mitigator 1.0.0

package/dist/index.js

@@ -0,0 +1,1501 @@
+import {
+  __export,
+  scanForSecrets,
+  validate_exports
+} from "./chunk-TT2DUALY.js";
+
+// src/sanitize/index.ts
+var sanitize_exports = {};
+__export(sanitize_exports, {
+  ALLOWLIST: () => ALLOWLIST,
+  escapeHtml: () => escapeHtml,
+  isSafeUrl: () => isSafeUrl,
+  preventDOMClobbering: () => preventDOMClobbering,
+  sanitizeHtml: () => sanitizeHtml,
+  sanitizeMediaTags: () => sanitizeMediaTags,
+  stripTags: () => stripTags
+});
+import sanitizeHtmlLib from "sanitize-html";
+var escapeHtml = (input) => {
+  const map = {
+    "&": "&",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#39;"
+  };
+  return input.replaceAll(/[&<>"']/g, (m) => map[m]);
+};
+var stripTags = (input) => {
+  return input.replaceAll(/<[^>]*>?/gm, "");
+};
+var ALLOWLIST = {
+  b: [],
+  i: [],
+  em: [],
+  strong: [],
+  p: ["style"],
+  a: ["href", "title", "target"],
+  ul: [],
+  ol: [],
+  li: [],
+  br: [],
+  span: ["style"]
+};
+var sanitizeHtml = (html, rules = ALLOWLIST) => {
+  return sanitizeHtmlLib(html, {
+    allowedTags: Object.keys(rules),
+    allowedAttributes: rules,
+    allowedSchemes: ["http", "https", "mailto", "tel"],
+    allowProtocolRelative: false,
+    enforceHtmlBoundary: true
+  });
+};
+var preventDOMClobbering = (html, prefix = "sk-") => {
+  const attrRegex = /(\s(id|name)\s*=\s*)(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
+  return html.replaceAll(attrRegex, (_match, attrPrefix, _attrName, val1, val2, val3) => {
+    const value = val1 || val2 || val3;
+    let quote;
+    if (val3) {
+      quote = "";
+    } else if (val1) {
+      quote = '"';
+    } else {
+      quote = "'";
+    }
+    return `${attrPrefix}${quote}${prefix}${value}${quote}`;
+  });
+};
+var sanitizeMediaTags = (html) => {
+  const dangerousTags = [
+    "script",
+    "animate",
+    "set",
+    "animateMotion",
+    "animateTransform",
+    "handler",
+    "discard",
+    "foreignObject"
+  ];
+  let result = html;
+  dangerousTags.forEach((tag) => {
+    const regex = new RegExp(String.raw`<${tag}[^>]*>[\s\S]*?<\/${tag}>|<${tag}[^>]*\/>`, "gi");
+    result = result.replaceAll(regex, "");
+  });
+  return result;
+};
+var isSafeUrl = (url) => {
+  const allowedProtocols = ["https:", "http:", "mailto:", "tel:"];
+  try {
+    const parsed = new URL(url);
+    return allowedProtocols.includes(parsed.protocol);
+  } catch {
+    const low = url.trim().toLowerCase();
+    return !low.startsWith("javascript:") && !low.startsWith("//") && (low.startsWith("/") || low.startsWith("."));
+  }
+};
+
+// src/headers/index.ts
+var headers_exports = {};
+__export(headers_exports, {
+  buildCSP: () => buildCSP,
+  buildStrictCSP: () => buildStrictCSP,
+  generateNonce: () => generateNonce,
+  parseCSPReport: () => parseCSPReport,
+  secureCSP: () => secureCSP,
+  standardHeaders: () => standardHeaders
+});
+import { randomBytes } from "crypto";
+var standardHeaders = {
+  "Content-Security-Policy": "default-src 'self'; img-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; object-src 'none'",
+  "X-Frame-Options": "DENY",
+  "X-Content-Type-Options": "nosniff",
+  "Referrer-Policy": "strict-origin-when-cross-origin",
+  "Strict-Transport-Security": "max-age=31536000; includeSubDomains"
+};
+var generateNonce = (length = 16) => {
+  return randomBytes(length).toString("base64");
+};
+var buildCSP = (directives, nonce) => {
+  return Object.entries(directives).filter((entry) => {
+    const sources = entry[1];
+    return Array.isArray(sources) && sources.length > 0;
+  }).map(([directive, sources]) => {
+    const updatedSources = nonce && (directive === "script-src" || directive === "style-src") ? [...sources, `'nonce-${nonce}'`] : sources;
+    return `${directive} ${updatedSources.join(" ")}`;
+  }).join("; ");
+};
+var buildStrictCSP = (nonce) => {
+  return buildCSP(
+    {
+      "object-src": ["'none'"],
+      "script-src": ["'strict-dynamic'", `'nonce-${nonce}'`, "'unsafe-inline'", "http:", "https:"],
+      "base-uri": ["'none'"]
+    },
+    nonce
+  );
+};
+var parseCSPReport = (reportBody) => {
+  if (!reportBody) return null;
+  const report = reportBody["csp-report"] || (Array.isArray(reportBody) ? reportBody[0] : reportBody);
+  if (!report?.["blocked-uri"]) return null;
+  return {
+    documentUri: report["document-uri"],
+    referrer: report["referrer"],
+    blockedUri: report["blocked-uri"],
+    violatedDirective: report["violated-directive"],
+    originalPolicy: report["original-policy"],
+    disposition: report["disposition"],
+    statusCode: report["status-code"],
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+};
+var secureCSP = buildCSP({
+  "default-src": ["'none'"],
+  "script-src": ["'self'"],
+  "style-src": ["'self'"],
+  "img-src": ["'self'"],
+  "connect-src": ["'self'"],
+  "font-src": ["'self'"],
+  "object-src": ["'none'"],
+  "base-uri": ["'none'"],
+  "form-action": ["'self'"],
+  "frame-ancestors": ["'none'"]
+});
+
+// src/auth/index.ts
+var auth_exports = {};
+__export(auth_exports, {
+  basicAuth: () => basicAuth,
+  can: () => can,
+  canAccess: () => canAccess,
+  generateCSRF: () => generateCSRF,
+  generateHmacChallenge: () => generateHmacChallenge,
+  generateHoneyToken: () => generateHoneyToken,
+  generatePasskeyChallenge: () => generatePasskeyChallenge,
+  hasRole: () => hasRole,
+  isHoneyToken: () => isHoneyToken,
+  isJwtValid: () => isJwtValid,
+  parseAuthenticatorData: () => parseAuthenticatorData,
+  suggestMFA: () => suggestMFA,
+  verifyCSRF: () => verifyCSRF,
+  verifyHmacResponse: () => verifyHmacResponse,
+  verifyPasskeyAssertion: () => verifyPasskeyAssertion,
+  verifyPasskeyRegistration: () => verifyPasskeyRegistration,
+  verifyPasskeySignature: () => verifyPasskeySignature
+});
+import { Buffer as Buffer2 } from "buffer";
+import { randomBytes as randomBytes2, timingSafeEqual, createHmac, createHash, verify } from "crypto";
+var basicAuth = (user, pass) => {
+  const credentials = user + ":" + pass;
+  return "Basic " + Buffer2.from(credentials).toString("base64");
+};
+var verifyPasskeySignature = (_challenge, response, signature, publicKey, algorithm = "sha256") => {
+  try {
+    const data = Buffer2.isBuffer(response) ? response : Buffer2.from(response);
+    const sig = Buffer2.isBuffer(signature) ? signature : Buffer2.from(signature, "base64");
+    return verify(algorithm, data, publicKey, sig);
+  } catch {
+    return false;
+  }
+};
+var suggestMFA = (riskScore, lastFingerprint, currentFingerprint) => {
