@jungjaehoon/mama-os 0.13.3 → 0.14.2

package/dist/security/security-monitor.js

@@ -0,0 +1,662 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getTarpitDelayMs = getTarpitDelayMs;
+exports.isHoneypotPath = isHoneypotPath;
+exports.setSecurityAlertSender = setSecurityAlertSender;
+exports.resetSecurityMonitorForTests = resetSecurityMonitorForTests;
+exports.flushSecurityMonitor = flushSecurityMonitor;
+exports.formatSecurityAlert = formatSecurityAlert;
+exports.recordSecurityEvent = recordSecurityEvent;
+exports.createSecurityMiddleware = createSecurityMiddleware;
+exports.getCloudflareCustomListCsvPath = getCloudflareCustomListCsvPath;
+exports.getCloudflareWafExpressionPath = getCloudflareWafExpressionPath;
+exports.getDenylistJsonPath = getDenylistJsonPath;
+exports.getDenylistTxtPath = getDenylistTxtPath;
+exports.getIncidentLogDir = getIncidentLogDir;
+exports.getSecurityLogPath = getSecurityLogPath;
+const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const debugLogger = __importStar(require("@jungjaehoon/mama-core/debug-logger"));
+const trusted_proxy_js_1 = require("./trusted-proxy.js");
+const { DebugLogger } = debugLogger;
+const logger = new DebugLogger('SecurityMonitor');
+const ALERT_COOLDOWN_MS = Number(process.env.MAMA_SECURITY_ALERT_COOLDOWN_MS || 60_000);
+const HONEYPOT_DELAY_MS = Number(process.env.MAMA_HONEYPOT_DELAY_MS || 2_000);
+const MAX_TARPIT_DELAY_MS = Number(process.env.MAMA_TARPIT_MAX_DELAY_MS || 5_000);
+const SECURITY_ENRICHMENT_TIMEOUT_MS = Number(process.env.MAMA_SECURITY_ENRICHMENT_TIMEOUT_MS || 4_000);
+const MAX_SECURITY_CACHE_ENTRIES = Number(process.env.MAMA_SECURITY_CACHE_MAX_ENTRIES || 1_024);
+const SECURITY_CACHE_ENTRY_TTL_MS = Number(process.env.MAMA_SECURITY_CACHE_ENTRY_TTL_MS || 60 * 60 * 1000);
+const DENYLIST_LOCK_TIMEOUT_MS = Number(process.env.MAMA_DENYLIST_LOCK_TIMEOUT_MS || 5_000);
+const DENYLIST_LOCK_STALE_MS = Number(process.env.MAMA_DENYLIST_LOCK_STALE_MS || 30_000);
+const suspicionScores = new Map();
+const attributionCache = new Map();
+const HONEYPOT_PATTERNS = [
+    /^\/\.git(?:\/|$)/i,
+    /^\/\.env(?:\.|$)/i,
+    /^\/\.DS_Store$/i,
+    /^\/wp-login\.php$/i,
+    /^\/xmlrpc\.php$/i,
+    /^\/phpmyadmin(?:\/|$)/i,
+    /^\/server-status$/i,
+    /^\/nginx_status$/i,
+    /^\/backup(?:\.(?:zip|tar|gz|sql|bak))?$/i,
+    /^\/mama-memory\.db$/i,
+    /^\/debug$/i,
+    /^\/metrics$/i,
+];
+let alertSender = null;
+const lastAlertAt = new Map();
+const incidentIds = new Map();
+const pendingTasks = new Set();
+let denylistWriteChain = Promise.resolve();
+const incidentUpdateChains = new Map();
+function buildFingerprint(event) {
+    return JSON.stringify([
+        event.type,
+        event.clientAddress || event.remoteAddress || 'unknown',
+        event.path || 'unknown',
+    ]);
+}
+function normalizeClientKey(clientAddress) {
+    if (!clientAddress || clientAddress === 'unknown') {
+        return 'unknown';
+    }
+    return clientAddress.replace(/[^a-zA-Z0-9_.:-]/g, '_');
+}
+function getIncidentId(event) {
+    const clientKey = normalizeClientKey(event.clientAddress || event.remoteAddress);
+    const existing = incidentIds.get(clientKey);
+    if (existing) {
+        return existing;
+    }
+    const incidentId = `${new Date().toISOString().replace(/[:.]/g, '-')}-${clientKey}`;
+    incidentIds.set(clientKey, incidentId);
+    return incidentId;
+}
+function getRiskWeight(severity) {
+    switch (severity) {
+        case 'critical':
+            return 4;
+        case 'warn':
+            return 2;
+        default:
+            return 1;
+    }
+}
+function pruneSuspicionScores(now = Date.now()) {
+    for (const [key, value] of suspicionScores.entries()) {
+        if (now - value.updatedAt > SECURITY_CACHE_ENTRY_TTL_MS) {
