@stacksjs/ts-cloud 0.9.3 → 0.10.0

package/dist/chunk-ttz2ra5j.js

@@ -1,12 +0,0 @@
-import {
-  EmailClient,
-  email
-} from "./chunk-nsgqsmrh.js";
-import"./chunk-32e7ya18.js";
-import"./chunk-rds0sy87.js";
-import"./chunk-zqtpg06c.js";
-import"./chunk-v0bahtg2.js";
-export {
-  email,
-  EmailClient
-};

package/dist/chunk-v0bahtg2.js

@@ -1,4 +0,0 @@
-import { createRequire } from "node:module";
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
-
-export { __require };

package/dist/chunk-va2yd85b.js

@@ -1,200 +0,0 @@
-// src/protection/waf.ts
-var DEFAULTS = {
-  mode: "detection",
-  paranoiaLevel: 1,
-  inboundThreshold: 5,
-  outboundThreshold: 4,
-  maxBodyBytes: 13107200,
-  rejectOversizedBody: true,
-  auditLogPath: "/var/log/ts-cloud/waf-audit.log",
-  blockStatus: 403
-};
-var RULE_IDS = {
-  bypassBase: 1e5,
-  exclusionBase: 101000,
-  rateLimitBase: 102000,
-  customBase: 109000
-};
-function escapeSecLang(value) {
-  return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/[\r\n]+/g, " ");
-}
-function isSafePattern(pattern) {
-  if (pattern.length > 1000)
-    return false;
-  if (/\([^)]*[+*]\)[+*]/.test(pattern))
-    return false;
-  if (/\[[^\]]*\][+*]\{/.test(pattern))
-    return false;
-  try {
-    new RegExp(pattern);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function rateLimitMarkers(rules, startId) {
-  const lines = [];
-  const unmapped = [];
-  let id = startId;
-  for (const rule of rules) {
-    if (rule.enabled === false)
-      continue;
-    if (rule.key && (rule.key.source === "cookie" || rule.key.source === "header") && !rule.key.name) {
-      unmapped.push({ ruleId: rule.id, reason: "The rule keys on a header or cookie but names none." });
-      continue;
-    }
-    const pattern = rule.path ? globToRegex(rule.path) : ".*";
-    if (!isSafePattern(pattern)) {
-      unmapped.push({ ruleId: rule.id, reason: "The path pattern compiles to an unsafe regular expression." });
-      continue;
-    }
-    const conditions = [`SecRule REQUEST_URI "@rx ${escapeSecLang(pattern)}"`];
-    if (rule.methods?.length)
-      conditions.push(`  "chain,id:${id},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${escapeSecLang(rule.id)}'"`);
-    else
-      conditions.push(`  "id:${id},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${escapeSecLang(rule.id)}'"`);
-    lines.push(`# Marks requests governed by the ts-cloud rate limit "${escapeSecLang(rule.id)}".`);
-    lines.push(conditions.join(" \\\n"));
-    if (rule.methods?.length)
-      lines.push(`  SecRule REQUEST_METHOD "@within ${escapeSecLang(rule.methods.join(" ").toUpperCase())}" "t:none"`);
-    lines.push("");
-    id++;
-  }
-  return { lines, unmapped };
-}
-function globToRegex(glob) {
-  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\x01").replace(/\*/g, "[^/]*").replace(/\u0001/g, ".*");
-  return `^${escaped}$`;
-}
-function renderWafConfig(config = {}, rateLimits = []) {
-  const mode = config.mode ?? DEFAULTS.mode;
-  const warnings = [];
-  const paranoia = config.paranoiaLevel ?? DEFAULTS.paranoiaLevel;
-  const inbound = config.inboundThreshold ?? DEFAULTS.inboundThreshold;
-  const outbound = config.outboundThreshold ?? DEFAULTS.outboundThreshold;
-  const maxBody = config.maxBodyBytes ?? DEFAULTS.maxBodyBytes;
-  const rejectOversized = config.rejectOversizedBody !== false;
