mitigator 1.0.0

package/dist/index.d.cts

@@ -0,0 +1,1116 @@
+import { Buffer as Buffer$1 } from 'node:buffer';
+import * as https from 'node:https';
+
+/**
+ * Basic HTML escaping for common characters.
+ */
+declare const escapeHtml: (input: string) => string;
+/**
+ * Strips all HTML tags from a string.
+ */
+declare const stripTags: (input: string) => string;
+/**
+ * Standard allowlist for "clean" HTML sanitization.
+ */
+declare const ALLOWLIST: Record<string, string[]>;
+/**
+ * Robust HTML sanitizer.
+ * Uses the industry-standard `sanitize-html` library.
+ */
+declare const sanitizeHtml: (html: string, rules?: Record<string, string[]>) => string;
+/**
+ * Defensive post-processor that namespaces 'id' and 'name' attributes to prevent DOM Clobbering attacks.
+ * Attackers use clobbering to overwrite global variables (window.foo) by naming an element 'id=foo'.
+ *
+ * @param html The HTML string to process.
+ * @param prefix The unique namespace prefix (default: sk-).
+ */
+declare const preventDOMClobbering: (html: string, prefix?: string) => string;
+/**
+ * Basic SVG & MathML sanitization.
+ */
+declare const sanitizeMediaTags: (html: string) => string;
+/**
+ * Validates if a string is a safe URL.
+ */
+declare const isSafeUrl: (url: string) => boolean;
+
+declare const index$a_ALLOWLIST: typeof ALLOWLIST;
+declare const index$a_escapeHtml: typeof escapeHtml;
+declare const index$a_isSafeUrl: typeof isSafeUrl;
+declare const index$a_preventDOMClobbering: typeof preventDOMClobbering;
+declare const index$a_sanitizeHtml: typeof sanitizeHtml;
+declare const index$a_sanitizeMediaTags: typeof sanitizeMediaTags;
+declare const index$a_stripTags: typeof stripTags;
+declare namespace index$a {
+  export { index$a_ALLOWLIST as ALLOWLIST, index$a_escapeHtml as escapeHtml, index$a_isSafeUrl as isSafeUrl, index$a_preventDOMClobbering as preventDOMClobbering, index$a_sanitizeHtml as sanitizeHtml, index$a_sanitizeMediaTags as sanitizeMediaTags, index$a_stripTags as stripTags };
+}
+
+/**
+ * Result returned by `checkPwnedPassword`.
+ * Always resolves (never rejects) to preserve fail-open availability semantics.
+ */
+interface CheckPwnedResult {
+    /** Number of times this password appeared in known data breaches. 0 if not found. */
+    count: number;
+    /**
+     * Whether the HIBP API was reachable during this check.
+     * If `false`, the result is inconclusive — the password may or may not be compromised.
+     * Callers should treat `apiAvailable: false` as a signal to retry or log a warning.
+     */
+    apiAvailable: boolean;
+}
+/**
+ * Checks if a password has been leaked in a data breach using the Have I Been Pwned (HIBP) API.
+ * Uses k-Anonymity (sending only the first 5 characters of the SHA-1 hash) to ensure
+ * the password is never exposed to the API.
+ *
+ * Always resolves — never rejects. If the API is unreachable, `apiAvailable` will be `false`
+ * and `count` will be `0` (inconclusive). Callers should check `apiAvailable` before
+ * treating a zero count as "password is clean".
+ *
+ * @param password The password to check.
+ * @returns {Promise<CheckPwnedResult>} Structured result with breach count and API availability.
+ *
+ * @example
+ * const { count, apiAvailable } = await checkPwnedPassword('hunter2');
+ * if (!apiAvailable) logger.warn('HIBP API unreachable — skipping pwned check');
+ * else if (count > 0) throw new Error('Password found in data breaches');
+ */
+declare const checkPwnedPassword: (password: string) => Promise<CheckPwnedResult>;
+/**
+ * Patterns for secrets.
+ */
+declare const SECRET_PATTERNS: RegExp[];
+/**
+ * Scans for secrets.
+ */
+declare const scanForSecrets: (input: any) => boolean;
+/**
+ * Weak password check.
+ */
+declare const isWeakPassword: (password: string) => boolean;
+/**
+ * Schema types.
+ */
+type Schema = {
+    [key: string]: 'string' | 'number' | 'boolean' | 'object' | 'array';
+};
+/**
+ * Type validation.
+ */
+declare const isType: (val: any, type: Schema[keyof Schema]) => boolean;
+/**
+ * Schema enforcement.
+ */
+declare const enforceSchema: <T extends Record<string, any>>(data: any, schema: Schema) => T | null;
+/**
+ * Email validation.
+ */
+declare const isEmail: (input: string) => boolean;
+/**
+ * Injection pattern detection (Heuristic).
+ * Detects common SQL, NoSQL, and Command Injection payloads.
+ */
+declare const hasInjectionPattern: (input: string) => boolean;
+
+type index$9_CheckPwnedResult = CheckPwnedResult;
+declare const index$9_SECRET_PATTERNS: typeof SECRET_PATTERNS;
+type index$9_Schema = Schema;
+declare const index$9_checkPwnedPassword: typeof checkPwnedPassword;
+declare const index$9_enforceSchema: typeof enforceSchema;
+declare const index$9_hasInjectionPattern: typeof hasInjectionPattern;
+declare const index$9_isEmail: typeof isEmail;
+declare const index$9_isType: typeof isType;
+declare const index$9_isWeakPassword: typeof isWeakPassword;
+declare const index$9_scanForSecrets: typeof scanForSecrets;
+declare namespace index$9 {
+  export { type index$9_CheckPwnedResult as CheckPwnedResult, index$9_SECRET_PATTERNS as SECRET_PATTERNS, type index$9_Schema as Schema, index$9_checkPwnedPassword as checkPwnedPassword, index$9_enforceSchema as enforceSchema, index$9_hasInjectionPattern as hasInjectionPattern, index$9_isEmail as isEmail, index$9_isType as isType, index$9_isWeakPassword as isWeakPassword, index$9_scanForSecrets as scanForSecrets };
+}
+
+/**
+ * Standard security header presets.
+ */
+declare const standardHeaders: {
+    'Content-Security-Policy': string;
+    'X-Frame-Options': string;
+    'X-Content-Type-Options': string;
+    'Referrer-Policy': string;
+    'Strict-Transport-Security': string;
+};
+/**
+ * CSP Directive Map type.
