edgeaegis 2026.10.1

package/rules/seclang-upstreams.json

@@ -0,0 +1,14 @@
+{
+  "version": 1,
+  "sources": [
+    {
+      "id": "owasp-crs",
+      "repository": "coreruleset/coreruleset",
+      "ref": "v4.30.0",
+      "commit": "e03a4f6dabc7a30ebd8c52c97d28a154f590a48f",
+      "rulesDirectory": "rules",
+      "setup": "crs-setup.conf.example",
+      "license": "LICENSE"
+    }
+  ]
+}

package/rules/setup.conf

@@ -0,0 +1,15 @@
+# Operator-owned behavior policy, loaded before upstream rules. Updaters never replace it.
+# Per engine/isolate: burst 120 requests, refill 20/s, ban 300s; 3 confirmed attacks/60s also ban.
+# All values/actions and exemptions remain controlled by the operator.
+SecAction "id:1000200,phase:1,pass,nolog,initcol:ip=%{REMOTE_ADDR}"
+Include emergency.conf
+SecRule IP:edgeshield_blocked "@eq 1" "id:1000201,phase:1,deny,status:403,log,msg:'Temporary behavior protection'"
+SecAction "id:1000202,phase:1,pass,nolog,deprecatevar:ip.edgeshield_rate=20/1,setvar:ip.edgeshield_rate=+1,expirevar:ip.edgeshield_rate=60"
+SecRule IP:edgeshield_rate "@gt 120" "id:1000203,phase:1,deny,status:403,log,msg:'Request burst protection',setvar:ip.edgeshield_blocked=1,expirevar:ip.edgeshield_blocked=300,setvar:!ip.edgeshield_attacks,setvar:!ip.edgeshield_rate"
+# Count once, after disrupted requests too; chained effects are applied only on their own match.
+SecAction "id:1000208,phase:5,pass,nolog,initcol:ip=%{REMOTE_ADDR}"
+SecRule TX:blocking_inbound_anomaly_score "@ge %{tx.inbound_anomaly_score_threshold}" "id:1000206,phase:5,pass,nolog,setvar:tx.edgeshield_attack=1"
+SecRule &IP:edgeshield_blocked "@eq 0" "id:1000204,phase:5,pass,nolog,chain"
+SecRule TX:edgeshield_attack "@eq 1" "setvar:ip.edgeshield_attacks=+1,expirevar:ip.edgeshield_attacks=60"
+SecRule &IP:edgeshield_blocked "@eq 0" "id:1000205,phase:5,pass,nolog,chain"
+SecRule IP:edgeshield_attacks "@ge 3" "setvar:ip.edgeshield_blocked=1,expirevar:ip.edgeshield_blocked=300,setvar:!ip.edgeshield_attacks,setvar:!ip.edgeshield_rate"

package/secret/credentials.example.yml

@@ -0,0 +1,7 @@
+# Copy to credentials.yml, or run npm run secret:init to create independent random tokens.
+# credentials.yml stays local and is excluded from Git and npm packages.
+originToken: ""
+# Optional client Bearer token for routes marked authenticated.
+# clientToken: ""
+# Required for signed transport metadata on Fetch-only cloud platforms.
+# ingressKey: ""

package/secret/relay-server.example.yml

@@ -0,0 +1,10 @@
+publicHost: relay.example
+listen:
+  host: 127.0.0.1
+  port: 8791
+privateKeyFile: relay/private.jwk
+authenticationKeyFile: relay/authentication.key
+credentialsFile: credentials.yml
+businessFile: ../origin/cloudflare/app/index.js
+stateFile: ../tools/.state/relay-replay.db
+maxBytes: 8388608

