xypriss 1.0.1 → 1.1.0

package/dist/cjs/mods/security/src/core/keys.js

@@ -0,0 +1,136 @@
+'use strict';
+
+var keysCore = require('./keys/keys-core.js');
+require('./keys/keys-logger.js');
+require('./keys/keys-types.js');
+require('./keys/keys-utils.js');
+require('crypto');
+require('./keys/algorithms/mods/PBKDF2Algo.js');
+
+/**
+ * Legacy Keys implementation for key derivation and management.
+ * This class provides a backward-compatible interface for key derivation while leveraging
+ * the modern, optimized key derivation infrastructure. It serves as a facade to the {@link OptimizedKeys} class,
+ * simplifying interaction with cryptographic key operations and providing environment insights.
+ *
+ * @remarks
+ * - This class ensures compatibility with legacy systems while delegating core functionality to {@link OptimizedKeys}.
+ * - All methods are static, allowing direct usage without instantiation.
+ * - Designed to be thread-safe and efficient by reusing a singleton instance of {@link OptimizedKeys}.
+ *
+ * @public
+ */
+/**
+ * ### Cryptographic Key Management
+ *
+ * Advanced key generation, derivation, and management utilities for
+ * symmetric and asymmetric cryptographic operations.
+ *
+ * @example
+ * ```typescript
+ * import { Keys } from "xypriss-security";
+ *
+ * // Generate encryption key
+ * const encryptionKey = Keys.generateEncryptionKey(256);
+ *
+ * // Derive key from password
+ * const derivedKey = await Keys.deriveKey("password", "salt");
+ * ```
+ */
+class Keys {
+    /**
+     * Derives a cryptographic key from the provided input using specified options.
+     * This method delegates to the optimized key derivation system, ensuring high performance
+     * and adherence to cryptographic best practices.
+     *
+     * @param input - The input data for key derivation, either a password (string) or raw bytes (Uint8Array).
+     * @param options - Optional configuration for key derivation, including algorithm, iterations, and other parameters.
+     *                  If omitted, default values are applied based on the underlying {@link OptimizedKeys} implementation.
+     * @returns A hexadecimal string representing the derived cryptographic key.
+     *
+     * @example
+     * ```typescript
+     * const key = Keys.deriveKey('myPassword', { algorithm: 'PBKDF2', iterations: 100000 });
+     * console.log(key); // Outputs: "a1b2c3d4e5f6..."
+     * ```
+     *
+     * @remarks
+     * - Throws an invalid input error if the input format is invalid or unsupported.
+     * - The output length depends on the algorithm and options specified.
+     * - For security, ensure the input is securely handled to prevent leakage.
+     *
+     * @public
+     */
+    static deriveKey(input, options = {}) {
+        return keysCore.OptimizedKeys.getInstance().deriveKey(input, options);
+    }
+    /**
+     * Retrieves performance metrics for key derivation operations.
+     * Offers detailed insights into the efficiency and resource usage of the underlying
+     * optimized key derivation system.
+     *
+     * @returns An object containing performance metrics, such as derivation time (ms) and memory usage (MB).
+     *
+     * @example
+     * ```typescript
+     * const metrics = Keys.getMetrics();
+     * console.log(metrics); // Outputs: { derivationTimeMs: 10, memoryUsedMb: 2.5, operationsCount: 100, ... }
+     * ```
+     *
+     * @remarks
+     * - Metrics are aggregated from the {@link OptimizedKeys} instance and may include vendor-specific data.
+     * - Useful for debugging and optimizing key derivation processes in performance-critical applications.
+     *
+     * @public
+     */
+    static getMetrics() {
+        return keysCore.OptimizedKeys.getInstance().getMetrics();
+    }
+    /**
+     * Retrieves information about the current runtime environment.
+     * Includes details about such the as platform, supported cryptographic algorithms,
+     * and other environment-specific data relevant to key derivation.
+     *
+     * @returns An object containing environment-specific information, such as platform type and cryptographic capabilities.
