@push.rocks/smartnftables 1.0.1

package/dist_ts/nft.manager.ratelimit.js

@@ -0,0 +1,39 @@
+import { buildRateLimitRule, buildConnectionRateRule } from './nft.rulebuilder.ratelimit.js';
+/**
+ * Manages rate limiting rules using nft meters and limit expressions.
+ */
+export class RateLimitManager {
+    constructor(parent) {
+        this.parent = parent;
+    }
+    /**
+     * Add a rate limit rule (global or per-IP).
+     */
+    async addRateLimit(groupId, rule) {
+        await this.parent.ensureFilterChains();
+        const commands = buildRateLimitRule(this.parent.tableName, this.parent.family, rule);
+        await this.parent.applyRuleGroup(`ratelimit:${groupId}`, commands);
+    }
+    /**
+     * Remove a rate limit rule group.
+     */
+    async removeRateLimit(groupId) {
+        await this.parent.removeRuleGroup(`ratelimit:${groupId}`);
+    }
+    /**
+     * Add a new-connection rate limit rule.
+     * Limits the rate of new TCP/UDP connections (ct state new).
+     */
+    async addConnectionRateLimit(groupId, rule) {
+        await this.parent.ensureFilterChains();
+        const commands = buildConnectionRateRule(this.parent.tableName, this.parent.family, rule);
+        await this.parent.applyRuleGroup(`connrate:${groupId}`, commands);
+    }
+    /**
+     * Remove a connection rate limit rule group.
+     */
+    async removeConnectionRateLimit(groupId) {
+        await this.parent.removeRuleGroup(`connrate:${groupId}`);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmZ0Lm1hbmFnZXIucmF0ZWxpbWl0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvbmZ0Lm1hbmFnZXIucmF0ZWxpbWl0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSx1QkFBdUIsRUFBRSxNQUFNLGdDQUFnQyxDQUFDO0FBRTdGOztHQUVHO0FBQ0gsTUFBTSxPQUFPLGdCQUFnQjtJQUMzQixZQUFvQixNQUFxQjtRQUFyQixXQUFNLEdBQU4sTUFBTSxDQUFlO0lBQUcsQ0FBQztJQUU3Qzs7T0FFRztJQUNJLEtBQUssQ0FBQyxZQUFZLENBQUMsT0FBZSxFQUFFLElBQXVCO1FBQ2hFLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sUUFBUSxHQUFHLGtCQUFrQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ3JGLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsYUFBYSxPQUFPLEVBQUUsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsZUFBZSxDQUFDLE9BQWU7UUFDMUMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxhQUFhLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDNUQsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxPQUFlLEVBQUUsSUFBNEI7UUFDL0UsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGtCQUFrQixFQUFFLENBQUM7UUFDdkMsTUFBTSxRQUFRLEdBQUcsdUJBQXVCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDMUYsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxZQUFZLE9BQU8sRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyx5QkFBeUIsQ0FBQyxPQUFlO1FBQ3BELE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsWUFBWSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQzNELENBQUM7Q0FDRiJ9

package/dist_ts/nft.rulebuilder.firewall.d.ts

@@ -0,0 +1,30 @@
+import type { TNftFamily, INftFirewallRule, INftIPSetConfig } from './nft.types.js';
+/**
+ * Build an nft firewall rule for input/output/forward chains.
+ */
+export declare function buildFirewallRule(tableName: string, family: TNftFamily, rule: INftFirewallRule): string[];
+/**
+ * Build commands to create an nft named set (IP set).
+ */
+export declare function buildIPSetCreate(tableName: string, family: TNftFamily, config: INftIPSetConfig): string[];
+/**
+ * Build command to add elements to an existing set.
+ */
+export declare function buildIPSetAddElements(tableName: string, family: TNftFamily, setName: string, elements: string[]): string[];
+/**
+ * Build command to remove elements from a set.
+ */
+export declare function buildIPSetRemoveElements(tableName: string, family: TNftFamily, setName: string, elements: string[]): string[];
+/**
+ * Build command to delete an entire set.
+ */
+export declare function buildIPSetDelete(tableName: string, family: TNftFamily, setName: string): string[];
+/**
+ * Build a rule that matches against a named set.
+ */
+export declare function buildIPSetMatchRule(tableName: string, family: TNftFamily, options: {
+    setName: string;
+    direction: 'input' | 'output' | 'forward';
+    matchField: 'saddr' | 'daddr';
+    action: 'accept' | 'drop' | 'reject';
+}): string[];

