webarmor 1.0.0

package/dist/index.cjs

@@ -0,0 +1,2199 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/modules/ddos/DDoSProtection.ts
+var DDoSProtection_exports = {};
+__export(DDoSProtection_exports, {
+  DDoSProtection: () => DDoSProtection,
+  default: () => DDoSProtection_default
+});
+var DDoSProtection, DDoSProtection_default;
+var init_DDoSProtection = __esm({
+  "src/modules/ddos/DDoSProtection.ts"() {
+    "use strict";
+    DDoSProtection = class {
+      config;
+      logger;
+      ipMap = /* @__PURE__ */ new Map();
+      cleanupInterval = null;
+      constructor(config, logger2) {
+        this.config = config;
+        this.logger = logger2;
+        this.startCleanup();
+      }
+      startCleanup() {
+        this.cleanupInterval = setInterval(() => {
+          const now = Date.now();
+          for (const [ip, data] of this.ipMap.entries()) {
+            if (data.blocked && data.blockUntil && now > data.blockUntil) {
+              data.blocked = false;
+              data.blockUntil = void 0;
+              this.logger.info(`IP ${ip} unblocked after DDoS protection`);
+            }
+            if (now - data.lastRequest > this.config.windowMs * 2) {
+              this.ipMap.delete(ip);
+            }
+          }
+        }, 6e4);
+      }
+      async check(data) {
+        const ip = data.ip || "unknown";
+        const now = Date.now();
+        let ipData = this.ipMap.get(ip);
+        if (!ipData) {
+          ipData = {
+            count: 0,
+            firstRequest: now,
+            lastRequest: now,
+            blocked: false,
+            score: 0
+          };
+          this.ipMap.set(ip, ipData);
+        }
+        if (ipData.blocked && ipData.blockUntil && now < ipData.blockUntil) {
+          return {
+            allowed: false,
+            reason: `DDoS protection: IP temporarily blocked until ${new Date(ipData.blockUntil).toISOString()}`
+          };
+        }
+        ipData.count++;
+        ipData.lastRequest = now;
+        const windowStart = now - this.config.windowMs;
+        const requestsInWindow = ipData.count;
+        if (requestsInWindow > this.config.maxRequests) {
+          ipData.blocked = true;
+          ipData.blockUntil = now + this.config.blockDurationMs;
+          ipData.score += 10;
+          this.logger.warn(`DDoS detected from IP ${ip}`, {
+            requestsInWindow,
+            maxRequests: this.config.maxRequests,
+            blocked: true
+          });
+          return {
+            allowed: false,
+            reason: "DDoS protection: Too many requests"
+          };
+        }
+        ipData.score = Math.max(0, ipData.score - 1);
+        if (ipData.score > this.config.scoreThreshold) {
+          ipData.blocked = true;
+          ipData.blockUntil = now + this.config.blockDurationMs;
+          this.logger.warn(`High risk score for IP ${ip}`, {
+            score: ipData.score,
+            threshold: this.config.scoreThreshold
+          });
+          return {
+            allowed: false,
+            reason: "DDoS protection: High risk score"
+          };
+        }
+        return { allowed: true };
+      }
+      getStats() {
+        const now = Date.now();
+        let active = 0;
+        let blocked = 0;
+        for (const data of this.ipMap.values()) {
+          if (!data.blocked || data.blockUntil && now < data.blockUntil) {
+            active++;
+          }
+          if (data.blocked) {
+            blocked++;
+          }
+        }
+        return {
+          totalTracked: this.ipMap.size,
+          activeConnections: active,
+          blockedIPs: blocked
+        };
+      }
+      middleware() {
+        return async (req, res, next) => {
+          const ip = req.ip || req.connection?.remoteAddress || req.headers?.["x-forwarded-for"] || "unknown";
+          const data = {
+            ip,
+            method: req.method,
+            url: req.url,
+            headers: req.headers,
+            body: req.body,
+            userAgent: req.headers?.["user-agent"]
+          };
+          const result = await this.check(data);
+          if (!result.allowed) {
+            return res.status(403).json({
+              error: "Forbidden",
+              message: result.reason
+            });
+          }
+          next();
+        };
+      }
+      destroy() {
+        if (this.cleanupInterval) {
+          clearInterval(this.cleanupInterval);
+        }
+        this.ipMap.clear();
+      }
+    };
+    DDoSProtection_default = DDoSProtection;
+  }
+});
+
+// src/modules/ratelimit/RateLimiter.ts
+var RateLimiter_exports = {};
+__export(RateLimiter_exports, {
+  RateLimiter: () => RateLimiter,
+  default: () => RateLimiter_default
+});
+var RateLimiter, RateLimiter_default;
+var init_RateLimiter = __esm({
+  "src/modules/ratelimit/RateLimiter.ts"() {
+    "use strict";
+    RateLimiter = class {
+      config;
+      logger;
+      limits = /* @__PURE__ */ new Map();
+      refillInterval = null;
+      constructor(config, logger2) {
+        this.config = config;
+        this.logger = logger2;
+        this.startRefill();
+      }
+      startRefill() {
+        this.refillInterval = setInterval(() => {
+          const now = Date.now();
+          for (const [key, data] of this.limits.entries()) {
+            const refillAmount = (now - data.lastRefill) / this.config.windowMs * this.config.max;
+            data.tokens = Math.min(this.config.max, data.tokens + refillAmount);
+            data.lastRefill = now;
+            if (data.tokens >= this.config.max && now - data.lastRefill > this.config.windowMs * 2) {
+              this.limits.delete(key);
+            }
+          }
+        }, 1e3);
+      }
+      async check(key) {
+        const now = Date.now();
+        let data = this.limits.get(key);
+        if (!data) {
+          data = {
+            tokens: this.config.max - 1,
+            lastRefill: now
+          };
+          this.limits.set(key, data);
+          return { allowed: true, remaining: data.tokens };
+        }
+        const refillAmount = (now - data.lastRefill) / this.config.windowMs * this.config.max;
+        data.tokens = Math.min(this.config.max, data.tokens + refillAmount);
+        data.lastRefill = now;
+        if (data.tokens < 1) {
+          this.logger.warn(`Rate limit exceeded for key: ${key}`);
+          return {
+            allowed: false,
+            reason: this.config.message || "Too many requests",
+            remaining: 0
+          };
+        }
+        data.tokens -= 1;
+        return { allowed: true, remaining: Math.floor(data.tokens) };
+      }
+      middleware() {
+        return async (req, res, next) => {
+          const key = this.config.keyGenerator ? this.config.keyGenerator(req) : req.ip || req.connection?.remoteAddress || "unknown";
+          const result = await this.check(key);
+          res.setHeader("X-RateLimit-Limit", this.config.max);
+          res.setHeader("X-RateLimit-Remaining", result.remaining ?? 0);
+          if (!result.allowed) {
+            return res.status(this.config.statusCode || 429).json({
+              error: "Too Many Requests",
+              message: result.reason
+            });
+          }
+          next();
+        };
+      }
+      getStats() {
+        return {
+          activeKeys: this.limits.size
+        };
+      }
+      reset(key) {
+        if (key) {
+          this.limits.delete(key);
+        } else {
+          this.limits.clear();
+        }
+      }
+      destroy() {
+        if (this.refillInterval) {
+          clearInterval(this.refillInterval);
+        }
+        this.limits.clear();
+      }
+    };
+    RateLimiter_default = RateLimiter;
+  }
+});
+
+// src/modules/security-headers/SecurityHeaders.ts
+var SecurityHeaders_exports = {};
+__export(SecurityHeaders_exports, {
+  SecurityHeaders: () => SecurityHeaders,
+  default: () => SecurityHeaders_default
+});
+var SecurityHeaders, SecurityHeaders_default;
+var init_SecurityHeaders = __esm({
+  "src/modules/security-headers/SecurityHeaders.ts"() {
+    "use strict";
+    SecurityHeaders = class {
+      config;
+      logger;
+      constructor(config, logger2) {
+        this.config = config;
+        this.logger = logger2;
+      }
+      buildCSP() {
+        const csp = this.config.contentSecurityPolicy;
+        if (!csp) return "";
+        const parts = [];
+        if (csp.defaultSrc) parts.push(`default-src ${csp.defaultSrc.join(" ")}`);
+        if (csp.scriptSrc) parts.push(`script-src ${csp.scriptSrc.join(" ")}`);
+        if (csp.styleSrc) parts.push(`style-src ${csp.styleSrc.join(" ")}`);
+        if (csp.imgSrc) parts.push(`img-src ${csp.imgSrc.join(" ")}`);
+        if (csp.connectSrc) parts.push(`connect-src ${csp.connectSrc.join(" ")}`);
+        if (csp.fontSrc) parts.push(`font-src ${csp.fontSrc.join(" ")}`);
+        if (csp.objectSrc) parts.push(`object-src ${csp.objectSrc.join(" ")}`);
+        if (csp.mediaSrc) parts.push(`media-src ${csp.mediaSrc.join(" ")}`);
+        if (csp.frameSrc) parts.push(`frame-src ${csp.frameSrc.join(" ")}`);
+        return parts.join("; ");
+      }
+      buildHSTS() {
+        const hsts = this.config.hsts;
+        if (!hsts || !hsts.enabled) return "";
+        let value = `max-age=${hsts.maxAge}`;
