@stacksjs/ts-cloud 0.9.3 → 0.10.0

package/dist/chunk-aa2dkn7b.js

@@ -1,205 +0,0 @@
-// src/protection/ddos.ts
-var DEFAULT_DDOS_THRESHOLDS = {
-  newConnectionsPerSecond: 50,
-  concurrentPerSource: 100,
-  synPerSecond: 2000,
-  burst: 100,
-  icmpPerSecond: 5,
-  banSeconds: 600
-};
-function resolveThresholds(config) {
-  return { ...DEFAULT_DDOS_THRESHOLDS, ...config.thresholds };
-}
-var CIDR_PATTERN = /^(?:\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$|^[0-9a-f:]+(?:\/\d{1,3})?$/i;
-function isValidCidr(value) {
-  if (!CIDR_PATTERN.test(value))
-    return false;
-  const [address, prefix] = value.split("/");
-  if (address.includes(":"))
-    return prefix == null || Number(prefix) >= 0 && Number(prefix) <= 128;
-  const octets = address.split(".");
-  if (octets.length !== 4 || octets.some((octet) => Number(octet) > 255 || octet === ""))
-    return false;
-  return prefix == null || Number(prefix) >= 0 && Number(prefix) <= 32;
-}
-function validCidrs(values) {
-  return [...new Set((values ?? []).map((value) => value.trim()).filter(isValidCidr))];
-}
-function validPorts(values) {
-  const ports = (values ?? [80, 443]).filter((port) => Number.isInteger(port) && port >= 1 && port <= 65535);
-  return [...new Set(ports)].sort((a, b) => a - b);
-}
-function sysctlHardening(config = {}) {
-  const thresholds = resolveThresholds(config);
-  return {
-    "net.ipv4.tcp_syncookies": "1",
-    "net.ipv4.tcp_max_syn_backlog": String(Math.max(4096, thresholds.synPerSecond * 4)),
-    "net.ipv4.tcp_synack_retries": "2",
-    "net.ipv4.tcp_abort_on_overflow": "1",
-    "net.ipv4.tcp_fin_timeout": "15",
-    "net.ipv4.tcp_keepalive_time": "300",
-    "net.ipv4.tcp_keepalive_intvl": "30",
-    "net.ipv4.tcp_keepalive_probes": "3",
-    "net.core.somaxconn": "4096",
-    "net.core.netdev_max_backlog": "16384",
-    "net.ipv4.conf.all.rp_filter": "1",
-    "net.ipv4.conf.default.rp_filter": "1",
-    "net.ipv4.conf.all.accept_source_route": "0",
-    "net.ipv4.conf.all.accept_redirects": "0",
-    "net.ipv4.conf.all.send_redirects": "0",
-    "net.ipv6.conf.all.accept_redirects": "0",
-    "net.ipv6.conf.all.accept_source_route": "0",
-    "net.ipv4.icmp_echo_ignore_broadcasts": "1",
-    "net.ipv4.icmp_ignore_bogus_error_responses": "1",
-    "net.netfilter.nf_conntrack_max": "262144",
-    "net.netfilter.nf_conntrack_tcp_timeout_established": "3600"
-  };
-}
-function renderSysctlFile(config = {}) {
-  const lines = [
-    "# Managed by ts-cloud. Edits are overwritten on the next deploy.",
-    "# Network hardening against L3/L4 floods.",
-    ""
-  ];
-  for (const [key, value] of Object.entries(sysctlHardening(config)))
-    lines.push(`${key} = ${value}`);
-  return `${lines.join(`
-`)}
-`;
-}
-function renderNftablesRuleset(config = {}) {
-  const thresholds = resolveThresholds(config);
-  const ports = validPorts(config.ports);
-  const allowlist = validCidrs(config.allowlist);
-  const blocklist = validCidrs(config.blocklist);
-  const verdict = config.monitorOnly ? "counter" : "counter drop";
-  const cdnRanges = config.originProtection?.enabled ? validCidrs(config.originProtection.cdnRanges) : [];
-  const ipv4Allow = allowlist.filter((cidr) => !cidr.includes(":"));
-  const ipv6Allow = allowlist.filter((cidr) => cidr.includes(":"));
-  const ipv4Block = blocklist.filter((cidr) => !cidr.includes(":"));
-  const lines = [
-    "#!/usr/sbin/nft -f",
-    "# Managed by ts-cloud. Edits are overwritten on the next deploy.",
-    "",
-    "table inet ts_cloud_ddos",
-    "delete table inet ts_cloud_ddos",
-    "",
-    "table inet ts_cloud_ddos {",
-    "  # Sources that tripped a limit, with a timeout so a ban self-expires.",