+  if (lastFingerprint !== currentFingerprint) return true;
+  if (riskScore > 10) return true;
+  return false;
+};
+var generateHmacChallenge = (userSalt) => {
+  return createHmac("sha256", userSalt).update(randomBytes2(32)).digest("hex");
+};
+var verifyHmacResponse = (challenge, proof, secret) => {
+  const expected = createHmac("sha256", secret).update(challenge).digest("hex");
+  const proofBuf = Buffer2.from(proof, "hex");
+  const expectedBuf = Buffer2.from(expected, "hex");
+  if (proofBuf.length !== expectedBuf.length) return false;
+  return timingSafeEqual(proofBuf, expectedBuf);
+};
+var generateHoneyToken = (prefix = "sk") => {
+  return `${prefix}_${randomBytes2(16).toString("hex")}_${randomBytes2(8).toString("hex")}`;
+};
+var isHoneyToken = (token, prefix = "sk") => {
+  if (!token) return false;
+  const parts = token.split("_");
+  return parts.length >= 3 && parts[0] === prefix;
+};
+var generateCSRF = () => {
+  const token = randomBytes2(32).toString("hex");
+  const cookieValue = randomBytes2(32).toString("hex");
+  return { token, cookieValue };
+};
+var verifyCSRF = (providedToken, cookieToken) => {
+  if (!providedToken || !cookieToken) return false;
+  const tokenBuf = Buffer2.from(providedToken, "hex");
+  const cookieBuf = Buffer2.from(cookieToken, "hex");
+  if (tokenBuf.length !== cookieBuf.length) return false;
+  return timingSafeEqual(tokenBuf, cookieBuf);
+};
+var isJwtValid = (token, secretOrPublicKey, algorithm = "HS256") => {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return false;
+    const [headerB64, payloadB64, signatureB64] = parts;
+    const header = JSON.parse(Buffer2.from(headerB64, "base64url").toString("utf8"));
+    if (!header.alg || header.alg.toLowerCase() === "none" || header.alg !== algorithm)
+      return false;
+    const payload = JSON.parse(Buffer2.from(payloadB64, "base64url").toString("utf8"));
+    if (payload.exp && Date.now() >= payload.exp * 1e3) return false;
+    const dataToSign = `${headerB64}.${payloadB64}`;
+    const signatureBuffer = Buffer2.from(signatureB64, "base64url");
+    if (algorithm.startsWith("HS")) {
+      const hashAlg = algorithm.replace("HS", "sha");
+      const expectedSignature = createHmac(hashAlg, secretOrPublicKey).update(dataToSign).digest();
+      if (signatureBuffer.length !== expectedSignature.length) return false;
+      return timingSafeEqual(signatureBuffer, expectedSignature);
+    } else if (algorithm.startsWith("RS") || algorithm.startsWith("ES")) {
+      const hashAlg = algorithm.replace(/RS|ES/, "sha");
+      return verify(hashAlg, Buffer2.from(dataToSign), secretOrPublicKey, signatureBuffer);
+    }
+    return false;
+  } catch {
+    return false;
+  }
+};
+var canAccess = (user, resource, rule) => {
+  return rule(user, resource);
+};
+var hasRole = (userRoles, requiredRoles) => {
+  return requiredRoles.every((role) => userRoles.includes(role));
+};
+var can = (userPermissions, requiredPermission) => {
+  return userPermissions.includes(requiredPermission);
+};
+var generatePasskeyChallenge = (length = 32) => {
+  return randomBytes2(length).toString("base64url");
+};
+var verifyPasskeyRegistration = (clientDataJSONStr, expectedChallenge, expectedOrigin) => {
+  try {
+    let jsonStr = clientDataJSONStr;
+    try {
+      JSON.parse(clientDataJSONStr);
+    } catch {
+      jsonStr = Buffer2.from(clientDataJSONStr, "base64url").toString("utf8");
+    }
+    const clientData = JSON.parse(jsonStr);
+    const receivedBytes = Buffer2.from(clientData.challenge ?? "", "base64url");
+    const expectedBytes = Buffer2.from(expectedChallenge, "base64url");
+    const challengeMatches = receivedBytes.length === expectedBytes.length && receivedBytes.length > 0 && timingSafeEqual(receivedBytes, expectedBytes);
+    const typeMatches = clientData.type === "webauthn.create";
+    let originMatches = true;
+    if (expectedOrigin && clientData.origin !== expectedOrigin) {
+      originMatches = false;
+    }
+    if (!challengeMatches) return { verified: false, error: "Challenge mismatch." };
+    if (!typeMatches) return { verified: false, error: "Invalid type (expected webauthn.create)." };
+    if (!originMatches) return { verified: false, error: "Origin mismatch." };
+    return { verified: true };
+  } catch (err) {
+    return { verified: false, error: err.message };
+  }
+};
+var parseAuthenticatorData = (authData) => {
+  try {
+    const rpIdHash = authData.subarray(0, 32);
+    const flags = authData[32];
+    const signCount = authData.readUInt32BE(33);
+    const attestedCredentialDataPresent = !!(flags & 64);
+    if (!attestedCredentialDataPresent) {
+      return { rpIdHash, flags, signCount };
+    }
+    const aaguid = authData.subarray(37, 53);
+    const credentialIdLength = authData.readUInt16BE(53);
+    const credentialId = authData.subarray(55, 55 + credentialIdLength);
+    const publicKeyBytes = authData.subarray(55 + credentialIdLength);
+    return {
+      rpIdHash,
+      flags,
+      signCount,
+      aaguid,
+      credentialId: credentialId.toString("base64url"),
+      publicKeyBytes: publicKeyBytes.toString("hex")
+    };
+  } catch {
+    return null;
+  }
+};
+var verifyPasskeyAssertion = (clientDataJSONStr, expectedChallenge, expectedOrigin, storedSignCount, authData, signature, publicKeyPem) => {
+  try {
+    let jsonStr = clientDataJSONStr;
+    try {
+      JSON.parse(clientDataJSONStr);
+    } catch {
+      jsonStr = Buffer2.from(clientDataJSONStr, "base64url").toString("utf8");
+    }
+    const clientData = JSON.parse(jsonStr);
+    if (clientData.type !== "webauthn.get") {
+      return { verified: false, error: "Invalid type (expected webauthn.get)." };
+    }
+    const receivedBytes = Buffer2.from(clientData.challenge ?? "", "base64url");
+    const expectedBytes = Buffer2.from(expectedChallenge, "base64url");
+    const challengeMatches = receivedBytes.length === expectedBytes.length && receivedBytes.length > 0 && timingSafeEqual(receivedBytes, expectedBytes);
+    if (!challengeMatches) return { verified: false, error: "Challenge mismatch." };
+    if (clientData.origin !== expectedOrigin) {
+      return { verified: false, error: "Origin mismatch." };
+    }
+    const newSignCount = authData.readUInt32BE(33);
+    if (storedSignCount !== 0 && newSignCount <= storedSignCount) {
+      return {
+        verified: false,
+        error: `Replay attack or cloned authenticator detected: signCount ${newSignCount} is not greater than stored ${storedSignCount}.`
