edgeaegis 2026.10.1

package/tools/.build/scr/seclang/vendor/unicode.json

@@ -0,0 +1,378 @@
+{
+  "source": "owasp-modsecurity/ModSecurity/unicode.mapping",
+  "sourceBlob": "2654c4a619bd585de547d0e4eeecec5753d56eeb",
+  "sha256": "5e4500ef82e45c49d8edd9513648939710d6c8cc2d5997513b32866dc5d9be23",
+  "codepage": 20127,
+  "mapping": {
+    "160": 32,
+    "161": 33,
+    "162": 99,
+    "164": 36,
+    "165": 89,
+    "166": 124,
+    "169": 67,
+    "170": 97,
+    "171": 60,
+    "173": 45,
+    "174": 82,
+    "178": 50,
+    "179": 51,
+    "183": 46,
+    "184": 44,
+    "185": 49,
+    "186": 111,
+    "187": 62,
+    "192": 65,
+    "193": 65,
+    "194": 65,
+    "195": 65,
+    "196": 65,
+    "197": 65,
+    "198": 65,
+    "199": 67,
+    "200": 69,
+    "201": 69,
+    "202": 69,
+    "203": 69,
+    "204": 73,
+    "205": 73,
+    "206": 73,
+    "207": 73,
+    "208": 68,
+    "209": 78,
+    "210": 79,
+    "211": 79,
+    "212": 79,
+    "213": 79,
+    "214": 79,
+    "216": 79,
+    "217": 85,
+    "218": 85,
+    "219": 85,
+    "220": 85,
+    "221": 89,
+    "224": 97,
+    "225": 97,
+    "226": 97,
+    "227": 97,
+    "228": 97,
+    "229": 97,
+    "230": 97,
+    "231": 99,
+    "232": 101,
+    "233": 101,
+    "234": 101,
+    "235": 101,
+    "236": 105,
+    "237": 105,
+    "238": 105,
+    "239": 105,
+    "241": 110,
+    "242": 111,
+    "243": 111,
+    "244": 111,
+    "245": 111,
+    "246": 111,
+    "248": 111,
+    "249": 117,
+    "250": 117,
+    "251": 117,
+    "252": 117,
+    "253": 121,
+    "255": 121,
+    "256": 65,
+    "257": 97,
+    "258": 65,
+    "259": 97,
+    "260": 65,
+    "261": 97,
+    "262": 67,
+    "263": 99,
+    "264": 67,
+    "265": 99,
+    "266": 67,
+    "267": 99,
+    "268": 67,
+    "269": 99,
+    "270": 68,
+    "271": 100,
+    "272": 68,
+    "273": 100,
+    "274": 69,
+    "275": 101,
+    "276": 69,
+    "277": 101,
+    "278": 69,
+    "279": 101,
+    "280": 69,
+    "281": 101,
+    "282": 69,
+    "283": 101,
+    "284": 71,
+    "285": 103,
+    "286": 71,
+    "287": 103,
+    "288": 71,
+    "289": 103,
+    "290": 71,
+    "291": 103,
+    "292": 72,
+    "293": 104,
+    "294": 72,
+    "295": 104,
+    "296": 73,
+    "297": 105,
+    "298": 73,
+    "299": 105,
+    "300": 73,
+    "301": 105,
+    "302": 73,
+    "303": 105,
+    "304": 73,
+    "305": 105,
+    "308": 74,
+    "309": 106,
+    "310": 75,
+    "311": 107,
+    "313": 76,
+    "314": 108,
+    "315": 76,
+    "316": 108,
+    "317": 76,
+    "318": 108,
+    "321": 76,
+    "322": 108,
+    "323": 78,
+    "324": 110,
+    "325": 78,
+    "326": 110,
+    "327": 78,
+    "328": 110,
+    "332": 79,
+    "333": 111,
+    "334": 79,
+    "335": 111,
+    "336": 79,
+    "337": 111,
+    "338": 79,
+    "339": 111,
+    "340": 82,
+    "341": 114,
+    "342": 82,
+    "343": 114,
+    "344": 82,
+    "345": 114,
+    "346": 83,
+    "347": 115,
+    "348": 83,
+    "349": 115,
+    "350": 83,
+    "351": 115,
+    "352": 83,
+    "353": 115,
+    "354": 84,
+    "355": 116,
+    "356": 84,
+    "357": 116,
+    "358": 84,
+    "359": 116,
+    "360": 85,
+    "361": 117,
+    "362": 85,
+    "363": 117,
+    "364": 85,
+    "365": 117,
+    "366": 85,
+    "367": 117,
+    "368": 85,
+    "369": 117,
+    "370": 85,
+    "371": 117,
+    "372": 87,
+    "373": 119,
+    "374": 89,
+    "375": 121,
+    "376": 89,
+    "377": 90,