+ */
+type CSPDirectives = {
+    'default-src'?: string[];
+    'script-src'?: string[];
+    'style-src'?: string[];
+    'img-src'?: string[];
+    'connect-src'?: string[];
+    'font-src'?: string[];
+    'object-src'?: string[];
+    'media-src'?: string[];
+    'frame-src'?: string[];
+    sandbox?: string[];
+    'report-uri'?: string[];
+    'child-src'?: string[];
+    'form-action'?: string[];
+    'frame-ancestors'?: string[];
+    'plugin-types'?: string[];
+    'base-uri'?: string[];
+    'report-to'?: string[];
+    'worker-src'?: string[];
+    'manifest-src'?: string[];
+    'prefetch-src'?: string[];
+    'navigate-to'?: string[];
+};
+/**
+ * Generates a random nonce for CSP headers.
+ */
+declare const generateNonce: (length?: number) => string;
+/**
+ * Builds a CSP string.
+ */
+declare const buildCSP: (directives: CSPDirectives, nonce?: string) => string;
+/**
+ * Builds a 'Strict CSP' which is the industry gold standard.
+ * It uses 'strict-dynamic' and nonces, rendering 99.9% of XSS impossible.
+ *
+ * @param nonce The nonce generated for the current request.
+ * @returns {string} The formatted Strict CSP string.
+ */
+declare const buildStrictCSP: (nonce: string) => string;
+/**
+ * Parses CSP violation report.
+ */
+declare const parseCSPReport: (reportBody: any) => {
+    documentUri: any;
+    referrer: any;
+    blockedUri: any;
+    violatedDirective: any;
+    originalPolicy: any;
+    disposition: any;
+    statusCode: any;
+    timestamp: string;
+} | null;
+/**
+ * Returns a secure-by-default CSP string.
+ */
+declare const secureCSP: string;
+
+type index$8_CSPDirectives = CSPDirectives;
+declare const index$8_buildCSP: typeof buildCSP;
+declare const index$8_buildStrictCSP: typeof buildStrictCSP;
+declare const index$8_generateNonce: typeof generateNonce;
+declare const index$8_parseCSPReport: typeof parseCSPReport;
+declare const index$8_secureCSP: typeof secureCSP;
+declare const index$8_standardHeaders: typeof standardHeaders;
+declare namespace index$8 {
+  export { type index$8_CSPDirectives as CSPDirectives, index$8_buildCSP as buildCSP, index$8_buildStrictCSP as buildStrictCSP, index$8_generateNonce as generateNonce, index$8_parseCSPReport as parseCSPReport, index$8_secureCSP as secureCSP, index$8_standardHeaders as standardHeaders };
+}
+
+/**
+ * Basic authentication helper.
+ */
+declare const basicAuth: (user: string, pass: string) => string;
+/**
+ * Passkey / WebAuthn Core Helper to verify an authentication signature.
+ * Supports industry-standard RS256 and ES256 algorithms.
+ *
+ * @param challenge The challenge originally sent to the client.
+ * @param response Authenticatable data from the client (authenticatorData + clientDataJSON).
+ * @param signature The cryptographic signature from the WebAuthn response.
+ * @param publicKey The credential's public key (PEM format).
+ */
+declare const verifyPasskeySignature: (_challenge: string | Buffer$1, response: string | Buffer$1, signature: string | Buffer$1, publicKey: string, algorithm?: "sha256" | "sha512") => boolean;
+/**
+ * Heuristic Auth Advisor.
+ */
+declare const suggestMFA: (riskScore: number, lastFingerprint: string, currentFingerprint: string) => boolean;
+/**
+ * Generates a random HMAC-based challenge for a challenge-response authentication flow.
+ *
+ * The server generates a per-request challenge that is tied to a user-specific salt.
+ * The client proves knowledge of a shared secret by computing HMAC(challenge, secret)
+ * and returning the result. The server verifies it with `verifyHmacResponse`.
+ *
+ * Note: This is an HMAC challenge-response protocol, not a zero-knowledge proof (ZKP).
+ * A true ZKP would allow the client to prove knowledge of the secret without revealing
+ * it even to a compromised verifier. Use this for server-side mutual authentication only.
+ *
+ * @param userSalt - A per-user, per-session random salt to bind the challenge.
+ */
+declare const generateHmacChallenge: (userSalt: string) => string;
+/**
+ * Verifies an HMAC challenge-response: checks that `proof === HMAC(challenge, secret)`
+ * using a timing-safe comparison to prevent timing attacks.
+ *
+ * @param challenge - The challenge string previously returned by `generateHmacChallenge`.
+ * @param proof     - The response computed by the client: `HMAC-SHA256(secret, challenge)`.
+ * @param secret    - The shared secret known to the server.
+ */
+declare const verifyHmacResponse: (challenge: string, proof: string, secret: string) => boolean;
+/**
+ * Honey-Token generation.
+ */
+declare const generateHoneyToken: (prefix?: string) => string;
+declare const isHoneyToken: (token: string, prefix?: string) => boolean;
+/**
+ * CSRF management.
+ */
+declare const generateCSRF: () => {
+    token: string;
+    cookieValue: string;
+};
+declare const verifyCSRF: (providedToken: string, cookieToken: string) => boolean;
+/**
+ * JWT Validation.
+ * Verifies the structure, expiration, and cryptographic signature of the token.
+ *
+ * @param token The JWT string.
+ * @param secretOrPublicKey The secret (for HS256) or public key (for RS256) to verify the signature.
+ * @param algorithm Optional. The expected algorithm (e.g., 'HS256', 'RS256'). Defaults to 'HS256'.
+ */
+declare const isJwtValid: (token: string, secretOrPublicKey: string | Buffer$1, algorithm?: string) => boolean;
+/**
+ * Auth guards.
+ */
+declare const canAccess: <U, R>(user: U, resource: R, rule: (u: U, r: R) => boolean) => boolean;
+declare const hasRole: (userRoles: string[], requiredRoles: string[]) => boolean;
+declare const can: (userPermissions: string[], requiredPermission: string) => boolean;
+/**
+ * Generates a random base64url challenge for FIDO2 WebAuthn / Passkeys.
+ */
+declare const generatePasskeyChallenge: (length?: number) => string;
+/**
+ * Interface representing the unpacked and verified result of a Passkey registration.
+ */
+interface PasskeyRegistrationResult {
+    verified: boolean;
+    error?: string;
+}
+/**
+ * Validates a Passkey registration response against the expected challenge and origin.
+ *
+ * Accepts `clientDataJSONStr` as either:
+ * - A raw UTF-8 JSON string (for testing/server-side construction)
+ * - A base64url-encoded JSON string (as browsers send in `response.clientDataJSON`)
+ *
+ * The challenge is compared at the byte level using `timingSafeEqual` after
+ * decoding both sides from base64url, per the WebAuthn Level 2 spec §7.1.