+        if (hsts.includeSubDomains) value += "; includeSubDomains";
+        if (hsts.preload) value += "; preload";
+        return value;
+      }
+      middleware() {
+        return (req, res, next) => {
+          if (this.config.xFrameOptions) {
+            res.setHeader("X-Frame-Options", this.config.xFrameOptions);
+          }
+          if (this.config.xContentTypeOptions) {
+            res.setHeader("X-Content-Type-Options", this.config.xContentTypeOptions);
+          }
+          if (this.config.xssProtection) {
+            res.setHeader("X-XSS-Protection", this.config.xssProtection);
+          }
+          if (this.config.referrerPolicy) {
+            res.setHeader("Referrer-Policy", this.config.referrerPolicy);
+          }
+          if (this.config.contentSecurityPolicy) {
+            const csp = this.buildCSP();
+            if (csp) {
+              res.setHeader("Content-Security-Policy", csp);
+            }
+          }
+          if (this.config.hsts && this.config.hsts.enabled) {
+            const hsts = this.buildHSTS();
+            if (hsts) {
+              res.setHeader("Strict-Transport-Security", hsts);
+            }
+          }
+          if (this.config.permissionsPolicy && Object.keys(this.config.permissionsPolicy).length > 0) {
+            const permissions = Object.entries(this.config.permissionsPolicy).map(([key, value]) => `${key}=(${value.join(" ")})`).join(", ");
+            res.setHeader("Permissions-Policy", permissions);
+          }
+          res.setHeader("X-Permitted-Cross-Domain-Policies", "none");
+          res.setHeader("X-Download-Options", "noopen");
+          next();
+        };
+      }
+      getConfig() {
+        return this.config;
+      }
+    };
+    SecurityHeaders_default = SecurityHeaders;
+  }
+});
+
+// src/modules/cors/CORSManager.ts
+var CORSManager_exports = {};
+__export(CORSManager_exports, {
+  CORSManager: () => CORSManager,
+  default: () => CORSManager_default
+});
+var CORSManager, CORSManager_default;
+var init_CORSManager = __esm({
+  "src/modules/cors/CORSManager.ts"() {
+    "use strict";
+    CORSManager = class {
+      config;
+      logger;
+      constructor(config, logger2) {
+        this.config = config;
+        this.logger = logger2;
+      }
+      isOriginAllowed(origin) {
+        if (!origin) return this.config.origins.includes("*");
+        return this.config.origins.some((allowed) => {
+          if (allowed === "*") return true;
+          if (allowed === origin) return true;
+          if (allowed.startsWith("*.")) {
+            const base = allowed.slice(2);
+            return origin.endsWith(base);
+          }
+          if (allowed.includes("*")) {
+            const regex = new RegExp("^" + allowed.replace(/\./g, "\\.").replace(/\*/g, ".*") + "$");
+            return regex.test(origin);
+          }
+          return false;
+        });
+      }
+      middleware() {
+        return (req, res, next) => {
+          const origin = req.headers.origin || req.headers.referer;
+          const method = req.method;
+          if (method === "OPTIONS") {
+            if (this.isOriginAllowed(origin)) {
+              if (this.config.credentials) {
+                res.setHeader("Access-Control-Allow-Origin", origin || "*");
+              } else {
+                res.setHeader("Access-Control-Allow-Origin", this.config.origins.includes("*") ? "*" : origin || "");
+              }
+              res.setHeader("Access-Control-Allow-Methods", this.config.methods?.join(", ") || "GET, POST, PUT, DELETE, OPTIONS");
+              res.setHeader("Access-Control-Allow-Headers", this.config.allowedHeaders?.join(", ") || "Content-Type, Authorization");
+              res.setHeader("Access-Control-Allow-Credentials", String(this.config.credentials));
+              if (this.config.maxAge) {
+                res.setHeader("Access-Control-Max-Age", String(this.config.maxAge));
+              }
+              if (this.config.exposedHeaders?.length) {
+                res.setHeader("Access-Control-Expose-Headers", this.config.exposedHeaders.join(", "));
+              }
+              if (this.config.preflightContinue) {
+                return next();
+              }
+              return res.status(204).end();
+            }
+            return res.status(403).json({ error: "CORS: Origin not allowed" });
+          }
+          if (this.isOriginAllowed(origin)) {
+            if (this.config.credentials) {
+              res.setHeader("Access-Control-Allow-Origin", origin || "*");
+            } else {
+              res.setHeader("Access-Control-Allow-Origin", this.config.origins.includes("*") ? "*" : origin || "");
+            }
+            if (this.config.credentials) {
+              res.setHeader("Access-Control-Allow-Credentials", "true");
+            }
+            if (this.config.exposedHeaders?.length) {
+              res.setHeader("Access-Control-Expose-Headers", this.config.exposedHeaders.join(", "));
+            }
+          }
+          next();
+        };
+      }
+      addOrigin(origin) {
+        if (!this.config.origins.includes(origin)) {
+          this.config.origins.push(origin);
+          this.logger.info(`Added CORS origin: ${origin}`);
+        }
+      }
+      removeOrigin(origin) {
+        const index = this.config.origins.indexOf(origin);
+        if (index > -1) {
+          this.config.origins.splice(index, 1);
+          this.logger.info(`Removed CORS origin: ${origin}`);
+        }
+      }
+      getConfig() {
+        return this.config;
+      }
+    };
+    CORSManager_default = CORSManager;
+  }
+});
+
+// src/modules/xss/XSSProtection.ts
+var XSSProtection_exports = {};
+__export(XSSProtection_exports, {
+  XSSProtection: () => XSSProtection,
+  default: () => XSSProtection_default
+});
+var XSSProtection, XSSProtection_default;
+var init_XSSProtection = __esm({
+  "src/modules/xss/XSSProtection.ts"() {
+    "use strict";
+    XSSProtection = class {
+      config;
+      logger;
+      patterns = {
+        low: /<script|javascript:|on\w+\s*=/i,
+        medium: /<script|javascript:|on\w+\s*=|<iframe|<object|<embed|eval\(|innerHTML|outerHTML/i,
+        strict: /<script|javascript:|on\w+\s*=|<iframe|<object|<embed|<embed|<applet|<meta|<link|<style|<body|<img|<input|<form|<select|<textarea|<datalist|<keygen|<output|<details|<dialog|<menu|<menuitem|eval\(|innerHTML|outerHTML|document\.|window\.|alert\(|confirm\(|prompt\(/i
+      };
+      customRules = [];
+      constructor(config, logger2) {
+        this.config = config;
+        this.logger = logger2;
+        if (this.config.customRules) {
+          for (const [name, pattern] of Object.entries(this.config.customRules)) {
+            this.customRules.push({ pattern: new RegExp(pattern, "i"), name });
+          }
+        }
+      }
+      sanitizeString(str) {
+        if (typeof str !== "string") return str;
+        return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;").replace(/\//g, "&#x2F;");
+      }
+      check(data) {
+        const result = this.deepCheck(data);
+        if (result.detected) {
+          this.logger.warn("XSS attempt detected", {
+            patterns: result.patterns,
+            level: this.config.level
+          });
+          if (this.config.level === "strict") {
+            return {
+              allowed: false,
+              reason: `XSS protection: Suspicious input detected - ${result.patterns.join(", ")}`
+            };
+          }
+        }
+        return { allowed: true };
+      }
+      deepCheck(obj, path3 = "") {
+        if (obj === null || obj === void 0) {
+          return { detected: false, patterns: [] };
+        }
+        if (typeof obj === "string") {
+          return this.checkString(obj, path3);
+        }
+        if (typeof obj === "object") {
+          const patterns = [];
+          let detected = false;
+          for (const key of Object.keys(obj)) {
+            const result = this.deepCheck(obj[key], path3 ? `${path3}.${key}` : key);
+            if (result.detected) {
+              detected = true;
+              patterns.push(...result.patterns);
+            }
+          }
+          return { detected, patterns };
+        }
+        return { detected: false, patterns: [] };
+      }
+      checkString(str, path3) {
+        const patterns = [];
+        const basePattern = this.patterns[this.config.level];
+        if (basePattern.test(str)) {
+          patterns.push(`base-${this.config.level}`);
+        }
+        for (const rule of this.customRules) {
+          if (rule.pattern.test(str)) {
+            patterns.push(rule.name);
+          }
+        }
+        return { detected: patterns.length > 0, patterns };
+      }
+      sanitize(data) {
+        if (typeof data === "string") {
+          return this.sanitizeString(data);
+        }
+        if (Array.isArray(data)) {
+          return data.map((item) => this.sanitize(item));
+        }
+        if (typeof data === "object" && data !== null) {
+          const sanitized = {};
+          for (const [key, value] of Object.entries(data)) {
+            sanitized[key] = this.sanitize(value);
+          }
+          return sanitized;
+        }
+        return data;
+      }
+      middleware() {
+        return (req, res, next) => {
+          if (req.body) {
