value}${quote}`;
+  });
+};
+var sanitizeMediaTags = (html) => {
+  const dangerousTags = [
+    "script",
+    "animate",
+    "set",
+    "animateMotion",
+    "animateTransform",
+    "handler",
+    "discard",
+    "foreignObject"
+  ];
+  let result = html;
+  dangerousTags.forEach((tag) => {
+    const regex = new RegExp(String.raw`<${tag}[^>]*>[\s\S]*?<\/${tag}>|<${tag}[^>]*\/>`, "gi");
+    result = result.replaceAll(regex, "");
+  });
+  return result;
+};
+var isSafeUrl = (url) => {
+  const allowedProtocols = ["https:", "http:", "mailto:", "tel:"];
+  try {
+    const parsed = new URL(url);
+    return allowedProtocols.includes(parsed.protocol);
+  } catch {
+    const low = url.trim().toLowerCase();
+    return !low.startsWith("javascript:") && !low.startsWith("//") && (low.startsWith("/") || low.startsWith("."));
+  }
+};
+
+// src/validate/index.ts
+var validate_exports = {};
+__export(validate_exports, {
+  SECRET_PATTERNS: () => SECRET_PATTERNS,
+  checkPwnedPassword: () => checkPwnedPassword,
+  enforceSchema: () => enforceSchema,
+  hasInjectionPattern: () => hasInjectionPattern,
+  isEmail: () => isEmail,
+  isType: () => isType,
+  isWeakPassword: () => isWeakPassword,
+  scanForSecrets: () => scanForSecrets
+});
+var import_node_crypto = require("crypto");
+var https = __toESM(require("https"), 1);
+var checkPwnedPassword = (password) => {
+  return new Promise((resolve2) => {
+    const hash = (0, import_node_crypto.createHash)("sha1").update(password).digest("hex").toUpperCase();
+    const prefix = hash.slice(0, 5);
+    const suffix = hash.slice(5);
+    https.get(`https://api.pwnedpasswords.com/range/${prefix}`, (res) => {
+      let data = "";
+      res.on("data", (chunk) => data += chunk);
+      res.on("end", () => {
+        const lines = data.split("\n");
+        for (const line of lines) {
+          const [hashSuffix, count] = line.split(":");
+          if (hashSuffix === suffix) {
+            return resolve2({ count: Number.parseInt(count.trim()), apiAvailable: true });
+          }
+        }
+        resolve2({ count: 0, apiAvailable: true });
+      });
+    }).on("error", (err) => {
+      console.error("Mitigator: HIBP API connection error.", err);
+      resolve2({ count: 0, apiAvailable: false });
+    });
+  });
+};
+var SECRET_PATTERNS = [
+  /AKIA[0-9A-Z]{16}/,
+  /-----BEGIN (RSA|OPENSSH|EC|PGP) PRIVATE KEY-----/,
+  /ghp_[a-zA-Z0-9]{36}/,
+  /sk_live_[a-zA-Z0-9]{24}/
+];
+var scanForSecrets = (input) => {
+  if (typeof input === "string") {
+    return SECRET_PATTERNS.some((pattern) => pattern.test(input));
+  }
+  if (typeof input === "object" && input !== null) {
+    return Object.values(input).some(scanForSecrets);
+  }
+  return false;
+};
+var isWeakPassword = (password) => {
+  if (password.length < 8) return true;
+  const hasLower = /[a-z]/.test(password);
+  const hasUpper = /[A-Z]/.test(password);
+  const hasNumber = /\d/.test(password);
+  const hasSpecial = /[^a-zA-Z0-9]/.test(password);
+  const types = [hasLower, hasUpper, hasNumber, hasSpecial].filter(Boolean).length;
+  if (types < 2) return true;
+  const common = ["password", "123456", "qwerty", "admin123", "password123", "12345678"];
+  if (common.includes(password.toLowerCase())) return true;
+  return false;
+};
+var isType = (val, type) => {
+  if (type === "array") return Array.isArray(val);
+  return typeof val === type && val !== null;
+};
+var enforceSchema = (data, schema) => {
+  if (typeof data !== "object" || data === null || Array.isArray(data)) return null;
+  const result = {};
+  for (const key of Object.keys(schema)) {
+    const expectedType = schema[key];
+    const value = data[key];
+    if (value === void 0 || !isType(value, expectedType)) return null;
+    result[key] = value;
+  }
+  return result;
+};
+var isEmail = (input) => {
+  return /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test(
+    input
+  );
+};
+var hasInjectionPattern = (input) => {
+  if (typeof input !== "string") return false;
+  const dangerousPatterns = [
+    // SQL Injection
+    /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|EXEC|UNION|ALL|ANY|SOME)\b.*\b(FROM|INTO|SET|TABLE|DATABASE)\b)/i,
+    /'\s*OR\s+'?1'?\s*=\s*'?1/i,
+    /"\s*OR\s+"?1"?\s*=\s*"?1/i,
+    /--\s*$/,
+    /;\s*(WAITFOR|DELAY|SLEEP)/i,
+    /;\s*(EXEC|EXECUTE)\b/i,
+    // NoSQL Injection
+    /\$(where|gt|lt|gte|lte|ne|in|nin|regex|expr|eq)/i,
+    /\{\s*\$ne\s*:/i,
+    // Command Injection
+    /(;|\||&&|\|\||`|\$)\s*(cat|ls|pwd|whoami|id|echo|bash|sh|ping|curl|wget)/i
+  ];
+  return dangerousPatterns.some((pattern) => pattern.test(input));
+};
+
+// src/headers/index.ts
+var headers_exports = {};
+__export(headers_exports, {
+  buildCSP: () => buildCSP,
+  buildStrictCSP: () => buildStrictCSP,
+  generateNonce: () => generateNonce,
+  parseCSPReport: () => parseCSPReport,
+  secureCSP: () => secureCSP,
+  standardHeaders: () => standardHeaders
+});
+var import_node_crypto2 = require("crypto");
+var standardHeaders = {
+  "Content-Security-Policy": "default-src 'self'; img-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; object-src 'none'",
+  "X-Frame-Options": "DENY",
+  "X-Content-Type-Options": "nosniff",
+  "Referrer-Policy": "strict-origin-when-cross-origin",
+  "Strict-Transport-Security": "max-age=31536000; includeSubDomains"
+};
+var generateNonce = (length = 16) => {
+  return (0, import_node_crypto2.randomBytes)(length).toString("base64");
+};
+var buildCSP = (directives, nonce) => {
+  return Object.entries(directives).filter((entry) => {
+    const sources = entry[1];
+    return Array.isArray(sources) && sources.length > 0;
+  }).map(([directive, sources]) => {
+    const updatedSources = nonce && (directive === "script-src" || directive === "style-src") ? [...sources, `'nonce-${nonce}'`] : sources;
+    return `${directive} ${updatedSources.join(" ")}`;
+  }).join("; ");
+};
+var buildStrictCSP = (nonce) => {
+  return buildCSP(
+    {
+      "object-src": ["'none'"],
+      "script-src": ["'strict-dynamic'", `'nonce-${nonce}'`, "'unsafe-inline'", "http:", "https:"],
+      "base-uri": ["'none'"]
+    },
+    nonce
+  );
+};
+var parseCSPReport = (reportBody) => {
+  if (!reportBody) return null;
+  const report = reportBody["csp-report"] || (Array.isArray(reportBody) ? reportBody[0] : reportBody);
+  if (!report?.["blocked-uri"]) return null;
+  return {
+    documentUri: report["document-uri"],
+    referrer: report["referrer"],
