@stacksjs/ts-cloud 0.16.34 → 0.16.36

package/dist/chunk-3nqtbyfp.js

@@ -0,0 +1,14 @@
+var v;try{v=await import("node:crypto")}catch{}var C=new Map,_=100,ee={appstream2:"appstream",cloudhsmv2:"cloudhsm",email:"ses",marketplace:"aws-marketplace",mobile:"AWSMobileHubService",pinpoint:"mobiletargeting",queue:"sqs","git-codecommit":"codecommit","mturk-requester-sandbox":"mturk-requester","personalize-runtime":"personalize"};function vl(e){let n=typeof e==="string"?new URL(e):e,{hostname:t,pathname:s}=n;if(t.endsWith(".on.aws")){let a=t.match(/^[^.]+\.lambda-url\.([^.]+)\.on\.aws$/);if(a)return{service:"lambda",region:a[1]};return{service:"",region:""}}if(t.endsWith(".r2.cloudflarestorage.com"))return{service:"s3",region:"auto"};if(t.endsWith(".backblazeb2.com")){let a=t.match(/^(?:[^.]+\.)?s3\.([^.]+)\.backblazeb2\.com$/);if(a)return{service:"s3",region:a[1]};return{service:"",region:""}}let c=t.replace("dualstack.","").match(/([^.]+)\.(?:([^.]+)\.)?amazonaws\.com(?:\.cn)?$/);if(!c)return{service:"",region:""};let r=c[1],i=c[2]||"";if(i==="us-gov")i="us-gov-west-1";else if(i==="s3"||i==="s3-accelerate")i="us-east-1",r="s3";else if(r==="iot")if(t.startsWith("iot."))r="execute-api";else if(t.startsWith("data.jobs.iot."))r="iot-jobs-data";else r=s==="/mqtt"?"iotdevicegateway":"iotdata";else if(r==="autoscaling");else if(!i&&r.startsWith("s3-"))i=r.slice(3).replace(/^fips-|^external-1/,""),r="s3";else if(r.endsWith("-fips"))r=r.slice(0,-5);else if(i&&/-\d$/.test(r)&&!/-\d$/.test(i))[r,i]=[i,r];return r=ee[r]||r,{service:r,region:i||"us-east-1"}}function R(e){let{method:n,url:t,body:s="",accessKeyId:c,secretAccessKey:r,sessionToken:i,signQuery:a=!1,expiresIn:h=86400,datetime:m}=e,d=new URL(t),f=d.hostname,p=vl(d),u=e.service||p.service,g=e.region||p.region;if(!u)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!g)throw Error("Could not detect region from URL. Please provide region explicitly.");let o=m||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),y=o.substring(0,8),S=[y,g,u,"aws4_request"].join("/"),b="AWS4-HMAC-SHA256";if(a)return te({urlObj:d,method:n,body:s,accessKeyId:c,secretAccessKey:r,sessionToken:i,service:u,region:g,timestamp:o,date:y,credentialScope:S,algorithm:b,expiresIn:h,cache:e.cache});let A=d.pathname||"/",x=j(d.searchParams),l={host:f,"x-amz-date":o,...e.headers};if(i)l["x-amz-security-token"]=i;let P=Object.keys(l).some((B)=>B.toLowerCase()==="content-type");if(s&&!P)l["content-type"]="application/x-amz-json-1.0";if(u==="s3"&&!l["x-amz-content-sha256"])l["x-amz-content-sha256"]=U(s);let q=N(l),w=G(l),k=l["x-amz-content-sha256"]||U(s),M=[n,O(A),x,q,w,k].join(`
+`),K=U(M),W=[b,o,S,K].join(`