+     *
+     * @example
+     * ```typescript
+     * const envInfo = Keys.getEnvironmentInfo();
+     * console.log('envInfo); // Outputs: ' { platform: 'Node.js', cryptoSupport: ['PBKDF2', 'Argon2'], version: '18.x', ... }
+     * ```
+     *
+     * @remarks
+     * - The exact structure of the returned object may vary depending on the runtime environment.
+     * - Useful for feature detection and compatibility checks in cross-platform applications.
+     *
+     * @public
+     */
+    static getEnvironmentInfo() {
+        return keysCore.OptimizedKeys.getInstance().getEnvironmentInfo();
+    }
+    /**
+     * Recommends an optimal key derivation algorithm based on the current runtime environment.
+     * Evaluates the environment to suggest a secure algorithm and performant algorithm, prioritizing security.
+     * security.
+     *
+     * @returns A string indicating the recommended key derivation algorithm (e.g., 'PBKDF2', 'Argon2').
+     *
+     * @example
+     * ```typescript
+     * const algorithm = Keys.getRecommendedAlgorithm();
+     * console.log(algorithm); // Outputs: 'Argon2'
+     * ```
+     *
+     * @remarks
+     * - The recommendation is based on factors like CPU architecture, memory availability, and cryptographic library support.
+     * - The recommended algorithm may differ across environments (e.g., browser vs. server).
+     *
+     * @public
+     */
+    static getRecommendedAlgorithm() {
+        return keysCore.OptimizedKeys.getInstance().getRecommendedAlgorithm();
+    }
+}
+
+exports.Keys = Keys;
+//# sourceMappingURL=keys.js.map

package/dist/cjs/mods/security/src/core/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sources":["../../../../../../mods/security/src/core/keys.ts"],"sourcesContent":[null],"names":["OptimizedKeys"],"mappings":";;;;;;;;;AAAA;;;;;;;;;;;;AAYG;AAKH;;;;;;;;;;;;;;;;AAgBG;MACU,IAAI,CAAA;AACb;;;;;;;;;;;;;;;;;;;;;;AAsBG;AACI,IAAA,OAAO,SAAS,CACnB,KAA0B,EAC1B,UAAgC,EAAE,EAAA;QAElC,OAAOA,sBAAa,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;KAChE;AAED;;;;;;;;;;;;;;;;;;AAkBG;AACI,IAAA,OAAO,UAAU,GAAA;AACpB,QAAA,OAAOA,sBAAa,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,CAAC;KACnD;AAED;;;;;;;;;;;;;;;;;;AAkBG;AACI,IAAA,OAAO,kBAAkB,GAAA;AAC5B,QAAA,OAAOA,sBAAa,CAAC,WAAW,EAAE,CAAC,kBAAkB,EAAE,CAAC;KAC3D;AAED;;;;;;;;;;;;;;;;;;AAkBG;AACI,IAAA,OAAO,uBAAuB,GAAA;AACjC,QAAA,OAAOA,sBAAa,CAAC,WAAW,EAAE,CAAC,uBAAuB,EAAE,CAAC;KAChE;AACJ;;;;"}

package/dist/cjs/mods/security/src/core/password/index.js

@@ -0,0 +1,122 @@
+'use strict';
+
+var passwordCore = require('./password-core.js');
+require('../random/random-types.js');
+require('../random/random-sources.js');
+require('crypto');
+require('nehonix-uri-processor');
+require('../../utils/memory/index.js');
+require('../../types.js');
+var passwordTypes = require('./password-types.js');
+require('../hash/hash-core.js');
+require('../hash/hash-types.js');
+require('../hash/hash-security.js');
+require('../hash/hash-advanced.js');
+require('../../algorithms/hash-algorithms.js');
+require('argon2');
+require('child_process');
+require('../../types/secure-memory.js');
+require('https');
+require('../../components/runtime-verification.js');
+require('../../components/tamper-evident-logging.js');
+
+/* ---------------------------------------------------------------------------------------------
+ *  Copyright (c) NEHONIX INC. All rights reserved.
+ *  Licensed under the MIT License. See LICENSE in the project root for license information.