+ */
+declare const verifyPasskeyRegistration: (clientDataJSONStr: string, expectedChallenge: string, expectedOrigin?: string) => PasskeyRegistrationResult;
+/**
+ * Parses WebAuthn raw authenticator data (authData) buffer to extract the
+ * aaguid, credential ID, and public key bytes according to the FIDO2 spec.
+ */
+declare const parseAuthenticatorData: (authData: Buffer$1) => {
+    rpIdHash: Buffer$1<ArrayBufferLike>;
+    flags: number;
+    signCount: number;
+    aaguid?: undefined;
+    credentialId?: undefined;
+    publicKeyBytes?: undefined;
+} | {
+    rpIdHash: Buffer$1<ArrayBufferLike>;
+    flags: number;
+    signCount: number;
+    aaguid: Buffer$1<ArrayBufferLike>;
+    credentialId: string;
+    publicKeyBytes: string;
+} | null;
+/**
+ * Result returned by `verifyPasskeyAssertion`.
+ */
+interface PasskeyAssertionResult {
+    /** Whether the assertion passed all WebAuthn §7.2 checks. */
+    verified: boolean;
+    /**
+     * The new signature counter value from the authenticator.
+     * Persist this value and pass it as `storedSignCount` on the next assertion to
+     * detect cloned authenticators (replay attack protection).
+     */
+    newSignCount?: number;
+    /** Human-readable error message when `verified` is false. */
+    error?: string;
+}
+/**
+ * Verifies a FIDO2 WebAuthn assertion response (navigator.credentials.get flow).
+ *
+ * Implements WebAuthn Level 2 §7.2 — Verifying an Authentication Assertion.
+ *
+ * Checks performed (in order):
+ * 1. Parses `clientDataJSON` — accepts both raw JSON and browser base64url-encoded format.
+ * 2. Verifies `type === 'webauthn.get'`.
+ * 3. Verifies the challenge at the byte level using `timingSafeEqual` (prevents timing attacks).
+ * 4. Verifies the origin.
+ * 5. Verifies `signCount > storedSignCount` (replay / cloned-authenticator detection).
+ * 6. Verifies the cryptographic signature over `authData || SHA-256(clientDataJSON)`
+ *    using the stored public key.
+ *
+ * @param clientDataJSONStr - The `response.clientDataJSON` from the browser, as either a
+ *   raw UTF-8 JSON string or a base64url-encoded string (browser format).
+ * @param expectedChallenge - The base64url-encoded challenge originally sent to the client.
+ * @param expectedOrigin    - The expected origin (e.g. `'https://example.com'`).
+ * @param storedSignCount   - The sign count stored server-side from the last successful assertion.
+ *   Pass `0` for the first assertion after registration.
+ * @param authData          - The raw `response.authenticatorData` buffer from the browser.
+ * @param signature         - The raw `response.signature` buffer from the browser.
+ * @param publicKeyPem      - The credential's stored public key in PEM (SPKI) format.
+ *
+ * @example
+ * const result = verifyPasskeyAssertion(
+ *   clientDataJSON,    // from navigator.credentials.get() response
+ *   storedChallenge,
+ *   'https://example.com',
+ *   storedSignCount,
+ *   authDataBuffer,
+ *   signatureBuffer,
+ *   credentialPublicKeyPem,
+ * );
+ * if (!result.verified) throw new Error(result.error);
+ * await db.updateSignCount(credentialId, result.newSignCount!);
+ */
+declare const verifyPasskeyAssertion: (clientDataJSONStr: string, expectedChallenge: string, expectedOrigin: string, storedSignCount: number, authData: Buffer$1, signature: Buffer$1, publicKeyPem: string) => PasskeyAssertionResult;
+
+type index$7_PasskeyAssertionResult = PasskeyAssertionResult;
+type index$7_PasskeyRegistrationResult = PasskeyRegistrationResult;
+declare const index$7_basicAuth: typeof basicAuth;
+declare const index$7_can: typeof can;
+declare const index$7_canAccess: typeof canAccess;
+declare const index$7_generateCSRF: typeof generateCSRF;
+declare const index$7_generateHmacChallenge: typeof generateHmacChallenge;
+declare const index$7_generateHoneyToken: typeof generateHoneyToken;
+declare const index$7_generatePasskeyChallenge: typeof generatePasskeyChallenge;
+declare const index$7_hasRole: typeof hasRole;
+declare const index$7_isHoneyToken: typeof isHoneyToken;
+declare const index$7_isJwtValid: typeof isJwtValid;
+declare const index$7_parseAuthenticatorData: typeof parseAuthenticatorData;
+declare const index$7_suggestMFA: typeof suggestMFA;
+declare const index$7_verifyCSRF: typeof verifyCSRF;
+declare const index$7_verifyHmacResponse: typeof verifyHmacResponse;
+declare const index$7_verifyPasskeyAssertion: typeof verifyPasskeyAssertion;
+declare const index$7_verifyPasskeyRegistration: typeof verifyPasskeyRegistration;
+declare const index$7_verifyPasskeySignature: typeof verifyPasskeySignature;
+declare namespace index$7 {
+  export { type index$7_PasskeyAssertionResult as PasskeyAssertionResult, type index$7_PasskeyRegistrationResult as PasskeyRegistrationResult, index$7_basicAuth as basicAuth, index$7_can as can, index$7_canAccess as canAccess, index$7_generateCSRF as generateCSRF, index$7_generateHmacChallenge as generateHmacChallenge, index$7_generateHoneyToken as generateHoneyToken, index$7_generatePasskeyChallenge as generatePasskeyChallenge, index$7_hasRole as hasRole, index$7_isHoneyToken as isHoneyToken, index$7_isJwtValid as isJwtValid, index$7_parseAuthenticatorData as parseAuthenticatorData, index$7_suggestMFA as suggestMFA, index$7_verifyCSRF as verifyCSRF, index$7_verifyHmacResponse as verifyHmacResponse, index$7_verifyPasskeyAssertion as verifyPasskeyAssertion, index$7_verifyPasskeyRegistration as verifyPasskeyRegistration, index$7_verifyPasskeySignature as verifyPasskeySignature };
+}
+
+/**
+ * Runs a high-CPU cryptographic function in a separate Worker Thread.
+ * Concurrency is bounded by the module-level `workerPool` semaphore, preventing
+ * unbounded thread allocation under high load.