+`),L=e.cache??C,X=J(r,y,g,u,W,L),D=[`${b} Credential=${c}/${S}`,`SignedHeaders=${w}`,`Signature=${X}`].join(", ");return l.authorization=D,{url:t,method:n,headers:l,body:s||void 0}}async function Tl(e){let{method:n,url:t,body:s="",accessKeyId:c,secretAccessKey:r,sessionToken:i,signQuery:a=!1,expiresIn:h=86400,datetime:m}=e,d=new URL(t),f=d.hostname,p=vl(d),u=e.service||p.service,g=e.region||p.region;if(!u)throw Error("Could not detect service from URL. Please provide service explicitly.");if(!g)throw Error("Could not detect region from URL. Please provide region explicitly.");let o=m||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),y=o.substring(0,8),S=[y,g,u,"aws4_request"].join("/"),b="AWS4-HMAC-SHA256";if(a)return ne({urlObj:d,method:n,body:s,accessKeyId:c,secretAccessKey:r,sessionToken:i,service:u,region:g,timestamp:o,date:y,credentialScope:S,algorithm:b,expiresIn:h,cache:e.cache});let A=d.pathname||"/",x=j(d.searchParams),l={host:f,"x-amz-date":o,...e.headers};if(i)l["x-amz-security-token"]=i;let P=Object.keys(l).some((F)=>F.toLowerCase()==="content-type");if(s&&!P)l["content-type"]="application/x-amz-json-1.0";let q=await T(s);if(u==="s3"&&!l["x-amz-content-sha256"])l["x-amz-content-sha256"]=q;let w=N(l),k=G(l),M=l["x-amz-content-sha256"]||q,K=[n,O(A),x,w,k,M].join(`
+`),W=await T(K),L=[b,o,S,W].join(`
+`),X=e.cache??C,D=await V(r,y,g,u,L,X),B=[`${b} Credential=${c}/${S}`,`SignedHeaders=${k}`,`Signature=${D}`].join(", ");return l.authorization=B,{url:t,method:n,headers:l,body:s||void 0}}function te(e){let{urlObj:n,method:t,body:s,accessKeyId:c,secretAccessKey:r,sessionToken:i,service:a,region:h,timestamp:m,date:d,credentialScope:f,algorithm:p,expiresIn:u,cache:g}=e,o=new URL(n.toString());o.searchParams.set("X-Amz-Algorithm",p),o.searchParams.set("X-Amz-Credential",`${c}/${f}`),o.searchParams.set("X-Amz-Date",m),o.searchParams.set("X-Amz-Expires",String(u));let y=a==="s3"?"UNSIGNED-PAYLOAD":U(s);if(a==="s3")o.searchParams.set("X-Amz-Content-Sha256",y);let S="host";if(o.searchParams.set("X-Amz-SignedHeaders",S),i)o.searchParams.set("X-Amz-Security-Token",i);let b=O(o.pathname||"/"),A=`host:${o.hostname}
+`,x=j(o.searchParams),l=[t,b,x,A,S,y].join(`
+`),P=[p,m,f,U(l)].join(`
+`),w=J(r,d,h,a,P,g??C);return o.searchParams.set("X-Amz-Signature",w),{url:o.toString(),method:t,headers:{},body:s||void 0}}async function ne(e){let{urlObj:n,method:t,body:s,accessKeyId:c,secretAccessKey:r,sessionToken:i,service:a,region:h,timestamp:m,date:d,credentialScope:f,algorithm:p,expiresIn:u,cache:g}=e,o=new URL(n.toString());o.searchParams.set("X-Amz-Algorithm",p),o.searchParams.set("X-Amz-Credential",`${c}/${f}`),o.searchParams.set("X-Amz-Date",m),o.searchParams.set("X-Amz-Expires",String(u));let y=a==="s3"?"UNSIGNED-PAYLOAD":await T(s);if(a==="s3")o.searchParams.set("X-Amz-Content-Sha256",y);let S="host";if(o.searchParams.set("X-Amz-SignedHeaders",S),i)o.searchParams.set("X-Amz-Security-Token",i);let b=O(o.pathname||"/"),A=`host:${o.hostname}
+`,x=j(o.searchParams),l=[t,b,x,A,S,y].join(`
+`),P=[p,m,f,await T(l)].join(`
+`),w=await V(r,d,h,a,P,g??C);return o.searchParams.set("X-Amz-Signature",w),{url:o.toString(),method:t,headers:{},body:s||void 0}}function Oo(e){let{url:n,method:t="GET",expiresIn:s=3600,...c}=e,r=Math.min(s,604800);return R({...c,url:n,method:t,signQuery:!0,expiresIn:r}).url}async function Qy(e){let{url:n,method:t="GET",expiresIn:s=3600,...c}=e,r=Math.min(s,604800);return(await Tl({...c,url:n,method:t,signQuery:!0,expiresIn:r})).url}function N(e){return Object.keys(e).sort().map((n)=>`${n.toLowerCase()}:${e[n].trim().replace(/\s+/g," ")}`).join(`
