@stacksjs/ts-cloud 0.7.108 → 0.7.109

package/dist/chunk-xrtwv3v2.js

@@ -0,0 +1,420 @@
+import {
+  isValidCidr
+} from "./chunk-aa2dkn7b.js";
+// src/protection/ratelimit.ts
+var RATE_LIMIT_KEY_SEPARATOR = "\x00";
+var GLOB_PLACEHOLDER = "\x01";
+function globMatches(pattern, value) {
+  if (pattern === "*" || pattern === "**")
+    return true;
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, GLOB_PLACEHOLDER).replace(/\*/g, "[^/]*").replace(/\u0001/g, ".*");
+  return new RegExp(`^${escaped}$`).test(value);
+}
+function hostMatches(pattern, host) {
+  if (pattern.startsWith("*.")) {
+    const suffix = pattern.slice(1);
+    return host.endsWith(suffix) && host.length > suffix.length;
+  }
+  return pattern === host;
+}
+function ruleMatches(rule, request) {
+  if (rule.enabled === false)
+    return false;
+  if (rule.methods?.length && !rule.methods.some((method) => method.toUpperCase() === request.method.toUpperCase()))
+    return false;
+  if (rule.path && !globMatches(rule.path, request.path))
+    return false;
+  if (rule.host && !hostMatches(rule.host, request.host ?? ""))
+    return false;
+  return true;
+}
+function rateLimitKey(rule, request) {
+  const spec = rule.key ?? { source: "ip" };
+  const fallback = spec.fallbackToIp !== false;
+  let identity;
+  if (spec.source === "ip")
+    identity = request.ip;
+  else if (spec.source === "global")
+    identity = "global";
+  else if (spec.source === "host")
+    identity = request.host ?? "";
+  else if (spec.source === "path")
+    identity = request.path;
+  else if (spec.source === "header")
+    identity = spec.name ? request.headers?.[spec.name.toLowerCase()] : undefined;
+  else if (spec.source === "cookie")
+    identity = spec.name ? request.cookies?.[spec.name] : undefined;
+  if (!identity && spec.source !== "global")
+    identity = fallback ? request.ip : "__missing__";
+  return `${rule.id}${RATE_LIMIT_KEY_SEPARATOR}${identity}`;
+}
+
+class RateLimiter {
+  clock;
+  maxTrackedKeys;
+  buckets = new Map;
+  windows = new Map;
+  rules;
+  constructor(rules, clock = () => Date.now(), maxTrackedKeys = 1e5) {
+    this.clock = clock;
+    this.maxTrackedKeys = maxTrackedKeys;
+    this.rules = [...rules].sort((a, b) => (a.priority ?? 0) - (b.priority ?? 0));
+  }
+  check(request) {
+    const now = this.clock();
+    const matching = this.rules.filter((rule) => ruleMatches(rule, request));
+    let blocked;
+    for (const rule of matching) {
+      const test = this.test(rule, request, now);
+      if (test.allowed)
+        continue;
+      if (!blocked || severity(test.action) > severity(blocked.action))
+        blocked = test;
+    }
+    if (blocked)
+      return blocked;
+    let tightest = { action: "allow", allowed: true };
+    for (const rule of matching) {
+      const decision = this.consume(rule, request, now);
+      if (decision.remaining != null && (tightest.remaining ?? Infinity) > decision.remaining)
+        tightest = decision;
+    }
+    return tightest;
+  }
+  test(rule, request, now) {
+    const key = rateLimitKey(rule, request);
+    if ((rule.algorithm ?? "token_bucket") === "token_bucket") {
+      const capacity = rule.burst ?? rule.limit;
+      const state = this.buckets.get(key);
+      const tokens = state ? Math.min(capacity, state.tokens + this.refill(rule, now - state.updatedAt)) : capacity;
+      if (tokens >= 1)
+        return { action: "allow", allowed: true };
+      return this.blocked(rule, key, 0, this.msPerToken(rule) * (1 - tokens), now);
+    }
+    const hits = (this.windows.get(key)?.hits ?? []).filter((at) => at > now - rule.windowMs);
+    if (hits.length < rule.limit)
+      return { action: "allow", allowed: true };
+    return this.blocked(rule, key, 0, hits[0] + rule.windowMs - now, now);