+    blockedUri: report["blocked-uri"],
+    violatedDirective: report["violated-directive"],
+    originalPolicy: report["original-policy"],
+    disposition: report["disposition"],
+    statusCode: report["status-code"],
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+};
+var secureCSP = buildCSP({
+  "default-src": ["'none'"],
+  "script-src": ["'self'"],
+  "style-src": ["'self'"],
+  "img-src": ["'self'"],
+  "connect-src": ["'self'"],
+  "font-src": ["'self'"],
+  "object-src": ["'none'"],
+  "base-uri": ["'none'"],
+  "form-action": ["'self'"],
+  "frame-ancestors": ["'none'"]
+});
+
+// src/auth/index.ts
+var auth_exports = {};
+__export(auth_exports, {
+  basicAuth: () => basicAuth,
+  can: () => can,
+  canAccess: () => canAccess,
+  generateCSRF: () => generateCSRF,
+  generateHmacChallenge: () => generateHmacChallenge,
+  generateHoneyToken: () => generateHoneyToken,
+  generatePasskeyChallenge: () => generatePasskeyChallenge,
+  hasRole: () => hasRole,
+  isHoneyToken: () => isHoneyToken,
+  isJwtValid: () => isJwtValid,
+  parseAuthenticatorData: () => parseAuthenticatorData,
+  suggestMFA: () => suggestMFA,
+  verifyCSRF: () => verifyCSRF,
+  verifyHmacResponse: () => verifyHmacResponse,
+  verifyPasskeyAssertion: () => verifyPasskeyAssertion,
+  verifyPasskeyRegistration: () => verifyPasskeyRegistration,
+  verifyPasskeySignature: () => verifyPasskeySignature
+});
+var import_node_buffer = require("buffer");
+var import_node_crypto3 = require("crypto");
+var basicAuth = (user, pass) => {
+  const credentials = user + ":" + pass;
+  return "Basic " + import_node_buffer.Buffer.from(credentials).toString("base64");
+};
+var verifyPasskeySignature = (_challenge, response, signature, publicKey, algorithm = "sha256") => {
+  try {
+    const data = import_node_buffer.Buffer.isBuffer(response) ? response : import_node_buffer.Buffer.from(response);
+    const sig = import_node_buffer.Buffer.isBuffer(signature) ? signature : import_node_buffer.Buffer.from(signature, "base64");
+    return (0, import_node_crypto3.verify)(algorithm, data, publicKey, sig);
+  } catch {
+    return false;
+  }
+};
+var suggestMFA = (riskScore, lastFingerprint, currentFingerprint) => {
+  if (lastFingerprint !== currentFingerprint) return true;
+  if (riskScore > 10) return true;
+  return false;
+};
+var generateHmacChallenge = (userSalt) => {
+  return (0, import_node_crypto3.createHmac)("sha256", userSalt).update((0, import_node_crypto3.randomBytes)(32)).digest("hex");
+};
+var verifyHmacResponse = (challenge, proof, secret) => {
+  const expected = (0, import_node_crypto3.createHmac)("sha256", secret).update(challenge).digest("hex");
+  const proofBuf = import_node_buffer.Buffer.from(proof, "hex");
+  const expectedBuf = import_node_buffer.Buffer.from(expected, "hex");
+  if (proofBuf.length !== expectedBuf.length) return false;
+  return (0, import_node_crypto3.timingSafeEqual)(proofBuf, expectedBuf);
+};
+var generateHoneyToken = (prefix = "sk") => {
+  return `${prefix}_${(0, import_node_crypto3.randomBytes)(16).toString("hex")}_${(0, import_node_crypto3.randomBytes)(8).toString("hex")}`;
+};
+var isHoneyToken = (token, prefix = "sk") => {
+  if (!token) return false;
+  const parts = token.split("_");
+  return parts.length >= 3 && parts[0] === prefix;
+};
+var generateCSRF = () => {
+  const token = (0, import_node_crypto3.randomBytes)(32).toString("hex");
+  const cookieValue = (0, import_node_crypto3.randomBytes)(32).toString("hex");
+  return { token, cookieValue };
+};
+var verifyCSRF = (providedToken, cookieToken) => {
+  if (!providedToken || !cookieToken) return false;
+  const tokenBuf = import_node_buffer.Buffer.from(providedToken, "hex");
+  const cookieBuf = import_node_buffer.Buffer.from(cookieToken, "hex");
+  if (tokenBuf.length !== cookieBuf.length) return false;
+  return (0, import_node_crypto3.timingSafeEqual)(tokenBuf, cookieBuf);
+};
+var isJwtValid = (token, secretOrPublicKey, algorithm = "HS256") => {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return false;
+    const [headerB64, payloadB64, signatureB64] = parts;
+    const header = JSON.parse(import_node_buffer.Buffer.from(headerB64, "base64url").toString("utf8"));
+    if (!header.alg || header.alg.toLowerCase() === "none" || header.alg !== algorithm)
+      return false;
+    const payload = JSON.parse(import_node_buffer.Buffer.from(payloadB64, "base64url").toString("utf8"));
+    if (payload.exp && Date.now() >= payload.exp * 1e3) return false;
+    const dataToSign = `${headerB64}.${payloadB64}`;
+    const signatureBuffer = import_node_buffer.Buffer.from(signatureB64, "base64url");
+    if (algorithm.startsWith("HS")) {
+      const hashAlg = algorithm.replace("HS", "sha");
+      const expectedSignature = (0, import_node_crypto3.createHmac)(hashAlg, secretOrPublicKey).update(dataToSign).digest();
+      if (signatureBuffer.length !== expectedSignature.length) return false;
+      return (0, import_node_crypto3.timingSafeEqual)(signatureBuffer, expectedSignature);
+    } else if (algorithm.startsWith("RS") || algorithm.startsWith("ES")) {
+      const hashAlg = algorithm.replace(/RS|ES/, "sha");
+      return (0, import_node_crypto3.verify)(hashAlg, import_node_buffer.Buffer.from(dataToSign), secretOrPublicKey, signatureBuffer);
+    }
+    return false;
+  } catch {
+    return false;
+  }
+};
+var canAccess = (user, resource, rule) => {
+  return rule(user, resource);
+};
+var hasRole = (userRoles, requiredRoles) => {
+  return requiredRoles.every((role) => userRoles.includes(role));
+};
+var can = (userPermissions, requiredPermission) => {
+  return userPermissions.includes(requiredPermission);
+};
+var generatePasskeyChallenge = (length = 32) => {
+  return (0, import_node_crypto3.randomBytes)(length).toString("base64url");
+};
+var verifyPasskeyRegistration = (clientDataJSONStr, expectedChallenge, expectedOrigin) => {
+  try {
+    let jsonStr = clientDataJSONStr;
+    try {
+      JSON.parse(clientDataJSONStr);
+    } catch {
+      jsonStr = import_node_buffer.Buffer.from(clientDataJSONStr, "base64url").toString("utf8");
+    }
+    const clientData = JSON.parse(jsonStr);
+    const receivedBytes = import_node_buffer.Buffer.from(clientData.challenge ?? "", "base64url");
+    const expectedBytes = import_node_buffer.Buffer.from(expectedChallenge, "base64url");