+`)+`
+`}function G(e){return Object.keys(e).sort().map((n)=>n.toLowerCase()).join(";")}function j(e){let n=[];return e.forEach((t,s)=>{n.push([Q(s),Q(t)])}),n.sort((t,s)=>{if(t[0]<s[0])return-1;if(t[0]>s[0])return 1;if(t[1]<s[1])return-1;if(t[1]>s[1])return 1;return 0}),n.map(([t,s])=>`${t}=${s}`).join("&")}function O(e){return e.split("/").map((n)=>Q(n)).join("/")}function Q(e){return encodeURIComponent(e).replace(/[!'()*]/g,(n)=>`%${n.charCodeAt(0).toString(16).toUpperCase()}`)}function U(e){if(!v)throw Error("Synchronous hash not available in browser. Use signRequestAsync() instead.");return v.createHash("sha256").update(e,"utf8").digest("hex")}function z(e,n){if(!v)throw Error("Synchronous hmac not available in browser. Use signRequestAsync() instead.");return v.createHmac("sha256",e).update(n,"utf8").digest()}async function T(e){let t=new TextEncoder().encode(e),s=await crypto.subtle.digest("SHA-256",t);return Y(new Uint8Array(s))}async function E(e,n){let t=new TextEncoder,s=typeof e==="string"?t.encode(e):e,c=t.encode(n),r=await crypto.subtle.importKey("raw",s.buffer,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),i=await crypto.subtle.sign("HMAC",r,c.buffer);return new Uint8Array(i)}function Y(e){return Array.from(e).map((n)=>n.toString(16).padStart(2,"0")).join("")}function J(e,n,t,s,c,r){let i=`${e}:${n}:${t}:${s}`,a=r.get(i);if(!a){let h=z(`AWS4${e}`,n),m=z(h,t),d=z(m,s);if(a=z(d,"aws4_request"),r.size>=_){let f=r.keys().next().value;if(f)r.delete(f)}r.set(i,a)}return z(a,c).toString("hex")}async function V(e,n,t,s,c,r){let i=`${e}:${n}:${t}:${s}`,a=r.get(i);if(!a){let m=await E(`AWS4${e}`,n),d=await E(m,t),f=await E(d,s);if(a=await E(f,"aws4_request"),r.size>=_){let p=r.keys().next().value;if(p)r.delete(p)}r.set(i,a)}let h=await E(a,c);return Y(h)}function Z(e,n){return n.includes(e)}function H(e,n,t){let s=n*Math.pow(2,e),c=Math.random()*0.3*s;return Math.min(s+c,t)}function I(e){return new Promise((n)=>setTimeout(n,e))}async function cf(e,n){let{maxRetries:t=3,initialDelayMs:s=100,maxDelayMs:c=5000,retryableStatusCodes:r=[429,500,502,503,504],timeoutMs:i=30000}=n??{},a,h;for(let m=0;m<=t;m++){let d=R(e),f={method:d.method,headers:d.headers};if(d.body)f.body=d.body;let p=new AbortController,u=setTimeout(()=>p.abort(),i);f.signal=p.signal;try{let g=await fetch(d.url,f);if(clearTimeout(u),h=g,g.ok)return g;if(m<t&&Z(g.status,r)){let y=H(m,s,c);await I(y);continue}let o=await g.text();throw Error(`AWS API request failed (${g.status}): ${o}`)}catch(g){if(clearTimeout(u),a=g,g instanceof Error&&g.name==="AbortError")a=Error(`Request timed out after ${i}ms`);if(m<t&&!(g instanceof Error&&g.message.includes("AWS API request failed"))){let o=H(m,s,c);await I(o);continue}throw a}}throw a??Error("Request failed after retries")}async function Hy(e){return cf(e,{maxRetries:0})}async function Gy(e,n){let{maxRetries:t=3,initialDelayMs:s=100,maxDelayMs:c=5000,retryableStatusCodes:r=[429,500,502,503,504],timeoutMs:i=30000}=n??