package/dist_ts/nft.rulebuilder.firewall.js

@@ -0,0 +1,119 @@
+/**
+ * Build an nft firewall rule for input/output/forward chains.
+ */
+export function buildFirewallRule(tableName, family, rule) {
+    const chain = rule.direction;
+    const parts = [`nft add rule ${family} ${tableName} ${chain}`];
+    // Connection tracking states
+    if (rule.ctStates && rule.ctStates.length > 0) {
+        parts.push(`ct state { ${rule.ctStates.join(', ')} }`);
+    }
+    // Protocol and port matching
+    const protocols = expandProtocols(rule.protocol);
+    const commands = [];
+    for (const proto of protocols) {
+        const ruleParts = [...parts];
+        if (rule.protocol) {
+            ruleParts.push(proto);
+        }
+        if (rule.sourceIP) {
+            ruleParts.push(`ip saddr ${rule.sourceIP}`);
+        }
+        if (rule.destIP) {
+            ruleParts.push(`ip daddr ${rule.destIP}`);
+        }
+        if (rule.sourcePort != null) {
+            ruleParts.push(`${proto} sport ${rule.sourcePort}`);
+        }
+        if (rule.destPort != null) {
+            // If protocol wasn't explicitly set but we have a port, we need the protocol
+            if (!rule.protocol) {
+                ruleParts.push(`tcp dport ${rule.destPort}`);
+            }
+            else {
+                ruleParts.push(`${proto} dport ${rule.destPort}`);
+            }
+        }
+        if (rule.comment) {
+            ruleParts.push(`comment "${rule.comment}"`);
+        }
+        ruleParts.push(rule.action);
+        commands.push(ruleParts.join(' '));
+    }
+    // If no protocol expansion needed (no protocol-specific fields)
+    if (commands.length === 0) {
+        const ruleParts = [...parts];
+        if (rule.sourceIP) {
+            ruleParts.push(`ip saddr ${rule.sourceIP}`);
+        }
+        if (rule.destIP) {
+            ruleParts.push(`ip daddr ${rule.destIP}`);
+        }
+        if (rule.comment) {
+            ruleParts.push(`comment "${rule.comment}"`);
+        }
+        ruleParts.push(rule.action);
+        commands.push(ruleParts.join(' '));
+    }
+    return commands;
+}
+/**
+ * Build commands to create an nft named set (IP set).
+ */
+export function buildIPSetCreate(tableName, family, config) {
+    const commands = [];
+    // Create the set
+    commands.push(`nft add set ${family} ${tableName} ${config.name} { type ${config.type} \\; }`);
+    // Add initial elements if provided
+    if (config.elements && config.elements.length > 0) {
+        commands.push(`nft add element ${family} ${tableName} ${config.name} { ${config.elements.join(', ')} }`);
+    }
+    return commands;
+}
+/**
+ * Build command to add elements to an existing set.
+ */
+export function buildIPSetAddElements(tableName, family, setName, elements) {
+    if (elements.length === 0)
+        return [];
+    return [
+        `nft add element ${family} ${tableName} ${setName} { ${elements.join(', ')} }`
+    ];
+}
+/**
+ * Build command to remove elements from a set.
+ */
+export function buildIPSetRemoveElements(tableName, family, setName, elements) {
+    if (elements.length === 0)
+        return [];
+    return [
+        `nft delete element ${family} ${tableName} ${setName} { ${elements.join(', ')} }`
+    ];
+}
+/**
+ * Build command to delete an entire set.
+ */
+export function buildIPSetDelete(tableName, family, setName) {
+    return [
+        `nft delete set ${family} ${tableName} ${setName}`
+    ];
+}
+/**
+ * Build a rule that matches against a named set.
+ */
+export function buildIPSetMatchRule(tableName, family, options) {
+    return [
+        `nft add rule ${family} ${tableName} ${options.direction} ip ${options.matchField} @${options.setName} ${options.action}`
+    ];
+}
+// ─── Internal helpers ─────────────────────────────────────────────
+function expandProtocols(protocol) {
+    if (!protocol)
+        return [];
+    switch (protocol) {
+        case 'tcp': return ['tcp'];
+        case 'udp': return ['udp'];
+        case 'both': return ['tcp', 'udp'];