+            suspicionScores.delete(key);
+        }
+    }
+    while (suspicionScores.size > MAX_SECURITY_CACHE_ENTRIES) {
+        const oldestKey = suspicionScores.keys().next().value;
+        if (!oldestKey) {
+            break;
+        }
+        suspicionScores.delete(oldestKey);
+    }
+}
+function pruneAttributionCache(now = Date.now()) {
+    for (const [key, value] of attributionCache.entries()) {
+        if (now - value.updatedAt > SECURITY_CACHE_ENTRY_TTL_MS) {
+            attributionCache.delete(key);
+        }
+    }
+    while (attributionCache.size > MAX_SECURITY_CACHE_ENTRIES) {
+        const oldestKey = attributionCache.keys().next().value;
+        if (!oldestKey) {
+            break;
+        }
+        attributionCache.delete(oldestKey);
+    }
+}
+function getClientAddressFromRequestLike(req) {
+    return (0, trusted_proxy_js_1.getForwardedClientAddress)(req);
+}
+function getPathFromRequestLike(req) {
+    const rawUrl = req.originalUrl || req.url || '/';
+    try {
+        return new URL(rawUrl, `http://${String(req.headers.host || 'localhost')}`).pathname;
+    }
+    catch {
+        return rawUrl;
+    }
+}
+function rememberSuspiciousClient(clientAddress, severity) {
+    if (!clientAddress || clientAddress === 'unknown' || (0, trusted_proxy_js_1.isLocalAddress)(clientAddress)) {
+        return;
+    }
+    const now = Date.now();
+    pruneSuspicionScores(now);
+    const existing = suspicionScores.get(clientAddress);
+    const nextScore = Math.min(20, (existing?.score || 0) + getRiskWeight(severity));
+    suspicionScores.set(clientAddress, { score: nextScore, updatedAt: now });
+}
+function getTarpitDelayMs(clientAddress) {
+    if (!clientAddress || clientAddress === 'unknown' || (0, trusted_proxy_js_1.isLocalAddress)(clientAddress)) {
+        return 0;
+    }
+    const now = Date.now();
+    pruneSuspicionScores(now);
+    const entry = suspicionScores.get(clientAddress);
+    if (!entry || entry.score < 3) {
+        return 0;
+    }
+    entry.updatedAt = now;
+    return Math.min(MAX_TARPIT_DELAY_MS, entry.score * 250);
+}
+function isHoneypotPath(pathname) {
+    return HONEYPOT_PATTERNS.some((pattern) => pattern.test(pathname));
+}
+function shouldSendAlert(event) {
+    if (!alertSender) {
+        return false;
+    }
+    const fingerprint = buildFingerprint(event);
+    const now = Date.now();
+    const last = lastAlertAt.get(fingerprint) || 0;
+    if (now - last < ALERT_COOLDOWN_MS) {
+        return false;
+    }
+    lastAlertAt.set(fingerprint, now);
+    return true;
+}
+function trackBackgroundTask(task) {
+    pendingTasks.add(task);
+    void task.finally(() => {
+        pendingTasks.delete(task);
+    });
+}
+async function appendSecurityLog(event) {
+    await (0, promises_1.mkdir)(getSecurityLogDir(), { recursive: true });
+    await (0, promises_1.appendFile)(getSecurityLogPath(), `${JSON.stringify(event)}\n`, 'utf8');
+}
+function extractAbuseEmails(rdap) {
+    const entities = Array.isArray(rdap.entities) ? rdap.entities : [];
+    const emails = new Set();
+    for (const entity of entities) {
+        if (!entity || typeof entity !== 'object') {
+            continue;
+        }
+        const roles = Array.isArray(entity.roles)
+            ? entity.roles
+            : [];
+        const isAbuseRelated = roles.some((role) => typeof role === 'string' &&
+            ['abuse', 'technical', 'administrative', 'noc'].includes(role.toLowerCase()));
+        if (!isAbuseRelated) {
+            continue;
+        }
+        const vcardArray = entity.vcardArray;
+        if (!Array.isArray(vcardArray) || vcardArray.length < 2 || !Array.isArray(vcardArray[1])) {
+            continue;
+        }