+    const challengeMatches = receivedBytes.length === expectedBytes.length && receivedBytes.length > 0 && (0, import_node_crypto3.timingSafeEqual)(receivedBytes, expectedBytes);
+    const typeMatches = clientData.type === "webauthn.create";
+    let originMatches = true;
+    if (expectedOrigin && clientData.origin !== expectedOrigin) {
+      originMatches = false;
+    }
+    if (!challengeMatches) return { verified: false, error: "Challenge mismatch." };
+    if (!typeMatches) return { verified: false, error: "Invalid type (expected webauthn.create)." };
+    if (!originMatches) return { verified: false, error: "Origin mismatch." };
+    return { verified: true };
+  } catch (err) {
+    return { verified: false, error: err.message };
+  }
+};
+var parseAuthenticatorData = (authData) => {
+  try {
+    const rpIdHash = authData.subarray(0, 32);
+    const flags = authData[32];
+    const signCount = authData.readUInt32BE(33);
+    const attestedCredentialDataPresent = !!(flags & 64);
+    if (!attestedCredentialDataPresent) {
+      return { rpIdHash, flags, signCount };
+    }
+    const aaguid = authData.subarray(37, 53);
+    const credentialIdLength = authData.readUInt16BE(53);
+    const credentialId = authData.subarray(55, 55 + credentialIdLength);
+    const publicKeyBytes = authData.subarray(55 + credentialIdLength);
+    return {
+      rpIdHash,
+      flags,
+      signCount,
+      aaguid,
+      credentialId: credentialId.toString("base64url"),
+      publicKeyBytes: publicKeyBytes.toString("hex")
+    };
+  } catch {
+    return null;
+  }
+};
+var verifyPasskeyAssertion = (clientDataJSONStr, expectedChallenge, expectedOrigin, storedSignCount, authData, signature, publicKeyPem) => {
+  try {
+    let jsonStr = clientDataJSONStr;
+    try {
+      JSON.parse(clientDataJSONStr);
+    } catch {
+      jsonStr = import_node_buffer.Buffer.from(clientDataJSONStr, "base64url").toString("utf8");
+    }
+    const clientData = JSON.parse(jsonStr);
+    if (clientData.type !== "webauthn.get") {
+      return { verified: false, error: "Invalid type (expected webauthn.get)." };
+    }
+    const receivedBytes = import_node_buffer.Buffer.from(clientData.challenge ?? "", "base64url");
+    const expectedBytes = import_node_buffer.Buffer.from(expectedChallenge, "base64url");
+    const challengeMatches = receivedBytes.length === expectedBytes.length && receivedBytes.length > 0 && (0, import_node_crypto3.timingSafeEqual)(receivedBytes, expectedBytes);
+    if (!challengeMatches) return { verified: false, error: "Challenge mismatch." };
+    if (clientData.origin !== expectedOrigin) {
+      return { verified: false, error: "Origin mismatch." };
+    }
+    const newSignCount = authData.readUInt32BE(33);
+    if (storedSignCount !== 0 && newSignCount <= storedSignCount) {
+      return {
+        verified: false,
+        error: `Replay attack or cloned authenticator detected: signCount ${newSignCount} is not greater than stored ${storedSignCount}.`
+      };
+    }
+    const clientDataHash = (0, import_node_crypto3.createHash)("sha256").update(import_node_buffer.Buffer.from(jsonStr, "utf8")).digest();
+    const signedData = import_node_buffer.Buffer.concat([authData, clientDataHash]);
+    const sigValid = (0, import_node_crypto3.verify)("sha256", signedData, publicKeyPem, signature);
+    if (!sigValid) return { verified: false, error: "Signature verification failed." };
+    return { verified: true, newSignCount };
+  } catch (err) {
+    return { verified: false, error: err.message };
+  }
+};
+
+// src/crypto/index.ts
+var crypto_exports = {};
+__export(crypto_exports, {
+  blindData: () => blindData,
+  decryptSession: () => decryptSession,
+  deriveSubKey: () => deriveSubKey,
+  encryptSession: () => encryptSession,
+  generatePQCKeyPair: () => generatePQCKeyPair,
+  generateToken: () => generateToken,
+  hashPassword: () => hashPassword,
+  reconstructSecret: () => reconstructSecret,
+  runIsolatedCrypto: () => runIsolatedCrypto,
+  sha256: () => sha256,
+  signPQC: () => signPQC,
+  splitSecret: () => splitSecret,
+  verifyPQCSignature: () => verifyPQCSignature,
+  verifyPassword: () => verifyPassword
+});
+var import_node_buffer2 = require("buffer");
+var import_node_crypto4 = require("crypto");
+var import_node_util = require("util");
+var import_node_url = require("url");
+var import_node_os = require("os");
+
+// src/utils/telemetry.ts
+var telemetry_exports = {};
+__export(telemetry_exports, {
+  getTelemetryProvider: () => getTelemetryProvider,
+  resetTelemetryProvider: () => resetTelemetryProvider,
+  setTelemetryProvider: () => setTelemetryProvider
+});
+var NOOP_PROVIDER = {
+  onRateLimitBlocked: () => {
+  },
+  onSecurityEvent: () => {
+  },
+  onKillSwitchTriggered: () => {
+  },
+  onWorkerSpawned: () => {
+  }
+};
+var _provider = NOOP_PROVIDER;
+var setTelemetryProvider = (provider) => {
+  _provider = provider;
+};
+var resetTelemetryProvider = () => {
+  _provider = NOOP_PROVIDER;
+};
+var getTelemetryProvider = () => _provider;
+
+// src/crypto/index.ts
+var scryptAsync = (0, import_node_util.promisify)(import_node_crypto4.scrypt);
+var getFilename = () => {
+  return (0, import_node_url.fileURLToPath)(importMetaUrl);
+};
+var BoundedWorkerSemaphore = class {
+  constructor(maxConcurrent = Math.max(2, (0, import_node_os.cpus)().length - 1)) {
+    this.maxConcurrent = maxConcurrent;
+  }
+  maxConcurrent;
+  active = 0;
+  queue = [];
+  async run(task) {
+    if (this.active >= this.maxConcurrent) {
+      await new Promise((resolve2) => this.queue.push(resolve2));
+    }
+    this.active++;
+    try {
+      return await task();
+    } finally {
+      this.active--;
+      const next = this.queue.shift();
+      if (next) next();
+    }
+  }
+};
+var workerPool = new BoundedWorkerSemaphore();
+var runIsolatedCrypto = async (functionName, args) => {
+  return workerPool.run(async () => {
+    getTelemetryProvider().onWorkerSpawned?.(functionName);
+    const { Worker } = await import("worker_threads");
+    return new Promise((resolve2, reject) => {
+      const worker = new Worker(getFilename(), {
+        workerData: { functionName, args }
+      });
+      worker.on("message", (msg) => {
+        if (msg && msg.status === "success") {
+          resolve2(msg.result !== void 0 ? msg.result : msg);
+        } else {
+          reject(new Error(msg?.error || "Worker execution failed."));
+        }
+      });
+      worker.on("error", reject);
+      worker.on("exit", (code) => {