+            const result = this.check(req.body);
+            if (!result.allowed) {
+              return res.status(400).json({
+                error: "Bad Request",
+                message: result.reason
+              });
+            }
+            req.body = this.sanitize(req.body);
+          }
+          if (req.query) {
+            const result = this.check(req.query);
+            if (!result.allowed) {
+              return res.status(400).json({
+                error: "Bad Request",
+                message: result.reason
+              });
+            }
+          }
+          next();
+        };
+      }
+      addCustomRule(name, pattern) {
+        this.customRules.push({ pattern: new RegExp(pattern, "i"), name });
+      }
+      getConfig() {
+        return this.config;
+      }
+    };
+    XSSProtection_default = XSSProtection;
+  }
+});
+
+// src/modules/csrf/CSRFProtection.ts
+var CSRFProtection_exports = {};
+__export(CSRFProtection_exports, {
+  CSRFProtection: () => CSRFProtection,
+  default: () => CSRFProtection_default
+});
+var import_crypto, CSRFProtection, CSRFProtection_default;
+var init_CSRFProtection = __esm({
+  "src/modules/csrf/CSRFProtection.ts"() {
+    "use strict";
+    import_crypto = __toESM(require("crypto"), 1);
+    CSRFProtection = class {
+      config;
+      logger;
+      tokens = /* @__PURE__ */ new Map();
+      cleanupInterval = null;
+      constructor(config, logger2) {
+        this.config = config;
+        this.logger = logger2;
+        this.startCleanup();
+      }
+      startCleanup() {
+        this.cleanupInterval = setInterval(() => {
+          const now = Date.now();
+          const expiryMs = 36e5;
+          for (const [key, token] of this.tokens.entries()) {
+            if (now - this.hashToTimestamp(token) > expiryMs) {
+              this.tokens.delete(key);
+            }
+          }
+        }, 3e5);
+      }
+      hashToTimestamp(token) {
+        const hash = token.substring(0, 8);
+        return parseInt(hash, 16) * 1e3;
+      }
+      generateToken(sessionId) {
+        const timestamp = Math.floor(Date.now() / 1e3).toString(16);
+        const random = import_crypto.default.randomBytes(this.config.tokenLength || 32).toString("hex");
+        const token = timestamp + random;
+        this.tokens.set(sessionId, token);
+        return token;
+      }
+      validateToken(token, sessionId) {
+        const storedToken = this.tokens.get(sessionId);
+        if (!storedToken) return false;
+        if (storedToken !== token) {
+          this.logger.warn("CSRF token mismatch", { sessionId });
+          return false;
+        }
+        const tokenTimestamp = this.hashToTimestamp(token);
+        const now = Date.now();
+        const maxAge = 36e5;
+        if (now - tokenTimestamp > maxAge) {
+          this.logger.warn("CSRF token expired", { sessionId });
+          this.tokens.delete(sessionId);
+          return false;
+        }
+        return true;
+      }
+      middleware() {
+        return (req, res, next) => {
+          const sessionId = req.session?.id || req.headers["x-session-id"] || req.ip;
+          if (req.method === "GET" || req.method === "HEAD" || req.method === "OPTIONS") {
+            const token2 = this.generateToken(sessionId);
+            if (this.config.cookie) {
+              res.cookie(this.config.cookie.name || "_csrf", token2, {
+                httpOnly: this.config.cookie.httpOnly !== false,
+                secure: this.config.cookie.secure !== false,
+                sameSite: this.config.cookie.sameSite || "strict",
+                maxAge: 36e5
+              });
+            }
+            res.locals.csrfToken = token2;
+            return next();
+          }
+          const token = req.body?.csrf || req.headers["x-csrf-token"] || req.headers["x-xsrf-token"];
+          if (!token) {
+            this.logger.warn("CSRF token missing", {
+              method: req.method,
+              path: req.path
+            });
+            return res.status(403).json({
+              error: "Forbidden",
+              message: "CSRF token missing"
+            });
+          }
+          if (!this.validateToken(token, sessionId)) {
+            return res.status(403).json({
+              error: "Forbidden",
+              message: "Invalid or expired CSRF token"
+            });
+          }
+          next();
+        };
+      }
+      getToken(sessionId) {
+        return this.generateToken(sessionId);
+      }
+      destroy() {
+        if (this.cleanupInterval) {
+          clearInterval(this.cleanupInterval);
+        }
+        this.tokens.clear();
+      }
+    };
+    CSRFProtection_default = CSRFProtection;
+  }
+});
+
+// src/modules/sql-injection/SQLInjectionProtection.ts
+var SQLInjectionProtection_exports = {};
+__export(SQLInjectionProtection_exports, {
+  SQLInjectionProtection: () => SQLInjectionProtection,
+  default: () => SQLInjectionProtection_default
+});
+var SQLInjectionProtection, SQLInjectionProtection_default;
+var init_SQLInjectionProtection = __esm({
+  "src/modules/sql-injection/SQLInjectionProtection.ts"() {
+    "use strict";
+    SQLInjectionProtection = class {
+      config;
+      logger;
+      customPatterns = [];
+      defaultPatterns = [
+        /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER|CREATE|TRUNCATE)\b.*\b(FROM|INTO|TABLE|DATABASE)\b)/i,
+        /((\%27)|(\'))((\%6F)|o|(\%4F))((\%72)|r|(\%52))/i,
+        /((\%27)|(\'))((\%6F)|o|(\%4F))((\%72)|r|(\%52))/i,
+        /((\%27)|(\'))\s*((\%6F)|o|(\%4F))((\%72)|r|(\%52))/i,
+        /(char\s*\(\s*\d+\s*\))/i,
+        /(\%77here\s+\w+\s*=\s*\w+)/i,
+        /(\hre\b.*\b\w+\s*=\s*\w+)/i,
+        /(union\s+select\s+)/i,
+        /(union\s+all\s+select\s+)/i,
+        /(select\s+.*\s+from\s+)/i,
+        /(insert\s+into\s+)/i,
+        /(delete\s+from\s+)/i,
+        /(update\s+.*\s+set\s+)/i,
+        /(drop\s+table\s+)/i,
+        /(drop\s+database\s+)/i,
+        /(exec\s*\(|execute\s*\(|xp_)/i,
+        /(0x[0-9a-fA-F]+)/i,
+        /(\bOR\b\s+\b\d+\s*=\s*\d+)/i,
+        /(\bAND\b\s+\b\d+\s*=\s*\d+)/i,
+        /(\'\s*OR\s*\'\s*\'\s*=\s*\'\s*)/i,
+        /(\'\s*OR\s+\w+\s*=\s*\w+)/i,
+        /(--\s*$)/m,
+        /(;\s*drop\s+)/i,
+        /(;\s*exec\s+)/i,
+        /(\/\*.*\*\/)/,
+        /(\bhaving\b\s+\w+\s*[=<>])/i,
+        /(\blimit\b\s+\d+(,\s*\d+)?)/i
+      ];
+      constructor(config, logger2) {
+        this.config = config;
+        this.logger = logger2;
+        if (this.config.customPatterns) {
+          for (const pattern of this.config.customPatterns) {
+            this.customPatterns.push(new RegExp(pattern, "i"));
+          }
+        }
+      }
+      check(data) {
+        const allInput = this.extractInput(data);
+        const detectedPatterns = [];
+        for (const input of allInput) {
+          if (typeof input !== "string") continue;
+          for (const pattern of this.defaultPatterns) {
+            if (pattern.test(input)) {
+              detectedPatterns.push(`default-${pattern.toString()}`);
+            }
+          }
+          for (const pattern of this.customPatterns) {
+            if (pattern.test(input)) {
+              detectedPatterns.push(`custom-${pattern.toString()}`);
+            }
+          }
+          if (this.hasSuspiciousPatterns(input)) {
+            detectedPatterns.push("suspicious-comments-union");
+          }
+        }
+        if (detectedPatterns.length > 0) {
+          this.logger.warn("SQL Injection attempt detected", {
+            ip: data.ip,
+            url: data.url,
+            patterns: detectedPatterns
+          });
+          if (this.config.blockOnDetect || !this.config.logOnly) {
+            return {
+              allowed: false,
+              reason: "SQL Injection protection: Suspicious input detected",
+              detected: detectedPatterns.join(", ")
+            };
+          }
+        }
+        return { allowed: true };
+      }
+      extractInput(data) {
+        const inputs = [];
+        if (data.body) {
+          inputs.push(...this.flattenObject(data.body));
+        }
+        if (data.url) {
+          const url = new URL(data.url, "http://localhost");
+          for (const [, value] of url.searchParams) {
+            inputs.push(value);
+          }
+        }
+        return inputs;
+      }
+      flattenObject(obj, prefix = "") {
+        const result = [];
+        if (obj === null || obj === void 0) {
+          return result;
+        }
+        if (typeof obj === "string" || typeof obj === "number" || typeof obj === "boolean") {
+          result.push(String(obj));
+          return result;
+        }
+        if (Array.isArray(obj)) {
+          for (const item of obj) {
+            result.push(...this.flattenObject(item));
+          }
+          return result;
+        }
+        if (typeof obj === "object") {
+          for (const [key, value] of Object.entries(obj)) {
+            result.push(...this.flattenObject(value, `${prefix}.${key}`));
+          }
+        }
+        return result;
+      }
+      hasSuspiciousPatterns(input) {
+        const suspicious = [
+          /\/\*.*\*\//,
+          /;\s*(drop|insert|update|delete|create|alter)/i,
+          /@@\w+/,
+          /0x[0-9a-fA-F]{8,}/,