+        for (const entry of vcardArray[1]) {
+            if (!Array.isArray(entry) || entry[0] !== 'email' || typeof entry[3] !== 'string') {
+                continue;
+            }
+            emails.add(entry[3]);
+        }
+    }
+    return [...emails];
+}
+async function lookupNetworkAttribution(ip) {
+    if (!ip || ip === 'unknown' || (0, trusted_proxy_js_1.isLocalAddress)(ip)) {
+        return null;
+    }
+    const now = Date.now();
+    pruneAttributionCache(now);
+    if (attributionCache.has(ip)) {
+        const cached = attributionCache.get(ip);
+        cached.updatedAt = now;
+        return cached.value;
+    }
+    if (process.env.MAMA_SECURITY_ENRICHMENT === 'false') {
+        attributionCache.set(ip, { value: null, updatedAt: now });
+        return null;
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), SECURITY_ENRICHMENT_TIMEOUT_MS);
+    try {
+        const res = await fetch(`https://rdap.org/ip/${encodeURIComponent(ip)}`, {
+            signal: controller.signal,
+            headers: { Accept: 'application/rdap+json, application/json' },
+        });
+        if (!res.ok) {
+            attributionCache.set(ip, { value: null, updatedAt: now });
+            return null;
+        }
+        const rdap = (await res.json());
+        const cidrEntries = Array.isArray(rdap.cidr0_cidrs)
+            ? rdap.cidr0_cidrs
+            : [];
+        const cidr = cidrEntries
+            .map((entry) => entry.v4prefix && entry.length
+            ? `${entry.v4prefix}/${entry.length}`
+            : entry.v6prefix && entry.length
+                ? `${entry.v6prefix}/${entry.length}`
+                : null)
+            .find(Boolean);
+        const attribution = {
+            source: 'rdap',
+            networkName: typeof rdap.name === 'string' ? rdap.name : null,
+            organization: typeof rdap.port43 === 'string'
+                ? rdap.port43
+                : typeof rdap.objectClassName === 'string'
+                    ? rdap.objectClassName
+                    : null,
+            country: typeof rdap.country === 'string' ? rdap.country : null,
+            cidr: typeof cidr === 'string' ? cidr : null,
+            abuseEmails: extractAbuseEmails(rdap),
+            asn: typeof rdap.asn === 'string'
+                ? rdap.asn
+                : typeof rdap.startAutnum === 'number'
+                    ? `AS${rdap.startAutnum}`
+                    : null,
+            handle: typeof rdap.handle === 'string' ? rdap.handle : null,
+        };
+        pruneAttributionCache(now);
+        attributionCache.set(ip, { value: attribution, updatedAt: now });
+        return attribution;
+    }
+    catch (error) {
+        logger.warn('Network attribution lookup failed', { ip, error: String(error) });
+        attributionCache.set(ip, { value: null, updatedAt: now });
+        return null;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function formatAbuseReport(incidentId, incidentSummary) {
+    return [
+        '# Abuse Report Draft',
+        '',
+        `- Incident ID: ${incidentId}`,
+        `- Generated At: ${new Date().toISOString()}`,
+        `- Severity: ${incidentSummary.highestSeverity}`,
+        `- Suspected Source IP: ${incidentSummary.clientAddress || 'unknown'}`,
+        `- First Seen: ${incidentSummary.firstSeen}`,
+        `- Last Seen: ${incidentSummary.lastSeen}`,
+        `- Event Count: ${incidentSummary.eventCount}`,
+        '',
+        '## Summary',
+        incidentSummary.summary,
+        '',
+        '## Network Attribution',
+        `- ASN: ${incidentSummary.attribution?.asn || 'unknown'}`,
+        `- Network: ${incidentSummary.attribution?.networkName || 'unknown'}`,