-    `  set banned4 { type ipv4_addr; flags timeout; timeout ${thresholds.banSeconds}s; }`,
-    `  set banned6 { type ipv6_addr; flags timeout; timeout ${thresholds.banSeconds}s; }`
-  ];
-  if (ipv4Allow.length > 0)
-    lines.push(`  set allow4 { type ipv4_addr; flags interval; elements = { ${ipv4Allow.join(", ")} } }`);
-  if (ipv6Allow.length > 0)
-    lines.push(`  set allow6 { type ipv6_addr; flags interval; elements = { ${ipv6Allow.join(", ")} } }`);
-  if (ipv4Block.length > 0)
-    lines.push(`  set block4 { type ipv4_addr; flags interval; elements = { ${ipv4Block.join(", ")} } }`);
-  if (cdnRanges.length > 0)
-    lines.push(`  set cdn4 { type ipv4_addr; flags interval; elements = { ${cdnRanges.filter((cidr) => !cidr.includes(":")).join(", ")} } }`);
-  lines.push("", "  chain input {", "    type filter hook input priority -150; policy accept;", "", "    # Established traffic is already paid for; never re-inspect it.", "    ct state established,related accept", "    iif lo accept", "", "    # Invalid packets are never legitimate and are cheap to drop early.", "    ct state invalid counter drop");
-  if (ipv4Allow.length > 0)
-    lines.push("    ip saddr @allow4 accept");
-  if (ipv6Allow.length > 0)
-    lines.push("    ip6 saddr @allow6 accept");
-  if (ipv4Block.length > 0)
-    lines.push("    ip saddr @block4 counter drop");
-  lines.push("    ip saddr @banned4 counter drop", "    ip6 saddr @banned6 counter drop", "");
-  lines.push("    # Nonsense TCP flag combinations: scanners and stack fingerprinting.", "    tcp flags & (fin|syn) == (fin|syn) counter drop", "    tcp flags & (syn|rst) == (syn|rst) counter drop", "    tcp flags & (fin|rst) == (fin|rst) counter drop", "    tcp flags & (fin|ack) == fin counter drop", "    tcp flags & (syn|fin|ack|rst|psh|urg) == 0x0 counter drop", "", `    # Ping stays usable, ping floods do not.`, `    ip protocol icmp icmp type echo-request limit rate ${thresholds.icmpPerSecond}/second burst ${thresholds.burst} packets accept`, "    ip protocol icmp icmp type echo-request counter drop", "");
-  if (ports.length > 0) {
-    const portSet = ports.join(", ");
-    lines.push(`    # Platform-wide SYN ceiling. Above it the kernel falls back to cookies.`, `    tcp dport { ${portSet} } ct state new limit rate ${thresholds.synPerSecond}/second burst ${thresholds.burst} packets accept`, "", `    # Per-source new-connection rate. This is what stops one host hammering.`, `    tcp dport { ${portSet} } ct state new meter conn_rate4 { ip saddr limit rate over ${thresholds.newConnectionsPerSecond}/second burst ${thresholds.burst} packets } add @banned4 { ip saddr } ${verdict}`, `    tcp dport { ${portSet} } ct state new meter conn_rate6 { ip6 saddr limit rate over ${thresholds.newConnectionsPerSecond}/second burst ${thresholds.burst} packets } add @banned6 { ip6 saddr } ${verdict}`, "", `    # Concurrency ceiling per source: the slow-loris defence.`, `    tcp dport { ${portSet} } ct state new meter conn_count4 { ip saddr ct count over ${thresholds.concurrentPerSource} } ${verdict}`, `    tcp dport { ${portSet} } ct state new meter conn_count6 { ip6 saddr ct count over ${thresholds.concurrentPerSource} } ${verdict}`, "");
-    if (cdnRanges.length > 0)
-      lines.push("    # Origin protection: reject traffic that skipped the CDN and came", "    # straight to the box, which is how an attacker bypasses the edge.", `    tcp dport { ${portSet} } ip saddr != @cdn4 counter drop`, "");
-  }
-  lines.push("  }", "}", "");
-  return lines.join(`
-`);
-}
-function renderDdosInstallScript(config = {}) {
-  return `#!/usr/bin/env bash
-# Managed by ts-cloud. Installs L3/L4 flood mitigation.