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmZ0LnJ1bGVidWlsZGVyLmZpcmV3YWxsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvbmZ0LnJ1bGVidWlsZGVyLmZpcmV3YWxsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBOztHQUVHO0FBQ0gsTUFBTSxVQUFVLGlCQUFpQixDQUMvQixTQUFpQixFQUNqQixNQUFrQixFQUNsQixJQUFzQjtJQUV0QixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDO0lBQzdCLE1BQU0sS0FBSyxHQUFhLENBQUMsZ0JBQWdCLE1BQU0sSUFBSSxTQUFTLElBQUksS0FBSyxFQUFFLENBQUMsQ0FBQztJQUV6RSw2QkFBNkI7SUFDN0IsSUFBSSxJQUFJLENBQUMsUUFBUSxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzlDLEtBQUssQ0FBQyxJQUFJLENBQUMsY0FBYyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUVELDZCQUE2QjtJQUM3QixNQUFNLFNBQVMsR0FBRyxlQUFlLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2pELE1BQU0sUUFBUSxHQUFhLEVBQUUsQ0FBQztJQUU5QixLQUFLLE1BQU0sS0FBSyxJQUFJLFNBQVMsRUFBRSxDQUFDO1FBQzlCLE1BQU0sU0FBUyxHQUFHLENBQUMsR0FBRyxLQUFLLENBQUMsQ0FBQztRQUU3QixJQUFJLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNsQixTQUFTLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3hCLENBQUM7UUFFRCxJQUFJLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNsQixTQUFTLENBQUMsSUFBSSxDQUFDLFlBQVksSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDOUMsQ0FBQztRQUVELElBQUksSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ2hCLFNBQVMsQ0FBQyxJQUFJLENBQUMsWUFBWSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUM1QyxDQUFDO1FBRUQsSUFBSSxJQUFJLENBQUMsVUFBVSxJQUFJLElBQUksRUFBRSxDQUFDO1lBQzVCLFNBQVMsQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLFVBQVUsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDdEQsQ0FBQztRQUVELElBQUksSUFBSSxDQUFDLFFBQVEsSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUMxQiw2RUFBNkU7WUFDN0UsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztnQkFDbkIsU0FBUyxDQUFDLElBQUksQ0FBQyxhQUFhLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBQy9DLENBQUM7aUJBQU0sQ0FBQztnQkFDTixTQUFTLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxVQUFVLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBQ3BELENBQUM7UUFDSCxDQUFDO1FBRUQsSUFBSSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDakIsU0FBUyxDQUFDLElBQUksQ0FBQyxZQUFZLElBQUksQ0FBQyxPQUFPLEdBQUcsQ0FBQyxDQUFDO1FBQzlDLENBQUM7UUFFRCxTQUFTLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM1QixRQUFRLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNyQyxDQUFDO0lBRUQsZ0VBQWdFO0lBQ2hFLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUMxQixNQUFNLFNBQVMsR0FBRyxDQUFDLEdBQUcsS0FBSyxDQUFDLENBQUM7UUFDN0IsSUFBSSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDbEIsU0FBUyxDQUFDLElBQUksQ0FBQyxZQUFZLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1FBQzlDLENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNoQixTQUFTLENBQUMsSUFBSSxDQUFDLFlBQVksSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDNUMsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2pCLFNBQVMsQ0FBQyxJQUFJLENBQUMsWUFBWSxJQUFJLENBQUMsT0FBTyxHQUFHLENBQUMsQ0FBQztRQUM5QyxDQUFDO1FBQ0QsU0FBUyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDNUIsUUFBUSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDckMsQ0FBQztJQUVELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUM7QUFFRDs7R0FFRztBQUNILE1BQU0sVUFBVSxnQkFBZ0IsQ0FDOUIsU0FBaUIsRUFDakIsTUFBa0IsRUFDbEIsTUFBdUI7SUFFdkIsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBRTlCLGlCQUFpQjtJQUNqQixRQUFRLENBQUMsSUFBSSxDQUNYLGVBQWUsTUFBTSxJQUFJLFNBQVMsSUFBSSxNQUFNLENBQUMsSUFBSSxXQUFXLE1BQU0sQ0FBQyxJQUFJLFFBQVEsQ0FDaEYsQ0FBQztJQUVGLG1DQUFtQztJQUNuQyxJQUFJLE1BQU0sQ0FBQyxRQUFRLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbEQsUUFBUSxDQUFDLElBQUksQ0FDWCxtQkFBbUIsTUFBTSxJQUFJLFNBQVMsSUFBSSxNQUFNLENBQUMsSUFBSSxNQUFNLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQzFGLENBQUM7SUFDSixDQUFDO0lBRUQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQztBQUVEOztHQUVHO0FBQ0gsTUFBTSxVQUFVLHFCQUFxQixDQUNuQyxTQUFpQixFQUNqQixNQUFrQixFQUNsQixPQUFlLEVBQ2YsUUFBa0I7SUFFbEIsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7UUFBRSxPQUFPLEVBQUUsQ0FBQztJQUNyQyxPQUFPO1FBQ0wsbUJBQW1CLE1BQU0sSUFBSSxTQUFTLElBQUksT0FBTyxNQUFNLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUk7S0FDL0UsQ0FBQztBQUNKLENBQUM7QUFFRDs7R0FFRztBQUNILE1BQU0sVUFBVSx3QkFBd0IsQ0FDdEMsU0FBaUIsRUFDakIsTUFBa0IsRUFDbEIsT0FBZSxFQUNmLFFBQWtCO0lBRWxCLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO1FBQUUsT0FBTyxFQUFFLENBQUM7SUFDckMsT0FBTztRQUNMLHNCQUFzQixNQUFNLElBQUksU0FBUyxJQUFJLE9BQU8sTUFBTSxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJO0tBQ2xGLENBQUM7QUFDSixDQUFDO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLFVBQVUsZ0JBQWdCLENBQzlCLFNBQWlCLEVBQ2pCLE1BQWtCLEVBQ2xCLE9BQWU7SUFFZixPQUFPO1FBQ0wsa0JBQWtCLE1BQU0sSUFBSSxTQUFTLElBQUksT0FBTyxFQUFFO0tBQ25ELENBQUM7QUFDSixDQUFDO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLFVBQVUsbUJBQW1CLENBQ2pDLFNBQWlCLEVBQ2pCLE1BQWtCLEVBQ2xCLE9BS0M7SUFFRCxPQUFPO1FBQ0wsZ0JBQWdCLE1BQU0sSUFBSSxTQUFTLElBQUksT0FBTyxDQUFDLFNBQVMsT0FBTyxPQUFPLENBQUMsVUFBVSxLQUFLLE9BQU8sQ0FBQyxPQUFPLElBQUksT0FBTyxDQUFDLE1BQU0sRUFBRTtLQUMxSCxDQUFDO0FBQ0osQ0FBQztBQUVELHFFQUFxRTtBQUVyRSxTQUFTLGVBQWUsQ0FBQyxRQUFpQztJQUN4RCxJQUFJLENBQUMsUUFBUTtRQUFFLE9BQU8sRUFBRSxDQUFDO0lBQ3pCLFFBQVEsUUFBUSxFQUFFLENBQUM7UUFDakIsS0FBSyxLQUFLLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDM0IsS0FBSyxLQUFLLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDM0IsS0FBSyxNQUFNLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQ3JDLENBQUM7QUFDSCxDQUFDIn0=