+      };
+    }
+    const clientDataHash = createHash("sha256").update(Buffer2.from(jsonStr, "utf8")).digest();
+    const signedData = Buffer2.concat([authData, clientDataHash]);
+    const sigValid = verify("sha256", signedData, publicKeyPem, signature);
+    if (!sigValid) return { verified: false, error: "Signature verification failed." };
+    return { verified: true, newSignCount };
+  } catch (err) {
+    return { verified: false, error: err.message };
+  }
+};
+
+// src/crypto/index.ts
+var crypto_exports = {};
+__export(crypto_exports, {
+  blindData: () => blindData,
+  decryptSession: () => decryptSession,
+  deriveSubKey: () => deriveSubKey,
+  encryptSession: () => encryptSession,
+  generatePQCKeyPair: () => generatePQCKeyPair,
+  generateToken: () => generateToken,
+  hashPassword: () => hashPassword,
+  reconstructSecret: () => reconstructSecret,
+  runIsolatedCrypto: () => runIsolatedCrypto,
+  sha256: () => sha256,
+  signPQC: () => signPQC,
+  splitSecret: () => splitSecret,
+  verifyPQCSignature: () => verifyPQCSignature,
+  verifyPassword: () => verifyPassword
+});
+import { Buffer as Buffer3 } from "buffer";
+import {
+  randomBytes as randomBytes3,
+  createHash as createHash2,
+  scrypt,
+  timingSafeEqual as timingSafeEqual2,
+  createHmac as createHmac2,
+  createCipheriv,
+  createDecipheriv,
+  hkdfSync
+} from "crypto";
+import { promisify } from "util";
+import { fileURLToPath } from "url";
+import { cpus } from "os";
+
+// src/utils/telemetry.ts
+var telemetry_exports = {};
+__export(telemetry_exports, {
+  getTelemetryProvider: () => getTelemetryProvider,
+  resetTelemetryProvider: () => resetTelemetryProvider,
+  setTelemetryProvider: () => setTelemetryProvider
+});
+var NOOP_PROVIDER = {
+  onRateLimitBlocked: () => {
+  },
+  onSecurityEvent: () => {
+  },
+  onKillSwitchTriggered: () => {
+  },
+  onWorkerSpawned: () => {
+  }
+};
+var _provider = NOOP_PROVIDER;
+var setTelemetryProvider = (provider) => {
+  _provider = provider;
+};
+var resetTelemetryProvider = () => {
+  _provider = NOOP_PROVIDER;
+};
+var getTelemetryProvider = () => _provider;
+
+// src/crypto/index.ts
+var scryptAsync = promisify(scrypt);
+var getFilename = () => {
+  return fileURLToPath(import.meta.url);
+};
+var BoundedWorkerSemaphore = class {
+  constructor(maxConcurrent = Math.max(2, cpus().length - 1)) {
+    this.maxConcurrent = maxConcurrent;
+  }
+  maxConcurrent;
+  active = 0;
+  queue = [];
+  async run(task) {
+    if (this.active >= this.maxConcurrent) {
+      await new Promise((resolve2) => this.queue.push(resolve2));
+    }
+    this.active++;
+    try {
+      return await task();
+    } finally {
+      this.active--;
+      const next = this.queue.shift();
+      if (next) next();
+    }
+  }
+};
+var workerPool = new BoundedWorkerSemaphore();
+var runIsolatedCrypto = async (functionName, args) => {
+  return workerPool.run(async () => {
+    getTelemetryProvider().onWorkerSpawned?.(functionName);
+    const { Worker } = await import("worker_threads");
+    return new Promise((resolve2, reject) => {
+      const worker = new Worker(getFilename(), {
+        workerData: { functionName, args }
+      });
+      worker.on("message", (msg) => {
+        if (msg && msg.status === "success") {
+          resolve2(msg.result !== void 0 ? msg.result : msg);
+        } else {
+          reject(new Error(msg?.error || "Worker execution failed."));
+        }
+      });
+      worker.on("error", reject);
+      worker.on("exit", (code) => {
+        if (code !== 0) reject(new Error(`Worker stopped with exit code ${code}`));
+      });
+    });
+  });
+};
+var gfExp = new Uint8Array(256);
+var gfLog = new Uint8Array(256);
+var gfX = 1;
+for (let i = 0; i < 255; i++) {
+  gfExp[i] = gfX;
+  gfLog[gfX] = i;
+  gfX = gfX << 1;
+  if (gfX & 256) {
+    gfX = gfX ^ 285;
+  }
+}
+gfExp[255] = gfExp[0];
+var gfMul = (a, b) => {
+  if (a === 0 || b === 0) return 0;
+  return gfExp[(gfLog[a] + gfLog[b]) % 255];
+};
+var gfDiv = (a, b) => {
+  if (a === 0) return 0;
+  if (b === 0) throw new Error("Division by zero in GF(256)");
+  return gfExp[(gfLog[a] - gfLog[b] + 255) % 255];
+};
+var evaluatePolynomial = (coefficients, x) => {
+  let result = 0;
+  let power = 1;
+  for (const coeff of coefficients) {
+    result ^= gfMul(coeff, power);
+    power = gfMul(power, x);
+  }
+  return result;
+};
+var splitSecret = (secret, sharesCount, threshold) => {
+  if (threshold > sharesCount) throw new Error("Threshold cannot be greater than sharesCount.");
+  if (threshold < 1) throw new Error("Threshold must be at least 1.");
+  if (sharesCount > 255)
+    throw new Error("Shamir Secret Sharing GF(256) supports up to 255 shares.");
+  const secretBuffer = Buffer3.isBuffer(secret) ? secret : Buffer3.from(secret);
+  const secretLen = secretBuffer.length;
+  const shareBuffers = Array.from({ length: sharesCount }, () => Buffer3.alloc(secretLen));
+  for (let byteIdx = 0; byteIdx < secretLen; byteIdx++) {
+    const s = secretBuffer[byteIdx];
+    const coefficients = [s];
+    for (let k = 1; k < threshold; k++) {
+      coefficients.push(randomBytes3(1)[0]);
+    }
+    for (let i = 0; i < sharesCount; i++) {
+      shareBuffers[i][byteIdx] = evaluatePolynomial(coefficients, i + 1);
+    }
+  }
+  return shareBuffers.map((buf, i) => `${i + 1}:${buf.toString("hex")}`);
+};
+var reconstructSecret = (shares) => {
+  if (shares.length === 0) throw new Error("No shares provided.");
+  const parsedShares = shares.map((s) => {
+    const [xStr, hex] = s.split(":");
+    return {
+      x: Number.parseInt(xStr, 10),
+      y: Buffer3.from(hex, "hex")
+    };
+  });
+  const secretLen = parsedShares[0].y.length;
+  const secretBuffer = Buffer3.alloc(secretLen);
+  for (let byteIdx = 0; byteIdx < secretLen; byteIdx++) {
+    let secretByte = 0;
+    for (let i = 0; i < parsedShares.length; i++) {
+      let li = 1;
+      for (let j = 0; j < parsedShares.length; j++) {
+        if (i === j) continue;
+        const num = parsedShares[j].x;
+        const denom = parsedShares[i].x ^ parsedShares[j].x;
+        li = gfMul(li, gfDiv(num, denom));
+      }
+      secretByte = secretByte ^ gfMul(parsedShares[i].y[byteIdx], li);
+    }
+    secretBuffer[byteIdx] = secretByte;
+  }
+  return secretBuffer;
+};
+var blindData = (data, factor) => {
+  return createHmac2("sha256", factor).update(data).digest("hex");
+};
+var generateToken = (length = 32, encoding = "hex") => {
+  return randomBytes3(length).toString(encoding);