-set -euo pipefail
-
-if ! command -v nft >/dev/null 2>&1; then
-  export DEBIAN_FRONTEND=noninteractive
-  apt-get update -qq
-  apt-get install -y -qq nftables
-fi
-
-install -d -m 0755 /etc/ts-cloud /etc/nftables.d
-cat > /etc/sysctl.d/90-ts-cloud-ddos.conf <<'SYSCTL_EOF'
-${renderSysctlFile(config)}SYSCTL_EOF
-sysctl --system >/dev/null
-
-cat > /etc/nftables.d/ts-cloud-ddos.nft.new <<'NFT_EOF'
-${renderNftablesRuleset(config)}NFT_EOF
-
-# Syntax-check before applying: a bad ruleset would leave the box unprotected.
-if ! nft -c -f /etc/nftables.d/ts-cloud-ddos.nft.new; then
-  echo "ts-cloud: generated nftables ruleset failed validation, keeping the previous one" >&2
-  rm -f /etc/nftables.d/ts-cloud-ddos.nft.new
-  exit 1
-fi
-
-mv /etc/nftables.d/ts-cloud-ddos.nft.new /etc/nftables.d/ts-cloud-ddos.nft
-nft -f /etc/nftables.d/ts-cloud-ddos.nft
-
-# Applying the ruleset does not survive a reboot on its own: nftables.service
-# loads /etc/nftables.conf, so the file has to be included from there or the box
-# comes back up unprotected and nothing says so.
-touch /etc/nftables.conf
-if ! grep -q 'ts-cloud-ddos.nft' /etc/nftables.conf; then
-  printf '
-include "/etc/nftables.d/ts-cloud-ddos.nft"
-' >> /etc/nftables.conf
-fi
-systemctl enable nftables >/dev/null 2>&1 || true
-echo "ts-cloud: L3/L4 mitigation active"
-`;
-}
-var LEVEL_ORDER = ["off", "monitor", "rate_limit", "challenge", "lockdown"];
-function planMitigation(signals, topSources = []) {
-  const reasons = [];
-  const baseline = Math.max(1, signals.baselineRequestsPerSecond);
-  const ratio = signals.requestsPerSecond / baseline;
-  let levelIndex = 0;
-  const escalate = (next, reason) => {
-    reasons.push(reason);
-    levelIndex = Math.max(levelIndex, LEVEL_ORDER.indexOf(next));
-  };
-  const surging = ratio >= 3;
-  if (surging)
-    escalate("monitor", `Traffic is ${ratio.toFixed(1)}x the baseline.`);
-  const concentrated = signals.topSourceShare >= 0.25;
-  const failing = signals.errorRate >= 0.25;
-  const scripted = (signals.suspiciousAgentShare ?? 0) >= 0.5;
-  const thinlySpread = signals.uniqueSources > 0 && signals.requestsPerSecond / signals.uniqueSources >= 50;
-  if (surging && concentrated)
-    escalate("rate_limit", `One source accounts for ${(signals.topSourceShare * 100).toFixed(0)}% of traffic.`);
-  if (surging && thinlySpread)
-    escalate("rate_limit", "Request rate per unique source is far above what a browser produces.");
-  if (surging && failing)
-    escalate("challenge", `Error rate is ${(signals.errorRate * 100).toFixed(0)}% under load.`);
-  if (surging && scripted)
-    escalate("challenge", "Most requests carry no recognisable browser agent.");
-  if (ratio >= 20 && (concentrated || failing || scripted || thinlySpread))
-    escalate("lockdown", `Traffic is ${ratio.toFixed(0)}x the baseline with attack-shaped characteristics.`);
-  if (!surging && signals.topSourceShare >= 0.6 && signals.requestsPerSecond > baseline)
-    escalate("rate_limit", "A single source dominates traffic without an overall surge.");
-  const level = LEVEL_ORDER[levelIndex];
-  const factor = { off: 1, monitor: 1, rate_limit: 0.5, challenge: 0.25, lockdown: 0.1 }[level];
-  return {
-    level,
-    reasons,
