@stacksjs/ts-cloud 0.9.3 → 0.10.0

package/dist/bin/chunk-7wzdaqh6.js

@@ -0,0 +1,2 @@
+var M=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"routing",label:"Routing"},{index:4,id:"apps",label:"Applications"},{index:5,id:"runtime",label:"Background runtime"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],N=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"entry",label:"Entry points"},{index:4,id:"compute",label:"Compute"},{index:5,id:"messaging",label:"Messaging & pooling"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],P=[{match:/^redis/,kind:"cache",label:"Redis"},{match:/^(?:mysql|mariadb)/,kind:"database",label:"MySQL"},{match:/^postgres/,kind:"database",label:"PostgreSQL"},{match:/^meilisearch/,kind:"database",label:"Meilisearch"},{match:/^vitess|^vtgate/,kind:"database",label:"Vitess"},{match:/^memcached/,kind:"cache",label:"Memcached"}],j=/^(?:rpx-gateway|nginx|caddy|traefik|haproxy)$/;function e(n,u=""){let a=n==null?"":String(n).trim();return a&&a!=="-"&&a!=="—"?a:u}function F(n){return Array.isArray(n)?n.length:0}function h(n){let u=e(n).toLowerCase();if(!u)return"unknown";if(["running","live","active","available","success","ok","healthy","enabled"].includes(u))return"ok";if(["failed","stopped","unreachable","error","critical","disabled"].includes(u))return"bad";if(["configured","creating","pending","degraded","shadowed","warn","unknown"].includes(u))return"warn";return"warn"}function r(n,u,a){if(a.has(u.source)&&a.has(u.target))n.push(u)}function I(n,u={}){let a=[],o=[],q=[],f=n.server??{},c=Array.isArray(n.sites)?n.sites:[],L=Array.isArray(n.services)?n.services:[],k=Array.isArray(n.workers)?n.workers:[],m=n.security??{},C=!!n._serverReachable&&!n.metricsUnavailable,T="box";if(!C)q.push("The compute box could not be probed, so live service state is missing; the shape comes from your cloud config.");a.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let i=[...new Set(c.map((t)=>e(t.domain)||e(t.route).split("/")[0]).filter((t)=>t&&t!=="internal"&&t!=="loopback"))],E=Array.isArray(m.tlsCertificates)?m.tlsCertificates:[],g=E.filter((t)=>Number(t?.daysRemaining??999)<21).length;a.push({id:"dns",label:i.length===1?i[0]:"Public domains",kind:"dns",layer:1,status:g?"warn":i.length?"ok":"unknown",sub:i.length>1?`${i.length} domains`:"DNS & certificates",facts:[{label:"Domains",value:i.length?i.slice(0,6).join(", "):"none resolved"},{label:"Certificates",value:E.length?`${E.length} issued`:"none reported"},...g?[{label:"Expiring",value:`${g} within 21 days`}]:[]],href:"/server/security",external:!0});let v=m.firewall??{},w=Array.isArray(m.ports)?m.ports:[];a.push({id:"firewall",label:"Host firewall",kind:"firewall",layer:2,status:h(v.status),sub:e(v.summary,"Inbound filtering"),facts:[{label:"State",value:e(v.status,"unknown")},{label:"Open ports",value:w.length?w.map((t)=>e(t.listen)).join(", "):"not reported"}],href:"/server/firewall",group:"box"});let y=L.find((t)=>j.test(e(t.name)));a.push({id:"proxy",label:e(y?.name,"Reverse proxy"),kind:"proxy",layer:3,status:y?h(y.status):"unknown",sub:"TLS termination & routing",facts:[{label:"Service",value:e(y?.name,"not detected")},{label:"State",value:e(y?.status,C?"not running":"not probed")},{label:"Routes",value:`${c.length} site${c.length===1?"":"s"}`}],href:"/server/services",group:"box"});for(let t of c){let d=`site:${e(t.name)}`;if(!e(t.name))continue;a.push({id:d,label:e(t.name),kind:"site",layer:4,status:h(t.status),sub:e(t.runtime,"runtime"),facts:[{label:"Route",value:e(t.route,"internal")},{label:"Runtime",value:e(t.runtime,"unknown")},{label:"Delivery",value:e(t.deploy,"unknown")},{label:"TLS",value:e(t.tls,"unknown")},...t.responseMs!=null?[{label:"Response",value:`${Math.round(Number(t.responseMs))} ms`}]:[],...t.httpStatus!=null?[{label:"HTTP",value:String(t.httpStatus)}]:[]],href:"/server/sites",group:"box"})}for(let t of k){let d=`worker:${e(t.name)}`;if(!e(t.name))continue;a.push({id:d,label:e(t.name),kind:"worker",layer:5,status:h(t.status),sub:`${Number(t.processes??1)} process${Number(t.processes??1)===1?"":"es"}`,facts:[{label:"Processes",value:String(t.processes??1)},{label:"State",value:e(t.status,"unknown")},...e(t.site)?[{label:"Site",value:e(t.site)}]:[]],href:"/operations/jobs",group:"box"})}let A=n.serverScheduler??{};if(A.enabled)a.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:5,status:"ok",sub:"Cron dispatch",facts:[{label:"Last run",value:e(A.lastRun,"unknown")}],href:"/operations/jobs",group:"box"});let l=L.map((t)=>{let d=e(t.name),s=P.find((p)=>p.match.test(d));return s?{service:t,name:d,...s}:null}).filter((t)=>!!t);for(let t of l)a.push({id:`data:${t.name}`,label:t.label,kind:t.kind,layer:6,status:h(t.service.status),sub:t.name,facts:[{label:"Unit",value:t.name},{label:"State",value:e(t.service.status,"unknown")}],href:"/data/services",group:"box"});let x=n.backup??