+ * -------------------------------------------------------------------------------------------
+ */
+/**
+ * XyPrissSecurity Password Management Module => FPMM
+ *
+ * Modular, military-grade password management system
+ *
+ * @example
+ * ```typescript
+ * import { PasswordManager } from "xypriss-security/core/password";
+ *
+ * // Create password manager instance
+ * const pm = PasswordManager.getInstance();
+ *
+ * // Hash a password
+ * const hash = await pm.hash("mySecurePassword123!");
+ *
+ * // Verify a password
+ * const result = await pm.verify("mySecurePassword123!", hash);
+ * console.log(result.isValid); // true
+ *
+ * // Generate secure password
+ * const generated = pm.generatePassword({ length: 16, minStrengthScore: 90 });
+ * console.log(generated.password);
+ *
+ * // Migrate from bcrypt
+ * const migration = await pm.migrate("password", bcryptHash);
+ * if (migration.migrated) {
+ *     console.log("Successfully migrated to XyPrissSecurity!");
+ * }
+ * ```
+ */
+passwordCore.PasswordManager.getInstance();
+/**
+ * Get default password policy
+ */
+function getDefaultPasswordPolicy() {
+    return {
+        minLength: 8,
+        maxLength: 128,
+        requireUppercase: true,
+        requireLowercase: true,
+        requireNumbers: true,
+        requireSymbols: true,
+        minStrengthScore: 70,
+        forbiddenPatterns: [
+            /^[0-9]+$/, // All numbers
+            /^[a-zA-Z]+$/, // All letters
+            /^(.)\1{2,}$/, // Repeated characters
+            /^(qwerty|asdfgh|zxcvbn)/i, // Keyboard patterns
+            /^(password|admin|user)/i, // Common words
+        ],
+        forbiddenWords: [
+            "password",
+            "admin",
+            "user",
+            "login",
+            "welcome",
+            "123456",
+            "qwerty",
+            "abc123",
+            "password123",
+        ],
+    };
+}
+/**
+ * Get recommended security configuration
+ */
+function getRecommendedConfig() {
+    return {
+        defaultAlgorithm: "argon2id",
+        defaultSecurityLevel: "high",
+        timingSafeVerification: true,
+        secureMemoryWipe: true,
+        enableMigration: true,
+        policy: getDefaultPasswordPolicy(),
+    };
+}
+// ===== DEFAULT INSTANCE =====
+/**
+ * Default password manager instance
+ * Ready to use out of the box
+ */
+passwordCore.PasswordManager.getInstance(getRecommendedConfig());
+
+exports.PasswordManager = passwordCore.PasswordManager;
+Object.defineProperty(exports, 'PasswordAlgorithm', {
+    enumerable: true,
+    get: function () { return passwordTypes.PasswordAlgorithm; }
+});
+Object.defineProperty(exports, 'PasswordSecurityLevel', {
+    enumerable: true,
+    get: function () { return passwordTypes.PasswordSecurityLevel; }
+});
+exports.getDefaultPasswordPolicy = getDefaultPasswordPolicy;
+exports.getRecommendedConfig = getRecommendedConfig;
+//# sourceMappingURL=index.js.map

package/dist/cjs/mods/security/src/core/password/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../../../../../../mods/security/src/core/password/index.ts"],"sourcesContent":[null],"names":["PasswordManager"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;;;;AAIG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BG;AAgBeA,4BAAe,CAAC,WAAW,GAAG;AAyFhD;;AAEG;SACa,wBAAwB,GAAA;IACpC,OAAO;AACH,QAAA,SAAS,EAAE,CAAC;AACZ,QAAA,SAAS,EAAE,GAAG;AACd,QAAA,gBAAgB,EAAE,IAAI;AACtB,QAAA,gBAAgB,EAAE,IAAI;AACtB,QAAA,cAAc,EAAE,IAAI;AACpB,QAAA,cAAc,EAAE,IAAI;AACpB,QAAA,gBAAgB,EAAE,EAAE;AACpB,QAAA,iBAAiB,EAAE;AACf,YAAA,UAAU;AACV,YAAA,aAAa;AACb,YAAA,aAAa;AACb,YAAA,0BAA0B;AAC1B,YAAA,yBAAyB;AAC5B,SAAA;AACD,QAAA,cAAc,EAAE;YACZ,UAAU;YACV,OAAO;YACP,MAAM;YACN,OAAO;YACP,SAAS;YACT,QAAQ;YACR,QAAQ;YACR,QAAQ;YACR,aAAa;AAChB,SAAA;KACJ,CAAC;AACN,CAAC;AAED;;AAEG;SACa,oBAAoB,GAAA;IAChC,OAAO;AACH,QAAA,gBAAgB,EAAE,UAAiB;AACnC,QAAA,oBAAoB,EAAE,MAAa;AACnC,QAAA,sBAAsB,EAAE,IAAI;AAC5B,QAAA,gBAAgB,EAAE,IAAI;AACtB,QAAA,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE,wBAAwB,EAAE;KACrC,CAAC;AACN,CAAC;AA8HD;AAEA;;;AAGG;AACmCA,4BAAe,CAAC,WAAW,CAC7D,oBAAoB,EAAE;;;;;;;;;;;;;;"}

