// SPDX-License-Identifier: Apache-2.0
// Copyright 2024-2026 Vorion LLC
/**
 * Security Hardening Module
 *
 * Comprehensive security controls for CAR ID specification compliance.
 * Implements critical security hardening requirements including:
 *
 * - DPoP (Demonstrating Proof-of-Possession) - RFC 9449
 * - TEE (Trusted Execution Environment) binding
 * - Pairwise DID generation for privacy
 * - Revocation management with SLA enforcement
 * - Token lifetime validation
 * - Token introspection (RFC 7662)
 *
 * Security Conformance Levels:
 * - SH-1 (Basic): DPoP required, short-lived tokens (T2)
 * - SH-2 (Standard): SH-1 + pairwise DIDs, recursive revocation (T3)
 * - SH-3 (Hardened): SH-2 + TEE binding, sync revocation checks (T4-T5)
 *
 * @packageDocumentation
 * @module security
 */
// =============================================================================
// Types
// =============================================================================
export { 
// Trust Tier
TrustTier, trustTierSchema, 
// Security Conformance
SecurityConformanceLevel, securityConformanceLevelSchema, dpopProofSchema, dpopHeaderSchema, dpopConfigSchema, dpopVerificationResultSchema, 
// TEE Types
TEEPlatform, teePlatformSchema, teeAttestationSchema, teeKeyBindingSchema, teeConfigSchema, teeVerificationResultSchema, 
// Pairwise DID Types
DataClassification, PairwiseDerivationAlgorithm, dataClassificationSchema, pairwiseDerivationAlgorithmSchema, pairwiseDIDConfigSchema, pairwiseDerivationSchema, 
// Revocation Types
RevocationStatusEnum, DEFAULT_REVOCATION_SLAS, revocationSLASchema, revocationPropagationPolicySchema, revocationPropagationSchema, revocationResultSchema, revocationStatusSchema, revocationEventSchema, DEFAULT_TOKEN_LIFETIME_CONFIG, tokenLifetimeConfigSchema, introspectionResultSchema, agentIdentitySchema, actionRequestSchema, securityContextSchema, securityValidationResultSchema, securityValidationErrorSchema, preRequestResultSchema, highValueCheckResultSchema, securityRequirementsSchema, incomingRequestSchema, securityPluginOptionsSchema, 
// Utility Functions
getSecurityRequirementsForTier, } from './types.js';
// =============================================================================
// DPoP Service
// =============================================================================
export { DPoPService, DPoPError, createDPoPService, } from './dpop.js';
// =============================================================================
// TEE Service
// =============================================================================
export { TEEBindingService, TEEError, TEEAttestationError, TEEKeyBindingError, createTEEBindingService, } from './tee.js';
// =============================================================================
// Pairwise DID Service
// =============================================================================
export { PairwiseDIDService, PairwiseDIDError, createPairwiseDIDService, } from './pairwise-did.js';
// =============================================================================
// Revocation Service
// =============================================================================
export { RevocationService, RevocationError, AgentRevokedError, createRevocationService, } from './revocation.js';
// =============================================================================
// Token Lifetime Service
// =============================================================================
export { TokenLifetimeService, TokenLifetimeError, TokenExpiredError, TokenTTLTooLongError, createTokenLifetimeService, HIGH_VALUE_OPERATIONS, } from './token-lifetime.js';
// =============================================================================
// Token Introspection Service
// =============================================================================
export { TokenIntrospectionService, IntrospectionError, TokenInactiveError, createTokenIntrospectionService, createMockIntrospectionService, } from './introspection.js';
// =============================================================================
// Security Service (Main Coordinator)
// =============================================================================
export { SecurityService, SecurityValidationError as SecurityServiceValidationError, createSecurityService, } from './security-service.js';
// =============================================================================
// Fastify Middleware
// =============================================================================
export { 
// Middleware factories
dpopMiddleware, introspectionMiddleware, revocationMiddleware, securityContextMiddleware, markHighValueOperation, requireTier, requireDPoP, 
// Fastify plugin
securityHardeningPlugin, } from './middleware.js';
// =============================================================================