{};if(x.enabled)a.push({id:"backup",label:"Backups",kind:"backup",layer:7,status:"ok",sub:e(x.destination,"destination"),facts:[{label:"Destination",value:e(x.destination,"unknown")},{label:"Schedule",value:e(x.schedule,"unknown")},{label:"Retention",value:`${x.retention??0} copies`},{label:"Last run",value:e(x.last,"unknown")}],href:"/data/backups"});let b=new Set(a.map((t)=>t.id));r(o,{source:"internet",target:"dns",flow:"request",label:"https"},b),r(o,{source:"dns",target:"firewall",flow:"request",label:"443/80"},b),r(o,{source:"firewall",target:"proxy",flow:"request"},b);for(let t of c){let d=`site:${e(t.name)}`;r(o,{source:"proxy",target:d,flow:"request",label:e(t.path)||void 0,status:h(t.status)},b)}for(let t of k){let d=`worker:${e(t.name)}`,s=`site:${e(t.site)}`;if(b.has(s))r(o,{source:s,target:d,flow:"async",label:"queue"},b);else r(o,{source:"proxy",target:d,flow:"async",label:"queue"},b)}for(let t of k)r(o,{source:"scheduler",target:`worker:${e(t.name)}`,flow:"async",label:"dispatch"},b);let D=[...c.map((t)=>`site:${e(t.name)}`),...k.map((t)=>`worker:${e(t.name)}`)];for(let t of l)for(let d of D)r(o,{source:d,target:`data:${t.name}`,flow:"data",label:"localhost"},b);if(l.length&&D.length)q.push("Data-service edges show co-location on the box: every process on it can reach localhost. They are not a declared per-site binding.");for(let t of l)r(o,{source:`data:${t.name}`,target:"backup",flow:"backup",label:"snapshot"},b);for(let t of c)r(o,{source:`site:${e(t.name)}`,target:"backup",flow:"backup"},b);return{mode:"server",project:e(u.project)||e(n.project?.name)||e(f.name,"project"),environment:e(u.environment)||e(n.environment,"production"),provider:e(f.provider,"unknown"),region:e(f.region,"unknown"),generatedAt:new Date().toISOString(),layers:M,groups:[{id:"box",label:e(f.name,"App server"),sub:[e(f.provider),e(f.region),e(f.ip)].filter(Boolean).join(" · ")}],nodes:a,links:o,notes:q}}function B(n,u={}){let a=[],o=[],q=[],f=n.app??{},c=Array.isArray(n.functions)?n.functions:[],L=Array.isArray(n.queues)?n.queues:[],k=n.metrics??{};if(!c.length)q.push("No Lambda functions were read for this environment, so the compute layer is empty rather than assumed.");a.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let m=e(f.url),C=m.replace(/^https?:\/\//,"").split("/")[0];a.push({id:"dns",label:C||"Application domain",kind:"dns",layer:1,status:C?"ok":"unknown",sub:"DNS & certificates",facts:[{label:"Endpoint",value:m||"not resolved"}],external:!0});let T=n.waf;if(T)a.push({id:"waf",label:"WAF",kind:"waf",layer:2,status:h(T.status??"active"),sub:e(T.scope,"Managed rules"),facts:[{label:"Web ACL",value:e(T.name,"unnamed")},...T.blocked!=null?[{label:"Blocked (24h)",value:String(T.blocked)}]:[],{label:"Rules",value:String(F(n.wafRules))}],href:"/serverless/firewall"});let i=n.assetsInfo;if(i)a.push({id:"cdn",label:"Asset CDN",kind:"cdn",layer:2,status:"ok",sub:e(i.cdn,"CloudFront"),facts:[{label:"Distribution",value:e(i.cdn,"unknown")},{label:"Custom domain",value:e(i.customDomain,"none")}],href:"/serverless/assets"}),a.push({id:"assets",label:"Asset bucket",kind:"storage",layer:6,status:"ok",sub:e(i.bucket,"S3"),facts:[{label:"Bucket",value:e(i.bucket,"unknown")},...i.files?[{label:"Objects",value:String(i.files)}]:[],...i.sizeMb?[{label:"Size",value:`${i.sizeMb} MB`}]:[]],href:"/serverless/assets"});let E=c.find((s)=>e(s.key).startsWith("http"));a.push({id:"gateway",label:"HTTP entry point",kind:"gateway",layer:3,status:E?"ok":"unknown",sub:"Function URL / API Gateway",facts:[{label:"Endpoint",value:m||"not resolved"},{label:"Invocations (24h)",value:String(k.invocations??0)},...k.errorRatePct!=null?[{label:"Error rate",value:`${k.errorRatePct}%`}]:[]],href:"/serverless/metrics"});for(let s of c){let p=`fn:${e(s.name)}`;if(!e(s.name))continue;let S=Number(s.errors??0),R=Number(s.invocations??0);a.push({id:p,label:e(s.key,e(s.name)),kind:"function",layer:4,status:S>0?R&&S/R>0.02?"bad":"warn":R?"ok":"idle",sub:e(s.runtime,"lambda"),facts:[{label:"Function",value:e(s.name)},{label:"Memory",value:`${s.memory??0} MB`},{label:"Timeout",value:`${s.timeout??0}s`},{label:"Invocations (24h)",value:String(R)},{label:"Errors (24h)",value:String(S)},{label:"p95",value:`${s.p95??0} ms`},...s.provisioned?[{label:"Provisioned",value:e(s.provisioned)}]:[]],href:"/serverless/functions"})}for(let s of L){let p=`queue:${e(s.name)}`;if(!e(s.name))continue;let S=Number(s.dlq??0);a.push({id:p,label:e(s.name),kind:"queue",layer:5,status:S>0?"bad":Number(s.visible??0)>0?"warn":"ok",sub:"SQS",facts:[{label:"Visible",value:String(s.visible??0)},{label:"In flight",value:String(s.inFlight??0)},{label:"Processed (24h)",value:String(s.processed??0)},{label:"Dead letter",value:String(S)}],href:"/serverless/queues"})}let g=n.aurora;if(g)a.push({id:"database",label:"Aurora Serverless",kind:"database",layer:6,status:h(g.status),sub:e(g.engine,"aurora"),facts:[{label:"Cluster",value:e(g.id,"unknown")},{label:"Capacity",value:`${g.currentAcu??0} ACU (${g.minAcu??0}–${g.maxAcu??0})`},{label:"Connections",value:String(g.connections??0)}],href:"/serverless/data"});let v=n.proxy;if(v)a.push({id:"rds-proxy",label:"RDS Proxy",kind:"database",layer:5,status:h(v.status),sub:"Connection pooling",facts:[{label:"Proxy",value:e(v.name,"unknown")},{label:"Endpoint",value:e(v.endpoint,"unknown")},{label:"Pooled",value:String(v.pooledConns??0)}],href:"/serverless/data"});let w=n.redis;if(w)a.push({id:"cache",label:"ElastiCache",kind:"cache",layer:6,status:h(w.status),sub:e(w.node,"redis"),facts:[{label:"Group",value:e(w.id,"unknown")},{label:"Hit rate",value:`${w.hitRate??0}%`}],href:"/serverless/data"});let y=n.efs;if(y)a.push({id:"efs",label:"EFS",kind:"filesystem",layer:6,status:h(y.status),sub:e(y.mount,"/mnt/local"),facts:[{label:"File system",value:e(y.id,"unknown")},{label:"Mount",value:e(y.mount,"unknown")},{label:"Size",value:`${y.sizeMb??0} MB`}],href:"/data/volumes"});let A=n.scheduler??