+        if (code !== 0) reject(new Error(`Worker stopped with exit code ${code}`));
+      });
+    });
+  });
+};
+var gfExp = new Uint8Array(256);
+var gfLog = new Uint8Array(256);
+var gfX = 1;
+for (let i = 0; i < 255; i++) {
+  gfExp[i] = gfX;
+  gfLog[gfX] = i;
+  gfX = gfX << 1;
+  if (gfX & 256) {
+    gfX = gfX ^ 285;
+  }
+}
+gfExp[255] = gfExp[0];
+var gfMul = (a, b) => {
+  if (a === 0 || b === 0) return 0;
+  return gfExp[(gfLog[a] + gfLog[b]) % 255];
+};
+var gfDiv = (a, b) => {
+  if (a === 0) return 0;
+  if (b === 0) throw new Error("Division by zero in GF(256)");
+  return gfExp[(gfLog[a] - gfLog[b] + 255) % 255];
+};
+var evaluatePolynomial = (coefficients, x) => {
+  let result = 0;
+  let power = 1;
+  for (const coeff of coefficients) {
+    result ^= gfMul(coeff, power);
+    power = gfMul(power, x);
+  }
+  return result;
+};
+var splitSecret = (secret, sharesCount, threshold) => {
+  if (threshold > sharesCount) throw new Error("Threshold cannot be greater than sharesCount.");
+  if (threshold < 1) throw new Error("Threshold must be at least 1.");
+  if (sharesCount > 255)
+    throw new Error("Shamir Secret Sharing GF(256) supports up to 255 shares.");
+  const secretBuffer = import_node_buffer2.Buffer.isBuffer(secret) ? secret : import_node_buffer2.Buffer.from(secret);
+  const secretLen = secretBuffer.length;
+  const shareBuffers = Array.from({ length: sharesCount }, () => import_node_buffer2.Buffer.alloc(secretLen));
+  for (let byteIdx = 0; byteIdx < secretLen; byteIdx++) {
+    const s = secretBuffer[byteIdx];
+    const coefficients = [s];
+    for (let k = 1; k < threshold; k++) {
+      coefficients.push((0, import_node_crypto4.randomBytes)(1)[0]);
+    }
+    for (let i = 0; i < sharesCount; i++) {
+      shareBuffers[i][byteIdx] = evaluatePolynomial(coefficients, i + 1);
+    }
+  }
+  return shareBuffers.map((buf, i) => `${i + 1}:${buf.toString("hex")}`);
+};
+var reconstructSecret = (shares) => {
+  if (shares.length === 0) throw new Error("No shares provided.");
+  const parsedShares = shares.map((s) => {
+    const [xStr, hex] = s.split(":");
+    return {
+      x: Number.parseInt(xStr, 10),
+      y: import_node_buffer2.Buffer.from(hex, "hex")
+    };
+  });
+  const secretLen = parsedShares[0].y.length;
+  const secretBuffer = import_node_buffer2.Buffer.alloc(secretLen);
+  for (let byteIdx = 0; byteIdx < secretLen; byteIdx++) {
+    let secretByte = 0;
+    for (let i = 0; i < parsedShares.length; i++) {
+      let li = 1;
+      for (let j = 0; j < parsedShares.length; j++) {
+        if (i === j) continue;
+        const num = parsedShares[j].x;
+        const denom = parsedShares[i].x ^ parsedShares[j].x;
+        li = gfMul(li, gfDiv(num, denom));
+      }
+      secretByte = secretByte ^ gfMul(parsedShares[i].y[byteIdx], li);
+    }
+    secretBuffer[byteIdx] = secretByte;
+  }
+  return secretBuffer;
+};
+var blindData = (data, factor) => {
+  return (0, import_node_crypto4.createHmac)("sha256", factor).update(data).digest("hex");
+};
+var generateToken = (length = 32, encoding = "hex") => {
+  return (0, import_node_crypto4.randomBytes)(length).toString(encoding);
+};
+var deriveSubKey = (secret, info, length = 32) => {
+  const ikm = import_node_buffer2.Buffer.isBuffer(secret) ? secret : import_node_buffer2.Buffer.from(secret);
+  const derived = (0, import_node_crypto4.hkdfSync)("sha256", ikm, import_node_buffer2.Buffer.alloc(0), import_node_buffer2.Buffer.from(info), length);
+  return import_node_buffer2.Buffer.from(derived).toString("hex");
+};
+var encryptSession = (obj, key) => {
+  const iv = (0, import_node_crypto4.randomBytes)(12);
+  const keyBuffer = import_node_buffer2.Buffer.isBuffer(key) ? key : import_node_buffer2.Buffer.from(key, "hex");
+  const cipher = (0, import_node_crypto4.createCipheriv)("aes-256-gcm", keyBuffer, iv);
+  const content = JSON.stringify(obj);
+  let encrypted = cipher.update(content, "utf8", "hex");
+  encrypted += cipher.final("hex");
+  const authTag = cipher.getAuthTag().toString("hex");
+  return `${iv.toString("hex")}:${authTag}:${encrypted}`;
+};
+var decryptSession = (sessionStr, key) => {
+  try {
+    const [ivHex, authTagHex, encrypted] = sessionStr.split(":");
+    const keyBuffer = import_node_buffer2.Buffer.isBuffer(key) ? key : import_node_buffer2.Buffer.from(key, "hex");
+    const iv = import_node_buffer2.Buffer.from(ivHex, "hex");
+    const authTag = import_node_buffer2.Buffer.from(authTagHex, "hex");
+    const decipher = (0, import_node_crypto4.createDecipheriv)("aes-256-gcm", keyBuffer, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(encrypted, "hex", "utf8");
+    decrypted += decipher.final("utf8");
+    return JSON.parse(decrypted);
+  } catch {
+    return null;
+  }
+};
+var WOTS_LEN = 67;
+var _usedWotsKeys = /* @__PURE__ */ new Set();
+var generatePQCKeyPair = () => {
+  const privKeyParts = [];
+  const pubKeyParts = [];
+  for (let i = 0; i < WOTS_LEN; i++) {
+    const part = (0, import_node_crypto4.randomBytes)(32).toString("hex");
+    privKeyParts.push(part);
+    let current = import_node_buffer2.Buffer.from(part, "hex");
+    for (let j = 0; j < 15; j++) {
+      current = (0, import_node_crypto4.createHash)("sha256").update(current).digest();
+    }
+    pubKeyParts.push(current.toString("hex"));
+  }
+  return {
+    publicKey: pubKeyParts.join(";"),
+    privateKey: privKeyParts.join(";")
+  };
+};
+var signPQC = (data, privateKeyStr) => {
+  const msgHash = (0, import_node_crypto4.createHash)("sha256").update(data).digest();
+  const nibbles = [];
+  let checksum = 0;
+  for (let i = 0; i < 32; i++) {
+    const byte = msgHash[i];
+    const n1 = byte >> 4;
+    const n2 = byte & 15;
+    nibbles.push(n1, n2);
+    checksum += 15 - n1 + (15 - n2);
+  }
+  const c1 = checksum >> 8 & 15;
+  const c2 = checksum >> 4 & 15;
+  const c3 = checksum & 15;
+  nibbles.push(c1, c2, c3);
+  const privParts = privateKeyStr.split(";");
+  if (privParts.length !== WOTS_LEN) throw new Error("Invalid private key length.");
+  const keyFingerprint = (0, import_node_crypto4.createHash)("sha256").update(privParts[0]).digest("hex");
+  if (_usedWotsKeys.has(keyFingerprint)) {
+    throw new Error(
+      "WOTS_KEY_REUSE: This WOTS private key has already been used to sign a message. Reusing a WOTS key leaks private key material and breaks the security of the scheme. Generate a new key pair with generatePQCKeyPair() for each message."