package/dist_ts/nft.rulebuilder.nat.d.ts

@@ -0,0 +1,15 @@
+import type { TNftFamily, INftDnatRule, INftSnatRule, INftMasqueradeRule } from './nft.types.js';
+/**
+ * Build DNAT rules for port forwarding.
+ * Generates DNAT + optional masquerade for each protocol.
+ * Direct port of Rust build_dnat_rule.
+ */
+export declare function buildDnatRules(tableName: string, family: TNftFamily, rule: INftDnatRule): string[];
+/**
+ * Build an SNAT rule to rewrite source address.
+ */
+export declare function buildSnatRule(tableName: string, family: TNftFamily, rule: INftSnatRule): string[];
+/**
+ * Build a masquerade rule for outgoing NAT.
+ */
+export declare function buildMasqueradeRule(tableName: string, family: TNftFamily, rule: INftMasqueradeRule): string[];

package/dist_ts/nft.rulebuilder.nat.js

@@ -0,0 +1,51 @@
+/**
+ * Expand a protocol spec into concrete protocol strings.
+ */
+function expandProtocols(protocol) {
+    switch (protocol ?? 'tcp') {
+        case 'tcp': return ['tcp'];
+        case 'udp': return ['udp'];
+        case 'both': return ['tcp', 'udp'];
+    }
+}
+/**
+ * Build DNAT rules for port forwarding.
+ * Generates DNAT + optional masquerade for each protocol.
+ * Direct port of Rust build_dnat_rule.
+ */
+export function buildDnatRules(tableName, family, rule) {
+    const protocols = expandProtocols(rule.protocol);
+    const commands = [];
+    for (const proto of protocols) {
+        // DNAT rule
+        commands.push(`nft add rule ${family} ${tableName} prerouting ${proto} dport ${rule.sourcePort} dnat to ${rule.targetHost}:${rule.targetPort}`);
+        // Masquerade (SNAT) unless preserveSourceIP is set
+        if (!rule.preserveSourceIP) {
+            commands.push(`nft add rule ${family} ${tableName} postrouting ${proto} dport ${rule.targetPort} masquerade`);
+        }
+    }
+    return commands;
+}
+/**
+ * Build an SNAT rule to rewrite source address.
+ */
+export function buildSnatRule(tableName, family, rule) {
+    const protocols = expandProtocols(rule.protocol);
+    const commands = [];
+    for (const proto of protocols) {
+        commands.push(`nft add rule ${family} ${tableName} postrouting ${proto} dport ${rule.targetPort} snat to ${rule.sourceAddress}`);
+    }
+    return commands;
+}
+/**
+ * Build a masquerade rule for outgoing NAT.
+ */
+export function buildMasqueradeRule(tableName, family, rule) {
+    const protocols = expandProtocols(rule.protocol);
+    const commands = [];
+    for (const proto of protocols) {
+        commands.push(`nft add rule ${family} ${tableName} postrouting ${proto} dport ${rule.targetPort} masquerade`);
+    }
+    return commands;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmZ0LnJ1bGVidWlsZGVyLm5hdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL25mdC5ydWxlYnVpbGRlci5uYXQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUE7O0dBRUc7QUFDSCxTQUFTLGVBQWUsQ0FBQyxRQUF1QjtJQUM5QyxRQUFRLFFBQVEsSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUMxQixLQUFLLEtBQUssQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMzQixLQUFLLEtBQUssQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMzQixLQUFLLE1BQU0sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDckMsQ0FBQztBQUNILENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsTUFBTSxVQUFVLGNBQWMsQ0FDNUIsU0FBaUIsRUFDakIsTUFBa0IsRUFDbEIsSUFBa0I7SUFFbEIsTUFBTSxTQUFTLEdBQUcsZUFBZSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNqRCxNQUFNLFFBQVEsR0FBYSxFQUFFLENBQUM7SUFFOUIsS0FBSyxNQUFNLEtBQUssSUFBSSxTQUFTLEVBQUUsQ0FBQztRQUM5QixZQUFZO1FBQ1osUUFBUSxDQUFDLElBQUksQ0FDWCxnQkFBZ0IsTUFBTSxJQUFJLFNBQVMsZUFBZSxLQUFLLFVBQVUsSUFBSSxDQUFDLFVBQVUsWUFBWSxJQUFJLENBQUMsVUFBVSxJQUFJLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FDakksQ0FBQztRQUVGLG1EQUFtRDtRQUNuRCxJQUFJLENBQUMsSUFBSSxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDM0IsUUFBUSxDQUFDLElBQUksQ0FDWCxnQkFBZ0IsTUFBTSxJQUFJLFNBQVMsZ0JBQWdCLEtBQUssVUFBVSxJQUFJLENBQUMsVUFBVSxhQUFhLENBQy9GLENBQUM7UUFDSixDQUFDO0lBQ0gsQ0FBQztJQUVELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUM7QUFFRDs7R0FFRztBQUNILE1BQU0sVUFBVSxhQUFhLENBQzNCLFNBQWlCLEVBQ2pCLE1BQWtCLEVBQ2xCLElBQWtCO0lBRWxCLE1BQU0sU0FBUyxHQUFHLGVBQWUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDakQsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBRTlCLEtBQUssTUFBTSxLQUFLLElBQUksU0FBUyxFQUFFLENBQUM7UUFDOUIsUUFBUSxDQUFDLElBQUksQ0FDWCxnQkFBZ0IsTUFBTSxJQUFJLFNBQVMsZ0JBQWdCLEtBQUssVUFBVSxJQUFJLENBQUMsVUFBVSxZQUFZLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FDbEgsQ0FBQztJQUNKLENBQUM7SUFFRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLFVBQVUsbUJBQW1CLENBQ2pDLFNBQWlCLEVBQ2pCLE1BQWtCLEVBQ2xCLElBQXdCO0lBRXhCLE1BQU0sU0FBUyxHQUFHLGVBQWUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDakQsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBRTlCLEtBQUssTUFBTSxLQUFLLElBQUksU0FBUyxFQUFFLENBQUM7UUFDOUIsUUFBUSxDQUFDLElBQUksQ0FDWCxnQkFBZ0IsTUFBTSxJQUFJLFNBQVMsZ0JBQWdCLEtBQUssVUFBVSxJQUFJLENBQUMsVUFBVSxhQUFhLENBQy9GLENBQUM7SUFDSixDQUFDO0lBRUQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyJ9