{};if(A.enabled)a.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:3,status:"ok",sub:e(A.expression,"rate(1 minute)"),facts:[{label:"Expression",value:e(A.expression,"unknown")},{label:"Last run",value:e(A.lastRun,"unknown")}],href:"/operations/jobs"});let l=new Set(a.map((s)=>s.id)),x=l.has("waf")?"waf":"gateway";r(o,{source:"internet",target:"dns",flow:"request",label:"https"},l),r(o,{source:"dns",target:x,flow:"request"},l),r(o,{source:"dns",target:"cdn",flow:"request",label:"assets"},l),r(o,{source:"waf",target:"gateway",flow:"request",label:"allowed"},l),r(o,{source:"cdn",target:"assets",flow:"data",label:"origin"},l);let b=c.filter((s)=>e(s.key).startsWith("http")),D=c.filter((s)=>e(s.key).startsWith("queue")),t=c.filter((s)=>e(s.key).startsWith("cli"));for(let s of b)r(o,{source:"gateway",target:`fn:${e(s.name)}`,flow:"request",label:"invoke"},l);for(let s of t)r(o,{source:"scheduler",target:`fn:${e(s.name)}`,flow:"async",label:"schedule"},l);for(let s of L){for(let p of b)r(o,{source:`fn:${e(p.name)}`,target:`queue:${e(s.name)}`,flow:"async",label:"publish"},l);for(let p of D)r(o,{source:`queue:${e(s.name)}`,target:`fn:${e(p.name)}`,flow:"async",label:"consume"},l)}let d=["rds-proxy","database","cache","efs","assets"];for(let s of c){let p=`fn:${e(s.name)}`;if(l.has("rds-proxy"))r(o,{source:p,target:"rds-proxy",flow:"data",label:"pooled"},l);else r(o,{source:p,target:"database",flow:"data",label:"sql"},l);for(let S of d.filter((R)=>R!=="rds-proxy"&&R!=="database"))r(o,{source:p,target:S,flow:"data"},l)}return r(o,{source:"rds-proxy",target:"database",flow:"data",label:"sql"},l),{mode:"serverless",project:e(u.project)||e(f.name,"application"),environment:e(u.environment)||e(f.env,"production"),provider:"aws",region:e(f.region,"unknown"),generatedAt:new Date().toISOString(),layers:N,groups:[],nodes:a,links:o,notes:q}}
+export{I as fg,B as gg};

package/dist/bin/chunk-80ar3aty.js

@@ -0,0 +1 @@
+import{pg as a,qg as b,rg as c,sg as d,tg as e,ug as f,vg as g,wg as h,xg as i}from"./chunk-axvr7dwa.js";import"./chunk-jnsbzqzz.js";import"./chunk-anm3ae6z.js";import"./chunk-b2ymh8k0.js";export{e as AwsSecretsManagerConfigurationBackend,f as AwsSsmConfigurationBackend,h as ConfigurationService,a as ConfigurationStore,g as ExternalConfigurationBackend,d as LocalEncryptedConfigurationBackend,b as parseDotenv,c as serializeDotenv,i as synchronizeConfiguredConfiguration};

package/dist/bin/chunk-8rwhsp5b.js

@@ -0,0 +1,2 @@
+import{bh as n}from"./chunk-ey9fagrr.js";class s{client;region;constructor(t="us-east-1",e){this.region=t,this.client=new n(void 0,{profile:e})}async getCallerIdentity(){let t=await this.client.request({service:"sts",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetCallerIdentity&Version=2011-06-15"});if(typeof t==="string"){let r=t.match(/<Account>(\d+)<\/Account>/),i=t.match(/<UserId>([^<]+)<\/UserId>/),c=t.match(/<Arn>([^<]+)<\/Arn>/);return{Account:r?.[1],UserId:i?.[1],Arn:c?.[1]}}let e=t?.GetCallerIdentityResponse?.GetCallerIdentityResult||t?.GetCallerIdentityResult;if(e)return{Account:String(e.Account),UserId:e.UserId,Arn:e.Arn};if(t?.Account)return{Account:String(t.Account),UserId:t.UserId,Arn:t.Arn};return{Account:void 0,UserId:void 0,Arn:void 0}}}
+export{s as ed};

package/dist/bin/chunk-936vp7dx.js

@@ -0,0 +1,44 @@
+var _={newConnectionsPerSecond:50,concurrentPerSource:100,synPerSecond:2000,burst:100,icmpPerSecond:5,banSeconds:600};function h(e){return{..._,...e.thresholds}}var y=/^(?:\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$|^[0-9a-f:]+(?:\/\d{1,3})?$/i;function S(e){if(!y.test(e))return!1;let[t,n]=e.split("/");if(t.includes(":"))return n==null||Number(n)>=0&&Number(n)<=128;let s=t.split(".");if(s.length!==4||s.some((a)=>Number(a)>255||a===""))return!1;return n==null||Number(n)>=0&&Number(n)<=32}function f(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(S))]}function w(e){let t=(e??[80,443]).filter((n)=>Number.isInteger(n)&&n>=1&&n<=65535);return[...new Set(t)].sort((n,s)=>n-s)}function k(e={}){let t=h(e);return{"net.ipv4.tcp_syncookies":"1","net.ipv4.tcp_max_syn_backlog":String(Math.max(4096,t.synPerSecond*4)),"net.ipv4.tcp_synack_retries":"2","net.ipv4.tcp_abort_on_overflow":"1","net.ipv4.tcp_fin_timeout":"15","net.ipv4.tcp_keepalive_time":"300","net.ipv4.tcp_keepalive_intvl":"30","net.ipv4.tcp_keepalive_probes":"3","net.core.somaxconn":"4096","net.core.netdev_max_backlog":"16384","net.ipv4.conf.all.rp_filter":"1","net.ipv4.conf.default.rp_filter":"1","net.ipv4.conf.all.accept_source_route":"0","net.ipv4.conf.all.accept_redirects":"0","net.ipv4.conf.all.send_redirects":"0","net.ipv6.conf.all.accept_redirects":"0","net.ipv6.conf.all.accept_source_route":"0","net.ipv4.icmp_echo_ignore_broadcasts":"1","net.ipv4.icmp_ignore_bogus_error_responses":"1","net.netfilter.nf_conntrack_max":"262144","net.netfilter.nf_conntrack_tcp_timeout_established":"3600"}}function x(e={}){let t=["# Managed by ts-cloud. Edits are overwritten on the next deploy.","# Network hardening against L3/L4 floods.",""];for(let[n,s]of Object.entries(k(e)))t.push(`${n} = ${s}`);return`${t.join(`