-    rateLimitFactor: factor,
-    challengeEnabled: level === "challenge" || level === "lockdown",
-    staticOnly: level === "lockdown",
-    banCandidates: level === "off" || level === "monitor" ? [] : validCidrs(topSources)
-  };
-}
-function applyMitigationFactor(limit, plan) {
-  return Math.max(1, Math.floor(limit * plan.rateLimitFactor));
-}
-
-export { DEFAULT_DDOS_THRESHOLDS, isValidCidr, sysctlHardening, renderSysctlFile, renderNftablesRuleset, renderDdosInstallScript, planMitigation, applyMitigationFactor };

package/dist/chunk-d48vtdj4.js

@@ -1,433 +0,0 @@
-import {
-  isValidCidr
-} from "./chunk-aa2dkn7b.js";
-// src/protection/ratelimit.ts
-var RATE_LIMIT_KEY_SEPARATOR = "\x00";
-var GLOB_PLACEHOLDER = "\x01";
-function globMatches(pattern, value) {
-  if (pattern === "*" || pattern === "**")
-    return true;
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, GLOB_PLACEHOLDER).replace(/\*/g, "[^/]*").replace(/\u0001/g, ".*");
-  return new RegExp(`^${escaped}$`).test(value);
-}
-function hostMatches(pattern, host) {
-  if (pattern.startsWith("*.")) {
-    const suffix = pattern.slice(1);
-    return host.endsWith(suffix) && host.length > suffix.length;
-  }
-  return pattern === host;
-}
-function ruleMatches(rule, request) {
-  if (rule.enabled === false)
-    return false;
-  if (rule.methods?.length && !rule.methods.some((method) => method.toUpperCase() === request.method.toUpperCase()))
-    return false;
-  if (rule.path && !globMatches(rule.path, request.path))
-    return false;
-  if (rule.host && !hostMatches(rule.host, request.host ?? ""))
-    return false;
-  return true;
-}
-function rateLimitKey(rule, request) {
-  const spec = rule.key ?? { source: "ip" };
-  const fallback = spec.fallbackToIp !== false;
-  let identity;
-  if (spec.source === "ip")
-    identity = request.ip;
-  else if (spec.source === "global")
-    identity = "global";
-  else if (spec.source === "host")
-    identity = request.host ?? "";
-  else if (spec.source === "path")
-    identity = request.path;
-  else if (spec.source === "header")
-    identity = spec.name ? request.headers?.[spec.name.toLowerCase()] : undefined;
-  else if (spec.source === "cookie")
-    identity = spec.name ? request.cookies?.[spec.name] : undefined;
-  if (!identity && spec.source !== "global")
-    identity = fallback ? request.ip : "__missing__";
-  return `${rule.id}${RATE_LIMIT_KEY_SEPARATOR}${identity}`;
-}
-
-class RateLimiter {
-  clock;
-  maxTrackedKeys;
-  buckets = new Map;
-  windows = new Map;
-  rules;
-  constructor(rules, clock = () => Date.now(), maxTrackedKeys = 1e5) {
-    this.clock = clock;
-    this.maxTrackedKeys = maxTrackedKeys;
-    this.rules = [...rules].sort((a, b) => (a.priority ?? 0) - (b.priority ?? 0));
-  }
-  check(request) {
-    const now = this.clock();
-    const matching = this.rules.filter((rule) => ruleMatches(rule, request));
-    let blocked;
-    for (const rule of matching) {
-      const test = this.test(rule, request, now);
-      if (test.allowed)
-        continue;
-      if (!blocked || severity(test.action) > severity(blocked.action))
-        blocked = test;
-    }
-    if (blocked)
-      return blocked;
-    let tightest = { action: "allow", allowed: true };