package/tools/.build/scr/adapters/cloudflare/runtime.d.ts

@@ -0,0 +1,18 @@
+import { type PortableOptions } from "../runtime.js";
+export declare function createCloudflareRuntime(options: PortableOptions): Promise<{
+    engine: {
+        handle: (request: Request, context: import("../../core/types.js").TrustedContext, rawTarget?: string, hooks?: {
+            event?: (event: import("../../core/types.js").SecurityEvent) => void;
+        }) => Promise<Response>;
+        version: string;
+        dispose(): void;
+        stats: {
+            requests: number;
+            ruleEvaluations: number;
+            blocked: number;
+            originRequests: number;
+            eventFailures: number;
+        };
+    };
+    handle(request: Request): Promise<Response>;
+}>;

package/tools/.build/scr/adapters/cloudflare/runtime.js

@@ -0,0 +1,16 @@
+import { createPortableRuntime } from "../runtime.js";
+export async function createCloudflareRuntime(options) {
+    const runtime = await createPortableRuntime(options);
+    return {
+        ...runtime,
+        handle(request) {
+            const protocol = request.cf?.httpProtocol;
+            const ip = request.headers.get("cf-connecting-ip");
+            return runtime.handle(request, {
+                ...(protocol ? { httpProtocol: protocol } : {}),
+                ...(ip ? { verifiedClientIp: ip } : {}),
+            });
+        },
+    };
+}
+//# sourceMappingURL=runtime.js.map

package/tools/.build/scr/adapters/cloudflare/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../../../scr/adapters/cloudflare/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAwB,MAAM,eAAe,CAAC;AAC5E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAwB;IACpE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,OAAO;QACV,MAAM,CAAC,OAAgB;YACrB,MAAM,QAAQ,GAAI,OAAwD,CAAC,EAAE,EAAE,YAAY,CAAC;YAC5F,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACnD,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE;gBAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/tools/.build/scr/adapters/cloudflare/worker.js

@@ -0,0 +1,25 @@
+import deployment from "edgeaegis:deployment";
+import originFetches from "edgeaegis:origin";
+import { INJECTION, PCRE2 } from "edgeaegis:wasm";
+import { createCloudflareRuntime } from "./runtime.js";
+const runtime = await createCloudflareRuntime({
+  ...deployment,
+  pcre2: PCRE2,
+  libinjection: INJECTION,
+  originFetches
+});
+var stdin_default = {
+  async fetch(request) {
+    try {
+      return runtime.handle(request);
+    } catch {
+      return Response.json(
+        { error: "shield_unavailable" },
+        { status: 503, headers: { "cache-control": "no-store" } }
+      );
+    }
+  }
+};
+export {
+  stdin_default as default
+};

package/tools/.build/scr/adapters/edgeone/worker.js

@@ -0,0 +1,7 @@
+import { handleCloudRequest } from "../handler.js";
+function onRequest(context) {
+  return handleCloudRequest(context.request);
+}
+export {
+  onRequest
+};

package/tools/.build/scr/adapters/esa/worker.js

@@ -0,0 +1,5 @@
+import { handleCloudRequest } from "../handler.js";
+var stdin_default = { fetch: handleCloudRequest };
+export {
+  stdin_default as default
+};

package/tools/.build/scr/adapters/forward.d.ts

@@ -0,0 +1,4 @@
+import type { Fetch } from "../core/types.js";
+import { type IngressMetadata } from "./ingress.js";
+/** Optional transport bridge for platforms whose Fetch API hides the wire protocol. */
+export declare function createIngressForwarder(endpoint: string, secret: string, transport?: Fetch): (request: Request, metadata: IngressMetadata) => Promise<Response>;