+`)}
+`}function P(e={}){let t=h(e),n=w(e.ports),s=f(e.allowlist),a=f(e.blocklist),l=e.monitorOnly?"counter":"counter drop",i=e.originProtection?.enabled?f(e.originProtection.cdnRanges):[],c=s.filter((r)=>!r.includes(":")),p=s.filter((r)=>r.includes(":")),u=a.filter((r)=>!r.includes(":")),o=["#!/usr/sbin/nft -f","# Managed by ts-cloud. Edits are overwritten on the next deploy.","","table inet ts_cloud_ddos","delete table inet ts_cloud_ddos","","table inet ts_cloud_ddos {","  # Sources that tripped a limit, with a timeout so a ban self-expires.",`  set banned4 { type ipv4_addr; flags timeout; timeout ${t.banSeconds}s; }`,`  set banned6 { type ipv6_addr; flags timeout; timeout ${t.banSeconds}s; }`];if(c.length>0)o.push(`  set allow4 { type ipv4_addr; flags interval; elements = { ${c.join(", ")} } }`);if(p.length>0)o.push(`  set allow6 { type ipv6_addr; flags interval; elements = { ${p.join(", ")} } }`);if(u.length>0)o.push(`  set block4 { type ipv4_addr; flags interval; elements = { ${u.join(", ")} } }`);if(i.length>0)o.push(`  set cdn4 { type ipv4_addr; flags interval; elements = { ${i.filter((r)=>!r.includes(":")).join(", ")} } }`);if(o.push("","  chain input {","    type filter hook input priority -150; policy accept;","","    # Established traffic is already paid for; never re-inspect it.","    ct state established,related accept","    iif lo accept","","    # Invalid packets are never legitimate and are cheap to drop early.","    ct state invalid counter drop"),c.length>0)o.push("    ip saddr @allow4 accept");if(p.length>0)o.push("    ip6 saddr @allow6 accept");if(u.length>0)o.push("    ip saddr @block4 counter drop");if(o.push("    ip saddr @banned4 counter drop","    ip6 saddr @banned6 counter drop",""),o.push("    # Nonsense TCP flag combinations: scanners and stack fingerprinting.","    tcp flags & (fin|syn) == (fin|syn) counter drop","    tcp flags & (syn|rst) == (syn|rst) counter drop","    tcp flags & (fin|rst) == (fin|rst) counter drop","    tcp flags & (fin|ack) == fin counter drop","    tcp flags & (syn|fin|ack|rst|psh|urg) == 0x0 counter drop","","    # Ping stays usable, ping floods do not.",`    ip protocol icmp icmp type echo-request limit rate ${t.icmpPerSecond}/second burst ${t.burst} packets accept`,"    ip protocol icmp icmp type echo-request counter drop",""),n.length>0){let r=n.join(", ");if(o.push("    # Platform-wide SYN ceiling. Above it the kernel falls back to cookies.",`    tcp dport { ${r} } ct state new limit rate ${t.synPerSecond}/second burst ${t.burst} packets accept`,"","    # Per-source new-connection rate. This is what stops one host hammering.",`    tcp dport { ${r} } ct state new meter conn_rate4 { ip saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned4 { ip saddr } ${l}`,`    tcp dport { ${r} } ct state new meter conn_rate6 { ip6 saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned6 { ip6 saddr } ${l}`,"","    # Concurrency ceiling per source: the slow-loris defence.",`    tcp dport { ${r} } ct state new meter conn_count4 { ip saddr ct count over ${t.concurrentPerSource} } ${l}`,`    tcp dport { ${r} } ct state new meter conn_count6 { ip6 saddr ct count over ${t.concurrentPerSource} } ${l}`,""),i.length>0)o.push("    # Origin protection: reject traffic that skipped the CDN and came","    # straight to the box, which is how an attacker bypasses the edge.",`    tcp dport { ${r} } ip saddr != @cdn4 counter drop`,"")}return o.push("  }","}",""),o.join(`
+`)}function C(e={}){return`#!/usr/bin/env bash
+# Managed by ts-cloud. Installs L3/L4 flood mitigation.
+set -euo pipefail
+
+if ! command -v nft >/dev/null 2>&1; then
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get update -qq
+  apt-get install -y -qq nftables
+fi
+
+install -d -m 0755 /etc/ts-cloud /etc/nftables.d
+cat > /etc/sysctl.d/90-ts-cloud-ddos.conf <<'SYSCTL_EOF'
+${x(e)}SYSCTL_EOF
+sysctl --system >/dev/null
+
+cat > /etc/nftables.d/ts-cloud-ddos.nft.new <<'NFT_EOF'
+${P(e)}NFT_EOF
+
+# Syntax-check before applying: a bad ruleset would leave the box unprotected.
+if ! nft -c -f /etc/nftables.d/ts-cloud-ddos.nft.new; then
+  echo "ts-cloud: generated nftables ruleset failed validation, keeping the previous one" >&2
+  rm -f /etc/nftables.d/ts-cloud-ddos.nft.new
+  exit 1
+fi
+
+mv /etc/nftables.d/ts-cloud-ddos.nft.new /etc/nftables.d/ts-cloud-ddos.nft
+nft -f /etc/nftables.d/ts-cloud-ddos.nft
+
+# Applying the ruleset does not survive a reboot on its own: nftables.service
+# loads /etc/nftables.conf, so the file has to be included from there or the box
+# comes back up unprotected and nothing says so.
