@stacksjs/ts-cloud 0.7.108 → 0.7.109

package/dist/{chunk-fmt40tpw.js → chunk-53jatzaw.js}

@@ -1,9 +1,9 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-3g4r09dd.js";
+} from "./chunk-wmbep3b5.js";
 import"./chunk-50jpda9q.js";
-import"./chunk-c6db5m63.js";
 import"./chunk-zqtpg06c.js";
+import"./chunk-t2s3gdq6.js";
 import"./chunk-v0bahtg2.js";
 export {
   buildAndPushServerlessImage

package/dist/{chunk-ef2dwfrg.js → chunk-8kh577qh.js}

@@ -8,12 +8,12 @@ import {
   UnifiedDnsValidator,
   createDnsProvider
 } from "./chunk-gttvakpv.js";
-import {
-  CloudFormationClient
-} from "./chunk-4cjrg98a.js";
 import {
   Route53Client
 } from "./chunk-32e7ya18.js";
+import {
+  CloudFormationClient
+} from "./chunk-4cjrg98a.js";
 import {
   S3Client
 } from "./chunk-wj3s95p9.js";
@@ -815,7 +815,7 @@ async function deployStaticSiteWithExternalDnsFull(config) {
     }
   }
   onProgress?.("upload", "Uploading files to S3...");
-  const { uploadStaticFiles } = await import("./chunk-s9c2x5jv.js");
+  const { uploadStaticFiles } = await import("./chunk-9v2pwxv9.js");
   const uploadResult = await uploadStaticFiles({
     sourceDir,
     bucket: infraResult.bucket,
@@ -835,7 +835,7 @@ async function deployStaticSiteWithExternalDnsFull(config) {
   }
   if (infraResult.distributionId && uploadResult.uploaded > 0) {
     onProgress?.("invalidate", "Invalidating CloudFront cache...");
-    const { invalidateCache } = await import("./chunk-s9c2x5jv.js");
+    const { invalidateCache } = await import("./chunk-9v2pwxv9.js");
     await invalidateCache(infraResult.distributionId);
   }
   onProgress?.("complete", "Deployment complete!");

package/dist/{chunk-s9c2x5jv.js → chunk-9v2pwxv9.js}

@@ -5,11 +5,11 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-ef2dwfrg.js";
+} from "./chunk-8kh577qh.js";
 import"./chunk-01d86gt1.js";
 import"./chunk-gttvakpv.js";
-import"./chunk-4cjrg98a.js";
 import"./chunk-32e7ya18.js";
+import"./chunk-4cjrg98a.js";
 import"./chunk-wj3s95p9.js";
 import"./chunk-zqtpg06c.js";
 import"./chunk-v0bahtg2.js";