+};
+var deriveSubKey = (secret, info, length = 32) => {
+  const ikm = Buffer3.isBuffer(secret) ? secret : Buffer3.from(secret);
+  const derived = hkdfSync("sha256", ikm, Buffer3.alloc(0), Buffer3.from(info), length);
+  return Buffer3.from(derived).toString("hex");
+};
+var encryptSession = (obj, key) => {
+  const iv = randomBytes3(12);
+  const keyBuffer = Buffer3.isBuffer(key) ? key : Buffer3.from(key, "hex");
+  const cipher = createCipheriv("aes-256-gcm", keyBuffer, iv);
+  const content = JSON.stringify(obj);
+  let encrypted = cipher.update(content, "utf8", "hex");
+  encrypted += cipher.final("hex");
+  const authTag = cipher.getAuthTag().toString("hex");
+  return `${iv.toString("hex")}:${authTag}:${encrypted}`;
+};
+var decryptSession = (sessionStr, key) => {
+  try {
+    const [ivHex, authTagHex, encrypted] = sessionStr.split(":");
+    const keyBuffer = Buffer3.isBuffer(key) ? key : Buffer3.from(key, "hex");
+    const iv = Buffer3.from(ivHex, "hex");
+    const authTag = Buffer3.from(authTagHex, "hex");
+    const decipher = createDecipheriv("aes-256-gcm", keyBuffer, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(encrypted, "hex", "utf8");
+    decrypted += decipher.final("utf8");
+    return JSON.parse(decrypted);
+  } catch {
+    return null;
+  }
+};
+var WOTS_LEN = 67;
+var _usedWotsKeys = /* @__PURE__ */ new Set();
+var generatePQCKeyPair = () => {
+  const privKeyParts = [];
+  const pubKeyParts = [];
+  for (let i = 0; i < WOTS_LEN; i++) {
+    const part = randomBytes3(32).toString("hex");
+    privKeyParts.push(part);
+    let current = Buffer3.from(part, "hex");
+    for (let j = 0; j < 15; j++) {
+      current = createHash2("sha256").update(current).digest();
+    }
+    pubKeyParts.push(current.toString("hex"));
+  }
+  return {
+    publicKey: pubKeyParts.join(";"),
+    privateKey: privKeyParts.join(";")
+  };
+};
+var signPQC = (data, privateKeyStr) => {
+  const msgHash = createHash2("sha256").update(data).digest();
+  const nibbles = [];
+  let checksum = 0;
+  for (let i = 0; i < 32; i++) {
+    const byte = msgHash[i];
+    const n1 = byte >> 4;
+    const n2 = byte & 15;
+    nibbles.push(n1, n2);
+    checksum += 15 - n1 + (15 - n2);
+  }
+  const c1 = checksum >> 8 & 15;
+  const c2 = checksum >> 4 & 15;
+  const c3 = checksum & 15;
+  nibbles.push(c1, c2, c3);
+  const privParts = privateKeyStr.split(";");
+  if (privParts.length !== WOTS_LEN) throw new Error("Invalid private key length.");
+  const keyFingerprint = createHash2("sha256").update(privParts[0]).digest("hex");
+  if (_usedWotsKeys.has(keyFingerprint)) {
+    throw new Error(
+      "WOTS_KEY_REUSE: This WOTS private key has already been used to sign a message. Reusing a WOTS key leaks private key material and breaks the security of the scheme. Generate a new key pair with generatePQCKeyPair() for each message."
+    );
+  }
+  _usedWotsKeys.add(keyFingerprint);
+  const sigParts = [];
+  for (let i = 0; i < WOTS_LEN; i++) {
+    const n = nibbles[i];
+    let current = Buffer3.from(privParts[i], "hex");
+    for (let j = 0; j < n; j++) {
+      current = createHash2("sha256").update(current).digest();
+    }
+    sigParts.push(current.toString("hex"));
+  }
+  return sigParts.join(";");
+};
+var verifyPQCSignature = (data, signature, publicKey) => {
+  try {
+    const msgHash = createHash2("sha256").update(data).digest();
+    const nibbles = [];
+    let checksum = 0;
+    for (let i = 0; i < 32; i++) {
+      const byte = msgHash[i];
+      const n1 = byte >> 4;
+      const n2 = byte & 15;
+      nibbles.push(n1, n2);
+      checksum += 15 - n1 + (15 - n2);
+    }
+    const c1 = checksum >> 8 & 15;
+    const c2 = checksum >> 4 & 15;
+    const c3 = checksum & 15;
+    nibbles.push(c1, c2, c3);
+    const sigParts = signature.split(";");
+    const pubParts = publicKey.split(";");
+    if (sigParts.length !== WOTS_LEN || pubParts.length !== WOTS_LEN) return false;
+    for (let i = 0; i < WOTS_LEN; i++) {
+      const n = nibbles[i];
+      let current = Buffer3.from(sigParts[i], "hex");
+      for (let j = 0; j < 15 - n; j++) {
+        current = createHash2("sha256").update(current).digest();
+      }
+      const expected = Buffer3.from(pubParts[i], "hex");
+      if (!timingSafeEqual2(current, expected)) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+};
+var hashPassword = async (password, salt) => {
+  const actualSalt = salt || generateToken(16);
+  const derivedKey = await scryptAsync(password, actualSalt, 64);
+  return { hash: derivedKey.toString("hex"), salt: actualSalt };
+};
+var verifyPassword = async (password, storedHash, salt) => {
+  const { hash } = await hashPassword(password, salt);
+  const hashBuffer = Buffer3.from(hash, "hex");
+  const storedBuffer = Buffer3.from(storedHash, "hex");
+  if (hashBuffer.length !== storedBuffer.length) return false;
+  return timingSafeEqual2(hashBuffer, storedBuffer);
+};
+var sha256 = (data) => {
+  return createHash2("sha256").update(data).digest("hex");
+};
+var startWorkerIfChild = async () => {
+  try {
+    const { isMainThread, parentPort, workerData } = await import("worker_threads");
+    if (!isMainThread && parentPort) {
+      try {
+        const { functionName, args = [] } = workerData || {};
+        if (functionName === "hashPassword") {
+          const [password, salt] = args;
+          if (password === void 0) {
+            parentPort.postMessage({ status: "success" });
+          } else {
+            hashPassword(password, salt).then((result) => {
+              parentPort.postMessage({ status: "success", result });
+            }).catch((err) => {
+              parentPort.postMessage({ status: "error", error: err.message });
+            });
+          }
+        } else if (functionName === "splitSecret") {
+          const [secret, sharesCount, threshold] = args;
+          const result = splitSecret(secret, sharesCount, threshold);
+          parentPort.postMessage({ status: "success", result });
+        } else if (functionName === "reconstructSecret") {
+          const [shares] = args;
+          const result = reconstructSecret(shares);
+          parentPort.postMessage({ status: "success", result: result.toString("hex") });
+        } else {
+          parentPort.postMessage({ status: "error", error: `Unknown function: ${functionName}` });
+        }
+      } catch (err) {
+        parentPort.postMessage({ status: "error", error: err.message });
+      }
+    }
+  } catch {
+  }
+};
+startWorkerIfChild();