// Security Configuration Validator
// =============================================================================
export { 
// Audit functions
runSecurityAudit, assertSecureConfig, getSecurityAuditSummary, 
// Utilities
calculateEntropy, } from './config-validator.js';
// =============================================================================
// Security Mode (New)
// =============================================================================
export { getSecurityMode, getSecurityConfig, isProductionGrade, isDevelopmentMode, requireProductionSecurity, assertSecurityCondition, isSecurityFeatureAllowed, devOnlyDefault, allowEphemeralKey, validateSecretStrength, } from '../common/security-mode.js';
// =============================================================================
// Session Management (New)
// =============================================================================
export { SessionStore, getSessionStore, createSessionStore, } from './session-store.js';
export { SessionManager, getSessionManager, createSessionManager, extractFingerprintHeaders, } from './session-manager.js';
// =============================================================================
// CSRF Protection (New)
// =============================================================================
export { CSRFProtection, getCSRFProtection, resetCSRFProtection, } from './csrf.js';
// =============================================================================
// Fingerprint Service (New)
// =============================================================================
export { FingerprintService, getFingerprintService, resetFingerprintService, } from './fingerprint-service.js';
// =============================================================================
// Injection Detection (New)
// =============================================================================
export { InjectionDetector, createInjectionDetectionMiddleware, InjectionType, hasInjection, sanitizeInput, } from './injection-detector.js';
// =============================================================================
// Brute Force Protection (New)
// =============================================================================
export { BruteForceProtection, getBruteForceProtection, resetBruteForceProtection, createBruteForceMiddleware, } from './brute-force.js';
// =============================================================================
// Password Policy (New)
// =============================================================================
export { PasswordPolicyEngine, getPasswordPolicyEngine, resetPasswordPolicyEngine, DEFAULT_PASSWORD_POLICY, NIST_PASSWORD_POLICY, } from './password-policy.js';
// =============================================================================
// Key Rotation (New)
// =============================================================================
export { KeyRotationManager, getKeyRotationManager, resetKeyRotationManager, } from './key-rotation.js';
// =============================================================================
// MFA (Multi-Factor Authentication)
// =============================================================================
export { 
// Types
MfaMethod, MfaStatus, MFA_DEFAULTS, 
// Service
MfaService, getMfaService, resetMfaService, createMfaService, MfaError, EnrollmentExpiredError, ChallengeExpiredError, TooManyAttemptsError, 
// Store
MfaStore, getMfaStore, resetMfaStore, createMfaStore, 
// Middleware
requireMfa, mfaContextMiddleware, requireMfaEnabled, 
// Schemas
mfaMethodSchema, mfaStatusSchema, mfaEnrollmentResponseSchema, mfaEnrollmentCompleteResponseSchema, mfaStatusResponseSchema, mfaChallengeResponseSchema, mfaVerifyResponseSchema, mfaBackupCodesResponseSchema, mfaServiceConfigSchema, } from './mfa/index.js';
// =============================================================================
// Request Integrity (New)
// =============================================================================
export { RequestIntegrity, getRequestIntegrity, resetRequestIntegrity, createSignatureHeaders, extractSignatureFromHeaders, INTEGRITY_HEADERS, DEFAULT_REQUEST_INTEGRITY_CONFIG, } from './request-integrity.js';
// =============================================================================
// Secure Memory (New)
// =============================================================================
export { SecureString, SecureBuffer, secureEnv, requireSecureEnv, secureRandomBytes, secureCompare, secureCompareBuffers, withSecureString, withSecureStringAsync, withSecureBuffer, withSecureBufferAsync, SecureMemoryError, MissingEnvironmentError, } from './secure-memory.js';
// =============================================================================
// Error Sanitization (New)
// =============================================================================