+  }
+  peek(request) {
+    const now = this.clock();
+    for (const rule of this.rules) {
+      if (!ruleMatches(rule, request))
+        continue;
+      const decision = this.test(rule, request, now);
+      if (!decision.allowed)
+        return decision;
+    }
+    return { action: "allow", allowed: true };
+  }
+  msPerToken(rule) {
+    return rule.windowMs / Math.max(1, rule.limit);
+  }
+  refill(rule, elapsedMs) {
+    return Math.max(0, elapsedMs) / this.msPerToken(rule);
+  }
+  blocked(rule, key, remaining, retryAfterMs, now) {
+    const action = rule.action ?? "deny";
+    return {
+      action,
+      allowed: action === "allow" || action === "log",
+      ruleId: rule.id,
+      limit: rule.limit,
+      remaining,
+      retryAfterMs: Math.max(0, Math.ceil(retryAfterMs)),
+      resetAt: now + Math.max(0, retryAfterMs),
+      key
+    };
+  }
+  consume(rule, request, now) {
+    const key = rateLimitKey(rule, request);
+    const algorithm = rule.algorithm ?? "token_bucket";
+    if (algorithm === "token_bucket") {
+      const capacity = rule.burst ?? rule.limit;
+      const state2 = this.buckets.get(key) ?? { tokens: capacity, updatedAt: now };
+      const tokens = Math.min(capacity, state2.tokens + this.refill(rule, now - state2.updatedAt));
+      if (tokens < 1) {
+        this.buckets.set(key, { tokens, updatedAt: now });
+        return this.blocked(rule, key, 0, this.msPerToken(rule) * (1 - tokens), now);
+      }
+      this.evictIfNeeded(this.buckets);
+      this.buckets.set(key, { tokens: tokens - 1, updatedAt: now });
+      return {
+        action: "allow",
+        allowed: true,
+        ruleId: rule.id,
+        limit: capacity,
+        remaining: Math.floor(tokens - 1),
+        resetAt: now + this.msPerToken(rule) * (capacity - (tokens - 1)),
+        key
+      };
+    }
+    const state = this.windows.get(key) ?? { hits: [] };
+    const cutoff = now - rule.windowMs;
+    const hits = state.hits.filter((at) => at > cutoff);
+    if (hits.length >= rule.limit) {
+      this.windows.set(key, { hits });
+      return this.blocked(rule, key, 0, hits[0] + rule.windowMs - now, now);
+    }
+    hits.push(now);
+    this.evictIfNeeded(this.windows);
+    this.windows.set(key, { hits });
+    return {
+      action: "allow",
+      allowed: true,
+      ruleId: rule.id,
+      limit: rule.limit,
+      remaining: rule.limit - hits.length,
+      resetAt: hits[0] + rule.windowMs,
+      key
+    };
+  }
+  evictIfNeeded(map) {
+    if (map.size < this.maxTrackedKeys)
+      return;
+    const excess = map.size - this.maxTrackedKeys + 1;
+    let removed = 0;
+    for (const key of map.keys()) {
+      map.delete(key);
+      if (++removed >= excess)
+        break;
+    }
+  }
+  sweep() {
+    const now = this.clock();
+    let removed = 0;
+    for (const [key, state] of this.windows) {
+      const ruleId = key.split(RATE_LIMIT_KEY_SEPARATOR)[0];
+      const rule = this.rules.find((candidate) => candidate.id === ruleId);
+      if (!rule) {
+        this.windows.delete(key);
+        removed++;
+        continue;
+      }
+      if (state.hits.every((at) => at <= now - rule.windowMs)) {
+        this.windows.delete(key);
+        removed++;
+      }
+    }
+    for (const [key, state] of this.buckets) {
+      const ruleId = key.split(RATE_LIMIT_KEY_SEPARATOR)[0];
+      const rule = this.rules.find((candidate) => candidate.id === ruleId);
+      if (!rule || now - state.updatedAt > rule.windowMs * 2) {
+        this.buckets.delete(key);
+        removed++;
+      }
+    }
+    return removed;
+  }
+  get trackedKeys() {
+    return this.buckets.size + this.windows.size;
+  }
+}
+function severity(action) {
+  return { allow: 0, log: 1, throttle: 2, challenge: 3, deny: 4 }[action];