+    "379": 90,
+    "380": 122,
+    "381": 90,
+    "382": 122,
+    "384": 98,
+    "393": 68,
+    "401": 70,
+    "402": 102,
+    "407": 73,
+    "410": 108,
+    "415": 79,
+    "416": 79,
+    "417": 111,
+    "427": 116,
+    "430": 84,
+    "431": 85,
+    "432": 117,
+    "438": 122,
+    "461": 65,
+    "462": 97,
+    "463": 73,
+    "464": 105,
+    "465": 79,
+    "466": 111,
+    "467": 85,
+    "468": 117,
+    "469": 85,
+    "470": 117,
+    "471": 85,
+    "472": 117,
+    "473": 85,
+    "474": 117,
+    "475": 85,
+    "476": 117,
+    "478": 65,
+    "479": 97,
+    "484": 71,
+    "485": 103,
+    "486": 71,
+    "487": 103,
+    "488": 75,
+    "489": 107,
+    "490": 79,
+    "491": 111,
+    "492": 79,
+    "493": 111,
+    "496": 106,
+    "609": 103,
+    "697": 39,
+    "698": 34,
+    "700": 39,
+    "708": 94,
+    "710": 94,
+    "712": 39,
+    "715": 96,
+    "717": 95,
+    "732": 126,
+    "768": 96,
+    "770": 94,
+    "771": 126,
+    "782": 34,
+    "817": 95,
+    "818": 95,
+    "8192": 32,
+    "8193": 32,
+    "8194": 32,
+    "8195": 32,
+    "8196": 32,
+    "8197": 32,
+    "8198": 32,
+    "8208": 45,
+    "8209": 45,
+    "8211": 45,
+    "8212": 45,
+    "8216": 39,
+    "8217": 39,
+    "8218": 44,
+    "8220": 34,
+    "8221": 34,
+    "8222": 34,
+    "8226": 46,
+    "8230": 46,
+    "8242": 39,
+    "8245": 96,
+    "8249": 60,
+    "8250": 62,
+    "8482": 84,
+    "65281": 33,
+    "65282": 34,
+    "65283": 35,
+    "65284": 36,
+    "65285": 37,
+    "65286": 38,
+    "65287": 39,
+    "65288": 40,
+    "65289": 41,
+    "65290": 42,
+    "65291": 43,
+    "65292": 44,
+    "65293": 45,
+    "65294": 46,
+    "65295": 47,
+    "65296": 48,
+    "65297": 49,
+    "65298": 50,
+    "65299": 51,
+    "65300": 52,
+    "65301": 53,
+    "65302": 54,
+    "65303": 55,
+    "65304": 56,
+    "65305": 57,
+    "65306": 58,
+    "65307": 59,
+    "65308": 60,
+    "65309": 61,
+    "65310": 62,
+    "65312": 64,
+    "65313": 65,
+    "65314": 66,
+    "65315": 67,
+    "65316": 68,
+    "65317": 69,
+    "65318": 70,
+    "65319": 71,
+    "65320": 72,
+    "65321": 73,
+    "65322": 74,
+    "65323": 75,
+    "65324": 76,
+    "65325": 77,
+    "65326": 78,
+    "65327": 79,
+    "65328": 80,
+    "65329": 81,
+    "65330": 82,
+    "65331": 83,
+    "65332": 84,
+    "65333": 85,
+    "65334": 86,
+    "65335": 87,
+    "65336": 88,
+    "65337": 89,
+    "65338": 90,
+    "65339": 91,
+    "65340": 92,
+    "65341": 93,
+    "65342": 94,
+    "65343": 95,
+    "65344": 96,
+    "65345": 97,
+    "65346": 98,
+    "65347": 99,
+    "65348": 100,
+    "65349": 101,
+    "65350": 102,
+    "65351": 103,
+    "65352": 104,
+    "65353": 105,
+    "65354": 106,
+    "65355": 107,
+    "65356": 108,
+    "65357": 109,
+    "65358": 110,
+    "65359": 111,
+    "65360": 112,
+    "65361": 113,
+    "65362": 114,
+    "65363": 115,
+    "65364": 116,
+    "65365": 117,
+    "65366": 118,
+    "65367": 119,
+    "65368": 120,
+    "65369": 121,
+    "65370": 122,
+    "65371": 123,
+    "65372": 124,
+    "65373": 125,
+    "65374": 126
+  }
+}

package/tools/build-platform.mjs

@@ -0,0 +1,199 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { build } from "esbuild";
+import { readCredentials, readData } from "./.build/scr/cli/config.js";
+import { readDeployment } from "./.build/scr/cli/deployment.js";