export { ErrorSanitizer, getErrorSanitizer, resetErrorSanitizer, createErrorSanitizer, createErrorHandler, errorSanitizerPlugin, sanitizeErrorMessage, classifyError, generateSafeMessage, SENSITIVE_PATTERNS, DEFAULT_ERROR_MAPPINGS, } from './error-sanitizer.js';
// =============================================================================
// API Key Management
// =============================================================================
export { 
// Types
ApiKeyScope, apiKeyScopeSchema, API_KEY_SCOPES, ApiKeyStatus, apiKeyStatusSchema, apiKeyRateLimitSchema, DEFAULT_API_KEY_RATE_LIMIT, apiKeySchema, createApiKeyInputSchema, updateApiKeyInputSchema, ApiKeyValidationErrorCode, apiKeyValidationResultSchema, apiKeyListFiltersSchema, ApiKeyAuditEventType, API_KEY_PREFIX, API_KEY_PREFIX_LENGTH, API_KEY_SECRET_LENGTH, API_KEY_PATTERN, InMemoryApiKeyStore, getApiKeyStore, createApiKeyStore, resetApiKeyStore, 
// Service
ApiKeyService, ApiKeyError, ApiKeyValidationError, ApiKeyRateLimitError, getApiKeyService, createApiKeyService, resetApiKeyService, 
// Middleware
apiKeyMiddleware, requireScopes, requireReadScope, requireWriteScope, requireAdminScope, requireWebhookScope, requireIntegrationScope, apiKeyPlugin, getApiKey, getApiKeyTenantId, hasApiKey, getApiKeyScopes, } from './api-keys/index.js';
// =============================================================================
// Security Headers Management
// =============================================================================
export { 
// Schemas
cspSourceValueSchema, cspSandboxValueSchema, cspDirectivesSchema, cspReportingConfigSchema, hstsConfigSchema, HSTS_MIN_MAX_AGE_FOR_PRELOAD, HSTS_RECOMMENDED_MAX_AGE, corsConfigSchema, permissionsPolicyValueSchema, permissionsPolicyConfigSchema, securityHeadersConfigSchema, validationIssueSchema, headerValidationResultSchema, cspViolationReportSchema, 
// CSP
CSPBuilder, generateNonce, formatNonce, STRICT_CSP_PRESET, MODERATE_CSP_PRESET, RELAXED_CSP_PRESET, API_CSP_PRESET, getCSPPreset, createStrictCSP, createModerateCSP, createAPICSP, createDevelopmentCSP, buildCSPString, parseCSPString, 
// HSTS
HSTSManager, HSTS_HEADER_NAME, HSTS_MIN_RECOMMENDED_MAX_AGE, HSTS_MAX_SENSIBLE_MAX_AGE, createProductionHSTS, createPreloadHSTS, createDevelopmentHSTS, createHSTS, buildHSTSHeader, parseHSTSHeader, validateHSTSHeader, 
// Permissions Policy
PermissionsPolicyManager, PERMISSIONS_POLICY_HEADER, KNOWN_FEATURES, HIGH_RISK_FEATURES, SENSOR_FEATURES, STRICT_PERMISSIONS_PRESET, MODERATE_PERMISSIONS_PRESET, API_PERMISSIONS_PRESET, createStrictPermissionsPolicy, createModeratePermissionsPolicy, createAPIPermissionsPolicy, createPermissionsPolicy, buildPermissionsPolicyHeader, parsePermissionsPolicyHeader, getSecureDefault, 
// Validation
validateSecurityHeaders, assertValidSecurityHeaders, getSecurityHeadersSummary, 
// Middleware/Plugin
securityHeadersPlugin, createStrictSecurityHeaders, createAPISecurityHeaders, createDevelopmentSecurityHeaders, createSecurityHeaders, } from './headers/index.js';
// =============================================================================
// Distributed State Provider
// =============================================================================
export { RedisStateProvider, getRedisStateProvider, resetRedisStateProvider, createRedisStateProvider, DEFAULT_REDIS_STATE_CONFIG, } from './distributed-state.js';
// =============================================================================
// WebAuthn/Passkeys
// =============================================================================
export { 
// Service
WebAuthnService, WebAuthnError, WebAuthnRegistrationError, WebAuthnAuthenticationError, getWebAuthnService, createWebAuthnService, resetWebAuthnService, InMemoryWebAuthnStore, RedisWebAuthnStore, getWebAuthnStore, createWebAuthnStore, createRedisWebAuthnStore, resetWebAuthnStore, enableRedisWebAuthnStore, RegistrationErrorCode, AuthenticationErrorCode, WebAuthnAuditEventType, DEFAULT_WEBAUTHN_CONFIG, } from './webauthn/index.js';
// =============================================================================
// Refresh Token Service
// =============================================================================
export { RefreshTokenService, RefreshTokenError, TokenReuseError, RefreshTokenExpiredError, RefreshTokenRevokedError, RefreshTokenInvalidError, getRefreshTokenService, createRefreshTokenService, resetRefreshTokenService, } from './refresh-token.js';
// =============================================================================
// Token Lifecycle Management (Unified Revocation)
// =============================================================================
export { TokenLifecycleService, TokenLifecycleError, getTokenLifecycleService, createTokenLifecycleService, resetTokenLifecycleService, } from './token-lifecycle.js';