package/tools/.build/scr/adapters/forward.js

@@ -0,0 +1,25 @@
+import { signIngress } from "./ingress.js";
+/** Optional transport bridge for platforms whose Fetch API hides the wire protocol. */
+export function createIngressForwarder(endpoint, secret, transport = fetch) {
+    const destination = new URL(endpoint);
+    if (destination.protocol !== "https:" ||
+        destination.username ||
+        destination.password ||
+        destination.hash ||
+        destination.search ||
+        destination.pathname !== "/")
+        throw new Error("Ingress destination must be an exact HTTPS origin");
+    return async (request, metadata) => {
+        const original = new URL(request.url);
+        if (request.headers.get("host") !== original.host)
+            throw new Error("Ingress Host mismatch");
+        const target = new URL(original.pathname + original.search, destination);
+        const headers = new Headers(request.headers);
+        headers.set("host", target.host);
+        headers.delete("x-edgeshield-ingress");
+        const forwarded = new Request(target, new Request(request, { headers, redirect: "manual" }));
+        forwarded.headers.set("x-edgeshield-ingress", await signIngress(forwarded, { ...metadata, originalUrl: request.url }, secret));
+        return transport(forwarded);
+    };
+}
+//# sourceMappingURL=forward.js.map

package/tools/.build/scr/adapters/forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.js","sourceRoot":"","sources":["../../../../scr/adapters/forward.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,WAAW,EAAE,MAAM,cAAc,CAAC;AACjE,uFAAuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,MAAc,EAAE,SAAS,GAAU,KAAK;IAC/F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IACE,WAAW,CAAC,QAAQ,KAAK,QAAQ;QACjC,WAAW,CAAC,QAAQ;QACpB,WAAW,CAAC,QAAQ;QACpB,WAAW,CAAC,IAAI;QAChB,WAAW,CAAC,MAAM;QAClB,WAAW,CAAC,QAAQ,KAAK,GAAG;QAE5B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,OAAO,KAAK,EAAE,OAAgB,EAAE,QAAyB,EAAE,EAAE;QAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7F,SAAS,CAAC,OAAO,CAAC,GAAG,CACnB,sBAAsB,EACtB,MAAM,WAAW,CAAC,SAAS,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAChF,CAAC;QACF,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC"}

package/tools/.build/scr/adapters/handler.js

@@ -0,0 +1,39 @@
+import deployment from "edgeaegis:deployment";
+import originFetches from "edgeaegis:origin";
+import { INJECTION, PCRE2 } from "edgeaegis:wasm";
+import { verifyIngress } from "./ingress.js";
+import { createPortableRuntime } from "./runtime.js";
+let pending;
+async function handleCloudRequest(request) {
+  try {
+    if (!deployment.credentials.ingressKey)
+      throw new Error("Configure a trusted ingress signing key");
+    const metadata = await verifyIngress(request, deployment.credentials.ingressKey);
+    pending ??= createPortableRuntime({
+      ...deployment,
+      pcre2: PCRE2,
+      libinjection: INJECTION,
+      originFetches
+    });
+    const headers = new Headers(request.headers);
+    headers.delete("x-edgeshield-ingress");
+    if (metadata.originalUrl) headers.set("host", new URL(metadata.originalUrl).host);
+    const inspected = new Request(
+      metadata.originalUrl ?? request.url,
+      new Request(request, { headers })
+    );
+    return (await pending).handle(
+      inspected,
+      { httpProtocol: metadata.httpProtocol, verifiedClientIp: metadata.verifiedClientIp },
+      metadata.rawTarget
+    );
+  } catch {
+    return Response.json(
+      { error: "trusted_ingress_required" },
+      { status: 503, headers: { "cache-control": "no-store" } }
+    );
+  }
+}
+export {
+  handleCloudRequest
+};

package/tools/.build/scr/adapters/ingress.d.ts

@@ -0,0 +1,10 @@
+import type { TrustedContext } from "../core/types.js";
+export type IngressMetadata = Omit<TrustedContext, "tenant" | "identity"> & {
+    originalUrl?: string;
+    rawTarget?: string;
+};
+type Metadata = IngressMetadata;
+/** Sign at the trusted transport before forwarding to a Fetch-only cloud function. */
+export declare function signIngress(request: Request, metadata: Metadata, secret: string, at?: number): Promise<string>;
+export declare function verifyIngress(request: Request, secret: string, now?: number): Promise<Metadata>;
+export {};