+import { readResponsePages } from "./.build/scr/cli/responses.js";
+import { compileSecLang } from "./.build/scr/seclang/index.js";
+import { loadSecLangDeployment } from "./.build/scr/seclang/node.js";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+export async function buildPlatform(
+  platform,
+  configFile = resolve("config.yml"),
+  outputDirectory = resolve(dirname(configFile), "tools/.build", platform),
+) {
+  if (!["cloudflare", "vercel", "netlify", "esa", "edgeone"].includes(platform))
+    throw new Error("Unknown deployment platform");
+  const { config, businesses, originRoot, platformRoot } = await readDeployment(
+    configFile,
+    platform,
+  );
+  const credentials = await readCredentials(config.secretFile),
+    native = await loadSecLangDeployment(
+      config.secLangFile,
+      config.localRulesFile,
+      config.setupRulesFile,
+    );
+  const program = compileSecLang(native.secLang, { ...native.secLangOptions, strict: true });
+  program.dispose();
+  const data = {
+    config,
+    credentials,
+    source: native.secLang,
+    files: native.secLangOptions.files,
+    allowlist: config.allowlistFile ? await readData(config.allowlistFile) : [],
+    errorPages: config.responses
+      ? await readResponsePages(config.responses.directory, config.responses.contentSecurityPolicy)
+      : {},
+  };
+  // Only the selected platform's business is bundled.
+  const directory = resolve(outputDirectory);
+  await mkdir(directory, { recursive: true });
+  const rel = (path) => JSON.stringify(path.replaceAll("\\", "/"));
+  const imports = [],
+    transports = [];
+  for (const [name, { settings, businessFile }] of Object.entries(businesses)) {
+    const id = imports.length;
+    if (settings.mode === "function") {
+      imports.push(`import business${id} from ${rel(businessFile)};`);
+      transports.push(
+        `${JSON.stringify(name)}:(input,init)=>Promise.resolve(business${id}.fetch(new Request(input,init)))`,
+      );
+    } else if (settings.mode === "proxy")
+      transports.push(`${JSON.stringify(name)}:(input,init)=>fetch(input,init)`);
+    else {
+      imports.push(
+        `import {createRelayTransport as createRelay${id}}from ${rel(resolve(root, "tools/.build/scr/origin/relay.js"))};const transport${id}=createRelay${id}(${JSON.stringify({ endpoint: settings.endpoint, serverPublicKey: await readData(settings.publicKeyFile, 16384), authenticationKey: await readData(settings.authenticationKeyFile, 4096), maxBytes: config.limits?.maxBodyBytes ?? 8388608 })});`,
+      );
+      transports.push(
+        `${JSON.stringify(name)}:async(input,init)=>(await transport${id})(input,init)`,
+      );
+    }
+  }
+  const origin = `${imports.join("\n")}\nexport default {${transports.join(",")}};`;
+  const wasm = [];
+  for (const name of ["pcre2", "libinjection"])
+    wasm.push(await readFile(resolve(root, "tools/.build/scr/seclang/vendor", `${name}.wasm`)));
+  const wasmSource =
+    platform === "cloudflare"
+      ? `import PCRE2 from './pcre2.wasm';import INJECTION from './libinjection.wasm';export{PCRE2,INJECTION};`
+      : `const decode=s=>Uint8Array.from(atob(s),c=>c.charCodeAt(0));export const PCRE2=decode('${wasm[0].toString("base64")}'),INJECTION=decode('${wasm[1].toString("base64")}');`;
+  const allowed = platformRoot;
+  const result = await build({
+    entryPoints: [resolve(root, `tools/.build/scr/adapters/${platform}/worker.js`)],
+    bundle: true,