+          /waitfor\s+delay/i,
+          /benchmark\s*\(/i,
+          /sleep\s*\(/i
+        ];
+        return suspicious.some((pattern) => pattern.test(input));
+      }
+      middleware() {
+        return (req, res, next) => {
+          const data = {
+            ip: req.ip || req.connection?.remoteAddress,
+            method: req.method,
+            url: req.url,
+            headers: req.headers,
+            body: req.body,
+            userAgent: req.headers?.["user-agent"]
+          };
+          const result = this.check(data);
+          if (!result.allowed) {
+            if (this.config.blockOnDetect) {
+              return res.status(403).json({
+                error: "Forbidden",
+                message: result.reason
+              });
+            } else {
+              this.logger.warn("SQL Injection detected (log only)", { reason: result.reason });
+            }
+          }
+          next();
+        };
+      }
+      addPattern(pattern) {
+        this.customPatterns.push(new RegExp(pattern, "i"));
+      }
+      getConfig() {
+        return this.config;
+      }
+    };
+    SQLInjectionProtection_default = SQLInjectionProtection;
+  }
+});
+
+// src/modules/bot-protection/BotProtection.ts
+var BotProtection_exports = {};
+__export(BotProtection_exports, {
+  BotProtection: () => BotProtection,
+  default: () => BotProtection_default
+});
+var BotProtection, BotProtection_default;
+var init_BotProtection = __esm({
+  "src/modules/bot-protection/BotProtection.ts"() {
+    "use strict";
+    BotProtection = class {
+      config;
+      logger;
+      challengeCache = /* @__PURE__ */ new Map();
+      cleanupInterval = null;
+      knownBotPatterns = [
+        /bot/i,
+        /crawler/i,
+        /spider/i,
+        /scraper/i,
+        /curl/i,
+        /wget/i,
+        /python-requests/i,
+        /node-fetch/i,
+        /go-http/i,
+        /java\//i,
+        /httpclient/i,
+        /fetch/i
+      ];
+      constructor(config, logger2) {
+        this.config = config;
+        this.logger = logger2;
+        this.startCleanup();
+      }
+      startCleanup() {
+        this.cleanupInterval = setInterval(() => {
+          const now = Date.now();
+          for (const [key, value] of this.challengeCache.entries()) {
+            if (now > value.expires) {
+              this.challengeCache.delete(key);
+            }
+          }
+        }, 6e4);
+      }
+      isKnownBot(userAgent) {
+        for (const pattern of this.knownBotPatterns) {
+          if (pattern.test(userAgent)) {
+            return true;
+          }
+        }
+        if (this.config.blockUserAgents && this.config.blockUserAgents.length > 0) {
+          for (const pattern of this.config.blockUserAgents) {
+            if (new RegExp(pattern, "i").test(userAgent)) {
+              return true;
+            }
+          }
+        }
+        if (this.config.allowUserAgents && this.config.allowUserAgents.length > 0) {
+          for (const pattern of this.config.allowUserAgents) {
+            if (new RegExp(pattern, "i").test(userAgent)) {
+              return false;
+            }
+          }
+        }
+        return false;
+      }
+      generateChallenge() {
+        const a = Math.floor(Math.random() * 10) + 1;
+        const b = Math.floor(Math.random() * 10) + 1;
+        const answer = (a + b).toString();
+        const question = `${a} + ${b} = ?`;
+        return { question, answer };
+      }
+      async check(data) {
+        const userAgent = data.userAgent || "";
+        const ip = data.ip || "unknown";
+        if (this.isKnownBot(userAgent)) {
+          if (this.config.challengeEnabled) {
+            const cacheKey = `${ip}:${data.url}`;
+            const challengeData = this.challengeCache.get(cacheKey);
+            if (!challengeData || !challengeData.solved) {
+              const challenge = this.generateChallenge();
+              this.challengeCache.set(cacheKey, {
+                solved: false,
+                expires: Date.now() + this.config.challengeExpiryMs
+              });
+              this.logger.info("Bot challenge issued", { ip, userAgent });
+              return {
+                allowed: false,
+                reason: "Bot verification required",
+                challenge: {
+                  question: challenge.question,
+                  cookieName: this.config.challengeCookieName
+                }
+              };
+            }
+          } else {
+            return {
+              allowed: false,
+              reason: "Bot detected and blocked"
+            };
+          }
+        }
+        return { allowed: true };
+      }
+      verifyChallenge(ip, url, answer) {
+        const cacheKey = `${ip}:${url}`;
+        const challengeData = this.challengeCache.get(cacheKey);
+        if (!challengeData) {
+          return false;
+        }
+        const storedChallenge = this.challengeCache.get(cacheKey + ":answer");
+        if (!storedChallenge) {
+          const newChallenge = this.generateChallenge();
+          this.challengeCache.set(cacheKey + ":answer", {
+            solved: false,
+            expires: Date.now() + 6e4
+          });
+          return newChallenge.answer === answer;
+        }
+        return storedChallenge.solved;
+      }
+      solveChallenge(ip, url) {
+        const cacheKey = `${ip}:${url}`;
+        const data = this.challengeCache.get(cacheKey);
+        if (data) {
+          data.solved = true;
+          this.challengeCache.set(cacheKey, data);
+        }
+      }
+      middleware() {
+        return async (req, res, next) => {
+          const ip = req.ip || req.connection?.remoteAddress || "unknown";
+          const userAgent = req.headers?.["user-agent"] || "";
+          const data = {
+            ip,
+            method: req.method,
+            url: req.url,
+            headers: req.headers,
+            userAgent
+          };
+          const challengeCookie = req.cookies?.[this.config.challengeCookieName || "webarmor_challenge"];
+          if (challengeCookie) {
+            try {
+              const decoded = Buffer.from(challengeCookie, "base64").toString();
+              const [storedIp, timestamp] = decoded.split(":");
+              if (storedIp === ip && Date.now() - parseInt(timestamp) < this.config.challengeExpiryMs) {
+                return next();
+              }
+            } catch (e) {
+            }
+          }
+          const result = await this.check(data);
+          if (!result.allowed) {
+            if (result.challenge) {
+              res.setHeader("X-WebArmor-Challenge", "required");
+              return res.status(403).json({
+                error: "Bot Verification Required",
+                message: result.reason,
+                challenge: result.challenge
+              });
+            }
+            return res.status(403).json({
+              error: "Forbidden",
+              message: result.reason
+            });
+          }
+          next();
+        };
+      }
+      getConfig() {
+        return this.config;
+      }
+      destroy() {
+        if (this.cleanupInterval) {
+          clearInterval(this.cleanupInterval);
+        }
+        this.challengeCache.clear();
+      }
+    };
+    BotProtection_default = BotProtection;
+  }
+});
+
+// src/modules/ip-filter/IPFilter.ts
+var IPFilter_exports = {};
+__export(IPFilter_exports, {
+  IPFilter: () => IPFilter,
+  default: () => IPFilter_default
+});
+var IPFilter, IPFilter_default;
+var init_IPFilter = __esm({
+  "src/modules/ip-filter/IPFilter.ts"() {
+    "use strict";
+    IPFilter = class {
+      config;
+      logger;
+      customBlockedIPs = /* @__PURE__ */ new Set();
+      constructor(config, logger2) {
+        this.config = config;
+        this.logger = logger2;
+      }
+      parseIP(ip) {
+        if (ip.includes("/")) {
+          return { ip, isIPv6: ip.includes(":"), isSubnet: true };
+        }
+        return { ip, isIPv6: ip.includes(":"), isSubnet: false };
+      }
+      isIPInRange(ip, range) {
+        if (!range.includes("/")) {
+          return ip === range;
+        }
+        const [subnet, mask] = range.split("/");
+        let maskNum = parseInt(mask);
+        if (maskNum >= 32) {
+          return ip === subnet;
+        }
+        const ipParts = ip.split(".").map(Number);
+        const subnetParts = subnet.split(".").map(Number);
+        const maskParts = [];
+        for (let i = 0; i < 4; i++) {
+          if (maskNum >= 8) {
+            maskParts.push(255);
+            maskNum -= 8;
+          } else if (maskNum > 0) {
+            maskParts.push(256 - Math.pow(2, 8 - maskNum));
+            maskNum = 0;
+          } else {
+            maskParts.push(0);
+          }
+        }
+        for (let i = 0; i < 4; i++) {
+          if ((ipParts[i] & maskParts[i]) !== (subnetParts[i] & maskParts[i])) {
+            return false;
+          }
+        }
+        return true;
+      }
+      getClientIP(req) {
+        if (this.config.useXForwardedFor) {
+          const forwarded = req.headers?.["x-forwarded-for"];
+          if (forwarded) {
+            return forwarded.split(",")[0].trim();
+          }
+        }
+        return req.ip || req.connection?.remoteAddress || req.socket?.remoteAddress || "127.0.0.1";