// =============================================================================
// Revocation Check Middleware (Bloom Filter)
// =============================================================================
export { RevocationCheckService, revocationCheckMiddleware, getRevocationCheckService, createRevocationCheckService, resetRevocationCheckService, } from './revocation-check.js';
// =============================================================================
// Security Alerting System
// =============================================================================
export { 
// Enums
AlertSeverity, AlertChannel, SecurityEventType, ConditionOperator, 
// Schemas
alertSeveritySchema, alertChannelSchema, securityEventTypeSchema, conditionOperatorSchema, alertContextSchema, securityAlertSchema, createAlertInputSchema, alertConditionSchema, alertThresholdSchema, channelConfigSchema, alertRuleSchema, maintenanceWindowSchema, escalationPolicySchema, alertConfigSchema, alertDeliveryResultSchema, 
// Defaults
DEFAULT_ALERT_CONFIG, 
// Detector
SecurityAlertDetector, getSecurityAlertDetector, resetSecurityAlertDetector, createSecurityAlertDetector, DEFAULT_BUILTIN_DETECTOR_CONFIG, 
// Service
SecurityAlertService, getSecurityAlertService, resetSecurityAlertService, createSecurityAlertService, 
// Channels
SlackAlertChannel, createSlackChannel, PagerDutyAlertChannel, createPagerDutyChannel, EmailAlertChannel, createEmailChannel, WebhookAlertChannel, createWebhookChannel, createSignedWebhookChannel, SNSAlertChannel, createSNSChannel, 
// Convenience helpers
SecurityAlerts, } from './alerting/index.js';
// =============================================================================
// Bot Detection (Threat Intel)
// =============================================================================
export { BotDetectionService, getBotDetectionService, resetBotDetectionService, botDetectionMiddleware, botDetectionPlugin, DEFAULT_BOT_DETECTION_CONFIG, } from './threat-intel/bot-detection.js';
// =============================================================================
// Data Loss Prevention (DLP)
// =============================================================================
export { 
// Scanner class
DLPScanner, 
// Enums and types
DataType, 
// Schemas
dlpScannerConfigSchema, 
// Default configuration
DEFAULT_DLP_CONFIG, 
// Error classes
DLPError, SensitiveDataBlockedError, DLPScanTimeoutError, 
// Middleware
dlpRequestScanner, dlpResponseScanner, 
// Plugin
dlpPlugin, 
// Singleton management
getDLPScanner, resetDLPScanner, createDLPScanner, } from './dlp/index.js';
// =============================================================================
// Service-to-Service Authentication
// =============================================================================
export { 
// Service Account Types
ServiceAccountStatus, serviceAccountSchema, createServiceAccountInputSchema, updateServiceAccountInputSchema, 
// Service Account Errors
ServiceAccountError, ServiceAccountNotFoundError, ServiceAccountRevokedError, ServiceAccountSuspendedError, 
// Service Account Constants
SERVICE_CLIENT_ID_PREFIX, 
// Service Account Utilities
generateClientSecret, generateClientId, hashClientSecret, verifyClientSecret, InMemoryServiceAccountStore, 
// Service Account Manager
ServiceAccountManager, 
// Service Account Singletons
getServiceAccountStore, setServiceAccountStore, getServiceAccountManager, createServiceAccountManager, resetServiceAccountSingletons, serviceTokenPayloadSchema, serviceSignatureSchema, tokenVerificationResultSchema, 
// Service Token Errors
ServiceTokenError, TokenExpiredError as ServiceTokenExpiredError, InvalidSignatureError, SignatureTimestampError, 
// Service Token Constants
DEFAULT_TOKEN_TTL_SECONDS, MAX_CLOCK_SKEW_SECONDS, MIN_TOKEN_TTL_SECONDS, MAX_TOKEN_TTL_SECONDS, SERVICE_TOKEN_ISSUER, SERVICE_AUTH_HEADERS, 
// Service Token Service
ServiceTokenService, serviceTokenServiceConfigSchema, 
// Service Token Singletons
initializeServiceTokenService, getServiceTokenService, createServiceTokenService, resetServiceTokenService, 
// Service Token Utilities
createServiceAuthHeaders, extractServiceIdFromBearer, 
// Service Auth Middleware Errors
ServiceAuthError, MissingAuthHeadersError, InvalidServiceSignatureError, IpNotAllowedError, InsufficientPermissionsError, 
// Service Auth Middleware Factory
createServiceAuthMiddleware, 
// Service Auth Helper Middleware
requireServicePermissions, requireAnyServicePermission, requireServiceTenant, 
// Service Auth Request Helpers
getServiceAuth, requireServiceAuth, hasServiceAuth, getServiceClientId, getServiceTenantId, getServicePermissions, serviceHasPermission, 
// Service Auth Fastify Plugin
serviceAuthPlugin, } from './service-auth/index.js';
//# sourceMappingURL=index.js.map