+
+// src/fs/index.ts
+var fs_exports = {};
+__export(fs_exports, {
+  MAGIC_NUMBERS: () => MAGIC_NUMBERS,
+  isPathSafe: () => isPathSafe,
+  resolveSafePath: () => resolveSafePath,
+  safeRead: () => safeRead,
+  verifyMagicNumber: () => verifyMagicNumber
+});
+import { resolve, relative, isAbsolute } from "path";
+var MAGIC_NUMBERS = {
+  PNG: [137, 80, 78, 71],
+  JPEG: [255, 216, 255],
+  PDF: [37, 80, 68, 70],
+  GIF: [71, 73, 70, 56]
+};
+var resolveSafePath = (rootDir, userInputPath) => {
+  const absoluteRoot = resolve(rootDir);
+  const resolvedPath = resolve(absoluteRoot, userInputPath);
+  const relativePath = relative(absoluteRoot, resolvedPath);
+  if (relativePath.startsWith("..") || isAbsolute(relativePath)) {
+    throw new Error("Security Error: Path traversal attempt detected.");
+  }
+  return resolvedPath;
+};
+var verifyMagicNumber = async (filePath, expectedMagic) => {
+  const fs = await import("fs/promises");
+  const handle = await fs.open(filePath, "r");
+  try {
+    const buffer = Buffer.alloc(expectedMagic.length);
+    await handle.read(buffer, 0, expectedMagic.length, 0);
+    return expectedMagic.every((byte, index) => buffer[index] === byte);
+  } finally {
+    await handle.close();
+  }
+};
+var safeRead = async (rootDir, filePath) => {
+  const fs = await import("fs/promises");
+  const safePath = resolveSafePath(rootDir, filePath);
+  return fs.readFile(safePath, "utf8");
+};
+var isPathSafe = (rootDir, filePath) => {
+  try {
+    resolveSafePath(rootDir, filePath);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+// src/http/index.ts
+var http_exports = {};
+__export(http_exports, {
+  analyzeDoSThreat: () => analyzeDoSThreat,
+  generateFingerprint: () => generateFingerprint,
+  generateSRI: () => generateSRI,
+  generateTLSFingerprint: () => generateTLSFingerprint,
+  getHardenedRequestOptions: () => getHardenedRequestOptions,
+  isSafeRedirect: () => isSafeRedirect,
+  isSecure: () => isSecure,
+  normalizeUrl: () => normalizeUrl,
+  projectNoise: () => projectNoise
+});
+import { createHash as createHash3, randomInt, randomBytes as randomBytes4 } from "crypto";
+var isSecure = (url, headers = {}) => {
+  if (url?.startsWith("https://")) return true;
+  const proto = headers["x-forwarded-proto"];
+  if (typeof proto === "string" && proto.toLowerCase() === "https") return true;
+  return false;
+};
+var normalizeUrl = (url) => {
+  try {
+    const parsed = new URL(url);
+    parsed.pathname = parsed.pathname.replaceAll("//", "/");
+    return parsed.toString();
+  } catch {
+    return url.replaceAll("//", "/");
+  }
+};
+var getHardenedRequestOptions = (options = {}) => {
+  return {
+    ...options,
+    minVersion: "TLSv1.3",
+    ciphers: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256",
+    rejectUnauthorized: true
+  };
+};
+var generateTLSFingerprint = (req) => {
+  const headers = req.headers || {};
+  const fingerprintParts = [
+    headers["user-agent"] || "",
+    headers["accept"] || "",
+    headers["accept-language"] || "",
+    headers["accept-encoding"] || "",
+    headers["connection"] || "",
+    headers["upgrade-insecure-requests"] || ""
+  ];
+  return createHash3("sha256").update(fingerprintParts.join("|")).digest("hex");
+};
+var analyzeDoSThreat = (req) => {
+  const headers = req.headers || {};
+  if (headers["transfer-encoding"] && headers["content-length"]) return true;
+  if (headers["connection"] === "keep-alive" && !headers["content-length"] && req.method === "POST")
+    return true;
+  return false;
+};
+var generateFingerprint = (reqHeaders, ip) => {
+  const parts = [
+    ip,
+    reqHeaders["user-agent"] || "unknown",
+    reqHeaders["accept-language"] || "unknown",
+    reqHeaders["accept-encoding"] || "unknown",
+    reqHeaders["sec-ch-ua"] || "unknown",
+    reqHeaders["sec-ch-ua-platform"] || "unknown"
+  ];
+  return createHash3("sha256").update(parts.join("|")).digest("hex");
+};
+var projectNoise = (obj) => {
+  if (typeof obj !== "object" || obj === null) return obj;
+  const noiseCount = randomInt(1, 4);
+  const result = { ...obj };
+  for (let i = 0; i < noiseCount; i++) {
+    const noiseKey = `_sk_${randomBytes4(4).toString("hex")}`;
+    const noiseValue = randomBytes4(8).toString("base64");
+    result[noiseKey] = noiseValue;
+  }
+  return result;
+};
+var isSafeRedirect = (url, allowedHosts = []) => {
+  if (url.startsWith("/")) return !url.startsWith("//");
+  try {
+    const parsed = new URL(url);
+    return allowedHosts.includes(parsed.hostname);
+  } catch {
+    return false;
+  }
+};
+var generateSRI = (data, algorithm = "sha384") => {
+  const hash = createHash3(algorithm).update(data).digest("base64");
+  return `${algorithm}-${hash}`;
+};
+
+// src/rate-limit/index.ts
+var rate_limit_exports = {};
+__export(rate_limit_exports, {
+  AdaptiveRateLimiter: () => AdaptiveRateLimiter,
+  MemoryStore: () => MemoryStore,
+  RateLimiter: () => RateLimiter,
+  RedisStore: () => RedisStore,
+  TokenBucket: () => TokenBucket
+});
+var MemoryStore = class {
+  constructor(windowMs) {
+    this.windowMs = windowMs;
+    this.gcInterval = setInterval(() => this.gc(), 6e4);
+    if (this.gcInterval.unref) {
+      this.gcInterval.unref();
+    }
+  }
+  windowMs;
+  hits = /* @__PURE__ */ new Map();
+  gcInterval;
+  gc() {
+    const now = Date.now();
+    for (const [key, hit] of this.hits.entries()) {
+      if (now > hit.expires) {
+        this.hits.delete(key);
+      }
+    }
+  }
+  async increment(key, amount = 1) {
+    const now = Date.now();
+    const hit = this.hits.get(key);
+    if (!hit || now > hit.expires) {
+      this.hits.set(key, { count: amount, expires: now + this.windowMs });
+      return amount;
+    }
+    hit.count += amount;
+    return hit.count;
+  }
+  async get(key) {
+    const hit = this.hits.get(key);
+    if (!hit || Date.now() > hit.expires) return void 0;
+    return hit.count;
+  }
+  async reset(key) {
+    this.hits.delete(key);
+  }
+  async setTTL(key, value, ttlMs) {
+    this.hits.set(key, { count: value, expires: Date.now() + ttlMs });
+  }
+  // Cleanup method if needed
+  destroy() {
+    clearInterval(this.gcInterval);
+  }
+};
+var RedisStore = class {
+  constructor(redisClient, windowMs, prefix = "rl:") {
+    this.redisClient = redisClient;
+    this.windowMs = windowMs;
+    this.prefix = prefix;
+  }
+  redisClient;
+  windowMs;
+  prefix;
+  async increment(key, amount = 1) {
+    const prefixedKey = this.prefix + key;
+    const multi = this.redisClient.multi();