{},a;for(let h=0;h<=t;h++){let m=await Tl(e),d={method:m.method,headers:m.headers};if(m.body)d.body=m.body;let f=new AbortController,p=setTimeout(()=>f.abort(),i);d.signal=f.signal;try{let u=await fetch(m.url,d);if(clearTimeout(p),u.ok)return u;if(h<t&&Z(u.status,r)){let o=H(h,s,c);await I(o);continue}let g=await u.text();throw Error(`AWS API request failed (${u.status}): ${g}`)}catch(u){if(clearTimeout(p),a=u,u instanceof Error&&u.name==="AbortError")a=Error(`Request timed out after ${i}ms`);if(h<t&&!(u instanceof Error&&u.message.includes("AWS API request failed"))){let g=H(h,s,c);await I(g);continue}throw a}}throw a??Error("Request failed after retries")}async function Vy(e){let n=await e.text(),t={},s=/<(\w+)>([^<]+)<\/\1>/g,c;while((c=s.exec(n))!==null){let[,r,i]=c;t[r]=i}return t}async function qy(e){return await e.json()}function jy(){C.clear()}function zy(){return C.size}function Ky(){return v!==void 0}function Wy(){return typeof crypto<"u"&&typeof crypto.subtle<"u"}
+export{vl,R,Tl,Oo,Qy,cf,Hy,Gy,Vy,qy,jy,zy,Ky,Wy};

package/dist/{chunk-v9t4751b.js → chunk-50m6sq01.js}

@@ -1,8 +1,8 @@
-var l={mode:"detection",paranoiaLevel:1,inboundThreshold:5,outboundThreshold:4,maxBodyBytes:13107200,rejectOversizedBody:!0,auditLogPath:"/var/log/ts-cloud/waf-audit.log",blockStatus:403},d={bypassBase:1e5,exclusionBase:101000,rateLimitBase:102000,customBase:109000};function Y(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/[\r\n]+/g," ")}function ci(e){if(e.length>1000)return!1;if(/\([^)]*[+*]\)[+*]/.test(e))return!1;if(/\[[^\]]*\][+*]\{/.test(e))return!1;try{return new RegExp(e),!0}catch{return!1}}function b(e,r){let t=[],o=[],s=r;for(let n of e){if(n.enabled===!1)continue;if(n.key&&(n.key.source==="cookie"||n.key.source==="header")&&!n.key.name){o.push({ruleId:n.id,reason:"The rule keys on a header or cookie but names none."});continue}let c=n.path?Ms(n.path):".*";if(!ci(c)){o.push({ruleId:n.id,reason:"The path pattern compiles to an unsafe regular expression."});continue}let u=[`SecRule REQUEST_URI "@rx ${Y(c)}"`];if(n.methods?.length)u.push(`  "chain,id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${Y(n.id)}'"`);else u.push(`  "id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${Y(n.id)}'"`);if(t.push(`# Marks requests governed by the ts-cloud rate limit "${Y(n.id)}".`),t.push(u.join(" \\\n")),n.methods?.length)t.push(`  SecRule REQUEST_METHOD "@within ${Y(n.methods.join(" ").toUpperCase())}" "t:none"`);t.push(""),s++}return{lines:t,unmapped:o}}function Ms(e){return`^${e.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*")}$`}function _c(e={},r=[]){let t=e.mode??l.mode,o=[],s=e.paranoiaLevel??l.paranoiaLevel,n=e.inboundThreshold??l.inboundThreshold,c=e.outboundThreshold??l.outboundThreshold,u=e.maxBodyBytes??l.maxBodyBytes,h=e.rejectOversizedBody!==!1;if(t==="blocking"&&s>=3)o.push(`Paranoia level ${s} blocks legitimate traffic on most applications until it is tuned. Run it in detection mode first.`);if(t==="blocking")o.push("zig-waf is pre-alpha. Blocking mode makes it a failure path for every request.");if(!h)o.push("Oversized bodies are passed through uninspected, so padding a request bypasses every rule.");if(e.bypassPaths?.length)o.push(`${e.bypassPaths.length} path(s) bypass inspection entirely.`);let i=["# Managed by ts-cloud. Edits are overwritten on the next deploy.",`# Mode: ${t}. Paranoia level: ${s}.`,""];if(t==="off")return i.push("SecRuleEngine Off",""),{config:`${i.join(`