+        `- Organization: ${incidentSummary.attribution?.organization || 'unknown'}`,
+        `- Country: ${incidentSummary.attribution?.country || 'unknown'}`,
+        `- CIDR: ${incidentSummary.attribution?.cidr || 'unknown'}`,
+        `- Handle: ${incidentSummary.attribution?.handle || 'unknown'}`,
+        `- Abuse Contacts: ${incidentSummary.attribution?.abuseEmails?.join(', ') || 'unknown'}`,
+        '',
+        '## Evidence',
+        `- Client Address: ${incidentSummary.clientAddress || 'unknown'}`,
+        `- Remote Address: ${incidentSummary.remoteAddress || 'unknown'}`,
+        `- Forwarded For: ${incidentSummary.forwardedFor || 'unknown'}`,
+        `- Cloudflare Connecting IP: ${incidentSummary.cfConnectingIp || 'unknown'}`,
+        `- Cloudflare Ray: ${incidentSummary.cfRay || 'unknown'}`,
+        `- Latest Path: ${incidentSummary.path || 'unknown'}`,
+        `- Latest Method: ${incidentSummary.method || 'unknown'}`,
+        '',
+        '## Recommended Submission',
+        '- Submit this report to your hosting provider, Cloudflare abuse contact, or upstream ISP abuse desk.',
+        `- Attach the JSON evidence file: ${incidentSummary.evidenceJsonPath}`,
+        `- Attach the timeline log: ${incidentSummary.timelinePath}`,
+        `- Review denylist candidates: ${incidentSummary.denylistCandidatePath}`,
+        `- Cloudflare custom list CSV: ${incidentSummary.cloudflareCustomListPath}`,
+        `- Cloudflare WAF rule expression: ${incidentSummary.cloudflareWafExpressionPath}`,
+        '',
+        '## Latest Event Details',
+        `\`\`\`json`,
+        JSON.stringify(incidentSummary.latestEvent, null, 2),
+        '```',
+        '',
+    ].join('\n');
+}
+function getSecurityLogDir() {
+    return (0, node_path_1.join)((0, node_os_1.homedir)(), '.mama', 'logs');
+}
+function getSecurityLogPath() {
+    return (0, node_path_1.join)(getSecurityLogDir(), 'security-events.jsonl');
+}
+function getIncidentLogDir() {
+    return (0, node_path_1.join)(getSecurityLogDir(), 'security-incidents');
+}
+function getDenylistJsonPath() {
+    return (0, node_path_1.join)(getSecurityLogDir(), 'security-denylist-candidates.json');
+}
+function getDenylistTxtPath() {
+    return (0, node_path_1.join)(getSecurityLogDir(), 'security-denylist-candidates.txt');
+}
+function getCloudflareCustomListCsvPath() {
+    return (0, node_path_1.join)(getSecurityLogDir(), 'cloudflare-ip-list.csv');
+}
+function getCloudflareWafExpressionPath() {
+    return (0, node_path_1.join)(getSecurityLogDir(), 'cloudflare-waf-expression.txt');
+}
+function getDenylistLockPath() {
+    return (0, node_path_1.join)(getSecurityLogDir(), 'security-denylist.lock');
+}
+async function acquireDenylistLock() {
+    await (0, promises_1.mkdir)(getSecurityLogDir(), { recursive: true });
+    const startedAt = Date.now();
+    while (Date.now() - startedAt < DENYLIST_LOCK_TIMEOUT_MS) {
+        try {
+            const handle = await (0, promises_1.open)(getDenylistLockPath(), 'wx');
+            return async () => {
+                await handle.close().catch(() => undefined);
+                await (0, promises_1.unlink)(getDenylistLockPath()).catch(() => undefined);
+            };
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== 'EEXIST') {
+                throw error;
+            }
+            try {
+                const existing = await (0, promises_1.stat)(getDenylistLockPath());
+                if (Date.now() - existing.mtimeMs > DENYLIST_LOCK_STALE_MS) {
+                    await (0, promises_1.unlink)(getDenylistLockPath()).catch(() => undefined);
+                    continue;
+                }
+            }
+            catch {
+                continue;
+            }
+            await new Promise((resolve) => setTimeout(resolve, 50));