package/dist/cjs/mods/security/src/core/password/password-algorithms.js

@@ -0,0 +1,397 @@
+'use strict';
+
+var hashCore = require('../hash/hash-core.js');
+var hashTypes = require('../hash/hash-types.js');
+require('crypto');
+require('../hash/hash-security.js');
+require('../hash/hash-advanced.js');
+require('../../algorithms/hash-algorithms.js');
+var randomCore = require('../random/random-core.js');
+require('../random/random-types.js');
+require('../random/random-sources.js');
+require('nehonix-uri-processor');
+require('../../utils/memory/index.js');
+var types = require('../../types.js');
+var sideChannel = require('../../components/side-channel.js');
+require('argon2');
+require('child_process');
+require('../../types/secure-memory.js');
+require('https');
+require('../../components/runtime-verification.js');
+require('../../components/tamper-evident-logging.js');
+var passwordTypes = require('./password-types.js');
+
+/**
+ * 🔐 Password Algorithms Module
+ *
+ * Implements various password hashing algorithms with security optimizations
+ */
+/**
+ * Password hashing algorithms implementation
+ */
+class PasswordAlgorithms {
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Update configuration
+     */
+    updateConfig(config) {
+        this.config = config;
+    }
+    /**
+     * Hash password using specified algorithm
+     */
+    async hash(password, salt, options) {
+        switch (options.algorithm) {
+            case passwordTypes.PasswordAlgorithm.ARGON2ID:
+                return this.hashWithArgon2(password, salt, options, "id");
+            case passwordTypes.PasswordAlgorithm.ARGON2I:
+                return this.hashWithArgon2(password, salt, options, "i");
+            case passwordTypes.PasswordAlgorithm.ARGON2D:
+                return this.hashWithArgon2(password, salt, options, "d");
+            case passwordTypes.PasswordAlgorithm.SCRYPT:
+                return this.hashWithScrypt(password, salt, options);
+            case passwordTypes.PasswordAlgorithm.PBKDF2_SHA512:
+                return this.hashWithPBKDF2(password, salt, options);
+            case passwordTypes.PasswordAlgorithm.BCRYPT_PLUS:
+                return this.hashWithBcryptPlus(password, salt, options);
+            case passwordTypes.PasswordAlgorithm.MILITARY:
+                return this.hashWithMilitary(password, salt, options);
+            default:
+                throw new Error(`Unsupported algorithm: ${options.algorithm}`);
+        }
+    }
+    /**
+     * Verify password using specified algorithm
+     */
+    async verify(password, hash, salt, metadata) {
+        const options = {
+            algorithm: metadata.algorithm,
+            securityLevel: metadata.securityLevel,
+            iterations: metadata.iterations,
+            memorySize: metadata.memorySize,
+            parallelism: metadata.parallelism,
+            saltLength: metadata.saltLength,
+        };
+        const computedHash = await this.hash(password, salt, options);
+        // Use constant-time comparison to prevent timing attacks
+        return sideChannel.constantTimeEqual(hash, computedHash);
+    }
+    /**
+     * Hash with Argon2 (recommended)
+     */
+    async hashWithArgon2(password, salt, options, variant) {
+        // Try to use native Argon2 implementation
+        try {
+            const argon2 = await import('argon2').catch(() => null);
+            if (argon2) {
+                const argon2Options = {
+                    type: variant === "i"
+                        ? argon2.argon2i
+                        : variant === "d"
+                            ? argon2.argon2d
+                            : argon2.argon2id,
+                    memoryCost: options.memorySize || 65536,
+                    timeCost: Math.floor((options.iterations || 100000) / 1000),
+                    parallelism: options.parallelism || 4,
+                    salt: Buffer.from(salt),
+                    hashLength: 32,
+                };
+                const fullHash = await argon2.hash(password, argon2Options);
