/**
 * Security Hardening Module
 *
 * Comprehensive security controls for CAR specification compliance.
 * Implements critical security hardening requirements including:
 *
 * - DPoP (Demonstrating Proof-of-Possession) - RFC 9449
 * - TEE (Trusted Execution Environment) binding
 * - Pairwise DID generation for privacy
 * - Revocation management with SLA enforcement
 * - Token lifetime validation
 * - Token introspection (RFC 7662)
 *
 * Security Conformance Levels:
 * - SH-1 (Basic): DPoP required, short-lived tokens (T2)
 * - SH-2 (Standard): SH-1 + pairwise DIDs, recursive revocation (T3)
 * - SH-3 (Hardened): SH-2 + TEE binding, sync revocation checks (T4-T5)
 *
 * @packageDocumentation
 * @module security
 */
export { TrustTier, trustTierSchema, SecurityConformanceLevel, securityConformanceLevelSchema, type DPoPProof, type DPoPHeader, type DPoPConfig, type DPoPVerificationResult, dpopProofSchema, dpopHeaderSchema, dpopConfigSchema, dpopVerificationResultSchema, TEEPlatform, type TEEAttestation, type TEEKeyBinding, type TEEConfig, type TEEVerificationResult, teePlatformSchema, teeAttestationSchema, teeKeyBindingSchema, teeConfigSchema, teeVerificationResultSchema, DataClassification, PairwiseDerivationAlgorithm, type PairwiseDIDConfig, type PairwiseDerivation, dataClassificationSchema, pairwiseDerivationAlgorithmSchema, pairwiseDIDConfigSchema, pairwiseDerivationSchema, RevocationStatusEnum, type RevocationSLA, type RevocationPropagationPolicy, type RevocationPropagation, type RevocationResult, type RevocationStatus, type RevocationEvent, DEFAULT_REVOCATION_SLAS, revocationSLASchema, revocationPropagationPolicySchema, revocationPropagationSchema, revocationResultSchema, revocationStatusSchema, revocationEventSchema, type TokenLifetimeConfig, DEFAULT_TOKEN_LIFETIME_CONFIG, tokenLifetimeConfigSchema, type IntrospectionResult, introspectionResultSchema, type AgentIdentity, type ActionRequest, type SecurityContext, type SecurityValidationResult, type SecurityValidationError, type PreRequestResult, type HighValueCheckResult, type SecurityRequirements, type IncomingRequest, type JTICache, type SecurityPluginOptions, agentIdentitySchema, actionRequestSchema, securityContextSchema, securityValidationResultSchema, securityValidationErrorSchema, preRequestResultSchema, highValueCheckResultSchema, securityRequirementsSchema, incomingRequestSchema, securityPluginOptionsSchema, getSecurityRequirementsForTier, } from './types.js';
export { DPoPService, DPoPError, createDPoPService, } from './dpop.js';
export { TEEBindingService, TEEError, TEEAttestationError, TEEKeyBindingError, createTEEBindingService, } from './tee.js';
export { ProductionAttestationVerifier, createProductionVerifier, verifySGXProduction, verifyNitroProduction, verifySEVProduction, type ProductionAttestationConfig, } from './tee-production.js';
export { PairwiseDIDService, PairwiseDIDError, createPairwiseDIDService, } from './pairwise-did.js';
export { RevocationService, RevocationError, AgentRevokedError, createRevocationService, type RevocationEventCallback, type DelegationRegistry, type TokenService, type WebhookService, } from './revocation.js';
export { TokenLifetimeService, TokenLifetimeError, TokenExpiredError, TokenTTLTooLongError, createTokenLifetimeService, type TokenType, type JWTPayload, type TokenLifetimeValidationResult, HIGH_VALUE_OPERATIONS, type HighValueOperation, } from './token-lifetime.js';