+        }
+    }
+    throw new Error('Timed out acquiring denylist lock');
+}
+async function withSerializedDenylistWrite(operation) {
+    const previous = denylistWriteChain;
+    let releaseQueue;
+    denylistWriteChain = new Promise((resolve) => {
+        releaseQueue = resolve;
+    });
+    await previous.catch(() => undefined);
+    let releaseLock = null;
+    try {
+        releaseLock = await acquireDenylistLock();
+    }
+    catch (error) {
+        releaseQueue();
+        throw error;
+    }
+    try {
+        return await operation();
+    }
+    finally {
+        await releaseLock?.().catch(() => undefined);
+        releaseQueue();
+    }
+}
+async function withSerializedIncidentUpdate(incidentId, operation) {
+    const previous = incidentUpdateChains.get(incidentId) || Promise.resolve();
+    let releaseQueue;
+    const nextChain = new Promise((resolve) => {
+        releaseQueue = resolve;
+    });
+    incidentUpdateChains.set(incidentId, nextChain);
+    await previous.catch(() => undefined);
+    try {
+        return await operation();
+    }
+    finally {
+        releaseQueue();
+        if (incidentUpdateChains.get(incidentId) === nextChain) {
+            incidentUpdateChains.delete(incidentId);
+        }
+    }
+}
+async function readIncidentSummary(path) {
+    try {
+        const content = await (0, promises_1.readFile)(path, 'utf8');
+        return JSON.parse(content);
+    }
+    catch {
+        return null;
+    }
+}
+async function writeDenylistCandidate(summary) {
+    const ip = summary.clientAddress;
+    if (!ip || ip === 'unknown' || (0, trusted_proxy_js_1.isLocalAddress)(ip)) {
+        return;
+    }
+    await withSerializedDenylistWrite(async () => {
+        const denylistJsonPath = getDenylistJsonPath();
+        const denylistTxtPath = getDenylistTxtPath();
+        const raw = await (0, promises_1.readFile)(denylistJsonPath, 'utf8').catch(() => '[]');
+        let candidates = [];
+        try {
+            candidates = JSON.parse(raw);
+        }
+        catch {
+            candidates = [];
+        }
+        const existing = candidates.find((candidate) => candidate.ip === ip);
+        const updated = {
+            ip,
+            firstSeen: existing?.firstSeen || summary.firstSeen,
+            lastSeen: summary.lastSeen,
+            eventCount: Math.max(existing?.eventCount || 0, summary.eventCount),
+            highestSeverity: existing && getRiskWeight(existing.highestSeverity) > getRiskWeight(summary.highestSeverity)
+                ? existing.highestSeverity
+                : summary.highestSeverity,
+            reasons: Array.from(new Set([...(existing?.reasons || []), summary.summary])),
+            suggestedAction: 'Review and block via Cloudflare/WAF if malicious activity is confirmed.',
+            attribution: summary.attribution || existing?.attribution || null,
+        };
+        const next = candidates.filter((candidate) => candidate.ip !== ip);
+        next.push(updated);
+        next.sort((a, b) => b.lastSeen.localeCompare(a.lastSeen));
+        await (0, promises_1.mkdir)(getSecurityLogDir(), { recursive: true });
+        await (0, promises_1.writeFile)(denylistJsonPath, JSON.stringify(next, null, 2), 'utf8');
+        await (0, promises_1.writeFile)(denylistTxtPath, `${next.map((candidate) => candidate.ip).join('\n')}\n`, 'utf8');
+        await writeCloudflareExports(next);
+    });
+}
+async function writeCloudflareExports(candidates) {
+    const csvLines = candidates.map((candidate) => {
+        const reason = candidate.reasons[0] || 'security-monitor candidate';
+        const description = `${candidate.highestSeverity}:${reason}`
+            .replace(/[\r\n]+/g, ' ')