-    for (const rule of matching) {
-      const decision = this.consume(rule, request, now);
-      if (decision.remaining != null && (tightest.remaining ?? Infinity) > decision.remaining)
-        tightest = decision;
-    }
-    return tightest;
-  }
-  test(rule, request, now) {
-    const key = rateLimitKey(rule, request);
-    if ((rule.algorithm ?? "token_bucket") === "token_bucket") {
-      const capacity = rule.burst ?? rule.limit;
-      const state = this.buckets.get(key);
-      const tokens = state ? Math.min(capacity, state.tokens + this.refill(rule, now - state.updatedAt)) : capacity;
-      if (tokens >= 1)
-        return { action: "allow", allowed: true };
-      return this.blocked(rule, key, 0, this.msPerToken(rule) * (1 - tokens), now);
-    }
-    const hits = (this.windows.get(key)?.hits ?? []).filter((at) => at > now - rule.windowMs);
-    if (hits.length < rule.limit)
-      return { action: "allow", allowed: true };
-    return this.blocked(rule, key, 0, hits[0] + rule.windowMs - now, now);
-  }
-  peek(request) {
-    const now = this.clock();
-    for (const rule of this.rules) {
-      if (!ruleMatches(rule, request))
-        continue;
-      const decision = this.test(rule, request, now);
-      if (!decision.allowed)
-        return decision;
-    }
-    return { action: "allow", allowed: true };
-  }
-  msPerToken(rule) {
-    return rule.windowMs / Math.max(1, rule.limit);
-  }
-  refill(rule, elapsedMs) {
-    return Math.max(0, elapsedMs) / this.msPerToken(rule);
-  }
-  blocked(rule, key, remaining, retryAfterMs, now) {
-    const action = rule.action ?? "deny";
-    return {
-      action,
-      allowed: action === "allow" || action === "log",
-      ruleId: rule.id,
-      limit: rule.limit,
-      remaining,
-      retryAfterMs: Math.max(0, Math.ceil(retryAfterMs)),
-      resetAt: now + Math.max(0, retryAfterMs),
-      key
-    };
-  }
-  consume(rule, request, now) {
-    const key = rateLimitKey(rule, request);
-    const algorithm = rule.algorithm ?? "token_bucket";
-    if (algorithm === "token_bucket") {
-      const capacity = rule.burst ?? rule.limit;
-      const state2 = this.buckets.get(key) ?? { tokens: capacity, updatedAt: now };
-      const tokens = Math.min(capacity, state2.tokens + this.refill(rule, now - state2.updatedAt));
-      if (tokens < 1) {
-        this.buckets.set(key, { tokens, updatedAt: now });
-        return this.blocked(rule, key, 0, this.msPerToken(rule) * (1 - tokens), now);
-      }
-      this.evictIfNeeded(this.buckets);
-      this.buckets.set(key, { tokens: tokens - 1, updatedAt: now });
-      return {
-        action: "allow",
-        allowed: true,
-        ruleId: rule.id,
-        limit: capacity,
-        remaining: Math.floor(tokens - 1),
-        resetAt: now + this.msPerToken(rule) * (capacity - (tokens - 1)),
-        key
-      };
-    }
-    const state = this.windows.get(key) ?? { hits: [] };
-    const cutoff = now - rule.windowMs;
-    const hits = state.hits.filter((at) => at > cutoff);
-    if (hits.length >= rule.limit) {
-      this.windows.set(key, { hits });
-      return this.blocked(rule, key, 0, hits[0] + rule.windowMs - now, now);
-    }
-    hits.push(now);
-    this.evictIfNeeded(this.windows);