package/tools/.build/scr/adapters/ingress.js

@@ -0,0 +1,62 @@
+import ipaddr from "ipaddr.js";
+import { stableJson } from "../core/types.js";
+const encoder = new TextEncoder();
+async function key(secret) {
+    if (!/^[\w-]{43,256}$/.test(secret))
+        throw new Error("Invalid ingress signing key");
+    return crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+}
+function message(request, metadata, at) {
+    return encoder.encode(stableJson({ method: request.method, url: request.url, metadata, at }));
+}
+function validate(value) {
+    if (!/^HTTP\/(?:1\.0|1\.1|2(?:\.0)?|3(?:\.0)?)$/.test(value.httpProtocol ?? "") ||
+        !value.verifiedClientIp ||
+        !ipaddr.isValid(value.verifiedClientIp) ||
+        Object.keys(value).some((k) => !["httpProtocol", "verifiedClientIp", "originalUrl", "rawTarget"].includes(k)))
+        throw new Error("Actual ingress protocol and IP are required");
+    if (value.originalUrl !== undefined) {
+        const url = new URL(value.originalUrl);
+        if (url.protocol !== "https:" ||
+            url.username ||
+            url.password ||
+            url.hash ||
+            value.originalUrl.length > 16384)
+            throw new Error("Invalid original URL");
+    }
+    if (value.rawTarget !== undefined &&
+        (typeof value.rawTarget !== "string" ||
+            value.rawTarget.length > 16384 ||
+            !value.rawTarget.startsWith("/") ||
+            /[\r\n]/.test(value.rawTarget)))
+        throw new Error("Invalid original request target");
+}
+/** Sign at the trusted transport before forwarding to a Fetch-only cloud function. */
+export async function signIngress(request, metadata, secret, at = Date.now()) {
+    validate(metadata);
+    const signature = new Uint8Array(await crypto.subtle.sign("HMAC", await key(secret), message(request, metadata, at)));
+    return JSON.stringify({
+        metadata,
+        at,
+        signature: Array.from(signature, (b) => b.toString(16).padStart(2, "0")).join(""),
+    });
+}
+export async function verifyIngress(request, secret, now = Date.now()) {
+    const header = request.headers.get("x-edgeshield-ingress");
+    if (!header || header.length > 2048)
+        throw new Error("Signed ingress metadata is required");
+    const packet = JSON.parse(header);
+    if (!packet ||
+        Object.keys(packet).some((k) => !["metadata", "at", "signature"].includes(k)) ||
+        !Number.isSafeInteger(packet.at) ||
+        Math.abs(now - packet.at) > 30000 ||
+        typeof packet.signature !== "string" ||
+        !/^[a-f\d]{64}$/.test(packet.signature))
+        throw new Error("Invalid ingress metadata");
+    validate(packet.metadata);
+    const signature = Uint8Array.from(packet.signature.match(/../g), (p) => Number.parseInt(p, 16));
+    if (!(await crypto.subtle.verify("HMAC", await key(secret), signature, message(request, packet.metadata, packet.at))))
+        throw new Error("Ingress signature mismatch");
+    return packet.metadata;
+}
+//# sourceMappingURL=ingress.js.map