+touch /etc/nftables.conf
+if ! grep -q 'ts-cloud-ddos.nft' /etc/nftables.conf; then
+  printf '
+include "/etc/nftables.d/ts-cloud-ddos.nft"
+' >> /etc/nftables.conf
+fi
+systemctl enable nftables >/dev/null 2>&1 || true
+echo "ts-cloud: L3/L4 mitigation active"
+`}var b=["off","monitor","rate_limit","challenge","lockdown"];function D(e,t=[]){let n=[],s=Math.max(1,e.baselineRequestsPerSecond),a=e.requestsPerSecond/s,l=0,i=(g,v)=>{n.push(v),l=Math.max(l,b.indexOf(g))},c=a>=3;if(c)i("monitor",`Traffic is ${a.toFixed(1)}x the baseline.`);let p=e.topSourceShare>=0.25,u=e.errorRate>=0.25,o=(e.suspiciousAgentShare??0)>=0.5,r=e.uniqueSources>0&&e.requestsPerSecond/e.uniqueSources>=50;if(c&&p)i("rate_limit",`One source accounts for ${(e.topSourceShare*100).toFixed(0)}% of traffic.`);if(c&&r)i("rate_limit","Request rate per unique source is far above what a browser produces.");if(c&&u)i("challenge",`Error rate is ${(e.errorRate*100).toFixed(0)}% under load.`);if(c&&o)i("challenge","Most requests carry no recognisable browser agent.");if(a>=20&&(p||u||o||r))i("lockdown",`Traffic is ${a.toFixed(0)}x the baseline with attack-shaped characteristics.`);if(!c&&e.topSourceShare>=0.6&&e.requestsPerSecond>s)i("rate_limit","A single source dominates traffic without an overall surge.");let d=b[l],m={off:1,monitor:1,rate_limit:0.5,challenge:0.25,lockdown:0.1}[d];return{level:d,reasons:n,rateLimitFactor:m,challengeEnabled:d==="challenge"||d==="lockdown",staticOnly:d==="lockdown",banCandidates:d==="off"||d==="monitor"?[]:f(t)}}function T(e,t){return Math.max(1,Math.floor(e*t.rateLimitFactor))}
+export{_ as af,S as bf,k as cf,x as df,P as ef,C as ff,D as gf,T as hf};

package/dist/bin/chunk-9px3rg4a.js

@@ -0,0 +1,4 @@
+import{bh as d}from"./chunk-ey9fagrr.js";class u{client;region;constructor(e="us-east-1"){this.region=e,this.client=new d}async describeInstances(e){let t={Action:"DescribeInstances",Version:"2016-11-15"};if(e?.InstanceIds)e.InstanceIds.forEach((r,a)=>{t[`InstanceId.${a+1}`]=r});if(e?.Filters)e.Filters.forEach((r,a)=>{t[`Filter.${a+1}.Name`]=r.Name,r.Values.forEach((i,c)=>{t[`Filter.${a+1}.Value.${c+1}`]=i})});if(e?.MaxResults)t.MaxResults=String(e.MaxResults);if(e?.NextToken)t.NextToken=e.NextToken;let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()}),n=s.DescribeInstancesResponse||s;return{Reservations:this.parseReservations(n.reservationSet?.item),NextToken:n.nextToken}}async getInstance(e){return(await this.describeInstances({InstanceIds:[e]})).Reservations?.[0]?.Instances?.[0]}async getConsoleOutput(e,t){let s={Action:"GetConsoleOutput",Version:"2016-11-15",InstanceId:e};if(t)s.Latest="true";let n=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(s).toString()}),r=n.GetConsoleOutputResponse||n;return{InstanceId:r.instanceId,Output:r.output,Timestamp:r.timestamp}}async getConsoleOutputDecoded(e,t){let s=await this.getConsoleOutput(e,t?.latest);if(!s.Output)return"No console output available yet";let n=Buffer.from(s.Output,"base64").toString("utf-8");if(t?.tailLines)return n.split(`
+`).slice(-t.tailLines).join(`
+`);return n}async describeInstanceStatus(e){let t={Action:"DescribeInstanceStatus",Version:"2016-11-15"};if(e?.InstanceIds)e.InstanceIds.forEach((n,r)=>{t[`InstanceId.${r+1}`]=n});if(e?.IncludeAllInstances)t.IncludeAllInstances="true";if(e?.Filters)e.Filters.forEach((n,r)=>{t[`Filter.${r+1}.Name`]=n.Name,n.Values.forEach((a,i)=>{t[`Filter.${r+1}.Value.${i+1}`]=a})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()});return{InstanceStatuses:this.parseArray(s.instanceStatusSet?.item).map((n)=>({InstanceId:n.instanceId,InstanceState:n.instanceState?{Code:Number.parseInt(n.instanceState.code),Name:n.instanceState.name}:void 0,InstanceStatus:n.instanceStatus?{Status:n.instanceStatus.status,Details:this.parseArray(n.instanceStatus.details?.item).map((r)=>({Name:r.name,Status:r.status}))}:void 0,SystemStatus:n.systemStatus?{Status:n.systemStatus.status,Details:this.parseArray(n.systemStatus.details?.item).map((r)=>({Name:r.name,Status:r.status}))}:void 0}))}}async startInstances(e){let t={Action:"StartInstances",Version:"2016-11-15"};e.forEach((n,r)=>{t[`InstanceId.${r+1}`]=n});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()});return{StartingInstances:this.parseArray(s.instancesSet?.item).map((n)=>({InstanceId:n.instanceId,CurrentState:n.currentState?{Name:n.currentState.name}:void 0,PreviousState:n.previousState?{Name:n.previousState.name}:void 0}))}}async stopInstances(e,t){let s={Action:"StopInstances",Version:"2016-11-15"};if(e.forEach((r,a)=>{s[`InstanceId.${a+1}`]=r}),t)s.Force="true";let n=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(s).toString()});return{StoppingInstances:this.parseArray(n.instancesSet?.item).map((r)=>({InstanceId:r.instanceId,CurrentState:r.currentState?{Name:r.currentState.name}:void 0,PreviousState:r.previousState?{Name:r.previousState.name}:void 0}))}}async rebootInstances(e){let t={Action:"RebootInstances",Version:"2016-11-15"};e.forEach((s,n)=>{t[`InstanceId.${n+1}`]=s}),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()})}async terminateInstances(e){let t={Action:"TerminateInstances",Version:"2016-11-15"};e.forEach((n,r)=>{t[`InstanceId.