package/dist_ts/nft.rulebuilder.ratelimit.d.ts

@@ -0,0 +1,16 @@
+import type { TNftFamily, INftRateLimitRule, INftConnectionRateRule } from './nft.types.js';
+/**
+ * Build a rate limit rule.
+ * Packets exceeding the rate are subjected to the specified action (default: drop).
+ */
+export declare function buildRateLimitRule(tableName: string, family: TNftFamily, rule: INftRateLimitRule): string[];
+/**
+ * Build a per-IP rate limit rule using nft meters.
+ * Convenience wrapper around buildRateLimitRule with perSourceIP=true.
+ */
+export declare function buildPerIpRateLimitRule(tableName: string, family: TNftFamily, rule: Omit<INftRateLimitRule, 'perSourceIP'>): string[];
+/**
+ * Build a new-connection rate limit rule.
+ * Limits the rate of new connections (ct state new) on the given port.
+ */
+export declare function buildConnectionRateRule(tableName: string, family: TNftFamily, rule: INftConnectionRateRule): string[];

package/dist_ts/nft.rulebuilder.ratelimit.js

@@ -0,0 +1,61 @@
+/**
+ * Expand a protocol spec into concrete protocol strings.
+ */
+function expandProtocols(protocol) {
+    switch (protocol ?? 'tcp') {
+        case 'tcp': return ['tcp'];
+        case 'udp': return ['udp'];
+        case 'both': return ['tcp', 'udp'];
+    }
+}
+/**
+ * Build a rate limit rule.
+ * Packets exceeding the rate are subjected to the specified action (default: drop).
+ */
+export function buildRateLimitRule(tableName, family, rule) {
+    const protocols = expandProtocols(rule.protocol);
+    const chain = rule.chain ?? 'input';
+    const action = rule.action ?? 'drop';
+    const commands = [];
+    for (const proto of protocols) {
+        const portMatch = rule.port != null ? ` ${proto} dport ${rule.port}` : '';
+        const burstClause = rule.burst != null ? ` burst ${rule.burst} packets` : '';
+        if (rule.perSourceIP) {
+            // Per-IP rate limiting using nft meters
+            const meterName = `meter_${proto}_${rule.port ?? 'all'}`;
+            commands.push(`nft add rule ${family} ${tableName} ${chain}${portMatch} meter ${meterName} { ip saddr limit rate over ${rule.rate}${burstClause} } ${action}`);
+        }
+        else {
+            // Global rate limiting
+            commands.push(`nft add rule ${family} ${tableName} ${chain}${portMatch} limit rate over ${rule.rate}${burstClause} ${action}`);
+        }
+    }
+    return commands;
+}
+/**
+ * Build a per-IP rate limit rule using nft meters.
+ * Convenience wrapper around buildRateLimitRule with perSourceIP=true.
+ */
+export function buildPerIpRateLimitRule(tableName, family, rule) {
+    return buildRateLimitRule(tableName, family, { ...rule, perSourceIP: true });
+}
+/**
+ * Build a new-connection rate limit rule.
+ * Limits the rate of new connections (ct state new) on the given port.
+ */
+export function buildConnectionRateRule(tableName, family, rule) {
+    const protocols = expandProtocols(rule.protocol);
+    const commands = [];
+    for (const proto of protocols) {
+        const portMatch = rule.port != null ? ` ${proto} dport ${rule.port}` : '';
+        if (rule.perSourceIP) {
+            const meterName = `connrate_${proto}_${rule.port ?? 'all'}`;
+            commands.push(`nft add rule ${family} ${tableName} input ct state new${portMatch} meter ${meterName} { ip saddr limit rate over ${rule.rate} } drop`);
+        }