export { TokenIntrospectionService, IntrospectionError, TokenInactiveError, createTokenIntrospectionService, createMockIntrospectionService, type IntrospectionServiceOptions, } from './introspection.js';
export { SecurityService, SecurityValidationError as SecurityServiceValidationError, createSecurityService, } from './security-service.js';
export { PKCEService, PKCEError, createPKCEService, generateCodeVerifier, calculateCodeChallenge, isValidCodeVerifier, CODE_VERIFIER_MIN_LENGTH, CODE_VERIFIER_MAX_LENGTH, PKCEChallengeMethod, type PKCEPair, type PKCEVerificationResult, type PKCEChallengeState, type PKCEConfig, type PKCEChallengeStore, pkcePairSchema, pkceVerificationResultSchema, pkceChallengeStateSchema, pkceConfigSchema, pkceChallengeMethodSchema, } from './pkce.js';
export { dpopMiddleware, introspectionMiddleware, revocationMiddleware, securityContextMiddleware, markHighValueOperation, requireTier, requireDPoP, securityHardeningPlugin, type FastifyMiddleware, type SecurityRequestContext, } from './middleware.js';
export { type SecurityCheck, type SecurityCheckResult, type SecurityCheckCategory, type SecurityCheckSeverity, runSecurityAudit, assertSecureConfig, getSecurityAuditSummary, calculateEntropy, } from './config-validator.js';
export { getSecurityMode, getSecurityConfig, isProductionGrade, isDevelopmentMode, requireProductionSecurity, assertSecurityCondition, isSecurityFeatureAllowed, devOnlyDefault, allowEphemeralKey, validateSecretStrength, type SecurityMode, type SecurityModeConfig, } from '../common/security-mode.js';
export { SessionStore, getSessionStore, createSessionStore, type Session, type CreateSessionInput, type SessionStoreConfig, } from './session-store.js';
export { SessionManager, getSessionManager, createSessionManager, extractFingerprintHeaders, type SessionManagerConfig, type SessionValidationResult, type SensitiveOperation, type RegenerateSessionOptions, type RequestHeaders as SessionRequestHeaders, type FingerprintValidationResult as SessionFingerprintValidationResult, } from './session-manager.js';
export { CSRFProtection, getCSRFProtection, resetCSRFProtection, type CSRFConfig, type CSRFCookieOptions, type TokenValidationResult, } from './csrf.js';
export { FingerprintService, getFingerprintService, resetFingerprintService, type FingerprintConfig, type FingerprintResult, type FingerprintValidationResult, type RequestHeaders, } from './fingerprint-service.js';
export { InjectionDetector, createInjectionDetectionMiddleware, InjectionType, hasInjection, sanitizeInput, type InjectionDetectorConfig, type InjectionDetectionResult, } from './injection-detector.js';
export { BruteForceProtection, getBruteForceProtection, resetBruteForceProtection, createBruteForceMiddleware, type BruteForceConfig, type LoginAttempt, type LockoutStatus, } from './brute-force.js';
export { PasswordPolicyEngine, getPasswordPolicyEngine, resetPasswordPolicyEngine, DEFAULT_PASSWORD_POLICY, NIST_PASSWORD_POLICY, type PasswordPolicy, type PasswordValidationResult, } from './password-policy.js';
export { KeyRotationManager, getKeyRotationManager, resetKeyRotationManager, type KeyType, type KeyMetadata, type KeyRotationConfig, type StoredKey, type RotationStatus, } from './key-rotation.js';