+    );
+  }
+  _usedWotsKeys.add(keyFingerprint);
+  const sigParts = [];
+  for (let i = 0; i < WOTS_LEN; i++) {
+    const n = nibbles[i];
+    let current = import_node_buffer2.Buffer.from(privParts[i], "hex");
+    for (let j = 0; j < n; j++) {
+      current = (0, import_node_crypto4.createHash)("sha256").update(current).digest();
+    }
+    sigParts.push(current.toString("hex"));
+  }
+  return sigParts.join(";");
+};
+var verifyPQCSignature = (data, signature, publicKey) => {
+  try {
+    const msgHash = (0, import_node_crypto4.createHash)("sha256").update(data).digest();
+    const nibbles = [];
+    let checksum = 0;
+    for (let i = 0; i < 32; i++) {
+      const byte = msgHash[i];
+      const n1 = byte >> 4;
+      const n2 = byte & 15;
+      nibbles.push(n1, n2);
+      checksum += 15 - n1 + (15 - n2);
+    }
+    const c1 = checksum >> 8 & 15;
+    const c2 = checksum >> 4 & 15;
+    const c3 = checksum & 15;
+    nibbles.push(c1, c2, c3);
+    const sigParts = signature.split(";");
+    const pubParts = publicKey.split(";");
+    if (sigParts.length !== WOTS_LEN || pubParts.length !== WOTS_LEN) return false;
+    for (let i = 0; i < WOTS_LEN; i++) {
+      const n = nibbles[i];
+      let current = import_node_buffer2.Buffer.from(sigParts[i], "hex");
+      for (let j = 0; j < 15 - n; j++) {
+        current = (0, import_node_crypto4.createHash)("sha256").update(current).digest();
+      }
+      const expected = import_node_buffer2.Buffer.from(pubParts[i], "hex");
+      if (!(0, import_node_crypto4.timingSafeEqual)(current, expected)) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+};
+var hashPassword = async (password, salt) => {
+  const actualSalt = salt || generateToken(16);
+  const derivedKey = await scryptAsync(password, actualSalt, 64);
+  return { hash: derivedKey.toString("hex"), salt: actualSalt };
+};
+var verifyPassword = async (password, storedHash, salt) => {
+  const { hash } = await hashPassword(password, salt);
+  const hashBuffer = import_node_buffer2.Buffer.from(hash, "hex");
+  const storedBuffer = import_node_buffer2.Buffer.from(storedHash, "hex");
+  if (hashBuffer.length !== storedBuffer.length) return false;
+  return (0, import_node_crypto4.timingSafeEqual)(hashBuffer, storedBuffer);
+};
+var sha256 = (data) => {
+  return (0, import_node_crypto4.createHash)("sha256").update(data).digest("hex");
+};
+var startWorkerIfChild = async () => {
+  try {
+    const { isMainThread, parentPort, workerData } = await import("worker_threads");
+    if (!isMainThread && parentPort) {
+      try {
+        const { functionName, args = [] } = workerData || {};
+        if (functionName === "hashPassword") {
+          const [password, salt] = args;
+          if (password === void 0) {
+            parentPort.postMessage({ status: "success" });
+          } else {
+            hashPassword(password, salt).then((result) => {
+              parentPort.postMessage({ status: "success", result });
+            }).catch((err) => {
+              parentPort.postMessage({ status: "error", error: err.message });
+            });
+          }
+        } else if (functionName === "splitSecret") {
+          const [secret, sharesCount, threshold] = args;
+          const result = splitSecret(secret, sharesCount, threshold);
+          parentPort.postMessage({ status: "success", result });
+        } else if (functionName === "reconstructSecret") {
+          const [shares] = args;
+          const result = reconstructSecret(shares);
+          parentPort.postMessage({ status: "success", result: result.toString("hex") });
+        } else {
+          parentPort.postMessage({ status: "error", error: `Unknown function: ${functionName}` });
+        }
+      } catch (err) {
+        parentPort.postMessage({ status: "error", error: err.message });
+      }
+    }
+  } catch {
+  }
+};
+startWorkerIfChild();
+
+// src/fs/index.ts
+var fs_exports = {};
+__export(fs_exports, {
+  MAGIC_NUMBERS: () => MAGIC_NUMBERS,
+  isPathSafe: () => isPathSafe,
+  resolveSafePath: () => resolveSafePath,
+  safeRead: () => safeRead,
+  verifyMagicNumber: () => verifyMagicNumber
+});
+var import_node_path = require("path");
+var MAGIC_NUMBERS = {
+  PNG: [137, 80, 78, 71],
+  JPEG: [255, 216, 255],
+  PDF: [37, 80, 68, 70],
+  GIF: [71, 73, 70, 56]
+};
+var resolveSafePath = (rootDir, userInputPath) => {
+  const absoluteRoot = (0, import_node_path.resolve)(rootDir);
+  const resolvedPath = (0, import_node_path.resolve)(absoluteRoot, userInputPath);
+  const relativePath = (0, import_node_path.relative)(absoluteRoot, resolvedPath);
+  if (relativePath.startsWith("..") || (0, import_node_path.isAbsolute)(relativePath)) {
+    throw new Error("Security Error: Path traversal attempt detected.");
+  }
+  return resolvedPath;
+};
+var verifyMagicNumber = async (filePath, expectedMagic) => {
+  const fs = await import("fs/promises");
+  const handle = await fs.open(filePath, "r");
+  try {
+    const buffer = Buffer.alloc(expectedMagic.length);
+    await handle.read(buffer, 0, expectedMagic.length, 0);
+    return expectedMagic.every((byte, index) => buffer[index] === byte);
+  } finally {
+    await handle.close();
+  }
+};
+var safeRead = async (rootDir, filePath) => {
+  const fs = await import("fs/promises");
+  const safePath = resolveSafePath(rootDir, filePath);
+  return fs.readFile(safePath, "utf8");
+};
+var isPathSafe = (rootDir, filePath) => {
+  try {
+    resolveSafePath(rootDir, filePath);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+// src/http/index.ts
+var http_exports = {};
+__export(http_exports, {
+  analyzeDoSThreat: () => analyzeDoSThreat,
+  generateFingerprint: () => generateFingerprint,
+  generateSRI: () => generateSRI,
+  generateTLSFingerprint: () => generateTLSFingerprint,
+  getHardenedRequestOptions: () => getHardenedRequestOptions,
+  isSafeRedirect: () => isSafeRedirect,
+  isSecure: () => isSecure,
+  normalizeUrl: () => normalizeUrl,
+  projectNoise: () => projectNoise
+});
+var import_node_crypto5 = require("crypto");
+var isSecure = (url, headers = {}) => {
+  if (url?.startsWith("https://")) return true;
+  const proto = headers["x-forwarded-proto"];
+  if (typeof proto === "string" && proto.toLowerCase() === "https") return true;
+  return false;
+};
+var normalizeUrl = (url) => {
+  try {
+    const parsed = new URL(url);
+    parsed.pathname = parsed.pathname.replaceAll("//", "/");
+    return parsed.toString();
+  } catch {
+    return url.replaceAll("//", "/");
+  }
+};
+var getHardenedRequestOptions = (options = {}) => {
+  return {
+    ...options,
+    minVersion: "TLSv1.3",
+    ciphers: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256",
+    rejectUnauthorized: true