-    this.windows.set(key, { hits });
-    return {
-      action: "allow",
-      allowed: true,
-      ruleId: rule.id,
-      limit: rule.limit,
-      remaining: rule.limit - hits.length,
-      resetAt: hits[0] + rule.windowMs,
-      key
-    };
-  }
-  evictIfNeeded(map) {
-    if (map.size < this.maxTrackedKeys)
-      return;
-    const excess = map.size - this.maxTrackedKeys + 1;
-    let removed = 0;
-    for (const key of map.keys()) {
-      map.delete(key);
-      if (++removed >= excess)
-        break;
-    }
-  }
-  sweep() {
-    const now = this.clock();
-    let removed = 0;
-    for (const [key, state] of this.windows) {
-      const ruleId = key.split(RATE_LIMIT_KEY_SEPARATOR)[0];
-      const rule = this.rules.find((candidate) => candidate.id === ruleId);
-      if (!rule) {
-        this.windows.delete(key);
-        removed++;
-        continue;
-      }
-      if (state.hits.every((at) => at <= now - rule.windowMs)) {
-        this.windows.delete(key);
-        removed++;
-      }
-    }
-    for (const [key, state] of this.buckets) {
-      const ruleId = key.split(RATE_LIMIT_KEY_SEPARATOR)[0];
-      const rule = this.rules.find((candidate) => candidate.id === ruleId);
-      if (!rule || now - state.updatedAt > rule.windowMs * 2) {
-        this.buckets.delete(key);
-        removed++;
-      }
-    }
-    return removed;
-  }
-  get trackedKeys() {
-    return this.buckets.size + this.windows.size;
-  }
-}
-function severity(action) {
-  return { allow: 0, log: 1, throttle: 2, challenge: 3, deny: 4 }[action];
-}
-function rateLimitHeaders(decision) {
-  const headers = {};
-  if (decision.limit != null)
-    headers["ratelimit-limit"] = String(decision.limit);
-  if (decision.remaining != null)
-    headers["ratelimit-remaining"] = String(decision.remaining);
-  if (decision.resetAt != null)
-    headers["ratelimit-reset"] = String(Math.max(0, Math.ceil((decision.resetAt - Date.now()) / 1000)));
-  if (!decision.allowed && decision.retryAfterMs != null)
-    headers["retry-after"] = String(Math.max(1, Math.ceil(decision.retryAfterMs / 1000)));
-  return headers;
-}
-function defaultRateLimitRules() {
-  return [
-    { id: "global-ip", limit: 600, windowMs: 60000, burst: 100, key: { source: "ip" }, action: "deny", priority: 100 },
-    {
-      id: "api-ip",
-      limit: 120,
-      windowMs: 60000,
-      burst: 30,
-      path: "/api/**",
-      key: { source: "ip" },
-      action: "deny",
-      priority: 50
-    },
-    {
-      id: "auth-ip",
-      limit: 10,
-      windowMs: 60000,
-      algorithm: "sliding_window",
-      path: "/auth/**",
-      methods: ["POST"],
-      key: { source: "ip" },
-      action: "challenge",
-      priority: 10
-    }
-  ];
-}
-// src/protection/controls.ts
-var PROTECTION_SETTING = "protection.controls";
-var MAX_CONTROL_HOURS = 24;
-var DEFAULT_ATTACK_MODE_HOURS = 4;
-var EMPTY = { ipRules: { allow: [], block: [] } };
-function activeControl(control, now) {
-  if (!control?.enabled)
-    return;
-  return new Date(control.expiresAt).getTime() > now.getTime() ? control : undefined;
-}
-function clampHours(hours, fallback) {
-  const value = Number.isFinite(hours) ? Number(hours) : fallback;
-  return Math.min(MAX_CONTROL_HOURS, Math.max(0.25, value));