export { MfaMethod, MfaStatus, MFA_DEFAULTS, type MfaServiceConfig, type MfaMiddlewareOptions, type MfaEnrollmentResponse, type MfaEnrollmentCompleteResponse, type MfaStatusResponse, type MfaChallengeResponse, type MfaVerifyResponse, type MfaBackupCodesResponse, type UserMfaRecord, type MfaBackupCodeRecord, type MfaChallengeRecord, type MfaRequestContext, MfaService, getMfaService, resetMfaService, createMfaService, MfaError, EnrollmentExpiredError, ChallengeExpiredError, TooManyAttemptsError, MfaStore, getMfaStore, resetMfaStore, createMfaStore, requireMfa, mfaContextMiddleware, requireMfaEnabled, mfaMethodSchema, mfaStatusSchema, mfaEnrollmentResponseSchema, mfaEnrollmentCompleteResponseSchema, mfaStatusResponseSchema, mfaChallengeResponseSchema, mfaVerifyResponseSchema, mfaBackupCodesResponseSchema, mfaServiceConfigSchema, } from './mfa/index.js';
export { RequestIntegrity, getRequestIntegrity, resetRequestIntegrity, createSignatureHeaders, extractSignatureFromHeaders, INTEGRITY_HEADERS, DEFAULT_REQUEST_INTEGRITY_CONFIG, type SignedRequest, type RequestIntegrityConfig, type IntegrityVerificationResult, type IntegrityErrorCode, type SignRequestInput, } from './request-integrity.js';
export { SecureString, SecureBuffer, secureEnv, requireSecureEnv, secureRandomBytes, secureCompare, secureCompareBuffers, withSecureString, withSecureStringAsync, withSecureBuffer, withSecureBufferAsync, SecureMemoryError, MissingEnvironmentError, } from './secure-memory.js';
export { ErrorSanitizer, getErrorSanitizer, resetErrorSanitizer, createErrorSanitizer, createErrorHandler, errorSanitizerPlugin, sanitizeErrorMessage, classifyError, generateSafeMessage, SENSITIVE_PATTERNS, DEFAULT_ERROR_MAPPINGS, type SanitizedError, type ErrorClassification, type ErrorSanitizerConfig, type ErrorCodeMapping, type ErrorHandlerOptions, } from './error-sanitizer.js';
export { ApiKeyScope, apiKeyScopeSchema, API_KEY_SCOPES, ApiKeyStatus, apiKeyStatusSchema, type ApiKeyRateLimit, apiKeyRateLimitSchema, DEFAULT_API_KEY_RATE_LIMIT, type ApiKey, apiKeySchema, type CreateApiKeyInput, createApiKeyInputSchema, type UpdateApiKeyInput, updateApiKeyInputSchema, type ApiKeyValidationResult, ApiKeyValidationErrorCode, apiKeyValidationResultSchema, type ApiKeyRateLimitState, type ApiKeyRateLimitResult, type ApiKeyCreationResult, type ApiKeyListFilters, apiKeyListFiltersSchema, ApiKeyAuditEventType, type ApiKeyContext, API_KEY_PREFIX, API_KEY_PREFIX_LENGTH, API_KEY_SECRET_LENGTH, API_KEY_PATTERN, type IApiKeyStore, InMemoryApiKeyStore, getApiKeyStore, createApiKeyStore, resetApiKeyStore, ApiKeyService, ApiKeyError, ApiKeyValidationError, ApiKeyRateLimitError, type ApiKeyServiceDependencies, type IAuditLogger as IApiKeyAuditLogger, getApiKeyService, createApiKeyService, resetApiKeyService, apiKeyMiddleware, requireScopes, requireReadScope, requireWriteScope, requireAdminScope, requireWebhookScope, requireIntegrationScope, apiKeyPlugin, getApiKey, getApiKeyTenantId, hasApiKey, getApiKeyScopes, type ApiKeyMiddlewareOptions, type ScopeRequirementOptions, type ApiKeyPluginOptions, type ApiKeyFastifyMiddleware, } from './api-keys/index.js';