+}
+function rateLimitHeaders(decision) {
+  const headers = {};
+  if (decision.limit != null)
+    headers["ratelimit-limit"] = String(decision.limit);
+  if (decision.remaining != null)
+    headers["ratelimit-remaining"] = String(decision.remaining);
+  if (decision.resetAt != null)
+    headers["ratelimit-reset"] = String(Math.max(0, Math.ceil((decision.resetAt - Date.now()) / 1000)));
+  if (!decision.allowed && decision.retryAfterMs != null)
+    headers["retry-after"] = String(Math.max(1, Math.ceil(decision.retryAfterMs / 1000)));
+  return headers;
+}
+function defaultRateLimitRules() {
+  return [
+    { id: "global-ip", limit: 600, windowMs: 60000, burst: 100, key: { source: "ip" }, action: "deny", priority: 100 },
+    {
+      id: "api-ip",
+      limit: 120,
+      windowMs: 60000,
+      burst: 30,
+      path: "/api/**",
+      key: { source: "ip" },
+      action: "deny",
+      priority: 50
+    },
+    {
+      id: "auth-ip",
+      limit: 10,
+      windowMs: 60000,
+      algorithm: "sliding_window",
+      path: "/auth/**",
+      methods: ["POST"],
+      key: { source: "ip" },
+      action: "challenge",
+      priority: 10
+    }
+  ];
+}
+// src/protection/controls.ts
+var PROTECTION_SETTING = "protection.controls";
+var MAX_CONTROL_HOURS = 24;
+var DEFAULT_ATTACK_MODE_HOURS = 4;
+var EMPTY = { ipRules: { allow: [], block: [] } };
+function activeControl(control, now) {
+  if (!control?.enabled)
+    return;
+  return new Date(control.expiresAt).getTime() > now.getTime() ? control : undefined;
+}
+function clampHours(hours, fallback) {
+  const value = Number.isFinite(hours) ? Number(hours) : fallback;
+  return Math.min(MAX_CONTROL_HOURS, Math.max(0.25, value));
+}
+var MAX_IP_RULES = 500;
+
+class ProtectionControlStore {
+  controlPlane;
+  options;
+  constructor(controlPlane, options = {}) {
+    this.controlPlane = controlPlane;
+    this.options = options;
+  }
+  now() {
+    return this.options.now?.() ?? new Date;
+  }
+  read() {
+    const raw = this.controlPlane.getSetting(PROTECTION_SETTING);
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+      return { ...EMPTY, ipRules: { allow: [], block: [] } };
+    const record = raw;
+    return {
+      attackMode: record.attackMode,
+      mitigationPause: record.mitigationPause,
+      ipRules: {
+        allow: Array.isArray(record.ipRules?.allow) ? record.ipRules.allow : [],
+        block: Array.isArray(record.ipRules?.block) ? record.ipRules.block : []
+      },
+      updatedAt: record.updatedAt
+    };
+  }
+  write(next) {
+    const stored = { ...next, updatedAt: this.now().toISOString() };
+    this.controlPlane.setSetting(PROTECTION_SETTING, stored);
+    return stored;
+  }
+  raw() {
+    return this.read();
+  }
+  current() {
+    const now = this.now();
+    const stored = this.read();
+    return {
+      attackMode: activeControl(stored.attackMode, now),
+      mitigationPause: activeControl(stored.mitigationPause, now),
+      ipRules: stored.ipRules
+    };
+  }
+  enableAttackMode(input) {
+    const now = this.now();
+    const control = {
+      enabled: true,
+      startedAt: now.toISOString(),
+      expiresAt: new Date(now.getTime() + clampHours(input.hours, DEFAULT_ATTACK_MODE_HOURS) * 3600000).toISOString(),
+      reason: input.reason.trim() || "Attack mode enabled by an operator.",
+      actorId: input.actorId
+    };
+    this.write({ ...this.read(), attackMode: control });
+    return control;
+  }
+  disableAttackMode() {
+    const stored = this.read();
+    if (!stored.attackMode?.enabled)
+      return false;
+    this.write({ ...stored, attackMode: { ...stored.attackMode, enabled: false } });
+    return true;
+  }
+  pauseMitigations(input) {