+  };
+};
+var generateTLSFingerprint = (req) => {
+  const headers = req.headers || {};
+  const fingerprintParts = [
+    headers["user-agent"] || "",
+    headers["accept"] || "",
+    headers["accept-language"] || "",
+    headers["accept-encoding"] || "",
+    headers["connection"] || "",
+    headers["upgrade-insecure-requests"] || ""
+  ];
+  return (0, import_node_crypto5.createHash)("sha256").update(fingerprintParts.join("|")).digest("hex");
+};
+var analyzeDoSThreat = (req) => {
+  const headers = req.headers || {};
+  if (headers["transfer-encoding"] && headers["content-length"]) return true;
+  if (headers["connection"] === "keep-alive" && !headers["content-length"] && req.method === "POST")
+    return true;
+  return false;
+};
+var generateFingerprint = (reqHeaders, ip) => {
+  const parts = [
+    ip,
+    reqHeaders["user-agent"] || "unknown",
+    reqHeaders["accept-language"] || "unknown",
+    reqHeaders["accept-encoding"] || "unknown",
+    reqHeaders["sec-ch-ua"] || "unknown",
+    reqHeaders["sec-ch-ua-platform"] || "unknown"
+  ];
+  return (0, import_node_crypto5.createHash)("sha256").update(parts.join("|")).digest("hex");
+};
+var projectNoise = (obj) => {
+  if (typeof obj !== "object" || obj === null) return obj;
+  const noiseCount = (0, import_node_crypto5.randomInt)(1, 4);
+  const result = { ...obj };
+  for (let i = 0; i < noiseCount; i++) {
+    const noiseKey = `_sk_${(0, import_node_crypto5.randomBytes)(4).toString("hex")}`;
+    const noiseValue = (0, import_node_crypto5.randomBytes)(8).toString("base64");
+    result[noiseKey] = noiseValue;
+  }
+  return result;
+};
+var isSafeRedirect = (url, allowedHosts = []) => {
+  if (url.startsWith("/")) return !url.startsWith("//");
+  try {
+    const parsed = new URL(url);
+    return allowedHosts.includes(parsed.hostname);
+  } catch {
+    return false;
+  }
+};
+var generateSRI = (data, algorithm = "sha384") => {
+  const hash = (0, import_node_crypto5.createHash)(algorithm).update(data).digest("base64");
+  return `${algorithm}-${hash}`;
+};
+
+// src/rate-limit/index.ts
+var rate_limit_exports = {};
+__export(rate_limit_exports, {
+  AdaptiveRateLimiter: () => AdaptiveRateLimiter,
+  MemoryStore: () => MemoryStore,
+  RateLimiter: () => RateLimiter,
+  RedisStore: () => RedisStore,
+  TokenBucket: () => TokenBucket
+});
+var MemoryStore = class {
+  constructor(windowMs) {
+    this.windowMs = windowMs;
+    this.gcInterval = setInterval(() => this.gc(), 6e4);
+    if (this.gcInterval.unref) {
+      this.gcInterval.unref();
+    }
+  }
+  windowMs;
+  hits = /* @__PURE__ */ new Map();
+  gcInterval;
+  gc() {
+    const now = Date.now();
+    for (const [key, hit] of this.hits.entries()) {
+      if (now > hit.expires) {
+        this.hits.delete(key);
+      }
+    }
+  }
+  async increment(key, amount = 1) {
+    const now = Date.now();
+    const hit = this.hits.get(key);
+    if (!hit || now > hit.expires) {
+      this.hits.set(key, { count: amount, expires: now + this.windowMs });
+      return amount;
+    }
+    hit.count += amount;
+    return hit.count;
+  }
+  async get(key) {
+    const hit = this.hits.get(key);
+    if (!hit || Date.now() > hit.expires) return void 0;
+    return hit.count;
+  }
+  async reset(key) {
+    this.hits.delete(key);
+  }
+  async setTTL(key, value, ttlMs) {
+    this.hits.set(key, { count: value, expires: Date.now() + ttlMs });
+  }
+  // Cleanup method if needed
+  destroy() {
+    clearInterval(this.gcInterval);
+  }
+};
+var RedisStore = class {
+  constructor(redisClient, windowMs, prefix = "rl:") {
+    this.redisClient = redisClient;
+    this.windowMs = windowMs;
+    this.prefix = prefix;
+  }
+  redisClient;
+  windowMs;
+  prefix;
+  async increment(key, amount = 1) {
+    const prefixedKey = this.prefix + key;
+    const multi = this.redisClient.multi();
+    multi.incrby(prefixedKey, amount);
+    multi.pttl(prefixedKey);
+    const results = await multi.exec();
+    const count = Number.parseInt(results[0][1], 10);
+    const ttl = Number.parseInt(results[1][1], 10);
+    if (ttl === -1) {
+      await this.redisClient.pexpire(prefixedKey, this.windowMs);
+    }
+    return count;
+  }
+  async get(key) {
+    const val = await this.redisClient.get(this.prefix + key);
+    return val ? Number.parseInt(val, 10) : void 0;
+  }
+  async reset(key) {
+    await this.redisClient.del(this.prefix + key);
+  }
+  async setTTL(key, value, ttlMs) {
+    const prefixedKey = this.prefix + key;
+    await this.redisClient.set(prefixedKey, value, "PX", ttlMs);
+  }
+};
+var TokenBucket = class {
+  constructor(capacity, refillRatePerSecond) {
+    this.capacity = capacity;
+    this.refillRatePerSecond = refillRatePerSecond;
+  }
+  capacity;
+  refillRatePerSecond;
+  buckets = /* @__PURE__ */ new Map();
+  async consume(id, tokens = 1) {
+    const now = Date.now();
+    const bucket = this.buckets.get(id);
+    if (bucket) {
+      const delta = (now - bucket.lastRefill) / 1e3;
+      const refill = delta * this.refillRatePerSecond;
+      bucket.tokens = Math.min(this.capacity, bucket.tokens + refill);
+      bucket.lastRefill = now;
+    } else {
+      const newBucket = { tokens: this.capacity, lastRefill: now };
+      if (newBucket.tokens >= tokens) {
+        newBucket.tokens -= tokens;
+        this.buckets.set(id, newBucket);
+        return true;
+      }
+      this.buckets.set(id, newBucket);
+      return false;
+    }
+    if (bucket.tokens >= tokens) {
+      bucket.tokens -= tokens;
+      this.buckets.set(id, bucket);
+      return true;
+    }
+    this.buckets.set(id, bucket);
+    return false;
+  }
+};
+var AdaptiveRateLimiter = class {
+  constructor(config, store, securityStore, burstStore) {
+    this.config = config;
+    this.store = store || new MemoryStore(config.windowMs);
+    this.securityStore = securityStore || new MemoryStore(config.windowMs);
+    this.burstStore = burstStore || new MemoryStore(config.windowMs * 10);
+  }
+  config;
+  store;
+  securityStore;
+  burstStore;
+  ipCheckers = [];
+  /**
+   * Automates Incident Response by globally "killing" a session or IP.
+   * This sets an infinite (effectively 1-year) block on the ID.
+   *
+   * @param id The client ID to block.
+   *
+   * @remarks
+   * **Persistence warning**: If the underlying store is `MemoryStore` (the default),
+   * the block is held in process memory and will be **lost on process restart**.
+   * For a persistent kill-switch that survives restarts and works across multiple
+   * instances, pass a `RedisStore` as the `store` and `securityStore` arguments
+   * to the `AdaptiveRateLimiter` constructor.
+   *
+   * @see {@link RedisStore} for a production-grade persistent store.