+      }
+      async check(ip) {
+        const clientIP = this.parseIP(ip);
+        if (this.config.whitelist.length > 0) {
+          const isWhitelisted = this.config.whitelist.some(
+            (range) => this.isIPInRange(ip, range)
+          );
+          if (!isWhitelisted) {
+            if (this.config.logBlocked) {
+              this.logger.warn("IP not in whitelist, blocked", { ip });
+            }
+            return {
+              allowed: false,
+              reason: "IP not in whitelist"
+            };
+          }
+          return { allowed: true };
+        }
+        const isBlocked = this.config.blacklist.some(
+          (range) => this.isIPInRange(ip, range)
+        );
+        if (isBlocked || this.customBlockedIPs.has(ip)) {
+          if (this.config.logBlocked) {
+            this.logger.warn("IP blocked by blacklist", { ip });
+          }
+          return {
+            allowed: false,
+            reason: "IP is blocked"
+          };
+        }
+        return { allowed: true };
+      }
+      addToWhitelist(ip) {
+        if (!this.config.whitelist.includes(ip)) {
+          this.config.whitelist.push(ip);
+          this.logger.info(`Added to whitelist: ${ip}`);
+        }
+      }
+      addToBlacklist(ip) {
+        this.customBlockedIPs.add(ip);
+        this.logger.info(`Added to blacklist: ${ip}`);
+      }
+      removeFromWhitelist(ip) {
+        const index = this.config.whitelist.indexOf(ip);
+        if (index > -1) {
+          this.config.whitelist.splice(index, 1);
+          this.logger.info(`Removed from whitelist: ${ip}`);
+        }
+      }
+      removeFromBlacklist(ip) {
+        this.customBlockedIPs.delete(ip);
+        this.logger.info(`Removed from blacklist: ${ip}`);
+      }
+      clearCustomBlacklist() {
+        this.customBlockedIPs.clear();
+        this.logger.info("Custom blacklist cleared");
+      }
+      middleware() {
+        return async (req, res, next) => {
+          const ip = this.getClientIP(req);
+          const result = await this.check(ip);
+          if (!result.allowed) {
+            return res.status(403).json({
+              error: "Forbidden",
+              message: result.reason
+            });
+          }
+          next();
+        };
+      }
+      getConfig() {
+        return this.config;
+      }
+    };
+    IPFilter_default = IPFilter;
+  }
+});
+
+// src/modules/file-block/FileBlocker.ts
+var FileBlocker_exports = {};
+__export(FileBlocker_exports, {
+  FileBlocker: () => FileBlocker,
+  default: () => FileBlocker_default
+});
+var FileBlocker, FileBlocker_default;
+var init_FileBlocker = __esm({
+  "src/modules/file-block/FileBlocker.ts"() {
+    "use strict";
+    FileBlocker = class {
+      config;
+      logger;
+      constructor(config, logger2) {
+        this.config = config;
+        this.logger = logger2;
+      }
+      isPathBlocked(path3) {
+        const normalizedPath = path3.toLowerCase();
+        for (const blocked of this.config.blockedPaths) {
+          if (normalizedPath.includes(blocked.toLowerCase())) {
+            return true;
+          }
+        }
+        const sensitivePatterns = [
+          /\.env$/i,
+          /\.git\//i,
+          /\.gitignore$/i,
+          /config\.json$/i,
+          /\.npmrc$/i,
+          /\.aws\//i,
+          /\.ssh\//i,
+          /credentials\.json$/i,
+          /\.pem$/i,
+          /\.key$/i,
+          /\.p12$/i
+        ];
+        for (const pattern of sensitivePatterns) {
+          if (pattern.test(normalizedPath)) {
+            return true;
+          }
+        }
+        for (const sensitive of this.config.protectSensitive) {
+          if (normalizedPath.includes(sensitive.toLowerCase())) {
+            return true;
+          }
+        }
+        const ext = normalizedPath.split(".").pop();
+        if (ext && this.config.blockedExtensions.includes(`.${ext}`)) {
+          return true;
+        }
+        if (this.config.customRules && this.config.customRules.length > 0) {
+          for (const rule of this.config.customRules) {
+            const regex = new RegExp(rule.pattern, "i");
+            if (regex.test(normalizedPath)) {
+              return rule.action === "block";
+            }
+          }
+        }
+        return false;
+      }
+      check(path3) {
+        if (this.isPathBlocked(path3)) {
+          this.logger.warn("File access blocked", { path: path3 });
+          return {
+            allowed: false,
+            reason: "Access to this path is denied"
+          };
+        }
+        return { allowed: true };
+      }
+      middleware() {
+        return (req, res, next) => {
+          const path3 = req.path || req.url;
+          const result = this.check(path3);
+          if (!result.allowed) {
+            return res.status(403).json({
+              error: "Forbidden",
+              message: result.reason
+            });
+          }
+          next();
+        };
+      }
+      addBlockedPath(path3) {
+        if (!this.config.blockedPaths.includes(path3)) {
+          this.config.blockedPaths.push(path3);
+          this.logger.info(`Added blocked path: ${path3}`);
+        }
+      }
+      removeBlockedPath(path3) {
+        const index = this.config.blockedPaths.indexOf(path3);
+        if (index > -1) {
+          this.config.blockedPaths.splice(index, 1);
+          this.logger.info(`Removed blocked path: ${path3}`);
+        }
+      }
+      addBlockedExtension(ext) {
+        const formatted = ext.startsWith(".") ? ext : `.${ext}`;
+        if (!this.config.blockedExtensions.includes(formatted)) {
+          this.config.blockedExtensions.push(formatted);
+          this.logger.info(`Added blocked extension: ${formatted}`);
+        }
+      }
+      removeBlockedExtension(ext) {
+        const formatted = ext.startsWith(".") ? ext : `.${ext}`;
+        const index = this.config.blockedExtensions.indexOf(formatted);
+        if (index > -1) {
+          this.config.blockedExtensions.splice(index, 1);
+          this.logger.info(`Removed blocked extension: ${formatted}`);
+        }
+      }
+      addCustomRule(pattern, action) {
+        this.config.customRules?.push({ pattern, action });
+        this.logger.info(`Added custom rule: ${pattern} -> ${action}`);
+      }
+      getConfig() {
+        return this.config;
+      }
+    };
+    FileBlocker_default = FileBlocker;
+  }
+});
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ConfigEncryptor: () => ConfigEncryptor_default,
+  DatabaseEncryptor: () => DatabaseEncryptor_default,
+  FileEncryptor: () => FileEncryptor_default,
+  Logger: () => Logger_default,
+  SessionEncryptor: () => SessionEncryptor_default,
+  Shield: () => Shield_default,
+  createShield: () => createShield,
+  default: () => index_default,
+  security: () => security
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/core/Config.ts
+var defaultConfig = {
+  framework: "express",
+  debug: false,
+  logLevel: "info",
+  ddos: {
+    enabled: true,
+    maxRequests: 1e3,
+    windowMs: 6e4,
+    blockDurationMs: 3e5,
+    scoreThreshold: 50
+  },
+  rateLimit: {
+    enabled: true,
+    windowMs: 6e4,
+    max: 100,
+    message: "Too many requests from this IP, please try again later.",
+    statusCode: 429,
+    skipSuccessfulRequests: false,
+    keyGenerator: void 0
+  },
+  securityHeaders: {
+    enabled: true,
+    contentSecurityPolicy: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'"],
+      styleSrc: ["'self'"],
+      imgSrc: ["'self'", "data:"]
+    },
+    hsts: {
+      enabled: true,
+      maxAge: 31536e3,
+      includeSubDomains: true,
+      preload: true
+    },
+    xFrameOptions: "DENY",
+    xContentTypeOptions: "nosniff",
+    xssProtection: "1; mode=block",
+    referrerPolicy: "strict-origin-when-cross-origin",
+    permissionsPolicy: {}
+  },
+  cors: {
+    enabled: true,
+    origins: ["*"],
+    methods: ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"],
+    allowedHeaders: ["Content-Type", "Authorization"],
+    exposedHeaders: [],
+    credentials: false,
+    maxAge: 86400,
+    preflightContinue: false
+  },
+  xss: {
+    enabled: true,
+    level: "medium",
+    blockOnDetect: true,
+    customRules: {}
+  },
+  csrf: {
+    enabled: false,
+    cookie: {
+      name: "_csrf",
+      httpOnly: true,
+      secure: true,
+      sameSite: "strict"
+    },
+    tokenLength: 32
+  },
+  sqlInjection: {
+    enabled: true,
+    blockOnDetect: true,
+    logOnly: false,
+    customPatterns: []
+  },
+  botProtection: {
+    enabled: true,
+    challengeEnabled: true,
+    challengeExpiryMs: 36e5,
+    challengeCookieName: "webarmor_challenge",
+    allowUserAgents: [],
+    blockUserAgents: []
+  },
+  ipFilter: {
+    enabled: false,
+    whitelist: [],
+    blacklist: [],
+    logBlocked: true,
+    useXForwardedFor: true
+  },
+  fileBlock: {
+    enabled: true,
+    blockedPaths: [],
+    blockedExtensions: [".exe", ".bat", ".cmd", ".sh", ".ps1"],
+    protectSensitive: [".env", ".git", "config.json", ".npmrc", ".aws/credentials"],
+    customRules: []
+  },
+  encryption: {
+    enabled: false,
+    algorithm: "aes-256-gcm",
+    defaultKey: "",
+    encryptEnv: false,
+    encryptDatabase: false,
+    encryptConfig: false,
+    keyEnvVariable: "WEBARMOR_KEY"
+  }
+};