+ *
+ * Note: Workers are still spawned on-demand (not persistent). For extremely
+ * high-throughput workloads consider replacing this with a persistent pool
+ * library such as Piscina.
+ */
+declare const runIsolatedCrypto: (functionName: string, args: any[]) => Promise<any>;
+/**
+ * Implements a production-grade verifiable Shamir's Secret Sharing (SSS) pattern to split
+ * a master secret into multiple 'shares'. N-of-M shares are required to reconstruct.
+ * This provides Threshold Security.
+ *
+ * @param secret The master secret string or buffer.
+ * @param sharesCount Global number of shares (M).
+ * @param threshold Minimum number of shares required to reconstruct (N).
+ */
+declare const splitSecret: (secret: string | Buffer$1, sharesCount: number, threshold: number) => string[];
+/**
+ * Reconstructs a master secret from N-of-M Shamir's Secret Sharing shares.
+ *
+ * @param shares Array of hex-encoded shares formatted as 'x:hex_payload'.
+ */
+declare const reconstructSecret: (shares: string[]) => Buffer$1;
+/**
+ * Blind Signature Framework placeholder.
+ * Allows a client to 'blind' a piece of data before sending it for signing.
+ */
+declare const blindData: (data: string | Buffer$1, factor: string) => string;
+/**
+ * Generates a random token.
+ */
+declare const generateToken: (length?: number, encoding?: BufferEncoding) => string;
+/**
+ * HKDF key derivation using the standard HKDF-SHA-256 algorithm (RFC 5869).
+ *
+ * Derives a cryptographically strong sub-key from a master secret using
+ * HKDF-SHA-256 (extract + expand). Safe to use for key diversification,
+ * e.g. deriving encryption and MAC keys from a single master secret.
+ *
+ * @param secret - The input key material (IKM). A high-entropy master secret.
+ * @param info   - Context/application-specific info string (e.g. 'session-key').
+ *                 Different values produce independent, unrelated sub-keys.
+ * @param length - Length of the derived key in bytes (default: 32).
+ * @returns Hex-encoded derived key.
+ */
+declare const deriveSubKey: (secret: string | Buffer$1, info: string, length?: number) => string;
+/**
+ * AES-256-GCM encrypted persistence.
+ */
+declare const encryptSession: (obj: any, key: string | Buffer$1) => string;
+/**
+ * Decrypts AES-256-GCM.
+ */
+declare const decryptSession: (sessionStr: string, key: string | Buffer$1) => any;
+/**
+ * Generates a Winternitz One-Time Signature (WOTS) key pair for post-quantum signing.
+ *
+ * @returns An object with `publicKey` and `privateKey` as semicolon-delimited hex strings.
+ *
+ * @example
+ * const { publicKey, privateKey } = generatePQCKeyPair();
+ * const signature = signPQC('my message', privateKey);
+ * const valid = verifyPQCSignature('my message', signature, publicKey); // true
+ *
+ * @caution **ONE-TIME USE ONLY.**
+ * WOTS is a one-time signature scheme. Each `privateKey` **must only be used to sign
+ * a single message**. Signing a second message with the same key reveals partial private
+ * key material, completely breaking the security of the scheme. Always generate a new
+ * key pair for each message you need to sign.
+ */
+declare const generatePQCKeyPair: () => {
+    publicKey: string;
+    privateKey: string;
+};
+/**
+ * Signs a message using a Winternitz One-Time Signature (WOTS) private key.
+ *
+ * @param data          - The message or data to sign.
+ * @param privateKeyStr - The private key string returned by `generatePQCKeyPair`.
+ *
+ * @throws {Error} If `privateKeyStr` is invalid (wrong number of key parts).
+ * @throws {Error} If this private key has already been used to sign a message
+ *                 (`WOTS_KEY_REUSE`). Generate a fresh key pair for each message.
+ *
+ * @caution **ONE-TIME USE ONLY.** See `generatePQCKeyPair` for the full warning.
+ */
+declare const signPQC: (data: string | Buffer$1, privateKeyStr: string) => string;
+/**
+ * Verifies a Winternitz One-Time Signature (WOTS) against a message and public key.
+ *
+ * This operation is safe to call multiple times for the same public key — verification
+ * does not consume the key or leak any private key material.
+ *
+ * @param data      - The original message that was signed.
+ * @param signature - The signature string returned by `signPQC`.
+ * @param publicKey - The public key string returned by `generatePQCKeyPair`.
+ * @returns `true` if the signature is valid for the given message and public key.
+ */
+declare const verifyPQCSignature: (data: Buffer$1 | string, signature: string, publicKey: string) => boolean;
+/**
+ * Password hashing.
+ */
+declare const hashPassword: (password: string, salt?: string) => Promise<{
+    hash: string;
+    salt: string;
+}>;
+/**
+ * verification.
+ */
+declare const verifyPassword: (password: string, storedHash: string, salt: string) => Promise<boolean>;
+/**
+ * SHA-256.
+ */
+declare const sha256: (data: string) => string;
+
+declare const index$6_blindData: typeof blindData;
+declare const index$6_decryptSession: typeof decryptSession;
+declare const index$6_deriveSubKey: typeof deriveSubKey;
+declare const index$6_encryptSession: typeof encryptSession;
+declare const index$6_generatePQCKeyPair: typeof generatePQCKeyPair;
+declare const index$6_generateToken: typeof generateToken;
+declare const index$6_hashPassword: typeof hashPassword;
+declare const index$6_reconstructSecret: typeof reconstructSecret;
+declare const index$6_runIsolatedCrypto: typeof runIsolatedCrypto;
+declare const index$6_sha256: typeof sha256;
+declare const index$6_signPQC: typeof signPQC;
+declare const index$6_splitSecret: typeof splitSecret;
+declare const index$6_verifyPQCSignature: typeof verifyPQCSignature;
+declare const index$6_verifyPassword: typeof verifyPassword;
+declare namespace index$6 {
+  export { index$6_blindData as blindData, index$6_decryptSession as decryptSession, index$6_deriveSubKey as deriveSubKey, index$6_encryptSession as encryptSession, index$6_generatePQCKeyPair as generatePQCKeyPair, index$6_generateToken as generateToken, index$6_hashPassword as hashPassword, index$6_reconstructSecret as reconstructSecret, index$6_runIsolatedCrypto as runIsolatedCrypto, index$6_sha256 as sha256, index$6_signPQC as signPQC, index$6_splitSecret as splitSecret, index$6_verifyPQCSignature as verifyPQCSignature, index$6_verifyPassword as verifyPassword };
+}
+
+/**
+ * Standard Magic Numbers for common file types.