package/tools/.build/scr/adapters/ingress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingress.js","sourceRoot":"","sources":["../../../../scr/adapters/ingress.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,WAAW,CAAC;AAE/B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAO9C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,KAAK,UAAU,GAAG,CAAC,MAAc;IAC/B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AACJ,CAAC;AACD,SAAS,OAAO,CAAC,OAAgB,EAAE,QAAkB,EAAE,EAAU;IAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAChG,CAAC;AACD,SAAS,QAAQ,CAAC,KAAe;IAC/B,IACE,CAAC,2CAA2C,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;QAC3E,CAAC,KAAK,CAAC,gBAAgB;QACvB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CACrF;QAED,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,IAAI;YACR,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,KAAK;YAEhC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC5C,CAAC;IACD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YAClC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,KAAK;YAC9B,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEjC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACvD,CAAC;AACD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,QAAkB,EAClB,MAAc,EACd,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;IAEf,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnB,MAAM,SAAS,GAAG,IAAI,UAAU,CAC9B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CACpF,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ;QACR,EAAE;QACF,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;KAClF,CAAC,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,MAAc,EACd,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,IACE,CAAC,MAAM;QACP,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK;QACjC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAEvC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CACjF,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CACvB,CAAC;IACF,IACE,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC1B,MAAM,EACN,MAAM,GAAG,CAAC,MAAM,CAAC,EACjB,SAAS,EACT,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAC7C,CAAC;QAEF,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC"}

package/tools/.build/scr/adapters/netlify/worker.js

@@ -0,0 +1,7 @@
+import { handleCloudRequest } from "../handler.js";
+var stdin_default = handleCloudRequest;
+const config = { path: "/*" };
+export {
+  config,
+  stdin_default as default
+};

package/tools/.build/scr/adapters/runtime.d.ts

@@ -0,0 +1,33 @@
+import type { DeploymentConfig, ProjectCredentials } from "../config.js";
+import { type Fetch, type TrustedContext } from "../core/types.js";
+import type { ErrorPages } from "../runtime/error-pages.js";
+import { type AllowlistEntry } from "../runtime/index.js";
+export interface PortableOptions {
+    config: DeploymentConfig;
+    credentials: ProjectCredentials;
+    source: string;
+    files: Record<string, string>;
+    pcre2: WebAssembly.Module | BufferSource;
+    libinjection: WebAssembly.Module | BufferSource;
+    allowlist: AllowlistEntry[];
+    errorPages?: ErrorPages;
+    originFetches: Record<string, Fetch>;
+}
+/** Every deployment uses this compiler, byte parser, transaction and response inspector. */
+export declare function createPortableRuntime(options: PortableOptions): Promise<{
+    engine: {
+        handle: (request: Request, context: TrustedContext, rawTarget?: string, hooks?: {
+            event?: (event: import("../core/types.js").SecurityEvent) => void;
+        }) => Promise<Response>;
+        version: string;
+        dispose(): void;
+        stats: {
+            requests: number;
+            ruleEvaluations: number;
+            blocked: number;
+            originRequests: number;
+            eventFailures: number;
+        };
+    };
+    handle(request: Request, transport: Omit<TrustedContext, "tenant">, rawTarget?: string): Promise<Response>;
+}>;

package/tools/.build/scr/adapters/runtime.js

@@ -0,0 +1,50 @@
+import { digest } from "../core/types.js";
+import { createShield } from "../runtime/index.js";
+import { createInjectionDetectors, createPCRE2Backend } from "../seclang/index.js";
+/** Every deployment uses this compiler, byte parser, transaction and response inspector. */
+export async function createPortableRuntime(options) {
+    const engine = await createShield({
+        tenant: options.config.tenant,
+        service: options.config.service,
+        publicHosts: options.config.publicHosts,
+        routes: options.config.routes,
+        secLang: options.source,
+        secLangOptions: {
+            files: options.files,
+            regexBackend: await createPCRE2Backend(options.pcre2),
+            detectors: await createInjectionDetectors(options.libinjection),
+        },
+        allowlist: options.allowlist,
+        ...(options.errorPages ? { errorPages: options.errorPages } : {}),
+        ...(options.config.limits ? { limits: options.config.limits } : {}),
+        ...(options.config.maxConcurrentRequests
+            ? { maxConcurrentRequests: options.config.maxConcurrentRequests }
+            : {}),
+        origins: Object.fromEntries(Object.entries(options.config.origins).map(([name, origin]) => {
+            const fetch = options.originFetches[name];
+            if (!fetch)
+                throw new Error("Missing business transport");
+            return [name, { ...origin, originToken: options.credentials.originToken, fetch }];
+        })),
+    });
+    const clientHash = options.credentials.clientToken
+        ? await digest(options.credentials.clientToken)
+        : undefined;
+    return {
+        engine,
+        async handle(request, transport, rawTarget) {
+            // Headers are never promoted to identity by the shared engine.
+            const token = request.headers.get("authorization");
+            const identity = clientHash && token?.startsWith("Bearer ") && (await digest(token.slice(7))) === clientHash
+                ? "configured-api-client"
+                : undefined;
+            const context = {
+                ...transport,
+                tenant: options.config.tenant,
+                ...(identity ? { identity } : {}),
+            };
+            return engine.handle(request, context, rawTarget);
+        },
+    };
+}
+//# sourceMappingURL=runtime.js.map