+        else {
+            commands.push(`nft add rule ${family} ${tableName} input ct state new${portMatch} limit rate over ${rule.rate} drop`);
+        }
+    }
+    return commands;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmZ0LnJ1bGVidWlsZGVyLnJhdGVsaW1pdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL25mdC5ydWxlYnVpbGRlci5yYXRlbGltaXQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUE7O0dBRUc7QUFDSCxTQUFTLGVBQWUsQ0FBQyxRQUFpQztJQUN4RCxRQUFRLFFBQVEsSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUMxQixLQUFLLEtBQUssQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMzQixLQUFLLEtBQUssQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMzQixLQUFLLE1BQU0sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDckMsQ0FBQztBQUNILENBQUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsa0JBQWtCLENBQ2hDLFNBQWlCLEVBQ2pCLE1BQWtCLEVBQ2xCLElBQXVCO0lBRXZCLE1BQU0sU0FBUyxHQUFHLGVBQWUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDakQsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLEtBQUssSUFBSSxPQUFPLENBQUM7SUFDcEMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUM7SUFDckMsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBRTlCLEtBQUssTUFBTSxLQUFLLElBQUksU0FBUyxFQUFFLENBQUM7UUFDOUIsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxVQUFVLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzFFLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxLQUFLLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxVQUFVLElBQUksQ0FBQyxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBRTdFLElBQUksSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ3JCLHdDQUF3QztZQUN4QyxNQUFNLFNBQVMsR0FBRyxTQUFTLEtBQUssSUFBSSxJQUFJLENBQUMsSUFBSSxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ3pELFFBQVEsQ0FBQyxJQUFJLENBQ1gsZ0JBQWdCLE1BQU0sSUFBSSxTQUFTLElBQUksS0FBSyxHQUFHLFNBQVMsVUFBVSxTQUFTLCtCQUErQixJQUFJLENBQUMsSUFBSSxHQUFHLFdBQVcsTUFBTSxNQUFNLEVBQUUsQ0FDaEosQ0FBQztRQUNKLENBQUM7YUFBTSxDQUFDO1lBQ04sdUJBQXVCO1lBQ3ZCLFFBQVEsQ0FBQyxJQUFJLENBQ1gsZ0JBQWdCLE1BQU0sSUFBSSxTQUFTLElBQUksS0FBSyxHQUFHLFNBQVMsb0JBQW9CLElBQUksQ0FBQyxJQUFJLEdBQUcsV0FBVyxJQUFJLE1BQU0sRUFBRSxDQUNoSCxDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLHVCQUF1QixDQUNyQyxTQUFpQixFQUNqQixNQUFrQixFQUNsQixJQUE0QztJQUU1QyxPQUFPLGtCQUFrQixDQUFDLFNBQVMsRUFBRSxNQUFNLEVBQUUsRUFBRSxHQUFHLElBQUksRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztBQUMvRSxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLHVCQUF1QixDQUNyQyxTQUFpQixFQUNqQixNQUFrQixFQUNsQixJQUE0QjtJQUU1QixNQUFNLFNBQVMsR0FBRyxlQUFlLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2pELE1BQU0sUUFBUSxHQUFhLEVBQUUsQ0FBQztJQUU5QixLQUFLLE1BQU0sS0FBSyxJQUFJLFNBQVMsRUFBRSxDQUFDO1FBQzlCLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxJQUFJLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssVUFBVSxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUUxRSxJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUNyQixNQUFNLFNBQVMsR0FBRyxZQUFZLEtBQUssSUFBSSxJQUFJLENBQUMsSUFBSSxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQzVELFFBQVEsQ0FBQyxJQUFJLENBQ1gsZ0JBQWdCLE1BQU0sSUFBSSxTQUFTLHNCQUFzQixTQUFTLFVBQVUsU0FBUywrQkFBK0IsSUFBSSxDQUFDLElBQUksU0FBUyxDQUN2SSxDQUFDO1FBQ0osQ0FBQzthQUFNLENBQUM7WUFDTixRQUFRLENBQUMsSUFBSSxDQUNYLGdCQUFnQixNQUFNLElBQUksU0FBUyxzQkFBc0IsU0FBUyxvQkFBb0IsSUFBSSxDQUFDLElBQUksT0FBTyxDQUN2RyxDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDIn0=