+var l={mode:"detection",paranoiaLevel:1,inboundThreshold:5,outboundThreshold:4,maxBodyBytes:13107200,rejectOversizedBody:!0,auditLogPath:"/var/log/ts-cloud/waf-audit.log",blockStatus:403},d={bypassBase:1e5,exclusionBase:101000,rateLimitBase:102000,customBase:109000};function Z(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/[\r\n]+/g," ")}function mi(e){if(e.length>1000)return!1;if(/\([^)]*[+*]\)[+*]/.test(e))return!1;if(/\[[^\]]*\][+*]\{/.test(e))return!1;try{return new RegExp(e),!0}catch{return!1}}function b(e,r){let t=[],o=[],s=r;for(let n of e){if(n.enabled===!1)continue;if(n.key&&(n.key.source==="cookie"||n.key.source==="header")&&!n.key.name){o.push({ruleId:n.id,reason:"The rule keys on a header or cookie but names none."});continue}let c=n.path?js(n.path):".*";if(!mi(c)){o.push({ruleId:n.id,reason:"The path pattern compiles to an unsafe regular expression."});continue}let u=[`SecRule REQUEST_URI "@rx ${Z(c)}"`];if(n.methods?.length)u.push(`  "chain,id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${Z(n.id)}'"`);else u.push(`  "id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${Z(n.id)}'"`);if(t.push(`# Marks requests governed by the ts-cloud rate limit "${Z(n.id)}".`),t.push(u.join(" \\\n")),n.methods?.length)t.push(`  SecRule REQUEST_METHOD "@within ${Z(n.methods.join(" ").toUpperCase())}" "t:none"`);t.push(""),s++}return{lines:t,unmapped:o}}function js(e){return`^${e.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*")}$`}function Uc(e={},r=[]){let t=e.mode??l.mode,o=[],s=e.paranoiaLevel??l.paranoiaLevel,n=e.inboundThreshold??l.inboundThreshold,c=e.outboundThreshold??l.outboundThreshold,u=e.maxBodyBytes??l.maxBodyBytes,h=e.rejectOversizedBody!==!1;if(t==="blocking"&&s>=3)o.push(`Paranoia level ${s} blocks legitimate traffic on most applications until it is tuned. Run it in detection mode first.`);if(t==="blocking")o.push("zig-waf is pre-alpha. Blocking mode makes it a failure path for every request.");if(!h)o.push("Oversized bodies are passed through uninspected, so padding a request bypasses every rule.");if(e.bypassPaths?.length)o.push(`${e.bypassPaths.length} path(s) bypass inspection entirely.`);let i=["# Managed by ts-cloud. Edits are overwritten on the next deploy.",`# Mode: ${t}. Paranoia level: ${s}.`,""];if(t==="off")return i.push("SecRuleEngine Off",""),{config:`${i.join(`
 `)}
-`,unmappedRateLimits:[],warnings:o,mode:t};i.push(`SecRuleEngine ${t==="blocking"?"On":"DetectionOnly"}`,"SecRequestBodyAccess On","SecResponseBodyAccess Off",`SecRequestBodyLimit ${u}`,`SecRequestBodyNoFilesLimit ${Math.min(u,131072)}`,`SecRequestBodyLimitAction ${h?"Reject":"ProcessPartial"}`,"SecRequestBodyInMemoryLimit 131072",`SecAuditEngine ${t==="blocking"?"RelevantOnly":"On"}`,"SecAuditLogParts ABIJDEFHZ",`SecAuditLog ${Y(e.auditLogPath??l.auditLogPath)}`,"SecAuditLogType Serial",`SecDefaultAction "phase:1,log,auditlog,${t==="blocking"?