export { type CSPSourceValue, type CSPSandboxValue, type CSPDirectives, type CSPReportingConfig, type HSTSConfig, type CORSConfig, type PermissionsPolicyValue, type PermissionsPolicyConfig, type COEPValue, type COOPValue, type CORPValue, type ReferrerPolicyValue, type XFrameOptionsValue, type SecurityHeadersConfig, type ValidationSeverity, type ValidationIssue, type HeaderValidationResult, type CSPViolationReport, type CSPPreset, type CSPValidationError, type CSPBuildResult, type HSTSValidationResult, type HSTSValidationIssue, type FeaturePermission, type PermissionsPolicyIssue, type PermissionsPolicyValidationResult, type SecurityHeadersMiddlewareOptions, type SecurityHeadersContext, cspSourceValueSchema, cspSandboxValueSchema, cspDirectivesSchema, cspReportingConfigSchema, hstsConfigSchema, HSTS_MIN_MAX_AGE_FOR_PRELOAD, HSTS_RECOMMENDED_MAX_AGE, corsConfigSchema, permissionsPolicyValueSchema, permissionsPolicyConfigSchema, securityHeadersConfigSchema, validationIssueSchema, headerValidationResultSchema, cspViolationReportSchema, CSPBuilder, generateNonce, formatNonce, STRICT_CSP_PRESET, MODERATE_CSP_PRESET, RELAXED_CSP_PRESET, API_CSP_PRESET, getCSPPreset, createStrictCSP, createModerateCSP, createAPICSP, createDevelopmentCSP, buildCSPString, parseCSPString, HSTSManager, HSTS_HEADER_NAME, HSTS_MIN_RECOMMENDED_MAX_AGE, HSTS_MAX_SENSIBLE_MAX_AGE, createProductionHSTS, createPreloadHSTS, createDevelopmentHSTS, createHSTS, buildHSTSHeader, parseHSTSHeader, validateHSTSHeader, PermissionsPolicyManager, PERMISSIONS_POLICY_HEADER, KNOWN_FEATURES, HIGH_RISK_FEATURES, SENSOR_FEATURES, STRICT_PERMISSIONS_PRESET, MODERATE_PERMISSIONS_PRESET, API_PERMISSIONS_PRESET, createStrictPermissionsPolicy, createModeratePermissionsPolicy, createAPIPermissionsPolicy, createPermissionsPolicy, buildPermissionsPolicyHeader, parsePermissionsPolicyHeader, getSecureDefault, validateSecurityHeaders, assertValidSecurityHeaders, getSecurityHeadersSummary, securityHeadersPlugin, createStrictSecurityHeaders, createAPISecurityHeaders, createDevelopmentSecurityHeaders, createSecurityHeaders, } from './headers/index.js';
export { RedisStateProvider, getRedisStateProvider, resetRedisStateProvider, createRedisStateProvider, type RedisStateConfig, type RedisHealthStatus, type IncrementResult, type InvalidationEvent, type InvalidationCallback, DEFAULT_REDIS_STATE_CONFIG, } from './distributed-state.js';
export { WebAuthnService, WebAuthnError, WebAuthnRegistrationError, WebAuthnAuthenticationError, getWebAuthnService, createWebAuthnService, resetWebAuthnService, type WebAuthnServiceDependencies, type IAuditLogger as IWebAuthnAuditLogger, type IWebAuthnStore, InMemoryWebAuthnStore, RedisWebAuthnStore, getWebAuthnStore, createWebAuthnStore, createRedisWebAuthnStore, resetWebAuthnStore, enableRedisWebAuthnStore, type WebAuthnCredential, type WebAuthnConfig, type ChallengeEntry, type RegistrationOptions, type AuthenticationOptions, type RegistrationResult, type AuthenticationResult, RegistrationErrorCode, AuthenticationErrorCode, WebAuthnAuditEventType, DEFAULT_WEBAUTHN_CONFIG, } from './webauthn/index.js';
export { RefreshTokenService, RefreshTokenError, TokenReuseError, RefreshTokenExpiredError, RefreshTokenRevokedError, RefreshTokenInvalidError, getRefreshTokenService, createRefreshTokenService, resetRefreshTokenService, type RefreshTokenData, type RefreshTokenPayload, type TokenFamily, type CreateRefreshTokenInput, type TokenRotationResult, type AccessTokenGenerator, type RefreshTokenServiceConfig, } from './refresh-token.js';