${r+1}`]=n});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()});return{TerminatingInstances:this.parseArray(s.instancesSet?.item).map((n)=>({InstanceId:n.instanceId,CurrentState:n.currentState?{Name:n.currentState.name}:void 0,PreviousState:n.previousState?{Name:n.previousState.name}:void 0}))}}async createImage(e){let t={Action:"CreateImage",Version:"2016-11-15",InstanceId:e.InstanceId,Name:e.Name};if(e.Description)t.Description=e.Description;if(e.NoReboot!==void 0)t.NoReboot=String(e.NoReboot);if(e.TagSpecifications)e.TagSpecifications.forEach((r,a)=>{t[`TagSpecification.${a+1}.ResourceType`]=r.ResourceType,r.Tags.forEach((i,c)=>{t[`TagSpecification.${a+1}.Tag.${c+1}.Key`]=i.Key,t[`TagSpecification.${a+1}.Tag.${c+1}.Value`]=i.Value})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()});return{ImageId:(s.CreateImageResponse||s).imageId}}async deregisterImage(e){await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({Action:"DeregisterImage",Version:"2016-11-15",ImageId:e}).toString()})}async describeVpcs(e){let t={Action:"DescribeVpcs",Version:"2016-11-15"};if(e?.VpcIds)e.VpcIds.forEach((n,r)=>{t[`VpcId.${r+1}`]=n});if(e?.Filters)e.Filters.forEach((n,r)=>{t[`Filter.${r+1}.Name`]=n.Name,n.Values.forEach((a,i)=>{t[`Filter.${r+1}.Value.${i+1}`]=a})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()});return{Vpcs:this.parseArray(s.vpcSet?.item).map((n)=>({VpcId:n.vpcId,CidrBlock:n.cidrBlock,State:n.state,DhcpOptionsId:n.dhcpOptionsId,InstanceTenancy:n.instanceTenancy,IsDefault:n.isDefault==="true",Tags:this.parseTags(n.tagSet?.item)}))}}async describeSubnets(e){let t={Action:"DescribeSubnets",Version:"2016-11-15"};if(e?.SubnetIds)e.SubnetIds.forEach((n,r)=>{t[`SubnetId.${r+1}`]=n});if(e?.Filters)e.Filters.forEach((n,r)=>{t[`Filter.${r+1}.Name`]=n.Name,n.Values.forEach((a,i)=>{t[`Filter.${r+1}.Value.${i+1}`]=a})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()});return{Subnets:this.parseArray(s.subnetSet?.item).map((n)=>({SubnetId:n.subnetId,VpcId:n.vpcId,CidrBlock:n.cidrBlock,AvailabilityZone:n.availabilityZone,AvailableIpAddressCount:Number.parseInt(n.availableIpAddressCount),State:n.state,MapPublicIpOnLaunch:n.mapPublicIpOnLaunch==="true",Tags:this.parseTags(n.tagSet?.item)}))}}async describeSecurityGroups(e){let t={Action:"DescribeSecurityGroups",Version:"2016-11-15"};if(e?.GroupIds)e.GroupIds.forEach((n,r)=>{t[`GroupId.${r+1}`]=n});if(e?.GroupNames)e.GroupNames.forEach((n,r)=>{t[`GroupName.${r+1}`]=n});if(e?.Filters)e.Filters.forEach((n,r)=>{t[`Filter.${r+1}.Name`]=n.Name,n.Values.forEach((a,i)=>{t[`Filter.${r+1}.Value.${i+1}`]=a})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()});return{SecurityGroups:this.parseArray(s.securityGroupInfo?.item).map((n)=>({GroupId:n.groupId,GroupName:n.groupName,Description:n.groupDescription,VpcId:n.vpcId,IpPermissions:this.parseIpPermissions(n.ipPermissions?.item),IpPermissionsEgress:this.parseIpPermissions(n.ipPermissionsEgress?.item),Tags:this.parseTags(n.tagSet?.item)}))}}async describeInternetGateways(e){let t={Action:"DescribeInternetGateways",Version:"2016-11-15"};if(e?.InternetGatewayIds)e.InternetGatewayIds.forEach((n,r)=>{t[`InternetGatewayId.${r+1}`]=n});if(e?.Filters)e.Filters.forEach((n,r)=>{t[`Filter.${r+1}.Name`]=n.Name,n.Values.forEach((a,i)=>{t[`Filter.${r+1}.Value.${i+1}`]=a})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()});return{InternetGateways:this.parseArray(s.internetGatewaySet?.item).map((n)=>({InternetGatewayId:n.internetGatewayId,Attachments:this.parseArray(n.attachmentSet?.item).map((r)=>({VpcId:r.vpcId,State:r.state})),Tags:this.parseTags(n.tagSet?.item)}))}}async describeAddresses(e){let t={Action:"DescribeAddresses",Version:"2016-11-15"};if(e?.AllocationIds)e.AllocationIds.forEach((n,r)=>{t[`AllocationId.${r+1}`]=n});if(e?.PublicIps)e.PublicIps.forEach((n,r)=>{t[`PublicIp.${r+1}`]=n});if(e?.Filters)e.Filters.forEach((n,r)=>{t[`Filter.${r+1}.Name`]=n.Name,n.Values.forEach((a,i)=>{t[`Filter.${r+1}.Value.${i+1}`]=a})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()});return{Addresses:this.parseArray(s.addressesSet?.item).map((n)=>({PublicIp:n.publicIp,AllocationId:n.allocationId,AssociationId:n.associationId,InstanceId:n.instanceId,NetworkInterfaceId:n.networkInterfaceId,PrivateIpAddress:n.privateIpAddress,Domain:n.domain,Tags:this.parseTags(n.tagSet?.item)}))}}async allocateAddress(e){let t={Action:"AllocateAddress",Version:"2016-11-15"};if(e?.Domain)t.Domain=e.Domain;if(e?.TagSpecifications)e.TagSpecifications.forEach((n,r)=>{t[`TagSpecification.${r+1}.ResourceType`]=n.ResourceType,n.Tags.forEach((a,i)=>{t[`TagSpecification.${r+1}.Tag.${i+1}.Key`]=a.Key,t[`TagSpecification.${r+1}.Tag.