+    multi.incrby(prefixedKey, amount);
+    multi.pttl(prefixedKey);
+    const results = await multi.exec();
+    const count = Number.parseInt(results[0][1], 10);
+    const ttl = Number.parseInt(results[1][1], 10);
+    if (ttl === -1) {
+      await this.redisClient.pexpire(prefixedKey, this.windowMs);
+    }
+    return count;
+  }
+  async get(key) {
+    const val = await this.redisClient.get(this.prefix + key);
+    return val ? Number.parseInt(val, 10) : void 0;
+  }
+  async reset(key) {
+    await this.redisClient.del(this.prefix + key);
+  }
+  async setTTL(key, value, ttlMs) {
+    const prefixedKey = this.prefix + key;
+    await this.redisClient.set(prefixedKey, value, "PX", ttlMs);
+  }
+};
+var TokenBucket = class {
+  constructor(capacity, refillRatePerSecond) {
+    this.capacity = capacity;
+    this.refillRatePerSecond = refillRatePerSecond;
+  }
+  capacity;
+  refillRatePerSecond;
+  buckets = /* @__PURE__ */ new Map();
+  async consume(id, tokens = 1) {
+    const now = Date.now();
+    const bucket = this.buckets.get(id);
+    if (bucket) {
+      const delta = (now - bucket.lastRefill) / 1e3;
+      const refill = delta * this.refillRatePerSecond;
+      bucket.tokens = Math.min(this.capacity, bucket.tokens + refill);
+      bucket.lastRefill = now;
+    } else {
+      const newBucket = { tokens: this.capacity, lastRefill: now };
+      if (newBucket.tokens >= tokens) {
+        newBucket.tokens -= tokens;
+        this.buckets.set(id, newBucket);
+        return true;
+      }
+      this.buckets.set(id, newBucket);
+      return false;
+    }
+    if (bucket.tokens >= tokens) {
+      bucket.tokens -= tokens;
+      this.buckets.set(id, bucket);
+      return true;
+    }
+    this.buckets.set(id, bucket);
+    return false;
+  }
+};
+var AdaptiveRateLimiter = class {
+  constructor(config, store, securityStore, burstStore) {
+    this.config = config;
+    this.store = store || new MemoryStore(config.windowMs);
+    this.securityStore = securityStore || new MemoryStore(config.windowMs);
+    this.burstStore = burstStore || new MemoryStore(config.windowMs * 10);
+  }
+  config;
+  store;
+  securityStore;
+  burstStore;
+  ipCheckers = [];
+  /**
+   * Automates Incident Response by globally "killing" a session or IP.
+   * This sets an infinite (effectively 1-year) block on the ID.
+   *
+   * @param id The client ID to block.
+   *
+   * @remarks
+   * **Persistence warning**: If the underlying store is `MemoryStore` (the default),
+   * the block is held in process memory and will be **lost on process restart**.
+   * For a persistent kill-switch that survives restarts and works across multiple
+   * instances, pass a `RedisStore` as the `store` and `securityStore` arguments
+   * to the `AdaptiveRateLimiter` constructor.
+   *
+   * @see {@link RedisStore} for a production-grade persistent store.
+   */
+  async triggerGlobalKillSwitch(id) {
+    getTelemetryProvider().onKillSwitchTriggered?.(id);
+    const ONE_YEAR_MS = 365 * 24 * 60 * 60 * 1e3;
+    await this.securityStore.setTTL(`${id}:score`, 99999, ONE_YEAR_MS);
+    await this.store.setTTL(id, 99999, ONE_YEAR_MS);
+    console.warn(`Mitigator: Global Kill-Switch triggered for actor: ${id}`);
+  }
+  registerIPChecker(checker) {
+    this.ipCheckers.push(checker);
+  }
+  async recordSecurityEvent(id, weight = 1) {
+    getTelemetryProvider().onSecurityEvent?.(id, weight);
+    await this.securityStore.increment(`${id}:score`, weight);
+  }
+  async isLimited(id) {
+    for (const checker of this.ipCheckers) {
+      if (await checker(id)) return true;
+    }
+    const score = await this.securityStore.get(`${id}:score`) || 0;
+    const bursts = await this.burstStore.get(`${id}:bursts`) || 0;
+    const isCompromised = score >= this.config.securityThreshold || bursts >= this.config.burstThreshold;
+    const currentLimit = isCompromised ? this.config.penaltyLimit : this.config.standardLimit;
+    const count = await this.store.increment(id);
+    if (count > currentLimit) {
+      if (count === currentLimit + 1) {
+        await this.burstStore.increment(`${id}:bursts`, 1);
+      }
+      getTelemetryProvider().onRateLimitBlocked?.(id, isCompromised ? "penalty" : "standard");
+      return true;
+    }
+    return false;
+  }
+  async isHighRisk(id) {
+    const score = await this.securityStore.get(`${id}:score`) || 0;
+    const bursts = await this.burstStore.get(`${id}:bursts`) || 0;
+    return score >= this.config.securityThreshold || bursts >= this.config.burstThreshold;
+  }
+};
+var RateLimiter = class {
+  constructor(limit, windowMs, store) {
+    this.limit = limit;
+    this.windowMs = windowMs;
+    this.store = store || new MemoryStore(windowMs);
+  }
+  limit;
+  windowMs;
+  store;
+  async isLimited(id) {
+    const count = await this.store.increment(id);
+    return count > this.limit;
+  }
+};
+
+// src/safe-json/index.ts
+var safe_json_exports = {};
+__export(safe_json_exports, {
+  containsPollution: () => containsPollution,
+  getDepth: () => getDepth,
+  parse: () => parse
+});
+var parse = (text, maxDepth = 10) => {
+  const obj = JSON.parse(text, (key, value) => {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      return void 0;
+    }
+    return value;
+  });
+  if (getDepth(obj) > maxDepth) {
+    throw new Error("Security Error: JSON depth limit exceeded (DoS protection).");
+  }
+  return obj;
+};
+var getDepth = (obj) => {
+  if (obj === null || typeof obj !== "object") return 0;
+  let max = 0;
+  for (const key in obj) {
+    if (Object.hasOwn(obj, key)) {
+      max = Math.max(max, getDepth(obj[key]));
+    }
+  }
+  return 1 + max;
+};
+var containsPollution = (obj) => {
+  if (obj === null || typeof obj !== "object") return false;
+  for (const key in obj) {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      return true;
+    }
+    if (containsPollution(obj[key])) {
+      return true;
+    }
+  }
+  return false;
+};
+
+// src/safe-merge/index.ts
+var safe_merge_exports = {};
+__export(safe_merge_exports, {
+  deepFreeze: () => deepFreeze,
+  merge: () => merge,
+  sanitizeObject: () => sanitizeObject
+});
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var isObject = (val) => {
+  return val !== null && typeof val === "object" && !Array.isArray(val);
+};
+var merge = (target, source, seen = /* @__PURE__ */ new WeakSet()) => {
+  if (seen.has(source)) {
+    throw new Error(
+      "Security Error: Circular reference detected during deep merge (DoS prevention)."