+    write: false,
+    metafile: true,
+    format: "esm",
+    platform: "browser",
+    target: "es2022",
+    outdir: directory,
+    sourcemap: false,
+    logLevel: "silent",
+    external: ["*.wasm"],
+    plugins: [
+      {
+        name: "private-project-assets",
+        setup(api) {
+          api.onResolve({ filter: /^edgeaegis:/ }, (args) => ({
+            path: args.path,
+            namespace: "project",
+          }));
+          api.onLoad({ filter: /.*/, namespace: "project" }, (args) => ({
+            contents:
+              args.path === "edgeaegis:deployment"
+                ? `export default ${JSON.stringify(data)};`
+                : args.path === "edgeaegis:origin"
+                  ? origin
+                  : wasmSource,
+            loader: "js",
+            resolveDir: directory,
+          }));
+          // Reject even transitive imports of another platform's business files.
+          api.onLoad({ filter: /.*/ }, (args) => {
+            const inside = relative(originRoot, args.path);
+            if (!inside.startsWith("..") && !isAbsolute(inside)) {
+              const own = relative(allowed, args.path);
+              if (own.startsWith("..") || isAbsolute(own))
+                throw new Error("Cross-platform origin import is forbidden");
+            }
+            return undefined;
+          });
+        },
+      },
+    ],
+  });
+  for (const output of result.outputFiles)
+    await writeFile(output.path, output.contents, { mode: 0o600 });
+  if (platform === "cloudflare")
+    for (let i = 0; i < wasm.length; i++)
+      await writeFile(join(directory, `${i ? "libinjection" : "pcre2"}.wasm`), wasm[i]);
+  if (Object.keys(result.metafile.inputs).some((path) => /secret\/relay\/private/.test(path)))
+    throw new Error("Relay private key must not enter a cloud build");
+  const deployDirectory = join(directory, "deploy");
+  await mkdir(deployDirectory, { recursive: true });
+  const code = result.outputFiles.find((file) => file.path.endsWith("worker.js")).contents;
+  const name = `edgeaegis-${config.tenant}-${config.service}`
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, "-")
+    .slice(0, 63);
+  const put = async (path, content) => {
+    const file = join(deployDirectory, path);
+    await mkdir(dirname(file), { recursive: true });
+    await writeFile(file, content, { mode: 0o600 });
+  };
+  await put(
+    "package.json",
+    JSON.stringify({ private: true, type: "module", engines: { node: "24.x" } }),
+  );
+  if (platform === "cloudflare") {
+    await put("worker.js", code);
+    await put(
+      "wrangler.json",
+      JSON.stringify(
+        {
+          name,
+          main: "worker.js",
+          compatibility_date: "2026-10-01",
+          workers_dev: false,
+          preview_urls: false,
+          routes: [],
+          send_metrics: false,
+          no_bundle: true,
+          rules: [{ type: "CompiledWasm", globs: ["**/*.wasm"], fallthrough: false }],
+        },
+        null,
+        2,
+      ),
+    );
+    for (let i = 0; i < wasm.length; i++)
+      await put(`${i ? "libinjection" : "pcre2"}.wasm`, wasm[i]);
+  } else if (platform === "vercel") {
+    await put("api/index.mjs", code);
+    await put(
+      "vercel.json",
+      JSON.stringify(
+        { version: 2, rewrites: [{ source: "/:path*", destination: "/api/index" }] },
+        null,
+        2,
+      ),
+    );
+  } else if (platform === "netlify") {