${i+1}.Value`]=a.Value})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()});return{AllocationId:s.allocationId,PublicIp:s.publicIp,Domain:s.domain}}async associateAddress(e){let t={Action:"AssociateAddress",Version:"2016-11-15"};if(e.AllocationId)t.AllocationId=e.AllocationId;if(e.PublicIp)t.PublicIp=e.PublicIp;if(e.InstanceId)t.InstanceId=e.InstanceId;if(e.NetworkInterfaceId)t.NetworkInterfaceId=e.NetworkInterfaceId;if(e.PrivateIpAddress)t.PrivateIpAddress=e.PrivateIpAddress;if(e.AllowReassociation)t.AllowReassociation="true";return{AssociationId:(await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()})).associationId}}async createTags(e){let t={Action:"CreateTags",Version:"2016-11-15"};e.Resources.forEach((s,n)=>{t[`ResourceId.${n+1}`]=s}),e.Tags.forEach((s,n)=>{t[`Tag.${n+1}.Key`]=s.Key,t[`Tag.${n+1}.Value`]=s.Value}),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()})}async waitForInstanceState(e,t,s){let n=s?.maxWaitMs||300000,r=s?.pollIntervalMs||5000,a=Date.now();while(Date.now()-a<n){let i;try{i=await this.getInstance(e)}catch{i=void 0}if(i?.State?.Name===t)return i;await new Promise((c)=>setTimeout(c,r))}return}async createVpc(e){let t={Action:"CreateVpc",Version:"2016-11-15",CidrBlock:e.CidrBlock};if(e.InstanceTenancy)t.InstanceTenancy=e.InstanceTenancy;if(e.TagSpecifications)e.TagSpecifications.forEach((a,i)=>{t[`TagSpecification.${i+1}.ResourceType`]=a.ResourceType,a.Tags.forEach((c,o)=>{t[`TagSpecification.${i+1}.Tag.${o+1}.Key`]=c.Key,t[`TagSpecification.${i+1}.Tag.${o+1}.Value`]=c.Value})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()}),r=(s.CreateVpcResponse||s).vpc;return{Vpc:r?{VpcId:r.vpcId,CidrBlock:r.cidrBlock,State:r.state,DhcpOptionsId:r.dhcpOptionsId,InstanceTenancy:r.instanceTenancy,IsDefault:r.isDefault==="true",Tags:this.parseTags(r.tagSet?.item)}:void 0}}async createSubnet(e){let t={Action:"CreateSubnet",Version:"2016-11-15",VpcId:e.VpcId,CidrBlock:e.CidrBlock};if(e.AvailabilityZone)t.AvailabilityZone=e.AvailabilityZone;if(e.TagSpecifications)e.TagSpecifications.forEach((a,i)=>{t[`TagSpecification.${i+1}.ResourceType`]=a.ResourceType,a.Tags.forEach((c,o)=>{t[`TagSpecification.${i+1}.Tag.${o+1}.Key`]=c.Key,t[`TagSpecification.${i+1}.Tag.${o+1}.Value`]=c.Value})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()}),r=(s.CreateSubnetResponse||s).subnet;return{Subnet:r?{SubnetId:r.subnetId,VpcId:r.vpcId,CidrBlock:r.cidrBlock,AvailabilityZone:r.availabilityZone,AvailableIpAddressCount:r.availableIpAddressCount?Number.parseInt(r.availableIpAddressCount):void 0,State:r.state,MapPublicIpOnLaunch:r.mapPublicIpOnLaunch==="true",Tags:this.parseTags(r.tagSet?.item)}:void 0}}async modifySubnetAttribute(e){let t={Action:"ModifySubnetAttribute",Version:"2016-11-15",SubnetId:e.SubnetId};if(e.MapPublicIpOnLaunch!==void 0)t["MapPublicIpOnLaunch.Value"]=String(e.MapPublicIpOnLaunch.Value);await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()})}async createSecurityGroup(e){let t={Action:"CreateSecurityGroup",Version:"2016-11-15",GroupName:e.GroupName,GroupDescription:e.Description};if(e.VpcId)t.VpcId=e.VpcId;if(e.TagSpecifications)e.TagSpecifications.forEach((r,a)=>{t[`TagSpecification.${a+1}.ResourceType`]=r.ResourceType,r.Tags.forEach((i,c)=>{t[`TagSpecification.${a+1}.Tag.${c+1}.Key`]=i.Key,t[`TagSpecification.${a+1}.Tag.${c+1}.Value`]=i.Value})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()});return{GroupId:(s.CreateSecurityGroupResponse||s).groupId}}async authorizeSecurityGroupIngress(e){let t={Action:"AuthorizeSecurityGroupIngress",Version:"2016-11-15",GroupId:e.GroupId};this.encodeIpPermissions(t,e.IpPermissions),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()})}async authorizeSecurityGroupEgress(e){let t={Action:"AuthorizeSecurityGroupEgress",Version:"2016-11-15",GroupId:e.GroupId};this.encodeIpPermissions(t,e.IpPermissions),await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()})}async describeRouteTables(e){let t={Action:"DescribeRouteTables",Version:"2016-11-15"};if(e?.RouteTableIds)e.RouteTableIds.forEach((r,a)=>{t[`RouteTableId.${a+1}`]=r});if(e?.Filters)e.Filters.forEach((r,a)=>{t[`Filter.${a+1}.Name`]=r.Name,r.Values.forEach((i,c)=>{t[`Filter.${a+1}.Value.${c+1}`]=i})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()}),n=s.DescribeRouteTablesResponse||s;return{RouteTables:this.parseArray(n.routeTableSet?.item).map((r)=>({RouteTableId:r.routeTableId,VpcId:r.vpcId,Routes:this.parseArray(r.routeSet?.item).map((a)=>({DestinationCidrBlock:a.destinationCidrBlock,GatewayId:a.gatewayId,NatGatewayId:a.natGatewayId,State:a.state})),Associations:this.parseArray(r.associationSet?.item).map((a)=>({RouteTableAssociationId:a.routeTableAssociationId,SubnetId:a.subnetId,Main:a.main==="true"||a.main===!0})),Tags:this.parseTags(r.tagSet?.item)}))}}async deleteVpc(e){let t={Action:"DeleteVpc",Version:"2016-11-15",VpcId:e};await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()})}async deleteSubnet(e){let t={Action:"DeleteSubnet",Version:"2016-11-15",SubnetId:e};await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()})}async deleteSecurityGroup(e){await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({Action:"DeleteSecurityGroup",Version:"2016-11-15",GroupId:e}).toString()})}async describeNetworkInterfaces(e){let t={Action:"DescribeNetworkInterfaces",Version:"2016-11-15"};if(e?.NetworkInterfaceIds)e.NetworkInterfaceIds.forEach((r,a)=>{t[`NetworkInterfaceId.