package/dist_ts/nft.rulebuilder.table.d.ts

@@ -0,0 +1,13 @@
+import type { TNftFamily } from './nft.types.js';
+/**
+ * Build commands to create the nftables table and NAT chains (prerouting + postrouting).
+ */
+export declare function buildTableSetup(tableName: string, family?: TNftFamily): string[];
+/**
+ * Build commands to create filter chains (input, forward, output).
+ */
+export declare function buildFilterChains(tableName: string, family?: TNftFamily): string[];
+/**
+ * Build command to delete the entire nftables table.
+ */
+export declare function buildTableCleanup(tableName: string, family?: TNftFamily): string[];

package/dist_ts/nft.rulebuilder.table.js

@@ -0,0 +1,27 @@
+/**
+ * Build commands to create the nftables table and NAT chains (prerouting + postrouting).
+ */
+export function buildTableSetup(tableName, family = 'ip') {
+    return [
+        `nft add table ${family} ${tableName}`,
+        `nft add chain ${family} ${tableName} prerouting { type nat hook prerouting priority 0 \\; }`,
+        `nft add chain ${family} ${tableName} postrouting { type nat hook postrouting priority 100 \\; }`,
+    ];
+}
+/**
+ * Build commands to create filter chains (input, forward, output).
+ */
+export function buildFilterChains(tableName, family = 'ip') {
+    return [
+        `nft add chain ${family} ${tableName} input { type filter hook input priority 0 \\; policy accept \\; }`,
+        `nft add chain ${family} ${tableName} forward { type filter hook forward priority 0 \\; policy accept \\; }`,
+        `nft add chain ${family} ${tableName} output { type filter hook output priority 0 \\; policy accept \\; }`,
+    ];
+}
+/**
+ * Build command to delete the entire nftables table.
+ */
+export function buildTableCleanup(tableName, family = 'ip') {
+    return [`nft delete table ${family} ${tableName}`];
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmZ0LnJ1bGVidWlsZGVyLnRhYmxlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvbmZ0LnJ1bGVidWlsZGVyLnRhYmxlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBOztHQUVHO0FBQ0gsTUFBTSxVQUFVLGVBQWUsQ0FBQyxTQUFpQixFQUFFLFNBQXFCLElBQUk7SUFDMUUsT0FBTztRQUNMLGlCQUFpQixNQUFNLElBQUksU0FBUyxFQUFFO1FBQ3RDLGlCQUFpQixNQUFNLElBQUksU0FBUyx5REFBeUQ7UUFDN0YsaUJBQWlCLE1BQU0sSUFBSSxTQUFTLDZEQUE2RDtLQUNsRyxDQUFDO0FBQ0osQ0FBQztBQUVEOztHQUVHO0FBQ0gsTUFBTSxVQUFVLGlCQUFpQixDQUFDLFNBQWlCLEVBQUUsU0FBcUIsSUFBSTtJQUM1RSxPQUFPO1FBQ0wsaUJBQWlCLE1BQU0sSUFBSSxTQUFTLG9FQUFvRTtRQUN4RyxpQkFBaUIsTUFBTSxJQUFJLFNBQVMsd0VBQXdFO1FBQzVHLGlCQUFpQixNQUFNLElBQUksU0FBUyxzRUFBc0U7S0FDM0csQ0FBQztBQUNKLENBQUM7QUFFRDs7R0FFRztBQUNILE1BQU0sVUFBVSxpQkFBaUIsQ0FBQyxTQUFpQixFQUFFLFNBQXFCLElBQUk7SUFDNUUsT0FBTyxDQUFDLG9CQUFvQixNQUFNLElBQUksU0FBUyxFQUFFLENBQUMsQ0FBQztBQUNyRCxDQUFDIn0=