+ */
+declare const MAGIC_NUMBERS: {
+    PNG: number[];
+    JPEG: number[];
+    PDF: number[];
+    GIF: number[];
+};
+/**
+ * Resolves a path relative to a root directory and ensures it doesn't escape the root.
+ */
+declare const resolveSafePath: (rootDir: string, userInputPath: string) => string;
+/**
+ * Verifies that a file's magic numbers match the expected type.
+ * This is much more secure than trusting file extensions or MIME types.
+ *
+ * @param filePath The path to the file.
+ * @param expectedMagic The array of bytes to match.
+ * @returns true if the file matches.
+ */
+declare const verifyMagicNumber: (filePath: string, expectedMagic: number[]) => Promise<boolean>;
+/**
+ * Safely reads a file from a root-locked directory.
+ */
+declare const safeRead: (rootDir: string, filePath: string) => Promise<string>;
+/**
+ * Checks if a path is safe (within the root) without throwing.
+ */
+declare const isPathSafe: (rootDir: string, filePath: string) => boolean;
+
+declare const index$5_MAGIC_NUMBERS: typeof MAGIC_NUMBERS;
+declare const index$5_isPathSafe: typeof isPathSafe;
+declare const index$5_resolveSafePath: typeof resolveSafePath;
+declare const index$5_safeRead: typeof safeRead;
+declare const index$5_verifyMagicNumber: typeof verifyMagicNumber;
+declare namespace index$5 {
+  export { index$5_MAGIC_NUMBERS as MAGIC_NUMBERS, index$5_isPathSafe as isPathSafe, index$5_resolveSafePath as resolveSafePath, index$5_safeRead as safeRead, index$5_verifyMagicNumber as verifyMagicNumber };
+}
+
+/**
+ * Checks if a request is over HTTPS.
+ */
+declare const isSecure: (url?: string, headers?: Record<string, string | string[] | undefined>) => boolean;
+/**
+ * Normalizes a URL.
+ */
+declare const normalizeUrl: (url: string) => string;
+/**
+ * Hardened HTTPS Tunneling Helper.
+ * Configures an outgoing https.request with strictly-enforced security options,
+ * including TLS 1.3, strong ciphers, and OCSP stapling if supported.
+ *
+ * @param options Custom https.RequestOptions to extend.
+ * @returns {https.RequestOptions} The hardened options.
+ */
+declare const getHardenedRequestOptions: (options?: https.RequestOptions) => https.RequestOptions;
+/**
+ * JA3 TLS Fingerprinting.
+ */
+declare const generateTLSFingerprint: (req: any) => string;
+/**
+ * Analyzestraffic for DoS patterns.
+ */
+declare const analyzeDoSThreat: (req: any) => boolean;
+/**
+ * Generates client fingerprint.
+ */
+declare const generateFingerprint: (reqHeaders: Record<string, string | string[] | undefined>, ip: string) => string;
+/**
+ * Projects noise.
+ */
+declare const projectNoise: (obj: any) => any;
+/**
+ * Safe Redirect.
+ */
+declare const isSafeRedirect: (url: string, allowedHosts?: string[]) => boolean;
+/**
+ * SRI Hash.
+ */
+declare const generateSRI: (data: string | Buffer, algorithm?: "sha256" | "sha384" | "sha512") => string;
+
+declare const index$4_analyzeDoSThreat: typeof analyzeDoSThreat;
+declare const index$4_generateFingerprint: typeof generateFingerprint;
+declare const index$4_generateSRI: typeof generateSRI;
+declare const index$4_generateTLSFingerprint: typeof generateTLSFingerprint;
+declare const index$4_getHardenedRequestOptions: typeof getHardenedRequestOptions;
+declare const index$4_isSafeRedirect: typeof isSafeRedirect;
+declare const index$4_isSecure: typeof isSecure;
+declare const index$4_normalizeUrl: typeof normalizeUrl;
+declare const index$4_projectNoise: typeof projectNoise;
+declare namespace index$4 {
+  export { index$4_analyzeDoSThreat as analyzeDoSThreat, index$4_generateFingerprint as generateFingerprint, index$4_generateSRI as generateSRI, index$4_generateTLSFingerprint as generateTLSFingerprint, index$4_getHardenedRequestOptions as getHardenedRequestOptions, index$4_isSafeRedirect as isSafeRedirect, index$4_isSecure as isSecure, index$4_normalizeUrl as normalizeUrl, index$4_projectNoise as projectNoise };
+}
+
+/**
+ * A simple in-memory Store for the rate limiter.
+ */
+interface RateLimitStore {
+    increment(key: string, amount?: number): Promise<number>;
+    get(key: string): Promise<number | undefined>;
+    reset(key: string): Promise<void>;
+    setTTL(key: string, value: number, ttlMs: number): Promise<void>;
+}
+declare class MemoryStore implements RateLimitStore {
+    private readonly windowMs;
+    private readonly hits;
+    private readonly gcInterval;
+    constructor(windowMs: number);
+    private gc;
+    increment(key: string, amount?: number): Promise<number>;
+    get(key: string): Promise<number | undefined>;
+    reset(key: string): Promise<void>;
+    setTTL(key: string, value: number, ttlMs: number): Promise<void>;
+    destroy(): void;
+}
+/**
+ * Redis Store implementation for the rate limiter.
+ * Expects a Redis-compatible client (e.g., from 'ioredis' or 'redis').
+ */
+/**
+ * Minimal structural interface for a Redis-compatible client.
+ *
+ * This is intentionally narrow — it describes only the API surface that
+ * `RedisStore` actually uses. Any client that satisfies this interface
+ * (e.g. `ioredis`, `node-redis` v4) will work without importing their
+ * types as a dependency.
+ */
+interface RedisMultiChain {
+    incrby(key: string, amount: number): RedisMultiChain;
+    pttl(key: string): RedisMultiChain;
+    exec(): Promise<Array<[error: Error | null, result: unknown]>>;
+}
+interface RedisClientLike {
+    multi(): RedisMultiChain;
+    get(key: string): Promise<string | null>;
+    del(key: string): Promise<number>;
+    set(key: string, value: number | string, mode: 'PX', ttlMs: number): Promise<string | null>;
+    pexpire(key: string, ttlMs: number): Promise<number>;
+}
+/**
+ * Redis Store implementation for the rate limiter.
+ * Accepts any `RedisClientLike`-compatible client (e.g. `ioredis`, `redis` v4).