-}
-var MAX_IP_RULES = 500;
-
-class ProtectionControlStore {
-  controlPlane;
-  options;
-  constructor(controlPlane, options = {}) {
-    this.controlPlane = controlPlane;
-    this.options = options;
-  }
-  now() {
-    return this.options.now?.() ?? new Date;
-  }
-  read() {
-    const raw = this.controlPlane.getSetting(PROTECTION_SETTING);
-    if (!raw || typeof raw !== "object" || Array.isArray(raw))
-      return { ...EMPTY, ipRules: { allow: [], block: [] } };
-    const record = raw;
-    return {
-      attackMode: record.attackMode,
-      mitigationPause: record.mitigationPause,
-      ipRules: {
-        allow: Array.isArray(record.ipRules?.allow) ? record.ipRules.allow : [],
-        block: Array.isArray(record.ipRules?.block) ? record.ipRules.block : []
-      },
-      updatedAt: record.updatedAt
-    };
-  }
-  write(next) {
-    const stored = { ...next, updatedAt: this.now().toISOString() };
-    this.controlPlane.setSetting(PROTECTION_SETTING, stored);
-    return stored;
-  }
-  raw() {
-    return this.read();
-  }
-  current() {
-    const now = this.now();
-    const stored = this.read();
-    return {
-      attackMode: activeControl(stored.attackMode, now),
-      mitigationPause: activeControl(stored.mitigationPause, now),
-      ipRules: stored.ipRules
-    };
-  }
-  enableAttackMode(input) {
-    const now = this.now();
-    const control = {
-      enabled: true,
-      startedAt: now.toISOString(),
-      expiresAt: new Date(now.getTime() + clampHours(input.hours, DEFAULT_ATTACK_MODE_HOURS) * 3600000).toISOString(),
-      reason: input.reason.trim() || "Attack mode enabled by an operator.",
-      actorId: input.actorId
-    };
-    this.write({ ...this.read(), attackMode: control });
-    return control;
-  }
-  disableAttackMode() {
-    const stored = this.read();
-    if (!stored.attackMode?.enabled)
-      return false;
-    this.write({ ...stored, attackMode: { ...stored.attackMode, enabled: false } });
-    return true;
-  }
-  pauseMitigations(input) {
-    const reason = input.reason.trim();
-    if (!reason)
-      throw new Error("Pausing mitigations requires a reason: you are liable for the traffic it admits.");
-    const now = this.now();
-    const control = {
-      enabled: true,
-      startedAt: now.toISOString(),
-      expiresAt: new Date(now.getTime() + clampHours(input.hours, MAX_CONTROL_HOURS) * 3600000).toISOString(),
-      reason,
-      actorId: input.actorId
-    };
-    this.write({ ...this.read(), mitigationPause: control });
-    return control;
-  }
-  resumeMitigations() {
-    const stored = this.read();
-    if (!stored.mitigationPause?.enabled)
-      return false;
-    this.write({ ...stored, mitigationPause: { ...stored.mitigationPause, enabled: false } });
-    return true;
-  }
-  addIpRule(list, cidr) {
-    const value = cidr.trim();
-    if (!isValidCidr(value))
-      throw new Error(`Not a valid IP or CIDR: ${cidr}`);
-    const stored = this.read();
-    const next = { ...stored.ipRules, [list]: [...new Set([...stored.ipRules[list], value])] };
-    if (next[list].length > MAX_IP_RULES)
-      throw new Error(`At most ${MAX_IP_RULES} ${list} rules are supported.`);