${a+1}`]=r});if(e?.Filters)e.Filters.forEach((r,a)=>{t[`Filter.${a+1}.Name`]=r.Name,r.Values.forEach((i,c)=>{t[`Filter.${a+1}.Value.${c+1}`]=i})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()}),n=s.DescribeNetworkInterfacesResponse||s;return{NetworkInterfaces:this.parseArray(n.networkInterfaceSet?.item).map((r)=>({NetworkInterfaceId:r.networkInterfaceId,SubnetId:r.subnetId,VpcId:r.vpcId,Status:r.status,Attachment:r.attachment?{AttachmentId:r.attachment.attachmentId,InstanceId:r.attachment.instanceId,Status:r.attachment.status}:void 0}))}}async detachNetworkInterface(e,t){let s={Action:"DetachNetworkInterface",Version:"2016-11-15",AttachmentId:e};if(t)s.Force="true";await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(s).toString()})}async deleteNetworkInterface(e){let t={Action:"DeleteNetworkInterface",Version:"2016-11-15",NetworkInterfaceId:e};await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()})}async describeRegions(){let e={Action:"DescribeRegions",Version:"2016-11-15"},t=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString()}),s=t.DescribeRegionsResponse||t;return{Regions:this.parseArray(s.regionInfo?.item).map((n)=>({RegionName:n.regionName,Endpoint:n.regionEndpoint}))}}async runInstances(e){let t={Action:"RunInstances",Version:"2016-11-15",ImageId:e.ImageId,InstanceType:e.InstanceType,MinCount:String(e.MinCount),MaxCount:String(e.MaxCount)};if(e.SecurityGroupIds)e.SecurityGroupIds.forEach((r,a)=>{t[`SecurityGroupId.${a+1}`]=r});if(e.SubnetId)t.SubnetId=e.SubnetId;if(e.UserData)t.UserData=e.UserData;if(e.IamInstanceProfile){if(e.IamInstanceProfile.Name)t["IamInstanceProfile.Name"]=e.IamInstanceProfile.Name;if(e.IamInstanceProfile.Arn)t["IamInstanceProfile.Arn"]=e.IamInstanceProfile.Arn}if(e.TagSpecifications)e.TagSpecifications.forEach((r,a)=>{t[`TagSpecification.${a+1}.ResourceType`]=r.ResourceType,r.Tags.forEach((i,c)=>{t[`TagSpecification.${a+1}.Tag.${c+1}.Key`]=i.Key,t[`TagSpecification.${a+1}.Tag.${c+1}.Value`]=i.Value})});let s=await this.client.request({service:"ec2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(t).toString()}),n=s.RunInstancesResponse||s;return{Instances:this.parseInstances(n.instancesSet?.item||n.instancesSet)}}encodeIpPermissions(e,t){t.forEach((s,n)=>{let r=`IpPermissions.${n+1}`;if(s.IpProtocol!==void 0)e[`${r}.IpProtocol`]=s.IpProtocol;if(s.FromPort!==void 0)e[`${r}.FromPort`]=String(s.FromPort);if(s.ToPort!==void 0)e[`${r}.ToPort`]=String(s.ToPort);if(s.IpRanges)s.IpRanges.forEach((a,i)=>{if(a.CidrIp)e[`${r}.IpRanges.${i+1}.CidrIp`]=a.CidrIp;if(a.Description)e[`${r}.IpRanges.${i+1}.Description`]=a.Description});if(s.Ipv6Ranges)s.Ipv6Ranges.forEach((a,i)=>{if(a.CidrIpv6)e[`${r}.Ipv6Ranges.${i+1}.CidrIpv6`]=a.CidrIpv6;if(a.Description)e[`${r}.Ipv6Ranges.${i+1}.Description`]=a.Description});if(s.UserIdGroupPairs)s.UserIdGroupPairs.forEach((a,i)=>{if(a.GroupId)e[`${r}.Groups.${i+1}.GroupId`]=a.GroupId;if(a.UserId)e[`${r}.Groups.${i+1}.UserId`]=a.UserId;if(a.Description)e[`${r}.Groups.${i+1}.Description`]=a.Description})})}parseArray(e){if(!e)return[];return Array.isArray(e)?e:[e]}parseFirstIpv6Address(e){for(let t of this.parseArray(e))for(let s of this.parseArray(t?.ipv6AddressesSet?.item))if(s?.ipv6Address)return s.ipv6Address;return}parseTags(e){return this.parseArray(e).map((t)=>({Key:t.key,Value:t.value}))}parseReservations(e){return this.parseArray(e).map((t)=>({ReservationId:t.reservationId,Instances:this.parseInstances(t.instancesSet?.item||t.instancesSet)}))}parseInstances(e){return this.parseArray(e).map((t)=>({InstanceId:t.instanceId,ImageId:t.imageId,InstanceType:t.instanceType,State:t.instanceState?{Code:Number.parseInt(t.instanceState.code),Name:t.instanceState.name}:void 0,PrivateIpAddress:t.privateIpAddress,PublicIpAddress:t.ipAddress,Ipv6Address:this.parseFirstIpv6Address(t.networkInterfaceSet?.item),SubnetId:t.subnetId,VpcId:t.vpcId,SecurityGroups:this.parseArray(t.groupSet?.item).map((s)=>({GroupId:s.groupId,GroupName:s.groupName})),Tags:this.parseTags(t.tagSet?.item),LaunchTime:t.launchTime,Placement:t.placement?{AvailabilityZone:t.placement.availabilityZone,Tenancy:t.placement.tenancy}:void 0,Architecture:t.architecture,RootDeviceType:t.rootDeviceType,RootDeviceName:t.rootDeviceName,BlockDeviceMappings:this.parseArray(t.blockDeviceMapping?.item).map((s)=>({DeviceName:s.deviceName,Ebs:s.ebs?{VolumeId:s.ebs.volumeId,Status:s.ebs.status,AttachTime:s.ebs.attachTime,DeleteOnTermination:s.ebs.deleteOnTermination==="true"}:void 0})),IamInstanceProfile:t.iamInstanceProfile?{Arn:t.iamInstanceProfile.arn,Id:t.iamInstanceProfile.id}:void 0}))}parseIpPermissions(e){return this.parseArray(e).map((t)=>({IpProtocol:t.ipProtocol,FromPort:t.fromPort?Number.parseInt(t.fromPort):void 0,ToPort:t.toPort?Number.parseInt(t.toPort):void 0,IpRanges:this.parseArray(t.ipRanges?.item).map((s)=>({CidrIp:s.cidrIp,Description:s.description})),Ipv6Ranges:this.parseArray(t.ipv6Ranges?.item).map((s)=>({CidrIpv6:s.cidrIpv6,Description:s.description})),UserIdGroupPairs:this.parseArray(t.groups?.item).map((s)=>({GroupId:s.groupId,UserId:s.userId,Description:s.description}))}))}}
+export{u as if};