+
+// src/core/Logger.ts
+var Logger = class {
+  level;
+  logs = [];
+  maxLogs = 1e3;
+  debugMode = false;
+  levels = {
+    error: 0,
+    warn: 1,
+    info: 2,
+    debug: 3
+  };
+  constructor(options) {
+    this.level = options?.level || "info";
+    this.debugMode = options?.debug || false;
+  }
+  shouldLog(level) {
+    return this.levels[level] <= this.levels[this.level];
+  }
+  formatMessage(level, message, data) {
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    let formatted = `[${timestamp}] [${level.toUpperCase()}] ${message}`;
+    if (data && this.debugMode) {
+      formatted += ` ${JSON.stringify(data)}`;
+    }
+    return formatted;
+  }
+  error(message, data) {
+    if (this.shouldLog("error")) {
+      console.error(this.formatMessage("error", message, data));
+      this.addLog("error", message, data);
+    }
+  }
+  warn(message, data) {
+    if (this.shouldLog("warn")) {
+      console.warn(this.formatMessage("warn", message, data));
+      this.addLog("warn", message, data);
+    }
+  }
+  info(message, data) {
+    if (this.shouldLog("info")) {
+      console.log(this.formatMessage("info", message, data));
+      this.addLog("info", message, data);
+    }
+  }
+  debug(message, data) {
+    if (this.shouldLog("debug")) {
+      console.log(this.formatMessage("debug", message, data));
+      this.addLog("debug", message, data);
+    }
+  }
+  addLog(level, message, data) {
+    this.logs.push({
+      level,
+      message,
+      timestamp: /* @__PURE__ */ new Date(),
+      data
+    });
+    if (this.logs.length > this.maxLogs) {
+      this.logs.shift();
+    }
+  }
+  getLogs(level) {
+    if (level) {
+      return this.logs.filter((log) => log.level === level);
+    }
+    return [...this.logs];
+  }
+  clearLogs() {
+    this.logs = [];
+  }
+  setLevel(level) {
+    this.level = level;
+  }
+  setDebug(debug) {
+    this.debugMode = debug;
+  }
+};
+var logger = new Logger();
+var Logger_default = Logger;
+
+// src/core/Shield.ts
+var Shield = class {
+  config;
+  logger;
+  stats = {
+    requests: 0,
+    blocked: 0,
+    allowed: 0,
+    ddosBlocked: 0,
+    rateLimited: 0,
+    xssBlocked: 0,
+    sqlInjectionBlocked: 0,
+    botBlocked: 0,
+    ipBlocked: 0,
+    fileBlocked: 0,
+    startTime: Date.now()
+  };
+  modules = /* @__PURE__ */ new Map();
+  enabledModules = /* @__PURE__ */ new Set();
+  constructor(userConfig) {
+    this.config = { ...defaultConfig, ...userConfig };
+    this.logger = new Logger_default({
+      level: this.config.logLevel,
+      debug: this.config.debug
+    });
+  }
+  async initialize() {
+    this.logger.info("WebArmor initializing...", { framework: this.config.framework });
+    await this.initializeModules();
+    this.logger.info("WebArmor initialized successfully");
+  }
+  async initializeModules() {
+    if (this.config.ddos.enabled) {
+      try {
+        const { DDoSProtection: DDoSProtection2 } = await Promise.resolve().then(() => (init_DDoSProtection(), DDoSProtection_exports));
+        const ddos = new DDoSProtection2(this.config.ddos, this.logger);
+        this.modules.set("ddos", ddos);
+        this.enabledModules.add("ddos");
+      } catch (e) {
+        this.logger.error("Failed to initialize DDoS protection", e);
+      }
+    }
+    if (this.config.rateLimit.enabled) {
+      try {
+        const { RateLimiter: RateLimiter2 } = await Promise.resolve().then(() => (init_RateLimiter(), RateLimiter_exports));
+        const rateLimit = new RateLimiter2(this.config.rateLimit, this.logger);
+        this.modules.set("rateLimit", rateLimit);
+        this.enabledModules.add("rateLimit");
+      } catch (e) {
+        this.logger.error("Failed to initialize Rate Limiter", e);
+      }
+    }
+    if (this.config.securityHeaders && typeof this.config.securityHeaders !== "boolean" && this.config.securityHeaders.enabled) {
+      try {
+        const { SecurityHeaders: SecurityHeaders2 } = await Promise.resolve().then(() => (init_SecurityHeaders(), SecurityHeaders_exports));
+        const headers = new SecurityHeaders2(this.config.securityHeaders, this.logger);
+        this.modules.set("securityHeaders", headers);
+        this.enabledModules.add("securityHeaders");
+      } catch (e) {
+        this.logger.error("Failed to initialize Security Headers", e);
+      }
+    }
+    if (this.config.cors.enabled) {
+      try {
+        const { CORSManager: CORSManager2 } = await Promise.resolve().then(() => (init_CORSManager(), CORSManager_exports));
+        const cors = new CORSManager2(this.config.cors, this.logger);
+        this.modules.set("cors", cors);
+        this.enabledModules.add("cors");
+      } catch (e) {
+        this.logger.error("Failed to initialize CORS", e);
+      }
+    }
+    if (this.config.xss.enabled) {
+      try {
+        const { XSSProtection: XSSProtection2 } = await Promise.resolve().then(() => (init_XSSProtection(), XSSProtection_exports));
+        const xss = new XSSProtection2(this.config.xss, this.logger);
+        this.modules.set("xss", xss);
+        this.enabledModules.add("xss");
+      } catch (e) {
+        this.logger.error("Failed to initialize XSS Protection", e);
+      }
+    }
+    if (this.config.csrf.enabled) {
+      try {
+        const { CSRFProtection: CSRFProtection2 } = await Promise.resolve().then(() => (init_CSRFProtection(), CSRFProtection_exports));
+        const csrf = new CSRFProtection2(this.config.csrf, this.logger);
+        this.modules.set("csrf", csrf);
+        this.enabledModules.add("csrf");
+      } catch (e) {
+        this.logger.error("Failed to initialize CSRF Protection", e);
+      }
+    }
+    if (this.config.sqlInjection.enabled) {
+      try {
+        const { SQLInjectionProtection: SQLInjectionProtection2 } = await Promise.resolve().then(() => (init_SQLInjectionProtection(), SQLInjectionProtection_exports));
+        const sql = new SQLInjectionProtection2(this.config.sqlInjection, this.logger);
+        this.modules.set("sqlInjection", sql);
+        this.enabledModules.add("sqlInjection");
+      } catch (e) {
+        this.logger.error("Failed to initialize SQL Injection Protection", e);
+      }
+    }
+    if (this.config.botProtection.enabled) {
+      try {
+        const { BotProtection: BotProtection2 } = await Promise.resolve().then(() => (init_BotProtection(), BotProtection_exports));
+        const bot = new BotProtection2(this.config.botProtection, this.logger);
+        this.modules.set("botProtection", bot);
+        this.enabledModules.add("botProtection");
+      } catch (e) {
+        this.logger.error("Failed to initialize Bot Protection", e);
+      }
+    }
+    if (this.config.ipFilter.enabled) {
+      try {
+        const { IPFilter: IPFilter2 } = await Promise.resolve().then(() => (init_IPFilter(), IPFilter_exports));
+        const ipFilter = new IPFilter2(this.config.ipFilter, this.logger);
+        this.modules.set("ipFilter", ipFilter);
+        this.enabledModules.add("ipFilter");
+      } catch (e) {
+        this.logger.error("Failed to initialize IP Filter", e);
+      }
+    }
+    if (this.config.fileBlock.enabled) {
+      try {
+        const { FileBlocker: FileBlocker2 } = await Promise.resolve().then(() => (init_FileBlocker(), FileBlocker_exports));
+        const fileBlock = new FileBlocker2(this.config.fileBlock, this.logger);
+        this.modules.set("fileBlock", fileBlock);
+        this.enabledModules.add("fileBlock");
+      } catch (e) {
+        this.logger.error("Failed to initialize File Blocker", e);
+      }
+    }
+  }
+  apply(app) {
+    this.logger.info("Applying WebArmor middleware to app");
+    if (app && typeof app.use === "function") {
+      if (this.modules.has("securityHeaders")) {
+        const headers = this.modules.get("securityHeaders");
+        app.use(headers.middleware());
+      }
+      if (this.modules.has("cors")) {
+        const cors = this.modules.get("cors");
+        app.use(cors.middleware());
+      }
+      if (this.modules.has("rateLimit")) {
+        const rateLimit = this.modules.get("rateLimit");
+        app.use(rateLimit.middleware());
+      }
+      if (this.modules.has("xss")) {
+        const xss = this.modules.get("xss");
+        app.use(xss.middleware());
+      }
+      if (this.modules.has("sqlInjection")) {
+        const sql = this.modules.get("sqlInjection");
+        app.use(sql.middleware());
+      }
+      if (this.modules.has("botProtection")) {
+        const bot = this.modules.get("botProtection");
+        app.use(bot.middleware());
+      }
+      if (this.modules.has("ipFilter")) {
+        const ipFilter = this.modules.get("ipFilter");
+        app.use(ipFilter.middleware());
+      }
+      if (this.modules.has("fileBlock")) {
+        const fileBlock = this.modules.get("fileBlock");
+        app.use(fileBlock.middleware());
+      }
+    }
+    this.logger.info("WebArmor middleware applied");
+  }
+  async protect(data) {
+    this.stats.requests++;
+    if (this.modules.has("ipFilter")) {
+      const ipFilter = this.modules.get("ipFilter");
+      const result = await ipFilter.check(data.ip);
+      if (!result.allowed) {
+        this.stats.ipBlocked++;
+        this.stats.blocked++;
+        return result;
+      }
+    }
+    if (this.modules.has("ddos")) {