+                // Extract just the hash part from the full Argon2 format
+                return this.extractHashValue(fullHash);
+            }
+        }
+        catch (error) {
+            // Fall back to custom implementation
+        }
+        // Fallback: Use PBKDF2 with enhanced security
+        return this.hashWithEnhancedPBKDF2(password, salt, options, `argon2${variant}-fallback`);
+    }
+    /**
+     * Hash with scrypt
+     */
+    async hashWithScrypt(password, salt, options) {
+        try {
+            // Use Node.js built-in crypto.scrypt
+            const crypto = await import('crypto');
+            const scryptOptions = {
+                N: Math.pow(2, 14), // CPU/memory cost (16384 - more reasonable)
+                r: 8, // Block size
+                p: options.parallelism || 1,
+            };
+            // Use promisified scrypt
+            const result = await new Promise((resolve, reject) => {
+                crypto.scrypt(password, Buffer.from(salt), 32, scryptOptions, (err, derivedKey) => {
+                    if (err)
+                        reject(err);
+                    else
+                        resolve(derivedKey);
+                });
+            });
+            return result.toString("hex");
+        }
+        catch (error) {
+            // Fall back to enhanced PBKDF2
+        }
+        return this.hashWithEnhancedPBKDF2(password, salt, options, "scrypt-fallback");
+    }
+    /**
+     * Hash with PBKDF2-SHA512
+     */
+    async hashWithPBKDF2(password, salt, options) {
+        const iterations = options.iterations || 100000;
+        // Use XyPrissSecurity Hash module for PBKDF2
+        const hash = hashCore.Hash.createSecureHash(password, salt, {
+            algorithm: types.HashAlgorithm.PBKDF2,
+            iterations,
+            outputFormat: "hex",
+            strength: hashTypes.HashStrength.MILITARY,
+            memoryHard: false, // Explicitly disable memory-hard hashing
+            quantumResistant: false, // Explicitly disable quantum-resistant hashing
+            timingSafe: false, // Explicitly disable timing-safe hashing
+        });
+        // Extract just the hash part using our helper method
+        return this.extractHashValue(hash);
+    }
+    /**
+     * Enhanced PBKDF2 with multiple rounds and algorithms
+     */
+    async hashWithEnhancedPBKDF2(password, salt, options, prefix = "enhanced") {
+        const iterations = options.iterations || 100000;
+        // First round: PBKDF2-SHA512
+        let round1 = hashCore.Hash.createSecureHash(password, salt, {
+            algorithm: types.HashAlgorithm.PBKDF2,
+            iterations: Math.floor(iterations / 3),
+            outputFormat: "hex",
+            memoryHard: false,
+            quantumResistant: false,
+            timingSafe: false,
+        });
+        // Extract just the hash using our helper method
+        round1 = this.extractHashValue(round1);
+        // Second round: SHA3-512
+        let round2 = hashCore.Hash.createSecureHash(round1, salt, {
+            algorithm: types.HashAlgorithm.SHA3_512,
+            iterations: Math.floor(iterations / 3),
+            outputFormat: "hex",
+            memoryHard: false,
+            quantumResistant: false,
+            timingSafe: false,
+        });
+        // Extract just the hash using our helper method
+        round2 = this.extractHashValue(round2);
+        // Third round: BLAKE3
+        let finalHash = hashCore.Hash.createSecureHash(round2, salt, {
+            algorithm: types.HashAlgorithm.BLAKE3,
+            iterations: Math.floor(iterations / 3),
+            outputFormat: "hex",
+            memoryHard: false,
+            quantumResistant: false,
+            timingSafe: false,
+        });
+        // Extract just the hash using our helper method
+        finalHash = this.extractHashValue(finalHash);
+        return `${prefix}:${finalHash}`;
+    }
+    /**
+     * Enhanced bcrypt with additional security layers
+     */
+    async hashWithBcryptPlus(password, salt, options) {