+   */
+  async triggerGlobalKillSwitch(id) {
+    getTelemetryProvider().onKillSwitchTriggered?.(id);
+    const ONE_YEAR_MS = 365 * 24 * 60 * 60 * 1e3;
+    await this.securityStore.setTTL(`${id}:score`, 99999, ONE_YEAR_MS);
+    await this.store.setTTL(id, 99999, ONE_YEAR_MS);
+    console.warn(`Mitigator: Global Kill-Switch triggered for actor: ${id}`);
+  }
+  registerIPChecker(checker) {
+    this.ipCheckers.push(checker);
+  }
+  async recordSecurityEvent(id, weight = 1) {
+    getTelemetryProvider().onSecurityEvent?.(id, weight);
+    await this.securityStore.increment(`${id}:score`, weight);
+  }
+  async isLimited(id) {
+    for (const checker of this.ipCheckers) {
+      if (await checker(id)) return true;
+    }
+    const score = await this.securityStore.get(`${id}:score`) || 0;
+    const bursts = await this.burstStore.get(`${id}:bursts`) || 0;
+    const isCompromised = score >= this.config.securityThreshold || bursts >= this.config.burstThreshold;
+    const currentLimit = isCompromised ? this.config.penaltyLimit : this.config.standardLimit;
+    const count = await this.store.increment(id);
+    if (count > currentLimit) {
+      if (count === currentLimit + 1) {
+        await this.burstStore.increment(`${id}:bursts`, 1);
+      }
+      getTelemetryProvider().onRateLimitBlocked?.(id, isCompromised ? "penalty" : "standard");
+      return true;
+    }
+    return false;
+  }
+  async isHighRisk(id) {
+    const score = await this.securityStore.get(`${id}:score`) || 0;
+    const bursts = await this.burstStore.get(`${id}:bursts`) || 0;
+    return score >= this.config.securityThreshold || bursts >= this.config.burstThreshold;
+  }
+};
+var RateLimiter = class {
+  constructor(limit, windowMs, store) {
+    this.limit = limit;
+    this.windowMs = windowMs;
+    this.store = store || new MemoryStore(windowMs);
+  }
+  limit;
+  windowMs;
+  store;
+  async isLimited(id) {
+    const count = await this.store.increment(id);
+    return count > this.limit;
+  }
+};
+
+// src/safe-json/index.ts
+var safe_json_exports = {};
+__export(safe_json_exports, {
+  containsPollution: () => containsPollution,
+  getDepth: () => getDepth,
+  parse: () => parse
+});
+var parse = (text, maxDepth = 10) => {
+  const obj = JSON.parse(text, (key, value) => {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      return void 0;
+    }
+    return value;
+  });
+  if (getDepth(obj) > maxDepth) {
+    throw new Error("Security Error: JSON depth limit exceeded (DoS protection).");
+  }
+  return obj;
+};
+var getDepth = (obj) => {
+  if (obj === null || typeof obj !== "object") return 0;
+  let max = 0;
+  for (const key in obj) {
+    if (Object.hasOwn(obj, key)) {
+      max = Math.max(max, getDepth(obj[key]));
+    }
+  }
+  return 1 + max;
+};
+var containsPollution = (obj) => {
+  if (obj === null || typeof obj !== "object") return false;
+  for (const key in obj) {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      return true;
+    }
+    if (containsPollution(obj[key])) {
+      return true;
+    }
+  }
+  return false;
+};
+
+// src/safe-merge/index.ts
+var safe_merge_exports = {};
+__export(safe_merge_exports, {
+  deepFreeze: () => deepFreeze,
+  merge: () => merge,
+  sanitizeObject: () => sanitizeObject
+});
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var isObject = (val) => {
+  return val !== null && typeof val === "object" && !Array.isArray(val);
+};
+var merge = (target, source, seen = /* @__PURE__ */ new WeakSet()) => {
+  if (seen.has(source)) {
+    throw new Error(
+      "Security Error: Circular reference detected during deep merge (DoS prevention)."
+    );
+  }
+  const output = { ...target };
+  if (isObject(target) && isObject(source)) {
+    seen.add(source);
+    Object.keys(source).forEach((key) => {
+      if (DANGEROUS_KEYS.has(key)) {
+        return;
+      }
+      const sourceValue = source[key];
+      const targetValue = target[key];
+      if (isObject(sourceValue) && isObject(targetValue)) {
+        output[key] = merge(targetValue, sourceValue, seen);
+      } else {
+        output[key] = sourceValue;
+      }
+    });
+  }
+  return output;
+};
+var sanitizeObject = (obj, seen = /* @__PURE__ */ new WeakSet()) => {
+  if (obj === null || typeof obj !== "object") return obj;
+  if (seen.has(obj)) {
+    throw new Error("Security Error: Circular reference detected during object sanitization.");
+  }
+  if (Array.isArray(obj)) {
+    seen.add(obj);
+    return obj.map((item) => sanitizeObject(item, seen));
+  }
+  seen.add(obj);
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (DANGEROUS_KEYS.has(key)) continue;
+    result[key] = sanitizeObject(value, seen);
+  }
+  return result;
+};
+var deepFreeze = (obj) => {
+  Object.getOwnPropertyNames(obj).forEach((name) => {
+    const prop = obj[name];
+    if (prop !== null && typeof prop === "object") {
+      deepFreeze(prop);
+    }
+  });
+  return Object.freeze(obj);
+};
+
+// src/utils/index.ts
+var utils_exports = {};
+__export(utils_exports, {
+  SENSITIVE_KEYS: () => SENSITIVE_KEYS,
+  SecureError: () => SecureError,
+  auditConfig: () => auditConfig,
+  checkSecureEnv: () => checkSecureEnv,
+  createMTLSOptions: () => createMTLSOptions,
+  deterministicDigitTransform: () => deterministicDigitTransform,
+  enforceSafeQuery: () => enforceSafeQuery,
+  lockdownPrototypes: () => lockdownPrototypes,
+  normalizeError: () => normalizeError,
+  redact: () => redact,
+  standardSecurityPreset: () => standardSecurityPreset,
+  startSelfHealingMonitor: () => startSelfHealingMonitor,
+  wipeBuffer: () => wipeBuffer
+});
+var import_node_crypto6 = require("crypto");
+var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
+  "password",
+  "token",
+  "secret",
+  "key",
+  "authorization",
+  "apiKey",
+  "access_token",
+  "refresh_token",
+  "cvv",
+  "card_number",
+  "ssn"
+]);
+var redact = (obj, redactKeys = SENSITIVE_KEYS) => {
+  if (obj === null || typeof obj !== "object") return obj;
+  if (Array.isArray(obj)) return obj.map((item) => redact(item, redactKeys));
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (redactKeys.has(key.toLowerCase())) {
+      result[key] = "[REDACTED]";
+    } else if (typeof value === "object") {
+      result[key] = redact(value, redactKeys);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+};
+var SecureError = class extends Error {
+  code;
+  userMessage;
+  constructor(message, code = "INTERNAL_ERROR", userMessage = "An unexpected error occurred.") {
+    super(message);
+    this.name = "SecureError";
+    this.code = code;
+    this.userMessage = userMessage;
+    if (process.env.NODE_ENV === "production") this.stack = "";
+  }
+  toJSON() {
+    return { error: true, code: this.code, message: this.userMessage };
+  }
+};
+var normalizeError = (error) => {
+  if (error instanceof SecureError) return error;
+  return new SecureError(error?.message || "Unknown error");
+};
+var wipeBuffer = (buf) => {
+  if (Array.isArray(buf)) {
+    for (let i = 0; i < buf.length; i++) buf[i] = 0;
+  } else if (buf instanceof Buffer || buf instanceof Uint8Array) {
+    buf.fill(0);
+  }
+};
+var startSelfHealingMonitor = (config, type, intervalMs = 6e5, logger = console) => {
+  setInterval(() => {
+    const issues = auditConfig(config, type);
+    if (issues.length > 0) {
+      logger.error("MITIGATOR CRITICAL: Self-healing monitor detected insecure config drift!");
+      issues.forEach((issue) => logger.error(`- ${issue}`));
+    }
+  }, intervalMs).unref();
+};
+var enforceSafeQuery = (query, params) => {
+  if ((!params || params.length === 0) && query.toLowerCase().includes("where")) {
+    const suspicious = ["'", '"', "=", "--", ";"];
+    if (suspicious.some((char) => query.includes(char))) {
+      throw new SecureError(
+        "Security Violation: Unparameterized query detected.",
+        "SQL_INJECTION_RISK"
+      );
+    }
+  }
+};
+var deterministicDigitTransform = (input, secret) => {