-  if (mode === "blocking" && paranoia >= 3)
-    warnings.push(`Paranoia level ${paranoia} blocks legitimate traffic on most applications until it is tuned. Run it in detection mode first.`);
-  if (mode === "blocking")
-    warnings.push("zig-waf is pre-alpha. Blocking mode makes it a failure path for every request.");
-  if (!rejectOversized)
-    warnings.push("Oversized bodies are passed through uninspected, so padding a request bypasses every rule.");
-  if (config.bypassPaths?.length)
-    warnings.push(`${config.bypassPaths.length} path(s) bypass inspection entirely.`);
-  const lines = [
-    "# Managed by ts-cloud. Edits are overwritten on the next deploy.",
-    `# Mode: ${mode}. Paranoia level: ${paranoia}.`,
-    ""
-  ];
-  if (mode === "off") {
-    lines.push("SecRuleEngine Off", "");
-    return { config: `${lines.join(`
-`)}
-`, unmappedRateLimits: [], warnings, mode };
-  }
-  lines.push(`SecRuleEngine ${mode === "blocking" ? "On" : "DetectionOnly"}`, "SecRequestBodyAccess On", "SecResponseBodyAccess Off", `SecRequestBodyLimit ${maxBody}`, `SecRequestBodyNoFilesLimit ${Math.min(maxBody, 131072)}`, `SecRequestBodyLimitAction ${rejectOversized ? "Reject" : "ProcessPartial"}`, "SecRequestBodyInMemoryLimit 131072", `SecAuditEngine ${mode === "blocking" ? "RelevantOnly" : "On"}`, "SecAuditLogParts ABIJDEFHZ", `SecAuditLog ${escapeSecLang(config.auditLogPath ?? DEFAULTS.auditLogPath)}`, "SecAuditLogType Serial", `SecDefaultAction "phase:1,log,auditlog,${mode === "blocking" ? `deny,status:${config.blockStatus ?? DEFAULTS.blockStatus}` : "pass"}"`, "", "# CRS anomaly scoring setup.", `SecAction "id:900000,phase:1,pass,nolog,t:none,setvar:tx.paranoia_level=${paranoia}"`, `SecAction "id:900001,phase:1,pass,nolog,t:none,setvar:tx.inbound_anomaly_score_threshold=${inbound}"`, `SecAction "id:900002,phase:1,pass,nolog,t:none,setvar:tx.outbound_anomaly_score_threshold=${outbound}"`, 'SecAction "id:900003,phase:1,pass,nolog,t:none,setvar:tx.critical_anomaly_score=5,setvar:tx.error_anomaly_score=4,setvar:tx.warning_anomaly_score=3,setvar:tx.notice_anomaly_score=2"', 'SecAction "id:900004,phase:1,pass,nolog,t:none,setvar:tx.anomaly_score=0"', "");
-  let bypassId = RULE_IDS.bypassBase;
-  for (const path of config.bypassPaths ?? []) {
-    const pattern = globToRegex(path);
-    if (!isSafePattern(pattern)) {
-      warnings.push(`Bypass path "${path}" was dropped: it compiles to an unsafe regular expression.`);
-      continue;
-    }
-    lines.push(`# Inspection bypass for ${escapeSecLang(path)}. Every bypass is an unguarded route.`, `SecRule REQUEST_URI "@rx ${escapeSecLang(pattern)}" "id:${bypassId},phase:1,pass,nolog,ctl:ruleEngine=Off"`, "");
-    bypassId++;
-  }
-  let exclusionId = RULE_IDS.exclusionBase;
-  for (const exclusion of config.exclusions ?? []) {
-    if (!Number.isInteger(exclusion.ruleId) || exclusion.ruleId <= 0) {
-      warnings.push(`Exclusion with rule id "${exclusion.ruleId}" was dropped: the id is not a positive integer.`);
-      continue;
-    }
-    lines.push(`# ${escapeSecLang(exclusion.reason)}`);
-    if (exclusion.pathPattern) {
-      if (!isSafePattern(exclusion.pathPattern)) {
-        warnings.push(`Exclusion for rule ${exclusion.ruleId} was dropped: its path pattern is unsafe.`);
-        continue;
-      }
-      lines.push(`SecRule REQUEST_URI "@rx ${escapeSecLang(exclusion.pathPattern)}" "id:${exclusionId},phase:1,pass,nolog,ctl:ruleRemoveById=${exclusion.ruleId}"`);