+    const reason = input.reason.trim();
+    if (!reason)
+      throw new Error("Pausing mitigations requires a reason: you are liable for the traffic it admits.");
+    const now = this.now();
+    const control = {
+      enabled: true,
+      startedAt: now.toISOString(),
+      expiresAt: new Date(now.getTime() + clampHours(input.hours, MAX_CONTROL_HOURS) * 3600000).toISOString(),
+      reason,
+      actorId: input.actorId
+    };
+    this.write({ ...this.read(), mitigationPause: control });
+    return control;
+  }
+  resumeMitigations() {
+    const stored = this.read();
+    if (!stored.mitigationPause?.enabled)
+      return false;
+    this.write({ ...stored, mitigationPause: { ...stored.mitigationPause, enabled: false } });
+    return true;
+  }
+  addIpRule(list, cidr) {
+    const value = cidr.trim();
+    if (!isValidCidr(value))
+      throw new Error(`Not a valid IP or CIDR: ${cidr}`);
+    const stored = this.read();
+    const next = { ...stored.ipRules, [list]: [...new Set([...stored.ipRules[list], value])] };
+    if (next[list].length > MAX_IP_RULES)
+      throw new Error(`At most ${MAX_IP_RULES} ${list} rules are supported.`);
+    const other = list === "allow" ? "block" : "allow";
+    next[other] = next[other].filter((entry) => entry !== value);
+    this.write({ ...stored, ipRules: next });
+    return next;
+  }
+  removeIpRule(list, cidr) {
+    const stored = this.read();
+    const next = { ...stored.ipRules, [list]: stored.ipRules[list].filter((entry) => entry !== cidr.trim()) };
+    this.write({ ...stored, ipRules: next });
+    return next;
+  }
+}
+function describePosture(controls) {
+  if (controls.mitigationPause)
+    return {
+      attackMode: !!controls.attackMode,
+      mitigationPaused: true,
+      summary: `Automatic mitigation is paused until ${controls.mitigationPause.expiresAt}. All traffic is being served and billed.`,
+      expiresAt: controls.mitigationPause.expiresAt
+    };
+  if (controls.attackMode)
+    return {
+      attackMode: true,
+      mitigationPaused: false,
+      summary: `Attack mode is on until ${controls.attackMode.expiresAt}. Every visitor is being challenged.`,
+      expiresAt: controls.attackMode.expiresAt
+    };
+  return { attackMode: false, mitigationPaused: false, summary: "Protection is in its normal posture." };
+}
+function applyControlsToRateLimits(rules, controls) {
+  if (controls.mitigationPause)
+    return rules.map((rule) => ({ ...rule, enabled: false }));
+  if (!controls.attackMode)
+    return [...rules];
+  return rules.map((rule) => ({
+    ...rule,
+    action: rule.action === "deny" ? "deny" : "challenge",
+    burst: Math.max(1, Math.min(rule.burst ?? rule.limit, 5))
+  }));
+}
+function applyControlsToDdos(config, controls) {
+  const allowlist = [...new Set([...config.allowlist ?? [], ...controls.ipRules.allow])];
+  const blocklist = [...new Set([...config.blocklist ?? [], ...controls.ipRules.block])];
+  if (controls.mitigationPause)
+    return { ...config, allowlist, blocklist, monitorOnly: true };
+  if (!controls.attackMode)
+    return { ...config, allowlist, blocklist };
+  const thresholds = config.thresholds ?? {};
+  return {
+    ...config,
+    allowlist,
+    blocklist,
+    thresholds: {
+      ...thresholds,
+      newConnectionsPerSecond: Math.max(1, Math.floor((thresholds.newConnectionsPerSecond ?? 50) / 5)),
+      concurrentPerSource: Math.max(1, Math.floor((thresholds.concurrentPerSource ?? 100) / 5))
+    }
+  };
+}
+export { RATE_LIMIT_KEY_SEPARATOR, globMatches, ruleMatches, rateLimitKey, RateLimiter, rateLimitHeaders, defaultRateLimitRules, PROTECTION_SETTING, MAX_CONTROL_HOURS, DEFAULT_ATTACK_MODE_HOURS, ProtectionControlStore, describePosture, applyControlsToRateLimits, applyControlsToDdos };