+  const hash = (0, import_node_crypto6.createHash)("sha256").update(input).update(secret).digest("hex");
+  let result = "";
+  for (let i = 0; i < input.length; i++) {
+    const digit = Number.parseInt(input[i]);
+    const offset = Number.parseInt(hash[i % hash.length], 16);
+    result += ((digit + offset) % 10).toString();
+  }
+  return result;
+};
+var checkSecureEnv = () => {
+  const isProd = process.env.NODE_ENV === "production";
+  if (isProd) {
+    if (!process.env.SESSION_SECRET || process.env.SESSION_SECRET.length < 32) {
+      console.warn("Security Warning: SESSION_SECRET is missing or too short.");
+    }
+  }
+};
+var auditConfig = (config, type) => {
+  const issues = [];
+  if (type === "db") {
+    if (config.ssl === false) issues.push("Database SSL is disabled.");
+    if (config.port === 3306 || config.port === 5432)
+      issues.push("Database is using a default port.");
+  } else if (type === "auth") {
+    if (config.allowInsecurePasswordReset) issues.push("Allowing insecure password reset.");
+  }
+  return issues;
+};
+var lockdownPrototypes = () => {
+  try {
+    Object.freeze(Object.prototype);
+    Object.freeze(Array.prototype);
+    Object.freeze(String.prototype);
+  } catch {
+    console.error("Mitigator Error: Failed to lockdown prototypes.");
+  }
+};
+var createMTLSOptions = (serverCert, serverKey, caCert) => {
+  return {
+    cert: serverCert,
+    key: serverKey,
+    ca: caCert,
+    requestCert: true,
+    rejectUnauthorized: true
+  };
+};
+var standardSecurityPreset = {
+  trustProxy: true,
+  strictTransportSecurity: { maxAge: 31536e3, includeSubDomains: true, preload: true },
+  contentSecurityPolicy: true,
+  referrerPolicy: "strict-origin-when-cross-origin"
+};
+
+// src/utils/presets.ts
+var presets_exports = {};
+__export(presets_exports, {
+  NestJsMitigatorMiddleware: () => NestJsMitigatorMiddleware,
+  SecureLoggerChain: () => SecureLoggerChain,
+  createSecureLogger: () => createSecureLogger,
+  expressErrorHandler: () => expressErrorHandler,
+  expressMiddleware: () => expressMiddleware,
+  fastifyPlugin: () => fastifyPlugin,
+  nextJsMiddleware: () => nextJsMiddleware
+});
+var import_node_crypto7 = require("crypto");
+var expressMiddleware = (options = {}) => {
+  const limiter = options.rateLimit ? new RateLimiter(
+    options.rateLimitMax || 100,
+    options.rateLimitWindowMs || 6e4,
+    new MemoryStore(options.rateLimitWindowMs || 6e4)
+  ) : null;
+  return async (req, res, next) => {
+    Object.entries(standardHeaders).forEach(([key, value]) => {
+      res.setHeader(key, value);
+    });
+    if (limiter) {
+      const ip = req.ip || req.connection.remoteAddress || "unknown";
+      if (await limiter.isLimited(ip)) {
+        return res.status(429).json({ error: "Too Many Requests" });
+      }
+    }
+    try {
+      if (req.body && typeof req.body === "object") {
+        if (scanForSecrets(req.body)) {
+          return next(
+            new SecureError("Security Violation: Potential secret leakage detected.", "BAD_INPUT")
+          );
+        }
+      }
+    } catch {
+      return next(new SecureError("Security Violation: Suspicious input detected.", "BAD_INPUT"));
+    }
+    req.mitigator = {
+      sanitize: (html) => sanitizeHtml(html),
+      safeJson: (text) => parse(text)
+    };
+    next();
+  };
+};
+var nextJsMiddleware = (_req, res) => {
+  Object.entries(standardHeaders).forEach(([key, value]) => {
+    res.headers.set(key, value);
+  });
+  return res;
+};
+var expressErrorHandler = (err, _req, res, _next) => {
+  const secureErr = err instanceof SecureError ? err : new SecureError(err.message);
+  res.status(secureErr.code === "BAD_INPUT" ? 400 : 500).json(secureErr.toJSON());
+};
+var SecureLoggerChain = class {
+  constructor(baseLogger) {
+    this.baseLogger = baseLogger;
+    this.lastHash = (0, import_node_crypto7.createHash)("sha256").update(Date.now().toString()).digest("hex");
+  }
+  baseLogger;
+  lastHash = "";
+  chain(msg, data) {
+    const payload = JSON.stringify({ msg, data, prev: this.lastHash });
+    this.lastHash = (0, import_node_crypto7.createHash)("sha256").update(payload).digest("hex");
+    return this.lastHash;
+  }
+  info(msg, data) {
+    const hash = this.chain(msg, data);
+    this.baseLogger.info(`[CHAIN:${hash}] ${msg}`, redact(data));
+  }
+  warn(msg, data) {
+    if (scanForSecrets(data)) {
+      this.baseLogger.warn("CRITICAL: Secret leakage blocked!");
+      return;
+    }
+    const hash = this.chain(msg, data);
+    this.baseLogger.warn(`[CHAIN:${hash}] ${msg}`, redact(data));
+  }
+  error(msg, err) {
+    const secureErr = err instanceof SecureError ? err : new SecureError(err?.message || "Error");
+    const hash = this.chain(msg, secureErr.toJSON());
+    this.baseLogger.error(`[CHAIN:${hash}] ${msg}`, redact(secureErr.toJSON()));
+  }
+};
+var createSecureLogger = (baseLogger) => new SecureLoggerChain(baseLogger);
+var fastifyPlugin = (options = {}) => {
+  const limiter = options.rateLimit ? new RateLimiter(
+    options.rateLimitMax || 100,
+    options.rateLimitWindowMs || 6e4,
+    new MemoryStore(options.rateLimitWindowMs || 6e4)
+  ) : null;
+  return async (fastify) => {
+    fastify.addHook("onRequest", async (req, reply) => {
+      Object.entries(standardHeaders).forEach(([key, value]) => {
+        reply.header(key, value);
+      });
+      if (limiter) {
+        const ip = req.ip || "unknown";
+        if (await limiter.isLimited(ip)) {
+          reply.code(429).send({ error: "Too Many Requests" });
+          return reply;
+        }
+      }
+    });
+    fastify.addHook("preHandler", async (req, reply) => {
+      try {
+        if (req.body && typeof req.body === "object") {
+          if (scanForSecrets(req.body)) {
+            throw new SecureError(
+              "Security Violation: Potential secret leakage detected.",
+              "BAD_INPUT"
+            );
+          }
+        }
+      } catch (err) {
+        const secureErr = err instanceof SecureError ? err : new SecureError(err.message, "BAD_INPUT");
+        reply.code(400).send(secureErr.toJSON());
+        return reply;
+      }
+      req.mitigator = {
+        sanitize: (html) => sanitizeHtml(html),
+        safeJson: (text) => parse(text)
+      };
+    });
+  };
+};
+var NestJsMitigatorMiddleware = class _NestJsMitigatorMiddleware {
+  static limiter = null;
+  static configure(options = {}) {
+    if (options.rateLimit) {
+      this.limiter = new RateLimiter(
+        options.rateLimitMax || 100,
+        options.rateLimitWindowMs || 6e4,
+        new MemoryStore(options.rateLimitWindowMs || 6e4)
+      );
+    }
+  }
+  async use(req, res, next) {
+    Object.entries(standardHeaders).forEach(([key, value]) => {
+      res.setHeader(key, value);
+    });
+    if (_NestJsMitigatorMiddleware.limiter) {
+      const ip = req.ip || req.connection?.remoteAddress || "unknown";
+      if (await _NestJsMitigatorMiddleware.limiter.isLimited(ip)) {
+        res.status(429).json({ error: "Too Many Requests" });
+        return;
+      }
+    }
+    try {
+      if (req.body && typeof req.body === "object") {
+        if (scanForSecrets(req.body)) {
+          throw new SecureError(
+            "Security Violation: Potential secret leakage detected.",
+            "BAD_INPUT"
+          );
+        }
+      }
+    } catch (err) {
+      const secureErr = err instanceof SecureError ? err : new SecureError(err.message, "BAD_INPUT");
+      res.status(400).json(secureErr.toJSON());
+      return;
+    }
+    req.mitigator = {
+      sanitize: (html) => sanitizeHtml(html),
+      safeJson: (text) => parse(text)
+    };
+    next();
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  auth,
+  crypto,
+  fs,
+  headers,
+  http,
+  presets,
+  rateLimit,
+  safeJson,
+  safeMerge,
+  sanitize,
+  telemetry,
+  utils,
+  validate
+});
+//# sourceMappingURL=index.cjs.map