export { TokenLifecycleService, TokenLifecycleError, getTokenLifecycleService, createTokenLifecycleService, resetTokenLifecycleService, type RevocationReason, type RevocationTrigger, type BulkRevocationResult, type RevocationOptions, type TokenLifecycleConfig, type RevocationEvent as TokenRevocationEvent, } from './token-lifecycle.js';
export { RevocationCheckService, revocationCheckMiddleware, getRevocationCheckService, createRevocationCheckService, resetRevocationCheckService, type RevocationCheckOptions, type RevocationCheckResult, } from './revocation-check.js';
export { AlertSeverity, AlertChannel, SecurityEventType, ConditionOperator, type AlertContext, type SecurityAlert, type CreateAlertInput, type AlertCondition, type AlertThreshold, type ChannelConfig, type AlertRule, type MaintenanceWindow, type EscalationPolicy, type AlertConfig, type AlertEvent, type AlertEventCallback, type AlertDeliveryResult, alertSeveritySchema, alertChannelSchema, securityEventTypeSchema, conditionOperatorSchema, alertContextSchema, securityAlertSchema, createAlertInputSchema, alertConditionSchema, alertThresholdSchema, channelConfigSchema, alertRuleSchema, maintenanceWindowSchema, escalationPolicySchema, alertConfigSchema, alertDeliveryResultSchema, DEFAULT_ALERT_CONFIG, SecurityAlertDetector, getSecurityAlertDetector, resetSecurityAlertDetector, createSecurityAlertDetector, type DetectorSecurityEvent, type DetectionResult, type BuiltInDetectorConfig, type SecurityAlertDetectorOptions, DEFAULT_BUILTIN_DETECTOR_CONFIG, SecurityAlertService, getSecurityAlertService, resetSecurityAlertService, createSecurityAlertService, type SecurityAlertServiceOptions, SlackAlertChannel, createSlackChannel, type SlackChannelConfig, PagerDutyAlertChannel, createPagerDutyChannel, type PagerDutyChannelConfig, EmailAlertChannel, createEmailChannel, type EmailChannelConfig, WebhookAlertChannel, createWebhookChannel, createSignedWebhookChannel, type WebhookChannelConfig, SNSAlertChannel, createSNSChannel, type SNSChannelConfig, type AlertChannelInterface, SecurityAlerts, } from './alerting/index.js';
export { BotDetectionService, getBotDetectionService, resetBotDetectionService, botDetectionMiddleware, botDetectionPlugin, DEFAULT_BOT_DETECTION_CONFIG, type BotScore, type BotSignal, type BotSignalType, type BotRecommendation, type BotDetectionConfig, type BotDetectionMiddlewareOptions, type BotDetectionPluginOptions, } from './threat-intel/bot-detection.js';
export { DLPScanner, DataType, type RiskLevel, type ScanMode, type DLPFinding, type DLPScanResult, type DLPScannerConfig, dlpScannerConfigSchema, DEFAULT_DLP_CONFIG, DLPError, SensitiveDataBlockedError, DLPScanTimeoutError, dlpRequestScanner, dlpResponseScanner, type DLPRequestScannerOptions, type DLPResponseScannerOptions, dlpPlugin, type DLPPluginOptions, getDLPScanner, resetDLPScanner, createDLPScanner, } from './dlp/index.js';