package/tools/.build/scr/adapters/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../../scr/adapters/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAmC,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAAuB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAanF,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAwB;IAClE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;QAC7B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;QAC/B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW;QACvC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;QAC7B,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,cAAc,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,MAAM,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC;YACrD,SAAS,EAAE,MAAM,wBAAwB,CAAC,OAAO,CAAC,YAAY,CAAC;SAChE;QACD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB;YACtC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;YAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC,CAAC,CACH;KACF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,WAAW;QAChD,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,MAAM;QACN,KAAK,CAAC,MAAM,CAAC,OAAgB,EAAE,SAAyC,EAAE,SAAkB;YAC1F,+DAA+D;YAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACnD,MAAM,QAAQ,GACZ,UAAU,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU;gBACzF,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,OAAO,GAAG;gBACd,GAAG,SAAS;gBACZ,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;gBAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClC,CAAC;YACF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/tools/.build/scr/adapters/vercel/worker.js

@@ -0,0 +1,7 @@
+import { handleCloudRequest } from "../handler.js";
+const runtime = "nodejs";
+var stdin_default = { fetch: handleCloudRequest };
+export {
+  stdin_default as default,
+  runtime
+};

package/tools/.build/scr/cli/config.d.ts

@@ -0,0 +1,2 @@
+export declare function readData(path: string, limit?: number): Promise<unknown>;
+export declare function readCredentials(path: string): Promise<import("../config.js").ProjectCredentials>;

package/tools/.build/scr/cli/config.js

@@ -0,0 +1,23 @@
+import { open } from "node:fs/promises";
+import { parseConfigText, validateCredentials } from "../config.js";
+export async function readData(path, limit = 8_000_000) {
+    const file = await open(path, "r");
+    try {
+        const chunks = [];
+        let length = 0;
+        for await (const chunk of file.createReadStream({ autoClose: false, highWaterMark: 65536 })) {
+            length += chunk.length;
+            if (length > limit)
+                throw new Error("Configuration input exceeds byte limit");
+            chunks.push(chunk);
+        }
+        return parseConfigText(Buffer.concat(chunks, length).toString("utf8"));
+    }
+    finally {
+        await file.close();
+    }
+}
+export async function readCredentials(path) {
+    return validateCredentials(await readData(path, 16384));
+}
+//# sourceMappingURL=config.js.map

package/tools/.build/scr/cli/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../scr/cli/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACpE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,KAAK,GAAG,SAAS;IAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACvB,IAAI,MAAM,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC9E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,OAAO,mBAAmB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/tools/.build/scr/cli/deployment.d.ts