+    );
+  }
+  const output = { ...target };
+  if (isObject(target) && isObject(source)) {
+    seen.add(source);
+    Object.keys(source).forEach((key) => {
+      if (DANGEROUS_KEYS.has(key)) {
+        return;
+      }
+      const sourceValue = source[key];
+      const targetValue = target[key];
+      if (isObject(sourceValue) && isObject(targetValue)) {
+        output[key] = merge(targetValue, sourceValue, seen);
+      } else {
+        output[key] = sourceValue;
+      }
+    });
+  }
+  return output;
+};
+var sanitizeObject = (obj, seen = /* @__PURE__ */ new WeakSet()) => {
+  if (obj === null || typeof obj !== "object") return obj;
+  if (seen.has(obj)) {
+    throw new Error("Security Error: Circular reference detected during object sanitization.");
+  }
+  if (Array.isArray(obj)) {
+    seen.add(obj);
+    return obj.map((item) => sanitizeObject(item, seen));
+  }
+  seen.add(obj);
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (DANGEROUS_KEYS.has(key)) continue;
+    result[key] = sanitizeObject(value, seen);
+  }
+  return result;
+};
+var deepFreeze = (obj) => {
+  Object.getOwnPropertyNames(obj).forEach((name) => {
+    const prop = obj[name];
+    if (prop !== null && typeof prop === "object") {
+      deepFreeze(prop);
+    }
+  });
+  return Object.freeze(obj);
+};
+
+// src/utils/index.ts
+var utils_exports = {};
+__export(utils_exports, {
+  SENSITIVE_KEYS: () => SENSITIVE_KEYS,
+  SecureError: () => SecureError,
+  auditConfig: () => auditConfig,
+  checkSecureEnv: () => checkSecureEnv,
+  createMTLSOptions: () => createMTLSOptions,
+  deterministicDigitTransform: () => deterministicDigitTransform,
+  enforceSafeQuery: () => enforceSafeQuery,
+  lockdownPrototypes: () => lockdownPrototypes,
+  normalizeError: () => normalizeError,
+  redact: () => redact,
+  standardSecurityPreset: () => standardSecurityPreset,
+  startSelfHealingMonitor: () => startSelfHealingMonitor,
+  wipeBuffer: () => wipeBuffer
+});
+import { createHash as createHash4 } from "crypto";
+var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
+  "password",
+  "token",
+  "secret",
+  "key",
+  "authorization",
+  "apiKey",
+  "access_token",
+  "refresh_token",
+  "cvv",
+  "card_number",
+  "ssn"
+]);
+var redact = (obj, redactKeys = SENSITIVE_KEYS) => {
+  if (obj === null || typeof obj !== "object") return obj;
+  if (Array.isArray(obj)) return obj.map((item) => redact(item, redactKeys));
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (redactKeys.has(key.toLowerCase())) {
+      result[key] = "[REDACTED]";
+    } else if (typeof value === "object") {
+      result[key] = redact(value, redactKeys);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+};
+var SecureError = class extends Error {
+  code;
+  userMessage;
+  constructor(message, code = "INTERNAL_ERROR", userMessage = "An unexpected error occurred.") {
+    super(message);
+    this.name = "SecureError";
+    this.code = code;
+    this.userMessage = userMessage;
+    if (process.env.NODE_ENV === "production") this.stack = "";
+  }
+  toJSON() {
+    return { error: true, code: this.code, message: this.userMessage };
+  }
+};
+var normalizeError = (error) => {
+  if (error instanceof SecureError) return error;
+  return new SecureError(error?.message || "Unknown error");
+};
+var wipeBuffer = (buf) => {
+  if (Array.isArray(buf)) {
+    for (let i = 0; i < buf.length; i++) buf[i] = 0;
+  } else if (buf instanceof Buffer || buf instanceof Uint8Array) {
+    buf.fill(0);
+  }
+};
+var startSelfHealingMonitor = (config, type, intervalMs = 6e5, logger = console) => {
+  setInterval(() => {
+    const issues = auditConfig(config, type);
+    if (issues.length > 0) {
+      logger.error("MITIGATOR CRITICAL: Self-healing monitor detected insecure config drift!");
+      issues.forEach((issue) => logger.error(`- ${issue}`));
+    }
+  }, intervalMs).unref();
+};
+var enforceSafeQuery = (query, params) => {
+  if ((!params || params.length === 0) && query.toLowerCase().includes("where")) {
+    const suspicious = ["'", '"', "=", "--", ";"];
+    if (suspicious.some((char) => query.includes(char))) {
+      throw new SecureError(
+        "Security Violation: Unparameterized query detected.",
+        "SQL_INJECTION_RISK"
+      );
+    }
+  }
+};
+var deterministicDigitTransform = (input, secret) => {
+  const hash = createHash4("sha256").update(input).update(secret).digest("hex");
+  let result = "";
+  for (let i = 0; i < input.length; i++) {
+    const digit = Number.parseInt(input[i]);
+    const offset = Number.parseInt(hash[i % hash.length], 16);
+    result += ((digit + offset) % 10).toString();
+  }
+  return result;
+};
+var checkSecureEnv = () => {
+  const isProd = process.env.NODE_ENV === "production";
+  if (isProd) {
+    if (!process.env.SESSION_SECRET || process.env.SESSION_SECRET.length < 32) {
+      console.warn("Security Warning: SESSION_SECRET is missing or too short.");
+    }
+  }
+};
+var auditConfig = (config, type) => {
+  const issues = [];
+  if (type === "db") {
+    if (config.ssl === false) issues.push("Database SSL is disabled.");
+    if (config.port === 3306 || config.port === 5432)
+      issues.push("Database is using a default port.");
+  } else if (type === "auth") {
+    if (config.allowInsecurePasswordReset) issues.push("Allowing insecure password reset.");
+  }
+  return issues;
+};
+var lockdownPrototypes = () => {
+  try {
+    Object.freeze(Object.prototype);
+    Object.freeze(Array.prototype);
+    Object.freeze(String.prototype);
+  } catch {
+    console.error("Mitigator Error: Failed to lockdown prototypes.");
+  }
+};
+var createMTLSOptions = (serverCert, serverKey, caCert) => {
+  return {
+    cert: serverCert,
+    key: serverKey,
+    ca: caCert,
+    requestCert: true,
+    rejectUnauthorized: true
+  };
+};
+var standardSecurityPreset = {
+  trustProxy: true,
+  strictTransportSecurity: { maxAge: 31536e3, includeSubDomains: true, preload: true },
+  contentSecurityPolicy: true,
+  referrerPolicy: "strict-origin-when-cross-origin"
+};
+
+// src/utils/presets.ts
+var presets_exports = {};
+__export(presets_exports, {
+  NestJsMitigatorMiddleware: () => NestJsMitigatorMiddleware,