+        try {
+            const bcrypt = await import('bcrypt').catch(() => null);
+            if (bcrypt) {
+                // First layer: Standard bcrypt
+                const rounds = Math.min(15, Math.max(10, Math.floor((options.iterations || 100000) / 10000)));
+                const bcryptHash = await bcrypt.hash(password, rounds);
+                // Second layer: PBKDF2 on bcrypt result
+                let enhancedHash = hashCore.Hash.createSecureHash(bcryptHash, salt, {
+                    algorithm: types.HashAlgorithm.PBKDF2,
+                    iterations: 50000,
+                    outputFormat: "hex",
+                    memoryHard: false,
+                    quantumResistant: false,
+                    timingSafe: false,
+                });
+                // Extract just the hash using our helper method
+                enhancedHash = this.extractHashValue(enhancedHash);
+                return `bcrypt-plus:${enhancedHash}`;
+            }
+        }
+        catch (error) {
+            // Fall back to enhanced PBKDF2
+        }
+        return this.hashWithEnhancedPBKDF2(password, salt, options, "bcrypt-plus-fallback");
+    }
+    /**
+     * Military-grade multi-layer hashing
+     */
+    async hashWithMilitary(password, salt, options) {
+        const iterations = options.iterations || 200000;
+        // Layer 1: Key stretching with PBKDF2-SHA512
+        let layer1 = hashCore.Hash.createSecureHash(password, salt, {
+            algorithm: types.HashAlgorithm.PBKDF2,
+            iterations: Math.floor(iterations / 4),
+            outputFormat: "hex",
+            memoryHard: false,
+            quantumResistant: false,
+            timingSafe: false,
+        });
+        // Extract just the hash using our helper method
+        layer1 = this.extractHashValue(layer1);
+        // Layer 2: Memory-hard function simulation
+        let layer2 = layer1;
+        for (let i = 0; i < 1000; i++) {
+            const tempSalt = randomCore.SecureRandom.generateSalt(32);
+            let tempHash = hashCore.Hash.createSecureHash(layer2, tempSalt, {
+                algorithm: types.HashAlgorithm.SHA3_512,
+                outputFormat: "hex",
+                memoryHard: false,
+                quantumResistant: false,
+                timingSafe: false,
+            });
+            // Extract just the hash using our helper method
+            layer2 = this.extractHashValue(tempHash);
+        }
+        // Layer 3: BLAKE3 with high iterations
+        let layer3 = hashCore.Hash.createSecureHash(layer2, salt, {
+            algorithm: types.HashAlgorithm.BLAKE3,
+            iterations: Math.floor(iterations / 4),
+            outputFormat: "hex",
+            memoryHard: false,
+            quantumResistant: false,
+            timingSafe: false,
+        });
+        // Extract just the hash using our helper method
+        layer3 = this.extractHashValue(layer3);
+        // Layer 4: Final hardening with SHA3-512
+        let finalHash = hashCore.Hash.createSecureHash(layer3, salt, {
+            algorithm: types.HashAlgorithm.SHA3_512,
+            iterations: Math.floor(iterations / 4),
+            outputFormat: "hex",
+            strength: hashTypes.HashStrength.MILITARY,
+            memoryHard: false,
+            quantumResistant: false,
+            timingSafe: false,
+        });
+        // Extract just the hash using our helper method
+        finalHash = this.extractHashValue(finalHash);
+        return `military:${finalHash}`;
+    }
+    // ===== PRIVATE HELPER METHODS =====
+    /**
+     * Extract just the hash value from complex hash formats
+     */
+    extractHashValue(hashResult) {
+        // Handle Argon2 format: $argon2id$v=19$m=65536,t=3,p=4$salt$hash
+        if (hashResult.startsWith("$argon2")) {
+            const parts = hashResult.split("$");
+            if (parts.length >= 6) {
+                return parts[5]; // The actual hash is the last part
+            }
+        }
+        // Handle PBKDF2 format: $pbkdf2$rounds$salt$hash