export { ServiceAccountStatus, type ServiceAccount, serviceAccountSchema, type CreateServiceAccountInput, createServiceAccountInputSchema, type ServiceAccountCreationResult, type SecretRotationResult, type UpdateServiceAccountInput, updateServiceAccountInputSchema, ServiceAccountError, ServiceAccountNotFoundError, ServiceAccountRevokedError, ServiceAccountSuspendedError, SERVICE_CLIENT_ID_PREFIX, generateClientSecret, generateClientId, hashClientSecret, verifyClientSecret, type IServiceAccountStore, InMemoryServiceAccountStore, ServiceAccountManager, type ServiceAccountManagerConfig, getServiceAccountStore, setServiceAccountStore, getServiceAccountManager, createServiceAccountManager, resetServiceAccountSingletons, type ServiceTokenPayload, serviceTokenPayloadSchema, type ServiceSignature, serviceSignatureSchema, type TokenVerificationResult, tokenVerificationResultSchema, type SignatureVerificationResult, ServiceTokenError, TokenExpiredError as ServiceTokenExpiredError, InvalidSignatureError, SignatureTimestampError, DEFAULT_TOKEN_TTL_SECONDS, MAX_CLOCK_SKEW_SECONDS, MIN_TOKEN_TTL_SECONDS, MAX_TOKEN_TTL_SECONDS, SERVICE_TOKEN_ISSUER, SERVICE_AUTH_HEADERS, ServiceTokenService, type ServiceTokenServiceConfig, serviceTokenServiceConfigSchema, initializeServiceTokenService, getServiceTokenService, createServiceTokenService, resetServiceTokenService, createServiceAuthHeaders, extractServiceIdFromBearer, type ServiceAuthContext, type ServiceAuthenticatedRequest, type ServiceAuthMiddlewareOptions, ServiceAuthError, MissingAuthHeadersError, InvalidServiceSignatureError, IpNotAllowedError, InsufficientPermissionsError, createServiceAuthMiddleware, requireServicePermissions, requireAnyServicePermission, requireServiceTenant, getServiceAuth, requireServiceAuth, hasServiceAuth, getServiceClientId, getServiceTenantId, getServicePermissions, serviceHasPermission, serviceAuthPlugin, type ServiceAuthPluginOptions, } from './service-auth/index.js';
export { RBACService, createRBACService, getRBACService, resetRBACService, type RBACServiceOptions, type AccessCheckRequest, type AccessCheckResult, BuiltinRoles, type BuiltinRole, type RoleDefinition, type RoleAssignment, type RoleScope, type TimeRestriction, type AssignmentConditions, ROLE_PRIORITY, ROLE_MINIMUM_TRUST_TIER, getBuiltinRoles, getEffectivePermissions, roleInheritsFrom, compareRoles, getAncestorRoles, validateRoleHierarchy, meetsTrustRequirement, createRoleDefinition, createRoleAssignment, roleDefinitionSchema, roleAssignmentSchema, PermissionActions, ResourceTypes, PermissionCategories, type PermissionAction, type ResourceType, type PermissionCategory, type PermissionDefinition, type PermissionCheckRequest, type PermissionCheckResult, getBuiltinPermissions, parsePermission, buildPermission, permissionMatches, hasPermission, hasAllPermissions, hasAnyPermission, filterMatchingPermissions, isValidPermissionFormat, getPermissionsByCategory, getSensitivePermissions, getCompliancePermissions, createPermissionDefinition, permissionDefinitionSchema, permissionCheckRequestSchema, permissionCheckResultSchema, PolicyTypes, PolicyEffects, CombiningAlgorithms, type PolicyType, type PolicyEffect, type CombiningAlgorithm, type AccessPolicy, type PolicyTarget, type PolicyConditions, type PolicyEvaluationContext, type PolicyEvaluationResult, type EvaluatedPolicy, type PolicyEngineOptions, RBACPolicyEngine, createRBACPolicyEngine, createPolicyEvaluationContext, createAccessPolicy, accessPolicySchema, rbacMiddleware, rbacPlugin, type RBACMiddlewareOptions, type SecurityRBACRequestContext, requirePermissions, requireAnyPermission, requireRole, requireResourceAccess, requireTrustTier as requireRBACTrustTier, type PermissionRequirement, } from './rbac/index.js';
//# sourceMappingURL=index.d.ts.map