package/dist/chunk-aa2dkn7b.js

@@ -0,0 +1,205 @@
+// src/protection/ddos.ts
+var DEFAULT_DDOS_THRESHOLDS = {
+  newConnectionsPerSecond: 50,
+  concurrentPerSource: 100,
+  synPerSecond: 2000,
+  burst: 100,
+  icmpPerSecond: 5,
+  banSeconds: 600
+};
+function resolveThresholds(config) {
+  return { ...DEFAULT_DDOS_THRESHOLDS, ...config.thresholds };
+}
+var CIDR_PATTERN = /^(?:\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$|^[0-9a-f:]+(?:\/\d{1,3})?$/i;
+function isValidCidr(value) {
+  if (!CIDR_PATTERN.test(value))
+    return false;
+  const [address, prefix] = value.split("/");
+  if (address.includes(":"))
+    return prefix == null || Number(prefix) >= 0 && Number(prefix) <= 128;
+  const octets = address.split(".");
+  if (octets.length !== 4 || octets.some((octet) => Number(octet) > 255 || octet === ""))
+    return false;
+  return prefix == null || Number(prefix) >= 0 && Number(prefix) <= 32;
+}
+function validCidrs(values) {
+  return [...new Set((values ?? []).map((value) => value.trim()).filter(isValidCidr))];
+}
+function validPorts(values) {
+  const ports = (values ?? [80, 443]).filter((port) => Number.isInteger(port) && port >= 1 && port <= 65535);
+  return [...new Set(ports)].sort((a, b) => a - b);
+}
+function sysctlHardening(config = {}) {
+  const thresholds = resolveThresholds(config);
+  return {
+    "net.ipv4.tcp_syncookies": "1",
+    "net.ipv4.tcp_max_syn_backlog": String(Math.max(4096, thresholds.synPerSecond * 4)),
+    "net.ipv4.tcp_synack_retries": "2",
+    "net.ipv4.tcp_abort_on_overflow": "1",
+    "net.ipv4.tcp_fin_timeout": "15",
+    "net.ipv4.tcp_keepalive_time": "300",
+    "net.ipv4.tcp_keepalive_intvl": "30",
+    "net.ipv4.tcp_keepalive_probes": "3",
+    "net.core.somaxconn": "4096",
+    "net.core.netdev_max_backlog": "16384",
+    "net.ipv4.conf.all.rp_filter": "1",
+    "net.ipv4.conf.default.rp_filter": "1",
+    "net.ipv4.conf.all.accept_source_route": "0",
+    "net.ipv4.conf.all.accept_redirects": "0",
+    "net.ipv4.conf.all.send_redirects": "0",
+    "net.ipv6.conf.all.accept_redirects": "0",
+    "net.ipv6.conf.all.accept_source_route": "0",
+    "net.ipv4.icmp_echo_ignore_broadcasts": "1",
+    "net.ipv4.icmp_ignore_bogus_error_responses": "1",
+    "net.netfilter.nf_conntrack_max": "262144",
+    "net.netfilter.nf_conntrack_tcp_timeout_established": "3600"
+  };
+}
+function renderSysctlFile(config = {}) {
+  const lines = [
+    "# Managed by ts-cloud. Edits are overwritten on the next deploy.",
+    "# Network hardening against L3/L4 floods.",
+    ""
+  ];
+  for (const [key, value] of Object.entries(sysctlHardening(config)))
+    lines.push(`${key} = ${value}`);
+  return `${lines.join(`
+`)}
+`;
+}
+function renderNftablesRuleset(config = {}) {
+  const thresholds = resolveThresholds(config);
+  const ports = validPorts(config.ports);
+  const allowlist = validCidrs(config.allowlist);
+  const blocklist = validCidrs(config.blocklist);
+  const verdict = config.monitorOnly ? "counter" : "counter drop";
+  const cdnRanges = config.originProtection?.enabled ? validCidrs(config.originProtection.cdnRanges) : [];
+  const ipv4Allow = allowlist.filter((cidr) => !cidr.includes(":"));
+  const ipv6Allow = allowlist.filter((cidr) => cidr.includes(":"));
+  const ipv4Block = blocklist.filter((cidr) => !cidr.includes(":"));
+  const lines = [
+    "#!/usr/sbin/nft -f",
+    "# Managed by ts-cloud. Edits are overwritten on the next deploy.",
+    "",
+    "table inet ts_cloud_ddos",
+    "delete table inet ts_cloud_ddos",
+    "",
+    "table inet ts_cloud_ddos {",
+    "  # Sources that tripped a limit, with a timeout so a ban self-expires.",