+    await put("edge-functions/edgeaegis.js", code);
+    await mkdir(join(deployDirectory, "public"), { recursive: true });
+    await put("netlify.toml", '[build]\npublish = "public"\nedge_functions = "edge-functions"\n');
+  } else if (platform === "esa") {
+    await put("worker.js", code);
+    await put("esa.jsonc", JSON.stringify({ name, entry: "./worker.js" }, null, 2));
+  } else
+    await put(
+      "edge-functions/[[default]].js",
+      `${new TextDecoder().decode(code)}\nexport default onRequest;\n`,
+    );
+  return {
+    directory,
+    deployDirectory,
+    entry: join(directory, "worker.js"),
+    inputs: Object.keys(result.metafile.inputs),
+    bytes: result.outputFiles.reduce((n, file) => n + file.contents.length, 0),
+  };
+}
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const result = await buildPlatform(
+    process.argv[2],
+    process.argv[3] ? resolve(process.argv[3]) : undefined,
+  );
+  console.log(JSON.stringify({ directory: result.directory, bytes: result.bytes }));
+}

package/tools/platform-command.mjs

@@ -0,0 +1,59 @@
+import { execFileSync } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { buildPlatform } from "./build-platform.mjs";
+export async function platformCommand(
+  command,
+  platform,
+  file = "config.yml",
+  { plan = false } = {},
+) {
+  const providers = {
+    cloudflare: ["wrangler", "wrangler", ["dev"], ["deploy"]],
+    vercel: ["vercel", "vercel", ["dev"], ["deploy", "--prod"]],
+    netlify: ["netlify-cli", "netlify", ["dev"], ["deploy", "--prod", "--no-build"]],
+    esa: ["esa-cli", "esa-cli", ["dev"], ["deploy"]],
+    edgeone: ["edgeone", "edgeone", ["makers", "dev"], ["makers", "deploy"]],
+  };
+  if (!Object.hasOwn(providers, platform) || !["build", "start", "deploy"].includes(command))
+    throw Error("Unknown platform command");
+  const built = await buildPlatform(platform, resolve(file));
+  if (command === "build") return built;
+  const [packageName, tool, dev, deploy] = providers[platform],
+    args = [...(command === "start" ? dev : deploy)];
+  if (platform === "cloudflare") args.push("--config", "wrangler.json");
+  const result = { platform, tool, args, cwd: built.deployDirectory };
+  if (plan) return result;
+  let entry;
+  for (const location of [dirname(resolve(file)), resolve(dirname(file), "tools")])
+    try {
+      const require = createRequire(join(location, "package.json"));
+      const manifestFile = require.resolve(`${packageName}/package.json`),
+        manifest = JSON.parse(await readFile(manifestFile, "utf8"));
+      const bin = typeof manifest.bin === "string" ? manifest.bin : manifest.bin?.[tool];
+      if (bin) {
+        entry = resolve(dirname(manifestFile), bin);
+        break;
+      }
+    } catch {}
+  if (!entry)
+    throw Error(`Install ${packageName} in the deployment project before running ${tool}`);
+  execFileSync(process.execPath, [entry, ...args], {
+    cwd: result.cwd,
+    stdio: "inherit",
+    windowsHide: true,
+  });
+  return result;
+}
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const [command, platform, ...rest] = process.argv.slice(2),
+    positional = rest.filter((v) => v !== "--plan");
+  if (positional.length > 1) throw Error("Unexpected command arguments");
+  console.log(
+    JSON.stringify(
+      await platformCommand(command, platform, positional[0], { plan: rest.includes("--plan") }),
+    ),
+  );
+}