@@ -0,0 +1,15 @@
+import { type DeploymentConfig } from "../config.js";
+import type { BusinessFunction, OriginSettings, PlatformName } from "../origin/types.js";
+export declare function readDeployment(path: string, platform?: PlatformName): Promise<{
+    config: DeploymentConfig;
+    businesses: Record<string, {
+        settings: OriginSettings;
+        originFile: string;
+        businessFile: string;
+    }>;
+    originRoot: string;
+    platformRoot: string;
+}>;
+export declare function readBusinessFunction(path: string): Promise<BusinessFunction>;
+export { readCredentials, readData } from "./config.js";
+export { readResponsePages } from "./responses.js";

package/tools/.build/scr/cli/deployment.js

@@ -0,0 +1,108 @@
+import { realpath } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { validateDeploymentConfig } from "../config.js";
+import { readData } from "./config.js";
+export async function readDeployment(path, platform) {
+    const directory = dirname(resolve(path));
+    const input = (await readData(path));
+    platform ??= input.platform;
+    if (!["cloudflare", "vercel", "netlify", "esa", "edgeone"].includes(platform))
+        throw new Error("Select a cloud platform for the business origins");
+    if (typeof input.originDirectory !== "string" || Object.hasOwn(input, "origins"))
+        throw new Error("Business origins must be configured in origin/<platform>/<business>/config.yml");
+    if (!Array.isArray(input.routes) || !input.routes.length)
+        throw new Error("At least one business route is required");
+    const names = [
+        ...new Set(input.routes.map((route) => {
+            if (!route ||
+                typeof route.business !== "string" ||
+                !/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(route.business))
+                throw new Error("Every route must select a valid business name");
+            return route.business;
+        })),
+    ];
+    const originRoot = await realpath(resolve(directory, input.originDirectory));
+    const platformRoot = await realpath(resolve(originRoot, platform));
+    if (relative(originRoot, platformRoot) !== platform)
+        throw new Error("Cross-platform origin path is forbidden");
+    const businesses = Object.create(null);
+    const origins = Object.create(null);
+    for (const name of names) {
+        const businessRoot = await realpath(resolve(platformRoot, name));
+        if (relative(platformRoot, businessRoot) !== name)
+            throw new Error("Business directory must remain within its platform");
+        const originFile = await realpath(resolve(businessRoot, "config.yml"));
+        if (dirname(originFile) !== businessRoot)
+            throw new Error("Origin config must remain in its business directory");
+        const settings = (await readData(originFile, 65536));
+        if (!settings ||
+            settings.platform !== platform ||
+            !["function", "relay", "proxy"].includes(settings.mode))
+            throw new Error("Origin platform or mode mismatch");
+        const keys = settings.mode === "proxy"
+            ? ["platform", "mode", "url"]
+            : settings.mode === "relay"
+                ? ["platform", "mode", "endpoint", "publicKeyFile", "authenticationKeyFile"]
+                : ["platform", "mode"];
+        if (Object.keys(settings).some((key) => !keys.includes(key)))
+            throw new Error("Unknown business origin option");
+        let origin = `https://${name.toLowerCase()}.origin.internal`;
+        let businessFile = resolve(businessRoot, "index.js");
+        if (settings.mode === "function") {
+            businessFile = await realpath(businessFile);
+            if (dirname(businessFile) !== businessRoot)
+                throw new Error("Business entry must remain in its business directory");
+        }
+        if (settings.mode === "proxy") {
+            const url = new URL(settings.url);
+            if (url.protocol !== "https:" ||
+                url.username ||
+                url.password ||
+                url.pathname !== "/" ||
+                url.search ||
+                url.hash)
+                throw new Error("Proxy origin must be an exact HTTPS origin (IP, hostname or CNAME)");
+            origin = url.origin;
+        }
+        if (settings.mode === "relay") {
+            const endpoint = new URL(settings.endpoint);
+            if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.hash)
+                throw new Error("Relay endpoint must use HTTPS without credentials or fragments");
+            const secretRoot = await realpath(resolve(directory, "secret"));
+            for (const field of ["publicKeyFile", "authenticationKeyFile"]) {
+                if (typeof settings[field] !== "string")
+                    throw new Error("Relay key file is required");
+                const file = await realpath(resolve(businessRoot, settings[field]));
+                const rel = relative(secretRoot, file);
+                if (rel.startsWith("..") || isAbsolute(rel))
+                    throw new Error("Relay keys must reside in the project secret directory");
+                settings[field] = file;
+            }
+        }
+        businesses[name] = { settings, originFile, businessFile };
+        origins[name] = { origin, allowedOrigins: [origin] };
+    }
+    const config = validateDeploymentConfig({ ...input, platform, origins });
+    config.secLangFile = resolve(directory, config.secLangFile);
+    if (config.localRulesFile)
+        config.localRulesFile = resolve(directory, config.localRulesFile);
+    if (config.setupRulesFile)
+        config.setupRulesFile = resolve(directory, config.setupRulesFile);
+    config.secretFile = resolve(directory, config.secretFile);
+    if (config.allowlistFile)
+        config.allowlistFile = resolve(directory, config.allowlistFile);
+    if (config.responses)
+        config.responses.directory = resolve(directory, config.responses.directory);
+    return { config, businesses, originRoot, platformRoot };
+}
+export async function readBusinessFunction(path) {
+    const module = await import(pathToFileURL(path).href);
+    const business = module.default;
+    if (!business || typeof business.fetch !== "function")
+        throw new Error("Business origin must export a fetch function");
+    return business;
+}
+export { readCredentials, readData } from "./config.js";
+export { readResponsePages } from "./responses.js";
+//# sourceMappingURL=deployment.js.map