package/dist/control-plane/types.d.ts

@@ -9,7 +9,7 @@ export type OrganizationRoleTemplate = 'owner' | 'admin' | 'deployer' | 'operato
 export type AuthorizationScopeType = 'organization' | 'project' | 'environment' | 'resource';
 export type AuthorizationEffect = 'allow' | 'deny';
 export type AuthorizationRecordSource = 'manual' | 'legacy' | 'invitation';
-export type AuthorizationCapability = 'project:read' | 'config:read' | 'config:write' | 'deployments:read' | 'deployments:create' | 'deployments:cancel' | 'deployments:rollback' | 'runtime:read' | 'runtime:restart' | 'runtime:logs' | 'runtime:terminal' | 'data:read' | 'data:write' | 'data:admin' | 'backups:read' | 'backups:create' | 'backups:restore' | 'secrets:read' | 'secrets:write' | 'fleet:read' | 'fleet:manage' | 'users:read' | 'users:manage' | 'users:transfer-ownership' | 'audit:read' | 'security:read' | 'security:manage' | 'security:waive' | 'sources:read' | 'sources:manage' | 'applications:read' | 'applications:manage' | 'automation:read' | 'automation:manage' | 'tags:manage';
+export type AuthorizationCapability = 'project:read' | 'config:read' | 'config:write' | 'deployments:read' | 'deployments:create' | 'deployments:cancel' | 'deployments:rollback' | 'runtime:read' | 'runtime:restart' | 'runtime:logs' | 'runtime:terminal' | 'data:read' | 'data:write' | 'data:admin' | 'backups:read' | 'backups:create' | 'backups:restore' | 'secrets:read' | 'secrets:write' | 'fleet:read' | 'fleet:manage' | 'users:read' | 'users:manage' | 'users:transfer-ownership' | 'audit:read' | 'billing:read' | 'billing:manage' | 'security:read' | 'security:manage' | 'security:waive' | 'sources:read' | 'sources:manage' | 'applications:read' | 'applications:manage' | 'automation:read' | 'automation:manage' | 'tags:manage';
 export interface AuthorizationScope {
     type: AuthorizationScopeType;
     id?: ControlPlaneId;

package/dist/deploy/dashboard-protection.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-spend.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/index.js

@@ -36,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-eg8ck25v.js";
+} from "../chunk-cktwk9hy.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -47,15 +47,17 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "../chunk-ef2dwfrg.js";
+} from "../chunk-8kh577qh.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-3g4r09dd.js";
-import"../chunk-ybcz6sxc.js";
+} from "../chunk-wmbep3b5.js";
+import"../chunk-x6yzgv7y.js";
+import"../chunk-hpv68b4a.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
 import"../chunk-he9a874b.js";
 import"../chunk-gttvakpv.js";
+import"../chunk-32e7ya18.js";
 import {
   IPV6_EXCLUDED_HOST_LABELS,
   MANAGEMENT_DASHBOARD_SITE,
@@ -76,14 +78,15 @@ import {
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-33sy72r8.js";
-import"../chunk-c6db5m63.js";
+} from "../chunk-d3vx2ekv.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
-import"../chunk-hpv68b4a.js";
-import"../chunk-32e7ya18.js";
 import"../chunk-wj3s95p9.js";
 import"../chunk-zqtpg06c.js";
+import"../chunk-grx1rp09.js";
+import"../chunk-va2yd85b.js";
+import"../chunk-aa2dkn7b.js";
+import"../chunk-t2s3gdq6.js";
 import"../chunk-v0bahtg2.js";
 export {
   verifyStaticApiOrigin,

package/dist/deploy/local-dashboard-server.d.ts

@@ -22,6 +22,8 @@ export interface LocalDashboardServerOptions {
     oidcFetch?: OidcFetch;
     /** Run the persistent deployment worker in this process. Defaults off in tests. */
     queueWorker?: boolean;
+    /** Evaluate spend budgets on a timer. Off in tests, like the queue worker. */
+    spendLoop?: boolean;
     /** Maximum number of operations this process may execute in parallel. */
     queueParallelism?: number;
     /** Resolve the provider-specific immutable activation primitive for release jobs. */

package/dist/drivers/index.js

@@ -68,12 +68,14 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-33sy72r8.js";
-import"../chunk-c6db5m63.js";
+} from "../chunk-d3vx2ekv.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-wj3s95p9.js";
 import"../chunk-zqtpg06c.js";
+import"../chunk-va2yd85b.js";
+import"../chunk-aa2dkn7b.js";
+import"../chunk-t2s3gdq6.js";
 import"../chunk-v0bahtg2.js";
 export {
   writeResizeCheckpoint,