+ */
+declare class RedisStore implements RateLimitStore {
+    private readonly redisClient;
+    private readonly windowMs;
+    private readonly prefix;
+    constructor(redisClient: RedisClientLike, windowMs: number, prefix?: string);
+    increment(key: string, amount?: number): Promise<number>;
+    get(key: string): Promise<number | undefined>;
+    reset(key: string): Promise<void>;
+    setTTL(key: string, value: number, ttlMs: number): Promise<void>;
+}
+/**
+ * TokenBucket implementation for smooth rate limiting.
+ */
+declare class TokenBucket {
+    private readonly capacity;
+    private readonly refillRatePerSecond;
+    private readonly buckets;
+    constructor(capacity: number, refillRatePerSecond: number);
+    consume(id: string, tokens?: number): Promise<boolean>;
+}
+/**
+ * Adaptive RateLimiter implementation with Global Kill-Switch and IR Hook support.
+ */
+declare class AdaptiveRateLimiter {
+    private readonly config;
+    private readonly store;
+    private readonly securityStore;
+    private readonly burstStore;
+    private readonly ipCheckers;
+    constructor(config: {
+        standardLimit: number;
+        penaltyLimit: number;
+        windowMs: number;
+        securityThreshold: number;
+        burstThreshold: number;
+    }, store?: RateLimitStore, securityStore?: RateLimitStore, burstStore?: RateLimitStore);
+    /**
+     * Automates Incident Response by globally "killing" a session or IP.
+     * This sets an infinite (effectively 1-year) block on the ID.
+     *
+     * @param id The client ID to block.
+     *
+     * @remarks
+     * **Persistence warning**: If the underlying store is `MemoryStore` (the default),
+     * the block is held in process memory and will be **lost on process restart**.
+     * For a persistent kill-switch that survives restarts and works across multiple
+     * instances, pass a `RedisStore` as the `store` and `securityStore` arguments
+     * to the `AdaptiveRateLimiter` constructor.
+     *
+     * @see {@link RedisStore} for a production-grade persistent store.
+     */
+    triggerGlobalKillSwitch(id: string): Promise<void>;
+    registerIPChecker(checker: (ip: string) => Promise<boolean>): void;
+    recordSecurityEvent(id: string, weight?: number): Promise<void>;
+    isLimited(id: string): Promise<boolean>;
+    isHighRisk(id: string): Promise<boolean>;
+}
+/**
+ * Basic Sliding Window RateLimiter for backward compatibility.
+ */
+declare class RateLimiter {
+    private readonly limit;
+    private readonly windowMs;
+    private readonly store;
+    constructor(limit: number, windowMs: number, store?: RateLimitStore);
+    isLimited(id: string): Promise<boolean>;
+}
+
+type index$3_AdaptiveRateLimiter = AdaptiveRateLimiter;
+declare const index$3_AdaptiveRateLimiter: typeof AdaptiveRateLimiter;
+type index$3_MemoryStore = MemoryStore;
+declare const index$3_MemoryStore: typeof MemoryStore;
+type index$3_RateLimitStore = RateLimitStore;
+type index$3_RateLimiter = RateLimiter;
+declare const index$3_RateLimiter: typeof RateLimiter;
+type index$3_RedisClientLike = RedisClientLike;
+type index$3_RedisMultiChain = RedisMultiChain;
+type index$3_RedisStore = RedisStore;
+declare const index$3_RedisStore: typeof RedisStore;
+type index$3_TokenBucket = TokenBucket;
+declare const index$3_TokenBucket: typeof TokenBucket;
+declare namespace index$3 {
+  export { index$3_AdaptiveRateLimiter as AdaptiveRateLimiter, index$3_MemoryStore as MemoryStore, type index$3_RateLimitStore as RateLimitStore, index$3_RateLimiter as RateLimiter, type index$3_RedisClientLike as RedisClientLike, type index$3_RedisMultiChain as RedisMultiChain, index$3_RedisStore as RedisStore, index$3_TokenBucket as TokenBucket };
+}
+
+/**
+ * Prototype pollution safe JSON parsing with depth limiting to prevent
+ * "JSON Depth" or "Billion Laughs" style DoS attacks.
+ */
+declare const parse: (text: string, maxDepth?: number) => any;
+/**
+ * Calculates the maximum depth of an object to detect nested-complexity attacks.
+ */
+declare const getDepth: (obj: any) => number;
+/**
+ * Recursively checks an object for prototype pollution keys.
+ */
+declare const containsPollution: (obj: any) => boolean;
+
+declare const index$2_containsPollution: typeof containsPollution;
+declare const index$2_getDepth: typeof getDepth;
+declare const index$2_parse: typeof parse;
+declare namespace index$2 {
+  export { index$2_containsPollution as containsPollution, index$2_getDepth as getDepth, index$2_parse as parse };
+}
+
+/**
+ * Deep merges source into target securely, preventing:
+ * 1. Prototype pollution (key filtering)
+ * 2. Infinite loops (circular reference detection)
+ *
+ * @param target The target object to merge into.
+ * @param source The source object to merge from.
+ * @param seen WeakSet to track seen objects for circular reference detection.
+ * @returns The merged object.
+ */
+declare const merge: <T extends object, S extends object>(target: T, source: S, seen?: WeakSet<object>) => T & S;
+/**
+ * Recursively removes prototype-related keys from an object to sanitize untrusted input.
+ */
+declare const sanitizeObject: <T>(obj: T, seen?: WeakSet<object>) => T;
+/**
+ * Deep freezes an object to prevent any modifications.
+ */
+declare const deepFreeze: <T extends object>(obj: T) => T;
+
+declare const index$1_deepFreeze: typeof deepFreeze;
+declare const index$1_merge: typeof merge;
+declare const index$1_sanitizeObject: typeof sanitizeObject;
+declare namespace index$1 {
+  export { index$1_deepFreeze as deepFreeze, index$1_merge as merge, index$1_sanitizeObject as sanitizeObject };
+}
+
+/**
+ * Common sensitive keys for redaction.
+ */
+declare const SENSITIVE_KEYS: Set<string>;
+/**
+ * Redacts sensitive keys.
+ */
+declare const redact: <T>(obj: T, redactKeys?: Set<string>) => T;
+/**
+ * SecureError wrapper.
+ */
+declare class SecureError extends Error {
+    readonly code: string;
+    readonly userMessage: string;
+    constructor(message: string, code?: string, userMessage?: string);
+    toJSON(): {
+        error: boolean;
+        code: string;
+        message: string;
+    };
+}
+/**
+ * Normalizes an error.
+ */
+declare const normalizeError: (error: any) => SecureError;
+/**
+ * Memory-Wiping (Anti-Forensics) utility.