+      const ddos = this.modules.get("ddos");
+      const result = await ddos.check(data);
+      if (!result.allowed) {
+        this.stats.ddosBlocked++;
+        this.stats.blocked++;
+        return result;
+      }
+    }
+    if (this.modules.has("rateLimit")) {
+      const rateLimit = this.modules.get("rateLimit");
+      const key = data.ip;
+      const result = await rateLimit.check(key);
+      if (!result.allowed) {
+        this.stats.rateLimited++;
+        this.stats.blocked++;
+        return result;
+      }
+    }
+    if (this.modules.has("botProtection")) {
+      const bot = this.modules.get("botProtection");
+      const result = await bot.check(data);
+      if (!result.allowed) {
+        this.stats.botBlocked++;
+        this.stats.blocked++;
+        return result;
+      }
+    }
+    if (this.modules.has("xss") && data.body) {
+      const xss = this.modules.get("xss");
+      const result = xss.check(data.body);
+      if (!result.allowed) {
+        this.stats.xssBlocked++;
+        if (this.config.xss.blockOnDetect) {
+          this.stats.blocked++;
+          return result;
+        }
+      }
+    }
+    if (this.modules.has("sqlInjection")) {
+      const sql = this.modules.get("sqlInjection");
+      const result = sql.check(data);
+      if (!result.allowed) {
+        this.stats.sqlInjectionBlocked++;
+        if (this.config.sqlInjection.blockOnDetect) {
+          this.stats.blocked++;
+          return result;
+        }
+      }
+    }
+    this.stats.allowed++;
+    return { allowed: true };
+  }
+  getStats() {
+    return {
+      ...this.stats,
+      uptime: Date.now() - this.stats.startTime,
+      enabledModules: Array.from(this.enabledModules)
+    };
+  }
+  updateConfig(config) {
+    this.config = { ...this.config, ...config };
+    this.logger.info("Configuration updated");
+  }
+  enableModule(moduleName) {
+    if (this.modules.has(moduleName)) {
+      this.enabledModules.add(moduleName);
+      this.logger.info(`Module ${moduleName} enabled`);
+    }
+  }
+  disableModule(moduleName) {
+    if (this.enabledModules.has(moduleName)) {
+      this.enabledModules.delete(moduleName);
+      this.logger.info(`Module ${moduleName} disabled`);
+    }
+  }
+  getLogger() {
+    return this.logger;
+  }
+  getConfig() {
+    return this.config;
+  }
+  getModule(name) {
+    return this.modules.get(name);
+  }
+};
+var Shield_default = Shield;
+
+// src/encryption/FileEncryptor.ts
+var import_crypto2 = __toESM(require("crypto"), 1);
+var import_fs = __toESM(require("fs"), 1);
+var FileEncryptor = class {
+  algorithm = "aes-256-gcm";
+  keyLength = 32;
+  ivLength = 16;
+  authTagLength = 16;
+  deriveKey(password, salt) {
+    return import_crypto2.default.pbkdf2Sync(password, salt, 1e5, this.keyLength, "sha256");
+  }
+  encryptFile(inputPath, outputPath, password) {
+    return new Promise((resolve, reject) => {
+      try {
+        const salt = import_crypto2.default.randomBytes(32);
+        const key = this.deriveKey(password, salt);
+        const iv = import_crypto2.default.randomBytes(this.ivLength);
+        const cipher = import_crypto2.default.createCipheriv(this.algorithm, key, iv);
+        const input = import_fs.default.readFileSync(inputPath);
+        const encrypted = Buffer.concat([cipher.update(input), cipher.final()]);
+        const authTag = cipher.getAuthTag();
+        const output = Buffer.concat([
+          salt,
+          iv,
+          authTag,
+          encrypted
+        ]);
+        import_fs.default.writeFileSync(outputPath, output);
+        resolve();
+      } catch (error) {
+        reject(error);
+      }
+    });
+  }
+  decryptFile(inputPath, outputPath, password) {
+    return new Promise((resolve, reject) => {
+      try {
+        const fileData = import_fs.default.readFileSync(inputPath);
+        const salt = fileData.subarray(0, 32);
+        const iv = fileData.subarray(32, 32 + this.ivLength);
+        const authTag = fileData.subarray(32 + this.ivLength, 32 + this.ivLength + this.authTagLength);
+        const encrypted = fileData.subarray(32 + this.ivLength + this.authTagLength);
+        const key = this.deriveKey(password, salt);
+        const decipher = import_crypto2.default.createDecipheriv(this.algorithm, key, iv);
+        decipher.setAuthTag(authTag);
+        const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+        import_fs.default.writeFileSync(outputPath, decrypted);
+        resolve();
+      } catch (error) {
+        reject(error);
+      }
+    });
+  }
+  encryptString(data, password) {
+    const salt = import_crypto2.default.randomBytes(32);
+    const key = this.deriveKey(password, salt);
+    const iv = import_crypto2.default.randomBytes(this.ivLength);
+    const cipher = import_crypto2.default.createCipheriv(this.algorithm, key, iv);
+    const encrypted = Buffer.concat([cipher.update(data, "utf8"), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    return Buffer.concat([salt, iv, authTag, encrypted]).toString("base64");
+  }
+  decryptString(encryptedData, password) {
+    const data = Buffer.from(encryptedData, "base64");
+    const salt = data.subarray(0, 32);
+    const iv = data.subarray(32, 32 + this.ivLength);
+    const authTag = data.subarray(32 + this.ivLength, 32 + this.ivLength + this.authTagLength);
+    const encrypted = data.subarray(32 + this.ivLength + this.authTagLength);
+    const key = this.deriveKey(password, salt);
+    const decipher = import_crypto2.default.createDecipheriv(this.algorithm, key, iv);
+    decipher.setAuthTag(authTag);
+    return decipher.update(encrypted) + decipher.final("utf8");
+  }
+  encryptJSON(data, password) {
+    const jsonString = JSON.stringify(data);
+    return this.encryptString(jsonString, password);
+  }
+  decryptJSON(encryptedData, password) {
+    const decrypted = this.decryptString(encryptedData, password);
+    return JSON.parse(decrypted);
+  }
+};
+var FileEncryptor_default = FileEncryptor;
+
+// src/encryption/ConfigEncryptor.ts
+var import_fs2 = __toESM(require("fs"), 1);
+var import_path = __toESM(require("path"), 1);
+var ConfigEncryptor = class {
+  encryptor;
+  configDir;
+  backupDir;
+  constructor(configDir = "./config") {
+    this.encryptor = new FileEncryptor_default();
+    this.configDir = configDir;
+    this.backupDir = import_path.default.join(configDir, ".backup");
+  }
+  encryptConfigFile(filename, password) {
+    const inputPath = import_path.default.join(this.configDir, filename);
+    const outputPath = import_path.default.join(this.configDir, `${filename}.enc`);
+    if (!import_fs2.default.existsSync(this.configDir)) {
+      import_fs2.default.mkdirSync(this.configDir, { recursive: true });
+    }
+    this.createBackup(inputPath);
+    this.encryptor.encryptFile(inputPath, outputPath, password);
+    import_fs2.default.unlinkSync(inputPath);
+  }
+  decryptConfigFile(filename, password) {
+    const inputPath = import_path.default.join(this.configDir, `${filename}.enc`);
+    const outputPath = import_path.default.join(this.configDir, filename.replace(".enc", ""));
+    if (!import_fs2.default.existsSync(inputPath)) {
+      throw new Error(`Encrypted file not found: ${filename}`);
+    }
+    this.encryptor.decryptFile(inputPath, outputPath, password);
+  }
+  encryptEnvFile(password) {
+    const envPath = import_path.default.join(process.cwd(), ".env");
+    const envBackupPath = import_path.default.join(process.cwd(), ".env.backup");
+    const envEncryptedPath = import_path.default.join(process.cwd(), ".env.enc");
+    if (!import_fs2.default.existsSync(envPath)) {
+      throw new Error(".env file not found");
+    }
+    if (import_fs2.default.existsSync(envBackupPath)) {
+      import_fs2.default.unlinkSync(envBackupPath);
+    }
+    import_fs2.default.copyFileSync(envPath, envBackupPath);
+    this.encryptor.encryptFile(envPath, envEncryptedPath, password);
+    import_fs2.default.unlinkSync(envPath);
+  }
+  decryptEnvFile(password) {
+    const envEncryptedPath = import_path.default.join(process.cwd(), ".env.enc");
+    const envPath = import_path.default.join(process.cwd(), ".env");
+    if (!import_fs2.default.existsSync(envEncryptedPath)) {
+      throw new Error(".env.enc file not found");
+    }
+    this.encryptor.decryptFile(envEncryptedPath, envPath, password);
+  }
+  getEncryptedEnv(password) {
+    const envEncryptedPath = import_path.default.join(process.cwd(), ".env.enc");
+    if (!import_fs2.default.existsSync(envEncryptedPath)) {
+      throw new Error(".env.enc file not found");
+    }
+    const tempOutput = import_path.default.join(process.cwd(), ".env.temp");
+    this.encryptor.decryptFile(envEncryptedPath, tempOutput, password);
+    const content = import_fs2.default.readFileSync(tempOutput, "utf8");
+    import_fs2.default.unlinkSync(tempOutput);
+    const envVars = {};
+    const lines = content.split("\n");
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const [key, ...valueParts] = trimmed.split("=");
+      if (key) {
+        envVars[key.trim()] = valueParts.join("=").trim();
+      }
+    }
+    return envVars;
+  }
+  createBackup(filePath) {
+    if (!import_fs2.default.existsSync(filePath)) return;
+    if (!import_fs2.default.existsSync(this.backupDir)) {
+      import_fs2.default.mkdirSync(this.backupDir, { recursive: true });