package/tools/.build/scr/cli/deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.js","sourceRoot":"","sources":["../../../../scr/cli/deployment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAyB,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAE/E,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,QAAuB;IACxE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAA4B,CAAC;IAChE,QAAQ,KAAK,KAAK,CAAC,QAAwB,CAAC;IAC5C,IAAI,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC;QAC9E,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;IACJ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM;QACtD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,GAAG,CACR,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACzB,IACE,CAAC,KAAK;gBACN,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAClC,CAAC,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAExD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC,QAAkB,CAAC;QAClC,CAAC,CAAC,CACH;KACF,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,KAAK,QAAQ;QACjD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,MAAM,UAAU,GAGZ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,OAAO,GAAgC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,KAAK,IAAI;YAC/C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,YAAY;YACtC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,CAAmB,CAAC;QACvE,IACE,CAAC,QAAQ;YACT,QAAQ,CAAC,QAAQ,KAAK,QAAQ;YAC9B,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YAEvD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,MAAM,IAAI,GACR,QAAQ,CAAC,IAAI,KAAK,OAAO;YACvB,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC;YAC7B,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;gBACzB,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,uBAAuB,CAAC;gBAC5E,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,IAAI,MAAM,GAAG,WAAW,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC;QAC7D,IAAI,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACjC,YAAY,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,YAAY;gBACxC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClC,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBACzB,GAAG,CAAC,QAAQ;gBACZ,GAAG,CAAC,QAAQ;gBACZ,GAAG,CAAC,QAAQ,KAAK,GAAG;gBACpB,GAAG,CAAC,MAAM;gBACV,GAAG,CAAC,IAAI;gBAER,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACxF,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI;gBAC3F,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACpF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YAChE,KAAK,MAAM,KAAK,IAAI,CAAC,eAAe,EAAE,uBAAuB,CAAU,EAAE,CAAC;gBACxE,IAAI,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBACvF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACvC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;oBACzC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;gBAC5E,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YACzB,CAAC;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACzE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,cAAc;QAAE,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,cAAc;QAAE,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC7F,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,aAAa;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,SAAS;QAAE,MAAM,CAAC,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAClG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AAC1D,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC;IAChC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,UAAU;QACnD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}

package/tools/.build/scr/cli/init.d.ts

@@ -0,0 +1,2 @@
+/** Materialize operator files outside node_modules; existing files are never overwritten. */
+export declare function initProject(target: string): Promise<void>;