+ * Explicitly overwrites the content of a Buffer or Uint8Array with zero bytes.
+ * This is the ultimate "last step" for protecting high-entropy key material.
+ *
+ * @param buf The Buffer or Uint8Array to zero-out.
+ */
+declare const wipeBuffer: (buf: Buffer | Uint8Array | any[]) => void;
+/**
+ * Minimal logger interface for dependency injection.
+ * Any object with `error` and `warn` methods satisfies this —
+ * e.g. `console`, `winston`, `pino`, or a custom OTEL-aware logger.
+ */
+interface MinimalLogger {
+    error(message: string, ...args: unknown[]): void;
+    warn(message: string, ...args: unknown[]): void;
+}
+/**
+ * Self-healing configuration monitor.
+ *
+ * Runs `auditConfig` on the supplied configuration at a fixed interval and
+ * logs any detected drift through the provided `logger`.
+ *
+ * @param config  The configuration object to audit.
+ * @param type    The configuration type ('db' | 'redis' | 'auth').
+ * @param intervalMs  How often to run the audit (default: 10 minutes).
+ * @param logger  Optional logger to receive drift alerts. Defaults to `console`.
+ *                Inject a structured logger (Winston, Pino, OTEL) for production.
+ *
+ * @example
+ * // Default — uses console
+ * startSelfHealingMonitor(dbConfig, 'db');
+ *
+ * // Production — inject your logger
+ * startSelfHealingMonitor(dbConfig, 'db', 600_000, pinoLogger);
+ */
+declare const startSelfHealingMonitor: (config: Parameters<typeof auditConfig>[0], type: Parameters<typeof auditConfig>[1], intervalMs?: number, logger?: MinimalLogger) => void;
+/**
+ * SQL Injection Hardening.
+ */
+declare const enforceSafeQuery: (query: string, params: any[]) => void;
+/**
+ * Deterministic digit substitution using SHA-256 offset encoding.
+ *
+ * @remarks
+ * **This is NOT Format-Preserving Encryption (FPE).**
+ * It does NOT implement NIST SP 800-38G (FF1/FF3-1). It is a lightweight,
+ * deterministic digit-level obfuscation function suitable for display masking
+ * and non-compliance-grade transformations only.
+ *
+ * Do NOT use this for PCI-DSS, HIPAA, or any standard requiring certified FPE.
+ *
+ * @param input A string of decimal digit characters (0–9) to transform.
+ * @param secret A secret key string used to derive the substitution offsets.
+ * @returns A digit-length-preserving transformed string.
+ */
+declare const deterministicDigitTransform: (input: string, secret: string) => string;
+/**
+ * Environment security check.
+ */
+declare const checkSecureEnv: () => void;
+/**
+ * Configuration Auditor.
+ */
+declare const auditConfig: (config: any, type: "db" | "redis" | "auth") => string[];
+/**
+ * Global prototype lockdown.
+ */
+declare const lockdownPrototypes: () => void;
+/**
+ * mTLS Helper.
+ */
+declare const createMTLSOptions: (serverCert: Buffer, serverKey: Buffer, caCert: Buffer) => {
+    cert: Buffer<ArrayBufferLike>;
+    key: Buffer<ArrayBufferLike>;
+    ca: Buffer<ArrayBufferLike>;
+    requestCert: boolean;
+    rejectUnauthorized: boolean;
+};
+/**
+ * Security preset.
+ */
+declare const standardSecurityPreset: {
+    trustProxy: boolean;
+    strictTransportSecurity: {
+        maxAge: number;
+        includeSubDomains: boolean;
+        preload: boolean;
+    };
+    contentSecurityPolicy: boolean;
+    referrerPolicy: "strict-origin-when-cross-origin";
+};
+
+type index_MinimalLogger = MinimalLogger;
+declare const index_SENSITIVE_KEYS: typeof SENSITIVE_KEYS;
+type index_SecureError = SecureError;
+declare const index_SecureError: typeof SecureError;
+declare const index_auditConfig: typeof auditConfig;
+declare const index_checkSecureEnv: typeof checkSecureEnv;
+declare const index_createMTLSOptions: typeof createMTLSOptions;
+declare const index_deterministicDigitTransform: typeof deterministicDigitTransform;
+declare const index_enforceSafeQuery: typeof enforceSafeQuery;
+declare const index_lockdownPrototypes: typeof lockdownPrototypes;
+declare const index_normalizeError: typeof normalizeError;
+declare const index_redact: typeof redact;
+declare const index_standardSecurityPreset: typeof standardSecurityPreset;
+declare const index_startSelfHealingMonitor: typeof startSelfHealingMonitor;
+declare const index_wipeBuffer: typeof wipeBuffer;
+declare namespace index {
+  export { type index_MinimalLogger as MinimalLogger, index_SENSITIVE_KEYS as SENSITIVE_KEYS, index_SecureError as SecureError, index_auditConfig as auditConfig, index_checkSecureEnv as checkSecureEnv, index_createMTLSOptions as createMTLSOptions, index_deterministicDigitTransform as deterministicDigitTransform, index_enforceSafeQuery as enforceSafeQuery, index_lockdownPrototypes as lockdownPrototypes, index_normalizeError as normalizeError, index_redact as redact, index_standardSecurityPreset as standardSecurityPreset, index_startSelfHealingMonitor as startSelfHealingMonitor, index_wipeBuffer as wipeBuffer };
+}
+
+/**
+ * A lightweight Express middleware preset.
+ */
+declare const expressMiddleware: (options?: {
+    rateLimit?: boolean;
+    rateLimitWindowMs?: number;
+    rateLimitMax?: number;
+}) => (req: any, res: any, next: any) => Promise<any>;
+/**
+ * Next.js Edge Middleware Preset.
+ * Note: Next.js edge runtime doesn't support all Node APIs, so we keep it lightweight.
+ */
+declare const nextJsMiddleware: (_req: any, res: any) => any;
+/**
+ * Global response error handler for Express.
+ */
+declare const expressErrorHandler: (err: any, _req: any, res: any, _next: any) => void;
+/**
+ * Secure Logger with Cryptographic Hash-Chain (Tamper-Proof Logs).
+ * Every entry is linked to the previous one via a SHA-256 hash, making it
+ * mathematically detectable if an attacker deletes or modifies log entries.
+ */
+declare class SecureLoggerChain {
+    private readonly baseLogger;
+    private lastHash;
+    constructor(baseLogger: {
+        info: Function;
+        error: Function;
+        warn: Function;
+    });
+    private chain;
+    info(msg: string, data?: any): void;
+    warn(msg: string, data?: any): void;
+    error(msg: string, err?: any): void;
+}
+/**
+ * Convenience logger creator.