`deny,status:${e.blockStatus??l.blockStatus}`:"pass"}"`,"","# CRS anomaly scoring setup.",`SecAction "id:900000,phase:1,pass,nolog,t:none,setvar:tx.paranoia_level=${s}"`,`SecAction "id:900001,phase:1,pass,nolog,t:none,setvar:tx.inbound_anomaly_score_threshold=${n}"`,`SecAction "id:900002,phase:1,pass,nolog,t:none,setvar:tx.outbound_anomaly_score_threshold=${c}"`,'SecAction "id:900003,phase:1,pass,nolog,t:none,setvar:tx.critical_anomaly_score=5,setvar:tx.error_anomaly_score=4,setvar:tx.warning_anomaly_score=3,setvar:tx.notice_anomaly_score=2"','SecAction "id:900004,phase:1,pass,nolog,t:none,setvar:tx.anomaly_score=0"',"");let g=d.bypassBase;for(let a of e.bypassPaths??[]){let y=Ms(a);if(!ci(y)){o.push(`Bypass path "${a}" was dropped: it compiles to an unsafe regular expression.`);continue}i.push(`# Inspection bypass for ${Y(a)}. Every bypass is an unguarded route.`,`SecRule REQUEST_URI "@rx ${Y(y)}" "id:${g},phase:1,pass,nolog,ctl:ruleEngine=Off"`,""),g++}let m=d.exclusionBase;for(let a of e.exclusions??[]){if(!Number.isInteger(a.ruleId)||a.ruleId<=0){o.push(`Exclusion with rule id "${a.ruleId}" was dropped: the id is not a positive integer.`);continue}if(i.push(`# ${Y(a.reason)}`),a.pathPattern){if(!ci(a.pathPattern)){o.push(`Exclusion for rule ${a.ruleId} was dropped: its path pattern is unsafe.`);continue}i.push(`SecRule REQUEST_URI "@rx ${Y(a.pathPattern)}" "id:${m},phase:1,pass,nolog,ctl:ruleRemoveById=${a.ruleId}"`),m++}else i.push(`SecRuleRemoveById ${a.ruleId}`);i.push("")}let p=b(r,d.rateLimitBase);if(p.lines.length>0)i.push("# Rate-limit route markers. SecLang has no counters, so the tag is set","# here and the counting stays in the ts-cloud limiter.",...p.lines);let f=d.customBase;for(let a of e.customRules??[])i.push(`# Operator-supplied rule ${f}.`,a.trim(),""),f++;if(t==="blocking")i.push("# Blocking decision: one rule, at the end, on the accumulated score.",`SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:949110,phase:2,deny,status:${e.blockStatus??l.blockStatus},log,msg:'Inbound anomaly score exceeded (total: %{tx.anomaly_score})'"`,"");return{config:`${i.join(`
+`,unmappedRateLimits:[],warnings:o,mode:t};i.push(`SecRuleEngine ${t==="blocking"?"On":"DetectionOnly"}`,"SecRequestBodyAccess On","SecResponseBodyAccess Off",`SecRequestBodyLimit ${u}`,`SecRequestBodyNoFilesLimit ${Math.min(u,131072)}`,`SecRequestBodyLimitAction ${h?"Reject":"ProcessPartial"}`,"SecRequestBodyInMemoryLimit 131072",`SecAuditEngine ${t==="blocking"?"RelevantOnly":"On"}`,"SecAuditLogParts ABIJDEFHZ",`SecAuditLog ${Z(e.auditLogPath??l.auditLogPath)}`,"SecAuditLogType Serial",`SecDefaultAction "phase:1,log,auditlog,${t==="blocking"?`deny,status:${e.blockStatus??l.blockStatus}`:"pass"}"`,"","# CRS anomaly scoring setup.",`SecAction "id:900000,phase:1,pass,nolog,t:none,setvar:tx.paranoia_level=${s}"`,`SecAction "id:900001,phase:1,pass,nolog,t:none,setvar:tx.inbound_anomaly_score_threshold=${n}"`,`SecAction "id:900002,phase:1,pass,nolog,t:none,setvar:tx.outbound_anomaly_score_threshold=${c}"`,'SecAction "id:900003,phase:1,pass,nolog,t:none,setvar:tx.critical_anomaly_score=5,setvar:tx.error_anomaly_score=4,setvar:tx.warning_anomaly_score=3,setvar:tx.notice_anomaly_score=2"','SecAction "id:900004,phase:1,pass,nolog,t:none,setvar:tx.anomaly_score=0"',"");let g=d.bypassBase;for(let a of e.bypassPaths??