-      exclusionId++;
-    } else {
-      lines.push(`SecRuleRemoveById ${exclusion.ruleId}`);
-    }
-    lines.push("");
-  }
-  const markers = rateLimitMarkers(rateLimits, RULE_IDS.rateLimitBase);
-  if (markers.lines.length > 0) {
-    lines.push("# Rate-limit route markers. SecLang has no counters, so the tag is set", "# here and the counting stays in the ts-cloud limiter.", ...markers.lines);
-  }
-  let customId = RULE_IDS.customBase;
-  for (const rule of config.customRules ?? []) {
-    lines.push(`# Operator-supplied rule ${customId}.`, rule.trim(), "");
-    customId++;
-  }
-  if (mode === "blocking")
-    lines.push("# Blocking decision: one rule, at the end, on the accumulated score.", `SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:949110,phase:2,deny,status:${config.blockStatus ?? DEFAULTS.blockStatus},log,msg:'Inbound anomaly score exceeded (total: %{tx.anomaly_score})'"`, "");
-  return { config: `${lines.join(`
-`)}
-`, unmappedRateLimits: markers.unmapped, warnings, mode };
-}
-function renderWafInstallScript(config = {}, rateLimits = [], options = {}) {
-  const binary = options.binary ?? "/usr/local/bin/zig-waf";
-  const configPath = options.configPath ?? "/etc/ts-cloud/waf.conf";
-  const rendered = renderWafConfig(config, rateLimits);
-  return `#!/usr/bin/env bash
-# Managed by ts-cloud. Installs the zig-waf ruleset.
-set -euo pipefail
-
-if [ ! -x "${binary}" ]; then
-  echo "ts-cloud: ${binary} is not installed; skipping WAF configuration" >&2
-  exit 0
-fi
-
-install -d -m 0755 "$(dirname "${configPath}")"
-install -d -m 0750 /var/log/ts-cloud
-
-cat > "${configPath}.new" <<'WAF_EOF'
-${rendered.config}WAF_EOF
-
-# Compile the config before it goes live. A config that does not validate
-# would leave the engine with no rules while still reporting itself enabled.
-if ! "${binary}" validate "${configPath}.new"; then
-  echo "ts-cloud: generated WAF config failed validation, keeping the previous one" >&2
-  rm -f "${configPath}.new"
-  exit 1
-fi
-
-if [ -f "${configPath}" ] && cmp -s "${configPath}.new" "${configPath}"; then
-  rm -f "${configPath}.new"
-  echo "ts-cloud: WAF config unchanged"
-  exit 0
-fi
-
-mv "${configPath}.new" "${configPath}"
-echo "ts-cloud: WAF config installed (mode: ${rendered.mode})"
-`;
-}
-function wafEventTelemetry(events, scope) {
-  return events.map((event) => ({
-    projectId: scope.projectId,
-    environmentId: scope.environmentId,
-    resourceId: scope.resourceId,
-    kind: "event",
-    source: "zig-waf",
-    name: event.action === "blocked" ? "waf.blocked" : "waf.matched",
-    timestamp: event.timestamp,
-    value: 1,
-    host: event.host,
-    pathTemplate: event.path,
-    method: event.method,
-    attributes: {
-      ruleId: event.ruleId ?? null,
-      anomalyScore: event.anomalyScore,
-      action: event.action,
-      messages: event.messages.slice(0, 5)
-    }
-  }));
-}
-
-export { escapeSecLang, isSafePattern, globToRegex, renderWafConfig, renderWafInstallScript, wafEventTelemetry };

package/dist/chunk-x9s0cqfx.js

@@ -1,13 +0,0 @@
-import {
-  AWSClient,
-  buildQueryParams,
-  detectCredentialSource,
-  resolveS3Endpoint
-} from "./chunk-zqtpg06c.js";
-import"./chunk-v0bahtg2.js";
-export {
-  resolveS3Endpoint,
-  detectCredentialSource,
-  buildQueryParams,
-  AWSClient
-};