+            .replace(/,/g, ';')
+            .slice(0, 500);
+        return `${candidate.ip},${description}`;
+    });
+    const expressionLines = [
+        '# Cloudflare WAF custom rule expression',
+        '# Create/import a custom IP list using cloudflare-ip-list.csv, then use:',
+        'ip.src in $mama_security_blocklist',
+    ];
+    await (0, promises_1.writeFile)(getCloudflareCustomListCsvPath(), `${csvLines.join('\n')}\n`, 'utf8');
+    await (0, promises_1.writeFile)(getCloudflareWafExpressionPath(), `${expressionLines.join('\n')}\n`, 'utf8');
+}
+async function preserveEvidence(event) {
+    const incidentId = getIncidentId(event);
+    const incidentDir = (0, node_path_1.join)(getIncidentLogDir(), incidentId);
+    const summaryPath = (0, node_path_1.join)(incidentDir, 'incident.json');
+    const timelinePath = (0, node_path_1.join)(incidentDir, 'timeline.jsonl');
+    const abuseReportPath = (0, node_path_1.join)(incidentDir, 'abuse-report.md');
+    const attribution = await lookupNetworkAttribution(event.clientAddress || event.remoteAddress || '');
+    await (0, promises_1.mkdir)(incidentDir, { recursive: true });
+    await (0, promises_1.appendFile)(timelinePath, `${JSON.stringify(event)}\n`, 'utf8');
+    return await withSerializedIncidentUpdate(incidentId, async () => {
+        const previous = await readIncidentSummary(summaryPath);
+        const highestSeverity = previous && getRiskWeight(previous.highestSeverity) > getRiskWeight(event.severity)
+            ? previous.highestSeverity
+            : event.severity;
+        const summary = {
+            incidentId,
+            clientAddress: event.clientAddress || previous?.clientAddress || null,
+            remoteAddress: event.remoteAddress || previous?.remoteAddress || null,
+            forwardedFor: event.forwardedFor || previous?.forwardedFor || null,
+            cfConnectingIp: event.cfConnectingIp || previous?.cfConnectingIp || null,
+            cfRay: event.cfRay || previous?.cfRay || null,
+            path: event.path || previous?.path || null,
+            method: event.method || previous?.method || null,
+            firstSeen: previous?.firstSeen || event.timestamp || new Date().toISOString(),
+            lastSeen: event.timestamp || new Date().toISOString(),
+            eventCount: (previous?.eventCount || 0) + 1,
+            highestSeverity,
+            summary: `${event.message} (${event.type})`,
+            latestEvent: event,
+            attribution: previous?.attribution || attribution,
+            evidenceJsonPath: summaryPath,
+            timelinePath,
+            abuseReportPath,
+            denylistCandidatePath: getDenylistJsonPath(),
+            cloudflareCustomListPath: getCloudflareCustomListCsvPath(),
+            cloudflareWafExpressionPath: getCloudflareWafExpressionPath(),
+        };
+        await (0, promises_1.writeFile)(summaryPath, JSON.stringify(summary, null, 2), 'utf8');
+        await (0, promises_1.writeFile)(abuseReportPath, formatAbuseReport(incidentId, summary), 'utf8');
+        await writeDenylistCandidate(summary);
+        return summary;
+    });
+}
+function setSecurityAlertSender(sender) {
+    alertSender = sender;
+    if (sender) {
+        logger.info('Security alert sender registered');
+    }
+}
+function resetSecurityMonitorForTests() {
+    alertSender = null;
+    lastAlertAt.clear();
+    suspicionScores.clear();
+    incidentIds.clear();
+    attributionCache.clear();
+    denylistWriteChain = Promise.resolve();
+    incidentUpdateChains.clear();
+}
+async function flushSecurityMonitor() {
+    if (pendingTasks.size === 0) {
+        return;
+    }
+    await Promise.allSettled([...pendingTasks]);
+}