+        if (hashResult.startsWith("$pbkdf2")) {
+            const parts = hashResult.split("$");
+            if (parts.length >= 5) {
+                return parts[4]; // The actual hash
+            }
+        }
+        // Handle bcrypt format: $2b$rounds$salthash (extract hash part)
+        if (hashResult.startsWith("$2")) {
+            const parts = hashResult.split("$");
+            if (parts.length >= 4) {
+                const saltAndHash = parts[3];
+                if (saltAndHash.length > 22) {
+                    return saltAndHash.substring(22); // bcrypt hash after 22-char salt
+                }
+            }
+        }
+        // Handle scrypt format: $scrypt$N$r$p$salt$hash
+        if (hashResult.startsWith("$scrypt")) {
+            const parts = hashResult.split("$");
+            if (parts.length >= 7) {
+                return parts[6]; // The actual hash
+            }
+        }
+        // Handle any other $ delimited format - take the last part
+        if (hashResult.includes("$")) {
+            const parts = hashResult.split("$");
+            return parts[parts.length - 1];
+        }
+        // If no special format, return as-is
+        return hashResult;
+    }
+    /**
+     * Get algorithm-specific default options
+     */
+    getAlgorithmDefaults(algorithm) {
+        switch (algorithm) {
+            case passwordTypes.PasswordAlgorithm.ARGON2ID:
+            case passwordTypes.PasswordAlgorithm.ARGON2I:
+            case passwordTypes.PasswordAlgorithm.ARGON2D:
+                return {
+                    iterations: 3,
+                    memorySize: 65536, // 64MB
+                    parallelism: 4,
+                    saltLength: 32,
+                };
+            case passwordTypes.PasswordAlgorithm.SCRYPT:
+                return {
+                    iterations: 32768, // N parameter
+                    memorySize: 8, // r parameter
+                    parallelism: 1, // p parameter
+                    saltLength: 32,
+                };
+            case passwordTypes.PasswordAlgorithm.PBKDF2_SHA512:
+                return {
+                    iterations: 100000,
+                    saltLength: 32,
+                };
+            case passwordTypes.PasswordAlgorithm.BCRYPT_PLUS:
+                return {
+                    iterations: 120000, // Equivalent to bcrypt rounds + PBKDF2
+                    saltLength: 32,
+                };
+            case passwordTypes.PasswordAlgorithm.MILITARY:
+                return {
+                    iterations: 200000,
+                    memorySize: 131072, // 128MB equivalent
+                    parallelism: 8,
+                    saltLength: 64,
+                };
+            default:
+                return {
+                    iterations: 100000,
+                    saltLength: 32,
+                };
+        }
+    }
+    /**
+     * Estimate hashing time for algorithm
+     */
+    estimateHashingTime(algorithm, options) {
+        // Rough estimates in milliseconds
+        switch (algorithm) {
+            case passwordTypes.PasswordAlgorithm.ARGON2ID:
+            case passwordTypes.PasswordAlgorithm.ARGON2I:
+            case passwordTypes.PasswordAlgorithm.ARGON2D:
+                return ((options.memorySize || 65536) / 1000 +
+                    (options.iterations || 3) * 100);
+            case passwordTypes.PasswordAlgorithm.SCRYPT:
+                return (options.iterations || 32768) / 100;
+            case passwordTypes.PasswordAlgorithm.PBKDF2_SHA512:
+                return (options.iterations || 100000) / 1000;
+            case passwordTypes.PasswordAlgorithm.BCRYPT_PLUS:
+                return (options.iterations || 120000) / 500;
+            case passwordTypes.PasswordAlgorithm.MILITARY:
+                return (options.iterations || 200000) / 200;
+            default:
+                return 100; // Default estimate
+        }
+    }
+}
+
+exports.PasswordAlgorithms = PasswordAlgorithms;
+//# sourceMappingURL=password-algorithms.js.map