-    const other = list === "allow" ? "block" : "allow";
-    next[other] = next[other].filter((entry) => entry !== value);
-    this.write({ ...stored, ipRules: next });
-    return next;
-  }
-  removeIpRule(list, cidr) {
-    const stored = this.read();
-    const next = { ...stored.ipRules, [list]: stored.ipRules[list].filter((entry) => entry !== cidr.trim()) };
-    this.write({ ...stored, ipRules: next });
-    return next;
-  }
-}
-function describePosture(controls) {
-  if (controls.mitigationPause)
-    return {
-      attackMode: !!controls.attackMode,
-      mitigationPaused: true,
-      summary: `Automatic mitigation is paused until ${controls.mitigationPause.expiresAt}. All traffic is being served and billed.`,
-      expiresAt: controls.mitigationPause.expiresAt
-    };
-  if (controls.attackMode)
-    return {
-      attackMode: true,
-      mitigationPaused: false,
-      summary: `Attack mode is on until ${controls.attackMode.expiresAt}. Every visitor is being challenged.`,
-      expiresAt: controls.attackMode.expiresAt
-    };
-  return { attackMode: false, mitigationPaused: false, summary: "Protection is in its normal posture." };
-}
-function applyControlsToRateLimits(rules, controls) {
-  if (controls.mitigationPause)
-    return rules.map((rule) => ({ ...rule, enabled: false }));
-  if (!controls.attackMode)
-    return [...rules];
-  return rules.map((rule) => ({
-    ...rule,
-    action: rule.action === "deny" ? "deny" : "challenge",
-    burst: Math.max(1, Math.min(rule.burst ?? rule.limit, 5))
-  }));
-}
-function applyControlsToDdos(config, controls) {
-  const allowlist = [...new Set([...config.allowlist ?? [], ...controls.ipRules.allow])];
-  const blocklist = [...new Set([...config.blocklist ?? [], ...controls.ipRules.block])];
-  if (controls.mitigationPause)
-    return { ...config, allowlist, blocklist, monitorOnly: true };
-  if (!controls.attackMode)
-    return { ...config, allowlist, blocklist };
-  const thresholds = config.thresholds ?? {};
-  return {
-    ...config,
-    allowlist,
-    blocklist,
-    thresholds: {
-      ...thresholds,
-      newConnectionsPerSecond: Math.max(1, Math.floor((thresholds.newConnectionsPerSecond ?? 50) / 5)),
-      concurrentPerSource: Math.max(1, Math.floor((thresholds.concurrentPerSource ?? 100) / 5))
-    }
-  };
-}
-function mergeControlsIntoConfig(config, controls) {
-  const compute = config?.infrastructure?.compute;
-  if (!compute || compute.ddos === false)
-    return config;
-  const base = typeof compute.ddos === "object" && compute.ddos !== null ? compute.ddos : {};
-  return {
-    ...config,
-    infrastructure: {
-      ...config.infrastructure,
-      compute: { ...compute, ddos: applyControlsToDdos(base, controls) }
-    }
-  };
-}
-export { RATE_LIMIT_KEY_SEPARATOR, globMatches, ruleMatches, rateLimitKey, RateLimiter, rateLimitHeaders, defaultRateLimitRules, PROTECTION_SETTING, MAX_CONTROL_HOURS, DEFAULT_ATTACK_MODE_HOURS, ProtectionControlStore, describePosture, applyControlsToRateLimits, applyControlsToDdos, mergeControlsIntoConfig };

package/dist/chunk-f55nkpvb.js

@@ -1,8 +0,0 @@
-import {
-  RDSClient
-} from "./chunk-he9a874b.js";
-import"./chunk-zqtpg06c.js";
-import"./chunk-v0bahtg2.js";
-export {
-  RDSClient
-};