+ */
+declare const createSecureLogger: (baseLogger: any) => SecureLoggerChain;
+/**
+ * Fastify Plugin Preset.
+ * Fastify hooks to inject secure headers, rate limiter, and scan inputs.
+ */
+declare const fastifyPlugin: (options?: {
+    rateLimit?: boolean;
+    rateLimitWindowMs?: number;
+    rateLimitMax?: number;
+}) => (fastify: any) => Promise<void>;
+/**
+ * NestJS Guard / Middleware class creator.
+ * Dynamic NestJS Middleware to apply Mitigator protections.
+ */
+declare class NestJsMitigatorMiddleware {
+    private static limiter;
+    static configure(options?: {
+        rateLimit?: boolean;
+        rateLimitWindowMs?: number;
+        rateLimitMax?: number;
+    }): void;
+    use(req: any, res: any, next: () => void): Promise<void>;
+}
+
+type presets_NestJsMitigatorMiddleware = NestJsMitigatorMiddleware;
+declare const presets_NestJsMitigatorMiddleware: typeof NestJsMitigatorMiddleware;
+type presets_SecureLoggerChain = SecureLoggerChain;
+declare const presets_SecureLoggerChain: typeof SecureLoggerChain;
+declare const presets_createSecureLogger: typeof createSecureLogger;
+declare const presets_expressErrorHandler: typeof expressErrorHandler;
+declare const presets_expressMiddleware: typeof expressMiddleware;
+declare const presets_fastifyPlugin: typeof fastifyPlugin;
+declare const presets_nextJsMiddleware: typeof nextJsMiddleware;
+declare namespace presets {
+  export { presets_NestJsMitigatorMiddleware as NestJsMitigatorMiddleware, presets_SecureLoggerChain as SecureLoggerChain, presets_createSecureLogger as createSecureLogger, presets_expressErrorHandler as expressErrorHandler, presets_expressMiddleware as expressMiddleware, presets_fastifyPlugin as fastifyPlugin, presets_nextJsMiddleware as nextJsMiddleware };
+}
+
+/**
+ * Lightweight OpenTelemetry-compatible telemetry hook system for Mitigator.
+ *
+ * This module provides a zero-dependency, zero-overhead telemetry integration point.
+ * By default all hooks are no-ops. Consumers inject their own tracer/metrics provider
+ * via `setTelemetryProvider()` — works with any OTEL SDK, Datadog, Prometheus, or custom.
+ *
+ * @example
+ * ```ts
+ * import { setTelemetryProvider } from 'mitigator/telemetry';
+ * import { trace, metrics } from '@opentelemetry/api';
+ *
+ * const tracer = trace.getTracer('mitigator');
+ * const meter  = metrics.getMeter('mitigator');
+ * const rateLimitCounter = meter.createCounter('mitigator.rate_limit.blocked');
+ * const securityEventCounter = meter.createCounter('mitigator.security.events');
+ *
+ * setTelemetryProvider({
+ *   onRateLimitBlocked(id, severity) {
+ *     rateLimitCounter.add(1, { id, severity });
+ *   },
+ *   onSecurityEvent(id, weight) {
+ *     securityEventCounter.add(weight, { id });
+ *   },
+ *   onKillSwitchTriggered(id) {
+ *     const span = tracer.startSpan('mitigator.kill_switch');
+ *     span.setAttribute('actor.id', id);
+ *     span.end();
+ *   },
+ *   onWorkerSpawned(functionName) {
+ *     // track worker thread usage
+ *   },
+ * });
+ * ```
+ */
+/**
+ * Telemetry event hooks that Mitigator calls at key security decision points.
+ * All methods are optional — implement only what your observability stack needs.
+ */
+interface MitigatorTelemetryProvider {
+    /**
+     * Called when a request is blocked by `AdaptiveRateLimiter.isLimited()`.
+     * @param id       The client ID (IP, session, etc.) that was blocked.
+     * @param severity `'penalty'` if the actor is high-risk, `'standard'` otherwise.
+     */
+    onRateLimitBlocked?(id: string, severity: 'standard' | 'penalty'): void;
+    /**
+     * Called when `AdaptiveRateLimiter.recordSecurityEvent()` is invoked.
+     * @param id     The client ID receiving the security score increment.
+     * @param weight The weight of the security event.
+     */
+    onSecurityEvent?(id: string, weight: number): void;
+    /**
+     * Called immediately before `AdaptiveRateLimiter.triggerGlobalKillSwitch()` writes.
+     * @param id The client ID being permanently blocked.
+     */
+    onKillSwitchTriggered?(id: string): void;
+    /**
+     * Called each time `runIsolatedCrypto` acquires a worker thread slot.
+     * @param functionName The crypto function being dispatched to the worker.
+     */
+    onWorkerSpawned?(functionName: string): void;
+}
+/**
+ * Registers a telemetry provider that Mitigator will call at key security events.
+ *
+ * Call this once at application startup, before any Mitigator functions are used.
+ * Replaces any previously registered provider.
+ *
+ * @param provider An object implementing any subset of `MitigatorTelemetryProvider`.
+ */
+declare const setTelemetryProvider: (provider: MitigatorTelemetryProvider) => void;
+/**
+ * Resets the telemetry provider to the built-in no-op (useful in tests).
+ */
+declare const resetTelemetryProvider: () => void;
+/**
+ * Internal accessor used by Mitigator modules to emit telemetry events.
+ * Not part of the public API — use `setTelemetryProvider` instead.
+ *
+ * @internal
+ */
+declare const getTelemetryProvider: () => MitigatorTelemetryProvider;
+
+type telemetry_MitigatorTelemetryProvider = MitigatorTelemetryProvider;
+declare const telemetry_getTelemetryProvider: typeof getTelemetryProvider;
+declare const telemetry_resetTelemetryProvider: typeof resetTelemetryProvider;
+declare const telemetry_setTelemetryProvider: typeof setTelemetryProvider;
+declare namespace telemetry {
+  export { type telemetry_MitigatorTelemetryProvider as MitigatorTelemetryProvider, telemetry_getTelemetryProvider as getTelemetryProvider, telemetry_resetTelemetryProvider as resetTelemetryProvider, telemetry_setTelemetryProvider as setTelemetryProvider };
+}
+
+export { index$7 as auth, index$6 as crypto, index$5 as fs, index$8 as headers, index$4 as http, presets, index$3 as rateLimit, index$2 as safeJson, index$1 as safeMerge, index$a as sanitize, telemetry, index as utils, index$9 as validate };