+function formatSecurityAlert(event) {
+    const incidentId = getIncidentId(event);
+    const incidentDir = (0, node_path_1.join)(getIncidentLogDir(), incidentId);
+    const lines = [
+        `🚨 [Security] ${event.message}`,
+        `type: ${event.type}`,
+        `severity: ${event.severity}`,
+        `client: ${event.clientAddress || event.remoteAddress || 'unknown'}`,
+    ];
+    if (event.path) {
+        lines.push(`path: ${event.path}`);
+    }
+    if (event.method) {
+        lines.push(`method: ${event.method}`);
+    }
+    if (event.cfRay) {
+        lines.push(`cfRay: ${event.cfRay}`);
+    }
+    if (event.details && Object.keys(event.details).length > 0) {
+        lines.push(`details: ${JSON.stringify(event.details)}`);
+    }
+    lines.push(`evidence: ${(0, node_path_1.join)(incidentDir, 'incident.json')}`);
+    lines.push(`abuse_draft: ${(0, node_path_1.join)(incidentDir, 'abuse-report.md')}`);
+    lines.push(`denylist: ${getDenylistJsonPath()}`);
+    lines.push(`cloudflare_csv: ${getCloudflareCustomListCsvPath()}`);
+    lines.push(`cloudflare_waf: ${getCloudflareWafExpressionPath()}`);
+    return lines.join('\n');
+}
+function recordSecurityEvent(event) {
+    const normalized = {
+        ...event,
+        timestamp: event.timestamp || new Date().toISOString(),
+    };
+    rememberSuspiciousClient(normalized.clientAddress || normalized.remoteAddress, normalized.severity);
+    logger.warn(`[SECURITY] ${normalized.message}`, normalized);
+    trackBackgroundTask(appendSecurityLog(normalized).catch((error) => {
+        logger.error('Failed to append security event log', error);
+    }));
+    trackBackgroundTask(preserveEvidence(normalized)
+        .then(() => undefined)
+        .catch((error) => {
+        logger.error('Failed to preserve security evidence', error);
+    }));
+    if (!shouldSendAlert(normalized) || !alertSender) {
+        return;
+    }
+    trackBackgroundTask(alertSender(normalized).catch((error) => {
+        logger.error('Failed to deliver security alert', error);
+    }));
+}
+function createSecurityMiddleware() {
+    return async (req, res, next) => {
+        const clientAddress = getClientAddressFromRequestLike(req);
+        const pathname = getPathFromRequestLike(req);
+        if (isHoneypotPath(pathname) && !(0, trusted_proxy_js_1.isLocalAddress)(clientAddress)) {
+            const delayMs = Math.max(HONEYPOT_DELAY_MS, getTarpitDelayMs(clientAddress));
+            recordSecurityEvent({
+                type: 'honeypot_hit',
+                severity: 'critical',
+                message: 'Honeypot path accessed',
+                clientAddress,
+                remoteAddress: req.socket?.remoteAddress || null,
+                forwardedFor: typeof req.headers['x-forwarded-for'] === 'string'
+                    ? req.headers['x-forwarded-for']
+                    : null,
+                cfConnectingIp: typeof req.headers['cf-connecting-ip'] === 'string'
+                    ? req.headers['cf-connecting-ip']
+                    : null,
+                cfRay: typeof req.headers['cf-ray'] === 'string' ? req.headers['cf-ray'] : null,
+                method: req.method,
+                path: pathname,
+                viaTunnel: !!(req.headers['cf-connecting-ip'] || req.headers['cf-ray']),
+                details: { delayMs },
+            });
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+            res.status(404).type('text/plain').send('Not Found');
+            return;
+        }
+        const delayMs = getTarpitDelayMs(clientAddress);
+        if (delayMs > 0 && pathname !== '/health') {
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+        }
+        next();
+    };
+}
+//# sourceMappingURL=security-monitor.js.map