package/dist/drivers/shared/protection.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Edge protection at provision time.
+ *
+ * UFW (see `ufw.ts`) decides which ports are open. This decides what happens to
+ * the traffic that arrives on them: kernel-level flood mitigation, and the WAF.
+ *
+ * Both are **on by default**. A protection that has to be switched on protects
+ * only the people who already knew they needed it, which is never the box that
+ * gets hit. The escape hatches are explicit (`ddos: false`, `waf: false`) and
+ * the WAF starts in detection-only, so the default posture is "see everything,
+ * block only floods".
+ */
+import type { DdosConfig } from '../../protection/ddos';
+import type { WafConfig } from '../../protection/waf';
+/** `true` for defaults, `false` to skip, or an object to tune. */
+export type ProtectionSetting<T> = boolean | T | undefined;
+/** L3/L4 defaults: protect the web ports, count-and-drop, ten-minute bans. */
+export declare const DEFAULT_COMPUTE_DDOS: DdosConfig;
+/**
+ * WAF defaults: paranoia 1, detection only.
+ *
+ * Detection rather than blocking because zig-waf is pre-alpha and because a
+ * ruleset nobody has read their own logs against will block real traffic. The
+ * operator promotes it once they have looked.
+ */
+export declare const DEFAULT_COMPUTE_WAF: WafConfig;
+/** Kernel-level flood mitigation. Returns no lines when disabled. */
+export declare function buildDdosScript(setting?: ProtectionSetting<DdosConfig>, extraPorts?: number[]): string[];
+/** WAF configuration. Returns no lines when disabled or when the binary is absent. */
+export declare function buildWafScript(setting?: ProtectionSetting<WafConfig>): string[];
+export interface ComputeProtectionConfig {
+    ddos?: ProtectionSetting<DdosConfig>;
+    waf?: ProtectionSetting<WafConfig>;
+}
+/**
+ * Both layers, in order: kernel first, then application.
+ *
+ * Order matters on a box that is already being hit. The packet filter costs
+ * nothing per request and starts dropping immediately; the WAF has to parse
+ * every request it inspects, so bringing it up first would spend CPU on
+ * traffic the kernel was about to discard anyway.
+ */
+export declare function buildProtectionScript(protection?: ComputeProtectionConfig, extraPorts?: number[]): string[];

package/dist/drivers/shared/protection.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.d.ts

@@ -9,6 +9,9 @@ export * from './compose';
 export * from './release';
 export * from './runtime';
 export * from './telemetry';
+export * from './spend';
+export { applyControlsToDdos, applyControlsToRateLimits, applyMitigationFactor, DEFAULT_ATTACK_MODE_HOURS, defaultRateLimitRules, describePosture, MAX_CONTROL_HOURS, ProtectionControlStore, DEFAULT_DDOS_THRESHOLDS, DEFAULT_RECURSION_LIMITS, escapeSecLang, functionFingerprint, globMatches, globToRegex, inspectInvocation, isSafePattern, isValidCidr, parseChain, planMitigation, propagationHeaders, rateLimitHeaders, rateLimitKey, RateLimiter as EdgeRateLimiter, RATE_LIMIT_KEY_SEPARATOR, RecursionGuard, recursionBlockedResponse, renderDdosInstallScript, renderNftablesRuleset, renderSysctlFile, renderWafConfig, renderWafInstallScript, ruleMatches, sysctlHardening, wafEventTelemetry, CHAIN_HEADER, DEPTH_HEADER, TRACE_HEADER, } from './protection';
+export type { DdosConfig, DdosThresholds, IpRules, ProtectionControls, ProtectionPosture, TimeBoxedControl, InvocationContext, MitigationLevel, MitigationPlan, ParanoiaLevel, RateLimitAction, RateLimitAlgorithm, RateLimitDecision, RateLimitKeySource, RateLimitKeySpec, RateLimitRule as EdgeRateLimitRule, RecursionLimits, RecursionReason, RecursionVerdict, RequestDescriptor, TrafficSignals, WafConfig as EdgeWafConfig, WafEvent, WafGenerationResult, WafMode, WafRuleExclusion, } from './protection';
 export { AlertEvaluator, AlertStore, HealthCheckRunner, NotificationRouter, evaluateTelemetryAlertRules, isQuietHours, } from './alerts';
 export type { Alert, AlertEvaluation, AlertRule, AlertSample, AlertSeverity, AlertState, HealthCheck as AlertHealthCheck, HealthResult as AlertHealthResult, HealthStatus as AlertHealthStatus, NotificationChannel as AlertNotificationChannel, NotificationDelivery as AlertNotificationDelivery, NotificationRoute as AlertNotificationRoute, } from './alerts';
 export * from './jobs';