+    `  set banned4 { type ipv4_addr; flags timeout; timeout ${thresholds.banSeconds}s; }`,
+    `  set banned6 { type ipv6_addr; flags timeout; timeout ${thresholds.banSeconds}s; }`
+  ];
+  if (ipv4Allow.length > 0)
+    lines.push(`  set allow4 { type ipv4_addr; flags interval; elements = { ${ipv4Allow.join(", ")} } }`);
+  if (ipv6Allow.length > 0)
+    lines.push(`  set allow6 { type ipv6_addr; flags interval; elements = { ${ipv6Allow.join(", ")} } }`);
+  if (ipv4Block.length > 0)
+    lines.push(`  set block4 { type ipv4_addr; flags interval; elements = { ${ipv4Block.join(", ")} } }`);
+  if (cdnRanges.length > 0)
+    lines.push(`  set cdn4 { type ipv4_addr; flags interval; elements = { ${cdnRanges.filter((cidr) => !cidr.includes(":")).join(", ")} } }`);
+  lines.push("", "  chain input {", "    type filter hook input priority -150; policy accept;", "", "    # Established traffic is already paid for; never re-inspect it.", "    ct state established,related accept", "    iif lo accept", "", "    # Invalid packets are never legitimate and are cheap to drop early.", "    ct state invalid counter drop");
+  if (ipv4Allow.length > 0)
+    lines.push("    ip saddr @allow4 accept");
+  if (ipv6Allow.length > 0)
+    lines.push("    ip6 saddr @allow6 accept");
+  if (ipv4Block.length > 0)
+    lines.push("    ip saddr @block4 counter drop");
+  lines.push("    ip saddr @banned4 counter drop", "    ip6 saddr @banned6 counter drop", "");
+  lines.push("    # Nonsense TCP flag combinations: scanners and stack fingerprinting.", "    tcp flags & (fin|syn) == (fin|syn) counter drop", "    tcp flags & (syn|rst) == (syn|rst) counter drop", "    tcp flags & (fin|rst) == (fin|rst) counter drop", "    tcp flags & (fin|ack) == fin counter drop", "    tcp flags & (syn|fin|ack|rst|psh|urg) == 0x0 counter drop", "", `    # Ping stays usable, ping floods do not.`, `    ip protocol icmp icmp type echo-request limit rate ${thresholds.icmpPerSecond}/second burst ${thresholds.burst} packets accept`, "    ip protocol icmp icmp type echo-request counter drop", "");
+  if (ports.length > 0) {
+    const portSet = ports.join(", ");
+    lines.push(`    # Platform-wide SYN ceiling. Above it the kernel falls back to cookies.`, `    tcp dport { ${portSet} } ct state new limit rate ${thresholds.synPerSecond}/second burst ${thresholds.burst} packets accept`, "", `    # Per-source new-connection rate. This is what stops one host hammering.`, `    tcp dport { ${portSet} } ct state new meter conn_rate4 { ip saddr limit rate over ${thresholds.newConnectionsPerSecond}/second burst ${thresholds.burst} packets } add @banned4 { ip saddr } ${verdict}`, `    tcp dport { ${portSet} } ct state new meter conn_rate6 { ip6 saddr limit rate over ${thresholds.newConnectionsPerSecond}/second burst ${thresholds.burst} packets } add @banned6 { ip6 saddr } ${verdict}`, "", `    # Concurrency ceiling per source: the slow-loris defence.`, `    tcp dport { ${portSet} } ct state new meter conn_count4 { ip saddr ct count over ${thresholds.concurrentPerSource} } ${verdict}`, `    tcp dport { ${portSet} } ct state new meter conn_count6 { ip6 saddr ct count over ${thresholds.concurrentPerSource} } ${verdict}`, "");
+    if (cdnRanges.length > 0)
+      lines.push("    # Origin protection: reject traffic that skipped the CDN and came", "    # straight to the box, which is how an attacker bypasses the edge.", `    tcp dport { ${portSet} } ip saddr != @cdn4 counter drop`, "");
+  }
+  lines.push("  }", "}", "");
+  return lines.join(`
+`);
+}
+function renderDdosInstallScript(config = {}) {
+  return `#!/usr/bin/env bash
+# Managed by ts-cloud. Installs L3/L4 flood mitigation.
+set -euo pipefail
+
+if ! command -v nft >/dev/null 2>&1; then