package/dist_ts/nft.types.d.ts

@@ -0,0 +1,88 @@
+export type TNftProtocol = 'tcp' | 'udp' | 'both';
+export type TNftFamily = 'ip' | 'ip6' | 'inet';
+export type TNftChainHook = 'prerouting' | 'postrouting' | 'input' | 'output' | 'forward';
+export type TNftChainType = 'nat' | 'filter';
+export type TNftPolicy = 'accept' | 'drop';
+export type TFirewallAction = 'accept' | 'drop' | 'reject';
+export type TCtState = 'new' | 'established' | 'related' | 'invalid';
+export interface INftDnatRule {
+    sourcePort: number;
+    targetHost: string;
+    targetPort: number;
+    protocol?: TNftProtocol;
+    preserveSourceIP?: boolean;
+}
+export interface INftSnatRule {
+    sourceAddress: string;
+    targetPort: number;
+    protocol?: TNftProtocol;
+}
+export interface INftMasqueradeRule {
+    targetPort: number;
+    protocol?: TNftProtocol;
+}
+export interface INftRateLimitRule {
+    /** Port to rate-limit on. If omitted, applies to all ports. */
+    port?: number;
+    protocol?: TNftProtocol;
+    /** Rate expression, e.g. "100/second", "10 mbytes/second" */
+    rate: string;
+    /** Burst allowance in packets or bytes */
+    burst?: number;
+    /** If true, track rate per source IP using nft meters */
+    perSourceIP?: boolean;
+    /** Action for packets exceeding rate. Default: 'drop' */
+    action?: TFirewallAction;
+    /** Chain to apply the rule to. Default: 'input' */
+    chain?: 'input' | 'forward' | 'prerouting';
+}
+export interface INftConnectionRateRule {
+    /** Port to limit new connections on */
+    port?: number;
+    protocol?: TNftProtocol;
+    /** New connection rate, e.g. "10/second" */
+    rate: string;
+    /** If true, track per source IP */
+    perSourceIP?: boolean;
+}
+export interface INftFirewallRule {
+    direction: 'input' | 'output' | 'forward';
+    action: TFirewallAction;
+    sourceIP?: string;
+    destIP?: string;
+    sourcePort?: number;
+    destPort?: number;
+    protocol?: TNftProtocol;
+    ctStates?: TCtState[];
+    comment?: string;
+}
+export interface INftIPSetConfig {
+    name: string;
+    type: 'ipv4_addr' | 'ipv6_addr' | 'inet_service';
+    elements?: string[];
+    comment?: string;
+}
+export interface INftRuleGroup {
+    id: string;
+    commands: string[];
+    createdAt: number;
+}
+export interface ISmartNftablesOptions {
+    /** nftables table name. Default: 'smartnftables' */
+    tableName?: string;
+    /** Address family. Default: 'ip' */
+    family?: TNftFamily;
+    /** If true, generate commands but never execute them */
+    dryRun?: boolean;
+}
+export interface INftStatus {
+    initialized: boolean;
+    tableName: string;
+    family: TNftFamily;
+    isRoot: boolean;
+    activeGroups: number;
+    groups: Record<string, {
+        ruleCount: number;
+        createdAt: number;
+    }>;
+}

package/dist_ts/nft.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmZ0LnR5cGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvbmZ0LnR5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/dist_ts/plugins.d.ts

@@ -0,0 +1,6 @@
+import * as childProcess from 'node:child_process';
+import * as util from 'node:util';
+export { childProcess, util, };
+import * as smartlog from '@push.rocks/smartlog';
+import * as smartpromise from '@push.rocks/smartpromise';
+export { smartlog, smartpromise, };

package/dist_ts/plugins.js

@@ -0,0 +1,9 @@
+// node native scope
+import * as childProcess from 'node:child_process';
+import * as util from 'node:util';
+export { childProcess, util, };
+// @push.rocks scope
+import * as smartlog from '@push.rocks/smartlog';
+import * as smartpromise from '@push.rocks/smartpromise';
+export { smartlog, smartpromise, };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxZQUFZLE1BQU0sb0JBQW9CLENBQUM7QUFDbkQsT0FBTyxLQUFLLElBQUksTUFBTSxXQUFXLENBQUM7QUFFbEMsT0FBTyxFQUNMLFlBQVksRUFDWixJQUFJLEdBQ0wsQ0FBQztBQUVGLG9CQUFvQjtBQUNwQixPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxFQUNMLFFBQVEsRUFDUixZQUFZLEdBQ2IsQ0FBQyJ9

package/license

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Task Venture Capital GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@push.rocks/smartnftables",
+  "version": "1.0.1",
+  "private": false,
+  "description": "A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.",
+  "main": "dist_ts/index.js",
+  "typings": "dist_ts/index.d.ts",
+  "type": "module",
+  "author": "Lossless GmbH",
+  "license": "MIT",
+  "scripts": {
+    "test": "(tstest test/**/test*.ts --verbose --timeout 60)",
+    "build": "(tsbuild tsfolders)",
+    "format": "(gitzone format)",
+    "buildDocs": "tsdoc"
+  },
+  "devDependencies": {
+    "@git.zone/tsbuild": "^4.4.0",
+    "@git.zone/tsrun": "^2.0.2",
+    "@git.zone/tstest": "^3.6.0",
+    "@types/node": "^25.5.0",
+    "typescript": "^6.0.2"
+  },
+  "dependencies": {
+    "@push.rocks/smartlog": "^3.2.1",
+    "@push.rocks/smartpromise": "^4.2.3"
+  },
+  "files": [
+    "ts/**/*",
+    "dist/**/*",
+    "dist_*/**/*",
+    "dist_ts/**/*",
+    "assets/**/*",
+    "readme.md",
+    "changelog.md"
+  ],
+  "keywords": [
+    "nftables",
+    "firewall",
+    "nat",
+    "rate limiting",
+    "network",
+    "linux",
+    "packet filter",
+    "port forwarding",
+    "ip sets",
+    "kernel firewall"
+  ],
+  "homepage": "https://code.foss.global/push.rocks/smartnftables#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://code.foss.global/push.rocks/smartnftables.git"
+  },
+  "bugs": {
+    "url": "https://code.foss.global/push.rocks/smartnftables/issues"
+  }
+}