+    }
+    const filename = import_path.default.basename(filePath);
+    const timestamp = Date.now();
+    const backupPath = import_path.default.join(this.backupDir, `${filename}.${timestamp}.bak`);
+    import_fs2.default.copyFileSync(filePath, backupPath);
+  }
+  restoreBackup(filename) {
+    if (!import_fs2.default.existsSync(this.backupDir)) {
+      throw new Error("No backups found");
+    }
+    const backups = import_fs2.default.readdirSync(this.backupDir).filter((f) => f.startsWith(filename)).sort().reverse();
+    if (backups.length === 0) {
+      throw new Error(`No backups found for ${filename}`);
+    }
+    const latestBackup = import_path.default.join(this.backupDir, backups[0]);
+    const originalPath = import_path.default.join(this.configDir, filename);
+    import_fs2.default.copyFileSync(latestBackup, originalPath);
+  }
+  listBackups() {
+    if (!import_fs2.default.existsSync(this.backupDir)) {
+      return [];
+    }
+    return import_fs2.default.readdirSync(this.backupDir);
+  }
+};
+var ConfigEncryptor_default = ConfigEncryptor;
+
+// src/encryption/DatabaseEncryptor.ts
+var import_fs3 = __toESM(require("fs"), 1);
+var import_path2 = __toESM(require("path"), 1);
+var DatabaseEncryptor = class {
+  encryptor;
+  dbDir;
+  constructor(dbDir = "./data") {
+    this.encryptor = new FileEncryptor_default();
+    this.dbDir = dbDir;
+  }
+  encryptDatabase(dbPath, password, outputPath) {
+    const targetPath = outputPath || `${dbPath}.enc`;
+    if (!import_fs3.default.existsSync(dbPath)) {
+      throw new Error(`Database file not found: ${dbPath}`);
+    }
+    this.encryptor.encryptFile(dbPath, targetPath, password);
+  }
+  decryptDatabase(encryptedPath, password, outputPath) {
+    const targetPath = outputPath || encryptedPath.replace(".enc", "");
+    if (!import_fs3.default.existsSync(encryptedPath)) {
+      throw new Error(`Encrypted database not found: ${encryptedPath}`);
+    }
+    this.encryptor.decryptFile(encryptedPath, targetPath, password);
+  }
+  encryptJSONDatabase(dbPath, password) {
+    if (!import_fs3.default.existsSync(dbPath)) {
+      throw new Error(`Database file not found: ${dbPath}`);
+    }
+    const data = JSON.parse(import_fs3.default.readFileSync(dbPath, "utf8"));
+    const encrypted = this.encryptor.encryptJSON(data, password);
+    import_fs3.default.writeFileSync(dbPath, encrypted, "utf8");
+  }
+  decryptJSONDatabase(dbPath, password) {
+    if (!import_fs3.default.existsSync(dbPath)) {
+      throw new Error(`Database file not found: ${dbPath}`);
+    }
+    const encrypted = import_fs3.default.readFileSync(dbPath, "utf8");
+    return this.encryptor.decryptJSON(encrypted, password);
+  }
+  encryptSQLite(dbPath, password) {
+    this.encryptDatabase(dbPath, password);
+  }
+  decryptSQLite(encryptedPath, password) {
+    this.decryptDatabase(encryptedPath, password);
+  }
+  autoEncryptDatabases(password, extensions = [".json", ".sqlite", ".db"]) {
+    if (!import_fs3.default.existsSync(this.dbDir)) {
+      return;
+    }
+    const files = import_fs3.default.readdirSync(this.dbDir);
+    for (const file of files) {
+      const ext = import_path2.default.extname(file);
+      if (extensions.includes(ext)) {
+        const filePath = import_path2.default.join(this.dbDir, file);
+        const encryptedPath = `${filePath}.enc`;
+        this.encryptor.encryptFile(filePath, encryptedPath, password);
+        import_fs3.default.unlinkSync(filePath);
+      }
+    }
+  }
+  autoDecryptDatabases(password) {
+    if (!import_fs3.default.existsSync(this.dbDir)) {
+      return;
+    }
+    const files = import_fs3.default.readdirSync(this.dbDir);
+    for (const file of files) {
+      if (file.endsWith(".enc")) {
+        const encryptedPath = import_path2.default.join(this.dbDir, file);
+        const decryptedPath = encryptedPath.replace(".enc", "");
+        this.encryptor.decryptFile(encryptedPath, decryptedPath, password);
+        import_fs3.default.unlinkSync(encryptedPath);
+      }
+    }
+  }
+  createEncryptedBackup(dbPath, backupDir, password) {
+    if (!import_fs3.default.existsSync(backupDir)) {
+      import_fs3.default.mkdirSync(backupDir, { recursive: true });
+    }
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    const filename = import_path2.default.basename(dbPath, import_path2.default.extname(dbPath));
+    const backupPath = import_path2.default.join(backupDir, `${filename}_${timestamp}.enc`);
+    this.encryptor.encryptFile(dbPath, backupPath, password);
+    return backupPath;
+  }
+  listEncryptedBackups(backupDir) {
+    if (!import_fs3.default.existsSync(backupDir)) {
+      return [];
+    }
+    return import_fs3.default.readdirSync(backupDir).filter((f) => f.endsWith(".enc")).map((f) => import_path2.default.join(backupDir, f));
+  }
+};
+var DatabaseEncryptor_default = DatabaseEncryptor;
+
+// src/encryption/SessionEncryptor.ts
+var import_crypto3 = __toESM(require("crypto"), 1);
+var SessionEncryptor = class {
+  encryptor;
+  key = null;
+  constructor(key) {
+    this.encryptor = new FileEncryptor_default();
+    if (key) {
+      this.setKey(key);
+    }
+  }
+  setKey(key) {
+    this.key = import_crypto3.default.createHash("sha256").update(key).digest();
+  }
+  ensureKey() {
+    if (!this.key) {
+      throw new Error("Encryption key not set. Call setKey() first.");
+    }
+  }
+  encryptSession(sessionData) {
+    this.ensureKey();
+    const json = JSON.stringify(sessionData);
+    return this.encryptor.encryptString(json, this.key.toString("base64"));
+  }
+  decryptSession(encryptedData) {
+    this.ensureKey();
+    const decrypted = this.encryptor.decryptString(encryptedData, this.key.toString("base64"));
+    return JSON.parse(decrypted);
+  }
+  encryptValue(value) {
+    this.ensureKey();
+    if (typeof value === "object") {
+      return this.encryptor.encryptJSON(value, this.key.toString("base64"));
+    }
+    return this.encryptor.encryptString(String(value), this.key.toString("base64"));
+  }
+  decryptValue(encryptedValue) {
+    this.ensureKey();
+    try {
+      const decrypted = this.encryptor.decryptString(encryptedValue, this.key.toString("base64"));
+      try {
+        return JSON.parse(decrypted);
+      } catch {
+        return decrypted;
+      }
+    } catch {
+      try {
+        return this.encryptor.decryptJSON(encryptedValue, this.key.toString("base64"));
+      } catch {
+        throw new Error("Failed to decrypt value");
+      }
+    }
+  }
+  createSignedSession(sessionData, secret) {
+    const encrypted = this.encryptSession(sessionData);
+    const signature = import_crypto3.default.createHmac("sha256", secret).update(encrypted).digest("base64");
+    return `${encrypted}.${signature}`;
+  }
+  verifySignedSession(signedSession, secret) {
+    const parts = signedSession.split(".");
+    if (parts.length !== 2) {
+      return { valid: false };
+    }
+    const [encrypted, signature] = parts;
+    const expectedSignature = import_crypto3.default.createHmac("sha256", secret).update(encrypted).digest("base64");
+    if (signature !== expectedSignature) {
+      return { valid: false };
+    }
+    try {
+      const data = this.decryptSession(encrypted);
+      return { valid: true, data };
+    } catch {
+      return { valid: false };
+    }
+  }
+  encryptCookie(sessionData, password) {
+    return this.encryptor.encryptString(JSON.stringify(sessionData), password);
+  }
+  decryptCookie(encryptedCookie, password) {
+    const decrypted = this.encryptor.decryptString(encryptedCookie, password);
+    return JSON.parse(decrypted);
+  }
+  generateSecureToken(length = 32) {
+    return import_crypto3.default.randomBytes(length).toString("hex");
+  }
+  hashData(data) {
+    return import_crypto3.default.createHash("sha256").update(data).digest("hex");
+  }
+  verifyHash(data, hash) {
+    return this.hashData(data) === hash;
+  }
+};
+var SessionEncryptor_default = SessionEncryptor;
+
+// src/index.ts
+async function createWebArmor(config) {
+  const shield = new Shield_default(config);
+  await shield.initialize();
+  return shield;
+}
+var index_default = {
+  create: createWebArmor,
+  Shield: Shield_default,
+  FileEncryptor: FileEncryptor_default,
+  ConfigEncryptor: ConfigEncryptor_default,
+  DatabaseEncryptor: DatabaseEncryptor_default,
+  SessionEncryptor: SessionEncryptor_default,
+  Logger: Logger_default
+};
+var security = {
+  encrypt: (data, password) => {
+    const enc = new FileEncryptor_default();
+    return enc.encryptString(data, password);
+  },
+  decrypt: (encryptedData, password) => {
+    const enc = new FileEncryptor_default();
+    return enc.decryptString(encryptedData, password);
+  },
+  encryptFile: async (inputPath, outputPath, password) => {
+    const enc = new FileEncryptor_default();
+    await enc.encryptFile(inputPath, outputPath, password);
+  },
+  decryptFile: async (inputPath, outputPath, password) => {
+    const enc = new FileEncryptor_default();
+    await enc.decryptFile(inputPath, outputPath, password);
+  }
+};
+var createShield = createWebArmor;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ConfigEncryptor,
+  DatabaseEncryptor,
+  FileEncryptor,
+  Logger,
+  SessionEncryptor,
+  Shield,
+  createShield,
+  security
+});
+//# sourceMappingURL=index.cjs.map