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get update -qq
+  apt-get install -y -qq nftables
+fi
+
+install -d -m 0755 /etc/ts-cloud /etc/nftables.d
+cat > /etc/sysctl.d/90-ts-cloud-ddos.conf <<'SYSCTL_EOF'
+${renderSysctlFile(config)}SYSCTL_EOF
+sysctl --system >/dev/null
+
+cat > /etc/nftables.d/ts-cloud-ddos.nft.new <<'NFT_EOF'
+${renderNftablesRuleset(config)}NFT_EOF
+
+# Syntax-check before applying: a bad ruleset would leave the box unprotected.
+if ! nft -c -f /etc/nftables.d/ts-cloud-ddos.nft.new; then
+  echo "ts-cloud: generated nftables ruleset failed validation, keeping the previous one" >&2
+  rm -f /etc/nftables.d/ts-cloud-ddos.nft.new
+  exit 1
+fi
+
+mv /etc/nftables.d/ts-cloud-ddos.nft.new /etc/nftables.d/ts-cloud-ddos.nft
+nft -f /etc/nftables.d/ts-cloud-ddos.nft
+
+# Applying the ruleset does not survive a reboot on its own: nftables.service
+# loads /etc/nftables.conf, so the file has to be included from there or the box
+# comes back up unprotected and nothing says so.
+touch /etc/nftables.conf
+if ! grep -q 'ts-cloud-ddos.nft' /etc/nftables.conf; then
+  printf '
+include "/etc/nftables.d/ts-cloud-ddos.nft"
+' >> /etc/nftables.conf
+fi
+systemctl enable nftables >/dev/null 2>&1 || true
+echo "ts-cloud: L3/L4 mitigation active"
+`;
+}
+var LEVEL_ORDER = ["off", "monitor", "rate_limit", "challenge", "lockdown"];
+function planMitigation(signals, topSources = []) {
+  const reasons = [];
+  const baseline = Math.max(1, signals.baselineRequestsPerSecond);
+  const ratio = signals.requestsPerSecond / baseline;
+  let levelIndex = 0;
+  const escalate = (next, reason) => {
+    reasons.push(reason);
+    levelIndex = Math.max(levelIndex, LEVEL_ORDER.indexOf(next));
+  };
+  const surging = ratio >= 3;
+  if (surging)
+    escalate("monitor", `Traffic is ${ratio.toFixed(1)}x the baseline.`);
+  const concentrated = signals.topSourceShare >= 0.25;
+  const failing = signals.errorRate >= 0.25;
+  const scripted = (signals.suspiciousAgentShare ?? 0) >= 0.5;
+  const thinlySpread = signals.uniqueSources > 0 && signals.requestsPerSecond / signals.uniqueSources >= 50;
+  if (surging && concentrated)
+    escalate("rate_limit", `One source accounts for ${(signals.topSourceShare * 100).toFixed(0)}% of traffic.`);
+  if (surging && thinlySpread)
+    escalate("rate_limit", "Request rate per unique source is far above what a browser produces.");
+  if (surging && failing)
+    escalate("challenge", `Error rate is ${(signals.errorRate * 100).toFixed(0)}% under load.`);
+  if (surging && scripted)
+    escalate("challenge", "Most requests carry no recognisable browser agent.");
+  if (ratio >= 20 && (concentrated || failing || scripted || thinlySpread))
+    escalate("lockdown", `Traffic is ${ratio.toFixed(0)}x the baseline with attack-shaped characteristics.`);
+  if (!surging && signals.topSourceShare >= 0.6 && signals.requestsPerSecond > baseline)
+    escalate("rate_limit", "A single source dominates traffic without an overall surge.");
+  const level = LEVEL_ORDER[levelIndex];
+  const factor = { off: 1, monitor: 1, rate_limit: 0.5, challenge: 0.25, lockdown: 0.1 }[level];
+  return {
+    level,
+    reasons,
+    rateLimitFactor: factor,
+    challengeEnabled: level === "challenge" || level === "lockdown",
+    staticOnly: level === "lockdown",
+    banCandidates: level === "off" || level === "monitor" ? [] : validCidrs(topSources)
+  };
+}
+function applyMitigationFactor(limit, plan) {
+  return Math.max(1, Math.floor(limit * plan.rateLimitFactor));
+}
+
+export { DEFAULT_DDOS_THRESHOLDS, isValidCidr, sysctlHardening, renderSysctlFile, renderNftablesRuleset, renderDdosInstallScript, planMitigation, applyMitigationFactor };