[]){let y=js(a);if(!mi(y)){o.push(`Bypass path "${a}" was dropped: it compiles to an unsafe regular expression.`);continue}i.push(`# Inspection bypass for ${Z(a)}. Every bypass is an unguarded route.`,`SecRule REQUEST_URI "@rx ${Z(y)}" "id:${g},phase:1,pass,nolog,ctl:ruleEngine=Off"`,""),g++}let m=d.exclusionBase;for(let a of e.exclusions??[]){if(!Number.isInteger(a.ruleId)||a.ruleId<=0){o.push(`Exclusion with rule id "${a.ruleId}" was dropped: the id is not a positive integer.`);continue}if(i.push(`# ${Z(a.reason)}`),a.pathPattern){if(!mi(a.pathPattern)){o.push(`Exclusion for rule ${a.ruleId} was dropped: its path pattern is unsafe.`);continue}i.push(`SecRule REQUEST_URI "@rx ${Z(a.pathPattern)}" "id:${m},phase:1,pass,nolog,ctl:ruleRemoveById=${a.ruleId}"`),m++}else i.push(`SecRuleRemoveById ${a.ruleId}`);i.push("")}let p=b(r,d.rateLimitBase);if(p.lines.length>0)i.push("# Rate-limit route markers. SecLang has no counters, so the tag is set","# here and the counting stays in the ts-cloud limiter.",...p.lines);let f=d.customBase;for(let a of e.customRules??[])i.push(`# Operator-supplied rule ${f}.`,a.trim(),""),f++;if(t==="blocking")i.push("# Blocking decision: one rule, at the end, on the accumulated score.",`SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:949110,phase:2,deny,status:${e.blockStatus??l.blockStatus},log,msg:'Inbound anomaly score exceeded (total: %{tx.anomaly_score})'"`,"");return{config:`${i.join(`
 `)}
-`,unmappedRateLimits:p.unmapped,warnings:o,mode:t}}function di(e={},r=[],t={}){let o=t.binary??"/usr/local/bin/zig-waf",s=t.configPath??"/etc/ts-cloud/waf.conf",n=_c(e,r);return`#!/usr/bin/env bash
+`,unmappedRateLimits:p.unmapped,warnings:o,mode:t}}function fi(e={},r=[],t={}){let o=t.binary??"/usr/local/bin/zig-waf",s=t.configPath??"/etc/ts-cloud/waf.conf",n=Uc(e,r);return`#!/usr/bin/env bash
 # Managed by ts-cloud. Installs the zig-waf ruleset.
 set -euo pipefail
 
@@ -33,5 +33,5 @@ fi
 
 mv "${s}.new" "${s}"
 echo "ts-cloud: WAF config installed (mode: ${n.mode})"
-`}function yp(e,r){return e.map((t)=>({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"event",source:"zig-waf",name:t.action==="blocked"?"waf.blocked":"waf.matched",timestamp:t.timestamp,value:1,host:t.host,pathTemplate:t.path,method:t.method,attributes:{ruleId:t.ruleId??null,anomalyScore:t.anomalyScore,action:t.action,messages:t.messages.slice(0,5)}}))}
-export{Y,ci,Ms,_c,di,yp};
+`}function qg(e,r){return e.map((t)=>({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"event",source:"zig-waf",name:t.action==="blocked"?"waf.blocked":"waf.matched",timestamp:t.timestamp,value:1,host:t.host,pathTemplate:t.path,method:t.method,attributes:{ruleId:t.ruleId??null,anomalyScore:t.anomalyScore,action:t.action,messages:t.messages.slice(0,5)}}))}
+export{Z,mi,js,Uc,fi,qg};