+  SecureLoggerChain: () => SecureLoggerChain,
+  createSecureLogger: () => createSecureLogger,
+  expressErrorHandler: () => expressErrorHandler,
+  expressMiddleware: () => expressMiddleware,
+  fastifyPlugin: () => fastifyPlugin,
+  nextJsMiddleware: () => nextJsMiddleware
+});
+import { createHash as createHash5 } from "crypto";
+var expressMiddleware = (options = {}) => {
+  const limiter = options.rateLimit ? new RateLimiter(
+    options.rateLimitMax || 100,
+    options.rateLimitWindowMs || 6e4,
+    new MemoryStore(options.rateLimitWindowMs || 6e4)
+  ) : null;
+  return async (req, res, next) => {
+    Object.entries(standardHeaders).forEach(([key, value]) => {
+      res.setHeader(key, value);
+    });
+    if (limiter) {
+      const ip = req.ip || req.connection.remoteAddress || "unknown";
+      if (await limiter.isLimited(ip)) {
+        return res.status(429).json({ error: "Too Many Requests" });
+      }
+    }
+    try {
+      if (req.body && typeof req.body === "object") {
+        if (scanForSecrets(req.body)) {
+          return next(
+            new SecureError("Security Violation: Potential secret leakage detected.", "BAD_INPUT")
+          );
+        }
+      }
+    } catch {
+      return next(new SecureError("Security Violation: Suspicious input detected.", "BAD_INPUT"));
+    }
+    req.mitigator = {
+      sanitize: (html) => sanitizeHtml(html),
+      safeJson: (text) => parse(text)
+    };
+    next();
+  };
+};
+var nextJsMiddleware = (_req, res) => {
+  Object.entries(standardHeaders).forEach(([key, value]) => {
+    res.headers.set(key, value);
+  });
+  return res;
+};
+var expressErrorHandler = (err, _req, res, _next) => {
+  const secureErr = err instanceof SecureError ? err : new SecureError(err.message);
+  res.status(secureErr.code === "BAD_INPUT" ? 400 : 500).json(secureErr.toJSON());
+};
+var SecureLoggerChain = class {
+  constructor(baseLogger) {
+    this.baseLogger = baseLogger;
+    this.lastHash = createHash5("sha256").update(Date.now().toString()).digest("hex");
+  }
+  baseLogger;
+  lastHash = "";
+  chain(msg, data) {
+    const payload = JSON.stringify({ msg, data, prev: this.lastHash });
+    this.lastHash = createHash5("sha256").update(payload).digest("hex");
+    return this.lastHash;
+  }
+  info(msg, data) {
+    const hash = this.chain(msg, data);
+    this.baseLogger.info(`[CHAIN:${hash}] ${msg}`, redact(data));
+  }
+  warn(msg, data) {
+    if (scanForSecrets(data)) {
+      this.baseLogger.warn("CRITICAL: Secret leakage blocked!");
+      return;
+    }
+    const hash = this.chain(msg, data);
+    this.baseLogger.warn(`[CHAIN:${hash}] ${msg}`, redact(data));
+  }
+  error(msg, err) {
+    const secureErr = err instanceof SecureError ? err : new SecureError(err?.message || "Error");
+    const hash = this.chain(msg, secureErr.toJSON());
+    this.baseLogger.error(`[CHAIN:${hash}] ${msg}`, redact(secureErr.toJSON()));
+  }
+};
+var createSecureLogger = (baseLogger) => new SecureLoggerChain(baseLogger);
+var fastifyPlugin = (options = {}) => {
+  const limiter = options.rateLimit ? new RateLimiter(
+    options.rateLimitMax || 100,
+    options.rateLimitWindowMs || 6e4,
+    new MemoryStore(options.rateLimitWindowMs || 6e4)
+  ) : null;
+  return async (fastify) => {
+    fastify.addHook("onRequest", async (req, reply) => {
+      Object.entries(standardHeaders).forEach(([key, value]) => {
+        reply.header(key, value);
+      });
+      if (limiter) {
+        const ip = req.ip || "unknown";
+        if (await limiter.isLimited(ip)) {
+          reply.code(429).send({ error: "Too Many Requests" });
+          return reply;
+        }
+      }
+    });
+    fastify.addHook("preHandler", async (req, reply) => {
+      try {
+        if (req.body && typeof req.body === "object") {
+          if (scanForSecrets(req.body)) {
+            throw new SecureError(
+              "Security Violation: Potential secret leakage detected.",
+              "BAD_INPUT"
+            );
+          }
+        }
+      } catch (err) {
+        const secureErr = err instanceof SecureError ? err : new SecureError(err.message, "BAD_INPUT");
+        reply.code(400).send(secureErr.toJSON());
+        return reply;
+      }
+      req.mitigator = {
+        sanitize: (html) => sanitizeHtml(html),
+        safeJson: (text) => parse(text)
+      };
+    });
+  };
+};
+var NestJsMitigatorMiddleware = class _NestJsMitigatorMiddleware {
+  static limiter = null;
+  static configure(options = {}) {
+    if (options.rateLimit) {
+      this.limiter = new RateLimiter(
+        options.rateLimitMax || 100,
+        options.rateLimitWindowMs || 6e4,
+        new MemoryStore(options.rateLimitWindowMs || 6e4)
+      );
+    }
+  }
+  async use(req, res, next) {
+    Object.entries(standardHeaders).forEach(([key, value]) => {
+      res.setHeader(key, value);
+    });
+    if (_NestJsMitigatorMiddleware.limiter) {
+      const ip = req.ip || req.connection?.remoteAddress || "unknown";
+      if (await _NestJsMitigatorMiddleware.limiter.isLimited(ip)) {
+        res.status(429).json({ error: "Too Many Requests" });
+        return;
+      }
+    }
+    try {
+      if (req.body && typeof req.body === "object") {
+        if (scanForSecrets(req.body)) {
+          throw new SecureError(
+            "Security Violation: Potential secret leakage detected.",
+            "BAD_INPUT"
+          );
+        }
+      }
+    } catch (err) {
+      const secureErr = err instanceof SecureError ? err : new SecureError(err.message, "BAD_INPUT");
+      res.status(400).json(secureErr.toJSON());
+      return;
+    }
+    req.mitigator = {
+      sanitize: (html) => sanitizeHtml(html),
+      safeJson: (text) => parse(text)
+    };
+    next();
+  }
+};
+export {
+  auth_exports as auth,
+  crypto_exports as crypto,
+  fs_exports as fs,
+  headers_exports as headers,
+  http_exports as http,
+  presets_exports as presets,
+  rate_limit_exports as rateLimit,
+  safe_json_exports as safeJson,
+  safe_merge_exports as safeMerge,
+  sanitize_exports as sanitize,
+  telemetry_exports as telemetry,
+  utils_exports as utils,
+  validate_exports as validate
+};
+//# sourceMappingURL=index.js.map